Schneier on Security

Clive Robinson • February 3, 2026 2:26 PM

@ K.S., ALL,

With regards,

“I am not aware of a way to bruteforce 128-bit AES key, so unless other shenanigans”

Whilst the algorithm is strong the implementation was brittle when you put it into “go faster stripes” of “loop unrolling”, it opened up side channels, which is something the closed community of the NSA, GCHQ and one or two other SigInt agencies knew a lot about, but few outside knew about it or cared.

I’ve reason to believe that the NSA put “the fix in” via NIST and in effect “rigged the AES competition” very much in their favour. And why MicroSoft received little or no issues writings secure code that was anythin but….

There is a clear history of this going on before the NSA was ever even thought about and goes back to Friedman and his Wife at the Riverbank laboratory and onwards.

You can see it in the design of the mechanical ciphers of Boris Hagelin that Friedman “advised”. And later encouraged Hagelin to set up Crypto AG in Zug Switzerland where we now know almost every machine had deliberately weaknesses built in.

The fix of AES was so good from the NSA perspective because it allowed the Key or Plaintext to be quickly and easily identified even well outside the computer on the network cable… Microsoft are certainly known to have “played along” by the “file formats” used for Office packages with the equivalent of “known plaintext” at the begining of the files to be sent mad cryptanalysis checking cery much easier than it might otherwise have been.

I could go on but, how much info do people need to know that MicroSoft very definitely “played along” with the NSA. And I assume they still do so.

Clive Robinson • February 3, 2026 10:05 PM

@ Not really…, ALL,

With regards,

“Since that time, constant time algorithms for AES have been developed.”

Whilst that might be true… The NSA still on devices used to encrypt hard disks like “In-line Media Encryptors”(IMEs) only certify AES for “Data At Rest”(DAR) encryption, so not whilst the algorithms are in actual use.

You will see it worded on product data sheets as,

“Type-1 certified, data-at-rest (DAR) inline encryption solution that stores and protects Secret and Below (SAB) data.”

Or equivalent. If you dig into the detailed technical data sheets you will usually find it more clearly stated as “data-at-rest” only for AES.

Clive Robinson • February 12, 2026 12:03 PM

@ Steve,

You ask,

<

blockquote>”What is the status of those outrageous demands today?”

<

blockquote>

Over judges demanding,

<

blockquote>”ordering defendants to hand over encryption keys and passwords to social media accounts and other stuff, such as combinations of locks and safes.”

<

blockquote>

The answer in my case has been to develop “Deniable XXX”

You can not hand over a Crypto Key if you never knew it.

You can not hand over a password if you never knew it.

And if you can show that there is no unique or near unique plaintext from a ciphertext even when you’ve been betrayed and that any and all messages are equally probable, then the prosecution carries an impossible burden of proof.

The big issue with not knowing is the “no way back” issue for which “backups were invented”.

The solution for that uses “key sharing” methods and an idea that @Nick P and myself put together about putting the key shares in multiple hostile jurisdictions.

Judges may think they have,

“The power of might is right”

But actually they do not, like any two bit crook they are really just bluster supported by thuggish people that are “authoritarian followers”. Who have vulnerabilities that with thought and planning can be neutered and made impotent.