Schneier on Security

Clive Robinson • December 12, 2018 5:19 PM

@ All,

It will be intetesting to see how they intend to move beyond the “communications end point”…

If you look at a modern smart phone or other consumer communications capable data device, they are not “segregated” in a way that will stop a suitably resourced attacker getting to the Human Computer Interface (HCI) from the communications channel.

Which means that such an attacker has no need to attack the crypro / stego / other security mechanism, they just by pass it with an End Run Attack.

But such a backdoor only works because the security end point is inside the application that the attacker is bypassing, thus they can get to the communications plaintext.

If you have the security end point “Off Device” such that ciphertext only is at the communications device HCI then the attacker is forced to attack the protected communication because they can not reach to the security end point that is now “Off Device”. Thus “backdoor” legislation fails in it’s stated purpose.

Yup read it again, the legislation fails if the security end point is not reachable from the communications end point.

I’ve been through how you can extend the security end point securely for private communications if you plan appropriatly.

What it will not protect you against is “Online Applications” of any type that need or require access to the plaintext. Such applications realy should be either avoided or altetnative security measures adopted (which are way beyond a single post to describe).

The upshot is knowing this, you can now see that criminals and others this legislation is supposadly designed to catch will not be, unless they are realy inept.

Thus you have to question the real reason for this legislation and that is quite simple,

<

ul>It is to spy on the everyday citizen all of whom are seen by certain individuals as a threat or enemy.

These people fear democracy because their whole life is about being undemocratic for their way of life to exist. They purchase their way of life through the representatives you vote for, either directly or through various underhanded methods. Either way they have made themselves “Enemies of Society” and likewise those representatives they have suborned.

The only way you can rid yourselves of bad representativs is with publicity that stops people voting for them. Getting rid of those who see the ordinary citizen as the enemy is somewhat harder but can be done peacefully and legitimately given time, which unfortunatly is running out.

I for one have no wish to see,

The tree of liberty refreshed by the blood of patriots and tyrants,

Clive Robinson • December 12, 2018 6:24 PM

@ David Walsh, 65535,

Choosing to boycott Aus

Apparently the Israeli Government managed to interfere in the legislative processes in other countries to make it in effect illegal to “boycott Israel” and it’s goods, because the Israeli politicians see it as an existential threat[1].

Do you think Aus has the same “fifth columnists” to do the same for them?

[1] https://www.theguardian.com/news/2018/aug/14/bds-boycott-divestment-sanctions-movement-transformed-israeli-palestinian-debate

Clive Robinson • December 13, 2018 3:46 PM

@ patron,

With regards the Motherboard article on “Signal” I think everybody, should read it.

Oh and remember each Mobile Device has two serial numbers it uses on the network[1], the Electronic Serial Number of the Phone, and the serial number of the SIM. Also there is an identifier that becomes your phone number after translation through various databases. Neither serial number, identifier or the resulting phone number are secure[2] in any real way, and you can be tracked by BOTH serial numbers…

[1] Neither serial number is your “phone number” they are supposadly unique to each phone (IMEI = International Mobile Equipment Identity) and SIM (ICCID = Integrated Circuit Card ID). On the SIM is your identifier (IMSI = International Mobile Subscriber Identity), but this can be changed in various ways including an OTA, a feature that will become more prevelant as the likes of e-SIM[2] take off.

[2] Espicially with physical SIM cards being replaced with e-SIM and OTA profile files, https://www.mckinsey.com/industries/telecommunications/our-insights/e-sim-for-consumers-a-game-changer-in-mobile-telecommunications

Clive Robinson • December 13, 2018 6:42 PM

@ John Carter,

It’s a nifty taxpayer funded revenue stream.

Maybe in a few places, probably not in many jurisdictions (giving evidence is not just a compelable “civic duty” it’s required by “eminent domain”).

Whilst “switch” makers like Ericson charge a fourtune for the software, in many jurisdictions the telco’s are expected to swallow the loss for ever.

In part that was what the FBI/DoJ court case against Apple was, a way to force “something for nothing” against mobile end point manufacturers and OS developers.

It’s why the question of “indentured servitude” which is illegal in the US –except ironically in prisons– came up at the time.

Clive Robinson • December 13, 2018 7:04 PM

@ William Smithers,

Somewhat surprisingly to my mind is the fact no-one here has yet referenced what I think is one of the “jewels in the crown” that will be targeted by this – that jewel being TOR.

I’m sorry but using Tor is painting a cross on your back. The way prosecuters will get you is “Guilt by association” in the juries minds.

