Schneier on Security

1&1~=Umm • April 6, 2019 12:23 AM

@Bas:

“One can use constant time algorithms against timing attacks.”

They work well on single use microcontrolers with out cache or other extended low level hardware features you find on modern desktop/server CPU chips.

For those around at the time when AES was finalised one or two people were sounding alarms about the AES competition and the fact timing channels were not mentioned at all by NIST who were in effect fronting for the NSA.

Since then others have pointed out that the competition code released on the competition pages for “speed tests” had things like loop unroling in them which had certain issues. One of these people then built exploit code via the cache timing that was shown to work fairly easily across the local area network…

As the NSA probably hoped the ‘speed test code’ ended up being copied into peoples code directly and indirectly by usage of libraries of code that were available as Open Source on the Internet.

Even now there are still computing systems using the ‘speed test code’ on accessible networks, and I fully expect some to still be around in another quater century or so.

It’s this sort of ‘known attack’ that the authors of the paper you link to were trying to address. But as noted in the intro given in the link

“‘However, in absence of further justification, the guarantees only hold for the language (source, target, or intermediate representation) on which the analysis is performed.'”

It’s just a variation on an existing formal method, thus prey to the assumptions within it, hence the warning.

The problem is that in the last year and a bit a new class of attack on the CPU hardware has occured that effects Intel, AMD, ARM and presumably other similar CPU architectures. This has been refered to by @Thoth and others as ‘The gift that keeps giving’ because new variations are still being found.

I suspect it is quite safe to predict other ‘below the CPU ISA’ attacks will be found and any one of them can be used to generate faults in the library code or excercise hardware faults that will open up other side channels other than time based ones.

The point is that formal verification and it’s methods currently is a top down approach and can only reach down a little way at best. Hardware attacks are bottom up, and way below the reach of current formal methods, and of absolutly no use against the likes of ‘fault injection attacks’ used in ‘Active EmSec’.

If you search this blog you will find comments by @Nick P, @Clive and @Wael about the issues of ‘bubbling up attacks’ from below the CPU ISA level and the fact that there is nothing current formal verification can do to stop them with current CPU architectures. Thus the best thing to do was make mitigations in hardware.

If you search this blog for @Thoth you will find he was designing such a system around the use of Smart Cards. Also that a group of security academics at UCL appear to have taken without credit the work of @Thoth and others which had discussed on this blog, and as noted ‘got it only half right’ in the process.

Security via software approaches on single CPU systems, even those with multiple cores is a ‘busted flush’ due to the hardware that actually addresses the shared control, data and address and power buses that go out to memory and other parts of the system.

Likewise multiple CPU systems that share external memory and with I/O and DMA controlers unless certain precautions are taken. The ideas behind the precautions are apparently still ‘secret’ even though a study of physics at high school level will give you all you need to know to think them out.

There is little that even machine code at the CPU ISA can do to make this area secure. In fact as has bern noted on this blog there is a real issue with ‘transparancy’ from the likes of keyboard microcontrolers through the main CPU(s) due to ‘Security-v-Efficiency’ issues, in essence the more efficient you make a CPU the OS on it and the driver codes both top and bottom side, the more transparent a system becomes thus the more internal state that leakes out.

Oh and there are discussions about ‘fault injection’ that uses ‘error handeling and correction mechanisms’ as a way to probe backwards through a computer to get at processes that most would assume are segregated or issolated, that even work backwards through the likes of data diodes, to excercise latent side channels.

It’s a hostile world out there and there must be thousands with ‘twisty little passages’ in their minds that enable them to as @Bruce Schneier puts it ‘think hinky’ and they have moved on from software exploits that current formal verification methods try to prevent.

Researching attackers have moved down the computing stack to low level hardware where formal methods can do little to mitigate attacks that rise through the computing stack, undermining the assumptions current formal verification methods are based upon.

I like the idea of what project Everest is trying to achieve, but the reality is attacks have now provably moved on beyond what it can achieve so from the more stringent security perspective it’s to little to late. However for building computers that are real walled gardens from those who have purchased them, yes Everest will serve certain interests very well.

1&1~=Umm • April 6, 2019 11:12 AM

@gasche:

“I’m surprised by some reactions to formal methods here which are almost hostile.”

As has been seen in the article under discussion formal verification and methods can and often do get very much over sold.

They have a very small part in security of systems, and they can still easily fail at what they are alleged to be able to do. This has been known since the 1950’s especially when the tools are misunderstood or misused as can easily happen.

System security is a long path full of traps for the unwary, encouraging unwary thinking in the way the journalist who wrote the article has is something that needs robust rebuttal to hopefully alleviate if not prevent future issues.

With regards,

“How come, when people do the hard work of providing a verified implementation that is much more secure than anything else we have so far, people decide to concentrate on what the approach does not cover, instead of recognizing the impressive advances that have been made on the parts that it does cover?”

