<div dir="ltr"><div>If you're a nation state, you often don't need to break the encryption. If you can store the device/data until you can hold someone in custody, you'll be able to "apply pressure" for the key to be provided.</div><div><br></div>Even without an arrest, patience is usually all that's required. People's operational security is generally terrible. <br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 15 Jun 2020 at 10:59, Klein, Hans K <<a href="mailto:hans@gatech.edu">hans@gatech.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-5409248618361217726WordSection1">
<p class="gmail-m_-5409248618361217726MsoPlainText">The claim, "[US, China, etc.] can crack any encryption" needs to be unpacked.<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">The ability to do something *in fact* differs from the ability to do something *in practice*.
<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">If you can crack any encryption, but it is costly to do so, then in practice you may not be able to crack the encryption. Even though you can do it, you may not have the budget to do so. Thus if all users are using encryption, then
the cost of cracking everyone's encryption may be prohibitive. <u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">Of course, the surveilling party will presumably optimize their efforts based on budgetary constraints. If it is too costly to crack e2e, they might invest in cracking the device, they might invest in physical interrogation of the communicating
person, they might invest in less-costly cracking technology, they might use heuristics to focus on just a subset of e2e, etc., etc.<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">They go where the costs are lowest. <u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">By thinking in terms of costs, it is easier to recognize <a href="https://xkcd.com/538/" target="_blank">
the equivalence of encryption technology and blunt objects</a>.<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">- Hans<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">-----Original Message-----<br>
From: LT [mailto:<a href="mailto:lt-bounces@lists.liberationtech.org" target="_blank">lt-bounces@lists.liberationtech.org</a>] On Behalf Of Bill Woodcock<br>
Sent: Sunday, June 14, 2020 5:29 PM<br>
To: Ali-Reza Anghaie <<a href="mailto:ali@packetknife.com" target="_blank">ali@packetknife.com</a>>; Yosem Companys <<a href="mailto:yosem@techlantis.com" target="_blank">yosem@techlantis.com</a>>; <a href="mailto:lt@lists.liberationtech.org" target="_blank">lt@lists.liberationtech.org</a><br>
Subject: Re: [liberationtech] What would you reply to this?</p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">>> On Sun, Jun 14, 2020 at 2:38 PM Yosem Companys <<a href="mailto:yosem@techlantis.com" target="_blank"><span style="color:windowtext;text-decoration:none">yosem@techlantis.com</span></a>> wrote:<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">>> Alex Nicholson 10:43 AM<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">>> Curious what others think about this... this past week @Jason Calacanis (<a href="http://launch.co" target="_blank">launch.co</a>) talked about the need for all-user end-to-end encryption on services like Zoom in China, and basically anyone operating in or through China, because
of the Chinese govt’s likelihood of intercepting and/or interfering with communications as it likes. However, I would argue that the conversation is severely under-estimating the sophistication of the Chinese govt. The US’s NSA can crack any encryption in
the world and listen to any communications it wants. Why would we think China’s version of the NSA is any less sophisticated? Commercial encryption prevents interception by hackers and criminals, low-level operations without the budgets or resources of state
actors. The intelligence services of major world powers have the skills and tools to crack any company’s best attempt at encryption. So what does it matter if a service like Zoom or anything touching China is encrypted or not? If it touches Chinese soil, fibers,
or airspace, it can be read by their govt. If it’s encrypted, it prob won’t be read by criminals and civilian hackers only. Thoughts?<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">> On Jun 14, 2020, at 8:46 PM, Ali-Reza Anghaie <<a href="mailto:ali@packetknife.com" target="_blank"><span style="color:windowtext;text-decoration:none">ali@packetknife.com</span></a>> wrote:<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">> I think people still don't understand what risk surfaces are actually worth attacking - and they latch onto encryption without any of the other OPSEC considerations, side-channel attacks on the information and groups being protected,
etc.<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">> This XKCD still applies: <a href="https://xkcd.com/538/" target="_blank">
<span style="color:windowtext;text-decoration:none">https://xkcd.com/538/</span></a> The problem is the
<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">> companies and politics still should _strive_ for the best in each applicable area but people are deluding themselves when they consider a Nation State threat model as their baseline.<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">Yeah, I mostly agree with that.<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">On the one hand, there is no uncrackable encryption… the passage of time, Moore’s law, quantum computing, it’ll all get decrypted, it’s just a question of when. Symmetric encryption works as long as the keys are used 1:1, get destroyed
after use, and are communicated securely in the first place. Quantum communication of symmetric keys seems promising.<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText">But there are so many other, easier attacks, in the short run, that getting idiots to focus on key-length and ignore all the real attacks just makes governments’ work easier.<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"> -Bill<u></u><u></u></p>
<p class="gmail-m_-5409248618361217726MsoPlainText"><u></u> <u></u></p>
</div>
</div>
-- <br>
Liberationtech is public & archives are searchable from any major commercial search engine. Violations of list guidelines will get you moderated: <a href="https://lists.ghserv.net/mailman/listinfo/lt" rel="noreferrer" target="_blank">https://lists.ghserv.net/mailman/listinfo/lt</a>. Unsubscribe, change to digest mode, or change password by emailing <a href="mailto:lt-owner@lists.liberationtech.org" target="_blank">lt-owner@lists.liberationtech.org</a>.</blockquote></div></div>