Schneier on Security

Clive Robinson • September 18, 2021 3:50 AM

@ FA, MarkH, Freezing_in_Brazil, ALL,

I’ve been analysing a generator exactly as you describe (with a 1-bit counter), both mathematically and by simulation.

You realise that a “1-bit counter” is a clocked latch, which is also a sampler and more interestingly a frequency mixer?

Something tells me you do not, in fact when you say,

the process is ‘memoryless’

Can be fairly easily disproved, is a fairly good indicator.

It’s a mistake in understanding I see many people make when using ring oscillators as TRNGs.

It’s fairly easy to see why, if you take two reasonably stable oscillators, and feed one into the data input of the latch and the other into the clock input of the latch and observe the Q output of the latch, on an oscilloscope.

According to what you say you will have a “menoryless” output, that is no correlation between outputs.

Well if you only look “close in” with an oscilloscope it may look that way, in fact to the human eue it may appear “random” but it is not. Open the scope timebase out and you will see that the Q output transitions appear to bunch up and seperate in a stable pattern.

If you take the Q output and put it into an appropriate low pass filter you get a near perfect sinwave, at the difference frequency between the two oscillators. So there is a very high degree of correlation between the Q output states of the latch (unless of course you subscribe to “magic pixie dust” thinking).

If you don’t have a scope to hand you can do this by drawing out the signals on graph paper.

So it is clear that the time difference on the inputs of the latch are very clearly taken forward through the latch. Which is what you would expect from sampling theory.

In fact look up the use of oversampling and undersampling for the use of A to D and D to A convertion. You might also want to look up the use of “dither” in the processes as well to get fractional improvments in measurments.

So if you regard the high frequency oscillator as one input to the latch and the output from the particle detector to the other. You will realise that even though the 1-bit counter may look random it’s not it represents an accurate measure of the system over time.

So as we know over a period of time the decay rate drops and the time period between detector outputs increases. So this will be seen as an effect on the Q output, it can not in any way be avoided.

Likewise as the XTAL oscilator “ages” and it’s frequency decreases over the years –a well studied phenomenon– it to will be seen as an effect on the latch Q output.

But in the much more short term so also will the delta F changes caused by the temprature inside the instrument case caused by room temprature and by sunlight if it shines on the case. Such changes will give depending on the crystal cut oh something like +- 10ppm change in frequency over the daily internal temprature cycle of the case (look up why Temprature Controled Xtal Oscillators also called TCXO were designed and still used).

Thus the “random” you see is in part the fairly determanistic effect of such things as “temprature” likewise mechanical “vibration” which is a well known effect known as “microphonics”.

To argue that none of this is true as you and MarkH have would be entirely pointless because anybody could verify what I’ve said above, and the several times in the past I’ve described the behaviour before.

I sugest at this point you and MarkH both stop, what other readers are probably somewhat tired of, which is these protracted and pointless arguments you have both started several times in the past over what I’ve said.

Clive Robinson • September 18, 2021 8:20 PM

@ SpaceLifeForm,

Objection! Assumes facts not in evidence!

Yes there is a lot “not in evidence” not just in what is being said by others but their thinking process.

Space is tricky!

Something else some are missing, all the time.

Clive Robinson • September 18, 2021 10:44 PM

@ SpaceLifeForm,

It’s funny that you should mention a certain very nastily behaved quadruped.

Terry Pratchett having had extensive practical experience of them observed that people do not realise under that cute fur and apparent poise etc they are not at all nice,

“If cats looked like frogs we’d realize what nasty, cruel little bastards they are. Style. That’s what people remember”

Have you ever seen them play with their prey?

Often the target for such behaviour has actually made it’s self into prey and the “pounce instinct” in the cat is triggered even though it is not in need of food. You see this with the way a cat tries to jump on moving laser beam spots, in part it is actually an “attack defense” instinctive reponse. That is where fight is favoured over flight, deep down in the “lizzard brain” all mammals have from their evolution.

You know it’s not only Felis catus domesticus that apparently “Plays with it’s prey”[1] other mammals do it for differing reasons. Humans however have taken it to a whole different level often where physical contact is not involved[2].

An unfortunate result of this is some will think incorrectly there is a hierarchy, and place themselves as lower in their hierarchy than others (it’s one reason humans have so much belief in deities and kings). Some with the self belief they are seen as lower in their hierarchy, will attack those they alone see as higher in the hierarchy for various self esteem / ego reasons. As they are wrong in their beliefs they tend to fail, so they will repeatedly attack and retreat. Often when they mistakenly see what they think is weakness in what they perceive as an individual they see as higher in the hierarchy. Madness? Well sort of.

Should such attacks be regarded as some form of flattery? Well… the problem is that the attackers fail to understand that it is their own inabilities that make them place themselves in their immagined hierarchy, and at a lower level, not others and frequently not those they perceive as higher in their hierarchy. But the repeated attacks do reflect badly on the attackers in the eyes of others. Thus in a perverse form of wish fulfilment they do end up being looked down upon… hence they are driven to repeat their mistake because they do not learn the lesson each time they turn the wheel.

[1] It has been argued that this is not tormenting/tourture as humans see it, but actually an inate survival mechanism, whereby the cat judges if it is safe to kill what it has caught.

