Subject: [perpass] Cops hate encryption but the NSA loves it when you use PGP

From: Dave Crocker <[email-masked]>
Date: Sat, 30 Jan 2016 08:51:11 -0800

Cops hate encryption but the NSA loves it when you use PGP
It lights you up like a Vegas casino, says compsci boffin

By Iain Thomson
Jan 27 2016
<http://www.theregister.co.uk/2016/01/27/nsa_loves_it_when_you_use_pgp/>

Although the cops and Feds wont stop banging on and on about encryption 
– the spies have a different take on the use of crypto.

To be brutally blunt, they love it. Why? Because using detectable 
encryption technology like PGP, Tor, VPNs and so on, lights you up on 
the intelligence agencies' dashboards. Agents and analysts don't even 
have to see the contents of the communications – the metadata is enough 
for g-men to start making your life difficult.

"To be honest, the spooks love PGP," Nicholas Weaver, a researcher at 
the International Computer Science Institute, told the Usenix Enigma 
conference in San Francisco on Wednesdy. "It's really chatty and it 
gives them a lot of metadata and communication records. PGP is the NSA's 
friend."

Weaver, who has spent much of the last decade investigating NSA 
techniques, said that all PGP traffic, including who sent it and to 
whom, is automatically stored and backed up onto tape. This can then be 
searched as needed when matched with other surveillance data.

Given that the NSA has taps on almost all of the internet's major trunk 
routes, the PGP records can be incredibly useful. It's a simple matter 
to build a script that can identify one PGP user and then track all 
their contacts to build a journal of their activities.

Even better is the Mujahedeen Secrets encryption system, which was 
released by the Global Islamic Media Front to allow Al Qaeda supporters 
to communicate in private. Weaver said that not only was it even harder 
to use than PGP, but it was a boon for metadata – since almost anyone 
using it identified themselves as a potential terrorist.

"It's brilliant!" enthused Weaver. "Whoever it was at the NSA or GCHQ 
who invented it give them a big Christmas bonus.”

<snip>

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 30 Jan 2016 18:24:37 +0000

Anyone got a link to Nick's slides/paper?

S.

On 30/01/16 16:51, Dave Crocker wrote:
> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass

---

From: Hugo Connery <[email-masked]>
Date: Sat, 30 Jan 2016 19:56:51 +0100

Hi,

Thanks Dave Crocker for posting this.  It is useful to know
who is running the standard anti-crypto arguments, and when.

"You stand out like a sore thumb and they (archive it forever,
focus on you more, ...)" goes with "only the 4 horsemen of the
infopocalypse use encryption" as one of the standard arguments.

Regards,  Hugo Connery

> – the spies have a different take on the use of crypto.
<snip standard anti-crypto argument>

---

From: "Matthijs R. Koot" <[email-masked]>
Date: Sat, 30 Jan 2016 19:32:30 -0000

Hi Stephen,

> Anyone got a link to Nick's slides/paper?

Slides (38MB .pdf):
http://www1.icsi.berkeley.edu/~nweaver/enigma_weaver.key.pdf

Paper: does not exist (
https://twitter.com/ncweaver/status/693516094003281920 ).

Video (20 min): https://www.youtube.com/watch?v=zqnKdGnzoh0

Regards,
Matthijs

---

From: Nicholas Weaver <[email-masked]>
Date: Sat, 30 Jan 2016 11:52:52 -0800

> On Jan 30, 2016, at 11:32 AM, Matthijs R. Koot <[email-masked]> wrote:
> 
> Hi Stephen,
> 

And how the NSA can rip through PGP (like we know they rip through MS2)

https://medium.com/@nweaver/extra-unofficial-xkeyscore-guide-b8513600ad24#.83bkhqx1v

--
Nicholas Weaver                  it is a tale, told by an idiot,
[email-masked]                full of sound and fury,
510-666-2903                                 .signifying nothing
PGP: http://www1.icsi.berkeley.edu/~nweaver/data/nweaver_pub.asc

---

From: Robin Wilton <[email-masked]>
Date: Sun, 31 Jan 2016 12:12:26 +0000

It's a good piece by Dave. It won't change my intention of using more crypto, though, for a few reasons:

1 - regardless of archival and possible decryption by spooks, encryption will still help protect some of my data against some other threats*;

2 - the fact that I'm encrypting my traffic doesn't mean there's anything sensitive in it. In fact, it would be rather silly of me to only encrypt the particularly confidential parts;

3 - as Dave and some of the commenters note, the real benefit here comes when encryption becomes pervasive enough that encrypted traffic no longer sticks out like the proverbial sore thumb.

