1

I have heard of some countries not allowing some type of encryption for data transfer along web applications, because the key length is too high (or other reasons), aka: "Datagram"...

Now, for HTTPS, I know that it uses RSA (with certificate, etc.) to initialize the connection, then AES-128/256 for payload transfer.

If it is allowed among most government policies (USA, Europe, ...), then does that mean that it is weak enough for specialized attackers to decrypt the data ?

How long would it take for an expert hacker to find the key ?

6

In addition to @Petris's answer.

In addition, here are a few reasons why government security services don't object too loudly to HTTPS:

  • They need to use it themselves
  • The cost to the country of not using secure comms for commerce would be immense
  • It is often just as easy to attack an end point than it is intercept the comms elsewhere.

In some countries, points 1 & 2 may carry less weight. 1 because they can do what they like without having to worry too much about public opinion. 2 because they centrally control the economy.

As it happens, point 3 is interesting partly because it shows the level of insecurity in modern systems. But even beyond the technology, much of spycraft has always been about manipulating people.

Even so, you will see repeated attempts by the US government (there is one happening right now) to try and add "secure" back-doors to encryption products. There are still far too many - mainly politicians but some spy managers too - who believe that it is possible for technology to create something secure in general use but with a back door that only a limited set of authorised people can access. This is rubbish of course as has been demonstrated time and again. Even if it weren't, who is in control of "authorisation" - obviously that cannot work properly, especially when only 1 country with some seriously vested interests is in charge.

If you are interested in this topic, the website Techdirt often has interesting articles.


In regard to your specific questions:

  • If it is allowed among most government policies (USA, Europe, ...), then does that mean that it is weak enough for specialized attackers to decrypt the data ?

    There is no such thing as perfect security. Well implemented HTTPS is pretty secure but it is hard to implement it properly and easy to get wrong. If attackers cannot get in, they will go round. Realistically, you can only make security too expensive and/or time-consuming to bother with breaking, if someone really wants in, they are likely to eventually do so.

    Of course, if you can slow down an attacker long enough then the value to them generally goes away. But even that is not totally a given. The NSA and others have been gathering a lot of information for a long time. They are probably forced to eventually throw most away due to the cost of storage but information encrypted a few years ago that couldn't easily then be broken can most certainly be now if the desire is there.

  • How long would it take for an expert hacker to find the key ?

    There are other sources for this information, it depends on the implementation but plenty of research is available that will show you how long it takes to break specific implementations.

    Once again though, don't forget that going through a different route (e.g. malware or other hacks on the end points) may well be a lot quicker than trying to directly crack HTTPS.

You should also do a search on "HTTPS vulnerabilities" which will highlight the many and ever changing issues with HTTPS that, in many cases, mean that attackers don't need to brute-force their way into it.

| improve this answer | |
2

Commerce over law enforcement

The current consensus on cryptography is that online encryption that would be safe from common criminals trying to steal your data (for e.g. credit card fraud) is also safe from government attackers, and encryption that's weak enough in structure (as opposed to a "secure" backdoor/MITM) for governments to monitor would be also insecure from common criminals.

Most governments have chosen to allow secure communications, because they believe that the benefits from secure commerce outweigh the loss of ability to easily eavesdrop connections.

Some governments consider the ability to eavesdrop very important, so they take measures that make their citizens less secure also from other attacks.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.