Schneier on Security

Clive Robinson • January 14, 2017 5:28 PM

@ Figureitout,

If you want to go further have a look at Serial Line IP (SLIP). The code is small and the serial driver code –used to be– is simple enough to get your head around in half an hours reading of the Driver-HOWTO. If you do a little hunting there are older “Serial Driver” examples given as an intro to building a character driver.

The underlying solution to your file size problem is two fold. Firstly use a simple method to break the file into lines with a CRC appended, thus if there is a transmission error it can be reasonably easily spotted on the other side of the diode, and thus flagged up, so that a hand/manual patchup is all that’s required. You can improve this by adding Forward Error Correction.

The second issue is to use a file transfer program such as Xmodem-CRC without the ACKs.

The Wiki page on Xmodem might make fruitful reading,

https://en.m.wikipedia.org/wiki/XMODEM

Clive Robinson • January 15, 2017 4:30 AM

@ Jen Gold Stockholm,

this is a bit old but may be of interest

PrivaTegrity was talked about a couple of times [1][2] on this blog (as you might expect 😉 But the backdoor issues were felt to make the shared secret holders significant targets.

However it was not an original idea for Chaum, both @Nick P and myself had discussed the idea of distributed holders of shared secrets in multiple –preferably conflicting– jurisdictions, long before that. We came up with the idea with regards the crossing of borders with hostile customs officers, where for your own safety you might need to prove to a judicial standard that you did not hold the encryption key to files on any computing/storage device you were carrying.

However, PrivaTegrity can never be a secure system on commodity computers, due to “end run” attacks possible in the devices (which the IC etc would do instead, by prefrence).

If you think about it the security end point is in the device communicating, all an attacker has to do is use the same communications path, and put a shim between the plaintext side of the application and the screen/keyboard or speaker/microphone. Such an attack is trivial on the likes of an Android Mobile phone by atleast three parties, the phone manufacturer, Google and the network provider who’s SIM is in the device.

To be secure you have to take the security endpoint beyond the autonomous unmonitored communication path endpoint.

I’ve been banging on about this since the 1990’s when I realised the side channel authentication by SMS I helped pioner was a bust for various reasons (and is now so broken on smart phones etc it’s ceased to be even a joke).

More important you need the human to be the last stage inside the secure security comms loop, immediately prior to the security endpoint device. Although I’ve been more recently looking at how to instrument and thus monitor that part of the communications path (have a hunt on this blog for “garden path” to get an idea).

You can find various comments I’ve made on this blog in the past about getting the human in the loop and the ideas (including failed) that I had to get around the issue with an immutable token to do the actuall transaction –not the comms channel– authentication.

[1] https://www.schneier.com/blog/archives/2016/01/how_the_us_is_p.html

[2] https://www.schneier.com/blog/archives/2016/01/the_internet_of.html

Clive Robinson • January 16, 2017 10:55 AM

@ Thoth,

Passwords are long outdated but people are too lazy…

It has been that way for over half a century. Meanwhile it’s not just attacking hardware/software that has moved, it’s legislation like the UK’s “Snooper’s Charter” and it’s preceding legislation. Thus secure authentication uses other factors such as tokens etc that even though supposadly protected by “what you know” as a passphrase/word are as we saw with Apple Phones etc subject to work around legislation.

Usually we think of only three factors,

1, What you “Know”.
2, What you “Are”.
3, What you “Have”.

Only the “Know” factor is still safe against the likes of the psychos in the US Doj. Thus we need another way to leverage “Know” factor.

In the past I’ve suggested that we need to also and sub factors of,

1b, Know “Where” to be.
1c, Know “When” to be Where.

This has the advantage of putting an imovable block on the “Know” in a similar way that “three tries and lockout” used to do when “Know” was inside your head as a passphrase/word.

This leaves the question of accidents and lifting the “block”. Obviously if this did not have a “Where” element the block lifting mechanism becomes the LEO legislative attack route.

This brings us back to the shared secrets in different jurisdictions idea, yet again. It also alows all sorts of other protection mechanisms to be added that fall into the 1a “Know” catagory such as “duress passphrases/words” but with out the infinate guess option open to those LEOs that belive they have over reaching powers.

Doing things this way alowes the use of more normal Technical Protection/security methods such as PK systems embeded in tokens etc to work in the way “the crypto-geeks thought” back thirty to fourty years ago.

When you think about it all legislation had it’s foundations in the religious and philisophical notion of “Free will”. That is you had a choice to be a criminal or a martyr, and there were places not just your mind that the law could not trespass hence “legal privilege” between you, your confessor, doctor or lawyer etc.