Due to the MSM everyone knows “Tor is the ‘dark web’ full of drug dealers, kiddy abusers, terrorists and worse”… The fact it’s not true does not matter it’s what the jury thinks or is lead/directed to think, and some at best circumstantial evidence that will get you a 5-20 spot somewhere. Like it or not that is what justice boils down to these days “Beyond Reasonable Doubt” is never mentioned and usually carved away by judges directions.

Clive Robinson • December 13, 2018 9:29 PM

@ David-8 of LV-223,

and some others including someone quite smart no one wants to name here anymore –

There have been quite a few that have come and gone, @RobertT, @Mike the Goat, @Figureitout and a certain Belgium with Rock interests @Dirk Praet, to name just a few, who do sometimes listen in and very very occasionally de-cloak.

And there are many others, even @Nick P, is very very seldom seen here, though he does pop up on lobste.rs and did on Hacker News a while ago. Even the redoubtable @Wael is rarely seen but does generally pop up and say hi when mentioned.

The thing is the better “open” security blogs got hit badly during 2016 due to various reasons, but also got hit by the banking crises. People kind of want to keep their heads down now recruiters and simillar “trawl the net” and run analytics. It has kind of “chilled free speach”.

Even @Nicholas Weaver who I sparred with on occasion now lurks rather than comments.

The real problem however is the “lack of qood quality news or research” to talk about. I can not remember the last time a crypto algorithm paper got discussed, I vaguely remember it was some suspect “lite” algorithm some one was trying to push into standards.

I know Brian Krebs talks about “patches” as and when they come out and some “same old same old” of company XXX loosing YYYmillion customer records, but it’s usually atributable to the same or similar mistake some other company made a year or more before. Yes it’s news but it’s like the soccer score of “Accrington Stanley” it happens but “what’s new”…

Just giving a loss number that is bigger than before is not realy interesting, do even a little analysis on the numbers would make it atleast something to think on and talk about.

The only news in security these days appears to be the latest round of lunacy from legislators…

It’s why I was glad to see meltdown and spector, they were long overdue, and I had hoped it would spark up a bit of enthusiasm in those wanting to get in whilst the going is good. I suppose I should not complain as it is the Xmas gift that is still giving a year later. But it’s kind of fallen into the “whats new trap” of new items being only a cigarette paper thickness from earlier exploits…

Any way if you want to see if some one is still around give their handle a rattle, the door just might open.

And it’s about time I reset my personal timezone as I’m running on East Coast time at the moment…

Clive Robinson • December 18, 2018 9:14 PM

@ Wael,

Hark what light…

One needs to eliminate meta-data or bring it at or below the noise floor.

Currently with the way the network part of the Internet works this is not possible. Because even though it is not “circuit switched” it is “Packet Switched” which are not “broadcast” methods but “point-to-point-reply” methods. That is not only do they have to be routed, in practice they require both ends to broadcast.

The only way to break this low level meta-data is by leaving the network of the Internet into a multi-homed host where individual traffic streams are terminated (so servers not routers).

But there is another issue which is meta-meta-data, which can “show the absence of meta-data”. Which is where,

None-tracability is also an important characteristics in the design.

Take for instance a server that is not “store and forward” or worse is also “low latency”. The fact the original meta-data is gone does not mean that the communications can not be still followed. That is routing meta-data might be removed but a new routing meta-data can be correlated by the meta-meta-data of time and in some cases “packet length” at the simplest level through to the packet cadence be it short term “jitter” through to longerterm packet bursts etc.

But even with long latency there is other meta-meta-data that can reveal meta-data. For instance counting the packets into a non-user host and counting the packets out will by a difference in numbers or “absence of meta-data” show that some data was actually destined for the host or originating from the host. Then by tying it via other meta-data or meta-meta-data such as length or offset time tie it back to a particular set of meta-data.

Therefore as there has, –by the way the network of the Internet works,– to be routing and other related meta-data to every packet communicated host to host, a way to make the meta-data usless beyond saying “an unknown packet was seen on a single host to host network segment” is required.

The easy way to do this is to always send a fixed rate of information from one host to another at a fixed tempo. That is you always send say one thousand packets a second on exactly 1ms time slots. But importantly the host at the other end recipricates at exactly the same rate and tempo. So that to an outside observer the only thing they can tell is two thousand packets per second are being transfered on that link, and because they are exactly balanced there is no indication of information direction or even movement.

