National Security Agency Director Gen. Keith B. Alexander testifies on Capitol Hill in Washington, Tuesday, June 18, 2013, before the House Intelligence Committee. (AP/J. Scott Applewhite)
In the overwhelming glare of the continuing drama concerning the House’s tying of funding allocations to the Affordable Care Act and the resulting government shutdown, many other stories were pushed to the side and failed to get the attention they deserved. One such story came out on Sept. 5, when Glenn Greenwald, James Ball and Julian Borger published revelations culled from the latest of former Booz Allen Hamilton national security contractor Edward Snowden’s federal government leaks.
Computer data encryption has improved to the point that it is not easily or procedurally possible to break an encrypted data feed without a true commitment of time and effort. An exhaustive key search, or a brute-force attack — in which all possible decryption keys are run against an encrypted feed — can be so resource-intensive that conducting millions or billions of such searches yearly would be mathematically impossible.
For example, the Von Neumann-Landauer Limit states that the minimum amount of power needed by a computer to complete a calculation is set at 1.380 6488×10−23 joules/degree Kelvin * the computer’s temperature in degrees Kelvin * 0.693, per bit of data. So, to get through a standard 128-bit encryption — in which the encryption key has 128 binary digits — assuming the calculations are happening at room temperature, the amount of power needed to scan all possible keys is 976,735,910,000,000,000 joules, or roughly 1/100th of the world’s available power.
While current technology — such as the use of graphics processing units as parallel processors in brute-force attacks — and modern cryptanalysis techniques mitigates this in part, it does not eliminate the resource drain such a major surveillance effort would demand. To help address this, the intelligence community went to the makers of Internet security software and asked for a “cheat.” What this amounted to was a hidden backdoor written into Internet security software in which the National Security Agency and the other members of the “Five Eyes” — the signatory nations of the United Kingdom – United States of America Agreement of 1946 for signals intelligence: Great Britain, Canada, Australia and New Zealand — can access any Internet-connected computer covertly.
The NSA program BULLRUN came to be after a call from the federal government to hold encryption keys — known as “key escrow” — for the purposes of computer crimes and espionage investigations went nowhere. In the 1990s, NSA called for the installation of the Clipper chip, a specialized kleptographic or code-stealing encryption microchip that would secure data encryption keys for the NSA and would permit real-time surveillance of chip-equipped devices’ communiques by the NSA. As the Clipper chip failed to win manufacturers’ support based on the vulnerabilities of the system to misuse, the NSA looked for other ways to pursue its surveillance goals.
BULLRUN
Starting in 2000, the NSA spent billions to protect and preserve its ability to eavesdrop online, by influencing and weakening encryption standards, obtaining keys by agreement, hacking or legal intimidation, and designing supercomputer nests to conduct optimized brute-force attacks.
“Project Bullrun deals with NSA’s abilities to defeat the encryption used in specific network communication technologies,” read a classification guide for NSA employees and contractors on BULLRUN. “Bullrun involves multiple sources, all of which are extremely sensitive.” The document reveals that the agency has capabilities against widely used online protocols, such as HTTPS, voice-over-IP and Secure Sockets Layer (SSL), used to protect online shopping and banking.
In 2006, cryptography researchers Dan Shumow and Niels Ferguson floated an informal paper suggesting the possibility that the NSA created a “workaround” for the Dual_EC_DRBG (Dual Elliptic Curve Deterministic Random Bit Generator), the adopted encryption standard supported by the International Organisation for Standardisation and used in computer system worldwide. As the encryption key used random numbers, it is impossible to form a “dictionary” of possible key values, forcing the hacker to go through all possible key values.
In 2007, Bruce Schneier, a cryptographer, picked up on Shumow and Ferguson’s research and suggested that it is most likely that the NSA would use a scheme similar to this proposal, as it would be significantly faster to implement. In his Wired article, Schneier argued: “There are a bunch of constants — fixed numbers — in the standard used to define the algorithm’s elliptic curve … What Shumow and Ferguson showed is that these numbers have a relationship with a second, secret set of numbers that can act as a kind of skeleton key. If you know the secret numbers, you can predict the output of the random-number generator after collecting just 32 bytes of its output.”
“To put that in real terms, you only need to monitor one TLS internet encryption connection in order to crack the security of that protocol. If you know the secret numbers, you can completely break any instantiation of Dual_EC_DRBG.”
It has recently been alleged that the NSA has done exactly this to get past the Internet’s encryption system.
A forced hand
Microsoft, as reported by Greenwald, Ball and Borger, for example, knowingly installed means for the NSA to defeat the company’s own security measures — including pre-encryption access to cloud-hosted email, access to Outlook.com’s web chats, access to its cloud storage service SkyDrive and access to Skype’s call feeds (Skype is a fully-owned subsidiary of Microsoft).
Skype, prior to its 2011 purchase by Microsoft, ran Project Chess — which made its transmission feeds easier legally and technically to be eavesdropped on by law enforcement and security agencies. The program was actively denied by Skype and Microsoft officials until the the New York Times published revelations on the program in June.
