Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/39 Thanks!
So, Michael, you are true to
a policy that will be picking
and choosing to do the show over you
with some historical background, which
is important to understand how this are
going to be actually was
created.
Then I'll jump straight into the issues
with the specific implementation
of the algorithm. In this,
we'll give you a short overview of the
disclosure timeline
because there were some interesting
things in there. And at the end,
I will jump right into the council's
sidebar itself, which will
only be a little more complex for
everyone who isn't interested in
cryptography, but very
interesting for people who like
to analyze the level of science.
So for introduction,
I didn't do this alone.
I didn't team with it.
Davis and newly minute
and later we learned that this was
independently discovered by any trousseau
sometime ago.
And one of the issues unreported
here was all he discovered some
way before.
Of course, it's been published,
and we already found that during the
research will mean
I studied the security in that trust,
and I spent way too much time on the
keyboards. And that means I get
ideas, and something like this usually
happens when I get their ideas.
I found a social issue in
those wars, and that's why some few
Michael my saw the movie as he
probably doesn't like me anyways,
and I would like to point out that I
don't apply cryptography.
That means I have to have
some idea on how to implement
cryptographic schemes and
design around an existing Typekit, but I
cannot design having sight for myself.
That's one of the things detectives, for
example, have helped me a lot.
The BBC is to do the science
for the Legitimates Institute, which
roughly translates to Federal Office for
Information Security, and they are the
ones who design for this over
the emerge in 1991
from the department,
so they do have one idea
of cryptography.
First, they were the two hashes of this
trip. These and then in
1998, they turned into the
notion of physical demand for maximum
safety. When they got some additional
I.T. security tasks and all there
the BBC,
the BBC is designed with the others
to Cyprus, which is and all
of them is the one we are talking with
you.
They are not public until
recently.
So officially, they are not published.
And this is a policy
decision to only use unpublished titles
to make problems at home.
This violates capital,
but
the idea itself isn't too crazy
if it's done correctly.
One of the titles is the key elements,
which is an idea of conventional software
implementations, and there's two
problems known to be implemented.
One of them is he has multiple Windows
and Windows, which is a file encryption
software.
Using this algorithm and this is
restricted, you cannot gather this
individual. You need to prove that you
have some public interest in having it.
So we weren't able to do that.
But this is the guest who
is publicly available as there's
a legal version who can simply download
and run, and it also
implements the key elements of a file
encryption.
The second that the group is designed we
do not talk about here is stability,
which is optimized and meant for
hardware.
It's used in so-called leadership,
which is also used by the senior boxes,
which is the VPN used for
in a lawful intercept.
These are kept captions like
if the government steals your emails and
that's what they want, they'll encrypt.
It's open, they'll steal them.
And the interesting thing is that
for the better, we know that the
development of the chip started
approximately 96 97.
So this gives a timeframe when these
ideas were great.
The key also was the green.
It's not completely unreasonable that
they designed their own.
First, of course, you don't want your
algorithms to be designed by the NSA, so
it's logical that the government might
not want to use you as a group
and say the first
reference to this was almost
one of the limitations is October
2000. There might be earlier ones, but
this is the earliest event and
dry, though, which later became a yes.
It's published in 98.
So the
public from this
cryptographic algorithms wasn't good
at the time when this agreement was
designed and it really took them.
Some people find it
easier to understand.
That was announced in 2001
in for a rough comparison.
The first version was released in 1999.
PGD was already five years old,
approximately the time, if I remember
correctly and to use crypto next
month restrictions where cryptography was
munition and you couldn't export
more than 56 bit cryptographic
fortinet's you or never.
These restrictions were lifted in January
2000, so it wasn't easy to get
an official agreement.
So it's pretty reasonable that they
designed their own number at the time,
and they did have the knowledge just
to compare for the time frame.
Wikipedia was founded in 2001, so this is
really the Dark Ages.
He has missed windows over the mentioned
that chocolate is a fine encryption
software, which was likely to create a
completely new house on the busy.
It uses the key elements are in the
file format.
You will find some encrypted transcripts
from the internet.
But the SCI is obfuscated, feels dated,
so it will
be difficult to analyze results for
itself.
They claim to CBC, which
seems probably from the times we
analyze and
it. According to the public
documentation. It asks the user for
additional randomness when you generate a
key like move your mouse in this window.
