NSA’s Encryption Algorithm in Linux Kernel is Creating Unease in the Community reddit / BSD ---------------------------------------------------------------------- midgaze · 2018-08-07 17:46 What could possibly go wrong ---------------------------------------------------------------------- kyousaya4life · 2018-08-07 19:55 Is it at all legitimate for Google to be requesting these things in the mainline kernel just because they want to use them in one branch of android? Surely Android's kernel is nothing at all like the mainline kernel and has plenty of additions and subtractions, why don't they implement the module themselves? ---------------------------------------------------------------------- twizmwazin · 2018-08-07 21:03 Android's kernel is slowly converging towards mainline. It is pretty hard to maintain a fork of the Linux kernel, so it is in Google's best interest to minimize the difference. With that said, this encryption algorithm isn't being used in Android apperently, despite Google's previous efforts to push for it. ---------------------------------------------------------------------- kyousaya4life · 2018-08-07 21:12 Huh, I always thought Android required a ton of default kernel functionality to be disabled in order to have decent battery life. (I have no clue what I'm talking about though, that's just what I've heard.) ---------------------------------------------------------------------- twizmwazin · 2018-08-07 21:27 The kernel supports many build time configurations. So when you build it, you can choose to enable/disable most of the features. So for example a desktop x86 distribution would disable drivers for hardware not found in x86 computers. Similarly, an Android build of the kernel would disable drivers for basically everything except what is needed by the phone. This is just a configuration though, not a set of patches on top of the kernel. ---------------------------------------------------------------------- kyousaya4life · 2018-08-07 21:38 Oh huh, I always assumed mainline was a specific configuration. So like, any build created from the official repo without modification can be called mainline? In that case, what keeps something like Linux-libre (which just excludes certain blobs) from being considered mainline? Is there no way to build it without those blobs unless you edit the build scripts or something? Or is it just a technicality because Linux-libre does some rebranding on top of the meaningful changes? ---------------------------------------------------------------------- twizmwazin · 2018-08-07 21:53 Any build built from torvald's master branch is considered mainline, regardless of the configuration. Linux-libre does a few things. Most importantly, they remove code used to load binary blobs. You could simply not have those blobs present (like Debian, by default), but they take it a level further to make sure you couldn't accidentally use the non-free blobs, which does require patches. They also modify drivers that make use of blobs to work to the greatest extent without blobs. For example some GPUs require blobs for power mangement, but you can still do some 2d/3d accelleration at the base clock frequency, even if restricted. Like you mentioned, they also do rebranding which is additional patches. ---------------------------------------------------------------------- BumpitySnook · 2018-08-08 00:04 Good thing we don't have any weak ciphers in BSD? Oops, Rc4, DES, and Blowfish. Good thing we don't have any NSA-designed ciphers? Oops, skipjack. The presence of the algorithm doesn't matter at all. It's whether and/or how it is used. ---------------------------------------------------------------------- somerandomguy101 · 2018-08-08 04:37 Well seeing that's its basically only going used on crappy Android phones, which are completely unencrypted anyways, so very little. ---------------------------------------------------------------------- up-sky-7 · 2018-08-08 08:55 >The presence of the algorithm doesn't matter at all. It's whether and/or how it is used. It does matter at least for the reason that it says a lot about **how** these kernels are developed and with whom. ---------------------------------------------------------------------- BumpitySnook · 2018-08-08 19:08 Yeah, it just says that Google didn't base Android on BSD and no one in the BSD community is trying to use FDE on low end ARM SoCs. ---------------------------------------------------------------------- Kernigh · 2018-08-09 02:36 The algorithm is Speck, a block cipher that runs