How the NSA can break trillions of encrypted Web and VPN connections

[JerkyMcDilerino]

Source: >>> Oh yeeeeeeeees, click here baby don't be shy, just click here. <<< 

 

For years, privacy advocates have pushed developers of websites, virtual private network apps, and other cryptographic software to adopt theDiffie-Hellman cryptographic key exchange as a defense against surveillance from the US National Security Agency and other state-sponsored spies. Now, researchers are renewing their warning that a serious flaw in the way the key exchange is implemented is allowing the NSA to break and eavesdrop on trillions of encrypted connections.

The cost for adversaries is by no means modest. For commonly used 1024-bit keys, it would take about a year and cost a "few hundred million dollars" to crack just one of the extremely large prime numbers that form the starting point of a Diffie-Hellman negotiation. But it turns out that only a few primes are commonly used, putting the price well within the NSA's $11 billion-per-year budget dedicated to "groundbreaking cryptanalytic capabilities."

"Since a handful of primes are so widely reused, the payoff, in terms of connections they could decrypt, would be enormous," researchers Alex Halderman and Nadia Heninger wrote in a blog post published Wednesday. "Breaking a single, common 1024-bit prime would allow NSA to passively decrypt connections to two-thirds of VPNs and a quarter of all SSH servers globally. Breaking a second 1024-bit prime would allow passive eavesdropping on connections to nearly 20% of the top million HTTPS websites. In other words, a one-time investment in massive computation would make it possible to eavesdrop on trillions of encrypted connections."

 

 

 

Most plausible theory

Halderman and Heninger say their theory fits what's known about the NSA's mass decryption capabilities better than any competing explanation. Documents leaked by former NSA subcontractor Edward Snowden, for instance, showed the agency was able to monitor encrypted VPN connections, pass intercepted data to supercomputers, and then obtain the key required to decrypt the communications.

"The design of the system goes to great lengths to collect particular data that would be necessary for an attack on Diffie-Hellman but not for alternative explanations, like a break in AES or other symmetric crypto," the researchers wrote. "While the documents make it clear that NSA uses other attack techniques, like software and hardware 'implants,' to break crypto on specific targets, these don’t explain the ability to passively eavesdrop on VPN traffic at a large scale."

The blog post came as Halderman, Heninger, and a raft of other researchers formally presented their academic paper detailing their findings to the 22nd ACM Conference on Computer and Communications Security in Denver on Wednesday. The paper, titled "Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice," received extensive media coverage in May when the paper was first released. Besides exposing the likely secret behind the NSA's mass interception of encrypted communications, the paper also revealed a closely related attack that left tens of thousands of HTTPS-protected websites, mail servers, and other widely used Internet services open to less sophisticated eavesdroppers.

The attack, which was dubbed Logjam, was extremely serious because it required just two weeks to generate data needed to attack the two most commonly called prime numbers 512-bit Diffie-Hellman uses to negotiate ephemeral keys. It affected an estimated 8.4 percent of the top 1 million Web domains and 3.4 percent of HTTPS-supported websites overall. E-mail servers that support simple mail transfer protocolwith StartTLS, secure POP3, and IMAP were estimated to be vulnerable in 14.8 percent, 8.9 percent, and 8.4 percent of the cases respectively. To exploit vulnerable connections, attackers used the number field sieve algorithm to precompute data. Once they had completed that task, they could perform man-in-the-middle attacks against vulnerable connections in real time.

The Logjam weakness was the result of export restrictions the US government mandated in the 1990s on US developers who wanted their software to be used abroad. The regimen was established by the Clinton administration so that the FBI and other agencies could break the encryption used by foreign entities. In the five months since the paper was released, most widely used browsers, VPNs, and server apps have removed support for 512-bit Diffie-Hellman, making Logjam much less of a threat. But a similar vulnerability can still be exploited by attackers with nation-state-sized budgets to passively decrypt the 1024-bit Diffie-Hellman key sizes that many implementations still use by default.

Unsettling conclusion
Halderman and Heninger's team arrived at this unsettling conclusion in May, but it's likely the NSA reached it long before then. While that knowledge makes it possible for the NSA to decrypt communications on a mass scale, it gives the same capability to other countries, some of which are adversaries to the US. Halderman and Heninger wrote:

Our findings illuminate the tension between NSA’s two missions, gathering intelligence and defending U.S. computer security. If our hypothesis is correct, the agency has been vigorously exploiting weak Diffie-Hellman, while taking only small steps to help fix the problem. On the defensive side, NSA has recommended that implementors should transition to elliptic curve cryptography, which isn’t known to suffer from this loophole, but such recommendations tend to go unheeded absent explicit justifications or demonstrations. This problem is compounded because the security community is hesitant to take NSA recommendations at face value, following apparent efforts tobackdoor cryptographic standards.

This state of affairs puts everyone’s security at risk. Vulnerability on this scale is indiscriminate—it impacts everybody’s security, including American citizens and companies—but we hope that a clearer technical understanding of the cryptanalytic machinery behind government surveillance will be an important step towards better security for everyone.

