The macosxhints Forums - Can mac users be spied on using PROMIS software?

The macosxhints Forums (http://hintsforums.macworld.com/index.php)

- The Coat Room (http://hintsforums.macworld.com/forumdisplay.php?f=8)

- - Can mac users be spied on using PROMIS software? (http://hintsforums.macworld.com/showthread.php?t=84623)

Quote:

Originally Posted by iampete (Post 444354)

Maybe a back door isn't really needed, after all. From Wikipedia:

Doesn't this imply that no matter how secure AES itself may be, it can be defeated in a de facto sense if the security incorporated into the computer has any unauthorized access "holes" at all? As previous posters have stated in different words, there is no absolutely certain firewall.

I wonder how many bit encryption was cracked. As far as I know, AES 128 and 256 have never been cracked, although the systems they protect have been, on rare occasions, by methods other than defeating the encryption.

Personally, if it were that important to me to breach someone's encrypted computer, I would probably use a small camera to monitor the keyboard for the password, or some other way that would be far, far easier than trying to break the encryption directly.

Quote:

Originally Posted by J Christopher (Post 444370)

Apparently, it is AES 128, and in a matter of just seconds!

From their paper <http://people.csail.mit.edu/tromer/papers/cache.pdf>:

Quote:

. . . (my comment: referring to a "clean" testing environment) . . . we recover the full 128-bit AES key after only 300 encryptions on Athlon 64, and after 16,000 encryptions on Pentium 4E. . .
We then set out to test the attacks on a real-life encrypted filesystem. . . .we succeed in extracting the full key after just 800 write operations done in 65ms (including the analysis of the cache state after each write), followed by 3 seconds of off-line analysis.

It's also probably worthwhile to note that this is freely disseminated, common knowledge stuff that the powers that be don't really care about. I understand that historically, "they" have actively suppressed encryption/decryption info they really don't want the public to know about.