Riverside killing off encrypted media radio access

[Outerdog]

They did not say, nor did I that the method forces the channel into clear. It just bars the users from passing encrypted voice. The users must then use a clear mode to communicate or not communicate at all.

I did not say that you said it forces the channel into the clear. You've moved the goalpost just a bit. You said:

... can be selectively jammed and the users would be forced to use clear mode.

I simply wanted to be clear that the attack does not force anything. The attacks, when successful, merely prevents certain modes of operation and does not force anyone to do anything.

The report also indicates that the end user would have difficulty detecting the attack and then suggests that they would be forced to use clear traffic. I'm not sure how they would make that connection if the exploit is difficult to detect. Besides, in most cases when deployed, encryption is strapped (recommended as a stop-gap in the report), wouldn't you agree?

I think we're saying the same thing...

 

[Hans13]

I did not say that you said it forces the channel into the clear. You've moved the goalpost just a bit.

I simply wanted to be clear that the attack does not force anything. The attacks, when successful, merely prevents certain modes of operation and does not force anyone to do anything.

You stated, "There is no mention of users being "forced" into running in the clear. "
The report you linked literally stated, " (thereby forcing the users to disable encryption)".

The report also indicates that the end user would have difficulty detecting the attack and then suggests that they would be forced to use clear traffic. I'm not sure how they would make that connection if the exploit is difficult to detect. Besides, in most cases when deployed, encryption is strapped (recommended as a stop-gap in the report), wouldn't you agree?

The title of the article is, in part, "Why (Special) Agent Johnny (Still) Can't Encrypt". When their communications don't go through, they naturally switch to be in the clear. They don't have to know why encryption isn't working, only that it isn't for some reason. The net result is that the user gets forced to communicate in the clear.

I think we're saying the same thing...

Yes, you are.

 

[allend]

Okay. I am popping some popcorn. Be back for more of this show.

 

[RFI-EMI-GUY]

Thank you Hans13..

Sent from my SM-T350 using Tapatalk

 

[Hans13]

Thank you Hans13..

I got ya.

 

[RFI-EMI-GUY]

I'd really hate to have to shoot my toaster; it makes good toast! That is, after all, its purpose in life. Sadly, even kitchen appliances will one day be encrypted. On that day, my toaster and I will have to re-enact a scene from "Old Yeller." Only one of us will be leaving the corn crib.

It is getting to that point. Today Google is being grilled by Congress for tracking our every movement using devices.

https://youtu.be/N9wsjroVlu8

Sent from my SM-T350 using Tapatalk

 

[allend]

Dont worry about Google or anybody else. Just take matters in your own hands to secure your own path. If you do not want tracking buy a car without GPS. Do not text message, do not email, or carry a cell phone. But if you have to use this enterprise solution. Government agencies use this technology when traveling aboard so other countries do not know they are present.

When firefighters are fighting fires they fight fire with fire. They set back fires to meet up with the ragging fire to put out the fire. Catch my drift. This is what the public needs to know and be aware of moving forward with life.

https://www.silentcircle.com/products-and-solutions/silent-phone/

 

[Hans13]

Dont worry about Google or anybody else. Just take matters in your own hands to secure your own path. If you do not want tracking buy a car without GPS. Do not text message, do not email, or carry a cell phone. But if you have to use this enterprise solution. Government agencies use this technology when traveling aboard so other countries do not know they are present

https://www.silentcircle.com/products-and-solutions/silent-phone/

Activists already use this strategy. Many of them tend to be hardware and software developers with knowledge and quite a bit of $$. I've used some of the tech when involved and some of it is not anywhere to be found on the clear web. You have to know someone and be trusted to even know it exists.

 

[slicerwizard]

That's what they said about DES 56.

So you have nothing...

Anyway, the NSA probably inserted a backdoor, so in the end it won't be brute force that compromizes it.

The NSA didn't design AES. How can you have such a fundamental misunderstanding?

They did not say, nor did I that the method forces the channel into clear. It just bars the users from passing encrypted voice. The users must then use a clear mode to communicate or not communicate at all.

Groups are typically strapped secure only, so not an issue for any well run department. It's like driving with the hood up and crashing into something and then claiming that the car is stupid and "vulnerable"...

So "that's what they said" and "probably" and "the stupid radio shop made the system stupid by allowing clear traffic". That's all that any of you have regarding cracking AES?

