CNN: Secure Email Encryption Has Been Broken

[lincoln]

Found this on CNN.com

http://www.cnn.com/2003/TECH/internet/02/21/email.encryption.reut/index.html

Limited capability now. How about in a year?

 

[lincoln]

It has to start somewhere. They can make imprvements on the crack end just like they do on the encrytpion end.

Before this it was considered unbreakable.

 

[karde]

Nothing is "unbreakable"

Some of these things would take an unrealistic amount of resources to break though.

Just wait for quantum computing which will be along one day. That will be the big revolution in computer and data security.

 

[crsnavet]

I don't trust any encryption level. I think it is good to consistently clean out your mailbox and sent items of anything that you wouldn't want to be read by big brother!

 

[nikolai_bolkov]

I believe that if the government is watching you and they are interested in you, then there is not much you can do if you're doing something you're not supposed to be doing.

 

[daemon]

The version people use for online shopping is 1024 bit. The version Hushmail uses is 2048. I don't have the math skills to tell you how much more secure that is but let's just say it's exponential. It would take an individual several lifetimes to break. The people who do break these schemes are using a distributed method that takes hundreds, possibly thousands, of computers working together.
Joe Friday Hacker doesn't have the resources to break it.

Agreed. Except that a flaw was found in the cryptographic code of SSL, not in the implementation. Meaning, https, the little padlock thingy you see at the bottom of your browser, thats been broken. This wasn't a distributed attack using thousands of computers. This was an attack by a research team who were able to identify the users password as it floated by a couple hundred times. The reason this only effects email is that with credit card transactions, your password is only sent once. With secure email, your password is continually sent to the server allowing an attacker to glean pieces, or hints at your password each time.

Updated SSL libraries have been released. This /should/ propogate out /relatively/ quickly. Especially to those sites concerned with security. I.E. hushmail. I wouldn't worry about it anymore than I would have worried about email security before.

 

[Surgical]

I'm not worried about it. Right this second, there are MILLIONS of emails being transferred all over the world. Only if they suspect something can they watch you. What are they going to do, pic out random emails?

 

[daemon]

I'm not worried about it. Right this second, there are MILLIONS of emails being transferred all over the world. Only if they suspect something can they watch you. What are they going to do, pic out random emails?

No need to. They just scan most emails for keywords which are then analyzed. Go read about carnivore.

 

[megabump]

From another board about the same article:

Well, I'm playing with X509 certs (SSL e-mail) myself and yes, they can be cracked. If you spend enough CPU time and resources.

Problem is that SSL default encryption scheme is RC2 40 bits. US gov allows this for export. The idea is that ppl from "friendly nations" can download the "strong encryption" package from M$. "enemy states" can't. The certs can also be "weak" or "strong".

If a "senders" cert "knows" that "recipient" cert supports "high encryption", the encryption scheme is "cranked up" to the highest scheme both support. Thus if "enemy user" don't have "high encryption package" and "low encryption cert" only "weak encryption" is used. And can be cracked. It will take a P4 2 Ghz about 2 years to crack one e-mail with this system, but I'm sure the NSA has better equipment.

As in many encryption systems there are many coding algorithms. Some are weaker then others. DES is weak. AES and RSA for example are strong.

It is possible to use "extra strong" encryption schemes with SSL (like AES-1024 with 3DES coded keys, MD5 hash etc) but those coding algorithms are export restricted. Everyone can download and compile them from internet if you're a bit handy. I'm fairly sure that cracking of those systems is extremely difficult. However, I "know" that the NSA monitors those "extra strong" coded e-mails, if you're using it with someone outside USA.

So yea, I'm a bit afraid to issue those certs. Suppose some terrorist uses "my certs" to plan an attack on America (or The Netherlands)? I wouldn't sleep for the rest of my life.

I also know that the NSA monitors the events in the www.openssl.org, and many American experts are very reluctant to tell about the high encryption systems