Reply to post:

We need to talk about mathematical backdoors in encryption algorithms

StargateSg7

Even the old standby AES-256 has a "Technical Backdoor" which is a byproduct of it being based upon integer-based manipulation AND a basic factor of where MOST of the data that gets encrypted is ASCII 8-bit text or UNICODE 16-bit bit TEXT which TENDS to have vowels, consonants and other characters NUMERICALLY IN CLOSE PROXIMITY to each other.

A group of students from the University of Toronto in 2016 were able to demonstrate using donated supercomputer time on an IBM Watson deep learning system that such encrypted data could be converted to Greyscale, RGB and YCC/TUV/YCbCr colour pixels in order to graphically isolate integer values that resulted when specific combinations of vowels and consonants (ASCII or UNICODE values) were encrypted using SPECIFIC non-random keys and non-random key lengths.

They were able to take advantage of human password usage foibles to bring down the normally ASTRONOMICAL numeric combinations of AES from 2 to the 256th power down to under 2^128th power which is actually computationally doable on modern multi-GPU network-based encryption cracking systems. The IBM Watson system found evidence of quadratic curves, linear rising and reductions in values and simple curves when input data and specific key combinations were graphed as a colour or greyscale chart. The curves and linear values WERE ONLY VISIBLE when those keys and data were present. This enabled ISLANDS OF PROBABILITY to be derived so that more conventional brute force computations could concentrate on those "Islands of Probability" when determining which key ranges to start brute force attacks against.

So long you have TRULY RANDOM FULL-WIDTH KEYS, then AES-256 is STILL good to go! ...BUT....if you use common words, number combinations and/or punctuation as your passcode, THEN you allow deep learning systems to find the POSSIBLE starting and ending points of specific and LIKELY letter/number/punctuation combinations where a brute force attack should be initiated.

This is the nature of the beast for ANY type of integer-based and curve-based encryption and hashing algorithms such as Twofish, Blowfish CAAST, AES, SHA2/3, Elliptic Curve, etc. where you use non-random human-readable text-based keys. THEY CAN BE BROKEN! You MUST USE Shor's Algorithm Resistant encryption techniques such as Mult-variate, Lattice, etc which will even protect against newer Quantum Computing technology from breaking your encryption.

While ALL encryption algorithms based upon integer/curve manipulation ARE eventually mathematically derivable...SOME algorithms are better than others. The Canadian-made CAAST-256 is great! AES-256 is great! And even Elliptic Curve is pretty good for MOST personal and commercial-level secrecy purposes.

It's when you are protecting data against a TRULY LARGE AGENCY such as the NSA, MI6/MI5/GCHQ

or the GRU ...THEN...you will have an uphill battle against organizations who can AFFORD to spend

many months and many man-hours on breaking those codes with 20milliondollar supercomputers! Your average local or national police agency or local community government is HOPELESSLY UNABLE to crack even the waaaay-old Blowfish encryption algorithm!

So go ahead and remember to use the FULL WIDTH of AES-256 with as much random encryption key combinations as humanly possible to remember without writing down and you are MOSTLY SAFE against data encryption breakage!

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon