Schneier on Security

Clive Robinson • February 7, 2018 12:43 PM

@ Wesley Parish,

British suffragettes: early UK ‘terrorists’?

Depends on your definition at the time.

When you consider the “Cat and Mouse” game the British Politicians and Legislature forced onto the women, and the prevailing definition of terrorism back then, then it was the British Government that were actually the terrorists not the women who were protesting.

Yes some of the women committed illegal acts, but they were not the ones using brut force of guard labour with cudgels and their horses to maim and kill their opponents. Nor were the women using what even then would be regarded as tourture techniques on their opponents.

As has often been observed in history, power tends not to cead power gracefully or quietly, and frequently employs violence to cling to power…

Clive Robinson • February 8, 2018 5:38 PM

@ Nick P,

Also, what impact if any did sharing source with everyone have on security? Almost none I found given a strong development and review process will leave almost no defects in system to begin with.

Which in essence is the main problem… Just about every closed source shop where I’ve had an opportunity to “see behind the veil” the big difference as far as security goes is their “Quality Processes”. Part of which is a development process not just with strong review but strong remediation. Also the documentation process, in particular the carrying forward of “learnt measures” via history files and the like.

It’s why in the past I’ve indicated that in development the security and quality processes are to most extents the same.

All that “Closed Source” gives over “Open Source” in the design and development process is the ability to hide junk code from most enquiring eyes (Obviously not to those who know how to reverse engineer the code backwards).

That’s not to say that Open Source is going to be of any higher quality[1]. The source just makes the code available to a larger group of observers, who might or might not look at the code.

The big example of how badly that could go wrong was the Open SSL code that was “used by all but reviewed by none”. An earlier example might be the libraries of AES code that all used the “fast” version of the competition code, that was to be polite not good news when time based side channels were finally considered (a real win for the NSA).

Which brings us onto the question of “Formal Methods” as I’ve pointed out in the past in the main they are too far up in the computing stack on the wrong side of the High Level Language / ISA “Great Abstraction Gap”. Thus are prone to quite predictable “bubbling up” attacks or any other attack that can reach down through the Virtual Memory (Rowhammer) or around it (Spector, Meltdown etc) to get direct core memory access/control. Such attacks were quite predictable and had been for some years now, which is why just about all higher end CPUs released in the past decade or so have these low level vulnerabilities.

As I said they were predictable which is why it’s something I’ve been banging on about for a number of years prior to Rowhammer, Spector or Meltdown, and discussed alternative atchitectures to mitigate such hardware issues.

As our host @Bruce has recently indicated it is quite unlikely we have heard the last about hardware susceptibility attack vectors. In part because those that have been seen recently are in effect “class attacks” that can easily be realised other ways when the trick is known. Now that it is known you can expect to see many “me too” type attacks appearing from academia in what is to them a new field to play in (but some have foreseen for years). So a number of early wins are to be expected, one of which is an attack against Intel’s SGX “secure enclave” technology, which is likely to be true of other CPU design “secure enclaves” as well…

I’m not saying that there is anything wrong about the use of formal methods or that people should not use them. On the contrary, I would encorage their use, but by those who are aware of their limitations, so that they can put other measures in place, as and when they become available/viable. One such measure is encrypted core memory on a per process basis (think individual file encryption -v- full disk encryption to see why it has to be on a per process basis).

[1] Actually a large amount of Open Source projects are not of higher quality than Closed Source. For a most important reason, that is they never realy makes it to “release quality”. The reason for this is large amounts of Open Source projects are “hommer projects” often started by those who have time on their hands for one reason or another, or are getting to grips with a new programming language or tool set/chain. Thus there is no “Commercial Imperative” to “go to market”.

Clive Robinson • February 9, 2018 7:17 AM

@ Nick P,

Clive’s energy-gapping theory gets corroborated even more. As if it needed more corroboration after all the leaks published so far over so many mediums.

Did you notice they missed a couple in their list of known methods?

1, Mechanical.
2, Gravitational.

So there is scope for atleast another four papers there 😉

I wonder how long it will take them to think further on it now I’ve mentioned the channels again. Then devise an experiment to demonstrate it. After all generating pure gravity waves is known to be a hard problem (quadripole radiator) but there are short cuts by changing vectors that have a measurable effect though small.

With regards physics as any 12 year old should know there are three basic types of energy transmission,

1, Radiation
2, Conduction
3, Convection

What is not immediatly obvious is that they all require an “efficient medium” to transmit the energy. Which alows for a fourth transmission effect which is “kinetic”. It would after all be hard to argue that somebody was not trying to send you a message when they point a machine gun in your direction and expend a few rounds.

