Schneier on Security

Clive Robinson • April 9, 2019 3:24 PM

@ Faustus, Wiley,

We have bandied about quite a few backdoors connected to the NSA in this forum. (Cue to Clive and his prodigious memory and typing ability!)

Hmmm not sure what to make of the later part of that from a person who has selected Faustus[1] as a handle 😉

But as you note potentially there is rather more to it than @Wiley’s,

The answer is actually quite obvious. They want more publicity. They want more people chatting about this “cool tool the guys at the NSA released” and more people talking positively about their organization.

Which to a playwrite or stage magician would be known as “misdirection” of directing the audience to see what you want them to see, not what you don’t.

As I’ve noted numerous times in the past the nature of “attack over defence” as an “operational defence strategy” which appears to be the NSA’s behaviour over the latter part of the last century and up untill the Ed Snowden revelations –the little we have seen– is actually not their prefered methods. It is with good reason that some say jokingly NSA stands for “Never Say Anything”. In the game of “smoke and mirrors” they want to remain hidden behind the mirror sight unseen blowing smoke if required as a distraction. Idealy they want to be not the fly on the wall, but the fly under the table, hearing all whilst out of sight. They are by nature where possible “passive observers” as are most SigInt agencies.

In the past prior to the formation of th NSA one trick was to have mechanical cipher machines that had both a small percentage of strong keys, with some very weak keys but about half breakable without “plaintext” by methods known to certain cryptographers only (a policy William Friedman continued with Crypto AG).

The assumption being that if the crypto mechanics were found via captured equipment or “given over to the enemy by traitors” then one of three things would happen.

1, The enemy would be wise to the issue, thus treat a traitor as a “dangle” or “double agent” thus treat them and any further information from them with deep suspicion, effectively neutralizing the traitor.

2, The enemy would learn little of the cryptograhers skills, thus would gain little knowledge about their methods.

3, The enemy if lacking sufficient crypto skills would copy the designs thus incorporate the weaknesses, thus make their own systems vulnerable.

This worked because the cryptographers who designed the weaknesses into the systems also issued the keying material, so did not issue weak keys unless there was a reason to.

Importantly breaking crypto is way way easier when you have more than just the ciphertext to work with. One such is “probable plaintext”, one thing the US learnt from Bletchly was the power of the card index library combined with traffic analysis. The result of which along with a few other tricks was good quality “probable plaintext” to form “cribs” etc. Without which even the “bombs” would not work effectively or at all.

In fact after WWII both Britain and the USA were way more concerned about the knowledge of “traffic analysis” becoming known than the already known “use of probable plaintex” as an aid in cryptanalysis. Plaintext tended to be depreciated by many of a “millitary mind” on the assumption of “If you know the plaintext why do you need to break the bl**dy code”… Which in these days of “collect it all” appears somewhat of a “quaint viewpoint”.

The upside trick of the weak and strong keys, is if your enemy don’t know it’s there then probability says they will use the weak keys as well as the strong as they don’t know the difference. Thus each weak key the enemy uses quickly gives plaintext that gets indexed into the library along with updating the traffic analysis information. Thus giving better probable plaintext to break other messages used under stronger or strong keys. Thus with say 80% of the enemy messages recovered most if not all of their “order of battle” is known.

When Robert Morris senior (father of the Morris Worm writer) retired from the NSA as part of his leaving speech he revealed that “plaintext” was what the NSA lived for and was their key mission requirement. Whilst true it was also a bit disingenuous because it hid a greater truth with a lesser truth, which is just another part of “finessing”.

It’s been suggested more than once that Microsofts slightly odd behaviour in having a lot of static plaintext in known positions in their file formats is due to NSA influance. If it’s true or not it certainly would help against the majority of “homemade ciphers”. The sort of thing a criminal or terrorist boss might come up with or even a nation state where education and knowledge is not respected sufficiently for which ever of many reasons.

However as I pointed out last century here and other places plaintext alone is not enough. Thus if I was the NSA I would target both protocols and standards to introduce covert side channels. In part because you don’t need insiders or liaison with individual companies when you get at protocols and standards. Thus you in effect stay behind the mirror out of sight.

