Schneier on Security

Clive Robinson • March 2, 2011 6:21 PM

@ Nick P,

“Honestly, I’d rather have half a dozen really good ones than the best one. Researchers will continue to crank out and review new algorithms.”

Yes I’d much rather have a collection of basic trusted and well charecterised primatives and a way to make the primatives into as many hashes as are required at any one point in time.

I’m not looking for speed or memory area or even extensibility, I’m looking for reliable and well tested.

Which means you are making my “frameworks” argument for me.

As you quite rightly say,

“The most important thing for me is that I have fallback options in the case that one is found to be weak Since this is often the case in crypto”

And the best way to ensure this is have a bloody framework that is mandatory.

It’s why I keep banging on about NIST coming up with frameworks not algorithm competitions.

So you are making my case for me the question is how do we get NIST to take note…

Anyway the nice kind nurse has given me my pain killers and sleeping tablet so time to turn in at just gone midnight in London.

Clive Robinson • March 7, 2011 4:42 PM

@ Nick P,

“Are you referring to lay people? Regular electronic engineering types? Because I know the EMSEC types have been dealing with active RF attacks for a long time”

Lay people are “civilians” in this particular battle, and most design engineers are judging by what they have done little more than “trench meat”.

The real problem is in accademia and with those who come up with standards, I almost feel sometimes some of them are working for the other side.

If you have a trawl through the internet and various scientific journals, there is little information except on EMC.

Historicaly on the Internet nearly all the TEMPEST sites where of the “big scary monster” variety and banded around things like -174dBm, -163dBc etc as though it had meaning.

Some of these people had obviously been on “You Do It This Way Stupid” courses from the likes of various national “communications establishments” and thought that there was some big secret they had become part of. By and large they dressed up basic EMC information from before the 1980’s with spurious figures and fancy names they had overheard and set up their shingle to tout for work.

We had the settop box crackers doing their thing by putting boxes in freezers and browning out supply lines as the first examples of fault injection attacks with purpose. The battle Sky had with these people reads like a Greek Epic.

Then phone cards got the cracker treatment and some of these were based on smart cards. That industry basicaly stuck it’s head in the sand and went for the quick and dirty solutions backed up by heavy heavy PR.

Then shortly before the end of last century we had the DPA paper which kind of threw a spanner in the Smart Card world and opened a vast casam even they could not paper and gloss paint over.

Ross Anderson started looking at “self clocking logic” as a potential solution. Whilst some guys started looking at injecting faults directly into the chip with IR light and lasers and in the case of a Belgian researcher EMP attacks from picoprobs made from miniture inductors made for the microwave circuit industry.

I actualy contacted the authors of the DPA paper and said to them very specificaly what could be done with simple low power RF illumination where the chip modulated the RF and you could do the DPA contactlessly. I contacted Ross and warned him what RF illumination would do to his self clocking logic and he passed the details of the Belgian researcher who I contacted and told him about the issue.

Then the world went software bug / crack crazy as the Internet realy started to get going and not much surfaced about hardware issues.

Finaly a student under Mat Baze (he of crypto.com) actually produced a worthwhile “original” project that showed how “efficient systems” like PC’s are transparent to things like time based attacks from the keyboard. And finaly opened peoples eyes to “clock the inputs and clock the outputs” briefly before they went back to sleep.

This “transparancy” to time based attacks is something that used to get taught to equipment designers before they went on EmSec Design 101.

There were also a few papers re-hashing the basic ideas that Van Eck had talked about in the 1970’s and had applied the benifits of modern technology such as DSP and some very novel twists such as using photomultipliers to pick up reflection of a CRT trace off of a wall etc.

And as I noted to them at the time in some respects it was old news in that any serialised data source that goes outside the box is a potential liability especially “hanging an LED of the data line” as a confidence indicator.

Then finally just a little while ago two students over at the Cambridge labs showed that pushing RF into electronics such as random number generators had some serious implications.

This is a quater of a century after I had showed not only how to screw with electronic purses but also how to predict and influance hand held gambling machines such that you could clean out the company, and had tried to get people to take note…. (and in one case got eased out of a job designing biometric scanners).

Guess what I had high hopes that at last people would wake up to RF fault injection in the academic world and actually do some real indepth research.