So it's probably is implemented
in a way another way than what we
analyzed.
So the official feels
the Windows encryption is probably not
affected by the findings here, since
these are implementation issues.
The guest will know that it is the
software for the management of IP
baseline of the IP based protection
process. So how secure
is it, frankly and stuff like that?
And this was made by contractors.
The contract has changed over time,
and the main feature of this program
is management of data security
processes not telling the truth, but it
contains an encryption function
to protect the database,
which explained more vulnerable
companies.
And this this encryption function uses.
The key also is overwritten, but can
also encrypt any file so some
people may and actually do use
it for generic five encryption.
It's symmetrical encryption, so it's not
like you can get the key of someone.
You have a Sharpie on both ends, so
it's a bit cumbersome.
He doesn't see friction is
that the first is the 3.0,
and according to the visit, this country
has not been changed since then.
Until the recent patch, which fixed
the issues and
this 3.0 version
was released in July 2003,
it was developed by a contractor stating
a moment.
I won't mention the name further because
I don't think all the contractors are
especially better, but they are the ones
who make these mistakes most likely,
and ABC made the mistake of not checking
on them.
There was a future version of the tool,
which I think was considerable.
Yeah, it's not with a 5.0 and
that was supposed to be developed by
Persephone. They failed very, very
hard and very publicly, and
the BBC first
told them, No, we don't want this.
Then they told for a bit that they should
have read and that they gave up.
So to the actual point of this
attack, the security
issues with implementation of chaos
in Gaza,
assuming you are implementing
cryptography, someone gives you a secure
algorithm, for example.
Yes. What can you measure?
Does anyone have an idea?
Just just
the.
Yes. Give me some examples where
you can mess up.
I know there's a
good idea in the line.
You know, jails
are too complex.
The really stupid things that randomness.
Randomness? Yes
or no?
Yes. Generation Regis.
Oh
yeah.
That's one of the things about his
generation. Looks like a mold, and
there's a built, integrated drinking
because encryption does not equal
integrity.
And these are the main things you can
resolve.
And guess what? They didn't resign.
So for a new generation, if
you are generating cryptographic keys,
these must be random.
They should be unpredictable because
otherwise I think I can guess them
had only been, and
they should be long enough because if the
keys are short, then you can use them.
If you generate the keys, you need to use
the good randomness that means on Linux
and playing. So it systems that you go
for that random or that you are in them.
It's a religious war.
I'm going to go for them too.
And if you need to use a sort of random
number generator, use a good one.
Usually you can rely on the
implementation of that.
You were in love and some up
generated specifically designed
for crypto.
So this is the way that is to look at
the problem.
Yes.
There's another origin thought this
is we reverse engineer that this is
called the does the same thing that they
do.
First, they generate one of the four
months of key, which
gets this with most
of it.
But the main issue is
they are using strong
time and runs.
So this is not a cryptographically
secured random number generator, so you
cannot use it for this purpose.
None has a has 32 bits of
state in implementation used by the 100
thieves, so this means
you can guess the key with at
most 32 bits of effort,
it seems to be no.
So no matter how good the generator
itself it is, you
only have to do the power to do seeds,
which you have to try so you can guess
the key and to make it even simpler.
The key is the seed is
the time. So if you can guess the time
well and you have the seed and you have
to guess even months.
So in practice, the key space is smaller
than to do the power to do.
I think everyone knows that
64 or 56 bit encryption
like a verse is broken.
So you can imagine holding on
to the thought of does.
It takes approximately less than one hour
to brute force it.
I think it will signal for off a pretty
old laptop, so we didn't bother to
optimize as early as possible to organize
it further because
not the entire state is used by the
generator. We didn't look into it further
because we didn't see the one Felix,
which had some of the parallel research
set in this thought that it was
good to optimize that I think in 24 bits,
which is even more in-situ, which is
basically instant if you know the
time when the key was generated, you know
the key. This means in practice, it
takes a few minutes.
And obviously, if you can get the
key from the from an encrypted file,
then that information is totally reckless
and it's dangerous because people will
encrypt stuff with it and they will
assume it's encrypted.
So they'll put it into the Dropbox
well on their website for the contractor
to download it, non-security security
and stuff like this.