The NSA had a major advantage with their influance over NIST thus both protocols and standards. If you go back and look at the AES competition rules they were in effect “got at”. The NSA most definately knew about time based covert side channels though it was not widely known in the open community at the time. The rules were such that it was almost guarenteed that the worst code for such channels would get used by developers everywhere. Oh and the NSA have subsequently effectively “given the game away” if you look at things they make such as “In line Media Encryptors” you will see thay say that AES is clasified as sutable for “secret” material but only when the data is at rest…

Basically the reason is it’s the old “Efficiency-v-Security” trade off. Unless you realy know all the ways covert channels can be made –and the open community is still way behind on this– then making your implementation “more efficient” makes it have more side channels thus reduce security to virtually nothing. Thus “fast code” that was written into the AES competition rules was going to be likewise riddled with loop unroling and time imbalances on branching instructions etc. Which the NSA knew would be copied by developers of programs and code libraries, thus in turn riddling any program using AES with “time based side channels” that leak key information across the network for quite a distance. Which obviously allowed the NSA etc to stay behind the mirror and passive monitor traffic flowing across data networks. Thus the NSA and other clued-in SigInt agencies in the Five-Eyes ect to use extended TEMPEST techniques to be easily able to “recover keys” thus decrypt to get plaintext.

Why would we think the NSA did this? Well it’s an old established technique is one very good reason. We know from Peter Wrights “Spycatcher” book of the early 1980’s that MI5/GCHQ were using back as early as the 1950’s acoustic time based side channels against mechanical cipher systems. In amongst others the Egyption Embassy Cipher room that had a phone in the “cipher-cell”.

The book also talks of the “flooding device” which could be used to turn on the microphone on in a phone and thus “listen-in” to what was happening in such a cipher-cell even though the phone was “on-hook” (it used an MF oscillator in a bridge circuit to jump across the hook switch contacts that had a small capacitance, the microphone in the handset thus envelop/amplitude modulated the signal with the noises it picked up). It was almost certain that the trick was passed onto the US under the BRUSA later UKUSA agreement. So it was a racing certainty that one of the things the NSA/GCHQ would have encoraged William Friedman to get Crypto AG to have included in the crypto kit supplied to most countries, the UN and many commercial organisations.

The same accoustic side channels appeared along with electrical ones in electromechanical ciphers where relay pull in / drop back times would give away both inputs to an XOR gate used in One Time Tape Cipher machines that would be otherwise theoretically unbreakable. Hence the point people make that “mathmatical proofs” of security with regards algorithms are worth little in practice with regards implementations, which is what AES fell to by the design of the NSA through their “usefull idiots” NIST…

But we now also know through the Dual Eliptic Curve supposadly Crypto Secure Digital Random Bit Generator that NIST was finessed into standardising, that they attack Standards as well as implementations and protocols. They even went on to pay RSA to make the ineficient DRNG the default RNG to use, and then there was the interesting story of Juniper Networks routers somehow ending up with a weakened RNG in their products…

So now it’s accepted the NSA has done the “backdoor thing” on Plaintext, Protocols and Standards and put side channels in as much as they can before most of the rest of the world woke up you would think they were kind of happy with what it was getting them. Well they probably were, despite others ringing the bell quite loudly the world was not waking upto what was going on, thus the data which was mainly unencrypted at that point in time was firehosing off of the phone and Internet faster than they could store it away, so apart from the inability to handle the data back then –Utah was not yet built– it was kind of good times.

Then Ed Snowden did a runner with a still unknown quantity of Five-Eye secrets that he chose to give to journalists to disclose to the public. The result the world kind of woke up briefly and all of a sudden the good times were not as good, with “lets encrypt” and similar going on all of a sudden things got a lot lot more difficult, or did they?

Probably not as much as some people think. As I’ve pointed out in the past information security ultimately rests on Key Managment (KeyMan) specifically Key Generation (KeyGen), Key Distribution and importantly Key and plaintext destruction.

Poorly designed RNGs are a god-send to the Five-Eyes which I’ve mentioned in the past, embedded systems such as routers and any and all IoT devices, are virtually guaranteed to have “low entropy” on start up when they generate their asymetric keys. As I’ve mentioned before that is an area I would expect the NSA to have expended considerable resources. That 1024bit RSA key cracking system they had would easily be repurposed into chasing embedded systems PrivKeys.

But the NSA reputation of “hunting sysadmins” why break the encryption when you can break the accounts of the SysAdmin tasked with KeyMan as just another part of the job they could do without… As a matter of self interest, SysAdmins are just not going to do Key Destruction properly and are also likely to do Key Audit etc in flat files, that are at best CSV formated so they can be used flexibly, including hand rebuilding if they get a sys-crash or equivalent breaking them. Also just to be safe they will also be on backup tapes and all sorts of other places. All of which have the equivalent security strength of over boiled wet noodles. What’s the betting some SysAdmins have such a file on a USB key on their key chain along with their car and house keys?

