Schneier on Security

Clive Robinson • January 11, 2018 10:02 AM

So we get the “You shall be our slaves and vassals” quip,

When a court issues a search warrant or wiretap order to collect evidence of crime, the company should be able to help.

No the company “shall not be forced into indentured service”, they espouse a free market system then they should live or die by it. Either they pay what independent consultants ask or they should grow their own talent, either they are uterly and moronically stupid or they have ulterior motives. Whilst it would be nice to think it’s the former I would bet on the latter. There is a plan you can be certain but this is just one steping stone not the end game, and as has been pointed out “The price of freedom is eternal vigilance”. These people are not going to give up they have been at it one way or another since before we ever heard of the Clipper chip. Like disease ridden mosquitoes, it does not matter how much you wave your hands they will keep coming back to put the bite on the population to rend them low, mad or both with their infective agent. As with mosquitoes you need to drain the swamp and poison every last place they might hide as well as using a powerfull deterant they can not get through[1].

But there is a darker side to these warrents. In the past when it was your papers, they had to present them to you or your agent. Thus you were given due notice, and you could use other legislation designed to give “equity at arms” to help defend yourself. With electronic communications they can keep looking and searching untill they find something, anything by which they can bankrupt you or in other ways strip you of your rights.

It is obvious by the many motions filed that part of their game plan is “rights stripping” that is to force you into a position where they can and will ruin you or drive you to your death. They have done it before, they are still doing it and they will step it up. Remember guilt or innocence is of absolutly no interest to them, getting press is what careers are made with… Thus when the knock comes you are already guilty or dead, you just don’t know it and you won’t be alowed to find out the who and the why of it…

@ echo,

Law enforcement have metadata and time on their side. I wonder if this demand for backdoors is really laziness on their part i.e. them expecting confessions and communities to provide leads and backdoors are just a means to this end.

As I indicated above part of it is “rights stripping” other parts would be “parallel construction” oh and in the UK “entrapment” would be high on the list as would be “placing” of agent provocateur’s for “incitement” purposes. Then there is the “passing on” of surveillance to commerial organisations like Sony, etc etc so that lawful protesters could have civil injunctions taken out against them by the commercial entities. The Met Police have been some what “ham fisted” about all of the above and the information has leaked. It is known that both MI5 and GCHQ have been involed upto their necks in it, the question is thus what have the Secret “Service” (MI6) been upto at home and abroad. Maggie Thatcher gave them handouts above inflation and they all still do rather well out of the UK tax payer… So they are “Pleasing, teasing or blackmailing” those who hold the purse strings. One such person they very much had under their thumb at her tenure in the Home Office is our current Prime Minister, whilst ordinary policing got the chop new fairly usless intek agencies got the cash instead, which realy does not bode well for UK citizens…

@ Denis,

This is not an “FBI proposal”, this is a Deputy Attorney General speech

The FBI have been upto this “going dark” nonsense for a very long time now. Back long ago “the screach” was giving private briefings in Europe about it and ironicaly it leaked out. We only know a very tiny fraction of what Edgar J. Hover got upto because those acolytes he had covered it up, but they almost certainly carried on as “true believers” always do. As they were in positions of power they could select train and promote other acolytes to “Maintain the Faith”. It is this legacy thinking you see behind both the FBI and DoJ behaviour to twist and warp and bend the law to their chosing. They have been at it a long time and the failing of their case against Apple was just an unexpected bump in their track, it did not derail anything just shook things up a little. They will do it again with some organisation less able to fight back untill they have the judgment they want as president to go back and take Apple or similar giant down. Thus have an example to beat others with. It’s exactly the same sort of game that gave the US the war on terror. Official US policy is beat up on the weak to set an example to the rest. Nations, corporations, citizens or even innocents abroad, that is the policy if Psyco Uncle Sam sees hesitation to jump to the whims the Puppet has. The real question is the “follow the money” one of “Who benifits” and pulls the puppets strings, it is sure bot the average US citizen. But when a US President warns the people of the MIC is he mad or giving due warning?

[1] I’ve talked about powerfull deterants they can not get through before, but nearly all of us are our own worst enemy due to “ease of use” it destroys OpSec and that is just one reason why they know they will win if they go softly softly and close the net around the entire population.