So if you should ever be in
the unfortunate situation that you have
to do generation yourself,
you'd probably use
the if you run into the friend, an old
lady and you insult systems
or even those who can use and
bring them, which is a Windows API
open since Windows 95 98,
we actually told them, OK,
when you're fixing this, use this key
generation.
The contractor then suggests
or asked us that they can use a specific
tutorial. It's linked to the science,
and the tutorial basically describes how
to properly castle type structure,
which is owned by time for calling
this runs.
So your compiler draws
less warnings when you do the same
insecure stuff, they do not
after you specifically told them not to
do this. And the tutorial itself
mentions that you shouldn't
really use it for anything serious.
So, yeah, pretty embarrassing.
And I think it's not this single
contract. I think it's a
it's a general description of rogue
contractors that supplied stuff
to governments
and other from the previous government or
whatever. Not.
So these issues are bogus because the
encryption is already told the growth at
this point. But if the fixed,
the first thing is will become relevant
when you are encrypting data with the
blocks over the blocks at all, encrypt
16 bytes and whatever the book says,
is that the kind that means you
will? If you have something bigger than
that, you will need to encrypt it in some
intelligent way.
ECB is awesome whatsoever, which
is a 269 encrypt them
the next 60 right and give them the same
and so on.
This is a bad idea because if you have
the same plaintext to investigate the
Samsung Galaxy, that means that
you have failed with the zeros.
The attacker will be able which to see
which areas are completely full of zeros.
And I think you can see which parts of
the file. I don't think and I think we
can also see if you encrypt the same
types of times that he sees.
OK, these two folks, I don't think
this may seem theoretical.
So let's give it the more practical
example.
This is an image.
It's a little bit more because of the.
So it's a bit nervous to roll
into just an encrypted end with
a proposed agreement and then
the call that the makers of it, right?
Can you guess what those images?
I assume this answer here, as long
it's not inside the image myself.
So let's give you another chance.
This is the same emerging group that
Mississippi.
And this is actually true today simply
because I simply this planet.
So this is when you actually get
the feeling for something that's not
triggering all my views around this
issue. Is this relatable?
You can see the issue, I guess, as you
can probably guess, but it's still a lot.
So yes, it
is a serious problem.
Of course, the entire block don't have to
be identical to get the same result.
So if you look here, for
example, I don't know
how easy it is to see from the bank, but
you have your different point of view.
You don't see why there is no uniform
pattern here that all of the areas well,
then adjusted once.
So if
if you have thought of where every pixel
contains a bit of noise,
even as you encrypt it, it would be
the result would be pretty OK.
The same goes for compressed data because
it's round the two blocks are completely
identical.
However, if you have for all bitcoins
locked, so there is like in this example,
this will never be another example
where this will remove this database.
And that's what this system was
designed to encrypt.
So, yeah, it's a problem, and
it's a practical problem if
you have to implement this.
You shouldn't. If you should have a
library that those for you.
But what this time as you use CBD,
for example, which means
you XOR the latest with
the random you
at the beginning, you start to scramble
and think it's just the randomize, the
plaintext, and then you take the output
of the first encryption of the first look
you, which is random
and use it to randomize and explain
things before encryption for decryption.
You first decrypt and then you use
Encrypt the cipher next, which you have
to explore it and then you get the actual
benefits.
So this is how it's done correctly.
Everyone does it, except well,
people who reside
in all this integrated you.
If you encrypt the file,
you might assume that the attacker cannot
change the file without you noticing
because of the crippling damage.
This is not true.
This is not true even if you use CBC.
People will think so, especially if they
have no background encryption.
Even some of the new electronic
encryption and people who are relying on
encrypted file, which currently decrypt
to be unchanged.
You cannot realize
when if you have an ECB encrypt the
parts, you can sign
them and you can simply swap against the
following decrypt and the next
box will be swapped in the same way as
opposed to text books.
So again, this could be a problem.
You could possibly even manipulate the
database in a meaningful way
for CBC.
You can, even for CBC,
you can truncate the file
you at the beginning and the end.
So it didn't come out a bit of the file
as long as it's aligned to block on risk
and will still operate correctly to
decrypt. So
this could also lead to some attacks
which are in the moment.
