Schneier on Security

Clive Robinson • October 4, 2017 11:04 AM

@ Bruce,

What we HP Enterprise thinking

You might have “over adjusted” when responding to @Justin’s comment.

Clive Robinson • October 5, 2017 3:03 AM

There is a flip side to this argument that ought to be high lighted which is,

If US National Security is of such importance to the USG, why does it buy “Consumer Off The Shelf” (COTS) software and not develop it’s own?

It’s primarily an economic question, but there is a secondary consideration arising from it which is,

Does the USG have the right to block what is an independent commercial software company from seeking sales abroad? Simply because the USG uses the software.

It’s an issue that I expect will come up more in the future, and people will point at the Export Controls for Conventional Arms and Dual-Use Goods and Technologies, or as it’s more commonly called “The Wassenaar Arrangement” (WA)[1].

The WA was designed to control the sale and trafficking of conventional weapons and dual use technologies, which can have both a civilian and military purpose. Or to put it another way try to ensure you have the upper hand / leading edge on potential hostile nations.

It has come under fire in the past[2] due to attempts to vastly increase it’s scope, in ways that are too broad to be considered safe. Prior to that it had a staring role in the first of the Crypto-wars, where it was mocked by crypto geek tee shirts.

The problem is ArcSight is in essence a distributed database report generator. That is it takes input log files from any device in a enterprise ICT environment that the security bods decide should be included. It then performs an analysis on those files and makes a report through a near real time interface.

If you decide ArcSight to be a “munition” or “Dual use” technology then that will spill over into all other database and report generators, which would frankly make it a daft thing to do (not that being daft is something Politicians are strangers to 😉

The real problem is the Politicos want it both ways. That is they want the techbology at low comnercial prices, but also they want the sort of control only eye wateringly bespoke defense R&D projects give. Realistically they can not have it both ways as you need a market place with sufficient demand not just for a product to be thought of but actually built in the quantaties that will bring the price down.

Any way for those in London say hello to another grey, dreary, pouring with rain morning commute to “the coal face”, it actually makes this stuff look interesting in comparison 😉 Time for a nice cup of tea then hit the keyboard and arrange some meetings…

[1] The Wassenarr Arrangnent –not to be confused with the agreement– is named after a town and it’s environs in south Holland. Where the arrangnent was first put to paper in july 1996, as an international arms-control agreement. It is a “MECR” or Multilateral Export Control Regime, that replaced the more stringent “Cold War” “Coordinating Committee for Multilateral Export Controls” (COCOM). Currently the WA has 41 participating states/nations including the US and many of West and East European countries including a number of former Warsaw Pact nations.

[2] https://www.wired.com/2015/06/arms-control-pact-security-experts-arms/

Clive Robinson • October 5, 2017 12:56 PM

@ Jan, Kiener,

Processor and board (there are other RISC-V boards)

Funny you should say that, I posted about a high end quad core 64bit version just a day or so ago,

https://www.schneier.com/blog/archives/2017/09/friday_squid_bl_594.html#c6761631

The problem with the hardware from my point of view is “Even if it is open source, you can not realisticaly edit it yourself” thus all sorts of Intel ME ring -3 or worse could be tucked away inside the chip just waiting to hatch out.

After all if RSA “trousered” 10million of NSA BULLRUN money just to make Dual EC-DRBG the default Random Number Generator in RSA’s suite of programs, ask yourself how much cash it would take to buy out the loyalty to customers of a small strugling fab?

Clive Robinson • October 5, 2017 10:37 PM

@ Jan,

Too bad none of the powerful open-source CPUs can be built with an open-source FPGA toolchain.

Yes, as I understand it theres a lot of IP involved and in some cases it’s seen as the competative edge.

But if you want “powerful” FPGA is not the way you would go if you could avoid it. Because although it will give a boost over software it’s still not close to naked silicon[1].

Which is the problem you have, to use somebody elses chip effectively “sight unseen”. Even if you personally could get to see the individual logic components, there is a lot of custom work involved so working your way through a design looking for just a few subtal “tricks” might be close to impossible in the length of time the actual part is available to buy and use in a product.

Further it’s probably not you who is going to do the job of looking, it’s highly specialised and such people are a bit ‘like hens teeth, you hear about them but you never see them’. Thus you get a trust issue, it’s the same for anything you can not do personally.

I could go one about many of the stages and trust issues –we have here in the past– but by no means all are known by me or most people who read this blog, due to the highly specialised nature of the work.

It’s why I decided that trying to lock down all the parts of the supply chain were not feasable for the many. After all as we know even the NSA with it’s culture, clout and funding can not hang on to things[2]. Thus it would be daft to assume people could not be got at one way or another[3].

There is an old saying about ‘you cann’t prove a negative’, in general it’s true. So I just accepted that like Intel “they would be inside” as I could not prove otherwise…

So having realised it was not only impractical to design a secure system the traditional way, but actually impossible in human terms, that there must be other ways, that had to be thought of and investigated.

The thought that occured is that “all bubbling up attacks” have to be more or less unique to each architecture to be of any real use to an attacker. Likewise any tricks would have to get through unknown testing without raising flags. Without going through the whole reasoning tree you can see that the attackers need for stealth/secrecy and effectiveness “boxes them in” and you can use that against them.

I realised that even if they are inside you can mitigate against them by a number of methods (which likewise have been discussed here before).

So whilst “Open Source” is nice, it’s by no means essential when it comes to the hardware. Thus the question moves to “finding the design sweet spot”.

[1] I gather some CPU manufacturers are currently looking at including FPGA within their CPU designs to make what is in effect a co-processing element to improve algorithm speed between five and twenty five times. Whether we will see them at the commodity pricing point appears unlikely from what has been said about it so far.

[2] It appears that yet another “take it home to work on” person has been found at the NSA. And attack tools or similar have escaped / been liberated, potentially to a foreign power. It’s all “undisclosed sources” so fact/fiction issues arise, so I’d be speculating like some of those “sources” if I said anything more. But let me say it would not surprise me the way things work these days.

[3] There is an acronym in the IC of “MICE”, it’s basic assumption is everybody has buttons, you just have to push hard enough, to get them to do what you want. And if they don’t, well just shove them under a bus and work on the next body in line, you’ll find one eventually.