Hacker News Reader

Comment by bascule | Hacker News Reader

Schneier has been giving some pretty weird advice lately. This is probably the weirdest thing I've seen from him:

"Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can."

There are plenty of ECC systems that have virtually no chance of NSA influence. Curve25519/Ed25519 come to mind.

View on HN

Schneier told people to use Tor to avoid the NSA[0]. Telling people to use Tor when Tor offers almost no anonymity guarantees against a global passive adversary (which the NSA almost certainly is), is not good advice at all. In fact, it's actively harmful since it both gives people a false sense of security and instructs the to wave a giant red flag saying I HAVE SOMETHING TO HIDE.

[0] http://www.theguardian.com/world/2013/sep/05/nsa-how-to-rema...

I noticed this as well.

A big single public voice with a public reputation profile is not trustworthy if you ask me.

If everyone used Tor they wouldn't stand out individually, and I think it's fair to assume Schneier offered his suggestions in that sense.

But there is still the problem that it offers no anonymity against the NSA and he is suggesting that it does.

I find his advice to be spot on and I see proof of it every day. People still use 'Password1' as the key to their AES-256 bit encrypted file system.

You don't have to be a mathematician to attack AES-256, you just need to know humans and do some password analysis.

But what does that have to do with the relative security of DLP vs EC?

Agree. The notion that they can break ECC but not RSA

1) means they're suggesting insecure algos for protecting top-secret data and know it

2) doesn't fit with the hints that maybe lots of traffic is being decrypted through some mathematical breakthrough[1], because for that you'd want to break RSA, not ECC

3) just seems odd, since knowing only the public attacks, a) RSA often has the narrowest security margin of any link in the chain in deplaoyed systems (e.g., RSA using a 1024-bit key thought to be worth ~80 bits vs. the symmetric algo using 128/256-bit keys) and b) RSA attacks, and not ECC attacks, have slowly gotten better.

[1] Not sure I believe those hints, but let's roll with the assumption.

I truly don't understand why the suggestion isn't encrypt it both ways (or, more generally, many different, layered encryption schemes).

In theory, that would work. In practice, you need to be careful, because you can screw up.

Encrypting twice is not guaranteed to not make the end result easier to attack than either of the two single methods.

Right, but that is the point. If you think that the NSA has some magic machine that might break one of the common encryption schemes, but you don't know which, then pick five different encryption schemes. A layered encryption scheme is only as weak as its strongest layer.

My comment was a bit hard to read. Layered encryption is not guaranteed to be only as weak as its strongest layer. It's possible for layering to enable side-channel attacks.

Encryption is hard :(

Reply on news.ycombinator.com