These days it’s clear that the “Guard labour” of society, wants to hold it’s self where it’s writ runs roughshod over such necessities of society such as “free will” and “legal privilege”. They try to remove them via legislation or technology for what they claim is “The common good” even though it is anything but. Thus those who have free will should have the same right to use legislation and technology to to maintain free will for themselves and others.

Clive Robinson • January 16, 2017 2:04 PM

@ CallMeLateForSupper,

Collectively those are a recipe for disaster. (You know that, I know.)

Yes I do, but as you also know, non security types, especialy those who believe they are on the express elevator to walnut corridor, either don’t know, don’t care or won’t let security get in the way of what they are doing…

Thus the question of what will happen in practice and what will be the security “low watermark” not “high watermark” for any given system. As we both know attackers will take any toe hold they can get to form a bridge head into a system. So one weak password in a hashed list is enough…

Clive Robinson • January 16, 2017 4:10 PM

@ CallMeLateForSupper,

And the password news goes from bad to worse,

https://www.theregister.co.uk/2017/01/16/123456_is_still_the_worlds_most_popular_password/

I’m aware that some of those are “throwaway” passwords but even so, it makes you wonder about those users more serious passwords…

Clive Robinson • January 17, 2017 1:25 AM

@ Wael,

It’s got nothing to do with either the trend of the day nor how lazy or industrious people are. It’s got to do with reality.

One man’s meat is another man’s poison, it’s a question of perspective, and the thing I hate most “Arguing back from a known effect to one or many probable causes”.

It’s an important point as it’s the effect of the users choices –Strong/Weak– that is the cause of the security vulnerability, not the system that alows the choice. If all users made strong choices then the system would not fail. The problem with the system is,

1, Choice type recognition.
2, Enforcment avoidence.

That is how do you build a system that can actually recognise the difference between a strong and weak password, and what it does when it thinks it is weak?

We know from cryptography weak plaintext, can appear as strong cipher text when encrypted with a weak determanistic algorithm (ie the persons name, stream cihpered using a LFSR KeyGen keyed by the date). The problem is as we know from black box RNGs examining the output can not tell between a determanistic sequence such as AES in CTR mode and a True RNG using a quantum source. The output is just bits with statistical properties that may or may not have 100% determinism, you just can not tell from the information the system has available. But an attacker who knows the users system is in like a rat up a drain it’s what Shannon’s maxim and Kerckhoffs’ principle warn us about.

But if the system does know a passphrase/word is weak, the user will as we know find another weak way that does, or change the something they “know” into something they “have” like a piece of paper with the passphrase/word on it. As I noted originaly only the something they “know” is protected under law, and that barely so.

So the object of the excercise is to ensure that even a very weak “know” can be put beyond what the law can achive technically if the users choice is not to tell investigators the “know”. It’s what Apple had tried to do on the iPhone that caused the FBI/DoJ to effectively tell “porkie pies” to a magistrate.

The lesson from the Apple case is that the “know” will fail if the “have” has a flaw or defect. Because if the “have” is in the attackers possession they can grind away at it via a technical means, unless there is a further limitation impossed on the technical means they can use.

So the “know” is limited by the capability of the average human brain, which due to evolution is realy quite bad at somethings. Specifically as has been shown the abillity to remember even very short random numbers such as PINs which are so weak they can be cracked by technical means in less time than it takes to push a button…

Thus the “know” has to play to human strengths not fail through their weaknesses.

So the “know” can be split into sub catagories,

1a, A “text” you know.
1b, A “place” you know.
1c, A,”time” you know
1d, …

They will each fail to a brut force attack after some period of time, thus the trick is to analyse what domain each is in.

The “text” you know is only in the intangible information domain it has no physical actuality. However the “place” you know has a physical actuality and the “time” you know has a temporal actuality. Thus they are in effect orthogonal to each other.

As we know brut force technical measures against intangible information is at the end of the day based on just how fast you can test untill you find the right combination of bits. With each additional bit doubling the test time at any given rate. Thus the aim of the game is to increase the number of bits beyond the resources of the attacker.

For a human a “place and time” are far easier to remember than a PIN and also have considerably more bits than a PIN. Thus the game is to design a sufficiently secure “have” that puts both the number of bits up and reduces an attackers test rate to negligable.

With regards,

Take for example a situation where…

What you talk about is a “function” of the device “in use”. What may people forget is that the security required for any given function is often significantly different. For instance the basic use of a phone to dial a user entered number in the general case requires little or no security. Thus we have the notion of allways being able to dial “emergancy numbers”. What has actually happened is there is no security on the phone use, but a “whitelist” has been put on the numbers that can be used in locked mode. Once you have a whitelist system implemented it’s very little effort to add a “blacklist” of numbers that require a greater level of security in unlocked mode. Thus the level of authentication required to go from locked to ublocked mode can be a lot lot lower than other functionality of the smart phone.

