Encryption and hacking drones Options

[Smokeskin]

When people talk about breaking encryption, most of the time they think about breaking public key encryption.

Public key encryption is based on the idea that Alice and Bob meet on the internet and want to share encrypted information. They can then share public keys, do some simple and fast mathematical operations on them, do some more operations, and now they're ready to transmit encrypted data. The clever part here is that they don't have to agree on an encryption code before they "meet" on the internet, enabling encrypted traffic between strangers.

This is because that even though Eve, who wants to spy on them, has picked up the data they transmitted between them to establish an encryption protocol, without Alice's or Bob's chosen private key (a very large prime number) she can't effectively "crack the code". The difficulty of the problem is basically one of factorizing a very large number that is the product of 2 very large primes. This just takes a really, really long time ("standard" professional current encryption takes months on supercomputers and 10,000ths of distributed computers to crack today). Build faster computers for cracking codes you say? The problem is that the complexity increases exponentially for the hacker - if computers get 1,000 times faster, the encrypters increase the complexity by 1,000 and are able to do their operations in the same time, while it now gets 1,000,000 times harder for the hacker so it now takes 1,000 times as long. The hacker just gets further and further behind as technology increases.

There are 2 potential ways to, in the future, hack encryption fast:
1) develop a mathematical method to quickly integer factorize large numbers by conventional means. It has not been proven that this isn't possible, but everyone expects that it can't be done. I wouldn't put my money on this.
2) develop efficient quantum computers. Quantum computers can do some operations that theoretically lets them integer factorize "quickly" and they don't get hit by exponentional complexity as the encrypters increase the size of the prime numbers.

Your average cyberdeck in 2070 obviously has a quantum computing module in there, letting it decrypt intercepted data quickly and easily.

All of this is however based on the premise of public key encryption, which is the only way to do it for communication strangers. People who are not strangers don't use public keys though. They use one time codes. Before you separate, you agree on a list with a number of codes, which are basically just long strings of random numbers you use to encrypt the data. There isn't a mathematical pattern to them, and the hacker doesn't have anything he can number crunch.

This is what a rigger would do with his drones. Back in the shop, he makes a one-time pad with each drone. What a hacker trying to intercept the traffic would hear is "Use code 23113132 [static for 100 milliseconds] Use code 654651651 [static for 100 milliseconds]". This can't be decrypted - there's no pattern, no numbers to crunch, nothing. The drone only accepts encrypted traffic, and the hacker can't spoof and encrypt a message - he doesn't know the encodings, so if he tries to send "Use code 7654435 [command]", the drone decrypts the command and gets static, so it disregards it.

The only ways to hack a drone is
1) hack the cyberdeck of the rigger and get hold of the one-time pads (or got hold off them in some other way, like from his drone shop)
2) if the rigger enables the drone to accept normal communication traffic.

Everything else is just plain unrealistic.
This goes for encrypted comms between professional forces too btw.

[Muttley]

Althrough I can see what you mean. I myself would never run it like that it would take away a cool aspect of the game.

[mfb]

but it would add a very cool, very different other aspect. because from now on, you can't just hand encryption over to the hacker and have him wave his magic wand--you have to hack. that might mean a sneak-and-peak through a corporate office to see if anyone left their password written down at their desk. that might mean social engineering to convince an employee to give your team access. that might mean structural re-engineering on an employee's shins, for the same reason. etcetera.

[Konsaki]

Hmm... this rigger is using one time codes...

... let me see, spam his drone with random code commands to tear away at his drone's pad and now he cant use his own drone till he himself catches up... but everytime he tries, the drone moves up in the count again, so its a crapshoot if he gets the next one right and continues on from there...

Thats the problem with the one time pad method. Everytime you use or recieve an encrypted message, you have to discard the current code.

[mfb]

that only works if you can find his drone. and if the rigger doesn't find you and have his team shoot you in the face, because you're giving away your location with all those massive transmissions.

besides, spamming the drone with random commands won't work. you'd have to get insanely lucky to get an actual command out of random noise within any reasonable time frame--that's the whole point of good encryption. all you're doing with random noise transmissions is, basically, trying to crack the encryption with brute force. the encryption we use today would take, at a minimum, years to crack that way.

[Smokeskin]

[Smokeskin]

[mfb]

true. even so, the likelihood of getting a useable response--and i'm including random actions and malfuctions as useable responses--within a reasonable timeframe is vanishingly low.

[Serbitar]

Shadowrun is not about realism. Its about a certain kind of game experience.
I agree that the current hacking rules do not deliver this experience, as Joe Hacker can hack the most advanced encryption out there in about 18 seconds, but one time pad encryption does not deliver this game experience, too.