*NB - that is still a rather cautious statement of benefit; I have intentionally qualified it in three ways:

- encryption only helps protect data, it doesn't guarantee it's safety. For instance, for communications, I want the other party to read what I sent them! They will decrypt it, and at that point any confidentiality of the data has to rely on other factors.

- I can't realistically encrypt all my traffic. Some of the apps, devices and services I want to use don't support encryption, and/or don't tell me if they encrypt traffic. Nor can I realistically encrypt my metadata; fixing things so that metadata, social graphs and traffic analysis reveal less information about me is a hard problem, and one I don't really have the resources, tools or rigour to solve.

- Encryption (whether for confidentiality or integrity) doesn't help much against threats like malware (Trojans, key-loggers), tracking (pixel beacons, non-browser cookies), denial of service attacks, etc.. But then again, *not* using crypto doesn't keep me any safer against those either.

That may all sound very pessimistic, but if Snowden has taught us anything, it is that pessimism is justified at every level in this context - from the hardware up, and at every network node (device, domestic router, commercial/telco router, backbone, data centre, etc etc).

Robin Wilton

Technical Outreach Director - Identity and Privacy

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 31 Jan 2016 18:53:15 +0000

Hi Nick,

I had a look at the slides and while it's hard to know
from just those, I didn't see too much that was new in
that so far. But maybe when you build some n/w monitoring
kit there may be more to report.

As far as using PGP goes, I'm nowhere near as pessimistic
as it you appear to be (from the slides). Given that much
SMTP is now transmitted over TLS, I think the opportunity
for the likes of NSA to record all the PGP ciphertext has
to be have been significantly diminished. (They can still
do it since much SMTP/TLS is still opportunistic but I hope
the significant transitions we have already seen from cleartext
to opportunistic ciphertext to mutually-authenticated
ciphertext continues to evolve in the right direction.)

And there is work on PGP being done now in the revived PGP
WG [1] - while that is starting with modest goals, (to just
update crypto), if that goes well, then there are some folks
who'd love to try extend the work to address the real issues
that exist with exposed non-body content. (I'm not calling it
meta-data, as there's really sooooo much in the envelope that
it's more than meta-data). I am sure that your (and other's)
assistance with that work would very much be appreciated.

So my take-aways here are:

- it'd be great if folks worked on measuring the proportion
and kind(s) of plain and ciphertext leaving/entering their
networks and developing tooling to help us figure out what
is a good next target to try to protect - reports on that
would be really interesting to see on this list

- more work on interpersonal messaging is needed, (e.g. with
PGP, but not only that), and any of us can help with that
simply by doing it.

Cheers,
S.

[1] http://tools.ietf.org/wg/openpgp

---

From: Dave Crocker <[email-masked]>
Date: Sun, 31 Jan 2016 11:03:29 -0800

On 1/31/2016 10:53 AM, Stephen Farrell wrote:
> Given that much
> to be have been significantly diminished.

This depends on the degree of cooperation they get from operators, since 
TLS is only for one hop and the messages is in the clear at any 
SMTP-level transit points.

d/

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 31 Jan 2016 19:13:29 +0000

> SMTP-level transit points.

Sure. OTOH, it also means that the PGP ciphertext can no longer
be as easily extracted from almost any network tap, which used
be the case. And (absent an attacker) doesn't most mail these
days only tend to transit the public Internet in one hop? My point
is not that the current situation is perfect (it is not) but that
it is improving and vastly improved on what we had deployed that
got used 3 years ago. (IOW, I'm an optimist but hopefully not a
fansasticist:-)

S.

---

From: Paul Kyzivat <[email-masked]>
Date: Sun, 31 Jan 2016 15:23:19 -0500

On 1/30/16 11:51 AM, Dave Crocker wrote:

> Even better is the Mujahedeen Secrets encryption system,

I guess they wouldn't like it so much if Apple started using it for 
*all* communications by Apple devices.

	Thanks,
	Paul

---

From: Hugo Maxwell Connery <[email-masked]>
Date: Sun, 31 Jan 2016 22:19:34 +0000

Hi,

Out of rare curiosity I actually read the comments to the 
article.  The take out was that people are both generally
pissed off about all the mass surveillance, and they
were proposing/suggesting/arguing various reasonably
considered response arguments.

Of course there was a bit of flaming, but I was rather 
satisfied to see a collection of reasonable
responses to the "encryption is dangerous"
contents of the article.

Of note was the general complaint that the site only uses http.

So, whilst the tech community does its best to respond to
the challenge of human rights abusing mass surveillance,
some parts of the general community are learning/thinking
about the problem and conversing about it.

This, I take as the most positive part of this standard
"encryption is bad" rubbish.

Regards,  Hugo