Has the CIA already stolen India's Aadhaar database?

[Screambowl]

fb twitter mein log hugte bhi hai toh post daal dety hain... ghanta bc privacy leak ho gayi ??
adhaar se zada to SM ne ki hai...

 

[Project Dharma]

How many times you have used Tor ???

I've used it a few times primarily to get free skype phone calls. Anyway, my question was general and not tor specific. How does it matter how many nodes are involved in the context of https?

In the context of tor, only the exit node can unecrypt your connection but how does it matter how many others are involved?

 

[Project Dharma]

@Bharat Ek Khoj

Look at this open bug on the tor project. It is literally talking about what I was bringing up.

If the exit node had a certificate for wikipedia issued using a rogue CA (there were some Chinese ones in the past), then that SSL warning would not show up. BTW, most users click out of the SSL warning. A lot of http clients don't validate the certificate at all. And worst of all, the procedure for revoking a bad cert is really broken The certificate is put on a revocation list that nobody checks.

https://trac.torproject.org/projects/tor/ticket/8657

detected a man-in-the-middle attack due to a bad exit node.

While connecting encryptedly to a web page of Wikipedia, the TorBrowser produces a SSL certificate warning.

Name of the exit node: Unnamed
IP address: 176.99.10.92
Location: Russia

CN: main.authority.com
O: Main Authority
OU: Certificate Management

Issued on: 03/14/2013
Expires on: 03/14/2014

SHA1 fingerprint: 0C:FF:4C:A3:5E:F3:A7:64:20:1F:55:0B:32:3F:96:81:91:65:0F:ED
MD5 fingerprint: 65:EE:3C:09:75:0D:E5:32:22:2F:0B:3C:7D:8C:A4:72

 

[Bharat Ek Khoj]

I've used it a few times primarily to get free skype phone calls. Anyway, my question was general and not tor specific. How does it matter how many nodes are involved in the context of https?

In the context of tor, only the exit node can unecrypt your connection but how does it matter how many others are involved?

At a time data passes thru 3 nodes. Tor encrypts all data irrelevant of https. At a time there are around 350 to 400 nodes available. Plus it automatically changes 3 nodes at a certain time. So maybe vulnerable are the only nodes that doesn't have https.

 

[Project Dharma]

At a time data passes thru 3 nodes. Tor encrypts all data irrelevant of https. At a time there are around 350 to 400 nodes available. Plus it automatically changes 3 nodes at a certain time. So maybe vulnerable are the only nodes that doesn't have https.

The three nodes are rotated every ten minutes like you said. The first two in the chain don't matter because the connection is encrypted through them. However, if the exit node is compromised then your data could be decrypted even if you are using https (only for the ten minutes). Rule of thumb is not to use tor for anything where you're giving up sensitive information like bank passwords and sure as heck don't use it for something illegal.

Also enable cert pinning on your browser (Chrome does it automatically for Google websites).

https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning

 

[Bharat Ek Khoj]

Rule of thumb is not to use tor for anything where you're giving up sensitive information like bank passwords and sure as heck don't use it for something illegal.

Come on, who use tor for something like bank transactions.
Tor is used for basically two purposes
to be anonymous
and to lurk into deep web.

 

[Bharat Ek Khoj]

Also USA gov seize tor nodes many times, if they find exit node is used for any illegal activities. But there's no way to find out the first node because second node doesn't give up to exit/third node about first one.

I think in USA, its even illegal to host a tor node.

 

[Project Dharma]

Also USA gov seize tor nodes many times, if they find exit node is used for any illegal activities. But there's no way to find out the first node because second node doesn't give up to exit/third node about first one.

I think in USA, its even illegal to host a tor node.

Correct, the system is anonymous as long as the exit node isn't a honeypot.

Hosting one isn't illegal AFAIK as long as it isn't used for illegal activities which it is a safe bet it will eventually.

 

[charlie]

Once you have the key you have everything since it is a symmetric key algorithm. Doesn't matter how many "packets" are being generated. If you are implying that each packet is encrypted using a new key, then why not use a more secure encryption system since you have all that memory for multiple keys in the first place?

Theoretically, you could rotate the keys every x seconds or something. But evidently, it can now be broken in near realtime. Why use an obsolete encryption method when newer ones are available?

A chosen-plaintext attack utilizing a rainbow table can recover the DES key for the specific plaintext 1122334455667788 in 25 seconds. This allows DES-based challenge-response authentication systems, such as MSCHAPv1, to be broken in real time.[21][22]

As for why the Brazilian Army bought a billion dollar system with DES, I don't know. They are stupid? Corrupt? Poor and can't afford newer hardware? They are using it for applications that are not security sensitive? I don't have inside knowledge so I can't presume to know.