The point is that not all of these channels are equal. Radio waves and light are assumed to originate omnidirectionaly from a “point radiator” and thus the energy to communicate a signal drops in proportion to the increasing surface of a sphere of expanding radius, ie as 1/(r^2). Magnetic fields are worse in that they are in effect volumetric thus 1/(r^3).

Thus many people fall into a trap of assuming all “side channels” fall off at a rate at worst of 1/(r^2) which also gets taught as such in EMC and TEMPEST/EmSec courses without much talking about the exceptions… Which is unfortunatly because it’s those exceptions that show you cannot generalize in that way.

For instance think about how energy moves by conduction in certain types of channel. The simplest way to think on this is with a simple electrical signal in a power supply line in a national grid. The power engineers will tell you that they have two main losses, I^2R “heating” and leakage currents through insulation. Thus the energy transmission limits are based on resistance more than distance, but as a consequence the losses are the same for any distance (which gives an exponetial decrease with distance). Thus the lower the resistance of the conductor and the higher the resistance of the insulation the less the loss and the further the energy will travel. The same is true for any transmission line. Which includes mechanical movment and vibration in mechanical structures.

So if you bolt your computer to your faraday cage and bolt that to the floor or support member, then the vibration from the fans will “conduct out” to any number of places. And you can not make the assumption that other vibrations will swamp the signal…

Finally, Sir Issac Newton had a few comments about “matter and motion” and Elon Musk’s “cherry red” electric sports car has been in the news as SpaceX’s demonstration of these and Kepler’s law of orbits.

Newton pointed out in principia that there were certain fundemental principles[1]. Of which the first two are normally stated as,

Every object persists in it’s state of rest or uniform motion in a straight line, unless it is compelled to change that state by forces impressed upon it.

And,

Force is equal to the change in momentum, per change in timr. For a constant mass, force equals mass multipled by acceleration (F=ma).

Which describes “ballistic” behaviour of bullets and cherry red sports cars. Hence the original pre launch press comments about the car going for a billion years or more. The kinetic energy they have will stay with them till they meet a force of some kind[2], which in the case of the car is likely to be a long time and immense distance covered[3] . Thus any information encoded on them will likewise remain untill that time at whatever the distance is.

But energy behaves in some seemingly odd ways. As the paper notes a Farady shield will not stop a low frequency magnetic field, which is to be expected. That is a Farady Shield is an electrically conductive medium not one with any degree of magnetic permiability. The reason it can keep out higher frequency magnetic fields is due to Eddy currents, the skin effect[4] and back EMF which via the inductance law,generates a magnetic field in opposition to the original magnetic field.

Thus as I’ve pointed out before shields should be made of materials that not only have a good conductance but alsow a high magnetic permativity. Hence aluminium foil has good conductance but low permativity. Iron wire such as chicken wire, has fairly bad conductance above low frequencies but has over ten thousand times the permativity of aluminium. Which helps cut down those magnetic fields quite a bit likewise their frequency thus information carrying bandwidth. As early radio engineers knew the likes of u-metal plated in copper or silver had very good shielding properties right down into the low audio frequencies, which is why many EMC mains filters are in plated iron based metals (a point I’ve made before when talking about designing shielding for TRNG’s). Modern slab and ring ferrite materials have even higher permativity, however they are often heavy and brittle, but you can now get plasticated materials with micro sized particles of ferrite uniformly mixed in that can be used for TEMPEST style shielding in SCIFs in layers with high conductance films[5].

Oh which brings us around to “gravity” or it’s dynamic side effects of “acceletation” as a side channel it is actually quite fascinating. We’ve already seen the use of “key press” information being leaked this way. The usual way to measure it is via a force balance system often in the form of a bridge or pendulum built on or out of a compressible medium. Which is then read out indirectly via strain guages, variable capacitance and speaker coil type magnetic displacment systems. Whilst gravity waves are dificult to generate, changing gravitational vectors is not that hard, you just need to move another mass into the physical arangment. In essence that is what mountains do as you climb down them, they rotate your effective downwards point of refrence from the vertical fractionaly to the the center of mass of the mountain. Whilst not entirely trivial to do, people have made pendulum systems capable of measuring the effect of tides far inland by the “tilt”. However they also have issues with the likes of security guards walking around and tilting seven foot thick reinforced concreate floors…