Clive Robinson • January 11, 2018 1:10 PM

@ hmm,

FWIW it has nothing to do with law enforcement terminology.

Who cares that’s boring, the other version is so much more fun style wise.

But it also gets the no such thing as NOBUS across to the ordinary bod on the street, which is the important thing.

Any way the FBI tried foisting “Golden Key” and “Frontdoor” make it sound nice names on us under that loony Comey and it panned for them. Thus it’s our turn to force “exploit”, “crime hole” “Arse end entry”, “Draws Dropper” and anything else that sounds bad or derogatory on them. It is after all only fair 😉

It’s a war of words and meaning, I’d call it illegal propaganda by the FBI but then they get all upset when justifiably accused of committing crimes, which makes their trigger fingers itch at the very least as various FBI extra judicial executions have shown.

Clive Robinson • January 11, 2018 3:00 PM

@ Doug,

And in the end, when they just force it on us – or make things they can’t break illegal, amounting to the same thing and making it even easier for them – they’ll say “well, we asked nicely, over and over…”

There are things you can do that have been common knowledge for over a century that you can still do today as long as they alow you a communications path at some level.

Let’s say I send you,

You up for a drink Friday usuall place and time?

What does it actually mean?

If I sent you,

When the seagulls follow the trawler, it’s because they think sardines will be thrown into the sea.

You might be suspicious unless of course I’m Eric Cantona.

The point is with care “One Time Phrase” codes do work. Some will also work if used repeatedly quite innocently but then used at a pre agreed time where their meaning changes. Likewise their place in a conversation.

Such systems came most obviously to the fore in WWII with the BBC transmitting “And now some messages for our friends” followed by half a different sentances. Some were One Time Phrases others were “nulls” used to pad out to the same number of messages to avoid traffic analysis.

Such systems hide in plain sight to some degree but they are neither simple codes or stegonography that can be found by various simple analysis techniques. They do have the same strengths as One Time Pads but not the same flexability, but they don’t stand out under simple analysis as One Time Pads do.

Thus the FBI have a problem, the One Time Phrase can be sent under their noses without them being able to say they are a code, or even recognising them as such. Further implanting spyware into the user device will not gain any advantage as it’s the human mind that extends the security end point beyond the comnunications end point.

Clive Robinson • January 12, 2018 8:46 AM

@ Doug,

As others are likely to be reading along I’m going to be a little more formal to stop them making assumptions that could hurt them.

So,

The real problem in my eyes is key exchange

Key Managment (KeyMan) is a way way more complicated process than most can even hazzard a guess at. Ignoring all the KeyGen, storage, distribution, audit and secure disposal issues you have the “turtles all the way down” issue of getting to the point of “Secuerly and covertly transfering the first/master key/seed/secret”.

Whilst the use of asymmetric PubKey can –maybe– give you a secure channel, it’s use in most occasions is not at all covert. Thus you need another layer of secure covert rendezvous protocols which means… yet another turtle. That’s why an in person meeting is what traditionaly it has boiled down to.

In some past cases a OTP typed on cigarette paper thats been washed in permangenate in a “brush by” in the street or similar using age old school field craft is the solution, but not “dead letter boxes” as the chain of KeyMat custody would be broken which is a major no no for KeyMan.

It’s an issue the open crypto community has been avoiding addressing for years, in part because Diffie-Hellmen was seen as a “good enough” solution to what may well turn out to be an intractable problem of “Holy Grail” proportions.

Which brings us around to the master secret issue. As you say,

For that matter, you could just agree that the bits starting after some number in say, a kitten video you send the link to, are the one time key till updated. Your keyphrase is then just the number you begin at, using it in similar fashion to a one time pad after that – perhaps whitening it a bit to make it a little less obvious.

Is fine for fun / experimentation, but as we now know the larger SigInt agencies that straddle communications choke points have a “Collect it all” policy with a “forever” clause on what might constitute crypto (including plain text that might be KeyMat). Stream ciphers which the OTP method is, using a public text makes it a week “Book Cipher” which are extreamly vulnerable to “Similar/Guesed Key” attacks. Put simply you do a trial run on part of a suspect “book cipher” and check the statistics of the output. Whilst incredibly dull work if done by hand it can be easily automated and increadibly fast these days with the entire top 100 alltime best sellers being fully checked for probables in mear seconds.

