Re: [gentoo-user] loop-aes + extra-ciphers...

[Chris Walters]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Sebastian Wiesner wrote:
| Chris Walters <cjw2004d@×××××××.net> at Wednesday 25 June 2008, 17:14:20
|
|> | Rumor has it that the three-letter agencies (CIA, KGB, M.A.V.O. [2],
|> | etc) can break those algorithms relatively easy. On the other hand even
|> | weaker algorithms can protect your data against laptop thieves.
|
| You had better used the acronym FUD instead of the word "rumor".  US
| government itself has declared Rijndael 256 sufficient for classified
| information up to top secret.  This level of security is shared among all
| AES finalists like RC6 or Serpent.
|
|> That's more than a rumor.  Another three letter agency (NSA) has networks
|> of supercomputers that can brute force a passphrase is little time.
|
| Bruteforcing a _passphrase_ is not the same as bruteforcing a key.  An both
| of these don't have nothing to do with the algorithm itself.  They are
| side-attacks ...  a weak passphrase is user idiocity, not a cipher
| weakness.
|
|> It is not that I'm terribly paranoid about people getting my data, I just
|> want to make it a little harder.
|
| What's the point in making the impossible even harder?
|
|> Of course, it is always possible to insert code that will send the
|> unencrypted data, once you've logged on - not easy for the casual user,
|> but for the guru, an easy thing.
|
| That's operating system security and has nothing to do with cryptology.
| Someone having only your hard disk can't inject a rootkit into the system.

Are you a cryptology expert?  By the way, nothing is impossible.  The only
thing that cryptography attempts to do is reduce the **probability** of
cracking the key and gaining access to the data as low as possible.

As for brute forcing a passphrase:  Since most implementations of AES
(Rijndael) use a hash of the passphrase to form the key, it amounts to the same
thing, in practice, as cracking the key.

Cryptology is, at least partly about finding the weakest link, because that is
what is likely to be attacked in any cryptosystem.  If the weakest link is
system security or a weak passphrase, then that weakness translates to a
weakness in anything encrypted in such an environment.

The US Government only keeps classified information on non-networked computers
in secure environments, so the cipher used does not matter as much as the other
security measures taken to ensure that the data does not fall into the wrong hands.

A final thought:  It is a fact that both the US Navy and the NSA are *very*
interested in cryptology and data security.  The NSA also does have large
networks of supercomputers that, using parallel, distributed or concurrent
computing principles can crack keys more quickly than you may think.

Regards,
Chris
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJIYqmqAAoJEIAhA8M9p9DAIo8P/A17VwmkVsscVgfFzpCVDQbw
69WHMmoUvn5GasVRiM2JUi2UeEDpzCuLNxYlQglFWhyvsbplV3aiJmtzVdbEitsK
hpf7Jt0wNvzi25Cye/j2DJlkGh7PTGRCkrMkoirgg+JTSFC21TzAnJZSUQH3Zhv8
Inb1C53jl8/RV1KTdPOX2W/hNo1VCPfpFnhxhad8fzj59pM1UwMVktwAQtO1JmOW
fQm3/mSbeLyr0L5ZKPlc5shao/QVZ7Zo9xTDU8PFrBCmmt93MODGdbaOY7IsCmsl
6vWfWi1suV1a9ptPpU9ohn7YZtHlEboRMb4/mHCsj46SsI9cOo1KVLpqfiQZxd1t
U1niZU8Cb67+cvEDcQ/q1eIGDMza01NR8UxtF66vHB8WrGKpLYs+ckHqJg9+hgF5
nUiY2RHeyNd3lh4vUWCY15Kh9OfK/LlL9IvGZV2Vpc066aa/EfC3AyiSSc+cMMx9
r4GQijL3wfKaDY9OUh6hJZcSZpBNTZezQ1sNZNMOm0TgDLGtJNMv5ltHjtZnxmbC
Fus0IRrQVYvXT8ADZW80Ic256RWtUvn73WjBevYswa2T/Oc3o/NWc2sMrxEg8FVs
a7nCa4ErSKIWRbMHTuTZLO3l6+XXjXm0sHk0qQ4JfFNkoV4gyMZq36HelAb2GsRu
7NJKaZIXlOCuNiYByLfp
=wp+F
-----END PGP SIGNATURE-----
-- 
gentoo-user@l.g.o mailing list