You only need to look as secure messaging apps for the reason behind “How come”. Much is talked about the security of the communications link whilst they all have significant failings in the way more important end point security. Which in the apps is effectively non existant so the apps whilst sold as the most secure thing since sliced bread because of the use of crypto, are in reality very easy to subvert with a simple end run attack.

The same is true for formal methods, they are but one small link in a very long chain, making statments that in effect claim they magically strengthen all the other weak links is not just laughable it is disingenuous to the point of fraud.

Which brings us around to,

“But there is a lot of really solid work that can, if we adopt it and extend it and do our best to adopt these state-of-the-art development methodologies, give strong improvements to everyone’s security. Why not also celebrate that?”

Yes there is a lot of solid work, but it can not stand alone, the actual researchers in this case are aware of this and say so.

The thing is there is an expression of “It’s an engineers lot to run the world without recognition” that is the way the world works, people are in general not interested in engineers they are seen as like ‘the oily oik who puts air in the tires”, only recognised when they fail.

There is the old saying about “Reward, around hear is like pissing in your dark trousers, you get a short lived warm feeling, that quickly chills, and if you are lucky nobody notices.”

The same is true for researchers and most software developers, their real reward for success is to be given another through at the dice of failure, untill either they fail and get ignominy or wise up and move into other work such as managment where their failings can be passed off onto others.

Douglas Adams sumed it up when he commented about people with,

“‘And then, one Thursday, nearly two thousand years after one man had been nailed to a tree for saying how great it would be to be nice to people for a change, a girl sitting on her own in a small café in Rickmansworth suddenly realized what it was that had been going wrong all this time, and she finally knew how the world could be made a good and happy place. This time it was right, it would work, and no one would have to get nailed to anything.'”

Then in the story the world got destroyed by the Vogons to make a hyperspace bypass so she never got to tell anyone.

Joking aside I was once told “Good news does not sell newspapers, which was aplified by the explanation that “‘Mrs Smith wins the cake contest’ is a headline that is only realy of interest to those who like Mrs Smith, even in a local paper. However ‘Mrs Smith’s cake poisons the judges at cake contest’ is of much wider interest and might make it into the national press on a slow news day. But ‘Mrs Smith’s cake poisons the queen of England’ will make headlines in newspapers all over the world.”

This was quite a few years before Lady Di got killed by paps and an out of control limo driver in a Paris underpass but sad as it was it proved the words true.

The simple fact is sad as it is only those who know and like engineers or researchers are goingvto be interested in “They done good” that’s just part of the human condition get used to it or find a way to make money that brings you fame as well as fortune, then people will be interested in you outside the circle of your friends.

1&1~=Umm • June 12, 2019 2:58 PM

@Jim:

“Consider an enigma machine that changes key
every few seconds.”

You have a limited polyalphabetic cipher inside a substitution cipher. The limited polyalphabetic cipher dependent on a very limited number of fixed wheels has “cycles” that stand out. To get around this the wheels have the simple substitution slugs mounted so they can be moved with respect to the ratcheting of the wheel. But that moves but does not break up the cycles so the ratcheting happens multiple times thus truncating a cycle.

But the truncation is far from sufficient, because the wheel movment is still basically that of the mechanical odometer mile counter in older vehicals. So you need to make other changes. Firstly you need not just a lot more wheels to select from, you need many more in use. You can cheat a little by making the pucks in the wheel reversable that is you can turn them over. You can make the odometer movment different such that wheels step in a very irregular pattern, you might also make some step in reverse.

All of that was done in some of the last of the mechanical cipher machines. But at the end of the day they are all not just determanistic they are due to other defects in effect reversable. That is you can wind their internal state backwards. Which means that if you can simulate it fast enough you can go through every required state mapping out the actual state. Thus if you have a both enough ‘known plain text’ and it’s coresponding ‘cipher text’ you can analyse it and pull gently at those multiple loose threads that are the message statistics and fully determin the internal state.

Whilst there were ways that could have been done the mechanical complexity would have been to greate and friction would have stopped it working. But worse still mechanical sloop would make more than just a handfull of gearing wheels to inacurate to use. Thus the limit on mechanical ciphers was the laws of nature. Alan Turings contempory at Bletchley and arguably smarter when it came to breaking Enigma Gordon Welchman found this was a limit you could not beat by clever design. The only solution as with the Bombs was to move from mechanics, even electromechanics through into the fully electronic where other laws of nature still apply as we have found out with Moores Law –which is not a law– hitting the buffers of the real laws of thermodynamics.

Thus the trick to making secure determanistic systems is to make the unwinding of the internal state so complex not only is there not enough time in the universe to run the statistics, but also not enough matter to hold all the required states for the statistics to find sufficient meaningfull information.

Oh and the easier way, ‘Roll God’s dice and take a couple of notes for you and your buddy’.