If a government agency responsible for signal monitoring and espionage suggests an encryption format, endorses one particular format over another or even just actively participates in such discussions -- shouldn't that raise alarm bells in most tech-savvy people's heads?
The reality is the telecommunication industries in UK, US and other nations are complicit with such activity because they are legally required to provide access to their partners in government intelligence. And they operate in highly regulated environments that they will be shut out of if they don't cooperate.
Encryption has moved to the OS level, which is why we're seeing similar pressure being presented to Apple with this terrorist's iPhone.
In any technical field, it is important for the “good” and “best” people from that field to participate in group activities so that there is a better chance of sane decision-making. And in any sufficiently-complex field that has a government agency, you would certainly hope that at least some of those “good” and “best” people are working for the government. So what to do?
Perhaps one approach is to make sure no one group is over-represented, e.g. 5 different organizations that each have one vote or something.
> If a government agency responsible for signal monitoring and espionage suggests an encryption format, endorses one particular format over another or even just actively participates in such discussions -- shouldn't that raise alarm bells in most tech-savvy people's heads?
The NIST and other state organsiation continue to be active in this area. However not all they do is poor evil and all the open standards AES or SHA1 have also been studied and reviewed by many other cryptographers. Most consider them still save for practical uscases.
Nowdays the NIST is guiding the process of standartisation, but does not itself activally doing anything. Most cryptographers agree that in the process for SHA3 ran quite smothly and they did a good job. However when the NIST tried to over some improvments, the crypto community heavly stomped them and these improvments never went into the standart.
There were talks on these subject in the last couple of Chaos Communication Congresses.
Sure, NIST ran the competition, but AES was designed by Daemen and Rijmen in Belgium, and vetted by a whole host of other academic cryptographers in an open process.
There's enough to be paranoid about already. No need to looking for problems where there aren't any.
It's a fine line, because after all it is also [part of] the responsibility of the NSA to protect American citizens and businesses from foreign interception. They have two directly competing goals when recommending an encryption scheme: make it as secure as possible to prevent foreign/malicious actors from intercepting it, while they also want to be able to break any encryption scheme they recommend themselves.
To me, this says that they would be more likely to recommend fundamentally sound encryption schemes, but choose parameters where they can have hidden knowledge that lets them undermine it. Stuff like what people think they may have done with the eliptic curve constants, where they [supposedly] have chosen constants that they have extra knowledge about, but the method itself is apparently otherwise quite solid.
The UK is one of the most problematic nation states on the planet. Couple all the nasty spying with all the banking, money laundering and tax havens and it's hard to think of one country doing more to suppress working people world-wide.
Frankly I don't think you can have the moral high ground if you live in a first world country ...
I'm French so of course I would tend to agree about UK (;-) but if I start to look at my country there are a lot of things not to be proud of ... and if I look at the neighbors it's the same, even Switzerland helped South Africa back in the apartheid days on a project to gas their ghettos !
Germany has the most active community fighting against this stuff and is far, far better then the US,UK or France. France itself is quite bad, but not to the point of US or the UK.
The UK is so bad that the NSA has more rights in the UK then in the US.
My point was that no-one knows what the French and German governments are upto in secret, because it is still secret. It hasn't been leaked. The only reason the US and the UK are getting so much press is because their programs have.
The UK's surveillance program was even ruled illegal once it was found out what they were doing. So what if a lot of the German public are against surveillance - so are a lot of Brits - they just don't know what their government is doing in secret.
I'd bet everything I own the French and Germans and every other major country are doing the exact same stuff.
I don't know about France, at least publicly they are not very excepting of privacy arguments, specially after Paris. I have no idea about the secret part.
Germany is somewhat different because of its history. We know quite a bit about what the BND does, in terms of monitoring extremist groups. We have pirates in pretty important positions and the CCC is regularly working with government in oversight commissions.
It is pretty hard to hide all that you are doing, both in terms of physical infrastructure and in terms of financials. Now it may be that the BND is extremely clever and hiding all of this from basically everybody. However given the competence displayed by the BND on various action that they have taken, it is a really hard sell that they are operating a infrastructure close to the US or UK one.
Yeah, but when you see the outrage that Merkel displayed over finding out her phone had been tapped by the NSA; do you seriously believe that the BND haven't tried the exact same thing on Obama or Cameron when they're in Germany?
My point is that a lot of the outrage is only because the UK and US are the only ones we know of.
So I hope you realize the error of your statement. Nowhere did South Africa "gas" their ghetto's, nor did Switzerland help. Research was done on nerve agents, and crowd control measures (two separate research goals) and a number of other substances, which almost all countries did similar military research. Furthermore there is allegations of birth control research but this the evidence is flimsy, controversial and nowhere is it alleged that it went any further than research.
As a post script, Apartheid was bad but it was not much more than legalized discrimination. Let's not demonize Apartheid any more than for what it really was. And the current situation in South Africa is far worse than the situation ever was during the reign of Apartheid.
I think we can take banking to mean those particularly wicked fruits of the City of London... things like AIG's collapse, LIBOR and FX rigging, HSBC's drug money laundering, the seemlingly endless scandals of UK retail banking like PPIs, etc etc that have completely eroded the general public's trust of our pinstriped friends. Nobody's complaining about banking. We're worried about banking.
I'm aware of how banks mostly originate and securitize loans these days, rather than holding them. However, as banks continue to perform many billions of mundane operations throughout our everyday lives, mere securitization may be problematic but seems inadequate to demonstrate a clear connection to the oppression of the working man.
In general, banks are not above criticism by any means, but making a throwaway statement about the existence of financial industry headquarters in a city being tantamount to Oppression is tendentious in the extreme. If one wishes to make that case in these pages while maintaining some semblance of rational discourse (as opposed to populist rhetoric and invective) then we should do so while identifying the assumptions and world-view which led to it, so that they can be properly understood and critiqued.
> If I'm reading this right then they basically have access to all 3G/4G data and they do so in a way that cannot be detected.
How did you reach that conclusion? While probably true, this article merely (poorly) describes how GCHQ "improved" on another backdoored encryption standard by making snooping impossible to detect.
This is only a thing because GCHQ has started certifying software and supporting the MIKEY-SAKKE protocol is a hard requirement.
I think a number of the comments tend to use the word "country" instead of "government". The UK, France, and all other first world countries are great countries, in many ways that count. Governments however are not so great, and cannot be expected to be, by the nature of being institutes of suppression (as well as castles of bureaucracies). Still, compared to the rest of the world, they are manageable, and often tolerable.
What I find frustrating is that there is not more adoption of ZRTP for VoIP calls. Heck, there's not a whole lot of people doing SRTP either. People just don't seem to care. =(
The reality is the telecommunication industries in UK, US and other nations are complicit with such activity because they are legally required to provide access to their partners in government intelligence. And they operate in highly regulated environments that they will be shut out of if they don't cooperate.
Encryption has moved to the OS level, which is why we're seeing similar pressure being presented to Apple with this terrorist's iPhone.