[2] Hence the expression “catty behaviour” often ascribed to two women socialy circling to establish dominance or territory. However it’s more visable in “get in your space” type posturing behaviour in men. If you’ve ever seen two cats “puff up” before they scrap, you can see almost identical behaviour in men “bracing up” before they resort to physical violence.

Clive Robinson • September 19, 2021 6:48 PM

@ FA,

The decision to reveal or not reveal the world-shocking truth about nuclear TRBG should be yours and only yours.

Nobody other than you has said “world-shocking” in fact I said “bl@@dy obvious” which is a world away. As for you stating it being my decision and only my decision… that is actually you playing games, not me.

If your time in the military (hinted to many times) involved showing leadership, you should know that taking responsability for your own decisions and not hiding behind others is an essential part of it.

I’ve already stated my prefrence, which is the one that any teacher will tell you is the best way which is “work it out for yourself from basic knowledge and information”. I have after all given you all the information you should need, you just need to join the dots together.

The fact I also offer you an alternative is not me playing games, just giving you a choice, in which path is taken.

By the way if you have spent any time in the military in the UK or Commonwealth forces, you should know that “drills” and similar only get the basics honed to instinct, they in no way teach an individial how to think thus be able to plan appropriately to lead.

There is some myth that leaders have to be charismatic, charming, orators, etc… Fine if you are a no good politician, but not being a leader of groups of people in most other endevors.

An essential part of being a leader in a military organisation is to recognise a couple of things,

1, Every one is fully expendable.
2, No plan survives contact with the enemy.

They are both part of the “Shit happens” ethos.

So to cover 1 you train those beneath you to replace you, which is more about teaching and learning than anything else, and you do it down the ranks. Which means a private is trained to be or atleast understand/appreciate one to three ranks above, so patrol and squad duties upto and including those of a sergeant. Likewise sergeants train to do the duties of lieutenants / captains / OCs and lieutenants train to be majors / OCs and also learn staff duties. This way delegation is not just possible but effective, and if a leader gets wounded or killed, somebody else simply steps into the position effectively.

However to cover 2 each person needs to be taught both tactics and strategy from basic patrol activities through combat skills upto and through being able to make not just immediate actions but plan various activities flexibly and effectively.

You might have heard of the John Boyd OODA loop from the US Airforce in the 1960s/70s? Well in the UK and Comenwealth armed forces much of it was “standard” in training going back before the Korean war in the 1950’s. It was based on leasons learned from WWII onwards by the likes of the long range desert group and various jungle fighting engagments in places like Malaysia, which also gave rise to the “hearts and minds” operations etc.

In essence it teaches that speed, agility, and independence of action of well trained small groups such as “4 man bricks/patrols”[1] can easily and successfuly take combat to far greater power and numbers (like entire battalions/Regiments[2]). It is part of what makes asymmetric warfare effective, especially when specialists are involved[3].

[1] The name “patrol” is a bit of a misnomer and “detachment” is sometimes used it rather depends on the skill sets required for a particular function and if they are tactical or support, as well as if they are stand alone or part of a larger grouping[2].

[2] Military personnel grouping naming conventions can get confusing (it is why NATO uses the ‘dot/line/X’ map marking to indicate group strengths). So what one arm, –say the infantry– call a basic group a “battalion” others –such as engineers, signals and other specialised units– call a “regiment”.

Infantry train in battle skills, that are not exactly marketable skills in the real world, engineers, signals and some other specialist groups whilst they learn battle skills are raised to other “skill sets” which are often called trades and attract increased daily payments as well as being marketable skills with equivalence to standard qualifications (HNC, HND, Degree).

[3] Some service personnel especially some specialists have more than one trade, which can cause problems from time to time. One such was “payday” I always elected to have payment made directly into “the bank” as it avoided a lot of embarrassment of signing for more money than the pay sergeant/captain etc earnt especially when they read it out for everyone on pay parade to hear. It was particularly problematical when you were away from your unit temporarily with other units or training especially abroad when they payed everyone in local currency (you could also get issues with the colour of your beret or stable belt). Worse your hair cut can give you away… Certain specialist trades need a level of training and experience modern militaries can not provide. One such is specialist Medics, in the UK there is an interesting “revolving door” effect. Some Regulars in specialist units get training in teaching hospitals and become fully qualified in nursing for A&E along with minnor surgery. Whilst some medical proffessionals become Reservists / Territorials often spending tours of duty in active war zones. It’s a problem because government ministers make false assumptions about the actual numbers of medically qualified personnel they have available. For instance at the begining of the pandemic one idea was “Nightingale Field Hospitals” where military medics would take load off of the National Health Service(NHS). Unfortunatly the plans “double counted” thus a member of the NHS who was also a reservist got counted once for the NHS and once as a reservist… I think most people appreciate that even with the best will in the world a person can not be in two places at the same time.

Clive Robinson • September 19, 2021 7:30 PM

@ Bernie,

Any comments from folks more knowledgeable than I?

I had a quick look for the “security evaluation report” the other day, but it did not appear to be available.

I have designed and described on this blog ways you can do the same thing but more securely…

From the ARS article it sounds like the words are just used instead of individual letters or numbers in a conventional cipher.