Which often gives rise to a thought process…

If you have an assumed secure cipher like AES256 and a secure mode to use it in on a public text how secure is the output, and can that be sufficiently secure to use as a practically secure One Time Pad with a little post encryption touch up[1]?

The answer is that it turns out to be likely to be less secure than using AES in CTR mode, due to the “reuse” issues inherant in plaintext. It’s thus actually more secure to use a seeded counter as the input to a block cipher and the plain text as extra whitening in a chain cipher[2].

The important point to note though is that you can not just use parts of a “book” such as a publicly available kitten video, you have not already used.

Which brings us around to the “Security and Communications end point” issue,

Obviously, no one’s actually going around breaking good crypto – it’s all side and back channel stuff in all but perhaps a rare and extreme case.

As always the SigInt agencies will go for the “easy route” where they can. However that may be a different approach depending on if it is a “targeted attack” rather than the prefered “hover it up” attack”.

If the security end point is before the communications end point they may just go directly to an “end run attack” at the HCI level as this will in most cases be valid plaintext. Thus the likes of the Signal protocol will not protect a user who has WhatSapp on a mobile phone. Because the likes of CarrierIQ and similar “tech support” software just logs not just the ciphertext comming in but likewise the plaintext displayed to the user, and sends it off to some server on the Internet where noboubt the SigInt agencies have “tee’d” the first upstream router to send them a copy of every users messages and plaintext at the HCI. Even if such software is not already on a smart phone the use of various Over The Air protocols will get it on there. Similar applies to connected desktops, laptops, netbooks, pads and PIMs. The clear message is “They own your device not you and they can do anything they please”.

Thus even is Apple goes to bat for you in one area they have no choice in others. Thus Cloud backups are not yours they are the Corporates and thus third party business records not even requiring a warrant from a judge, just an NSL at most…

To be secure the security end point not only has to be off the communicatiins device, it also has to be in effect “side channel” free to stop the hidden onwards comms channel. Thus the ciphertext must not be random uninteligable charecters, but an easily read apparently plaintext string that the human mind can easily remember. Without these properties it’s game over. So whilst the One Time Pad –cipher– “sounds cool” it’s a bit of a nightmare to use, thus the One Time Phrase –code– trumps it in many ways, providing you have sufficient fore knowledge to make a suitable code. Because a user can just look at the phrase and either immediately know what it means from memory, or can put the phone down and do other things untill they can surreptitiously slip of and look it up in the code book.

When it comes to OpSec “simplicity and ease of use” trump just about everything else almost every time.

But in addition also making an attackers life hard for little effort is almost always a good thing. Which brings us around to,

You could also (and I note in an interview with Snowden and Bruce this was quickly subject-changed) layer a few types of encryption, perhaps designing it so that a little garbage plaintext would show up if one layer got broken successfully. This would of course drive human analysts crazy with false positives

I’ve no idea why either Bruce or Ed would shy away from this area it’s a fairly standard thing and has been for so long its beard is longer than both mine and Methuselah’s combined.

If you look at a successfull hand cipher they rarely encrypt plaintext directly, they either compress or precode it before ciphering. This is the first level of making life harder for an analyst and something that must always be done with a stream cipher, which includes the One Time Pad[3]. If you look up the VIC cipher[4] you will see it has a simple method of changing the plaintext from a 26 member alphabet to a 10member alphabet using a “Straddling Checkerboard”, and as part of the process flattens the statistics quite a bit.

Most people do not think about using the straddling checkerboard or other compression system in reverse to change the “give away” near flat statistics of the One Time Pad into something with statistics that make it look like a simple non polyalphabetic cipher.

There is also the notions of “Russian coupling” and “Indicator embedding” to consider. You can obviously “plaintext embbed” as well.

That is you take your ciphertext output from the OTP break it at some point and move the first part to last. You then at the correct point put the indicator in, which is the normal procedure. Then decomoress it to change the statistics You then add random plaintext encrypted with a non polyalphabetic cipher and add it in using the equivalent of a grill method. This also has the ability to act as “nulls” to padout messages to a fixed size. Yes it makes the final message quite a bit longer but the old “minimum on air time” rule[5] does not apply to digital communications networks.