But… nagh, nothing doing, the only research if you can call it that is what working design engineers in FAB labs etc are doing almost as a hobby just as I did. And they pass it around by word of mouth almost like an ascociation of funny handshakes, possibly because they fear managment.

Have a chat with Robert T and ask him how he came by his knowledge of such things, they are kind of “known in the industry” but no one can say quite where or point to a good solid document.

It is something that is long past being draged out kicking and screaming into the light of day, but… nobbody want’s to do it. It’s almost as if they are frightened you are going to kill the goose that lays the golden eggs and to be quite honest I’m tired of it.

And it’s not the first time and I doubt it will be the last time I’ve come across this “golden goose” mentality forensic “science” is riddled with it as are some other fields of endeavor. Putting your head in the sand and hoping it will go away is not the way you deal with this sort of issue. Various religions tried it including burnning people as heretics, it didn’t work at best it deleyed things becoming “known” at worst a lot of people have needlessly be hurt.

Any way I shall now step down of my soap box and find a dark room to lay down in, “it being a quater off the witching hour” 8)

Clive Robinson • March 8, 2011 7:27 AM

@ W,

Actually the fundemental gates in nearly all practical electrical/electronic circuits are the NAND or NOR which is used is dependent on the technology used.

For instance in discreet component Diode Transistor Logic (DTL) the NOR gate was often the preffered choice. However once on sillicon with Transistor Transistor Logic (TTL) the basic functional block was the NAND gate (depending on how you looked at it 😉

The problem with nearly all logic gates in use, is that they are “non-reversable” unlike the likes of the Fredkin or Toffili gates. The reversability has an interesting issue to do with energy and the transportation of information.

First of though you have to understand the concept ot the “Controlable NOT gate” (CNOT). In essence it is an XOR gate with two inputs and two outputs. It can be shown to be a fundemental building block of many but not all logic functions.

That is the control line goes straight through the CNOT gate and the data line will invert or not invert the state of the data bit dependant on the control gate. However it is important to note that unlike an XOR gate the CNOT Gate can have the outputs pushed back in to get the original inputs.

The Fredkin gate is effectivly the same except that it has two inputs and two outputs and simply swaps or not swaps them under the influance of the control gate (you can fake this behaviour easily enough with relays but not the likes of ordinary transistor based gates).

The Toffili gate is in effect a “Controled Controled Not Gate” (CCNG), it is like the CNOT gate except for an aditional control line. The state of the data is only inverted when both control lines are asserted [ thus D’ = D XOR (C1 AND C2)]. This can be shown to be “functionaly compleate” and thus a Universal Gate from which all others can be built.

Now both the Fredkin and Toffili gates work within the “Billiard Ball Model” which means all the mass that goes into the gate comes out of the gate. Likewise if you push the balls outputed from the gate back through it they appear at the inputs in the original state.

Hence not only are they reversable, additionaly with the mass what goes in comes out which is quite an important point within physics as the “Conservation of Mass” shows that the gates are not wastefull. It has also been shown that “Mass and Energy” are equivalent….

Now to 99.9999% of the world and probabbly the same percentage of electronic engineers the lack of reversability in NAND and NOR gates is a shoulder shrug exercise.

It is only a few that think hey if “Mass in = Mass out” and “Energy = Mass” then the logical conciquence is “Energy out = Energy in = 100% Efficiency”… Thus energy lost to suroundings = 0. Which has significant implications for chip density where one of the bigger issues is getting rid of heat.

However as important as these gates are in an information theoretic way and in a very real practical way due to zero energy loss is the aditional fact that the “lost energy” is “leaked energy to the environment” and this might just be cohearent enough to “leak information to the environment”.

Interestingly from this perspective is that just over two years ago at the University of Innsbruck the Quantum Optics and Spectroscopy Group anounced that some of their members (T. Monz, K. Kim, W. Hansel, M. Riebe, A. S. Villar,m P.Schindler, M. Chwalla, M. Hennrich, and R. Blatt) had made a Toffoli gate using trapped ions.

http://link.aps.org/doi/10.1103/PhysRevLett.102.040501

If the technology can be made to work reliably there is the very distinct possability that we can have hardware without unknown energy based side channels which would make life so much easier in some respects.