Bitcoin Forum
May 06, 2024, 01:37:02 PM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: « 1 [2] 3 4 5 »  All
  Print  
Author Topic: SHA-256 is designed by the NSA - do they have a backdoor?  (Read 27760 times)
ShadowOfHarbringer
Legendary
*
Offline Offline

Activity: 1470
Merit: 1005


Bringing Legendary Har® to you since 1952


View Profile
September 10, 2013, 08:45:35 AM
 #21

The algorithm is open ... however it was produced by a politically motivated rogue government branch that seems to harbouring a cynical bunch of criminal bastards ... do your own due diligence, if you don't have to deal with them why bother?
Don't forget that the Internet and TOR were also started by the US military.
Just the fact that they did something does not mean that they still have control over it.

Edit: oops, forgot to point out that the NSA algos flaws/backdoors will be tailored towards cracking by hardware capabilities that they , and maybe only them, possess. So saying it is secure because no-one else has found a flaw is redundant since no-one else knows or can replicate what they are capable of in terms of mining the exploit ...
Flaws in one of most widely used algos would be quickly found by NSA's/USA enemies - such as China and Russia (Russia/China have some of the world brightest mathematicans & cryptographers).
Especially after the Prism scandal.

Hiding something like this is simply not possible in after-Prism paranoia world.

1715002622
Hero Member
*
Offline Offline

Posts: 1715002622

View Profile Personal Message (Offline)

Ignore
1715002622
Reply with quote  #2

1715002622
Report to moderator
"Governments are good at cutting off the heads of a centrally controlled networks like Napster, but pure P2P networks like Gnutella and Tor seem to be holding their own." -- Satoshi
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
1715002622
Hero Member
*
Offline Offline

Posts: 1715002622

View Profile Personal Message (Offline)

Ignore
1715002622
Reply with quote  #2

1715002622
Report to moderator
Jace
Sr. Member
****
Offline Offline

Activity: 288
Merit: 251


View Profile
September 10, 2013, 08:51:07 AM
 #22

NSA can afford to hire the best mathematicians. Nowadays when one of them devises something only a few people are able to understand the mathematical proof it's based on. A flaw could exist for decades/centuries before someone else find it by accident.
It could, yes, hypothetically. But it's extremely unlikely. Chances are slim to none. There is a much, MUCH larger group of extremely talented mathematicians out there than the NSA has employed.

Oh, and in the VERY unlikely (and purely theoretical) scenario that the NSA does indeed have some sort of edge on SHA-256, we can still keep our peace of mind knowing that fortunately, Bitcoin uses double (nested) SHA-256.

Feel free to send your life savings to 1JhrfA12dBMUhcgh85wYan6HL2uLQdB6z9
Galahad
Full Member
***
Offline Offline

Activity: 190
Merit: 100


View Profile
September 10, 2013, 09:07:05 AM
 #23

They already had this discussion in newbies. But there were articles on the Guardian and why would the NSA lie in their own documents? It's a bit worrying. Perhaps they have not cracked the cryptography but found around it on poorly managed servers:

http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security
miztaziggy
Sr. Member
****
Offline Offline

Activity: 432
Merit: 500


View Profile
September 10, 2013, 11:20:20 AM
 #24

Why is everyone so certain that the 'entire world community' has looked at this encryption and hasn't found a flaw?

I don't understand the mathematics in this but:
http://eprint.iacr.org/2008/270.pdf

Now, this looks like it's been done by a university in India.

My guess is that the NSA and other world intelligence agencies employ the very best of the best mathematicians. They will scour universities and pick up the top students early on. Their work won't be published like this was. It will be kept secret and the world will think that it's secure.

Why would the NSA ever release a 'secure' algorithm? It's like shooting yourself in the foot, it would make their job so much harder. They would only ever release something that they could control. It's just the way the world works.

 *Image Removed*
Galahad
Full Member
***
Offline Offline

Activity: 190
Merit: 100


View Profile
September 10, 2013, 12:38:46 PM
 #25

Why would the NSA ever release a 'secure' algorithm? It's like shooting yourself in the foot, it would make their job so much harder. They would only ever release something that they could control. It's just the way the world works.

Because it's public domain and the best experts in cryptography in the world have worked on it, tested it and found no flaw. Also, the NSA themselves rely on this encryption, do they want their secrets revealed?
miztaziggy
Sr. Member
****
Offline Offline

Activity: 432
Merit: 500


View Profile
September 10, 2013, 12:56:59 PM
 #26

Why would the NSA ever release a 'secure' algorithm? It's like shooting yourself in the foot, it would make their job so much harder. They would only ever release something that they could control. It's just the way the world works.