If that is true, a simple frequency analysis on the words will show it is not real “plaintext” just obfuscated “ciphertext” thus be easy to spot automatically.

For such a system to be not “painting a target on your back” the actual message sent should be able to get past a human reader. That is not just “words” but coherant “sentences” in coherant “paragraphs” with a coherent “context” from start to finish.

The way to do this is by “analysing for redundancy” and use the redundancy to send “covert bits”.

For instance the opening salutation can be “hi” or hello” or similar as they are fully interchangable they give you 1-bit of covert information. If you have four such words such as “hi, hello, wotcher, greatings” then you have 2-bits.

Most social communications is very redundant, for instance,

“How about we meet up for a drink”

You can replace “how about” with “Can”, “Should”, “How’s about”, etc. Likewise “drink” with “meal, snack, cocktail, tea, coffee, cupper, lunch” giving you a 2+3 or 5-bit sentance.

The trick is not to use the same word for the same plaintext bit pattern. That is you encrypt the plaintext bit pattern into a ciphertext pattern with a different key for each message or sentence.

Whilst the resulting message will pass a human censor, the covert channel bandwidth is quite small.

Clive Robinson • September 20, 2021 8:48 AM

@ FA, MarkH, Freezing_in_Brazil, interested others,

That would be the case if we would take the time between events modulo some small interval.

But that is not what we do: the counter and the phase of the clock driving it are NOT reset when an event is detected.

You so very nearly got it but failed at the last moment with an incorrect assumption…

You need to understand the difference between a period/time counter and a frequency counter.

A frequency counter “gates” a stream of high frequency external pulses into a counter with the gate signal comming from an internal low frequency very precise timebase. Whilst a period/time counter works the other way around, a very high frequency precise frequency is gated into the counter by a low frequency external signal.

You are thinking “frequency counter” not “period/time counter” and misunderstanding what actually drives the Q output from the latch in the “roulette wheel” circuit (which is not what @MarkH claims it is with “This is no problem at all, when the TRNG uses the One True Sampling Method”).

@MarkH has said “high frequency oscillator” which implies that it goes to the D-input of the latch. Which means the output of the particle detector drives the CLK-input of the latch. Which is what most engineers do. But… it is the input to the CLK-input that changes the state of the Q-output to what ever the D-input is.

So it leaks the time between particle detections. You then using the same clk-input drive a two latch shift register using the two Q-ouputs to drive the XOR gate of the von Neumann debias circuit. Whilst that de-biases the “data” the data comes out clocked by the particle detector output, thus it is still time biased to the gap between particle detections, and frequently this time bias is easily visable at the TRNG output.

Stick that CLK-input signal through a lowpass filter and you recover the exponential decay rate of the source very accurately…

The hard design problem is not further leaking this time between particle detections.

Most RNG designers either miss this, or somebody tells them not to remove the time bias. The usuall trick of “clocking bits from the XOR gate untill you have 8-32 random data bits does not hide the time between detector outputs, nor does then hashing the new 8 to 32 bits and previous 480-504 output bits. In fact it makes the time bias even more obvious.

Worse when you clock all those latches in the counter, debias, and shift register accumulator it sends quite a current spike onto the PSU lines and generates a recognisable spike in the EM output the TRNG generates as a function of charge moving in the circuit.

For a TRNG to be of any use in high security use, you must solve this time leakage problem, as it leaves you open to some “Passive TEMPEST Attacks” and some rather interesting “Active EmSec Atacks”.

Oh and when you read the publically available information of TRNG’s you get all the blurb about “data” and the likes of “Die Hard(er)” statistical tests but you will have to search very hard to find actual usefull information on TEMPEST/EmSec attacks, the best you usually find is “EMC Guidence”.

There has only been half a dozen academic papers on Active EmSec Attacks, one of which funnily enough was against an IBM 32bit TRNG with all sorts of peotection. However hit it with an EM CW signal and the entropy dropped from 32bit down to less than 7bits, Opps that takes searching attacks from 4billion down to a little over a hundred…

What you won’t yet read academic papers on, is using EM signals modulated with crafted signals. To not only get synchronizing information out[1] but then use it to effect both “logic” and “software” by carefull “Fault Injection Attacks”.

It is something I’ve been doing since the 1980’s when I independently discovered it (as it turns out did one or two other engineers).

Any way, you now have the information to see that it is not just “data-debiasing” you need to worry about, but “time debiasing” as well. Oh and the fact that DPA type attacks can be repurposed from “smart card attacks” to TRNGs and other “root of trust” systems like HSMs. Along with a whole class of interesting attacks you had probably never considered.

[1] Look up the history of the “Great Seal Bug” or “Thing” the best technical description of which for many years was in Peter Wright’s early 1980’s book “Spy Catcher”. That he and Tony Sale –later saver of Bletchly Park– worked out how it worked. The principles of wgich are still used in all those “illuminator” or incorrectly naned RADAR bugs work.

Clive Robinson • September 20, 2021 6:12 PM

@ FA,

But why would you want to do that ?

When you’ve been around security engineering long enough, that question will come to haunt you.

It’s all to do with,

Security -v- Efficiency

As I’ve explained many times before[0].