Which brings us to your point of,

There is a lot more to say. But passwords won’t go away anytime soon.

Yes there is, and no they will never go away, the trick is to augment them in a way that plays to the strengths of the human mind.

Finaly with regards,

That’s all I have to say about that — Forest Gump.

And the link to your prophetic poem. On that same page lower down is a post from you which is well within this authentication discussion, and well worth a re-read,

https://www.schneier.com/blog/archives/2012/06/friday_squid_bl_330.html#c782990

And says a lot more 😉

Clive Robinson • January 17, 2017 11:18 AM

@ CallMeLate…,

I declare the following to be my question for all time: “When will they ever learn.”

It might also be the song chorus of all time (if you are old enough to remember it the first time 😉 Though Barry McGuire’s Eve of Destruction is the song I’d plump for.

Clive Robinson • January 17, 2017 3:20 PM

@ Q,

cyber attacks vs. squirrels.

I would have told my “dazed rat” story except…

At the bottom of the article there is a link to this story,

http://metro.co.uk/2017/01/13/swan-holds-up-train-by-waddling-on-the-track-for-two-miles-6380202/

The article is slightly wrong in that it is actually not a “Teddington Service” but a “Richmond loop Service to London Waterloo” (as you can see on the front of the train in the photo). The service normally stops at Kingston Railway Station for a timetabled 5-10mins anyway to allow for “late running” catch up to avoid Government imposed fines for late running as the service is so shoddy. The train operator SWT[1] also “runs them fast” cutting out stations like Norbiton, New Malden, Raynes Park for the same reason much to the anoyance of many commuters…

And Yes Kingston Railway station is one I use when traveling as there is a handy bus connection. And Yes “I was not a million miles away” at the time getting frustrated just like a lot of those commuters.

[1] SWT is owned by a brother and sister, who make themselves share “dividens” of up around $75million mark. The sister now owns a couple of Castles and much else besides, the brother is busy buying up scotish politicians with his share. All very much to the upset of commuters who pay the highest cost per mile, not just in Europe but the World for what is basically a very very shoddy service.

Clive Robinson • January 17, 2017 4:45 PM

@ MikeA,

That (codec mangling tones) was my first guess, but when I asked a senior Qualcom engineer about this, he said it was unlikely, and that it “should just work”.

The codecs do mangle tones phase and amplitude. In some respects the codecs work like a cross between a vocoder and an audio processor / compressor. In the GSM system they were designed to be most efficient with a German male voice, which kinda differs from even the Bell 103 FSK tones by quite a margin.

Clive Robinson • January 18, 2017 1:57 AM

@ Wael,

Frank Stajano’s Pico, replaces something you “know” with something you “have” or… two somethings you have. Thus it removes your freedom of choice when the authoritarian guard labour comes along and takes the something you have devices away from you.

Frank Stajano is not going to like me saying it but he’s building the FBI Comey’s front door for him…

As I pointed out the only authentication factor the guard labour have not yet sequestrated in some way is “something you know”.

And yes there is a possability that at some point they will waterboard you or use a monkey wrench to adjust your nuts etc, hence the point of extending the “know” orthagonaly in other domains such as space and time, backstopped by out of jurisdiction recovery.

Anything less and Pico is a lot less will fail to technical measures.

Yes that may be harsh, but I think I’ve probably been thinking about it for quite a bit longer than Frank Stajano has. If you think –link– back to the description I gave of the banking transaction authentication token many years ago on this blog you will see it’s what the Pico is attempting to be.

You need the “something you know” to give you the freedom of choice otherwise society as we know it will fail inextricably into tyranny under the technical measures that the guard labour will aquire. So the something you “know” is going to stay with us, and the most likely method is by the passphrase/word. So no I can not see passphrases going away any time soon if ever (or they develop reliable brain imaging of sufficient accuracy).

Oh what’s the betting academic researchers start “fine graining” the “something you know” as I have done above as 1a, 1b, 1c, etc?

Clive Robinson • January 19, 2017 7:42 AM

@ Figureitout and the usual suspects,

You might want to read abd bookmark this,

https://dmitryfrank.com/articles/how_i_ended_up_writing_my_own_kernel

r similar reasons I’ve written several BIOS and RTOS / OSs in my time for the same and similar microcontrolers and SoCs.

As I’ve mentioned before, each one you right for a new job or microcontroler teaches you a lot about what belongs in the BIOS/drivers, the kernel and user spaces and why the likes of circular buffers are better than other types of buffer as well as the importance of what goes in which interupt top and bottom handler.