The NSA again has a reputation not for hacking user machines or servers but routers. How often do SysAdmins check routers? Trick question that’s the NetAdmins job… As a general rule of thumb a SysAdmins security perimeter is “the box before” not the router or anything upstream of it. Thus the router is the NSAs mirror to hide behind… Few if any organisations “instrument” that no-mans-land between the organisational gateway router and their service providers upstream router. Thus will miss any nasty trafic coming down for their gateway router… As it’s the gateway, it does not get taken off line to be checked in ways that might reveal implants and malware. Which is why the NSA love them so much.

The thing is many of those side channel attacks can be seen from that gateway router thus some key-leakage is going to happen.

So the question remains of “Do the NSA and other Five-Eye SigInt agencies actually need exploits in user or server computers?”

The answer is not realy, it’s the network devices such as routers, bridges, data diodes, switches and IoT devices that are going to be their targets of choice.

So the question you have to ask is are security people investigating these devices with the likes of IDA Pro? Probably not as many as you would first think. It’s not the debug tool of choice for embeded systems device designers.

Thus how much real harm is the release of Ghidra going to be to the SigInt agencies missions?

Simple answer very little at all. Infact if the NSA is shifting it’s focus from “mindless attack” of certain War Hawk types to “thoughtful defence” then having other people mainly investigate user and server OS’s and their applications very benificial. It kind of helps the “thousand eyes” paradigm along where as IDA-Pro’s pricing and that of some other tools acts as real impediment to constructive thoughtful defence.

Thus I can see the less militaristic minds in the SigInt agencies actually welcoming more eyes on user machines and servers. Especially as everything is “moving onto the network”. Microsoft 365, Googles and many others are shifting their finance models from “one off licence fees” to “monthly rental” via “Cloud Services”.

It will probably not be more than a couple of years before what is currently happening with mobile phones and the cloud happens to user computers, and the only servers around will be the specialized ones of the cloud providers.

That is your user computing device will be little more than a slightly fat “thin client” with application “front ends” being web-based pulled into your local browser, but the backend data handeling for storage and similar will be a local very limited capacity mirror updated to the cloud with increasing frequency as the price of data communications makes even the cost of the lowest cost local storage comparatively prohibitively expensive. 100USD for an SSD in thirty user computers is a lot more than the cost of providing comms to a cloud service for them in the anual budget. There are also other cost saving benifits, such as non fixed location working those thirty workers won’t need thirty desks, floor space, heating and lighting or even toilets that you need now, maybe only fascilities for five or six. Add reliable comms and they can work anywhere, the notepad/tablet camera, mic, and keystroke sensor alowing the AI Office Manager to monitor time “at work”. It’s the view of the future for a number of entrepreneurs who aim to revolutionise the way software is produced by contract. Likewise other “knowledge workers” oh and students have been getting it for some time now not just with online exams but course work where background apps check for online searching or data uploading to spot plagiarism…

Such “network living” is a god-send to the SigInt agencies along with “walled garden” devices “being owned” not by the purchasor, but by who ever has a copy of the code signing key. But as with IoT the manufacturer forcing the user online just to use the device so the manufacturer can sell the user data… Thus the SigInt agencies just “free-ride” as the data goes by “on the networks they own”.

Thus in that near future model the better the defence from enemies the better, cyber-attacking is rapidly becoming “oh so yesterday” anyway as various people start to wake up to stronger defence.

It’s not “owning the apps” that interest the SigInt agencies it’s “owning the data”, it’s manufacturers that want to “own the apps, to own the data” and as long as the data flows across their network the SigInt agencies will be happy. Have a think back to CarrierIQ and mobile phones. CarrierIQ’s software was a “test harness” that recorded every action of the user and them “Phoned it back to the mothership” at the data center. All the NSA had to do to collect all of those users actions was sit on the otherside of the upstream router from the data center teeing the data off to be recorded in their systems for ever more. It’s bot even as though CarrierIQ used any real security protection…

That is the world we are moving into thus fixing apps on user computers and the servers the user data is stored in is in the NSA’s interests. After all if you think those apps are secure, –as we have seen with the supposadly secure messaging apps,– you will “over trust” and that’s in the NSA and corporate interests. You can be sure that if a corporate can access your data then the SigInt agencies will already have it…