You have to understand why the question is actually used by both sides.

You and @MarkH have actually demonstrated this, and it is only now I’ve explained the issue of how the output of a TRNG is biased by the half life decay curve that you say,

Just store the bit in memory where it will be retrieved as necessary, probably to be the input of a crypto hash

I’ve already explained that most go straight to the hash with “magic pixie dust thinking”, and they don’t store-n-forward “data” in a way that sufficiently breaks the “time” based side channel. As I’ve mentioned our host @Bruce Schneier with Niels Furguson designed one of the few systems to partially eliminate this problem, by using an “entropy pool” however it can and does fail as a store-n-forward “time” break, which is when you draw out to much from the pool in any given time. It is a real serious security concern in embedded systems, something I’ve previously discussed on this blog with regards discovering “primes” used in PubKey Certs.

I’ve also discussed the issue of “System Transparancy” and time based covert channels quite a number of times. The classic example and the first academic paper on it was from Mat Blaze et al on “JitterBugs”,

https://www.mattblaze.org/papers/jbug-Usenix06-final.pdf

Which showed how a keyboard plugged into an ordinary PC could by using a time based covert channel leak user key press data such as passwords right through the PC and appear as time “jitter” on network packets.

Put overly simply the more “efficient” a system is, the more “transparant” it is, so the greater the bandwidth of any time based side / covert channel. One TEMPEST design rule is “Clock the inputs and clock the outputs” another is “Clock from in to out” I’ve mentioned them quite a few times in the past. If you understand the problem you can see how they reduce not just “transparancy” but the “bandwidth” of potential “time based” side/covert channels.

Such “time” bias in outputs is a very real fairly easy to implement covert channel in nearly every computer based system in the world… Because the designers of such systems put “efficiency” before “security” just about every time. This includes many of the chip designers that implement ring counter based on chip supposed TRNGs.

@MarkH,

I’ve understood you to repeatedly say that the the bits obtained by sampling a free-running counter (modulo a suitably small value) will be biased.

I’ve said the output of a TRNG will be effected by this and so biased, yes but in the broader sense than you are assuming.

You know very well that I frequently talk of side channels that are “time based”. By simple inductive reasoning if information is leaking via any side channel then there must be some form of not just redundancy, but bias in that redundancy for the information to be carried out of the system.

But yes time differences can effect the “data” not just “time” in the output of any system which mixes two or more entropy sources.

It’s a question of “which comes first” random source A or random source B. Whilst there appears to be only two possibilities you have to remember transitions so there are actually three states each random source can be in,

1, High
2, Transitioning
3, Low

If we ignore “meta-stability” for the moment which most logic designers do, you will get four potential results,

1, A befor B
2, A after B
3, B befor A
4, B after A

They are different when viewed from the perspective of the sources, even though 1&4 have the same effect when viewed from the output likewise 2&3.

But you can not ignore “meta-stability” as you will find out if you actually “deep dive” into the way the “rising clock edge” works in latches.

Ignoring “soft lock up” meta-stability appears as an extra psudo random input. In that the actual transitioning edges on both data and clock have apparant indeterminacy. In effect around the transition of either random source you appear to have a period of uncertainty.

However if you add a bias signal to either input you can make that uncertainty realy quite biased in your favour. It actually requires very small bias to effect a significant change[1]. Such bias can be caused by an EM “fault injection” attack. That is you point a antenna at it and “illuminate” it with a RF carrier. Which a couple of students did at Cambridge University Computer Labs[0] did to a very expensive supposadly very secure IBM TRNG and trashed it’s entropy as a result they got a best paper award at if memory serves either Usnix or an IEEE conference.

There has been another paper again from CCL that discusses attacking an on chip “ring oscillator TRNG” on a Chip-n-Spin EVM Payment Card, that should have 2^64 bits of entropy, but gets draged down from 1.85e19 possible outputs to just 3300 which makes searching attacks fairly easy. Thus the practical attacks on it they describe…,

https://www.cl.cam.ac.uk/~atm26/papers/markettos-ches2009-inject-trng.pdf

I suggest everyone downloads and reads it, as it has nice pictures that are worth rather more than a thousand words.

Now back to… That single latch roulette / stroboscopic / waggon wheel circuit, which is in that paper. It actually has TWO random/chaotic[2] inputs, the input from the particle detector and –the one you are ignoring in your analysis– the high frequency oscillator with it’s “delta F”. So you have the “A befor B” etc issue biasing the “data” as well as the “time”.

Obviously the more “sources” there are the more this issue arises detrementaly unless you specifically design it out or as some occasionaly do “just get lucky”.

I hope you now understand why I have repeatedly said the things I do, that appear to go against your outlook limiting assumptions.

[0] A statment that I should get a jingle made up for… Oh and as I said these issues have been discussed befor on this and other blogs by me and others. For instance,

https://www.schneier.com/blog/archives/2017/08/proof_that_hmac.html/#comment-306803

Also take a look at Cambridge Computer labs “lightbluetouchpaper.org” site as well.