There's another type of cipher gridlock
in the box office here, which encrypted
the look like lock the screen sizes and
this is dream cycle like operation
multiple examples.
If you do this, you can even flip
individual bits. That means if you flip
the script and the plane things in the
same place, the first bit and the
plaintext will be flipped. That means if
you noticed plaintext or parts of it,
you can actually change it through the
encryption.
This was actually exploited in the wild
with the V, the one
of those that have been previously in my
phone, and this was one
of the things that were broken with it.
So a practical example of how you can
break in security of a phone.
You are the attacker and you want to make
a five people ending.
And
I don't know how familiar you haven't got
archives, but the headline is
this is at the end and
now completely ignores any garbage and
from those archives so that you take, for
example, the JPEG, which is the length at
the beginning and end around.
Then you have a hybrid file, which is at
the same time of an object that will
correctly display in nearly any
giving you and the correct
Rafael, which will correctly strike
depending on what program you
open with it.
So now let's take the real
time you want to send the victim
and make the you have
two people, one symbol
in Brisbane, that you want to fool the
recipient into believing that
the phone is actually coming from the
victim. Send them to make the
victim send the encrypted.
That looks harmless because it's pure
evil, wrong and behind this
some decoding. Rather, it looks like
the guy might want forwarded to the other
guy to the victim.
Encrypted your DNA sample things,
you truncated the cut of the decoy.
You have an even encrypted with his
key, which ruled the grid
correctly.
Of course, you need to match a block on
the river. That simply means aligning it
to 60 months.
So and then the
victim will receive a part of the
picture came from the other guy
who wanted to be talking about the two
of
you can not protect this against
this attack by simply defending the hash
and encrypting it. This is what many
people try, and it does not work
because you can from here,
take a listen when you put the event
file and then you put the hands that you
will find in there, then you both
equally, then the real Henry gets another
thing in your book.
Well, now he's a drunkard and you get
the red part, which you have to do
this red.
And that means that the
book correctly decrypt the hash will be
there. It will appear to work
and will be vulnerable again
if you have the screen cycles.
You can simply, if
someone does the same thing, which they
did in the web, they found something
even more stupid. But
you can do it orange in the military.
You have the blanket. So you know exactly
what it's right and you flip.
You can calculate what it should be.
And then you flip the bits you need to
flip. And that's a.
So if you will, if you do a do
you do anything at the tricky for us, use
the library, we will do it yourself.
But if you have to do it and if
you do, is you drive a separate jeep.
That means you take the one
car you have to the garage and then
virtually you drive more than the Asian
people and then you
encrypt the file with
the court in an encrypted file with one
thing and then you
run them and connect with the
second key or the entire thing.
You should be careful because they are
spending on record checks and stuff like
that. So do not lose yourself.
Simply take a library that hopefully
was made by people who know what they're
doing.
There's also automatic cipher modes
where the encryption is.
Literally, it means that the
authentication so you don't
have to perform the cryptographic
operations of the data.
You can use those, of course,
if you have them available and
all the things that you get through
encryption like tools.
And he filed some of the checks.
I'm not sure if they check the length.
So maybe you can just use any random
key Ring five
as a key. But I actually don't think they
change.
So if you decrypt
the file with your own key, well,
it shows you that the decrypted the
file and you get out
and then you wonder why you would run and
you don't get any indication whatsoever.
And from there, there's no security,
political, there's just a usability right
now.
But if you can use rank and file
encryption and somebody decides to
encrypt the runtime, it's either more
using itself as the key.
And I think you can guess the key because
that's the head of the merchant, which
is always the same.
And the issue of the file. So there
needs to be some side of
the traceability, and there
is no reason humans.
So summarize the findings about
the J-school this vengeance
tool, which this
database application, which has
encryption as a safe feature
and is often used for
hydrogen in general.
This encryption is totally broken in
nearly every possible way.
The only thing that is not overgrowth is
the cyber itself, despite it being
an stomatitis, and this is actually
pretty interesting.
But we can recover the key
and totally break encryption with minimal
effort.
So this is all the right in
the classical software.
The official file encryption software is
likely not affected by this because it
separates. I, like you mentioned multiple
times because people often confuse
this. So if you use that against the
system, you're probably most affected
too much by this. If you use the case to
encrypt encrypted individual
congratulations that are compromised.
