Schneier on Security

Clive Robinson • August 22, 2015 8:10 AM

@ GeoD,

You can replace the vinegar with another “acid” such as lemon juice.

In effect you are “cold cooking” or “pickling” the proteins which reduces the shrinkage caused when what is basicaly muscle gets heated over 40C.

Though with your way I would add a little sugar to the salt solution.

It also helps if you “blunt score” the surface of the squid with the likes of a butter knife, as when the squid cooks it produces a nice diamond pattern and spirals that the sauce clings to, as well as reducing the effect of the shrinking, it looks realy good in salads and pasta dishes.

As for the articles “three copper pots” or “wine corks” hmm a table spoon of white wine vinegar or lemon juice and a good pinch or three of salt and sugar in the water would probably work as well.

Which is kind of what happens when you cook it with tomatoes or other fruits (not bananas or plantains though).

Clive Robinson • August 22, 2015 12:35 PM

@ John Gault III and the usuall suspects,

Of more interest to many from the website you link to is,

http://www.nakedcapitalism.com/2015/08/picking-apart-one-of-the-biggest-lies-in-american-politics-free-trade.html

It is without doubt destroying national economies and their governments and handing it over to the 1% non tax paying elite.

For instance Apple has so much of it’s non taxed profit off shore, it’s actually starting to limit what it can do with the capital to keep Apple in existance…

Likewise Starbucks has so much faux debt to off shore entities to avoid tax it likewise is starting to run into real issues.

Clive Robinson • August 23, 2015 6:01 PM

@ John Gault III,

With regards the One Time Pad and a “true random key” sequence, I’ve explained this on this blog several times in the past. There are quite a few practical issues you have to deal with as the theoretical argument has deficiencies.

The first thing to note when people discuss the theoretical side of the OTp is the length of the message is effectivly ignored… Thus ask yourself the question of how many “one bit messages” you can send before you have to reuse key material.

But there is a more subtle issue with short messages, if I ask you a question to which a one bit answer is required you might send “yes” or you might send “no” the length of your message will tell an observer the answer without having to “break the key”. This message length issue becomes quite critical if you are “talking to a computer menu” because if the observer “knows the system” they have a good probability of working out exactly what you are doing by looking at the lengths of the messages.

Thus the real entropy of the plaintext must be above a certain amount. Judging this can be difficult after all what’s the entropy of this message “Congratulations Mister Gault it’s a baby boy”?

The actual answer is two bits, one bit for the fact the baby is born alive, and a second to tell you it’s sex. With formulaic or stock statments/answers both bits can be determined without breaking the message. Thus practical implementations of OTPs like stream ciphers leak information unless you take precautions. The obvious one is to always send messages that are of a given length. The best length to use is actually a multiple of the most commonly used block cipher size which is currently likely to be 128bits.

There is also issues as to what “random” means not just for the key stream but for the plain text as well. In the case of the OTP it’s best to say “how determanistic” either the plain text or key stream is.

Most of us on this blog know that the ASCII alphabet is 127 charecters in size, but is usually sent in 8bit transmission unit where the 8th bit is either zero or set to the parity of the other seven bits. This means the entropy of ASCII based messages is actually very low and is actually problematical with the key stream selection…

Ask yourself a question, if you have a random bit generator how do you decide it’s output is not determanistic, or has not become determanistic during use?

The answer is unless it’s trivialy obvious you can not…

One of the OTP requirments is the key stream is as long as the plain text message. However that means for any message of N bits there are 2^N possible key streams, of which most have issues.

Firstly half the messages are inverses of each other, secondly many have easily determind sequences such as runs of “all zero’s”, it’s inverse of “all one’s” or a regular pattern. That is only a subset of keys have sufficient entropy to be considered sufficiently non determanistic for use.

However the amount of bit by bit entropy required in the key stream is dependent on the amount of entropy in the plain text. To see this think about the ASCII in byte sized transmission units, how long a run of zeros will leak information?

