Since I am not going to log into their blog thingy to answer their question as to why it was taken down I'll just answer 'Why the DMCA request?'
It's illegal in the United States to have the capability or share information on how defeat crypto that is used for the purposes of enforcing copyright restrictions.
Since DRM-style cryptography is fundamentally flawed technology (ie: you have to give the crypto keys, the software,and the hardware capable of decrypting the media to the people you want to protect the media from) in depends on government enforcement (ie: threats of violence) to stop people from making products that make it easy to break DRM.
We can thank Bill Clinton and friends for this lovely bit of legislation.
DMCA notices can only be used to allege copyright infringement, not violation of the anticircumvention rules. If SE was delivered a DMCA notice, it was over the images or text in the post infringing some copyright, not the nature of their content.
While they're technically both part of the same bill, the safe harbor system (Title II, the Online Copyright Infringement Liability Limitation Act) is totally separate from the anticircumvention stuff (Title I, WIPO Copyright and Performances and Phonograms Treaties Implementation Act).
It's certain that it's shit. They pull words out of strings and AES encrypt each one with the provided key (deterministically, either no IV, or a constant one). "Hi, Alice" -> <AES "Hi"> + ", " + <AES "Alice"> + ".".
That way a query for strings containing "Alice" (through virtue of symmetry and determinism) can have the expected results, as well as allowing them virtually any storage back end.
This makes them vulnerable to frequency analysis and known-plaintext attacks, as well as probably not working at all for CJK languages or any other type of value which isn't trivial to split into useful tokens.
Thanks for the explaination. Even if this is a protected and valid use of DMCA, it doesn't strike me as a strong move for a company confident in its product.
This isn't what I would consider "technologically sophisticated cryptattack", but instead just looking at some screenshots or slides and doing a quick observational analysis on them.
If the analysis were wrong, it might just come down to "well that's how our designers ended up making the slides/video" (replacing each word with a hash of itself), then I think it might make more sense to issue a statement that the advertising materials weren't exactly matching how the encryption works. Not sure if that would open them up to libel though.
Comments
Since I am not going to log into their blog thingy to answer their question as to why it was taken down I'll just answer 'Why the DMCA request?'
It's illegal in the United States to have the capability or share information on how defeat crypto that is used for the purposes of enforcing copyright restrictions.
Since DRM-style cryptography is fundamentally flawed technology (ie: you have to give the crypto keys, the software,and the hardware capable of decrypting the media to the people you want to protect the media from) in depends on government enforcement (ie: threats of violence) to stop people from making products that make it easy to break DRM.
We can thank Bill Clinton and friends for this lovely bit of legislation.
DMCA notices can only be used to allege copyright infringement, not violation of the anticircumvention rules. If SE was delivered a DMCA notice, it was over the images or text in the post infringing some copyright, not the nature of their content.
While they're technically both part of the same bill, the safe harbor system (Title II, the Online Copyright Infringement Liability Limitation Act) is totally separate from the anticircumvention stuff (Title I, WIPO Copyright and Performances and Phonograms Treaties Implementation Act).
Oh, and given that 'CipherCloud' seems intent on suppressing information about their cryptography it's probably a very safe bet that it's utter shit.
It's certain that it's shit. They pull words out of strings and AES encrypt each one with the provided key (deterministically, either no IV, or a constant one). "Hi, Alice" -> <AES "Hi"> + ", " + <AES "Alice"> + ".".
That way a query for strings containing "Alice" (through virtue of symmetry and determinism) can have the expected results, as well as allowing them virtually any storage back end.
This makes them vulnerable to frequency analysis and known-plaintext attacks, as well as probably not working at all for CJK languages or any other type of value which isn't trivial to split into useful tokens.
Thanks for the explaination. Even if this is a protected and valid use of DMCA, it doesn't strike me as a strong move for a company confident in its product.
This isn't what I would consider "technologically sophisticated cryptattack", but instead just looking at some screenshots or slides and doing a quick observational analysis on them.
If the analysis were wrong, it might just come down to "well that's how our designers ended up making the slides/video" (replacing each word with a hash of itself), then I think it might make more sense to issue a statement that the advertising materials weren't exactly matching how the encryption works. Not sure if that would open them up to libel though.
Did you just refer to stackexchange as a "blog thingy"?