Is going to play within
it if it was first discovered in secure
of which was discovered by just didn't
result because it's really, really
simple to see is you simply
looking for an encrypted file?
And if it has multiple blocks or just
saying it's EACB?
And that's what he did.
He published it in 2008.
We found this during a research and
yeah, this is the first time that
something is very wrong.
But if you choose them,
once you started
doing it, I think it would be easy.
Hey, do you want to my results
and the reply team, if you analyze
this, we'll send out Lawrence up to you.
So he did research and marketing,
told anything about the results, and he
found basically the same things we did,
which we only heard about later because
he didn't publish it.
He actually proceeded to use this
one encryption as a challenge
before and after the second dose, and it
was solved.
So this highly secure.
It's really.
Well, listen, you have a challenge, so I
think it might
have been reported, the BBC by
whoever sold it.
I'm not sure about it.
We don't know.
In 2011, approximately
the same time where this incident
happened, we were really Lawrence's.
We collected the B.S.
that individual told them, he said,
was a file labeled this something
some doesn't file.
OK, here's the leader of the fire.
We need to talk.
And they were very friendly
at first.
We'll describe that exact issue.
They made an advisory.
You probably shouldn't use encryption
anymore. They announced that they're
going to be releasing the service, making
fixes it.
They only give us another one credit,
like some researchers from the
government, and advisory
is hard to find today.
It basically disappeared from the
website. I won't say it's my list.
I think there's a we don't have the
website. I'm looking for all the emails
and I it the lose the whole time.
Well, it's many people
who didn't reach it didn't tell us,
or we can get into more with
them, gave them advice.
So who was a comic?
I let's use sounds and reply to
the suggestion by the window to correctly
cast the time spectrum
and to provide the ABC with
a draft of a paper.
Let me describe that over, and we just
got and they didn't like it, but we
received the rest, the
be specific and translating it
here. Thank you for the work you have put
into further analysis of
the previous engineering.
These products constitutes a breach
of copyright and then be prosecuted very
strictly by warlords.
I therefore urge you to request that the
document remains confidential.
Can you please confirm that?
So it was pretty clear that they
basically do not publish what will settle
on something they have been entrusted
with? And if it didn't let it all go when
we researched the actual legal situation
and said, OK, we think it's actually
legal to publish it.
Software is protected by copyright
security, I wrote 69.
The section free the loss
absorbing program.
Nobody knows what this means.
So we're not looking
at it with a view my lawyer is observing.
A lot is unclear and
well, if they sue us in
the federal court, we throw away in
10 years, tell us whether it was legal
or whether we go to judgments
and 69 e-mails.
That allows the company for its
operability purposes.
But that put some limitations in the
stuff you get in. So it's unclear
if you can publish the results.
For example, anybody who's themselves not
copyrighted in Germany, which is
this, would certainly not in the section.
And I would like to point out we did not
for use in the original court.
We didn't have it. We looked at the data
and we wrote it on paper, actually
in only minor the description.
And then we went on to implement that.
So to make absolutely sure we do not
accidentally use some of their votes.
And of this is until something.
So we went the very
fine way to protect ourselves legally.
We raised a lot of time in the research.
We did not get too much into the council
because there isn't one.
They might still sue us.
I don't think they will.
But it sucks
that people give you legal threats.
In response to have been, we delayed
the publication to give them time to read
from the bench, which would indicate
that some group, some or all of them
asked them several times here.
Do you want to do something
about it? It's been a year,
and about two and a half years
later, we finally published a service
book, which raises the issue.
A month after that, there were also some
small talk involved in any issues
that involve the government.
You may want to see the slides,
then they go for a little bit longer.
We then two months later, because we were
quite lazy to do it after two years, it
didn't matter to the.
We published advisory and I sent them the
Freedom of Information Act request for
some further details, but I didn't get a
response. If it's perfectly OK, they're
still within the time limit for that.
So it's my fault that I found it too
late, but we might get some interesting
answer. The fix was to simply disable
encryption, but never use user interface
that action on the back of a trial
because the encryption was broken.
There's better encryption available
today, so just disable it.
However, the U.S. limitation is it
doesn't work that simply the buttons
break out. No indication whatsoever.