The usuall answer is the arbitary “A maximum of five letters in a twenty six member alphabet” or ~23bits, but with the ASCII’s fixed bit patterns this drops to ~18bits. Which means you need to keep run lengths down below this. With non character aligned ~10bits considered the maximum in some circles (ie no 3 successive digits the same in a number pad)…

However there is a further issue with “stock messages” from automated systems, run lengths that reveal one or two letters can over very many repeated sendings of the plaintext leak the entire plain text…

Which is why you have to think very carefully about how you would implement an OTP system for non “paper and pencil” usage, and why the standard advice is usualy “avoid them”. However similar reasoning also applies to stream ciphers generated by block ciphers, which is just one of many reasons stream ciphers are far less popular than block ciphers.

Clive Robinson • August 24, 2015 1:25 PM

@ Tam Mariner,

How do you guys mitigate this when it really matters? Or do you shrug it off as a lost cause?

You can not shrug it off unless you are a very short term viewing CEO, who’s going to jump ship before the shareholders start a class action etc.

I’ve mentioned before what I do, but I will give the basic rules,

1, Total Isolation.
2, Minimal internal functionality (ie CLI not GUI).
3, Custom Apps
4, Mediate and check all data transfers.
5, “Paper Paper, never data” to transfer outwards.

Most people can not do “total issolation” it’s actually very difficult to achive even with the likes of SCIFs and hardened equipment. I’ve previously described how to build your own “shield room” and “clean supplies” to limit EM side channels. However the design did not stop acoustic, mechanical or thermal side channels. You can add these relativly easily. Which is why I further described a quick DIY house/hotel way for optical, thermal, mechanical and acoustic side channel reduction.

I also use old hardware (1990s) running minimal command line OS’s and apps. For instance DOS 3 and Mirror combined comms and limited WordStar style text editor to talk to custom hardware via RS232 serial ports through microcontroler based custom “guards”. I also write code in C compiled in a compiler I wrote (based on SmallC). I’ve a bad habit of using “debug” on floppy disks to check for any “oddities”. If I have to import information it goes in via text only files which can be generated and checked in various ways.

Not many people will stretch to doing this sort of thing, but then they don’t have the KeyMat generation requirments some people have. Which can include letter or number OTP generation for emergency EOW comms occasionaly needed with ComCen bug outs.

Clive Robinson • August 25, 2015 8:23 AM

@ ianf,

Yes the system I use “when it matters” is extreme, but the next step back is a manual typewriter which I also use occasionaly “when it matters”. And as I’ve said before a glass table top is not just easy to clean, it also does not take an impression from writing implements, thus “when it matters” you hand write on a single sheet of paper at a time on the glass surface using a soft tip such as a 4B pencil or non ball tip pen (Rotoring technical drawing pens are still around). Oh and as I’ve indicated various nitrates and permanganates are fairly easily available, thus paper soaked and dried in a solution of them will burn not just quickly but eftectivly, and some permanganates will ignite if cooking glycerine is wiped on them, you can find the safe recipes on various magician pages on the web. Large “hand rolling” cigarette ( Rizzler etc) are known to not just burn but fold up into incredibly small easily concealable volumes that unlike Micro SD cards are not easily reveiled by metel detectors and similar.

The important point is understanding “when it matters” is actually saying “make a risk assesment and act accordingly”. That is you have to use a solution that matches the risk level you are working at, and this can cause problems due to “roles”.

The technology push these days is “one device does all” Swiss Army Knife solutions as exemplified by “smart phones” and in a similar way by “web browsers”. They unfortunatly disencourage “role seperation” hence they are a very real OpSec problem.

That’s not to say I don’t use them, I do, but I seperate out what I do on them, it’s why I’m typing this on an ageing smart phone, I’m finally geting around to replacing, whilst having a spot of lunch away from sensitive things.

Thus “when it matters” I have alternative –and yes more extream in some peoples eyes– systems I use. Importantly these “when it matters” activities are occasional and mainly “stand alone” thus the tightened restrictions are not that onerous.