Clive Robinson • January 19, 2017 8:47 AM

@ Curious, ALL

In the page you link to,

There is a link given to the IETF, where the top level domain name is given as “.ort” not “.org”

Which may be because Deb Cooley at NSA IA hand typed in the link on a qwerty keyboard 😉

Clive Robinson • January 20, 2017 12:47 AM

@ Thoth,

would it be better to implement the usual whole stack of commonly used code (MOV, JMP …etc…) or would it be better if I were to only pick what I need and stick to high level languages ?

It depends on your assumptions about the capabilities of the developer and the attacker, and finding a usable range or sweet spot.

As an over generalized point the further up the computing stack a developer works the easier it is to stop their errors producing attack vectors.

Skilled attackers however will work as far down the computing stack as they can because that gives them the greatest control and access.

The trick is to pander to the developers failures whilst stopping the attacker reaching under to do their thing.

Or that was the way it was… I’ve mentioned inducing faults or behaviour changes by active EM attacks. To most such attacks are at best theoretical and thus ignored by all but a very select few. Then a large lump of the brown stuff hit the airconditioning and people are waking up not smelling the daisies, but the gut wrenching stench that goes by the name of RowHammer. Most are going through the grief process on this and “are in the denial phase”, but the lid is off the can as it were. If you think about what happened with BadBIOS through to ultra sound tagging and detection by malware marketers and how quickly it happened, you can get an idea of what might happen when such “reach down the stack attacks” become more practical.

Thus go as high level as you can to stop developers messing up, whilst implementing protections that check as far down the stack as you can.

It’s one of the reasons my model included the ability for a hypervisor to halt a prison CPU and inspect it’s memory for signs of illicit changes…

Clive Robinson • January 20, 2017 9:04 AM

@ r, ab praeceptis,

… if you look at programming trends, maybe we should refer to it as ‘immature coding’ rather than ‘us-american’ ?

As far as I’m aware, neither of you have been around here long enough to have seen one of my explanations of why the majority of people writting software are not “engineers” but artisanal “code cutters”.

So a brief explanation about Stephenson’s “Ring of Iron” and Victorian birth of ebgineering.

Prior to the Victorian era one of the most complex pieces of design was the iron hooped spoked wagon wheel. It came about over several hundred years of artisanal craft passed down as trade secrets from master craftsman to journeyman craftsman in the form of a pattern. There was much tried and tested but no mathmatics behind it.

Then came steam power and boilers that would inexplicably expload and pump arms that would break. The solution was to keep an eye out for cracks etc, then “bolt a patch on”. The result was large ineligent, unwieldy, inefficient and above all fragile systems.

The increasing frequency of accidents gave rise to the English Parliment passing the first mechanical safety acts. The birth of engineering and a kick up the A55 for “gentlemen experimenters” who were the first experimental scientists. This gave rise to the notion of engineering institutions and the oath like that of a doctor to do no harm, and the ring of iron or steel to be worn as a mark of such circumspection, much like the masons masonic medal.

If you look at the software industry in the main there is no maths, no science and no engineering, just design patterns getting swapped and passed on (via cut-n-paste of the Internet) and the same artisanal “bolt on a patch” philosophy. Thus the result is large ineligent, unwieldy, inefficient and above all fragile software systems, who’s only saving grace is that the users can not see the full horror of the cludge upon cludge that lurks like a barely caged slavering beast behind the UI..

It’s long past time that software development became a proper proffession, but thr large US corporates don’t want that. Hence the current face in the dock of Oracal for questionable if not illegal employment ptactices, to join the likes of Google, Apple etc with their “no compeate” policirs to reduce the open market wage rises that would follow the “supply and demand” tenents of economics if it was not for their cartel like behaviour….

Clive Robinson • January 20, 2017 9:27 AM

@ r,

The slashdot thread says something about it may be related to a test that was performed while the satellites were still earthbound, hopefully it’s repairable or circumnavigable for them.

Each of the Galileo satellites has much much higher time keeping accuracy than the US GPS system and a Swiss company contracted by ESA supplies four atomic clocks for each satellite to the payload builder Surrey Satellite Technology Ltd (SSTL) in Guildford Surrey. When built and tested by SSTL they then get shipped to Europe to OHB Systems of Bremen to be integrated into the chasis (what you might call the airframe if it were an aircraft). When built this then gets put into what could be quite extended storage waiting for a launch platform either four at a time from ESA’s Guiana Space Cente on an Ariane 5 or two at a time from a Russian Soyuz out of Baikonur/ Kourou.

From some of the information available the very precise Hydrogen Mazers are suffering some kind of problem in the extended storage. Apparently the Swiss supplier is looking into what the very unexpected problems could be.

Current each satellite has one or more of each clock type functioning.