And there are some, some small
and pretty interesting warning in the
documentation. So some people might
actually continue to use the old version
because, well, you will need to choose
from.
And so this is excellent.
I've actually talked with some
talk with some people
who use this tool for fighting
corruption, and this was like one
year after the initial advisory.
They didn't have an idea, for instance,
that there's something that they were
hoping for this year to fly.
So I think the old one that's going to be
thrown out anyway.
Well, yes, conflict is not going to
happen. They didn't know it at the time.
We did think about when we should
publish this.
Security and obscurity could be of
the design secure over an animal to keep
it secret in addition
to it.
It will improve security.
OK, there will be this review Celeste
risk. The more is the issues will stay
undiscovered, but it will be more
difficult to criminalize it.
So the idea to use nonviolent
humans is not totally crazy.
Despite being very unpopular,
but in the end, the bad guys like the
NSA, they know about this.
If you ever see ASML's and then
you find the distance from Orlando to
build it, you can get the codes.
You will be able to get the algorithm and
reverse engineering is easy.
And if they can do it, so
we are not accidentally
disclosing some state secrets that will
endanger those drums that
they did reveal something.
So we decided that, no,
it's not unusual to publish it, and we
need to bring awareness to the users
because the Lazarus went very
public.
They have enough time to fix it.
The progress was very slow.
I think it would have been faster if you
told them we'll publish very soon,
and it's been three years since the
initial advisory.
You sufficient been notified.
As I said, the visor is hard to find
officials aren't there and against what
is used as a general kind
of virtue to me by people
who really shouldn't use it for a while.
I would say no.
Yeah, it was a problem, and they were
easy for us to get all of the evidence
off the air and going to the signals
and the events of all these issues will
go on in 2003, but
not that little CVC was invented
three decades ago.
So it is embarrassing and especially
embarrassing to the BBC.
Did not do any review because they don't
have cash was a problem.
Lessons learned for publication.
If you find the security issue, give them
a hard deadline, preferably less than one
year, and tell them no matter what you
release a metronome, we don't care at
this time it will be published.
I think especially if the issue is
as easy to fix us here, but certainly
I think this will have significant sped
up the development of ethics
and the new personal policy.
Any legal threats in any time if it
fails or something, we immediately
publication, I think following will any
moment they.
I will not waste several days to research
whether it's legal to comment on it
when it's published, they have less
motivation to sue me because it will
achieve nothing except rather than affect
your mileage may vary.
You may get sued, but
it will say it'll probably save a lot
of lives, especially if you know full
disclosure from the beginning, because
then they don't even get to make a
difference. It's not nice, I
don't you? I'm from the middle with
everyone I know, even with the Brazilian
blood, you know,
so I don't have much time
for the key elements that says you'll be
able to see the slides.
And yeah, it's
probably more entertaining dozens of
people.
It's a lot safer, with more than six
officers in Colombia
on those they claim to use one
to the treatments.
Plus two tricks on
the other itself was one of the six
events.
It gets expanded to
13 times six people around or
64 the 64, and he's still you.
Which explains why the he was generating
the 104 bytes.
It was no provides, but
they the created
creatinine that he's getting news all
influences looks at the 64 makes.
It's optimized for 32 bit sea
views and consists of
12 rounds plus one key addition
drones, for example.
They add the wrong keys here.
Then you have a
one bucket as box,
the box the truffles, and then you have
something pretty unusual a variable among
shifts or the shift around events here
that they do, which makes it this
much more interesting. So different,
isn't it?
This matrix multiplication
in the middle.
The constants on a given encryption for
the encryption they are in
some source code my my, my publish.
But I guess the people will probably be
able to drive them.
So this is a moderate, and it looks like
moderates multiplication in the
utterances are multiplied.
So basically, the two halves
of the data model
are the keys, and I think that's
nonsense. Then again, a variable
shift and escorts, which is
inverse to the first one and the
microphone is
what's assigned versus here's
one of them.
I've highlighted
one of the values which is in position
hexadecimal one
tree, and
the value is the hexagons in the Z,
right.
So for the second, this as blocks we have
in the little pixels and zero f,
I love those one three.
So all the display turns as you take a
bite. You have an array
of 26 divided and
256 values, and
if divide is 15,
then you take the position of the 15
at the 15th position in the area.