As I’ve said these techniques are not exactly new, they have been suspected to be in use with the likes of Numbers Stations and other “Home Station” broadcasts all through the cold war, and they have recently shown a resurgence of use, with North Korea supposadly putting more into service in the HF bands with skip down in most of the US and Europe. Also apparently causing interferance and jamming to existing services in South Korea[6] via NVIS antenna radiation which is difficult to DF beyond the ground wave (a mode I happen to like as well 😉

The problem is injudicious use of crypto which makes,

But it’s all fantasy, the problem is that when they grab that level of control over everyone, you’re had, secrets kept or not.

A point of concern.

It’s why the use of sensible One Time Phrases and effectively OffLine usage via the human mind is where it will end up as long as some method of communication is alowed. And I suspect there is way way to much invested in “Social Networking” for it to be stamped out. Whilst Governments can be powerfull they are far from onipotent, and it’s a quater to a third of a century to late to put Social Networking back in Pandora’s box. For instance it is known that even North Korea’s do Social Networking via Smart Phones on mobile phone networks in China. The cost of trying to stamp this out is too great compared to monitoring it. Thus the trick as normal is “looking innocent” and “staying under the radar”

There is a problem with TRNG derived One Time Pads that you note,

But then… You have all these “white noise” files on your system, or other issues they can decide not to like you about.

It’s why the question about AES256 or similar in CTR mode arises. As has been noted the RC4 stream generator was sufficiently simple that it could be memorised and coded in five minutes by even an average programer. There was also the Perl implementation of a crypto algorithm that was printed on a tee shirt that could also be memorised. We are bringing into this world a whole new generation of programmers who use Python which has certain advantages as most interpreters do. The thing is that we need crypto in many forms otherwise the first world economy will grind to a halt rapidly. In times past there were arguments about 40bit Crypto for Export but alowing full size hash algorithms to be exported. It takes very little in the way of brains to look memorise a Horst Feistel round structure and see how a hash function could replace the one way structures in the Feistel round. Likewise memorising a Key Expansion scheme using a hash function is very easy as is turning a hash function into a keyed stream generator. Writing the Python code to do this fron memory whilst not quite trivial is more than possible for quite a few people.

Thus writing a program to generate One Time Pad sheets to a printer or just typing the crypto/plain text in to get plain/crypto text out is more than possible if not easy with a little practice. Thus booting a disconected PC from a CD/DVD run from RAM distro and typing in the code into the python interpreter is a possability that gets around the use of TRNG derived “White Noise” files.

Whilst I’m not suggesting people do any of this, it will give then ideas they can work on such that if ever the need arises they have a position to fall back to.

As for “being selected” there is nothing you can do about that once it starts, it has to run it’s corse irrespective of anything you do. There are still people who lived through Senator McCathy’s “Unamerican Behaviour” witch trials, where people were more than happy to lie under oath about other people to either try and save their own necks or for the fame of being a star witness, or strut around being “A big man” in a snazzy uniform with lots of badges and medals. The US citizens sat there night after night watching it like a spectator sport and did nothing but sit and watch. This is a fairly common human failing and history shows it happening with regular monotony.

Put simply there are Authoritarian leaders, who can only maintain their position due to mindless authoritarian followers or chancers, and they only maintain their position because the rest of the citizens let them one way or another… As long as humanity does this then your chance of being selected is just pot luck, because of the “I’m alright jack” attitude untill it’s their turn for the “midnight knock”…

Like death it’s one of the few certainties in life. It’s what the various documents the founding fathers and others drew up to stop it happening. In all honesty do you think the authoritarian in the DoJ / FBI / NSA / CIA care one jot to the oath they swore to the Constirution? Nope me neither, how about their had selected authoritarian follows? Nope me neither. How about good old Joe public? Is his head out of the sporting pages? The Romans used Bread and Circuses, the West Beer and Sport. Mind you back in Ceasers day they were for free, these days theres a bunch of rent seekers holding their hands out to fleece you to the core.

Sorry to end on a grim note, but realy that’s the way of the Western world today and I doubt it’s going to be any better tommorow or the day after… It’s a get down –on your knees– or get out –of town– culture. You atleast have taken some steps away from it and I sure wish more than a few others would to.

[1] I won’t go into the details again, but genuine unbounded output from a TRNG is not suitable for making an OTP due to Run Length issues without having adjustments made to reduce plaintext leakage by changes in the output statistics. Nor for that matter is output from AES256 regardless of the modes you might use it in for the same reasons.