[1] Back in the 1970’s there was a design for an FM bug All it had was a 74LS13 dual quad input Schmit NAND 14 pin DIP an electret microphone and an overtone XTAL with a frequency above 29.34MHz and a 30pf silver mica or polystyrene capacitor and a couple of resistors. You still see it mentioned from time to time,

https://components101.com/ics/sn74ls13-4-input-nand-gate-schmitt-trigger

The circuit was configured as the usuall NAND gate XTAL oscillator but with tha capacitive output of the electret mic connected to the input side of the gate. It’s very small output voltage, moved the bias point which caused the XTAL to be phase modulated. The NAND gate output was connected to the antenna where the resulting square wave third harmonic appeared in the FM broadcast band.

I used to make dual mic bugs with them, because two audio sources alow you to post process them to make in effect a “steerable mic”.

There is also a version using a Hex Shmitt inverter TTL chip, that demonstrates an inverter “ring oscillator”,

https://www.pcs-electronics.com/schematics/SimpleFmTransmitter.pdf

But I can not recomend it as it has no frequency stability and drifts wildly if you go near it, due to the lack of tuning componets. But it does demonstrate by it’s gross instability why such ring oscillators are used as faux-entropy sources for “on chip RNGs”.

[2] When looking at signal sources in engineering you normally consider “Signal + Noise” and immediately make a lot of simplifying assumptions about “noise” the worst of which is that the “noise is a random source” because it makes the maths simple (see RMS). In reality the noise is not at all random it is actually determanistic from within the overall systems other functions you actually have a spectrum of

“Determanistic through chaotic to random”

Where chaotic is defined as being a determanistic process that shows extream sensitivity to the input conditions. Which makes it’s output difficult to predict, even though it is determanistic. So the normal engineering assumption is it can be treated as “random”. Fine if you are designing most signal processing systems be that analog or digital, but potentially fatal when you are doing security engineering.

Clive Robinson • September 20, 2021 7:08 PM

@ SpaceLifeForm, MarkH,

Space is tricky

I’ve just very quickly “skim-read” the web page.

First of it’s not a “results” paper, but one describing an experimental setup and experimental findings.

Such papers alow other scientists to “play along” as they carry on with their experiments / research.

There is a bit of history as to why such papers appear.

Back a century ago experimental results were published, that others could not repeat. The usual sort of controversy started…

One researcher on visiting another researcher who had different results noticed there was a difference in their setups.

In his lab they used marble topped benches, in the other lab they used wooden…

Adding wood into the marble topped bench experiment, showed the wood was the cause of the experimental differences.

Oh speaking of “Space is tricky” a fun fact, somebody I used to work with for several years carried out his “particle research” in a Womens toilet… Which he included in the title of his results… He included this in his C.V. which always raised a question at interview… (and he suspected why he got so many interviews[1]).

The actual reason it was the womens toilet was to do with architecture and deficient construction at the University he was at, not the experiment.

It just so happened that the toilet was on the top floor of a tower block with a window pointing in the right direction. The tower block was closed for “refurbishment” of the offices and class rooms (something to do with flooring if I remember correctly). So he could use the stairs to access the toilet and his experiment.

[1] He mentioned it when a group of us were chatting one day Catherine had been grumbling about the problems she had had in getting interviews and was a bit annoyed about another woman who had got a lot of interviews. Apparantly the “other woman” had at some point won a pagent or some such and had been crowned “Miss Sausage Queen” which she put in her “otherwise less than mediocre C.V.”. Which had not got the “other woman” any interviews untill a “recruitment advisor” had told her to add in the “Miss Sausage Queen” in the personal statment section. In trying to lighten the mood I put my foot in it by “asking the air” “I wonder did she look like a sausage?” that got a smile from Catherine but a dirty look from “the boss”. It was then that Mark told his story. Like most of us, I lack such curiosity raising achievments. After all “Best dressed Klingon look alike” hardly sparks any interest 😉

Clive Robinson • September 21, 2021 3:50 AM

@ FA,

I think it was very clear from the start that all event timing information would be discarded

No, not at all. That is your and MarkH’s assumption and why the pair of you went flying off in the wrong direction, and have since tried to drag everyone down your chosen path, to prove you are right when in fact from the general security perspective you are arguing about angels on the head of a pin.

As I’ve said that time bias issue will still be present at the output of the XOR gate of the von Neumann data debias ciruit which would in many peoples views fixed any “bias” where as in fact it only removes one type of “data” bias (there are others such as sequence bias which as I noted can be introduced by the roulette circuit).

I don’t wish to be impolite, but it’s becoming more and more clear you have never designed a proffessional grade TRNG.

Also we were not discussing security engineering in general, nor the imperfections of digital logic, nor TEMPEST.

That is as silly as your,

It’s not possible to build a usable electric car because you can’t have perfectly round wheels.

Security engineering is and has to be “general” because every thing in it is usually subject to the “weakest link” principle. I’ve said this repeatedly in several practical ways[1] over the years. And I’m certainly not going to change any time soon to suit you or others.

As for the attacks on TRNGs they are very real especially for chip based TRNGs and also a very large amount of embeded equipment used for communications such as network equipment[2]. There have been several real attacks show to be practical on the likes of EVM Chip-n-Spin cards that are in just about all credit/debit cards and ID cards for the likes of Electronic Pasports and Citizen cards. So of concern in fighting financial crime and terrorism if you want a “rubber meets the road” argument.