So if you divide Franciscus
once and for the sake of those posts,
will be the same again because they're
inverse,
the keys give you a great in 32 bit
address.
The first five integers are
the original key.
Then you then only for
the fifth and only position you take
the, you know, the
integer five positions before that
right? It's all right granted
by seven widths.
Um, you take the integer three positions
to the left.
Multiply that by constant pixels
of three three three three three
three three three you x all
the rules, and that's the next key.
So it's pretty simple keys get you in
the end, they add to the position
to the key. It's interesting to
Philstocks Philstocks fifth in the
sixth attributes, increments of classics
and so on.
So you read in the cycle, looks
reasonable, said you said you're I cannot
have this myself, but
there's a quick cursory look.
This doesn't mean it is secure, but it's
not the usual snake oil that you used to
see with all the theoretical attacks that
reduces if you take a
fight. If you reduce it to five rounds
instead of 10 rounds,
then you can break it at the complexity
of two to the power of on the 14th
of June 2016 will find the
same tactics against the Sun all
the time. So this is a purely theoretical
and trivial
result for crypto users.
It's not anything that indicates that the
cycle would be so
is this feels most probably the cycles
of just isn't going to be easy because
this contract definitely didn't
design anything that works in this way.
Because crypto is hard, I can do it.
And this contract suddenly concludes
it's unlikely to the best into the
separate. So far, she hasn't lost.
But it could differ from the regular
classrooms.
This possibility was explicitly mentioned
in. Look, it was a data that they have
very little burden.
So, for example, the costumes, the
sponsors, the number of rounds, possibly
even the kiss can do could be modified.
And since you know, the contract that we
don't the that actually encrypted
codes, I think it was the contract.
So it's always possible that they
made some mistake that change
without making it stop encrypting
in a way that the file gets decrypted
again. So we cannot
be 100 percent sure, but it will be very
similar to actually.
So summarize the key aspects, either
on its own words, something it's its
public. Analyze it.
The implementation in years to is totally
broken. The best most likely didn't
review it because it's really obvious,
especially if you have the source code.
If you don't have the source code and
government, I think drive this summer.
I think that's a pretty generic term.
There will be exceptions, but the general
rule is designed and do not
implement prepare yourself, not even by
using existing over.
If they didn't use this, they could have
made exactly the same as these.
Take those implications.
The arguments of this?
Okay, so do not do it.
You say, well, libraries and that's it.
I some questions do before we go to the
future. And I think if any of you
know, anyone who uses guests would
or have used it themselves do.
If you know how to use this spiritual
moment as they go through modification,
please tell me if you have examples of
users who relied on it and would be
surprised by this book.
Well, I would like to hear
interesting stories.
Thank you for that, and you have
nothing to do in.
At the end of the year, I know, and I
would like to make a personal
announcement on my project, so
yeah.
OK, well, thank you very much.
And if you have any questions, could you
please line up at the microphones to
that use the microphones because
the streams are recorded?
And before you line up, I could just
ask, you got any questions from
the internet?
Well, I think the names are crunch,
but we have any questions from the Irish
Sea.
Not great. Move to
somebody else and the question of the
moment.
OK, then let's have microphone
number one.
Hey, is there?
So did I get this right?
The analysis that you did?
The algorithm is all from guess
to the right and not from this other
the Cosmos tool that you mentioned.
OK. Yes, that is correct.
We do not have access to the key elements
to it. We saw we only have two
world wars in the East.
Two, unless we can compare it to
some of the other tools is not public.
The autotools is not public.
You cannot even buy it without
proving that you have some public
interest in it. Right?
It's being deployed. Doesn't they try to
keep everything secret?
There might be some variations.
So yeah.
OK, so this is actually the first
analysis of this algorithm.
As I said,
there was another analysis by
live in Jerusalem.
It was not designed to publish
until they hear the talk about
it in rather limited
the limited audience.
But at the time where we did
it, it was the first animals.
As we went around, there were
obviously there was a little, but that
wasn't published at the time, I think.
OK, microphone number four
of those tools, rather than a storage
device to the making of something
God is good for them now
as he is supervising only things about
the film, something of which is not not
the high schools and
stuff, of course, and it feels as the
art world when he is called 04.50
dolphins or too much.
