-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Sebastian Wiesner wrote: | Chris Walters <[EMAIL PROTECTED]> at Wednesday 25 June 2008, 17:14:20 | |> | Rumor has it that the three-letter agencies (CIA, KGB, M.A.V.O. [2], |> | etc) can break those algorithms relatively easy. On the other hand even |> | weaker algorithms can protect your data against laptop thieves. | | You had better used the acronym FUD instead of the word "rumor". US | government itself has declared Rijndael 256 sufficient for classified | information up to top secret. This level of security is shared among all | AES finalists like RC6 or Serpent. | |> That's more than a rumor. Another three letter agency (NSA) has networks |> of supercomputers that can brute force a passphrase is little time. | | Bruteforcing a _passphrase_ is not the same as bruteforcing a key. An both | of these don't have nothing to do with the algorithm itself. They are | side-attacks ... a weak passphrase is user idiocity, not a cipher | weakness. | |> It is not that I'm terribly paranoid about people getting my data, I just |> want to make it a little harder. | | What's the point in making the impossible even harder? | |> Of course, it is always possible to insert code that will send the |> unencrypted data, once you've logged on - not easy for the casual user, |> but for the guru, an easy thing. | | That's operating system security and has nothing to do with cryptology. | Someone having only your hard disk can't inject a rootkit into the system.
Are you a cryptology expert? By the way, nothing is impossible. The only thing that cryptography attempts to do is reduce the **probability** of cracking the key and gaining access to the data as low as possible. As for brute forcing a passphrase: Since most implementations of AES (Rijndael) use a hash of the passphrase to form the key, it amounts to the same thing, in practice, as cracking the key. Cryptology is, at least partly about finding the weakest link, because that is what is likely to be attacked in any cryptosystem. If the weakest link is system security or a weak passphrase, then that weakness translates to a weakness in anything encrypted in such an environment. The US Government only keeps classified information on non-networked computers in secure environments, so the cipher used does not matter as much as the other security measures taken to ensure that the data does not fall into the wrong hands. A final thought: It is a fact that both the US Navy and the NSA are *very* interested in cryptology and data security. The NSA also does have large networks of supercomputers that, using parallel, distributed or concurrent computing principles can crack keys more quickly than you may think. Regards, Chris -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJIYqmqAAoJEIAhA8M9p9DAIo8P/A17VwmkVsscVgfFzpCVDQbw 69WHMmoUvn5GasVRiM2JUi2UeEDpzCuLNxYlQglFWhyvsbplV3aiJmtzVdbEitsK hpf7Jt0wNvzi25Cye/j2DJlkGh7PTGRCkrMkoirgg+JTSFC21TzAnJZSUQH3Zhv8 Inb1C53jl8/RV1KTdPOX2W/hNo1VCPfpFnhxhad8fzj59pM1UwMVktwAQtO1JmOW fQm3/mSbeLyr0L5ZKPlc5shao/QVZ7Zo9xTDU8PFrBCmmt93MODGdbaOY7IsCmsl 6vWfWi1suV1a9ptPpU9ohn7YZtHlEboRMb4/mHCsj46SsI9cOo1KVLpqfiQZxd1t U1niZU8Cb67+cvEDcQ/q1eIGDMza01NR8UxtF66vHB8WrGKpLYs+ckHqJg9+hgF5 nUiY2RHeyNd3lh4vUWCY15Kh9OfK/LlL9IvGZV2Vpc066aa/EfC3AyiSSc+cMMx9 r4GQijL3wfKaDY9OUh6hJZcSZpBNTZezQ1sNZNMOm0TgDLGtJNMv5ltHjtZnxmbC Fus0IRrQVYvXT8ADZW80Ic256RWtUvn73WjBevYswa2T/Oc3o/NWc2sMrxEg8FVs a7nCa4ErSKIWRbMHTuTZLO3l6+XXjXm0sHk0qQ4JfFNkoV4gyMZq36HelAb2GsRu 7NJKaZIXlOCuNiYByLfp =wp+F -----END PGP SIGNATURE----- -- [email protected] mailing list
