SoylentNews is people
SoylentNews
from the put-all-your-secrets-in-one-basket dept.
'The intelligence coup of the century'
In case of paywall...
CIA Secretly Owned Crypto, the Swiss Company That Ruled Global Spy Comms for Decades, Says Report
For more than half a century, governments all over the world trusted a single company to keep the communications of their spies, soldiers and diplomats secret.
The company, Crypto AG, got its first break with a contract to build code-making machines for U.S. troops during World War II. Flush with cash, it became a dominant maker of encryption devices for decades, navigating waves of technology from mechanical gears to electronic circuits and, finally, silicon chips and software.
The Swiss firm made millions of dollars selling equipment to more than 120 countries well into the 21st century. Its clients included Iran, military juntas in Latin America, nuclear rivals India and Pakistan, and even the Vatican.
But what none of its customers ever knew was that Crypto AG was secretly owned by the CIA in a highly classified partnership with West German intelligence. These spy agencies rigged the company's devices so they could easily break the codes that countries used to send encrypted messages.
For the most goodest security, use only one commercial crypto system. Trust it with all your secrets.
(Score: 3, Insightful) by edIII on Thursday February 13 2020, @02:27AM
If you want to be sure what is going on, and want to
writeroll your own, use the reference implementations. They're there specifically to make sure they don't have stuff you don't want, and allow vetting by the crypto community at large. There not obfuscated, and are open code. This allows us to have some trust in the code, as long as we have some trust in the academic community.Crypto is just way too complicated a subject for any ordinary programmer to tackle. It's hubris to think that you not only have the programming chops to make sure there are no security holes in your implementation, but also that you have the mathematical chops to grok all the math, the algorithms, the timing, .etc. Do you understand oracle padding enough to inspect an encryption implementation to make sure it isn't possible? This is why the reference implementations are nice, because much smarter people than you or I, vetted them.
All that being said, home grown crypto is 100% impossible to break by anyone, under a very specific set of circumstances:
- Alice uses the SBC with the phrase "Rocky & Bullwinkle"
- Cipher text is generated and sent
- Bob receives cipher text with plaintext "Rocky & Bullwinkle" as a label
- Bob uses the SBC to receive original plaintext after feeding in the label as the parameter.
That's the big ol' brick version of it. Not very practical, but it's sure as hell secure. From what I understand the military does the same damn thing (HDs full of entropy) in top secret planes. Drive space is cheap. You just load up enough OTP along with the ordnance for the mission parameters. Telemetry is decoded with a local copy on the base.
A 10TB HD is a large number of communications, even ones with a few seconds of video attached. You can go years without exchanging again. For situations in which physical contact is regular, additional exchanges are easily possible to refresh OTP "reserves" as it were.
Other than OTP, which is so damn simple a child can do it, there doesn't exist anything else simple enough for the common programmer or sysadmin to be able to code without vulnerabilities. Which is why we need to rely very public, very transparent, and very much discussed and reviewed, reference implementations. Those need to be used by competent people to contribute to our various libraries so we can have some reasonable levels of trust. As most exploits seem to work against poor implementations, and not core insights into breaking the math, it makes a lot more sense for us to have a robust process ensuring people have access to vetted code and libraries.
Technically, lunchtime is at any moment. It's just a wave function.