1

I just came across this article. I am confused as to how, save MITM attacks or similar nefarious tactics, anyone can "overcome" PKI, which is founded on the substrate of asymmetric encryption, meaning that no decryption can be done using public keys? I am interested how the "masterminds" of this idea envisioned it be done, perhaps getting a hold of everyone's private key.

My understanding of PKI is fairly basic. Am I missing something?

  • 1
    Have a look into stealing root certificates and installing malicious root certificates. The CCC talk on the logjam attack on export grade SSL is also an interesting direction. – J.A.K. Jan 24 '17 at 18:38
3

That article strikes me as inspecific.

Modernly recognized quality encryption algorithms (e.g. AES which has been scrutinized for almost 20 years now) cannot really be 'backdoored'.

It could be 'cracked', but that would require a famous research breakthrough.

As is typical with mainstream articles, they don't really give us much to go on (unless I missed something) because it doesn't define the context.

In the case of Full Disk Encryption on smartphones and laptops, etc. The designers could decide to use a weaker Derivation function making it more susceptible to Brute Force. Or other built-in vulnerabilities. If that is indeed what the article is referencing, then we could discuss further.

However, the context could be completely different, such as HTTPS/TLS which refers to encryption of data in transit. For this, a compromised CA could be used to achieve MiTM. The website owners could work around this with Public Key Pinning, but I digress.

Without knowing the context, it is difficult to answer in detail. However I would summarize by saying that encryption algorithms cannot be backdoored, but a weak implementation could certainly be used.

As for public site visiting, like HTTPS, there is perhaps more room to fudge around by a) eavesdropping to begin with and b) compromising a CA without telling anybody. Still I think they would get caught if they used this technique frequently?

there is no mathematically possible way to offer an encryption backdoor to law enforcement without weakening that encryption for everybody else

Even not knowing the context, I would probably concur with that statement.

Beyond that I'd say we need to look for a more specific article? Or perhaps Mr. Sessions just doesn't know tech well enough to clarify the How as you are asking.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.