Some people call it the " intelligence coup" of the 20th century: According to media reports, the secret services CIA and BND have been spying on governments for decades by selling manipulated encryption devices to countries over a company called "Crypto AG". Prof. Gregor Leander from the Chair of Cryptography explains how these machines were used and how secure today's encryption methods are.
According to reports by the Washington Post/ZDF, the secret services CIA and BND have manipulated encryption devices in the past to spy on encrypted diplomatic communications all over the world. Is such equipment still being used today?
Prof. Gregor Leander: The machines of the company Crypto AG, which is the focus of the "Cryptoleaks", were initially rotor machines. These electromagnetic devices functioned as cryptographic typewriters and were used to encrypt messages. But just like conventional typewriters, these devices are no longer in use today. Cryptographic typewriters were a development of Enigma, which was used by the Germans in World War II. Enigma was not secure, the Allies succeeded in cracking it. But mechanical encryption machines can be secure and some machines can be broken even with today's knowledge only with relatively high effort
Which methods of encryption are used today?
Gregor Leander: Nowadays we no longer use typewriters, but computers. With this development, mechanical encryption techniques have turned into algorithms. What once required hardware is now increasingly being replaced by software. The most common encryption software usually uses symmetric and asymmetric encryption methods. To put it simply, the first method uses only one shared key between sender and receiver to decrypt the contents of messages. For the asymmetric method, also called public key encryption, a key pair is needed, which is composed of a private key (secret key) and a public key (public key).
With today's standards, would manipulations like in the case of "Cryptoleaks" even be possible?
Gregor Leander: In this context we have to differentiate between manipulations in cryptographic algorithms and in devices. Manipulating today's encryption standards is not easy and the chance of being spotted is high. There have been efforts, however. For example, the NSA has intentionally implemented a vulnerability in the DualEC random generator, which has been discovered by scientists. In addition to the technical resources, some secret services also have the power to influence the committees for standardisation.
Manipulating devices, on the other hand, is much less complicated, since it is easier to hide backdoors in more complex devices. This is precisely what the current discussion on Huawei is about, with the concerns about their devices.
One research focus of the Cluster of Excellence CASA "Cyber Security in the Age of Large-Scale Adversaries" is to develop basic cryptographic solutions against such attacks. How do you intend to achieve this?
Gregor Leander: In CASA, we are working on precisely these questions: How do you ensure that there are no backdoors - and how do you test devices in such a way that they are discovered? How can cryptographic algorithms be protected against such attacks? To achieve this, researchers from several areas of IT security such as cryptography, embedded security on the hardware level and secure systems on the software level work together in an interdisciplinary approach. The current findings from the "Cryptoleaks" once again demonstrate the relevance of these issues and the high practical and political significance they have.
Info:
Investigations by ZDF, Washington Post and the SFR have revealed that a Swiss company for encryption technology called "Crypto AG" became half owned by the Federal Intelligence Service (BND) and the US foreign intelligence agency CIA in the 1970s. The company was long regarded as the world market leader for eavesdrop-proof communication, and its customers included numerous international governments. None of them knew about the built-in backdoors that the secret services had installed in the technology. This manipulation enabled them to eavesdrop on secret diplomatic communications. In the USA, the operation ran under the code name "Minerva" and with the BND under "Rubicon".
General note: In case of using gender-assigning attributes we include all those who consider themselves in this gender regardless of their own biological sex.
