We know that the National Security Agency (NSA) can break through some of the Internet’s most popular encryption tools thanks to leaked documents provided by whistleblower and former CIA contractor Edward Snowden.
Can the NSA also crack Tor, the anonymity network used by political activists, cybercriminals, and world governments?
Rob Graham, a security researcher and CEO of penetration testing firm Errata Security, says that much of of the network is actually vulnerable thanks to the widespread use of weak encryption keys.
Snowden’s leaks have confirmed that tools such as HTTPS, VPNs, SSH, and an alphabet soup of popular programs designed to make the Web private have been cracked by the NSA to varying degrees.
Tor’s weakness lies in the 1024 bit Diffie-Hellman encryption keys used by more than three quarters of the connections surveyed by Graham.
Tor achieves anonymity by sending encrypted information to various nodes (computers) around the world. The “exit node”, the last node in the chain, unlocks the information with a key. If the NSA can crack a 1024 bit key as suspected, they have free reign on significant portions of Tor’s network.
Users have long suspected that the NSA or any “hostile” force could simply run a node and examine the information that comes through it. Graham did exactly that. He ran a node and recorded the encryption used by incoming connections. The verdict was unsettling.
“After more revelations, and expert analysis, we still aren’t precisely sure what crypto the NSA can break. But everyone seems to agree that if anything, the NSA can break 1024 RSA/DH keys. “
Those 1024 bit keys are used by older versions of Tor, while the newer 2.4 version of Tor sports stronger keys that are more likely to withstand attack. Tor statistics show that only 10 percent of users are using 2.4, a version currently in alpha and not yet considered a stable and recommended download for most users. Version 2.3.25 is still the chief version available for download on Tor’s site.
“The NSA can spend $1 billion on custom chips that can break such a key in a few hours,” Graham wrote.
H/T Ars Technica | Illustration by Jason Reed
