There's an old saying in Security... "if you think encryption is the answer, you might not have understood the question". I never liked the tone of that statement because it sounds kind of elitist, but it is basically true. And that's because encryption is very confusing.
Encrypting data is great because it means it can't read by unauthorized people. And that is the trick... how to let the right people in and keep the wrong people out. If my encrypted data is unreadable by anyone then that's called Ransomware!
Encrypting my data so only I can read it is pretty easy. It means that only I need the "key". Of course, I better not loose that key! Encrypting my data so I can share it with you is also pretty easy. We just need a "shared secret". If I need to share my data with a bunch of people then we get into something called "public key cryptography". Here's a good explanation of that.
Encryption is basically a solved problem. Because math. #math. There are many great algorithms with cool names like Elliptic Curve, RSA and Two-Fish.
There are four main ways that an encryption product can distinguish itself. Each of these help make it harder to brake the code through brute force. Ultimately, our goal is to make our encryption more costly to brake (cost as in it would take a lot of computing power and a lot of time - similar to making our house harder to break into than another house by having multiple locks, alarms and puppies!):- key length - a long key creates more possible choices making it too hard for someone to guess how things are encrypted. It's kind of like how long passwords are harder to guess.
- repetitions - it's like encrypting the encryption, but you can do that 1000s of times.
- salting - just a little "tweak" how the encryption algorithm is started.
- key protection - you can't keep the key next to the lock!
But the algorithm must always be a known standard. It's the math. Then, the key length, repetitions and salting add the extra differentiation so that no two implementations are exactly the same.
We have problems when companies or individuals try to write their own encryption algorithms. It's hard and when individuals try to write custom encryption they almost always get it wrong. It's the math... and it's hard. When they get it wrong we end up with encryption that is easily broken.
We have problems when companies or individuals try to write their own encryption algorithms. It's hard and when individuals try to write custom encryption they almost always get it wrong. It's the math... and it's hard. When they get it wrong we end up with encryption that is easily broken.
I've covered how passwords and encryption works so I won't go into it again here, but you can read about it in these previous posts.
Hopefully you now see that encryption is pretty complicated. That we need to stick with the proven math and use standardized encryption algorithms tweaked with long key length, repetitions and salting. And that custom encryption usually doesn't hold up under attack.
But there's another key way we can get stuck with broken encryption... and that's by creating "back doors". A backdoor is a built-in way to get into a system. For encryption algorithms, it means creating a "hidden" way for law enforcement, government, or other "authorized" people to bypass the encryption. The problem is... wait for it... Math! If there's a way around the encryption then there's a way around the encryption. It can't be just for a chosen few. If there's a way, the attackers will find it. If encryption algorithms are created with (or mandated to have) back doors, then nothing encrypted with that code is safe.
I'm all for helping law enforcement. But you can't break the laws of mathematics! It's not politics... it's math!
One final comment on the Apple v DoJ issues, sometimes called "FBiOS". That's when Apple refused to create a method to decrypt an iPhone 4 used by one of the San Bernadino shooters. In this case, Apple was saying that, because math, they could not decrypt the one phone without putting information on all phones in danger. But because of their encryption implementation on the iPhone 4, they actually could have.
What do you think about the encryption issues? Would you like to learn more? Or is it just too much math? :-)
Hopefully you now see that encryption is pretty complicated. That we need to stick with the proven math and use standardized encryption algorithms tweaked with long key length, repetitions and salting. And that custom encryption usually doesn't hold up under attack.
But there's another key way we can get stuck with broken encryption... and that's by creating "back doors". A backdoor is a built-in way to get into a system. For encryption algorithms, it means creating a "hidden" way for law enforcement, government, or other "authorized" people to bypass the encryption. The problem is... wait for it... Math! If there's a way around the encryption then there's a way around the encryption. It can't be just for a chosen few. If there's a way, the attackers will find it. If encryption algorithms are created with (or mandated to have) back doors, then nothing encrypted with that code is safe.
I'm all for helping law enforcement. But you can't break the laws of mathematics! It's not politics... it's math!
One final comment on the Apple v DoJ issues, sometimes called "FBiOS". That's when Apple refused to create a method to decrypt an iPhone 4 used by one of the San Bernadino shooters. In this case, Apple was saying that, because math, they could not decrypt the one phone without putting information on all phones in danger. But because of their encryption implementation on the iPhone 4, they actually could have.
What do you think about the encryption issues? Would you like to learn more? Or is it just too much math? :-)
No comments:
Post a Comment