Because it's public domain and the best experts in cryptography in the world have worked on it, tested it and found no flaw. Also, the NSA themselves rely on this encryption, do they want their secrets revealed?

Are you really that naive?

 *Image Removed*
Galahad
Full Member
***
Offline Offline

Activity: 190
Merit: 100


View Profile
September 10, 2013, 01:18:15 PM
 #27

Are you really that naive?

Do you underestimate the brightest minds in the world? Do you believe that the minds in the NSA are somehow brighter than those outside of it?
DeathAndTaxes
Donator
Legendary
*
Offline Offline

Activity: 1218
Merit: 1079


Gerald Davis


View Profile
September 10, 2013, 01:31:10 PM
 #28

By the way: What might have been the reason that Mr. Nakamoto decided to use an NSA algorithm (SHA-256) for Bitcoin?

The same reason that banks, the US government, foreign governments, millions of websites, the SSL protocol, PGP, and other secure systems use it.
It is the most widely studied and analyzed algorithms in the last twenty years.  It has held up to extensive public scrutiny and been shown to be a strong hashing function.

DeathAndTaxes
Donator
Legendary
*
Offline Offline

Activity: 1218
Merit: 1079


Gerald Davis


View Profile
September 10, 2013, 01:39:40 PM
 #29

Why would the NSA ever release a 'secure' algorithm? It's like shooting yourself in the foot, it would make their job so much harder. They would only ever release something that they could control. It's just the way the world works.

Because you can never definitively prove a cryptographic system is secure.  The only way to "know" a cipher is secure is to make it publicly available and let the best in the world take a crack at it.  It is very easy to write a cryptographic system that you yourself can't break but that is next to useless.  Secret cryptography usually is weak cryptography.  History is littered with examples of failed "strong" systems.  One classic one is WEP which is so unbelievably broken it is hard to believe cryptographers came up with it.  Security through obscurity doesn't work.  Had the specs for WEP been made publicly available in the design phase people would have found the flaws in a matter of weeks and saved everyone a ton of problems down the road.  For every good cipher there are dozens and dozens of flawed ones.  No matter how smart a single developer is the combined intellect of the planet is better, that is the entire rationale for open source.  The NSA is not only responsible for finding the secrets of others they are responsible for ensuring others don't find the secrets of the United States. 

The US government uses SHA-2 in secure cryptographic systems including SIPERNet.  I know this from personal experience.
ShadowOfHarbringer
Legendary
*
Offline Offline

Activity: 1470
Merit: 1005


Bringing Legendary Har® to you since 1952


View Profile
September 10, 2013, 01:51:35 PM
 #30

Why would the NSA ever release a 'secure' algorithm? It's like shooting yourself in the foot, it would make their job so much harder. They would only ever release something that they could control. It's just the way the world works.

Because you can never definitively prove a cryptographic system is secure.  The only way to "know" a cipher is secure is to make it publicly available and let the best in the world take a crack at it.  It is very easy to write a cryptographic system that you yourself can't break but that is next to useless.  Secret cryptography usually is weak cryptography.  History is littered with examples of failed "strong" systems.  One classic one is WEP which is so unbelievably broken it is hard to believe cryptographers came up with it.  Security through obscurity doesn't work.  Had the specs for WEP been made publicly available in the design phase people would have found the flaws in a matter of weeks and saved everyone a ton of problems down the road.  For every good cipher there are dozens and dozens of flawed ones.  No matter how smart a single developer is the combined intellect of the planet is better, that is the entire rationale for open source.  The NSA is not only responsible for finding the secrets of others they are responsible for ensuring others don't find the secrets of the United States.  

This is probably the most wise & complete explanation of "why there is no backdoor in SHA-2" that we will come up with here.

This topic could be now closed for all I care.

miztaziggy
Sr. Member
****
Offline Offline

Activity: 432
Merit: 500


View Profile
September 10, 2013, 01:53:22 PM
 #31

Are you really that naive?

Do you underestimate the brightest minds in the world? Do you believe that the minds in the NSA are somehow brighter than those outside of it?

So what evidence do you have that the brightest minds in the world are not in these government agencies?

A friend of mine's son has studied maths at Cambridge in the UK, he is now doing a PHD over in the US at MIT. She had her son's friend stay with her over the holiday, and told me that this girl was also studying for a PHD also. This girl is apparently ridiculously intelligent, to the point of being autistic, she has no social skills. She has already been approached by GCHQ and has done a summer placement there. She has been offered a place after completing her PHD.