It is a very real problem and one that is only going to get worse with time, unless people wake up to it…

[1] One of my more recent being why the so called “Secure Messaging Apps” are fundementaly “NOT Secure” because they get the “end points” wrong.

[2] There has been research on “poor prime choice” seen in PubKey certificates. It was found that a disproportiantly high number originated in embedded devices where the alleged TRNGs are obviously deficient or used incorrectly.

Clive Robinson • September 21, 2021 5:43 AM

@ MarkH,

Perhaps you missed my above comment timestamped 11:56 AM, in which I stated that there is no XOR circuit. von Neumann debias is not required, and therefore not performed.

Not realy relevant, the conversation had started about the general design of radio isotope sources long before that, and the XOR gate debiaser had been brought in likewise before you went of down your earthquake example.

… you wrote, “I’ve explained the issue of how the output of a TRNG is biased by the half life decay curve.” I haven’t seen any such explanation …

Go back and read what I’ve written about the roulette circuit and how the “time” domain effects the “data domain”.

I don’t think I’ve seen the expression “sequence bias” here before. A crisp definition thereof would be helpful.

The von Neumann debias circuit only works on pairs of bits, thus the resulting debias scope is very limited. It is possible to design sequences that appear not to be biased to the von Neumann debiaser because they are biased in a way that the limited scope of the deviaser does not act against.

That is you can find sequences that are “balanced” in terms of the numbers of set and clear bits, and you can add start and end sequencies that when concatenated likewise form balanced sequences. So you end up with very long sequences that are bitwise balanced and pass through the von Newmann debiaser. Howrver if you have say two balanced sequences you can use a lot more of one sequence than the other. The result is on a wider scope than pair wise bits you have bias in your data you do not want.

But a fun little experiment for you, as you like doing such things.

The von Neumann debiaser takes a pair of bits to output a single bit. Can you find a short sequence where it has a balanced set of set and clear bits before the debiaser but does not after the debiaser?

Clive Robinson • September 22, 2021 3:39 AM

@ ResearcherZero, ALL,

With regards “SSID Stripping” and AirEye article you point to.

The first few words made me think “this is familiar”. Eventually I got down to,

“… the Computer Science faculty at the Technion – Israel Institute of Technology …”

Every time I see their name pop up I get that “Déjà vu Fealing” of having seen the fundemental work before and they have just “re-boiled the cabbage”.

The essential part of the attack is the use of non printing characters in a user interface to hide information that is seen by a –different intetface– from humans.

Whilst that sort of thing has been known about for decades especially with the proliferation of character sets and the ability to hide stuff in input attacks on the likes of SQL databases, the first real creative use for it was on this blog.

It started out with the idea of somehow attaching digital signatures to posts in a way that would be there to be checked but not visable to the user.

The idea carried on in the hands of @Wael and @Ratio who used it as a form of steganography.

Yes even I had a small contribution, in that I noted that the old “WordPress” version of this blog software in the Hundred Last Comments page treated their messages quite a bit diffetently than other postings.

So yeah AirEye / Technion have pulled another “Cabbage re-boil”.

BUT the important thing is, although everything behind it was from other peoples original work. They have again taken what to many appears “theoretical research” and put a “very real practical face on it”.

Which I hope will wake people up to the fact that theoretical ideas should not be ignored.

Our host @Bruce Schneier has in the past called the repurposing of ideas in this way as “thinking hinky” a “technical term” I’ve not seen him use of late 😉

But back on the theory side of this for a moment, it is worth considering why it’s possible. Well it occurs because software interprets the SSID in it’s “raw” entirety, that is every bit in the string counts thus it’s a “one to one” mapping. Human Computer Interface(HCI) software by tradition has “non printing” or “printing as white space” characters even in 7-bit ASCII to hide “in-band communications signaling”.

Where it’s gone horribly wrong is the extensible character sets they have so many not defined or redundant characters they considerably out number the ones that are meaningfull to humans, thus HCI software has a blanket “non printing” or “print as whitecspace” policy that gives a “cooked” output… So have a “many to one” or “many to none” mapping which is very very different to the “one to one” mapping of the non-HCI software.

Which proves once again that where there is “redundancy” “covert channels” can be made, and they can be used for good or bad depending on your view point…

Clive Robinson • September 22, 2021 4:09 AM

@ SpaceLifeForm, JonKnowsNothing, ALL,

Does more sectors make the Random more Random?

In the longterm no, in the short term yes.

To see why put the resulting squarewave signal through a low pass filter, it acts as a lossy integrator.

The lower the frequency of the square wave for any given filter cut off frequency the more “squarewave” the filter output looks, the higher the frequency the more it looks like a DC level of zero if the sector sizes are uniform or some other “biased” level if they are not. In between the “ripple” changes faster and faster so hitting it with a non synchronized sample gives different results.

But as I said about the latch based roulette wheel circuit, whilst it might look chaotic or random close in it is neither, as seen further out the bunching when integrated gives a very nice sinewave at the “difference frequency”…

Which kind of confirms @JonKnowsNothing’s tounge in cheak reply, to which you could add “what goes around comes around” 😉

Clive Robinson • September 22, 2021 4:42 AM

@ MarkH,

… but also that for an ideal “perfect random” generator, any finite sample of its output would show some degree of bias because the outputs are … well, random.

