> [ strong cryptography is easily recognizable ]
> Eugene Leitl writes,
>
> > These arguments are not valid. Cryptography does not work this way.
>
> What I'm trying to say is that when they recognize that someone is
> using strong cryptography -- stronger than what most people
The point is "recognition". The only way to recognize would to try, which
would tie up M$ worth of special-purpose equipment for days, if not weeks,
for the shortest of a single encrypted message. Considering current
Internet traffic, that's impossible. Totally impossible. Even backdoors
won't help, since the majority of the algorithms has not been developed
by the NSA, and thus are unlikely to have obvious backdoors, or backdoors
at all.
> generally use -- they will use *other* methods to investigate and
There are no other methods. The only way to tell would to try.
Steganography hides even high-entropy messages, making attempts entirely
unworthwhile. This sample/picture contains contraband? Which bits? Which
encryption methods? Aw shit, just a noisy picture. Was it really? Let's
check again. Yechchchchchhhhh! (sound of hair roots deserting the scalp).
> find out what he's up to. Cryptography can be supplemented by
> plain old detective work.
Of course trashing, torture, surveillance and old-fashioned break-ins are
much more effective than cryptoattacs. But it just prove my point: you
can't apply these simultaneously upon the entire U.S. populace who are
just using the Internet. There are even less resources for that there. It
will certainly make the No Such Agency suddenly to become quite
unpopular (for what's this is worth, NSA has certainly done it's part in
protecting U.S.'s interests. Spooks be spooks, but at times one _needs_
spooks, whether federal, or private).
> > It is quite impossible to tell random from pseudorandom,
>
> Why is it impossible? If that's a theorem, I would like to see the proof.
I can't think of a general one off-hand (entropy being observer-relative,
maybe), one thing is trying to find the rule _and_ the contents of a CAM
just by watching the generated sequence. It's impossible, without trying.
> Anyway the problem here is not to distinguish random from
> pseudorandom. The problem is to distinguish among the many
> different kinds of pseudorandomness.
There are oompteen tests for randomness. Good pseudorandom is
indistinguishable from good true random, and you _can't derive any
knowledge about the generating process_ if you just watch the stream
(unless you watch it for an semi-eternity). Don't you get it? Consider
reading some standard literature on cryptoattacks, these can't even be
fully automated yet (unless you consider special cases as DSA). And good
cryptoanalysts are rare and costly beasts indeed.
> > The only way to tell them apart would try a serious cryptoattack,
> > which is a very costly business.
>
> So it's costly. When the government feels seriously threatened,
> they will spend astonomical amounts of money to defend themselves.
Could they turn the entire solar system into a computer? The entire
galaxy? The entire universe (fuck Einstein)? When I say astronomic, I really
mean it.
> Cryptography is now classified as munitions, and the NSA may emerge
> as a branch of the military, with the same standing as the Army, Navy,
> and Air Force, and with a comparable budget.
I know most mathematicians work for NSA, and that NSA buys more than half
of the entire silicon output, _but that's not sufficient_. Or should they
have mastered quantum computers by now, to better factor primes? A lot of
cryptomethods do not rely on prime factoring. As in biological systems,
diversity of cryptosystems is the best protection.
> >: but the NSA could see the difference.
> >
> > But not _casually_. That's the point.
>
> Why is that the point? There is nothing casual about this. Recognizing
> the various kinds of pseudorandom sequences produced by various
> encryption schemes is not easy; neither is finding submarines in the
> ocean. But neither problem is impossible. Suppose NSA has a budget
In comparison to that, you already have found your submarines, without
even looking. Human language has no comparatives to denote differences in
these tasks.
> as big as the Navy's budget. Then a lot of things become possible.
Like FTL? Attotechnology? Transcension? Spacetime engineering?
> It is true that universal encryption would make the NSA's task more
> difficult. Instead of using chips that make a simple distinction between
That's an understatement.
> low-entropy and high-entropy messages, they would have to
> continually upgrade their chips to make more and more fine-grained
> distinctions, and they would have to use other methods as well.
Please have at least a look at Bruce Schneier's "Applied Cryptography" to
understand why no more and faster chips can possibly help.
> >: Let me rephrase my original statement: using more encryption than
> >: other people commonly use is like painting your windows black when
> >: everybody else uses curtains. It just attracts attention.
> >
> > everybody using cryptography equals to anybody having windows.
> > It is just some of them are bulletproof. Really easy to tell, huh?
>
> Yes, it is easy to tell.
> 1. Shoot a bullet at the window. If it breaks, it's not bulletproof.
Imagine hiring 50% of the entire populace, equipping them with Uzi's and
having a go at the housefront of the entire northern hemisphere. That's
great fun. Oh yes, they might even find some bulletproof windows, as a
side effect.
> 2. Take pictures of all houses in the neighborhood with an
> infra-red camera. Regular glass and bulletproof glass will show up
> differently in the pictures.
As I said, the comparison was flawed. (Plain infrared won't help, btw).
> 3. Reflect a laser off all the windows in the neighborhood. Different
> kinds of glass have different properties, and are identifiable.
Nope, again. You'd need a spectrometer.
> 4. Ask the contractors who build houses -- who uses bulletproof glass?
You do, in a lazy afternood. Or John Doe. Or Foo Barsky. Or Mr. Everybody.
> 5. Ask the company that makes bulletproof glass -- who buys it?
See above.
> Anyway this analogy is not valid. Everybody using cryptography
Indeed.
> equals to everybody *covering* their windows. It's just that some use
No. If the matrix does it for you, _every_ single window is bulletproof.
It is just that some of them are reinforced with an undetectable class
4711 forcefield.
> more opaque coverings than others. If there is a standard covering
> that most people use, and somebody uses a different, more opaque
> covering, that person has called attention to himself.
Please consider reading a basic book (e.g. Schneier's one) on
cryptography. I am really not being sarcastic, but you must understand all
the impacts of cryptography before you set out to critisize. Cryptography
is really extremely basics: in two decades you'll find it in every (and I
meant it) intelligent household appliance (and by then virtually every
household appliance will be intelligent). E.g. digicash and digital
signatures (to name the most trivial commodities) are impossible without
cryptography.
ciao,
'gene
> Lyle
>
>
______________________________________________________________________________
|mailto:ui22204@sunmail.lrz-muenchen.de |transhumanism >H, cryonics, |
|mailto:Eugene.Leitl@uni-muenchen.de |nanotechnology, etc. etc. |
|mailto:c438@org.chemie.uni-muenchen.de |"deus ex machina, v.0.0.alpha" |
|icbmto:N 48 10'07'' E 011 33'53'' |http://www.lrz-muenchen.de/~ui22204 |