Re: AI's take on my cipher...

Stefan Claas <stefan@mailchuck.com> wrote:

Rich wrote:

Stefan Claas <stefan@mailchuck.com> wrote:

Rich wrote:

Stefan Claas <stefan@mailchuck.com> wrote:

Rich wrote:
 

And, how accurately do you think the average person who wants to send
an encrypted message will be at typing this:
 
KqHtqbSca2hvI02pCMHtdKQLfHhW6OeN7iK1Fg45nMpoT+to8XpwpvARkW6UziY0iyZWUEgP/gol
gz5p3XpGCe0hZbYV2IYYLDvvRjGWj1k5IHkDX4WshBZvI5fhVssJOqVI3bzqdEW3XLD4NoGKVQg3
ZeNaSJs2hBySnkBoKGI=
 
That's 128 random bytes, base64 encoded.  128 bytes is right about the
original "tweet length" of tweets on shitter, so there is a severe
limit of the amount of information that can be transferred.

 
That why I have my az and ug program for people available, but it uses 2
bytes, which should be no problem.
 
$ openssl rand 128 | az | ug -g
ZMAXT OPNWC LZWIF OQIMR PNNQV BFQLC BRZDA RUFBT ROLQS GOLKA
KKNJF ULBLO WINNL IIVVK FWTEE XRGBS UJCYS DCMWH JUMAA VLLNX
MJMYS LHSKG ENKLL LUGBN YNDSP AJYMO OXUBC YQNOY QMFYW ABOPH
NUVCJ KMFCM XKDVM EEXYL LVUKO VVGAU UACYV OHKUG GTVAA MWDLO
KCPYN HOWVM DPNHA ZMGHV MFIKW DILNO FYQHK VQELK OMFNL EOLTL
ETMPL S

 
Yes, easier to enter than raw base64.  But in this case this "easier"
is like the fact that it is "easier" to move 10,000kg of sand 1km by
hand than it is to move one single 10,000kg rock 1km by hand.  "Easier?" Yes,
but no one will actually want to do so either by hand if they have
other alternatives.
 
No one, except for the very very truly determined (a tiny sized
population), will want to hand type that to maintain proper
air-gapping.  So they will use USB sticks or other methods to "move"
the data, opening up the possibility of transfer of an exploit via that
same USB stick.
 

 
A 3.5 ich disk drive and disk for it come in handy, because you hear
every read/write process

 
You hope.  A NSA level attack could hide a microcontroller and several
GB of non-volatile memory on an otherwise normal looking interface
board.  Some of the read/writes could then be redirected to/from that
non-volatile memory.
 
Far fetched -- certianly not when such CPU's can be had from Amazon for
$10.00.
 
Likely to happen to any individual - well, very unlikely, unless they
happen to also be in the NSA's crosshairs.
 

and can quickly examine the sectors with a disk editor.

 
The same exploited drive could perform a VW Dieselgate detection to
detect likely access by a disk editor (the access patterns will differ
vs. filesystem accesses) and return alternate contents or modify the
actual return from the disk surface to make you believe anything was
written to the sectors.  So you'd have to disk edit read on another
machine that itself was not compromised in some way (and hope the NSA
didn't swap the drive in that machine for another comprimised one).
 
And -- I'm ignoring the fact that buying a newly manufactured in 2025
3.5" drive mechanism is all but impossible today.
 

 
What you always forget. the NSA can't snoop on onffline devices in Eurasia.

They surely can.  Lets just presume some target on their radar.  They
learn (somehow, could be intercepting a communication, could be a tip
from some other countries variant of the NSA) that their target has
orderd from TEAC [1] in Japan ten new 3.5" drives that are suspected to
be used for their "air-gap encrypting machine".  They approach TEAC (or
more likely a vulnerable TEAC employee) with an "offer they can't
refuse" (could be enough cash to make it worth their while, could be
something else) to let them "install" this slighly altered control
board onto the ten drives destined for the target.  The accomplice
agrees, the NSA provides the alternate controller, and they are
installed.  Then those ten are packaged up exactly as every other drive
is, and shipped off to the target.  If done properly, and via the
typical long chain of shell corporations, the attack, and who was
behind it, may never come to light.

I.e., they very well can architect a similar supply chain attack as
Israel is accused of having mounted when all those Hamas pager units
began exploding at about the same time in the pockets of various high
ranking Hamas commanders some months back.

Whether they bother to do so is very much dependent upon if the target
is a person of interest to them, but "location around the world" is not
going to pose a significant barrier to a group well versed in hiding
what they are up from everyone to on a regular basis.

They can do that with US citizens in the US.

Presumably, given the US laws that established them, they are not
/supposed/ to be spying on US citizens in the US, rather their focus is
supposed to be "other than US" (among other roles they have been
given).  Whether they actually abide by this restriction is a matter of
much debate at times.


[1] Chosen only because that is a name I recall from yester-year that
made 3.5" drives.  I very much doubt they continue to manufacture them.