When you read RMS’s page and filter out the “must be free” message, there is actually very little there that “the usual suspects” on this site would disagree with.

RMS has correctly identified that like many other “public figures” he is at a higher level of risk than many others so his base / starting point of “when it matters” is higher than it is for many others.

Something I suspect other “public figures” probably wish they had given consideration to before their personal selfies and confidential messages became public news fodder…

Thus the real problem is people taking to many unwarented / unconsidered risks and not setting their “when it matters” point high enough for certain roles they carry out.

If you look back you will find we used to quite frequently warn that if you are doing a higher risk activity such as your online banking you should take certain precautions. Such as a cold boot of your computer from a DVD/CDROM based OS that has been “hardened” in several ways, do only the banking activity the cold reboot before doing anything else. Whilst the talk is now more about doing it via a VM the likes of Tails still gets talked about here (even if it’s only because of it’s failings).

However as the “usual suspects” were all to aware and discussed here on and off long pre-Snowden there were other realy serious issues in PCs and had been for a very long time.

One of which is ever since the first Apple ][ was released “IO Cards” with ROM were a security threat which was way back in the 1970’s. The saving grace then was a ROM realy ment “Read only”, thus “physical access” was required by an attacker. So the traditional well understood “physical access controls” very much limited it as an attack vector, and made it more theoretical than practical. But the need for a “real time clock” brought batteries into computers and thus Static RAM could be “battery backed up” with the same battery to store the likes of configuration data. Which made a variation on attacking ROMs a new theoretical consideration.

Then much later we were warned of the very real dangers of the use of “battery backed RAM”, when someone managed to put malware in the IBM PC, but of the few that heard the warning back then most forgot about it fairly quickly.

Thus the real message that “Any remotely mutable persistant memory in a computer was an attack vector” was lost to most.

As the AV Industry history shows most only considered boot floppies and hard drives, but forgot or did not realise that Flash ROM was not “Read Only” just persistant like Battery backed up RAM… Thus BadBIOS and other realy nasty and very persistant malware went unnoticed untill shortly before the disclosure of the TAO catalogue made it painfully obvious. Even those of us who knew how to or had done it experimentaly up to that point just occasionaly warned it was an issue. I guess because firstly few were interested in listening and further we kind of assumed criminals would stick to the “low hanging fruit” route they were following and that those that likewise knew how to do it would be not criminaly inclined. Thus the “folly of security by obscurity” won out… and the State Level attackers must have secretly rejoiced in our folly.

Now we know real ROM is a thing of the past as it’s all EEROM / Flash ROM, thus reloading the OS to get rid of malware does not work with such Flash resident malware. Hopefully the AV industry will come up with a new set of ROM memory checking. But will they… probably not for a whole variety of reasons. One of which is,

HEADS UP it’s happening to RAM… DRAM in it’s many forms is on it’s way out, there are new soon to be low cost SRAM look alike alternatives based on magnetic bubbles –in a Fe layer in the transistor control gate– hitting the market. This FeRAM does not lose it’s contents when powered down… The oportunity to use this for extending battery life by clever switching, or “instant on” booting etc is going to make it a “must have” in new designs in the fairly near future.

The OpSec issues of this are mind achingly bad. For instance, the forensic boys won’t have to lug their cryostats of liquid nitrogen around with them to “freeze RAM” any longer, because the OpSec emergancy proceadure stalwart of “yank the battery” will nolonger work… Thus Full Disk Encryption will become pointless without major OS changes. But it’s not just KeyMat for traditionaly persistant memory such as hard drived we are going to have to protect, it’s now the main system memory as well…

But along the same time line there were other serious vulnerability warnings that came up and were forgoton by most which you will see occasionaly mentioned in these pages.

As Apple demonstrated when it was found that an employee of a sub-contractor was putting PC malware on their media players befor they left the factory back in the 90’s. Thus “Supply Chain Poisoning” was very briefly brought to peoples attention and almost as quickly forgoton. It poped up again in the UK when it was found that “Point of Sale” credit card readers had had a tiny GSM module added that stored the details for criminal card skimming activities. Now again through the TAO catalog and other sources we know it’s a major governmental activity…

As with several other things there had been warnings but they were largely ignored except by a few.

