I have read this article about the revelation that in 2010 major encryption mechanisms including big four (hotmail, facebook, google, yahoo) and other encryption mechanisms were broken by NSA and GCHQ.

The agencies have not yet cracked all encryption technologies, however, the documents suggest. Snowden appeared to confirm this during a live Q&A with Guardian readers in June. "Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on," he said before warning that NSA can frequently find ways around it as a result of weak security on the computers at either end of the communication.


For at least three years, one document says, GCHQ, almost certainly in close collaboration with the N.S.A., has been looking for ways into protected traffic of the most popular Internet companies: Google, Yahoo, Facebook and Microsoft’s Hotmail. By 2012, GCHQ had developed “new access opportunities” into Google’s systems, according to the document.




My question is, what does Edward Snowden mean by Properly implemented strong crypto systems.

Could some IT security professional explain that to me a little more? What crypto systems does he think about?

1 Answer 1


By "properly implemented strong crypto systems" he means "cryptographic systems in which the design or the implementation was neither unwillingly weakened through designer/implementer incompetence, nor willingly weakened through deliberate alterations".

NSA/GCHQ did not break encryption mechanisms; they bribed (or otherwise forced) the designers, implementers and providers of some cryptographic systems into adding backdoors for them to use. Backdoors can be deliberately weak design elements, data leakage... my favourite is poor PRNG, because such alterations can be disguised as incompetence (e.g. the rumours on OpenBSD a few years ago).

A properly implemented strong crypto system is a system:

  • which is strong, i.e. whose design has been done according to the state-of-the-art and can be argued to "look solid" (subject to the usual caveat that "you cannot test for security");
  • whose implementation was not botched in some way.

For the first point, this mostly means: complies with standards which have been published for quite some years, and for which cryptographers have not found anything bad to say (or anything that could not be fixed), but still got interested in it. E.g. SSL/TLS or OpenPGP. For the second point, this mostly means open-source, with reasons to believe that "many eyes" have gone through the code; e.g. OpenSSL or GnuPG.

  • Btw. SSL have been already broken by NSA/GCHQ. The mechanism is not known yet, but Spiegel.de has written an article on that today. Sep 6, 2013 at 17:02
  • 3
    Everybody wrote an article on that today, and most of them got it wrong. They all derive such "information" from some quotes of Edward Snowden who, explicitly, denies exactly that. Sep 6, 2013 at 17:38

Not the answer you're looking for? Browse other questions tagged .