Schneier on Security

Clive Robinson • June 18, 2013 6:05 AM

@ Phil Karn,

The important weasle words in the statment are,

Properly implemented

And of course the “end point” issue, I and one or two others on this blog have talked about this fairly often.

And I again repeate my advise of having entirely seperate and fully disconnected (crypto) computers for encryption and decryption you keep in a safe when not using and “sneaker net” the ciphertext files over to a connected (comms) computer for onwards transmission.

The problem is ensuring the full “disconnection” and effective “issolation” of the crypto computer. For instance most laptops come with WiFi chips but not floppy disk drives which means problematic use of USB thumb drives that could carry malware back to the crypto computer from the comms computer. The malware could then activate the WiFi chipset in an unusuall manner to a nearby listening post.

Even if you manage to solve that issue there is then the problem of EmSec issues and in room bugging devices. Setting up an effective “crypto cell” in your house or office is going to be difficult. The simple fact that you’ve gone to such trouble is probably sufficient evidence in many places to get you convicted…

One way to make your crypto computer EmSec proof is to actually build it into an appropriate safe, I’ve done this a number of times (and included thermite anti tamper) and it’s not hard to do but the devil is very much in the details.

For instance only connecting by appropriately filtered power and serial lines is a pain, as is remembering to close and lock the door when you put a new floppy in and properly de-gauss it after transmission and before re-use.

Then there is the issue of the OS the crypto computer is to use and ensuring it can not be tampered with, before, during and after use. But prior to that is how to ensure the OS is not “backdoored” in some way. One way is to write it yourself, although that is easier to say than do (most “old school” embedded systems engineers can do it without to much difficulty), but how do you trust the “tool chain” few people know how to write a high level language from scratch, even a basic shell and interpreter is pushing many programers these days, especialy as it will have to be done in assembler and then “hand checked”.

Then there is the thorny issuse of hardware. 1980’s computers were made of parts where full data sheets were available and you would hand craft your own device drivers etc. Even Byte magazine produced it’s own PC design on a multilayer PCB you could buy and populate with components you could source from a myriad of places. You could even design and build your own secure hardware (which I’ve done a number of times). Not so today, most System on Chip (SoC) and high integration PC support chips are unavailable to you, and even if you can get them they are not by any means fully documented. Thus you need to look at low end chips such as the Microchip PIC range or other “embeded system” micro controler such as a limited number of ARM core chips or equivalent. In more recent times I’ve “rolled my own” CPU using FPGA’s I don’t recomend it but the results can be quite interesting and you can find VHDL code to download of the net for basic 8bit micros that are not hard to extend likewise basic video controlers etc. Access to old ccts and ROM code for 1980’s home computers like the Jupiter Ace can likewise give you a leg up and assembler code for Forth running on Z80 and otther 8 bit micros can be found via the FIG Forth web site. You can also get TCL code in K&R pre ANSI C from books likewise the Small C compiler code depending on how far back you want to go to prevent “tool chain contamination”. If you want to be a little more modern then finding Borland C++ Builder 3 floppy disks and MS Dos etc floppy disks can be done.

The real question is “Can you be paranoid enough to have a chance of being secure against the US intel agencies if they want to bug you?”

Clive Robinson • June 19, 2013 11:09 AM

@ Figureitout,

The end of your comment has double meaning

Yes it does 🙂

And as you correctly reasond it’s not the technical issues but the human/political issues you have to deal with.

One of the privelidges of power is delegation to a myriad of underlings, who can and will do your basic biding in more inventive ways than you can imagine. The danger as an English King discovered is that sometimes your wish gets granted when it should not. We all have our “will someone rid me of this pest” moments, they usually pass fairly quickly, but sometimes others do our unintended bidding and then the trouble realy starts.

The trick when dealing with the powerful is to be less trouble alive well and free, than captive unwell or dead.

There are ways to arange this but it usually requires you to plan your own demise to be effective as a viable deterant to the powerfull and it’s what underlies MAD and Doomsday devices (see tzar-bomb and 1Giga tonne ship the Russian scientists came up with but their politicos rightly decided were a step to far).

Another solution if you can manage it is the advice I give my son fairly regularly “The best way to deal with trouble is to be somewhere else”. And if you think about it there are ways to achieve this that are simpler than MAD.

If people are not looking for you, you have little reason to hide, and people tend not to try and find those that are dead, as the dead cannot be harmed. Staying dead though can be hard, if first you have not lived in anothers shoes, long enough to be comfortable and not need your own habitual life.