NSA Releases Security-Enhanced Android 81
An anonymous reader writes with the recent news that, in line with its goal to provide secure phones to government employees in various domains, "The NSA has released a set of security enhancements to Android. These appear to be based on SELinux, which was also originally created by the NSA."
Re:Is it secure from the NSA et al? (Score:5, Informative)
NSA is made up of two sections; one does cryptanalysis (i.e. signals intelligence), the other provides crytographic help for the government (and the public), often being at the cutting edge of cryptographic research.
SHA1 and SHA2 were NSA designed; do you trust those?
In any case it's open source (info page is here: http://selinuxproject.org/page/SEAndroid . currently down; use google cache)
The NSA has a good track record too (Score:5, Informative)
Take a look at DES. There was a big to do about the NSA "messing" with the S-boxes in DES. People conspiracy theoried that they had weakened it so they could crack it. Nobody at the NSA or IBM (who made DES) would say anything about it. The, in 1990, differential cryptanalysis was discovered by public researchers and it turned out the DES S-boxes were way more resilient to it than had then been random. Turns out IBM and the NSA knew about it back in the 70s, but the NSA asked IBM to keep a lid on it. The NSA's changes made DES more resilient.
Time has borne it out too. DES is decades old now and there has been no magic break in it discovered, no "backdoor" that would let people in, it is just too short a key to be useful anymore.
Along those lines, the NSA has signed off on AES (which was originally developed in Finland) as an approved standard to be used for classified data and said that AES is good security for the commercial world (which was the point of the AES standard). Again, time seems to bear them out on that, it is the most analyzed cryptosystem out there, and nobody has found any "backdoor" in it.
While there's no doubt the NSA takes their signals intelligence mission seriously, they seem to take their security mission seriously too. Their track record so far is excellent. Everything they've released has stood the test of time.
Now I suppose it is possible in theory that they are so far advanced of everyone else, and so arrogantly confident in their superiority, that they have hidden "backdoors" they figure nobody will ever notice... However if they really were that much better, would they need to?
Re:Enhancement, from the NSA? (Score:5, Informative)
I recommend you look at some of the examples of winning entries. It's amazing what these people have come up with. No number of eyes will find it. Simply put, even if it's a popular open-source project, thousands of eyes are likely to miss a well-placed backdoor like these. And if anyone is capable of doing it, the NSA certainly is.
Still don't believe me? How about the OpenSSH PRNG flaw [cyberciti.biz] that went unnoticed for two years, despite being used in servers all over the world. It was due to someone removing what appeared to be a useless line of code, but that code was actually adding some necessary extra entropy to the random number generator. It might've been an accident, or malicious. But the point is it happened, and on a high-profile project.
AES Finland? (Score:3, Informative)
No Sir, you must be joking. AES ie. Rijndael comes from Belgium.
AES [wikipedia.org]