CIA Director John Brennan Pretends Foreign Cryptography Doesn't Exist

Re:CIA Director John Brennan Pretends Foreign Cryptography D... by cschmidt on Tuesday June 21, 2016 @10:24AM (#11945801)

Schneier made an interesting point at his talk at DEFCON last year. He suggested people use encryption from the big players, rather than more niche crypto products. He said he thought the NSA etc. monitor users of those niche software closely, essentially getting lots of metadata about them. He suggested "hiding" in the mass of other people using big player products.

Maybe the NSA wants terrorists to switch, since it would make them stand out from the crowd, creating a much smaller pool of people (terrorists and crypto geeks) to watch.

[ Parent | on HN ]

Re:CIA Director John Brennan Pretends Foreign Cryptography D... by Johnny555 on Tuesday June 21, 2016 @11:40AM (#11946493)

Sounds like the best solution is to use the niche encryption software to encrypt your data, then wrap it up in encryption by the big players, so you keep your everyday activity under wraps, but if they can break the big-player encryption, you have another layer of protection.

[ Parent | on HN ]

Re:CIA Director John Brennan Pretends Foreign Cryptography D... by chatmasta on Tuesday June 21, 2016 @12:11PM (#11946765)

The best solution is probably to communicate via encrypted stetanography in open channels. For example a Twitter account posting a bunch of cat pics with (encrypted) messages encoded in them. This way your first layer of protection is the steganography (nobody knows the message even exists), and the second layer is the encryption.

I've got a side project about 10% complete that's a "stegonographic social overlay network". Fully client side JS steganographic encoding of images that are then uploaded to a choice of social media sites, and then subscribed to like RSS feeds. I think it's a cool concept.

[ Parent | on HN ]

Re:CIA Director John Brennan Pretends Foreign Cryptography D... by deelowe on Tuesday June 21, 2016 @01:13PM (#11947382)

Maybe, but how hard is it to derive suspension of stenography in an image for some useful level of confidence (e.g 20%, 50%, 75%)? Not crack it, but know that there's perhaps something up?

Surely, just knowing which accounts are posting "suspicious" communications is valuable enough in and of itself.

[ Parent | on HN ]

Re:CIA Director John Brennan Pretends Foreign Cryptography D... by poizan42 on Tuesday June 21, 2016 @01:32PM (#11947575)

Every picture contains some amount of noise. It should at least in theory be equivalent to the Halting problem to decide whether this noise was generated by an algorithm or truly random.

But there's a lot of practical issues here. If you just add noise then it may raise suspicion merely by there being more noise than expected. So you may need to "move the existing noise around" or remove the existing noise which gets more problematic to do without leaving artifacts. And of course most of the noise may actually be following some patterns that means that the added/substituted noise must also correctly follow as not not raise suspicion.

[ Parent | on HN ]

Re:CIA Director John Brennan Pretends Foreign Cryptography D... by Natanael_L on Tuesday June 21, 2016 @06:53PM (#11950119)

Couldn't you in theory solve it by using high quality originals and manipulate the compression algorithm to introduce controlled noise that then decodes to your message? That way you can make the noise look more natural than with approaches like modifying existing compressed files.

[ Parent | on HN ]

Re:CIA Director John Brennan Pretends Foreign Cryptography D... by deelowe on Tuesday June 21, 2016 @04:48PM (#11949279)

Exactly. I don't know enough about the topic personally, but I'm genuinely curious if stenography is detectable enough to provide a viable list of targets.

[ Parent | on HN ]

Re:CIA Director John Brennan Pretends Foreign Cryptography D... by nxzero on Tuesday June 21, 2016 @09:54PM (#11951050)

Yes, steganalysis is used to flag material is irregular based on a number of factors:

https://en.m.wikipedia.org/wiki/Steganalysis

[ Parent | on HN ]

Re:CIA Director John Brennan Pretends Foreign Cryptography D... by deelowe on Wednesday June 22, 2016 @10:53AM (#11954373)

Thanks!

[ Parent | on HN ]

Re:CIA Director John Brennan Pretends Foreign Cryptography D... by smcgregor on Tuesday June 21, 2016 @01:15PM (#11947408)

This [0] research paper sounds relevant to your "stegonographic social overlay network."

[0] F. Beato, I. Ion, S. Capkun, M. Langheinrich, and B. P. (2013). For Some Eyes Only: Protecting Online Information Sharing. In ACM Conference on Data and Application Security and Privacy.

[ Parent | on HN ]

Re:CIA Director John Brennan Pretends Foreign Cryptography D... by saiya-jin on Tuesday June 21, 2016 @11:12AM (#11946216)

this sort of hiding sounds a bit like desperate attempt to save a lost battle of credibility of major US IT companies... no, thank you

[ Parent | on HN ]

Re:CIA Director John Brennan Pretends Foreign Cryptography D... by nxzero on Tuesday June 21, 2016 @01:01PM (#11947244)

Hard to believe Schneier would say something like that, are you sure that's what he said?

[ Parent | on HN ]

Re:CIA Director John Brennan Pretends Foreign Cryptography D... by cschmidt on Tuesday June 21, 2016 @01:30PM (#11947544)

The talk is here:

http://www.securitytube.net/video/14656?utm_source=feedburne...

He makes the point I was referring to at 12:53. The question starts about 11:45.

[ Parent | on HN ]

Re:CIA Director John Brennan Pretends Foreign Cryptography D... by cschmidt on Tuesday June 21, 2016 @01:11PM (#11947362)

I'm going by memory, but I'm pretty sure he made that point (that I'm paraphrasing, of course). Anyone else here his talk that would care to comment?

[ Parent | on HN ]