Fetish-Numbers - Marie de Sade, Dr. Olaf Hoffmann (the beach read TXT) 📗

copier or to technical noise.
In any case, only what has been identified as undisturbed is used as a key. Thus an undisturbed channel is established on which keys are generated which are known only to the receiver and sender.

At most directly at the sender or receiver beyond the communication channels, information can still be intercepted in the form of an unencrypted or decrypted message itself.
This is what so-called backdoors in encryption programs aim at, through which attackers unnoticed before or after the encryption process, regardless of the keys used, can tap the message bit patterns. Backdoors therefore corrupt any cryptographic method, including quantum cryptography, simply because it bypasses the entire cryptographic part by accessing it through that backdoor.
Because backdoors can be discovered and used by any attacker, they generally corrupt and discredit the affected program, which becomes generally unusable.
In order to reduce the probability of backdoors, serious cryptographic programs will therefore always be open source, so that all knowledgeable, interested persons can immediately detect, publish and eliminate backdoors.

Quantum cryptography has other obvious weaknesses: Currently computers cannot exchange entangled quantum particles over public networks or even generate them locally. An attacker can always use sufficient noise on the quantum transmission channel to prevent the exchange of secure keys, making the method impractical. Sabotage of the sensitive transmission channel is therefore relatively simple. For both transmitter and receiver, a difference between technical defects and sabotage is not necessarily immediately apparent.
Frustration can quickly lead to the selection of unsafe communication channels, which are less susceptible to interference, but at the same time can be overheard.

Encryption via entangled quantum particles is therefore secure, but also susceptible to interference. Unlike classical communication, which can be implemented relatively robustly against interference from opponents, the weak point of quantum communication lies in the susceptibility of the quantum channel to interference. This in turn gives meaning to methods that are more robust, but actually less secure in terms of concept.

Because a great deal of information is exchanged on the internet today, and messages exchanged in the form of videos or digital books, for example, can be very extensive, it is an obvious idea to simply hide critical messages in a very large file using sufficiently complex, still robust encryption. Unauthorised persons cannot know, for example, in which cat video, in which 'selfie' encrypted messages are hidden like in background noise, in which video or digital book again random patterns were hidden like in order to exchange long keys unnoticed.
Finding a particular piece of straw in a haystack will remain difficult even for quantum computers, simply because additional information is missing about what is the relevant piece of straw in the haystack to be searched for.

Of course, this approach of obfuscation is also prone to errors. Should it come out how and where a key or an encrypted message is hidden, decryption possibilities are subject to similar conditions as for unhidden, classically encrypted messages. After all, with this method of obfuscation, messages can already be effectively hidden at all, so that they will probably not even be subjected to an attempt of decryption, because it is not apparent that exchanged data contains relevant information.
This is where the Kerckhoffs principle comes into play: encryption must not depend solely on the secrecy of the procedure, as this can be guessed at. Complexity and parameters must be sufficient to ensure security.
Obfuscation alone is therefore insufficient. However, as outlined above, it can save a dramatic amount of time until attackers find out what needs to be done for decryption.

In some cases, deceleration can also be an effective means against unauthorised access. This is especially true for passwords and keywords. In the best case, these are stored securely in encrypted form. Encryption is irreversible; it is therefore no longer possible to calculate back from the encrypted result to an original unencrypted character string. For authentication, the password entered is encrypted again and compared with the stored value. Therefore, the unencrypted password or keyword is never stored. This remains only as the treasure word of users.

If a password can't be checked more than a few times per minute, even the fastest attackers take forever to guess a password. However, this approach requires that the attacker does not have access to the list of encrypted values. Otherwise, attackers can test any number of passwords in rapid succession until one of them matches. Therefore, the protection of such lists of encrypted passwords plays a central role with the providers.
This can also be supplemented by the respective user through obfuscation, because a login is done by a combination of nickname and password. Providers must design a login in such a way that used login nicknames are not known. Often an email address is used to ensure uniqueness. In such cases, users are advised to use a different email address for different providers, as well as different addresses that are used publicly for normal communication purposes. Thus, attackers cannot correlate which combination of nickname and password belongs to which real person, who is no longer identifiable as the target of the attack. Providers of email services often offer the possibility to create multiple addresses.

In any case, large files can be well suited for obfuscation within the framework of classical cryptology in order to conceal that relevant information or critical keys are exchanged at all. A weak point is inevitably that the communication partners involved will not be aware of the fact that unauthorised persons can overcome this obfuscation to gain access to information. Thus, only encrypted information is hidden. Obfuscation is an additional means in classical cryptology to deceive unauthorised persons about whether or how information is exchanged, especially which small component of a larger amount of data has to be subjected to cryptanalysis to decrypt critical information.
If it is not clear what has to be investigated, the effort is inevitably great, as is the uncertainty about the results of an analysis, because it will inevitably come across data which were actually only added as noise. So even if a decryption succeeds, it remains uncertain whether the algorithm has been hoaxed, whether the information actually sought is deeper or hidden somewhere else.