Still waiting for anything concrete about how AES256 is going to be cracked. And if you manage to social engineer or steal a key, that's not cracking AES, despite what Hansie wants to claim. Might as well steal a radio and yell "I cracked AES!!!11!"

 

[Hans13]

despite what Hansie wants to claim.

I claimed nothing of the sort.

Stay classy, my friend.

 

[RFI-EMI-GUY]

So you have nothing...


The NSA didn't design AES. How can you have such a fundamental misunderstanding?



Groups are typically strapped secure only, so not an issue for any well run department. It's like driving with the hood up and crashing into something and then claiming that the car is stupid and "vulnerable"...

So "that's what they said" and "probably" and "the stupid radio shop made the system stupid by allowing clear traffic". That's all that any of you have regarding cracking AES?

Still waiting for anything concrete about how AES256 is going to be cracked. And if you manage to social engineer or steal a key, that's not cracking AES, despite what Hansie wants to claim. Might as well steal a radio and yell "I cracked AES!!!11!"

I will leave this right here.

https://www.schneier.com/blog/archives/2008/01/nsa_backdoors_i.html

And this..

https://www.schneier.com/blog/archives/2006/06/greek_wiretappi_1.html

Sent from my SM-T350 using Tapatalk

 

[Outerdog]

I will leave this right here.

https://www.schneier.com/blog/archives/2008/01/nsa_backdoors_i.html

And this..

https://www.schneier.com/blog/archives/2006/06/greek_wiretappi_1.html

For those like me who aren't as enlightened as you, can you explain what these two blog entries do to further the possibility of cracking AES?

I mean just dropping two decade-old blog entries without any context doesn't tell us dummies very much.

 

[krazybob]

Why such drama and outright sarcasm? This is supposed to be an intellectual discussion of encryption and not comments pointed directly at an individual.

The NSA does not need to have developed aes-256 to find a back door. They're the experts at finding back doors of foreign entities and getting into their systems and it only makes sense that they've already cracked AES 256. When you take it to the extreme and consider that drug cartels are likely using this technology that they have obtained unlawfully the NSA of course is motivated to find a way in. If the NSA can find the camera inside of my flat screen LED TV that I can't even find in the microphone I'm sure they can find a back door into AES 256.

 

[RFI-EMI-GUY]

For those like me who aren't as enlightened as you, can you explain what these two blog entries do to further the possibility of cracking AES?

I mean just dropping two decade-old blog entries without any context doesn't tell us dummies very much.

The NSA has for decades, embedded back doors into communications systems and encryption algorithms. They do it by infiltrating the companies who make the technology. It is no different than a corporation hiring a PI firm to plant employees in their company to weed out union sympathizers. But in this case, it is the NSA who recruits engineers and technicians within the industry and they work covertly at the firms making the tech.

Why wait until the product is completed to "social engineer a key" when you can social engineer a back door into the product during development.

For those who remember, the NSA is the one who approves commercial crypto for the government and for export. They really got peaved back when PGP encryption was developed independently and wanted it shut down. To think they have nothing to do with inner workings of AES is extremely naive.





Sent from my SM-T350 using Tapatalk

 

[allend]

I use to work for a tech company that bought this company in New Zealand. Now the reason we bought them was Endace since they were an off shore company they could not sell the technology to US based companies because they were offshore and could not sell to the Military or to the CIA or NSA. So in order to sell this product we bought them and sold this hardware device.

https://www.endace.com/

So this hardware device is a network packet sniffer. You attach this hardware appliance to any internal computer network and it can sniff each packet on the network and decode each packet in to plain text.

 

[RFI-EMI-GUY]

I use to work for a tech company that bought this company in New Zealand. Now the reason we bought them was Endace since they were an off shore company they could not sell the technology to US based companies because they were offshore and could not sell to the Military or to the CIA or NSA. So in order to sell this product we bought them and sold this hardware device.

https://www.endace.com/

So this hardware device is a network packet sniffer. You attach this hardware appliance to any internal computer network and it can sniff each packet on the network and decode each packet in to plain text.

There is absolutely no privacy on the internet. It can all be recorded and studied and decrypted at a later time when it it is either technically feasible to decrypt or it becomes important enough to spend money to fund a decryption effort.