That's what happens in the real world, these ultra bright kids will be snapped up by places like GCHQ and NSA before they are 21, but, this forum is just like a hollow box where you all like to shout about the positives of bitcoin without ever considering the real world, so I guess none of this matters.

 *Image Removed*
Galahad
Full Member
***
Offline Offline

Activity: 190
Merit: 100


View Profile
September 10, 2013, 02:46:47 PM
 #32

So what evidence do you have that the brightest minds in the world are not in these government agencies?

They will also be working in the open source community rather than exclusively in one place because they are passionate about the subject.

Why would the NSA ever release a 'secure' algorithm? It's like shooting yourself in the foot, it would make their job so much harder. They would only ever release something that they could control. It's just the way the world works.

Because you can never definitively prove a cryptographic system is secure.  The only way to "know" a cipher is secure is to make it publicly available and let the best in the world take a crack at it.  It is very easy to write a cryptographic system that you yourself can't break but that is next to useless.  Secret cryptography usually is weak cryptography.  History is littered with examples of failed "strong" systems.  One classic one is WEP which is so unbelievably broken it is hard to believe cryptographers came up with it. Security through obscurity doesn't work. Had the specs for WEP been made publicly available in the design phase people would have found the flaws in a matter of weeks and saved everyone a ton of problems down the road.  For every good cipher there are dozens and dozens of flawed ones.  No matter how smart a single developer is the combined intellect of the planet is better, that is the entire rationale for open source.  The NSA is not only responsible for finding the secrets of others they are responsible for ensuring others don't find the secrets of the United States.

This is probably the most wise & complete explanation of "why there is no backdoor in SHA-2" that we will come up with here.

This topic could be now closed for all I care.

Thank you. I couldn't properly express why he was wrong so I was waiting for more sane people to get here. Please close topic!
cypherdoc
Legendary
*
Offline Offline

Activity: 1764
Merit: 1002



View Profile
September 10, 2013, 02:47:04 PM
 #33

Why would the NSA ever release a 'secure' algorithm? It's like shooting yourself in the foot, it would make their job so much harder. They would only ever release something that they could control. It's just the way the world works.

Because you can never definitively prove a cryptographic system is secure.  The only way to "know" a cipher is secure is to make it publicly available and let the best in the world take a crack at it.  It is very easy to write a cryptographic system that you yourself can't break but that is next to useless.  Secret cryptography usually is weak cryptography.  History is littered with examples of failed "strong" systems.  One classic one is WEP which is so unbelievably broken it is hard to believe cryptographers came up with it.  Security through obscurity doesn't work.  Had the specs for WEP been made publicly available in the design phase people would have found the flaws in a matter of weeks and saved everyone a ton of problems down the road.  For every good cipher there are dozens and dozens of flawed ones.  No matter how smart a single developer is the combined intellect of the planet is better, that is the entire rationale for open source.  The NSA is not only responsible for finding the secrets of others they are responsible for ensuring others don't find the secrets of the United States. 

The US government uses SHA-2 in secure cryptographic systems including SIPERNet.  I know this from personal experience.

i agree with this.

miztaziggy
Sr. Member
****
Offline Offline

Activity: 432
Merit: 500


View Profile
September 10, 2013, 02:55:10 PM
 #34

So what evidence do you have that the brightest minds in the world are not in these government agencies?

They will also be working in the open source community rather than exclusively in one place because they are passionate about the subject.



Really? What world do you live in where employees of the NSA and GCHQ can moonlight in the open source community and spread state secrets around for the users of the bitcoin forum to read?

And as for being passionate about the subject, I expect that when you're working on the inside of an agency like that and are in the know when it comes to the real threats in this world, you would probably be on the side of these agencies that do the work they do.

 *Image Removed*
cypherdoc
Legendary
*
Offline Offline

Activity: 1764
Merit: 1002



View Profile
September 10, 2013, 02:57:52 PM
 #35

The algorithm is open ... however it was produced by a politically motivated rogue government branch that seems to harbouring a cynical bunch of criminal bastards ... do your own due diligence, if you don't have to deal with them why bother?
Don't forget that the Internet and TOR were also started by the US military.
Just the fact that they did something does not mean that they still have control over it.

Edit: oops, forgot to point out that the NSA algos flaws/backdoors will be tailored towards cracking by hardware capabilities that they , and maybe only them, possess. So saying it is secure because no-one else has found a flaw is redundant since no-one else knows or can replicate what they are capable of in terms of mining the exploit ...
Flaws in one of most widely used algos would be quickly found by NSA's/USA enemies - such as China and Russia (Russia/China have some of the world brightest mathematicans & cryptographers).
Especially after the Prism scandal.

