[Cryptography] PRISM-Proofing and PRISM-Hardening

[Eugen Leitl]

----- Forwarded message from ianG <iang@iang.org> -----

Date: Wed, 18 Sep 2013 11:05:46 +0300
From: ianG <iang@iang.org>
To: cryptography@metzdowd.com
Subject: Re: [Cryptography] PRISM-Proofing and PRISM-Hardening
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130801 Thunderbird/17.0.8

On 17/09/13 23:52 PM, John Kemp wrote:
> On Sep 17, 2013, at 2:43 PM, Phillip Hallam-Baker <hallam@gmail.com

>> I am sure there are other ways to increase the work factor.
> 
> I think that "increasing the work factor" would often result in
> switching the kind of "work" performed to that which is easier than
> breaking secrets directly.


Yes, that's the logical consequence & approach to managing risks.
Mitigate the attack, to push attention to easier and less costly
attacks, and then start working on those.

There is a mindset in cryptography circles that we eliminate entirely
the attacks we can, and ignore the rest.  This is unfortunately not
how the real world works.  Most of risk management outside
cryptography is about reducing risks not eliminating them, and
managing the interplay between those reduced risks.  Most unfortunate,
because it leads cryptographers to strange recommendations.


> That may be good. Or it may not.


If other attacks are more costly to defender and easyish for the
attacker, then perhaps it is bad.  But it isn't really a common
approach in our security world to leave open the easiest attack, as
the best alternative.  Granted, this approach is used elsewhere (in
warfare for example, minefields and wire will be laid to channel the
attack).

If we can push an attacker from mass passive surveillance to targetted
direct attacks, that is a huge win.  The former scales, the latter
does not.


> "PRISM-Hardening" seems like a blunt instrument, or at least one which
> may only be considered worthwhile in a particular context (technical
> protection) and which ignores the wider context (in which such technical
> protections alone are insufficient against this particular adversary).


If I understand it correctly, PRISM is or has become the byword for
the NSA's vacuuming of all traffic for mass passive surveillance.  In
which case, this is the first attack of all, and the most damaging,
because it is undetectable, connects you to all your contacts, and
stores all your open documents.

From the position of a systems provider, mass surveillance is possibly
the most important attack to mitigate.  This is because:  we know it
is done to everyone, and therefore it is done to our users, and it
informs every other attack.  For all the other targetted and active
attacks, we have far less certainty about the targetting (user) and
the vulnerability (platform, etc).  And they are very costly, by
several orders of magnitude more than mass surveillance.



iang
_______________________________________________
The cryptography mailing list
cryptography@metzdowd.com
http://www.metzdowd.com/mailman/listinfo/cryptography

----- End forwarded message -----
-- 
Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org
______________________________________________________________
ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org
AC894EC5: 38A5 5F46 A4FF 59B8 336B  47EE F46E 3489 AC89 4EC5
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <http://cpunks.org/pipermail/cypherpunks/attachments/20130920/6d63db99/attachment.sig>