The Silent Circle product mentioned a few posts above would concern me. I would think that the resulting network traffic would be a target for state sponsored eavesdropping. The traffic, no matter how brief, can be captured and stored for later analysis. A Canadian company selling a similar product was shut down this past year by the USDOJ who claimed that the Mexican Cartel used their phones. Maybe so, but others were certainly affected by the shutdown.

If you want secure communications, use simplex radio. Encrypt it and change channels hourly. Yes the entire band can be recorded as well. But they have to be in proximity of the signal.

 

[krazybob]

If you want secure communications, use simplex radio. Encrypt it and change channels hourly. Yes the entire band can be recorded as well. But they have to be in proximity of the signal.

We already have secure Communications in the military. They use spread spectrum multiband technology. Good luck to decoding that unless you have the key. But therein lies the rub. Technology used to get the key Although our military communications remain secure to some extent. But even though they are using secure communications when orders are sent they have a cipher key that must match on both sides. If it doesn't it is assumed to be fake. That's different than real time dispatch.

I don't know how you can say to use simplex and encrypt it and change channels hourly. If the key is compromised so are your simplex.

Do you remember the mass killings and roving terrorists in San Bernardino California? The man had an iPhone and Apple refused to provide assistance decrypting the phone. They said it was impossible and would destroy the content. Our anti-terrorist folks paid a man $1,000,000 and almost instantly he decrypted the key.

I'll bet if we came up with a million dollars he would decrypt AES256 and provide the software that would allow us to intercept it OTR and grab the key.

As the owner of a hosting company that uses his own Hardware that includes firewalls and switches I can tell you that my own network is not secure. If somebody wants in there going to get in. I am not deluded in thinking because I know that if Yahoo can be broken into, so can I. If Citibank can be broken into, so can I. But why break in? Some do it just to prove that they can do it while others do it so that they may harness to computing power of thousands or hundreds of thousands of computers at any given time. This is how complex keys are easily hacked.

When you think of it this way understand that the computers on the Space Shuttle are 8088 processors. The Originals going all the way back to the IBM or the Tandy that first hit the market. One computer performs one function only on the Space Shuttle. Even though today's computing power can fit into a watch, they don't trust it to one computer.

I will end with this. 5G processing. As mobile devices and smartphones continue to advance so does their speed. I use my cell phone more than I use my desktop now.

Sent from my SM-G965U using Tapatalk

 

[RFI-EMI-GUY]

Dont worry about Google or anybody else. Just take matters in your own hands to secure your own path. If you do not want tracking buy a car without GPS. Do not text message, do not email, or carry a cell phone. But if you have to use this enterprise solution. Government agencies use this technology when traveling aboard so other countries do not know they are present.

When firefighters are fighting fires they fight fire with fire. They set back fires to meet up with the ragging fire to put out the fire. Catch my drift. This is what the public needs to know and be aware of moving forward with life.

https://www.silentcircle.com/products-and-solutions/silent-phone/

Have you read the "privacy" policy? They collect everything and sell everything. Maybe your voice and text are encrypted and destroyed, maybe?. But your very existence and behavior as a subscriber to the service is retained and sold.

No thanks...

https://www.silentcircle.com/privacy-policy/

Sent from my SM-T350 using Tapatalk

 

[Outerdog]

The NSA has for decades, embedded back doors into communications systems and encryption algorithms. They do it by infiltrating the companies who make the technology. It is no different than a corporation hiring a PI firm to plant employees in their company to weed out union sympathizers. But in this case, it is the NSA who recruits engineers and technicians within the industry and they work covertly at the firms making the tech.

Why wait until the product is completed to "social engineer a key" when you can social engineer a back door into the product during development.

For those who remember, the NSA is the one who approves commercial crypto for the government and for export. They really got peaved back when PGP encryption was developed independently and wanted it shut down. To think they have nothing to do with inner workings of AES is extremely naive.

So the two decade-old blog entries actually do nothing to support AES 256 being cracked.

Got it.

 

[Hans13]

Why such drama and outright sarcasm? This is supposed to be an intellectual discussion of encryption and not comments pointed directly at an individual.

I was wondering the same thing. Hopefully, there can be a perspective shift in this thread and we can all focus on the discussion instead of barbs at individuals.

As to the intellectual part, I'm not making any guarantees on my end. Some of what I post will appear quite dense, I assure you.