Hiding something like this is simply not possible in after-Prism paranoia world.

and don't forget that the NSA relies on it's operatives going into harms way into foreign and hostile areas.

you now have to imagine a scenario where they lie to them, and have the operatives allow themselves to be lied to, and say all their communications will continue to be safe and secure so continue doing what you're doing?  either way, the NSA has suffered irreparable damage as a result of these so called revelations.  

i prefer the simplest explanation and that is to continue to believe that the Internet is ripping open age-old secrets and increasing the dissemination of the truth.  to expect one US centric organization to be able to buck that trend over the long term is not viable, imo.
cypherdoc
Legendary
*
Offline Offline

Activity: 1764
Merit: 1002



View Profile
September 10, 2013, 03:10:41 PM
 #36

if open source is so insecure, why are all these gov't agencies using it including the NSA itself via SELinux?  i think the same can be said of SHA 1&2:

http://en.wikipedia.org/wiki/List_of_Linux_adopters

Government

As local governments come under pressure from institutions such as the World Trade Organization and the International Intellectual Property Alliance, some have turned to Linux and other Free Software as an affordable, legal alternative to both pirated software and expensive proprietary computer products from Microsoft, Apple and other commercial companies. The spread of Linux affords some leverage for these countries when companies from the developed world bid for government contracts (since a low-cost option exists), while furnishing an alternative path to development for countries like India and Pakistan that have many citizens skilled in computer applications but cannot afford technological investment at "First World" prices.

    In July 2001[1] the White House started moving their computers to a Linux platform based on Red Hat Linux and Apache HTTP Server.[2] The installation was completed in February 2009.[3][4] In October 2009 the White House servers adopted Drupal, an open source content management system software distribution.[5][6]
    Brazil uses PC Conectado, a program utilizing Linux.
    The City government of Munich chose in 2003 to start to migrate its 14,000 desktops to Debian-based LiMux.[7] Even though more than 80% of workstations used OpenOffice and 100% used Firefox/Thunderbird five years later (November 2008),[8] an adoption rate of Linux itself of only 20.0% (June 2010) was achieved.[9][10] The effort was later reorganized, focusing on smaller deployments and winning over staff to the value of the program. By the end of 2011 the program had exceeded its goal and changed over 9000 desktops to Linux.[11] The city of Munich reported at the end of 2012 that the migration to Linux was highly successful and has already saved the city over €11 million (US$14 million).[12]
    The United States Department of Defense uses Linux - "the U.S. Army is “the” single largest install base for Red Hat Linux"[13] and the US Navy nuclear submarine fleet runs on Linux.[14]
    The city of Vienna has chosen to start migrating its desktop PCs to Debian-based Wienux.[15] However, the idea was largely abandoned, because the necessary software was incompatible with Linux.[16]
    Spain was noted as the furthest along the road to Linux adoption in 2003,[17] for example with Linux distribution LinEx
    State owned Industrial and Commercial Bank of China (ICBC) is installing Linux in all of its 20,000 retail branches as the basis for its web server and a new terminal platform. (2005) [18]
    In April 2006, the US Federal Aviation Administration announced that it had completed a migration to Red Hat Enterprise Linux in one third of the scheduled time and saved 15 million dollars.[19][dead link]
    The Government of Pakistan established a Technology Resource Mobilization Unit in 2002 to enable groups of professionals to exchange views and coordinate activities in their sectors and to educate users about free software alternatives. Linux is an option for poor countries which have little revenue for public investment; Pakistan is using open source software in public schools and colleges, and hopes to run all government services on Linux eventually.
    The French Parliament has switched to using Ubuntu on desktop PCs.[20][21]
    The Federal Employment Office of Germany (Bundesagentur für Arbeit) has migrated 13,000 public workstations from Windows NT to OpenSuse.[22]
    Czech Post migrated 4000 servers and 12,000 clients to Novell Linux in 2005[23][24]
    Cuba - Students from the Cuban University of Information Science launched its own distribution of Linux called Nova to promote the replace of Microsoft Windows on civilian and government computers, a project that is now supported by the Cuban Government. By early 2011 the Universidad de Ciencias Informáticas announced that they would migrate more than 8000 PCs to this new operating system.[25][26][27]
    The Canton of Solothurn in Switzerland decided in 2001 to migrate its computers to Linux, but in 2010 the Swiss authority has made a U-turn by deciding to use Windows 7 for desktop clients.[28]
    France's national police force, the National Gendarmerie started moving their 90,000 desktops from Windows XP to Ubuntu in 2007 over concerns about the additional training costs of moving to Windows Vista, and following the success of OpenOffice.org roll-outs. The migration should be completed by 2015. The force has saved about €50 million on software licensing between 2004 and 2008.[29][30][31]
    France's Ministry of Agriculture uses Mandriva Linux.[31]
    Macedonia's Ministry of Education and Science deployed more than 180,000 Ubuntu based classroom desktops, and has encouraged every student in the Republic of Macedonia to use Ubuntu computer workstations.[32]
    The People's Republic of China exclusively uses Linux as the operating system for its Loongson processor family, with the aim of technology independence.[33]
    The US National Nuclear Security Administration operates the world's tenth fastest supercomputer, the IBM Roadrunner, which uses Red Hat Enterprise Linux along with Fedora as its operating systems.[34]
    The regional Andalusian Autonomous Government of Andalucía in Spain developed its own Linux distribution, called Guadalinex in 2004.[35]
    The South African Social Security Agency (SASSA) deployed Multi-station Linux Desktops to address budget and infrastructure constraints in 50 rural sites.[36]
    In 2003, the Turkish government decided to create its own Linux distribution, Pardus, developed by UEKAE (National Research Institute of Electronics and Cryptology). The first version, Pardus 1.0, was officially announced in 27 December 2005.[37]
    In 2010 The Philippines fielded an Ubuntu-powered national voting system.[38]
    In July 2010 Malaysia had switched 703 of the state's 724 agencies to Free and Open Source software with a Linux based operating system used.[39] The Chief Secretary to the Government cited, "(the) general acceptance of its promise of better quality, higher reliability, more flexibility and lower cost".[40]
    In late 2010 Vladimir Putin signed a plan to move the Russian Federation government towards free software including Linux in the second quarter of 2012.[41][42]
    The city government of Largo, Florida, USA uses Linux and has won international recognition for their implementation, indicating that it provides "extensive savings over more traditional alternatives in city-wide applications."[43]
    Iceland has announced in March 2012 that it wishes to migrate to open source software in public institutions. Schools have already migrated from Windows to Ubuntu Linux.[44]
    In June 2012 the US Navy signed a US$27,883,883 contract with Raytheon to install Linux ground control software for its fleet of vertical take-off and landing (VTOL) Northrup-Grumman MQ8B Fire Scout drones. The contract involves Naval Air Station Patuxent River, Maryland, which has already spent $5,175,075 in preparation for the Linux systems.[45]
    In 2004 Venezuela's government approved the 3390 decree,[46] to give preference to using free software in public administration. One result of this policy is the development of Canaima, a Deban-based Linux distribution.
Zangelbert Bingledack
Legendary
*
Offline Offline

