Whatever happened to CipherSaber?
Some of you still know how a modem sounds. Back in the days of 14400 baud strong encryption was rare. Compression was king. Every bit counted. And you had to protect yourself. This is where CipherSaber comes into play. Given the exclusive use of strong cryptographic algorithms by government authorities, the CipherSaber algorithm was meant to be easy enough to be memorised, and yet strong enough to protect messages from being intercepted in clear. It is based on the RC4 algorithm. According to the designer CipherSaber can be implemented in a few lines of code. Basically you have crypto to go which cannot be erased from the minds of the public, because it is readily available. That’s where the name came from. It is modelled after the light sabers found in the Star Wars universe. CipherSaber’s web site claims, that „…Jedi Knights were expected to make their own light sabers. The message was clear: a warrior confronted by a powerful empire bent on totalitarian control must be self-reliant.“ It is obvious that the algorithm has its roots in the crypto-anarchism movement (also connected to the cypherpunk advocates which are still alive and kicking).
RC4 and CipherSaber haven’t aged well. RC4 is obsolete. Both have disadvantages and are prone to several cryptographic attacks. The state of the art has moved. Modern algorithms are much more complex. It’s hard to implement anything from the pool of strong algorithms in a few lines of code these days. Furthermore modern processors have taken a beating by design flaws such as Spectre and Meltdown. The ecosystem of communication has changed. Sending messages is becoming more and more centralised. Social Media platforms and their messenger apps rule. Alternative messengers often have a centralised approach, too. The computing platforms are pushed into Walled Gardens of Proprietary Delight. Of course you can still write code and run it, but the underlying layer is controlled by someone else. At DeepSec we have seen our share of malicious hypervisors and operating systems (modified or unmodified by adversaries).
The reason for the creation of CipherSaber is still there. The Crypto Wars are still raging. The battlefield has shifted. The reason against introducing any weakness in algorithms, using key escrow, or implementing backdoors has not changed. Either you want a secure system or you don’t. There is no middle ground. Mathematics does not offer a compromise. On the technical side messengers such as Signal and Threema are very popular (among people who care about secure communication; and yes, the list is quite incomplete). The problem is that you have to register your device with an app store. The device needs to be a smartphone which in turns give you a lot more (surveillance) than just secure communication. Decentralised networks are still in development phase. The only widespread decentralised messaging network is email which in turn is being strongly connected to big companies who do email hosting (and sometimes develop smartphone operating systems).
The future of CipherSaber replacements lies in open standards which are free to use. As a consequence of Edward Snowden’s global surveillance disclosures (which was no surprise for any self-respecting cypherpunk and serves as a proof for the suspicions of the CipherSaber designers) the tech world has reacted. The Internet Engineering Task Force (IETF) has declared pervasive monitoring as an attack. The Institute of Electrical and Electronics Engineers (IEEE) has adapted its position on security. The IEEE Board of Directors adopted a position statement in support of strong encryption for confidentiality and data integrity. The standardisation process of the new Transport Layer Security (TLS) version 1.3 has fought attempts to weaken the security. The tools have changed, but the goal of having strong security as a component for information security as a whole has not changed.