You basically want a rule where you take a little longer to decrypt things and where you may not succeed for sure if the encryption is too hard.

[Rotbart van Dain...]

Using OTPs for transmissions requires packet-encryption, using codes that never are used twice: Not for encoding, nor in another drone.
The code-jumps you proposed are irrelevant to the encryption itself.

Enter old problem: source of random data. Real randomness isn't easy to come by, and much harder to generate.

Drones transmit huge amounts of data, especially if jumping into them. As they need exactly the same amount of data for codes as those are used up, you need huge libraries, which, depending on the mission lenght, might even stretch the 'unlimited storage' of SR4.
If you lose a drone, you lose the data completly, too.

So, basically, that setup might work some time, but it will be inpractical on the long run.


OTPs are great for secret communication of short messages, as they can be used to encrypt manually, though.

[Smokeskin]

@RvD: The code jumps aren't necessary for encryption, they're there to ensure that you both agree on where you are in the encoding stream. It's a necessity when operating in environments where the parties sometimes lose contact.

You're taking the onetime pad name too literally. Most likely the codes will contain seeds for one or more semi-random functions that tells you how to encrypt the data with real random data. So a code might be 2-part, one says what semi-random function to use, the other is a table index that you look up a seed with. The semi-random function plus seed then gives you a long output that tells you what snippets to use from the real random data stream you've stored.

Something like that gives you effectively unlimited streams for encrypting. If it is not enough for you, then that scheme can be made a lot more random and given a lot more combinations. A combination of semi-random functions, tables that only Alice and Bob knows, and a large common real random data file, and you've got something that can keep on spewing out random data without repeating itself for ages without the need for unrealisticly large pads.

[Smokeskin]

[Rotbart van Dain...]

Certainly, I'm no cryptoanalyst, but that approach sounds like snake-oil:

Essentially it still is an OTP that is reused, but shifts the start and ending of that pad with a PRNG. This removes the proven security of an OTP, and the PRNG opens the possibility of pattern matching attacks.
As the OTPs algorithm itself is very easy, it is trival to break once you have exploited the PRNG for pattern matching.

This is especially true since the attacker has a very good guess what parts of the plaintext looks like, since the protocol for drone communication is standardized.

[Smokeskin]

The whole setup is really just making the OTP extremely large without using extreme amounts of storage.

At the very least, you must agree that you could easily store a very large random stream to start with as a basis for a OTP - you could measure it in terms of the drone's recording capacity. Say 2 hours worth. Before you can even start pattern matching, you need 2 hours of full sensor feed transmitted. After 4 hours, you have 1 run-through of the stream. That is much too little to get anything useful out of, at best you figure out just a bit of the encoding stream if you're really lucky with recognizing the actual data.

If I mixed the random stream, even with PRNG-based methods, you'd completely wipe out any pattern matching attemps. Pattern matching through something encoded with a random stream that's mixed up between each pass, and with the underlying data being very close to random too (by far the bulk of the data will be video feed or neural impulses) requires an incredible amount of intercepted data, and the power needed to analyze it would be enormous (and AFAIK quantum computing tricks can't help pattern analyze).

Hey, you could even have one random stream to encode with, and another random stream to determine how it gets mixed up after each pass (and another random stream to mix up the second etc., for as long as you need the chain to be). That sounds like it gives pattern matchers an exponential problem with only linear storage increase for the encryption.

[The Jopp]

Well, there are ways of completely cut of any kind of Spoofing attempt, and Encryption can always be slightly redesigned to take longer.

Standing order: Doublecheck command
Drone always doublecheck latest sent order from Persona (Spoofing will fail as the Spoofer does not get anything sent back to it, the drone checks if the order was genuine with Persona and says Ay or Nay if the response was correct or not.

Harder Encryption
There are several ways one can encrypt a signal or the information of a device.

1. Public Encryption
Public Encryption is the standard Encryption people have on their devices and one does not need any special skills for it. Decryption works as in SR4 Core Rules (Encrypt X2).

2. Secure Encryption
This requires an Encryption test and the successes are added to the Multiplier for cracking the encryption. A rating 4 Encryption and 4 successes on an Encryption test would raise the threshold to Encrypt X6.

3. Military Encryption
Works as Secure Encryption but takes considerably longer. Decrypt+Response VS (Encrypt [Rating] / 1 Hour).

[Serbitar]

[Smokeskin]

[Lebo77]

[Smokeskin]

[Rotbart van Dain...]

[Smokeskin]

[hobgoblin]

ah, the age old one-time pad, when will the debate ever stop?

[Smokeskin]

[The Jopp]

[Smokeskin]