Activity: 1036
Merit: 1000


View Profile
September 10, 2013, 03:16:03 PM
 #37

I have a sneaking suspicion that the NSA's alleged superpowers are overrated. Maybe they once were way ahead of the curve back when crypto was a nerd curiosity. But now? In 2013, when the whole world understands the importance of crypto and scads of people are interested in it, including hackers who stand to become fabulously wealthy if they could find a flaw? I just don't buy it. More likely the government just wants people to think there's no point in using cryptography.
Galahad
Full Member
***
Offline Offline

Activity: 190
Merit: 100


View Profile
September 10, 2013, 03:28:20 PM
 #38

I won't be following this topic now as I want to avoid an irrational troll. The only thing which could add to this discussion now for me would be an explanation of what they have cracked.
Xiaoma
Full Member
***
Offline Offline

Activity: 133
Merit: 100


View Profile
September 10, 2013, 03:56:05 PM
 #39

By the way: What might have been the reason that Mr. Nakamoto decided to use an NSA algorithm (SHA-256) for Bitcoin?

There are more than a few hints that Mr Nakamoto himself (themselves) may be linked to NSA. just saying...
DeathAndTaxes
Donator
Legendary
*
Offline Offline

Activity: 1218
Merit: 1079


Gerald Davis


View Profile
September 10, 2013, 04:19:51 PM
 #40

By the way: What might have been the reason that Mr. Nakamoto decided to use an NSA algorithm (SHA-256) for Bitcoin?

There are more than a few hints that Mr Nakamoto himself (themselves) may be linked to NSA. just saying...

A cite?  The only comments I remember is when Gavin went to CIA for a presentation on Bitcoin, Satoshi wasn't interested.
Pages: « 1 [2] 3 4 5 »  All
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!