The trick of a complex obfuscation is therefore to hide keys or encrypted messages in a flood of data, by no means to keep the encryption method itself secret and thus to evade a check for security holes. With complex obfuscation it is possible to decouple key exchange and message exchange in time and space, which in turn complicates the search for a cryptanalysis approach. By the time an approach is found, the message or key may already be inaccessible again, may have lost their validity or relevance.
However, the exchange of information between sender and receiver about where and how the information is hidden remains critical as before, although this can be a much shorter information than the message to be exchanged itself.

In this context, a cascade can also be useful: A data packet consists on the one hand of encrypted false information, whereby it is assumed that an attacker could possibly decrypt this false message with some effort. On the other hand, the actual message is hidden in it, again encrypted with a different method. This principle can be continued in a cascade, whereby it remains unclear to an attacker at which level his decryption has just arrived, whether the current result is therefore still false information or is already the secret information that was actually desired.
A similar approach is to offer so-called honeypots, this means special offers of fake information for attackers, so that they work off and invest valuable time in it instead of analysing the actually relevant data.

Encryption of Digital Works in Practice

What is the situation with encryptions of digital works, especially EPUBs now under German copyright law?
It is repeatedly claimed that copyright law prohibits the making available of encrypted works.
Is this really true?
This would make no sense, because what would the general public do with inaccessible files, mere cryptic bit patterns?
In practice, therefore, decryption is always necessary to allow the files to be used for the intended purpose.

Initially, copyright law only protects works as personal intellectual creations:
Works within the meaning of this law are only personal intellectual creations. [Copyright law § 2]
In practice, however, encryption is neither done by authors as personal intellectual creations nor by authorised institutions such as publishers. Encryption is carried out by distributors, again not as a personal intellectual creation, because programs are used for encryption which automatically perform this encryption. Furthermore, the object of the sale is not the encrypted file as a potential personal intellectual creation of the programmers of the encryption programs, rather the work of the authors was requested by the buyers. However, the encrypted file is the target of decryption.

As a result, encryption and decryption should be seen more as a transient part of the sales process carried out by the retailer and not as an integral part of the digital book purchased. If decryption were prohibited by copyright law across the board, it would be legally impossible to read such works at all. Moreover, copyright does not restrict the programmes with which digital works are made available to the public, so it is irrelevant how a sales process is concluded with final decoding. Basically, a sales process can only be considered successfully completed when the digital work is accessible to the public, which has been the central purpose of the purchase.
Therefore, the encoding here is more similar to a sales packaging, as it is more often found in printed books in the form of welded plastic foils. The foil may come from the printer, the packer or the retailer, which is irrelevant in this context. Removal of this foil only leads to the intended use of the work and does not remove the effective protection of the work in terms of copyright. This again does not exclude the possibility that the foil may protect the work from dirt, for example, during storage or exhibition prior to sale. However, removing the foil after the purchase is certainly not to be considered as circumventing effective protection in the sense of the law, and is therefore permitted, even necessary, before the work is received.

This is specifically stated in the law [copyright law § 95a]:

(1) Wirksame technische Maßnahmen zum Schutz eines nach diesem Gesetz geschützten Werkes oder eines anderen nach diesem Gesetz geschützten Schutzgegenstandes dürfen ohne Zustimmung des Rechtsinhabers nicht umgangen werden, soweit dem Handelnden bekannt ist oder den Umständen nach bekannt sein muss, dass die Umgehung erfolgt, um den Zugang zu einem solchen Werk oder Schutzgegenstand oder deren Nutzung zu ermöglichen.

(2) Technische Maßnahmen im Sinne dieses Gesetzes sind Technologien, Vorrichtungen und Bestandteile, die im normalen Betrieb dazu bestimmt sind, geschützte Werke oder andere nach diesem Gesetz geschützte Schutzgegenstände betreffende Handlungen, die vom Rechtsinhaber nicht genehmigt sind, zu verhindern oder einzuschränken. Technische Maßnahmen sind wirksam, soweit durch sie die Nutzung eines geschützten Werkes oder eines anderen nach diesem Gesetz geschützten Schutzgegenstandes von dem Rechtsinhaber durch eine Zugangskontrolle, einen Schutzmechanismus wie Verschlüsselung, Verzerrung oder sonstige Umwandlung oder einen Mechanismus zur Kontrolle der Vervielfältigung, welche die Erreichung des Schutzziels sicherstellen, unter Kontrolle gehalten wird.

Translation:

(1) Effective technical methods for the protection of a work protected under this act or other subject matter protected under this act may not be circumvented without the consent of the rightholder, provided that the person acting is aware or must reasonably be aware that the circumvention is being carried out in order to enable access to or use of such work or subject matter.

(2) Technical methods within