6
$\begingroup$

The story

The protagonist (whom will be referred with a first person narrative in this question) had a friend, Eve, who was a math genius. Eve was dying of cancer. She kept her mind occupied in her last days studying cryptography. As her condition got severe, she eventually managed to write a computer program that could extract the AES key by taking the plain and encrypted texts as its input. Meaning that she broke the AES. Let's assume the key length does not matter, but the encryption mode is ECB and the program can crack the key in less than three minutes.

Eve died the next day. But before going to the ICU, she gave me her code and told me to run some tests. I am a sort of normal guy (not a genius) with moderate programming skills. I don't know much about network details or cryptography, but I'm familiar with the concepts and also a fast learner. I know that Eve's discovery is a huge breakthrough and I will honor her name... hmm... well, maybe later.

So, after giving some more thoughts I reckon that this code is basically a treasure and you know, Eve owed me some money. Let's see if she can return the favor at least.

The problem

Now that I have decided to use this potential treasure, I have no idea where to start. Although the code is a giant leap for humanity, but it has limited capability in practice. Can I hack the banking system with it? I have no idea. This is the real world and I am not a magician like the one in the movies who types a few words and breaks into any camera system. I have almost zero knowledge about hacking and stuff. Yes I am a fast learner, but I have no idea what to learn. The biggest problem is, I want to work alone and don't intend to share this knowledge with anyone.

To make things worse, I also have a political agenda. I would like very much to hack into, say, the US government systems and do some wikileaks like stuff. Without getting caught of course.

Question(s)

With this premise, is it possible to come up with a procedure for using this code to make money and expose some dirty secrets, while minimizing the chance of getting caught or exposing the AES vulnerabilities? By procedure I mean a step by step guide for the protagonist to maybe learn this and that, and whatever.

I am not even sure that this code has any actual worth other than its scientific value. It can only extract AES key, but there are still RSA and elliptic curves and other cryptographic schemes and I know that network protocols typically use a combination of these schemes. So, is it better to maybe sell this code to the highest bidder in the first place and forget about the political agenda? That would be very disappointing for the story of course.

I thought about posting this question on cryptoSE or securitySE, but since it has a fictional premise, I decided to post it here.

$\endgroup$

This question asks for hard science. All answers to this question should be backed up by equations, empirical evidence, scientific papers, other citations, etc. Answers that do not satisfy this requirement might be removed. See the tag description for more information.

closed as off-topic by Renan, elemtilas, JBH, Cyn, Ash May 12 at 13:01

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    $\begingroup$ Breaking ECB mode wouldn't be that much of a big deal, because nobody in their right mind ever uses ECB except as a building block for more complex modes. The real world would probably tell you to come back once you break AES-GCM, AES-CTR or AES-CBC. Yes, breaking AES-ECB to the point described in this question would be a big deal, but it would be much more a theoretical than a practical attack on actual cryptosystems. It would likely lead to a rapid phase-out and replacement of AES, but it would seem unlikely to get you access to much content or traffic. $\endgroup$ – a CVn May 11 at 16:45
  • 4
    $\begingroup$ Consider: TLS 1.3 removes support for CBC cipher suites because they are believed to be insecure; no version of TLS even includes ECB modes for any cipher, even though e.g. DES-CBC with a 40 bit key is included (though not recommended). $\endgroup$ – a CVn May 11 at 16:45
  • $\begingroup$ For a version of this idea where the ability to break encryption is bluffed see: en.wikipedia.org/wiki/The_Reichenbach_Fall also, mission impossible re the "rabbits foot" MacGuffin: movies.stackexchange.com/questions/14141/… $\endgroup$ – 011358 smell May 11 at 17:18
  • $\begingroup$ @user535733 Actually, she had two other friends, Alice and Bob. And they were pretty close. But Eve got jealous of the relationship between the other two, and tried to win over Bob by doing some nasty stuff. They could never forgive her and didn't even attend her funeral. So yes, she died almost alone. But she had it coming I guess. $\endgroup$ – polfosol May 11 at 17:47
  • $\begingroup$ Well, that's a fair enough backstory! Previous comment cheerfully withdrawn. $\endgroup$ – user535733 May 11 at 17:48
3
$\begingroup$

AES is a symmetric cipher, but basically all systems use an asymmetric cipher to share the secret key for AES to ensure that this kind of break doesn't occur and so they can do authentication. Also, even if you do find some services to attack, people will pretty quickly catch on that the attacked sites are all using AES. This will just mean that the people who have been saying we need to switch to something more secure than AES will finally get people to cave. Also, if you steal a credit card with a man in the middle attack and immediately steal it, then the defenders might even see it takes about 2 minutes to work, then people may still use AES to secure transmissions they know take less than 1 minute. If you are buffering video in 2-minute intervals, You can get the key, send the message, then send a new key. By the time the attacker has cracked the key, the key has changed.

$\endgroup$
1
$\begingroup$

Beware the Black Helicopters

In all likelihood, you'll be forcefully recruited to an unnamed government agency.

To use the ability to get rich means the taxman will want to know how you got rich. Once the taxman knows or can't tell, others will start looking.

The government (any government) will want the ability to spy on others including it's own people and the key to this is nobody knows they can do it. Once it gets out, a new encryption system will be used to stop the spying.

They'd black bag you, charge you with trumped up charges of stuff like cyber terrorism and force you to work for them or just steal everything and make you disappear or have a tragic bathroom slip and fall accident.

$\endgroup$
  • $\begingroup$ That is surely a good idea, but unfortunately, doesn't seem realistic (which was the whole point of the question) $\endgroup$ – polfosol May 12 at 6:08
  • $\begingroup$ What? The government wouldn't imprison someone for their ability to break encryption? Your comment doesn't make sense. $\endgroup$ – Thorne May 12 at 23:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.