That is untill the Ed Snowden trove and other leaks, made them headlines again, but how long are people going to listen, before collective amnesia sets in and most sleep walk into other security nightmares because they don’t take the time or effort to “seperate their roles” and lift their “when it matters” point.

If you look back in this blog, you will see that our host has raised his “when it matters” point as he became more of a public figure and thus more cautious in how he does things. I think the readers hear should take it on board and for good reason, we know that the NSA, GCHQ et al target system admins and those with a security interest. Thus it’s not unreasonable to assume possibly belatedly, we are now all persons of interest to them…

Clive Robinson • August 25, 2015 2:57 PM

@ Thoth,

How do we separate our smartphones from our computer equipments at home ?

The simple answer is do not use them for the same things ever.

I don’t download videos or other entertainment media from the Internet to use at home, or for that matter with rare exception the smart phone either. The smart phone gets used for texting and limited web browsing but no email etc and as I’ve now got hearing issues –due to wearing the green,– phone calls can be at best difficult and can rapidly descend into farce…

The increasing “museum” of home machines are used for doing “learning/skills updating”, places to put things on and legacy support of applications and such like I developed years ago. Thus are not connected to the Internet or in some cases a network at all. And yes as I’ve said in the past I still support an app on the Apple ][ and CP/M (on a MicroSoft Z80 card in the Apple..) a couple of apps runing on Mess Dros 3 and a whole load of stuff for rmicrocontrolers where the tool chain and ICE’s won’t run on anything past Dos 5 (though oddly they will run under Unix with DOS Merge and an eight port serial card and network based serial port box, and perhaps more suprisingly Gnu-Linux / DOSEMU and USB-serial converters).

One of the realy anoying things about “code cutter” developers is their desperate need to have their development machine connected to the internet “to research” or as an old work colleague once put it “To cut-n- paste there way to the next pay cheque”.

I now have a new toy which is a pad and keyboard dock running android, I’ve still got to sort out a google account for it (@Nick P, yup I know, I promised but I’m pleading backlog due to illness). It’s mainly for reading pdfs and writing text docs, and “social email” but I’ll need to “liberate it” at some point to do sideways loads and get a root terminal etc but that can wait a while. Oh and a USB extension to use a freebi phone SIM in an old USB mobile dongle for occasionally getting SMS from the likes of Giigle etc for their silly ideas of 2FA etc.

The main point to remember is different things have different roles, and you don’t share across devices ever, thus never repurpose mobiles etc. Especialy don’t make the mistake of using SIMs in different phones as the electronic serial number on the device would cross contaminate and give people a “zero degree of seperation” and a way to link your roles in life…

As for being “paranoid” that depends on where your “base point” is, from what you’ve said I guess it’s higher than most of your customers, so just smile politely. Or if you want to unerve them give’m a “thousand mile stare” and say ernestly “you can never be certain can you?” then give an obviously forced smile and change the subject before they can reply 😉

Oh and where you can “use cash”, if you have to use cards only use them close to the address the card is registered to for buying household items and taking it away only on holiday as an emergancy. I don’t know what the rules/laws are where you live but anonymous “pre-pay cards” which you can top up with cash can be a real bonus, if anyone ever asks say it’s for “internet shopping” thus you only put small amounts on it to avoid getting hit by fraud etc. As always with such things it’s not having it that causes questions, but what other people think you might use it for, if you have a sensible answer for the question, pluss can show that’s mainly what you use it for, they frequently lose interest at that point.

Clive Robinson • August 26, 2015 4:54 AM

@ Thoth,

Sorry it was 4:20AM in the UK when I posted, and for some strange reason the harder I tried to concentrate the harder it was to compleate the post, so I cut out early and went to bed, before i’d erfinished.