At a higher level traffic is always sent to multiple hosts in an individually encrypted form. That way when a host decrypts the packet it will know if it is for it’s self, to be dropped or to be forwarded. The observer if they can see into this level but not into the packets will see traffic heading as a “broadcast” to several other hosts who in turn forward them on to multiple hosts for several steps and not know which if any of the hosts it was destined for.

But also at this level you add a degree of “store and forward” or more correctly “indeterminate buffering” which has the downside of increasing latency at each server. However doing this helps increase anonymity but at the price of some increased latency which means it is not suitable for some types of “interactive traffic”, which in many cases is only annoying to a user not actually in anyway disruptive and slight redesigns such as local buffering can alleviate[1] quite extensively. For even “voice traffic” where low latency and “full break in” is assumed for “telephone” style full duplex operating, a change to “two way radio” half duplex operating is usually quite acceptable. Humans are more flexible than many system designers think they are and will quite happily trade away “niceties” when they see the need to do so[2].

Store and forward is used at other levels as well, as it can be used to “even out traffic” load. That is when you analyze most data communication networks they tend to be bursty in nature. It’s why the Internet is packet switched unlike the telephone network that used to be circuit switched[4]. Bursty traffic is undesirable because you have to design for “peak load” rather than “mean load” which is not just expensive but inefficient. Store and forward can be used to bring the mean load close to the peak load thus making the system more efficient[5].

Whilst still inside the overlay network large data files that would “time out” on a regular TCP transfer can be themselves packetised at the input server and reasembled at the output server to help with maintaining the mean load at the circuit peak load. It also enables the packets not just to be sent on different routes but out of sequence as well, making an observers task that much harder.

With regards,

The intent is not to challenge authorities by demonstrating work-arounds to regulations. The intent is to show that the regulation is flawed and does not achieve the advertised intents.

My prefrence is to show not that the “regulation is flawed” but “entirely useless for it’s stated intent” thus others can see that “It’s stated intent” is in actuality a very deliberate lie to mislead or provide cover for malintent by the regulations drafters. I view legislation obtained dishonestly in the same way I view goods or money obtained dishonestly ie “Criminal Behaviour” where the perpetrators should be removed from any place they can do further harm to society (it’s why we have “malfeasance in public office” legislation but is insufficient to be effective). Put simply by definition a process can not be democratic if one party is wilfully lying about their intent.

Finally with regards,

And there is no proof I saw that demonstrates Asymmetric Cryptography is secure

Both block and stream ciphers are “bounded” so can not be “unconditionaly secure”. Thus any proof would rely on a complexity/time/resource argument. Whilst I’m happy to believe that at our current technological point in time you could say it would take X years with Y machines etc I know darn well you can not “project into the future” very far with technology points. Because at the end of the day technology changes quite dramaticaly within a decade any way and there is no way to predict outside of any human meaningful time –two decade generation– when the next big technology jump will occure.

[1] The simplest example of this is found in the *nix and similar “line discipline” buffering where what a user types in is kept local to them untill they hit the enter key then the whole buffer is transmitted. Not only is it much more efficient editing and similar can be done localy to the user where low latency is important.

[2] Back late last century there was some research done about personality types and behaviour. Part of which looked at communications. Without going into details it was found that those who had important things to communicate were more than happy to give up niceties and drop into single sentance conversations that got the information across reliably and effectively. Conversly those who could not or would not give up the niceties rarely had anything of importance to say, nor did they expect replys etc. As an older colleague at the time observed “The sort that talks like a shaper to a plant, or just ‘talks to the trees'”[3].

[3] They had worked at Henly and had indirectly worked with Meredith Belbin and was I think not exactly overwhelmed by the experience in any way. For those not British and of a certain age “I talk to the trees / That’s why they put me away…” was a catchphrase of “The Goons” radio show charecter called “Eccles” played by comedian Spike Milligan. Oh for those antipodeans that disdain “Belbin for “Margerison-McCann” an insenitive “Thruster-organiser” would be an archetypal “Shaper”. As for those in the US do you have any “Team Invinotory” types that would be equivalent? 😉

[4] The reality today is that the technology behind the high capacity networks of the Intetnet have to alow for low latency critically paced traffic, which circuit switching is considerably better at than packet switching. The result is that the modern switches and routers have moved towards supporting circuit switching very effectively via traffic managment. Thus building telephone networks on such switches and routers is now just as effective but a lot cheaper than traditional packetised circuit switching trunk switch equipment.