“For the past decade, [the NSA] has led an aggressive, multipronged effort to break widely used Internet encryption technologies,” said a 2010 memo describing a briefing about the NSA’s accomplishments for employees of its British counterpart, the Government Communications Headquarters (GCHQ). “Cryptanalytic capabilities are now coming online. Vast amounts of encrypted Internet data which have up till now been discarded are now exploitable.”
“We are investing in groundbreaking cryptanalytic capabilities to defeat adversarial cryptography and exploit Internet traffic,” the director of national intelligence, James Clapper, wrote in his budget request for the current year.
In response to the Guardian’s coverage, Microsoft asserted in a statement:
“We have clear principles which guide the response across our entire company to government demands for customer information for both law enforcement and national security issues. First, we take our commitments to our customers and to compliance with applicable law very seriously, so we provide customer data only in response to legal processes. Second, our compliance team examines all demands very closely, and we reject them if we believe they aren’t valid. Third, we only ever comply with orders about specific accounts or identifiers, and we would not respond to the kind of blanket orders discussed in the press over the past few weeks, as the volumes documented in our most recent disclosure clearly illustrate.
“Finally when we upgrade or update products legal obligations may in some circumstances require that we maintain the ability to provide information in response to a law enforcement or national security request. There are aspects of this debate that we wish we were able to discuss more freely. That’s why we’ve argued for additional transparency that would help everyone understand and debate these important issues.”
It has been alleged that GCHQ has also sought infiltration into Google, Yahoo and Facebook. Google vehemently denies that it granted governmental access to its networks or systems and says there is no evidence suggesting a system breach.
Broken trust
The weight of all of this is shocking. Effectively, the NSA has access to every Internet-connected device — from commerce and banking services to virtual private networks to foreign computer networks to iPhones, Android-enabled phones and BlackBerry phones. This effectively kills the expectation of communication privacy. “If back doors are built into systems by the N.S.A., who is to say that other countries’ spy agencies — or hackers, pirates and terrorists — won’t discover and exploit them?,” reported the New York Times on the issue.
“The risk is that when you build a back door into systems, you’re not the only one to exploit it,” said Matthew D. Green, a cryptography researcher at Johns Hopkins University. “Those back doors could work against U.S. communications, too.”
This seemingly continuous drama about the NSA’s overreaches comes into play due to conflicting obligations under a single organization. While the National Institute of Standards and Technology — the federal agency charged with the standardization of official measures in the United States — officially institutes the nation’s encryption standards, the NSA, which is charged with ensuring the safety of the nation’s communications, unofficially “consults” the NIST on its official standards. As the NSA also carries the Reagan-era mandate of monitoring electronic communications, this creates a blatant conflict of interest.
This creates a multilayered problem. First, if Internet traffic cannot be ruled “safe” even if the transmission is “secure,” trust of the Internet suffers and Internet commerce may take a hit. “Cryptography forms the basis for trust online,” said Bruce Schneier, an encryption specialist and fellow at Harvard’s Berkman Center for Internet and Society. “By deliberately undermining online security in a short-sighted effort to eavesdrop, the NSA is undermining the very fabric of the internet.” Classified briefings between the agencies celebrate their success at “defeating network security and privacy.”
“Loss of confidence in our ability to adhere to confidentiality agreements would lead to loss of access to proprietary information that can save time when developing new capability,” reads one communique to GCHQ workers. “Some exploitable products are used by the general public; some exploitable weaknesses are well known eg possibility of recovering poorly chosen passwords. Knowledge that GCHQ exploits these products and the scale of our capability would raise public awareness generating unwelcome publicity for us and our political masters.”
Second, this activity undermines the federal government’s moral authority to pursue and prosecute computer crimes, as this alleged creation of a “backdoor network” is a computer crime within itself. In effect, the federal government is creating a “do as I say, not as I do” scenario in which the government is perceived as violating the very laws it aggressively enforces.
Finally, it calls into question the trustworthiness of Silicon Valley, which serves as a major component to the nation’s economy. A slowdown in buyers’ confidence in electronic consumer goods could have a stalling effect on the nation’s recovery.
“Backdoors are fundamentally in conflict with good security,” said Christopher Soghoian, principal technologist and senior policy analyst at the American Civil Liberties Union. “Backdoors expose all users of a backdoored system, not just intelligence agency targets, to heightened risk of data compromise. This is because the insertion of backdoors in a software product, particularly those that can be used to obtain unencrypted user communications or data, significantly increases the difficulty of designing a secure product.”
Snowden, however, feels confidence in the security of encryption to continue to vouch for it, as he did in a June live Q&A session for the Guardian. “Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on,” Snowden pointed out, before stating that the problem is not the technology, but the NSA’s attempts to “game the system” by compromising security on either end of the communique.
Unfortunately, this is a problem that can’t solve itself. The NSA is legally obligated to continue its programs as defined, politicians have little incentive to push for reform — despite public outcry — and the mentality of “a world of potential enemies” will continue to fuel the suspicion that such espionage efforts as the NSA’s are needed for national security. Unless something changes, however, the federal government increasingly runs the danger not only of isolation internationally, but isolation from its own people.
“Without Congressional action or a strong judicial precedent,” wrote Ladar Levison, founder of Lavabit, after the closure of his service after refusal to co-operate with the NSA, “I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States.”
The post How Does The NSA Bypass Online Encryption? appeared first on Mint Press News.