Schneier on Security

Clive Robinson • September 28, 2026 7:32 AM

@ Bruce,

What was it you once said about attacks never get worse with time?

😉

Clive Robinson • September 28, 2026 6:02 PM

@ ALL,

From the Dan Goodin article in ARSTech,

“Most Privacy Pass implementations rotate keys regularly, a measure that greatly reduces, but doesn’t automatically eliminate, the chances of attacker success.”

Read that carefully because the first half “rotate keys regularly” can and often does negate “greatly reduces”.

The reason is that under all the crypto magic lies “integers” that in reality are vectors of bits.

In crypto for such things you have four primary but virtually incompatible requirements in a major implementation,

1, No vector should be ever reused.
2, Every vector should be fully independent of all others.
3, There should be no determinism or structure in bit selection.
4, The average of the set and clear bits should be close to 50:50.

(There are other requirements such as length of bit runs but they just make the problem worse).

Whilst there are ways to meet these four requirements they are generally slow and not suitable for high through put production systems.

The result is thus often somebody “invents a method” by “Home-Brew” system that all to often uses a weaker crypto algorithm as a short cut or to save resources.

Or breaks other security requirements such as properly disposing of used “Key Material”(KeyMat) and auditing new KeyMat as part of “Key Management”(KeyMan).

All such “Home-Brew” systems are thus likely to be more susceptible to new attack methods than “factoring” will be.

Thus I fully expect to see further successful “non factoring attacks” in the future.

But something for people to mull over. I’ve mentioned on the odd occasion that Current AI LLM Systems have a “Digital Neural Network”(DNN) at their heart. Further I’ve indicated that in reality the DNN is actually a “Digital Signal Processing”(DSP) system that acts as an “adaptive filter” the purpose of which is to draw coherent signals from seemingly random noise[1].

Now imagine how with a little tweaking such a network could be used to find any statistical pattern in otherwise thought to be “random” noise.

[1] There is a myth that most noise signals, in particular “Average White Gaussian Noise”(AWGN) shaped noise is “truly random”…

The bad news is outside of certain fairly rare physical processes noise is actually not really random at all.

A coherent signal diminishes with range and other “Shannon Channel” issues. These signals “add” in linear channels and multiply in non-linear often “Square Law” channels.

We know from research done on codes using plaintext books, back quite a bit into the last century that after four or five plaintext book additions the resulting character stream “looks random” enough to use as a “stream cipher – key stream”.

However more modern techniques will enable such additive stream noise to be decompiled back into the constituent plaintexts. It’s something that a lightly modified Current AI system could do.

Thus layer by layer the supposedly random noise can be stripped back to individual signals and removed one by one.

This signal decomposition is an issue that comes up in the design of “True Random Bit Generators” where cross modulation from the power supply and other signal sources causes deterministic signals to get mixed together and appear to give randomness that is in fact “faux-entropy” and in effect swamps any “true-entropy” below a useful level.

We know this to be the case due to “EM Signal Fault Injection” on the likes of IBM True Random Bit Generators where the measured output entropy dropped from more than 32bits down to around 7bits.

A fault that Intel “on chip” “random number generators”(RNGs) suffered from as well (something I’ve discussed here in the past). And why Intel and other manufacturers always add a crypto algorithm after the actual “on chip” RNG, but do not allow you access to the actual raw RNG output for “fault testing” (which is a very major “No No” security wise, and fairly suspicious as a PRNG based around a crypto algorithm in CTR mode will look statistically better in the usual canon of tests,

https://webhome.phy.duke.edu/~rgb/General/dieharder.php ).

Clive Robinson • September 29, 2026 11:38 AM

@ iAPX,

With regards your “two fears” of,

1. An Eureka moment from a genius, and boommm, pans of cryptographic security is gone without warning
2. Corrupt pseudo RNG, again and again

What happens when you consider the two being coincident?

I call it a “nightmare” and one that has for many years kept me awake when thinking about the issues to do with “Key Generation”(KeyGen) in production systems with high throughput required.

In theory quantum noise sources have both,

1, flat probability.
2, High independent output.

But that does not fix

1. No vector should be ever reused.
2. The average of the set and clear bits should be close to 50:50.

Whilst the second can be fixed by a couple of tricks such as, shuffling algorithms, bit flipping, and bit dropping.

The first issue of no KeyMat “reuse” is actually much harder to solve and in effect becomes similar to the “Password no reuse” issue.

That is you can try the impossible of keeping a database not of the actual values but the crypto secure hash of them.

Or you can split the key into two parts one of which is a “salt” made by using a crypto algorithm in CTR mode. It should be used for only about 1/4 of the bits. That way each random output from the generator is guaranteed to be unique but only under certain strict conditions (such as no subsequent dropping or flipping of any of the CTR stream bits and that their positions within the vector should not be changed.)

Clive Robinson • September 30, 2026 7:36 AM

@ Celos, iAPX, ALL,

With regards,

““True” RNG is possible and actually cheap. A Z-Diode or reversed transistor PN junction”

And very inadvisable to use without a lot of supporting circuitry to detect it is still working correctly.

Basically the circuit is very fragile and you should not use a zener but avalanche diode.

They are also highly susceptable to “Fault Injection Attacks by EM Radiation” that can kill the entropy down to just a few bits at best. And would turn your idea into a very poor PRNG that would be worse than the on chip RNG junk Intel tried fobbing people off with for years.

But consider, a few years back now, a couple of students from the UK Cambridge Computer Lab won a best paper award at USENIX for taking a very expensive IBM TRNG and just pointing a CW EM source of moderate power at it. The entropy went down from 32bits to around 7 bits.

You can have even better results by using an appropriately modulated EM source as I’ve talked about here and other places in the past.

I’ve “done work” in the area of EM Fault Injection Attacks since the 1980’s when the 1802 COSMAC was the CPU of choice for mil and industry systems. When one “safety test” for Industrial controllers was to hold a VHF 1-2watt Hand held radio’s antenna up against the case the 1802 was in and just press the PTT and move it around. All to often the 1802 “would take a walk in the park or just hang up” so would fail the “Factory Acceptance Test”(FAT).