[5] A mechanical equivalent of “store and forward” would be a “fly wheel” in a transmission system that smooths out the “thumps” of low stroke engines or provides inertia compensation with switched or abruptly changing “snatch” loads.

Clive Robinson • December 19, 2018 11:58 AM

@ Wael,

And there are other ways, I’m sure

Oh there are. You might remember I occasionally point out that you need a certain minimum of components that are not secure to build a secure system.

I regard the DOD TCP/IP protocols upto version 4 as being “to simple a component to be secure” but OK to build secure systems from “If you know what you are doing”. As we know there are overlays on TCP or IP that are not sufficiently secure for various reasons. Thus at design time either the designers did not know what they were doing, or they actually knew exactly what they were doing when they designed an insecure system. As for later “vulnerability discoveries” not taking timely steps to fix them is shall we say something that is more wide spread than just secure network designs.

With regards “UDP?” at some level the host has to get information to work in the network for traffic to get to it, in that respect it’s more like a mobile phone than a Shortwave Receiver, that can just be turned on. Thus there is a finger pointing towards the host somewhere which the transmitter has to be able to find to route a UDP packet to it. So if the sending host can find that pointing finger so can others unless they are somehow prevented by mechanisms at a higher level. Which was what I was effectively discussing as you noted.

With regards,

although I don’t see the ‘constant’ part as a necessity

It’s not just “passive” attacks that can be used to reveal information via side channels, active attacks can induce them to appear. The most obvious of which would be to somehow “modulate” the timing/phase of the data packets and look for correlation elsewhere even though the meta-data has been changed through a host. As I’ve mentioned before systems especially those used as hosts tend to be very transparent in nature. Whilst it’s easy to see that an attacker corrupting a packet can see it’s down stream meta-mete-data by holes in timing, less easy to see and way harder to fix is the upstream effects caused by the error/exception signalling meta-meta-data propergating back through upstream hosts to the source for a re-transmission etc. Those meta-meta-data “ripples” go in both directions even on what to most appears a one way channel. They even work backwards through “Data Diodes” “Data,Pumps” and “Data Sluices”.

Think of the ripples if you like as “Standing waves” in a transmission line some one has deliberatly made a dent in etc, a lot can be learned from time delays (TDR) etc. Such tricks were first used on active EmSec attacks that came out of TEMPEST techniques and have comfortably moved over to the digital domain of network systems.

With regards,

We say if the cost of attack is much higher than the value of the asset, then the system is unconditionally secure (paraphrasing from applied cryptography.)

That is “wrong wrong wrong” in the same way as an economists free market…

Look at it this way an asset has a real value and a perceived value, black tulip bulbs being an extream example, or the modern day equivalent of Bitcoins. The real value of the bulb or bitcoin is very very small, though the cost of making it might be high, cost of making can as seen with art result in something worth less than the equivalent weight of fire wood or something people will pay tens of millions of dollars for. In either case the real value is the same but the perceived value can be beyond belief.

The cost of securing fire wood is minimal usually just inside an unlocked shed/outhouse, the cost of securing a “work of art” so much that you need a lot of paintings to make it worth while to do in anything other than a bank vault.

You thus drop directly into the “Defence spending” issue, if the owner over values the asset then way to much will be spent on securing the asset. If however the owner under values the asset then it will get stolen. As the owner has no way to know what value a potential attacker will perceive the asset at they can never know what value of spend will secure the asset, thus there never can be an “unconditional” about it.

The view I use of “unconditional” is the more common “not subject to any conditions”. Which is the likes of the One Time Phrase selected by what we would regard as a True Random Number Generator from a set of unrelated phrases to be matched via an independent True Random Number Generator selected meaning from the set of meanings.

It’s close but not quite the same as “Information-theoretic security” the main point to remember is that it’s security is independent of attackers resources. Or to put it another way, the chance of decrypting with paper pencil and a pair of dice is the same as all the computing power available. That is random chance that can not be verified as correct or incorrect. Whilst this might sound counter intuative it’s bassed on the premise that “all messages of the same length are equiprobable”. Lets assume you get a three charecter message that you know must mean “yes or no”. It’s clear to see that at the very least your guessing or compleate mapping out by brut force will yeild {y,e,s},{ ,n,o},{n,o, } all with the same probability, so you’ve gained nothing. Further as an attacker you have no idea if the messaging parties agree that the yes or no get pre-coded/enciphered thus {o,u,i} or {n,o,n} could likewise be valid as could {a,b,c} or {x,y,z}.