The NSA sure breaks a lot of "unbreakable" crypto. This is probably how they do it.

[Valerian 20]

Article from BoingBoing:

 

'For instance, the Snowden documents show that NSA’s VPN decryption infrastructure involves intercepting encrypted connections and passing certain data to supercomputers, which return the key. The design of the system goes to great lengths to collect particular data that would be necessary for an attack on Diffie-Hellman but not for alternative explanations, like a break in AES or other symmetric crypto.

 

'While the documents make it clear that NSA uses other attack techniques, like software and hardware “implants,” to break crypto on specific targets, these don’t explain the ability to passively eavesdrop on VPN traffic at a large scale.'

 

 

http://boingboing.net/2015/10/15/the-nsa-sure-breaks-a-lot-of.html

[LBDude 3]

Nissemus,

 

Thanks for posting this.  I just signed on with the intention of posting the same information from today's  "Guardian":

 

http://www.theguardian.com/technology/2015/oct/15/nsa-crack-encryption-software-reusing-passwords

 

 

I assume that if this is hitting the mainstream press, then a lot of tech savvy people  here have known about it for a while and can probably offer their insights.

 

I hope this topic stimulates more comments/discussion.  I, for one, would like to know how this relates to the encryption used by AirVPN.

[snipe 0]

And this published today on arstechnica - http://arstechnica.com/security/2015/10/how-the-nsa-can-break-trillions-of-encrypted-web-and-vpn-connections/

[Staff 9972]

Hello!

 

We remind you that we use 4096 bit keys for DH and unique primes on each VPN server.

 

Kind regards

[eyes878 43]

Hello!

 

We remind you that we use 4096 bit keys for DH and unique primes on each VPN server.

 

Kind regards

I love how AirVPN has every potential issue solved before it's even a problem.

[snipe 0]

I figured when I posted the link to the arstechnica article that we would hear from the AirVPN guys that they already had it covered, lol.

[iwih2gk 93]

Hello!

 

We remind you that we use 4096 bit keys for DH and unique primes on each VPN server.

 

Kind regards

 

 

Just curious as to HOW you generate "unique primes" and how often if at all they are rotated?

[rickjames 106]

 

Hello!

 

We remind you that we use 4096 bit keys for DH and unique primes on each VPN server.

 

Kind regards

 

 

Just curious as to HOW you generate "unique primes" and how often if at all they are rotated?

This ^

 

I would also give anything for key regeneration/cycle every X weeks or something

[Valerian 20]

For the truly cautious, here's an EFF article on protecting yourself from NSA attacks on 1024-bit Diffie-Hellman.

https://www.eff.org/deeplinks/2015/10/how-to-protect-yourself-from-nsa-attacks-1024-bit-DH