The danger of homebrew crypto

Previously I was agreeing with Schneier that "public domain encryption is probably the correct choice", with reservations. To better illustrate the point however, consider some famous cases of closed source encryption.

Mafia boss undone by clumsy crypto

Clues left in the clumsily encrypted notes of a Mafia don have helped Italian investigators to track his associates and ultimately contributed to his capture after years on the run.

The recently busted Bernardo Provenzano, reputed to be the "boss of bosses" of the Sicilian Mafia, used a modified form of the Caesar cipher to obscure "sensitive information" in notes left to either his family or underlings.

via The Register, 2006. LZW USWKSJ UAHZWJ, AK, GX UGMJKW, FGL EMUZ VWXWFKW.ⁱ

BA jihadist relied on Jesus-era encryption
An IT worker from British Airways jailed for 30 years for terrorism offences used encryption techniques that pre-date the birth of Jesus.

Rajib Karim, 31, from Newcastle, was found guilty of attempting to use his job at BA to plot a terrorist attack at the behest of Yemen-based radical cleric Anwar al-Awlaki, a leader of al-Qaeda in the Arabian Peninsular.

Sentencing him at Woolwich Crown Court last week, Justice Calvert-Smith described Karim as a "committed jihadist" who responded "enthusiastically" towards plans to smuggle a bomb onto a plane or damage BA's IT systems.

[...]

Woolwich Crown Court was told that Bangladeshi Islamic activists who were in touch with Karim had rejected the use of common modern systems such as PGP or TrueCrypt in favour of a system which used Excel transposition tables, which they had invented themselves.

But the underlying code system they used predated Excel by two millennia. The single-letter substitution cipher they used was invented by the ancient Greeks and had been used and described by Julius Caesar in 55BC.

Karim, an IT specialist, had used PGP, but for storage only.

Despite urging by the Yemen-based al Qaida leader Anwar Al Anlaki, Karim also rejected the use of a sophisticated code program called "Mujhaddin Secrets", which implements all the AES candidate cyphers, "because 'kaffirs', or non-believers, know about it so it must be less secure".

via The Register, 2011. Excel, you know ? It's not only the secret agents cracking the case by Excel spreadsheet, it's the evil terrorists too.

Basically these people are living in a parallel universe of their very own, happily going about their business in Excel spreadsheets and braindamaged reimplemetations of ROT13, firmly convinced the holy amulet works and the lemon juice makes them invisibleⁱⁱ. Perhaps their driver is all the frustration accumulated during childhood, all those years spent unable to make the magic decoder rings work ?

This is, by and large, closed source crypto : the unfounded belief that whitey couldn't possibly have figured out your genius, Allah-inspired "idea". The ungrounded belief that all those other kids that stayed in school rather than quit at age 8 learned nothing at all for their trouble. The firm conviction that you can hide behind your finger. Because you're just that special, unique and overall cool, and J. C. never existed because you never bothered to learn the history of Europe - which is to say of this world.

The problem is ubiquitous. for that matter. Redditards who still haven't mastered the First Rule of Bitcoinⁱⁱⁱ insistently act as if their ignorance of MPEx has any impact on MPEx itself. Then get gutted. Voters who still haven't mastered the First Rule of Government^iv insistently act as if their ignorance of government corruption and lawlessness somehow erases the corruption and enacts legality. Then get gutted. Consumers who still haven't mastered the First Rule of Consumption^v insistently act as if their ignorance of Facebook policy somehow erases the mass packaging of their privacy for corporate consumption. On it goes, endlessly. And why not ? It's easier, after all.

It does not work, but it is easier, and you don't have to deal with all the mean people telling you just how stupid you are. Which you aren't. Because Allah.

1. MAX VTXLTK VBIAXK, BL, HY VHNKLX, GHM FNVA WXYXGLX.
   NBY WUYMUL WCJBYL, CM, IZ WIOLMY, HIN GOWB XYZYHMY.
   OCZ XVZNVM XDKCZM, DN, JA XJPMNZ, IJO HPXC YZAZINZ.
   PDA YWAOWN YELDAN, EO, KB YKQNOA, JKP IQYD ZABAJOA.
   QEB ZXBPXO ZFMEBO, FP, LC ZLROPB, KLQ JRZE ABCBKPB.
   RFC AYCQYP AGNFCP, GQ, MD AMSPQC, LMR KSAF BCDCLQC.
   SGD BZDRZQ BHOGDQ, HR, NE BNTQRD, MNS LTBG CDEDMRD.
   THE CAESAR CIPHER, IS, OF COURSE, NOT MUCH DEFENSE.

   [↩]

2. True story. [↩]
3. TALKING ABOUT BITCOIN, EVEN IF IN A GROUP, DOES NOT MAKE YOU PART OF BITCOIN. [↩]
4. If you're not ruling them, they shall rule you. [↩]
5. If you're not paying, you're not the customer, you're the meal. [↩]