Yes, most of my time, Mr. Wilson.
So from this young woman,
good down. If I hadn't, if it wasn't
Vince, then I understand if it's a
variant of Cosmos, then
it's a very hands officially created by
the BBC, so it
could still be a slightly different
algorithm and be so defined for
those it would be. But I do not think
it's so defined for any the
of the encryption.
Doesn't mean it's not useful.
OK. Microphone number one, please.
You that you've described the situation
in which government department is
encouraging people to use an algorithm
that they know is broken, they're trying
to suppress people saying
that it's broken.
What's the legal comeback on them from
users who could sue them for,
you know, pushing a tool that's not fit
for purpose? Or do they have a disclaimer
in jest to saying,
you know, we give no warranties for this
at all? I mean, they're effectively
encouraging people to use a product
that's not only broken for them
to see, but yeah, it's in the same minds
that's easily breakable by anyone.
We saw businesses secure the soda
and they made an advisory that you should
not use the encryption.
I simply think it was a published moment
enough.
And one of the things is I
don't think they would have been
for another three political game is
broken, maybe even if we told
them, OK, it's broken.
And in that way.
Well, did it work? I think what they
really didn't like is that we planned to
publish the Cosmos accurate description
itself, which was almost like novel.
I think that's what really got me
because until then they were friendly,
and when they sold, they were in
descriptions of people.
That's when we got the email.
Okay, market for no phone, please.
Well, you mentioned that
a file
of possibly encrypted with the
officials. Yes.
Miss tool on the internet.
Are they using the same file
for?
You know, the heels of the
fiasco between Windows Phone is, as I
said, obfuscated. It's a completely
different life on Earth and you
can actually see us through they use of
very interesting license and licensing
scheme or DRM scheme.
If you want to get an
update for the essential windows to
download for Windows Update
encrypted the cosmos.
It's the key is public,
but you you simply need the software
because otherwise you can kind of drip
nothing.
And so we got some of these updates
and that was more signed with X
Y and lose this box.
We made no progress.
So that's no help
in verifying whether through
several implementations of the, you
know, it's to obfuscate or to make and
use. And there was also some
leak of data stolen from.
I think it's sort of, I don't know,
something where some hacker group take
them. They have something to try to
do, but I don't think doesn't contain any
copies of that on the internet.
Thank you.
Great microphone number one, please.
Thank you.
So is the
GST to keep stored on a disk
so that that key get protected by a
password?
He has missed keys are key files
which are simply stored and put in the
platform and without any remitting any
protection in anything.
Well, I mean, you
have to stop them from affecting.
Somehow you could protect them.
But the council about no, that's not what
they're doing.
Thanks.
OK.
In the meantime, many residents from the
internet know, for instance,
from the internet business back to you.
OK, thank you for letting me at home.
Hope it was good.
It was my first call.
This is yet to be an experiment,
and it will be really great to have
some small part of it here
in the Congress because there's a lot of
people so I can test it with more than 10
devices in the room. So if we could get
100 participants on
this new course using the tool at the
same time, this would be great.
It's a new tool it creates for to be a
connection between the participating
phones and colleagues in a whole.
Well, these connections work.
There's a privacy policy in the App
Store.
You can get you can get
through the program by entering peer to
peer P2P experiment and
explorer.
If you have any questions, I'll be
running around here and Congress
and, you know, email me on something,
and this will provide research data for
all of it to be, which would be very
valuable for censorship resistance.
So if you police officer, if you have
an Android device with Android two or
three six on your work, please just
download it run and you just need to run
the full time to Congress.
You can install it after thought that
would be really, really, really helpful
if you would just make sure it can the
phones at the end just give it time
before it uninstalled.
Thank you very much.
Thank you.
Preparations to run,
I think in the application
of America's admission that it actually
needs which it is,
I don't know them all for you, little
off my internet access, long uploads
and Bluetooth, obviously
for Bluetooth communications.
It does not collect location data.
That's truly the most important thing,
and obviously it doesn't believe in zero
numbers or stuff from your phones.
OK, well, thank you very much.
Thank you for this talk on the way out.
Could you please take all the trash with
you that you brought in so we have to cut
you off the rolls?
Thank you very much, everybody.