Err not necessarily, because the readings are “bounded” by the system of measurment.

An infinite sequence when measured can have no bias of any kind other than fundemental bias (like a DC level) because within the range of a measurment what goes up comes down, wraps around or hits an end stop, so eventually with enough samples the average converges on some constant value at infinity.

That’s what a “tame metrologist” will tell you 😉

https://en.wikipedia.org/wiki/Metrology

Clive Robinson • September 22, 2021 8:23 AM

@ Wesley Parish, JonKnowsNothing, lurker, vas pup,

The one common characteristic identified so far, is it is happening to US diplomatic staff or US officers attached to US embassies.

And that would suggest it’s not an ordinary pathogen, but something that is “selective” for some reason. Especially as it has not spread.

Whilst we do have the genetic ability to come up with pathogens that do not reproduce, I’m not sure we’ve come up with a “Genetic kill switch” that acts as a count down timer for either virus or bacteria.

But as I’ve said before the basic physics is against it simply being a radiant energy device be it acoustic or EM.

Whilst you could develop a “multiple beam” system[1] with a very select target area, it would be an “interferance system”. Which whilst it would have a high information capacity over a small target area, the same would not be true for energy. To see the complications on that look up the use ot X-Rays and similar to kill cancers.

Can an interferance system hurt humans. The answer is sort of yes. It takes very little energy to stimulate nerve endings, we also know that seizures and similar can be induced by flashing lights. So it would not be that surprising if someone had worked out how to make an interferance based weapon to stimulate nerve endings to cause shock / insult to a hunans neurological system. In fact it has been done whilst researching “nonlethal weapons” for crowd control, and anti-piracy and just keeping those in their teenage years out of corridors and other places people do bot want them. But they have significant issues when the levals are anything above mildly annoying, in part due to the very very wide range of sensitivities in people.

So yes it could be a biological weapon but I realy don’t think viral or bacterial because it is way to selective. Could it be a higher order pathogen[2], like a malaria varient? Possible but then you would expect it to be found the first time someone put it under a microscope (which due to US health care being so instrumented by computers may not actually have happened).

There is of course another factor to consider… Think of the likes of dengue feaver. The first varient you get mearly stimulates your immune system and gives mild cold/flu like symptoms. However when you get a second varient you can be in a whole world of hurt unlike orhers around you who are getting their first infection…

In hypothetical theory you could design a virus in a lab to replicate this behaviour but tailor it to not be the second but maybe third different strain[3].

My fealing is we are not there yet, but it is probably not that far off.

[1] See Prof R.V.Jones 1978/2009 book “Most secret War” and the section on the “Battle of the beams” and the bombing of Coventry.

https://graycity.net/r-v-jones/408938-most_secret_war.html

Start with chapter 11 and work through most chapters upto chapter 30.

[2] But there are other micro organisms and things like phages that have not been much researched in the West, and some that are only just starting to be,

https://www.ncbi.nlm.nih.gov/pathogens/pathogens_help/

[3] You only need to see what is happening to people with “long COVID” to see that some think SARS-2 with perhaps a little nudge might make an excelent multiple stage bio-weapon…

Clive Robinson • September 22, 2021 6:53 PM

@ JonKnowsNothing, SpaceLifeForm,

The existing behavior of +bars and -bars can be traced to the daily-weekly FBI flyovers of the area doing their collect-it-all Cessna flights.

You saying this, has kind of brought to a head, something I’ve been mulling over for a while now…

As you may remember from some of my previous posts I’ve been keeping an eye on ADS-B hobbyists and just what they can do in the way of OsInt.

The reason for this intriguing hobby is,

It’s a legal requirment by the FAA and others around the world that if ADS-B beacons are fitted they must be activated when the aircraft is under it’s own power. In effect even if the aircraft is not being flown but the “pilot” turns on the electrics for any reason, even when up on chocks in the hanger.

Now ADS-B systems transmit plain text packets of data including the aircrafts unique identifer, which can be traced through public open access databases.

Some ADS-B receiving hobbyists have uncoverd CIA covert operations and several other bits of “embarrassing” information about Federal agencies and some State agencies.

Well the FBI has to follow the law when it comes to aircraft flights just as any other government agency is required to do. Not doing so can cause one heck of a “5h1t storm” and “turf war”.

The thing is legally you can not just chuck a stingray unit in an aircraft it breaks any number of laws and regulations and it’s not just the FAA that will start “throwing the toys around” if you get caught doing so. And there is nothing more appealing to some federal agency heads than to have an excuse to send the Federal Marshals into FBI offices and business…

The chances of getting ADS-B encrypted any time soon is very low, or changing any of the existing international agreements about the required identifiers in the transmissions.

Which boils down to you can fairly quickly work out when an FBI flight be it an aircraft owned by the FBI or leased etc by the FBI is in the air around your location.

If you modify some Open Source software, you can come up with a programme that uses an SDR to get the ADS-B packets as they are transmitted and look them up in a DB of identifiers to owners, or a local “watch list” you’ve compiled.