[2] Chain ciphers like 3DES whilst conceptually simple have a few issues that can be looked up. But if you think about it with 3DES if you use a seeded counter as the primary input you have three non output chain points you can add XOR type whitening. As long as one of the ciphers is keyed, you can use crypto hashes for other positions in the chain after whitening.

[3] People misunderstand how a stream cipher and in particular the OTP work and what their security promise is. They do not guarentee to make a message undecipherable, only to make all possible plaintexts equally probable. It’s one reason why an incorrectly made OTP can leak plain text and book ciphers can be broken by the sawbuck method. The way to limit this is to change the statistics of the plaintext first. That way the real plaintext looks like random gibberish and does not make it out of a simple fast statistical checking process as a “probable”.

[4] https://en.m.wikipedia.org/wiki/VIC_cipher

[5] Early “Spy Sets” are truly appaling in many respects, I’ve one or two in my collection along with Mil comms gear. WWII kit was “morse code” and was in effect a “keyed power oscillator” and a “Direct Conversion” converter to get side tone and reception. Often they would use a single crystal for frequency control and back in WWII these were not those tiny welded “relay can” HCU devices but bakalite containers the size of a matchbox with two bannana plugs 1/2inch appart at one end and a rubber gasket and screw down lid at the other with internal spring clips and plates to hold the natural quartz resonator. It realy did not matter if the key was down or not, it leaked signals from the oscillator all the time it was on and the German radio service were known to be able to Direction Find from upto ten miles away. Which made the life expectancy of all but a light traffic radio operator quite short unless they were very cautious and clever about their OpSec.

[6] http://nationalinterest.org/blog/the-buzz/north-korea-broadcasts-really-strange-messages-new-nuclear-20183

Clive Robinson • January 13, 2018 3:00 PM

@ Jacques, All,

More and more people realise that Gmail is simply a massive surveillance system, and it was so from the beginning:

Whilst the more savvy users have caught on, there are a whole host of users that even though they are clued up they have no choice. Some are considered our most vulnerable ie school children/students where there academic career is on various google storage center mass storage, which also means with high probability the NSA and other US IC entities have it as well.

Put simply schools, collages universities have been pushed by those like Deans who have their fingers firmly in the institutions till into Googles various offerings. Thus neither the the academics, the children/students or their parents have any choice, they get told “Use or be Failed/Expelled”…

It is as they say “Utter Madness” but those institutions that have now effectively become “Hedge Funds” have an insatiable desire for the students loan monies, but offer less and less in return. It’s now not at all unknown for a student to be taught/mentored and in effect supervised by older students, who are often paid way way less than they should be.

It is a disaster in not just the US Education system, and it does not bode well. The view of a number of –cash grabbing– “advisors” is “AI will replace the need for not just unskilled labour but all the way up to researcher assistants, technicians and engineers”… The trouble is they appear incapable of “joining the dots” in their arguments… This sort of thinking was around in the “money men” back it the Thatcher/Reagan era, with bold but stupid statments such as in the UK “We will only need a service industry” well we know how that played out several Banking Crisis and Recessions later, with “Quantative Easing” and it’s like robbing the bottom 99% of the population over and over for the massive benifit of the 1% of the 1%…

Clive Robinson • January 23, 2018 7:54 AM

@ Wael,

BSPMBS is sick, I hear.

I had heard he was a weedy sort, obviously the BS has got to him. Perhaps a change would be as good as a rest… Maybe he needs to get out and just smell the grass instead?

Obviously if he so tired he needs to avoid getting burned, out side up on a stretch might be better for him.

Clive Robinson • January 23, 2018 9:20 PM

@ BSPMBS,

I can neither confirm nor deny we are spooks.

Well thanks for telling the world…

The boys in the “service” do not use the word “spooks” ever, they are and ever have been “Officers of His/Her Britanic Majesty’s Government”. Ever since Mr “C” Cunningham made them “Pasport Officers”.

So the line should be,

We can neither confirm nor deny the points you have raised

As for the ‘clodies’ on your side of the pond they have their own PR people call your people for a meeting in the old capital building, for an official “off the record” briefing. Apparently Hayden and Rice did a lot of these…