The problem with “tin foil” shields wrapped around a phone is that they are quite likely to be in the near field reactive zone, and thus only be an “electrostatic screen” not a magnetic screen. The reason they are in this zone is a “little secret” the phone industry does not realy talk about. Most phone antennas are not realy antennas in the traditional sense, they are partly designed to couple energy into you and use you as the antenna…

If you look at transformer design, electrostatic screens do not stop them very efficiently transfering power from one side of the screen to the other by “magnetic coupling”.

So wraping a phone in “tin foil” that close is not going to prevent an appropriate coupling coil coupling the magnetic field into a transmission line or antenna.

I’ve not tried it as an experiment, but a hair pin loop would look like a coupling loop on the end of a transmission line, and an appropriate bit of wire with a bend in the middle would look like an antenna driven by a coupling loop. Thus having a metal plated pen, keys, comb or other metal object in the same pocket could couple the magnetic component and thus re-radiate a signal.

A shield room / cage, would be well outside the reactive zone of the near field. In the far field the E field is effectivly on the surface of an expanding surface thus per unit of mesurment the field drops as the square of distance, the magnetic field however drops proportionatly to volume so per unit of measure it drops as the cube of the distance, so is negligable very much more quickly.

Which means putting your phone in a “family” size/selection metal biscuit tin, spaced away from the bottom of the tin by a book or similar to get it aproximatly in the middle of the tin volume, is likely to be more effective. Even more so if you have lined the tin with ferrite / carbon loaded foam used in RF anechoic chambers, though the black antistatic “hundred ohm foam” used for storing DIL and similar IC’s/chips on works quite well for a much lower price (often free when buying chips).

Another problem to remember, is “slot antennas” thus a gap in the shield such as the open edges of such a wallet will act as an antenna being quite efficient at some frequencies.

Also no shielding is “perfect” and phones will “ramp up” their power in weak signal conditions, and could thus “kill the battery” much faster than otherwise.

Clive Robinson • August 27, 2015 7:28 PM

@ Thoth,

… but not sure about sending fake visible light images…

It’s not fake images you are sending, you are “blinding” or “desensitising” the sensor (camera) so it can not determine any information about the environment other than it is being blinded.

Imagine you are walking around after dark, usually your eyes adjust to the low light and you can see where you are going. If however I flash a bright light in your eyes even from the side your iris rapidly shuts to protect the retina and you will not be able to see anything for several minutes and will thus stumble around or have to stop moving. If you get flashed again befor your iris has opened, it will close further or remain closed. If you shut your eyes your night sight might or might not return depending on the brightness of the flashes. That is a very bright flash will still overload the eye and stop your night vision returning even though your eyes are closed.

I’ve got a five million candle power white light flash light, a 10mW green laser or 50mW near IR laser if you inadvisably want to try it out. At night both the flashlight and green laser can be seen reflecting off of objects over three miles away… and close too when focused they both quite happily set fire to safety match heads and paper as well as bursting dark coloured party balloons…

Clive Robinson • September 3, 2015 8:29 AM

@ Figureitout,

Ok I’ll STFU and I’ll definitely just flip off the union and walk away b

No don’t STFU, that’s censorship even if it is “self” censorship. The trick is to “go wih the flow” but as an edge case not main stream.

There is one argument the “union” can not get away from which is the impossibility of proving a negative. Thus flip the argument by inverting one of the inputs. Thus instead of random –the opposite of which is arguably determanistic– use “non determanistic”, so for any given sequence ask not the question “is this random” phrase it as “is this non-determanistic?”. As I was arguing –back in the early 90’s– the argument can only be true if you have sufficient (read compleate) knowledge of the system as an observer.

Without going through the boring proofs (that have bad assumptions anyway) you arive at the conclusion that the important point is that “random” is not the important thing when it comes to the use of “random generators. It’s what an observer of the generator output can do with incompleate knowledge of the internals of the generator. From both the observer and generator designer/users perspective there are three times that are important, the present, future and past So if the observer can not predict the next bit from the generator with anything greater than pure chance no matter how many previous bits they have observed then they can not make predictions in the present, and likewise the future. But for secrecy more important is determaning bits in the past, so if the observer can not determine all past unseen bits from any present and all future bits then their observations give them nothing. It therefore does not matter if the process is determanistic or not, because the observer can not reproduce it except by chance, which is the same for a physical or true random generator.

