{"id":36851,"date":"2013-09-07T20:27:14","date_gmt":"2013-09-08T03:27:14","guid":{"rendered":"http:\/\/www.cryptogon.com\/?p=36851"},"modified":"2013-09-07T20:27:14","modified_gmt":"2013-09-08T03:27:14","slug":"is-nsa-dropping-its-own-versions-of-open-source-encryption-software-onto-the-wire-as-we-download-them","status":"publish","type":"post","link":"https:\/\/www.cryptogon.com\/?p=36851","title":{"rendered":"Is NSA Dropping Its Own Versions of Open Source Encryption Software Onto the Wire As We Download Them?"},"content":{"rendered":"

Hijacking the stream and substituting the content?<\/p>\n

Trivial. I used to do this for fun on wi-fi networks last decade. Definitely trivial.<\/p>\n

But what I don’t get is how the downloads would pass hash checks?<\/p>\n

For example, you can check GPG’s SHA-1 values here<\/a>.<\/p>\n

What’s SHA-1<\/a>, you ask?<\/p>\n

In cryptography, SHA-1 is a cryptographic hash function designed by the United States National Security Agency and published by the United States NIST as a U.S. Federal Information Processing Standard.<\/p>\n

…<\/p>\n

In 2005, cryptanalysts found attacks on SHA-1 suggesting that the algorithm might not be secure enough for ongoing use. NIST required many applications in federal agencies to move to SHA-2 after 2010 because of the weakness.<\/p><\/blockquote>\n

Oh.<\/p>\n

Via: Bruce Schneier<\/a>:<\/p>\n

How Far \u2022 September 5, 2013 4:22 PM<\/p>\n

Could the NSA be intercepting downloads of open-source encryption software and silently replacing these with their own versions? Is there any way to detect such interference had the NSA enough control over communications channels to automatically replace binaries and published hash lists?<\/p>\n

Bruce Schneier \u2022 September 5, 2013 4:35 PM<\/p>\n

“Could the NSA be intercepting downloads of open-source encryption software and silently replacing these with their own versions?”<\/p>\n

Yes, I believe so.<\/strong><\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Hijacking the stream and substituting the content? Trivial. I used to do this for fun on wi-fi networks last decade. Definitely trivial. But what I don’t get is how the downloads would pass hash checks? For example, you can check GPG’s SHA-1 values here. What’s SHA-1, you ask? In cryptography, SHA-1 is a cryptographic hash […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27,22,4,12],"tags":[],"class_list":["post-36851","post","type-post","status-publish","format-standard","hentry","category-covert-operations","category-dictatorship","category-surveillance","category-technology"],"_links":{"self":[{"href":"https:\/\/www.cryptogon.com\/index.php?rest_route=\/wp\/v2\/posts\/36851","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cryptogon.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cryptogon.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cryptogon.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cryptogon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=36851"}],"version-history":[{"count":2,"href":"https:\/\/www.cryptogon.com\/index.php?rest_route=\/wp\/v2\/posts\/36851\/revisions"}],"predecessor-version":[{"id":36853,"href":"https:\/\/www.cryptogon.com\/index.php?rest_route=\/wp\/v2\/posts\/36851\/revisions\/36853"}],"wp:attachment":[{"href":"https:\/\/www.cryptogon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=36851"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cryptogon.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=36851"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cryptogon.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=36851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}