faster than AES. The speed of crypto matters. In 2017, OpenBSD added a [new constant- time AES](https://marc.info/?l=openbsd-cvs&m=149358799204793&w=2) but then [switched back to the old AES](https://marc.info/?l=openbsd- cvs&m=149504367411703&w=2) because the new AES was too slow. I knew of [ChaCha20](https://tools.ietf.org/html/rfc7539) as an alternative to AES, but ChaCha20 is a block cipher and AES is a stream cipher. Disk encryption uses a block cipher in XTS mode. [The Linux commit for Speck](https://git.kernel.org/pub/scm/linux/kernel/git/torv alds/linux.git/commit/?id=da7a0ab5b4babbe5d7a46f852582be06a00a28f0) explains, > Speck has been somewhat controversial due to its origin. Nevertheless, it has a straightforward design (it's an ARX cipher), and it appears to be the leading software-optimized lightweight block cipher currently, with the most cryptanalysis. It's also easy to implement without side channels, unlike AES. Moreover, we only intend Speck to be used when the status quo is no encryption, due to AES not being fast enough. > > We've also considered a novel length-preserving encryption mode based on ChaCha20 and Poly1305. While theoretically attractive, such a mode would be a brand new crypto construction and would be more complicated and difficult to implement efficiently in comparison to Speck-XTS. ---------------------------------------------------------------------- KeijoTheSnowLeopard · 2018-08-09 23:36 It is doing that too slow, there are pretty capable devices that end up with EOL kernels, because forking happens. Android in general is only good at creating ewaste. Look for example at gemini pda, it is delievered with a 3.18 kernel, probably even not the latest release from that branch and it won't be updated, because ARM SoC vendors are bad. Linux can't be ran without tons of hacks in form of libhybris and stuff or without porting the device to mainline. I'd love to see a new BSD or fully mainline Linux phone someday, but I've lost my faith. ---------------------------------------------------------------------- twizmwazin · 2018-08-09 23:43 There are some devices running mainline kernels, but they are mostly older devices. You might be interested in checking out postmarketOS. Additionally, I am unsure if they are targeting mainline support, but Purism's Librem 5 device is worth watching. ---------------------------------------------------------------------- KeijoTheSnowLeopard · 2018-08-09 23:49 I own two, namely Xperia Z2 and Nokia N900, I need to get a battery for the latter. I think I'll try to run postmarketOS'd N900 as my daily for some time and posting the results somewhere. There's no new phones able to run mainline, nor a way to mainline them fast or just ditch Linux entierely in favor of BSD. I'd love to see something like Nokia E7 Communicator or Blackberry Priv formfactor running an independent OS, but that isn't happening anytime soon. I stopped believing in Librem 5, because their road to releasing the device is so messy, they can't even maintain a partnership properly, also they aren't even planning on releasing anything with hardware keyboard. ---------------------------------------------------------------------- alexanderino · 2018-09-08 05:49 > Good thing we don't have any weak ciphers in BSD? Oops, Rc4, DES, and **Blowfish** How is Blowfish weak? ---------------------------------------------------------------------- alexanderino · 2018-09-08 05:49 > Good thing we don't have any weak ciphers in BSD? Oops, Rc4, DES, and **Blowfish** How is Blowfish weak? ---------------------------------------------------------------------- alexanderino · 2018-09-08 05:50 > Good thing we don't have any weak ciphers in BSD? Oops, Rc4, DES, and **Blowfish** How is Blowfish weak? ---------------------------------------------------------------------- alexanderino · 2018-09-08 05:51 > Good thing we don't have any weak ciphers in BSD? Oops, Rc4, DES, and **Blowfish** How is Blowfish weak? ---------------------------------------------------------------------- alexanderino · 2018-09-08 09:15 > Good thing we don't have any weak ciphers in BSD? Oops, Rc4, DES, and **Blowfish** How is Blowfish weak? ---------------------------------------------------------------------- BumpitySnook · 2018-09-09 19:29 https://en.wikipedia.org/wiki/Blowfish_(cipher)#Weakness_and_successor s ---------------------------------------------------------------------- alexanderino · 2018-09-13 19:19 Thank you. They should highlight that weakness in the Wikipedia summary box, not the others.