[1] Strangely perhaps Dr Fsustus is the name of the protagonist in a play by Christopher Marlowe, his also known to have been involved in earky cryotography, the down fall of Queens and an untimely death by stabbing that might have been state sanctioned…

Some time in the 1590’s Christopher Marlowe wrote the play about Dr Faustus the necromancer, based on earlier German tales. Faustus was capable of summoning devils and the attention of Mephistophilis, a condemned soul pressed by the devil to close deals and collect souls on others. Part of Mephistophilis punishment was that he was allowed in fact encoraged to warn others of their fate before closing the bargin, few ever headed thus Mephistophilis had to further suffer the torment of collecting their souls for the bargins that actually were nothing.

In Act.1 Dr Fautus has a soliloquy, about the vanity of human science, having previously described himself as having mastered every piece of knowledge he has come across… Thus revealing himself to be both vain and egotistical to the audiance and thus setting the tone for his eventual fate via hubris and Mephistophilis’s administrations. Thus setting the required moral tones of the time. A time when an ill written word could lead to not just the author’s metaphorical downfall but literall downfall of their head from their shoulders on “Tower hill green”, when even Queen’s were not safe from such fates.

Indead it’s been suggested more than a few times that this fate happened to Christopher Marlowe. He was warranted to appear befor the Queen’s Privy councill but there is no record of him actually attending. Effectively on charges of atheism. Which at that time was a charge of such seriousness to be the equivalent of treason. This was because the previous English monarch Henry VIII after his reforms had made himself thus all subsequent English monarchs the head of the Church of England. So to be against the church was, to be against the monarch, ergo treason for which there could only be one fate “Death by the Monarchs command” or execution. As atheism is a charge easy to fabricate and well neigh impossible to defend against, it was also used as an effective way “to deal with the politically troublesome”.

But Marlowe’s story then gets very curious, just days later, a man of distinct ill repute one Ingram Frizer who’s “master” was Thomas Walsingham stabbed Christopher Marlowe to death in the home of Eleanor Bull. Also in attendance were Nicholas Skeres and Robert Poley, both of whom along with Christopher Marlowe and Thomas Walsinghan had been associated with Sir Francis Walsingham’s earlier intelligence operations that led to the execution of Mary Queen of Scots, by Queen Elizabeth the 1st of England. Of note is that Robert Poley was a member of the Privy Council and would certaibly have known of the warrant against Marlowe. More currious as “murder was done” nobody paid with their neck, in fact the Queen pardoned Frizer a short while later.

If the fatal stabbing was connected to Marlowe’s allegrd arrest warant remains unknown, however it has been pointed out that it might have been “Expedient for the Crown” to have him dealt with this way rather than by trial etc. Some believe Christopher Marlowe as both a philosopher-scientist and translator of some repute was also a member of what would have been Queen Elizabeth’s “black chamber” responsible for amongst other things cryptography. Thus he probably had a lot of secrets in his head that might easily come out at trial including what some have indicated was the fabrication of evidence and the setting up of Mary Queen of Scotts for her execution.

Here the story divides between two different theories, which depend on what Christopher Marlowe might have been upto. He along with a number of others including Sir Walter Raleigh were members of a group of what were later called “The School of Atheism” and also “The School of Night”. Was he there as friend or spy?

Why would Marlowe be suspected of talking? Well one theory is that Marlowe was “friend” to Sir Walter Raleigh had “fallen out of favour” with the Earl of Essex who was plotting Sir Walter’s down fall and it has been suggested Marlowe was aware of this and was going to warn Sir Walter. Thus the meeting at the house was to purswade Marlowe not to talk, it went failed and Marlowe was stabbed in the eye, whilst Friezr had very minor wounds, possibly as a cover story.

The other theory is Marlowe was “spy” thus had to “disappear” so that the others could be executed. Thus Marlowe’s death was faked and Marlowe assumed a new identity and became the oh so secretive William Shakespeare… Who in the Merry Wives of Windsor also writes of Mephistophilis.

Of interest both Marlowe and Shakespeare were both realy bad spellers of words, often using three different spellings of the same word on a single page… Not that anyone actually cared back in Elizabethan times where “the spoken word was King” as it were 😉

And people think history is “Oh so dull”, but the story pales in comparison to what followed, you should see the venomous behaviour between the two theory followers, it’s downright “Crossed words and pens at dawn” 😉