The NSA and the extent of its interest in cryptographic systems has long been discussed in security and cryptography circles and opinions have already been published regarding unprecedented major breakthroughs in cryptanalytic technologies at The Agency.
The fact that the NSA have been pushing Elliptic Curve Cryptography could also be understood as an indicator that they would like everyone to have greater confidence in its security and thus be more likely to use it. It is of course within the bounds of possibility that widespread algorithms such as RSA and Diffie-Hellamn have already been compromised by any agency with such a huge talent pool and corresponding budget. Agencies such as the NSA have the advantage that they are free to use all of the research that comes out of academia, but of course are under no obligation to share their own, particularly if it is seen to confer any national security advantage. Let’s not forget that equivalents to both the Diffie-Hellamn and RSA Key Exchange algorithms were actually originally described in Great Britain’s GCHQ, but was kept classified, the entirely separate academic discoveries came later. So am I surprised that the NSA has invested large sums and significant numbers of employees in maintaining a cryptographic advantage? Definitely not.
One of the most efficient ways to overcome security measures such as encryption is by some kind of compromise of the underlying technology, it is this work which poses perhaps the greatest risk for the average internet user. While a backdoored system or technology might be used by the target of a surveillance program, it is potentially just as likely to be used by any other individual or corporate entity. That other user may be of no interest to the US security agencies, however the fact that they have been obliged to use a fundamentally flawed system leaves them far more open to attacks from other nation-states or intelligence organisations. It would be naive to think that other countries, which the NSA may well consider hostile or adversarial (although that term seems to be applied to anyone not in the employ of the NSA), do not devote similar resources to exactly the same kinds of program. Perhaps this goes some way towards explaining the current conviction in US intelligence circles that network hardware of Chinese origin is factory-shipped with various undocumented weaknesses and backdoors, set a thief to catch a thief.
Deliberately designed weaknesses are anathema to effective security, by definition they make it more difficult to construct a fundamentally secure product or service, particularly if those weaknesses are inserted into the very building blocks of much security architecture, such as operating systems or even cryptographic standards and algorithms. The law of unintended consequences indicates that those same weaknesses could well result in significant “collateral damage” and loss of commercial intellectual property that may otherwise have been instrumental in keeping citizens and the nation itself secure. Even though the vast majority of internet users, and unfortunately a large part of commercial enterprises, have still not made encryption a mature part of their security portfolio (with the possible exception of VPN technologies).
These latest revelations from the apparently bottomless briefcase of Mr. Snowden may serve to undermine public confidence in the technology provided by some security companies, particularly those with significant US-based operations, although perhaps that would be too extreme a reaction. Let’s consider them in the light of previous revelations; if the NSA had the ability to decrypt, for example SSL encrypted traffic, at will and instantaneously, then there would be no need for the previously detailed PRISM program. In the majority of cases, access to end-point systems seems still to be required, to access data either before or after the encryption/decryption process.
A more likely outcome is that these revelations will spur new investigation into more efficient practical application of symmetric cryptography and shared-secret key distribution, also a wider adoption of open-source frameworks in commercial encryption technologies. The scrutiny of the crowd should serve as some reassurance that the underlying code has not been tampered with in any malicious way. Doubtless many of these future innovations will focus on practical applications of homomorphic encryption, which allows encrypted data to be processed without the need for decryption at all, neutering the effectiveness of any direct compromise of the endpoint.
While the NSA may have unprecedented levels of access to flows of data across the internet, encrypted and otherwise, and extensive means of breaking into any system or network hardware they choose; let’s not forget Snowden’s own assurance “Encryption works.” I’ll add, if I may, “for now“.