As for "reading too much internet", it is my business as a developer to read the internet. Please don't be presumptuous.

Once you have the key you have everything since it is a symmetric key algorithm. Doesn't matter how many "packets" are being generated. If you are implying that each packet is encrypted using a new key, then why not use a more secure encryption system since you have all that memory for multiple keys in the first place?

Theoretically, you could rotate the keys every x seconds or something. But evidently, it can now be broken in near realtime. Why use an obsolete encryption method when newer ones are available?

A chosen-plaintext attack utilizing a rainbow table can recover the DES key for the specific plaintext 1122334455667788 in 25 seconds. This allows DES-based challenge-response authentication systems, such as MSCHAPv1, to be broken in real time.[21][22]

As for why the Brazilian Army bought a billion dollar system with DES, I don't know. They are stupid? Corrupt? Poor and can't afford newer hardware? They are using it for applications that are not security sensitive? I don't have inside knowledge so I can't presume to know.

As for "reading too much internet", it is my business as a developer to read the internet. Please don't be presumptuous.

First of all in an brute force attack you will never get a key, in brute force attack you only get packets and every packet for an attacker will be like using a new key. Hence I told you it will takes hours just to decrypt one packets just for des.

key is never transferred from one system to another system through a communication medium if it does that then there is no point of encryption

Key is loaded into a client system using a special device in radio industry we call it key loader.

If we need a key to be transferred into a different system then we ask the key management system and that puts a 3 times encrypted key into a USB and that USB is also encrypted 3 times in our industry it even puts a active software which attack the device or a system it cannot verify.

Keys cannot be sent over an email or through any other medium except USB or special device it can't be read or you cannot even see the key in KMF.

I hope that clears your brute force attack ?

"Theoretically, you could rotate the keys every x seconds or something. But evidently, it can now be broken in near realtime. Why use an obsolete encryption method when newer ones are available? "

Again when a brute force attacks takes places it looks at the packets and decrypt it and for the attacker every packet will look like as the encryption key has been changed and has to decipher each and every packet.

Why obsolete ? Because des is not obsolete with current computing power and AES 256 is in US export control list depending on systems.

chosen-plaintext attack !!! Are we living in real world who in the world will have a encryption key in public again read about kmf and how keys are transferred in real world. When I read the wikipedia link I was just laughing.

About Brazilian army

Well as much as I hate the consultant and think they are dumb for asking the contractors to do which was not signed off in the agreement.

After saying that these guys have 20 to 30 years of experience in one specific thing.

It's army uses our comms so they are suppose to be sensitive, and there was no corruption involved the company I worked for has many checks and balances to make sure corruption does not take place.

It's not a billion but nearly half a billion and not may countries can afford a comms so expensive even India can't for now, do definitely not poor.


We had a discussion in US about aes 128 encryption to the death, final verdict came as it cannot be broken, my ex company used extensive resources in hacking some of the federal agency use our system for that.

Now there is a loophole but up to a certain extent, all packets have clear header they can't be encrypted.

 

[Project Dharma]

First of all in an brute force attack you will never get a key, in brute force attack you only get packets and every packet for an attacker will be like using a new key. Hence I told you it will takes hours just to decrypt one packets just for des.

I hope that clears your brute force attack ?

Somehow, we're not on the same page. The property of the DES algorithm is that "decryption can supposedly only be performed by those who know the particular key used to encrypt".

So a bruteforce attack that succeeds by defacto gets the key since it is the input to the brute force function that succeeds. You don't need to include the key in the packet for it to be recovered by a successful brute force attack!

In fact the wiki link specifically mentions "recover the DES key".

Again when a brute force attacks takes places it looks at the packets and decrypt it and for the attacker every packet will look like as the encryption key has been changed and has to decipher each and every packet.

Actually, reading this paragraph, it sounds like you guys are doing something on top of DES. In standard DES, you'd have a key which would be distributed through a secure means before beginning communication like the secure key loader that you mentioned. After that, you would use the key to encrypt/decrypt data before transmitting it over a protocol like HTTP or TCP/IP or whatever else the radio industry uses. If the attacker succeeded in brute forcing ANY part of the communication, they would derived the key and the whole communication is compromised.

It sounds like you guys are doing something to rotate the keys or derive new keys for every packet that is transmitted using an input other than the key. Which totally makes sense and explains why the Brazilian Army is using it.

Anyway, nice chatting. Hopefully India has done something sensible when it comes to Aadhar security as well.