You can use this to sound an alarm, or turn a mobile phone off.

So if your AFS-B antenna is up on the roof, some considerable hight above your mobile phone antenna then the “radio horizon” radius of the ADS-B antenna will be significantly larger than that of the mobile phone.

So… The aircraft ADS-B transmitter will be heard by your rooftop ADS-B antenna some considerable distance greater than your mobile phone will hear the aircraft mounted stingray.

So in effect you can have your mobile phone off before the stingray gets to have it’s way with it.

Now the fun thing is not only can you look up the ADS-B identifier to find the aircraft and owner, you get to find out all sorts of other information. Some of which is modifications permits.

In theory if you put a stingray in an aircraft you want the antennas to be on the outside of the aircraft. The work to do that needs not just a permit, but an inspection report which are entered into a federal register which in effect makes them “public documents”.

The thing is this has a knock on effect. That is once you’ve got a permit and report for one type of aircraft it is less expensive / arduous to stick with that aircraft type than go through the process with an entirely new type of aircraft each time.

So… just making a note of which type of aircraft fly at the time you see unusual behavior with the phone, by correlation gives you not just the likely suspect, but the types of aircraft favourd by the agency. So if a new aircraft comes into the area, just finding out it’s type can effectively give a “heads up” ability when the agency brings a new aircraft into the area…

Whilst not perfect, it can give a thoughtfull person way increased privacy in their home etc.

Clive Robinson • September 23, 2021 1:40 AM

@ Mowmowfi,

You still do a lot of work, are you 25 with a brain?

Well… My body is of a similar age to our host @Bruce, I used to joke about who had “More badger in their beard”. Unfortunately my body is now very definately falling apart in several ways, so there is no,more walk twenty miles or cycle a hundred everyday to get excercise and thinking time.

My brain on the other hand, for various reasons, still thinks it’s in it’s early twenties, and is still extraordinarily curious and inquisitive and does not want to slow down or “act it’s age”.

It feels you can leave the perponderance of gravitas for “The near dead philosophers society” 😉

I’ve been known to say I’ll never retire, as I’ve to much to do, but that’s just the brain talking 😉

Clive Robinson • September 23, 2021 2:26 AM

@ Wesley Parish,

I’m thinking along the lines of “sick building”, which syndrome arrived on the tail of Legionnaire’s Disease, iirc.

It arived via an accountants tut tutering… Architects were persuaded that brutalist glass and concrete design was the way to go, as it was quick, fast and above all cheap. But it was not just visual oppression to those walking by that came with it, it was the brutality of a closed and enforced environment. With the banishment of diurnal cycles for 24h working, killing circadian rhythms and those that need them shortly thereafter. They are places where a “mouse fart in the basment” gets endlessly recycled throughout the building in the name of “efficiency” and it is only by human ingestion that such organics get removed…

Now of course such inane stupidity has become an enabler to a virulant pathogen just to emphasize how stupid certain types of humanity are.

But the point against your argument for this as yet cause unknown syndrom is some people who don’t work in such stygian environments are suffering from it as well.

Which is just another reason why I’m thinking what ever it is, it has to be multi-part.

As for what is happening to the US State Department, it is to be expected. It grew to large, became to powerfull and staffed by those of a certain disposition and outlook. They are now out of step not just with the wishes of society, but more importantly those with the money to influence the politicians.

Such a large beast can not be dispatched by sword and shield with one clean stroke, so instead the insiduous poisoner is called in to slowely kill the beast body and soul organ by organ, whilst the official executioner inflicts the visable death by a thousand cuts. Such is the way of those who would make plans in the dark. So expect a round of “puritanical cleansing” to remove those who still have power or visability and to cower those who remain.

Clive Robinson • September 23, 2021 9:00 AM

@ SpaceLifeForm, ALL,

Parse slowly so it sinks in

I don’t realy need to, I’ve seen the basic faults so many times…

Fault One “fall back attack” you MITMA a comms link and force the lowest level state you can.

Back many years ago there was a lot of noise about a well known supposadly secure terminal emulator falling back to “ASCII Plaintext”…

OK this is “basic HTML” but when sniffing for a credential “Do you care as long as it is there?”

So absolutly no excuse on that one…

Fault Two, the Microsoft favourit that just keeps on giving… It gave us amongst other things “Plug and Pray” attacks and dare I say “USB rooting”. It is the old “Ease of use over root of trust”.

I could go on but what the heck were Microsoft doing?

These are decades old attacks, that Microsoft developers are obviously not learning from…

Or for that matter many other developers of commercial / consumer software.

Clive Robinson • September 23, 2021 10:40 PM

@ lurker,

“man charged withfaking positive covid 19 test”

Whenever something like this happens, it is “because they see” some advantage in it.

Thus the question arises of “can we see it?” and if so “is it an advantage to us?”.

As a generalisation criminal law regards a person as making mentaly competent and rational choices before they commit a crime. Remove any of the components and the crime may not have occured even though the event did (think murder -v- manslaughter etc).

So although the article did not say what the motivation was, the fact there has been an arrest kind of implies at the moment the authorities believe the man had a rational reason to do what he did, so we assume something to gain by it.

I guess we are going to have to wait to find out.