Diffie-Hellman is the breakthrough that lets two parties that have never met before negotiate a secret key even when communicating over an unsecured, public channel that's monitored by a sophisticated adversary. It also makes possible perfect forward secrecy, which periodically changes the encryption key. That vastly increases the work of eavesdropping because attackers must obtain the ephemeral key anew each time it changes, as opposed to only once with other encryption schemes, such as those based on RSA keys. The research is significant because it shows a potentially crippling weakness in a crypto regimen widely favored by privacy and security advocates.

The original research team recommended that websites use 2048-bit Diffie-Hellman keys and published this Guide to Deploying Diffie-Hellman for TLS. The team also recommended SSH users upgrade both server and client software to the latest version of OpenSSH, which favors Elliptic-Curve Diffie-Hellman Key Exchange. Update: Nicholas Weaver, a security researcher at the University of California at Berkeley and the International Computer Science Institute, said the researchers' theory is "almost certainly correct" has analysis here.

 

[ThinkWithPortals]

I think my paranoia may just have gotten worse...

[Guest]

Snowden be like

LEAVE THE PEOPLE ALONE

*cries* 

I personally hate the NSA. 

I mean fuck, if I could see what people where doing I wouldn't do it...

Its privacy. I don't care to know what my friends are doing right now. 

[AresKrieger]

Most of the reasons people use vpn the nsa doesn't care about thankfully, also I'm not even remotely surprised, the US government made quite a lot of in the way of encryption themselves, but it does show you how much reach the nsa have which is a scary thought to say the least.

[SurvivorNVL]

We must now evolve beyond 256-bit encryption.  DNA Encryption.  We'll have to sacrifice a leg.

[The Cool n00B]

Fuck the NSA tho

 

They're a bunch of corrupt-ass bitches "trying to protect America" like no you're fucking not you're putting normal ass people on the Terrorist Watch List (which I'll probably be on for this post) who don't deserve to be on it (like myself, I'm 14 years old what am I gonna do?). Just because I said some nasty-ass shit about you, NSA, doesn't mean I'm gonna blow shit up, c'mon get fucking real.

 

Anyway, I'm sure you all know my position on the NSA after that. --====> Fuck That <====--

[MatthewEnderle]

Do you guys realize what the NSA is actually collecting? No, I didn't think so. For someone in in the ISR field I'm telling you that the NSA doesn't collect on you. 

[Lethal Seraph]

All that money spent on surveillance just to keep a sweetroll safe.

[Arty]

please fix for night theme users

[Prysin]

someone needs to set off an EMP or two inside NSA's offices.... atleast then they would spend a few years rebuilding and leave us alone.

[JAKEBAB]

Do you guys realize what the NSA is actually collecting? No, I didn't think so. For someone in in the ISR field I'm telling you that the NSA doesn't collect on you. 

Lol Snowden says otherwise. http://www.nytimes.com/2014/07/21/us/politics/edward-snowden-at-nsa-sexually-explicit-photos-often-shared.html

[Fetzie]

"everybody use eDHK exchange, it's really secure"

 

"hey guys, we were only ever actually using two unique prime numbers in the algorithm, soooo yeah. Sorry, we dun goofed."

[Ekpyrosis]

So their source of randomness worked similiar to this?

[suicidalfranco]

this is just going to hurt us businesses more than ever; had to that the fact that the safe harbor agreement is now invalid (thanks to yours truly the nsa), future just seems grimmer than ever

[Trik'Stari]

We "tinfoil hatters" told you so.

 

Nothing is safe from the beast

[Spongy141]

Personally I do not have anything to hide anyways, so the NSA can look at all my shit for all I care, I have literally nothing to hide. The only reason you should truly give a fuck what they do is if you have shit to hide.

[BuckGup]

I don't care. What I do care about is idiots at my school thinking free VPNs on their phones are the greatest thing ever that allow you to go to blocked websites on your phone when really they are farming all data and passwords

[qwertywarrior]

"Since a handful of primes are so widely reused"

 

but we already know that, the NSA  some how reverse engineered it

just dont use the ones provided NIST

 

 dont use the "P" and "Q"

http://csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf

[iwasaperson]

Personally I do not have anything to hide anyways, so the NSA can look at all my shit for all I care, I have literally nothing to hide. The only reason you should truly give a fuck what they do is if you have shit to hide.

http://www.ted.com/talks/glenn_greenwald_why_privacy_matters

[Beskamir]

Well shit, I use a vpn to gain access to my home network which then gives me access to my server. So this news is horrible Maybe since I'm using 2048-bit instead of 1024-bit I'll be a little safer? Probably not.

[Master Disaster]

So their source of randomness worked similiar to this?random_number.png

Exactly what I was thinking, when they've got so many different choices why the fuck would they reuse them?

[Admiral Naismith]

We "tinfoil hatters" told you so.

 

Nothing is safe from the beast

It sucks being right.

[MatthewEnderle]

Lol Snowden says otherwise. http://www.nytimes.com/2014/07/21/us/politics/edward-snowden-at-nsa-sexually-explicit-photos-often-shared.html

NSA has unwarranted access to records, but they don't collect personally

[LarsReviews]

Haha, no with me

 

[thunderdog512]

Personally I do not have anything to hide anyways, so the NSA can look at all my shit for all I care, I have literally nothing to hide. The only reason you should truly give a fuck what they do is if you have shit to hide.

Can I have all your passwords and usernames than? You have nothing to hide so let me snoop around your accounts and see what you're up to and where you go. I'll wait for your PM.