Hacker News Reader

Comment by ranger_danger | Hacker News Reader

Is it really fair to call these such algorithms "security through obscurity"?

By that logic, wouldn't real symmetric crypto also be considered the same, since it's still just math that similarly swaps the data with other bytes, based on an "obscured" password or key?

View on HN

The obscured part was pretending the unlocker needs external information

I guess they could have done a public/private key pair in 1996, but doing that over a phone call was going to be painful. A simple password read over the phone and verified by the software was the best solution at the time.

Mind, this was also intended for a world where internet connectivity was not to be expected. The majority of PC owners were not online.

Which is true, so the distribution of the software cracker would have been fairly limited I would have thought.

Sneakernet was common also. Say you have a class of 30 kids, and one of them has access to Usenet to grab qcrack.zip. He'll put it on a floppy disk and share ;)

Hells yeah qcrack.zip

yeah, software travelled exactly the same way as rumours that such and such had a rib removed - remarkably effectively.

Also the same way we got viruses, long before anyone I knew had the Internet.

Haha, I remember that rumour being told to me by classmates back in the day. Great example.

I was 12 years old and had qcrack on a floppy from a buddy. Everyone had it. Didn't even have to have internet.

BBS, zmodem

How would your scheme work? You use RSA to encrypt the entire thing? Or you use it to get a key for a block cipher and then use that?

I feel like either way, you'd need the key to be different for every CD, otherwise you could just share the shared key. But if the encryption of every CD is different, why not just share the block cipher key directly? They can have a list of CDs and the associated key(s).

What additional security or functionality does an RSA like step add here?

If I ask you to pass on a message from me to someone else, and the message is encrypted using a symmetric key known to me, and to the recipient, but not to you, there's no security-by-obscurity in place.

If I ask you to pass on a message to someone, and the message is encrypted using a symmetric key known only to me, and I expect the recipient to be able to decrypt it because he knows that the key is written on the back of the paper, that's security by obscurity. You're just as able to do the decryption as the intended recipient is; I'm just hoping that you won't realize that.

But all parties are able to bruteforce the key, it's still just math, still obscured. The only difference is how complicated the math is, and how long the attack takes.

Changing from a simpler substitution algorithm to a "real" crypto cipher IMO is still just as symmetrical, and still technically obscurity, only more complicated this time.

> But all parties are able to bruteforce the key

This isn't true, and you should be well aware of that.

I think it is fair, as all the released CDs are identical. So all the symmetric keys used to encrypt the data are also necessarily identical.

I think you right, however they left all the right clues to decrypt it in days. You really don't want to do that.

Reply on news.ycombinator.com