So the opposite argument arises, can you show that a physical / true random generator is not determanistic to which the answer is likewise no as well. But further because for all such generators every one without exception is an observer you start getting into the “hidden variables” domain that is attracting more attention currently so it will be interesting times for the “paid up members”.

A thought experiment for you, if physical processes are truly unpredictable, why do we have a half life with radioactive atoms? That is what causes the next decay event and the one after etc that keeps so accurately to the half life curve?

But think a bit further, we can in theory model all systems mathmaticaly if we have all information about them. Most systems are either linear or in some otherway readily predictable under observation of their output. This is mainly because that’s the way we humans design them, or the ones we chose to observe in research. However we know of systems that are extreamly sensitive to their starting conditions, such that although we can model them, we can not make past present or future predictions about the output of any practical implementation. We tend to call these systems “chaotic” and you may remember not so long ago somebody suggested using chaotic systems as generators for One Time Pad crypto…

Nearly all algorithms we use for random generators are very far from chaotic, because it’s generaly the only way we can make predictions about performance. And after you strip things away you end up with a storage of state. Thus all algorithmic random generators can be modeled as a counter feeding some kind of mapping process. Which alows us to say certain things about such generators. The first of which is that either the counter will stop or it will overflow to zero and count up in known length cycles. This means that at some point no matter how complex the mapping function the output state will become known in past present and future.

We can thus generalise that all random generators have internal but hidden from the observer state (hence the interest in “hidden variables”). We also know that as far as we can tell in our universe the amount of matter we can store state on/with is finite… the implication of this is that if state were the only thing of interest all physical generators would at some point either stop or start repeating themselves, of which –thermal– entropy suggests that all physical generators would have two sequences, the initial rundown phase from organised to disorganised followed by a very much longer period of chaotic behaviour…

Thus arguably all thermal noise is the result of multiple chaotic generators interacting with each other, to an extent that an external observer can not make predictions…

However there is another issue to consider, and that is “what an observer can measure”, measurment is the process of quantertization which means it has limits. Thus there is a limit on what we can know from observation…

But further even with a quite moderate amount of state, we know that there are practical limits on what we can know about observing the output of even fully determanistic systems…

And no matter how much it may hurt our egos, that is the way of not just this world but the universe we inhabit. And these limitations have advantages, if we can show that any system has more individual states than it is possible to go through in any period of time then even though theoreticaly bounded in practice we can not approach anywhere close to those bounds, thus they are not a consideration we need concern ourselves with. Thus suitibly complex mapping processes will keep the value of the counter hidden to all but chance. Further we can design systems where the value of that chance is reduced to the point where it can not be determined it has actually be guessed correctly in a practical time period.

So at the end of the day an algorithm with proper design criteria is as good as if not better than an ill defined and understood physical process. But more importantly you can with care combine both and get the best of both.

But this leaves open another question, can you combine a crypto algorithm with a chaotic algorithm and get the same result. That is the inability to be able to sufficiently measure the interaction of chaotic processes keeps the ability to determine if an observers “guess” is correct or not, hidden in a practical system? If it is then “entropy pools” are going to be secure…

Clive Robinson • September 3, 2015 2:40 PM

@ Nick P,

That’s not true. Many let the randomness affect a storage variable that’s put into an entropy pool

Did you type that before your first coffee of the day?

An “algorithmic random generator” is a PRNG not a TRNG.

What you are describing is an algorithm to take one or more TRNG sources and “spread their entropy” across all the variables in the entropy pool.

It’s like droping a couple of crystals of potassium permanganate into clear water, their purple dark enough to be almost brown, spreads through the water giving it that pale pink to light purple colouration we remember from school science lessons showing heated water rises and cold water sinks.