But there is one channel I’ve not talked about which is “convection” whilst it generaly has a very low bandwidth it has been used in the past to leak security information. It caused heat from the CPU to change the temprature of the system clock crystal (Xtal) by fractional but measurable amounts. I first mentioned this issue of “load” and delta F on timing which is common to all processes on the same system on this blog sometime prior to it becoming the the focus of a researcher at the UK’s Cambridge Computer Labs… Whilst the bandwidth from a convection channel is low, it has certain advantages. It is visable from considerable distance and can go around corners and through the mesh of EmSec screens with little difficulty. It is also a real problem because it’s due to “inefficiency of work” and is thus the ultimate form of pollution thermal energy. You can not “screen” it nor can you cancel it without doing greater work… In practice all you can do is use large “thermal masses” to act as storage devices, thus integrate the signal and thus effectively lower the signal bandwidth. However the likes of personal/portable equipment and “large masses” tend not to go together well 😉

Which means even though you might hide in your cubical, that hot air will rise like a smoke signal causing at a minimum turbulance that can be seen with appropriate equipment. More importantly so can the heat rising out of a computer in a Faraday screen that out of necessity has to be ventilated andcas such may easily end up outside of the “secure area” (I’ve indirectly mentioned these issues when talking about putting computers in safes on this blog some years ago). That said the convection problem moves backwards up the power supply chain and also will end up outside of the “secure area”… It’s one of the reasons that designing effective SCIF tents / rooms / buildings can be not just difficult but regarded as “secret”[5] in some places.

I can fairly confidently predict we will hear more on why “air gapping” is nolonger effective, which is why some time ago now I coined the term “energy gapping”. For many people it will require a shift in their “paradigm” thinking but it actually is not that difficult. The essentials to gather are,

1, Type of channel.
2, The channel limitations.
3, Energy type and levels.
4, Information coding/modulation.
5, Channel bandwidth.
6, Channel losses.

But also the difference between passive and active EmSec attacks. Which means you realy have to understand “transducers” and how they convert energy from one form to another across multiple steps, and the fact that most are actually bi-ditectional. Which in turn brings up the thorny issues of “transparancy” and “error detection and correction”.

Oh that Cambridge Computer Labs paper won an IEEE award, funnily the same happened with another paper from there on “active EM EmSec” techniques on a TRNG… As I’ve gently half joked before you always get to read it first on this blog ;-).

[1] The following year Newton proved –via what we now call calculus– that his laws apply to Kepler’s laws of planetary motion. That is the eliptical orbits that fairly accurately describe the motions of the planets. Which makes life a bit awkward for modern astronomers as Einstein’s laws are not as amenable.

[2] A point to note is that we have reason to believe that the universe is not continuous but discret. Thus there are “smallest” indivisable objects of not just matter but energy as well. Thus Newton’s laws apply to them in a similar way with a few extra tweaks from Einstein’s thinking.

[3] It appears the car got a little bit more of a shove than intended. Thus it has overshot the intended mars orbit. But not as much as originally thought, it won’t be heading as first thought for the asteroid belt but a more interesting orbit which will bring it within a few million miles of both Earth and Mars for some time to come it has in effect taken a –lack of– scenic route 😉

https://www.theverge.com/2018/2/6/16983744/spacex-tesla-falcon-heavy-roadster-orbit-asteroid-belt-elon-musk-mars

[4] The skin effect is not an easy thing to initially get your head around which is why I’m not even going to attempt to describe it. For those that want to know more,

https://en.m.wikipedia.org/wiki/Skin_effect

Importantly it contains a lot of important information that can be easily understood without having to sweat the mathmatics. So is well worth the read.

[5] In the past the US classified such information at “codeword” level secrecy hence “TEMPEST”. However this met “head on” with Electromagnetic Compatability (EMC) which in the 1980’s Europe did not regard as being secret (despite the UK representatives attempts). Which means that I’m entirely uncertain as to just how much “US Citizen’s” are currently alowed to know, if anything about the subject of shielding, TEMPEST, EmSec or SCIF design in general or specific. However as I independently discovered some of the more interesting “active” EmSec attacks back in the 1980’s I look at it this way “Stuff’m and their needy want’s”…

Clive Robinson • February 9, 2018 8:54 AM

@ Nick P,

Do you actually know the date that draft report on Viper issues was written? I looked at Viper for various reasons in the late 80’s as I had a tie in with RSRE and it was getting pushed. I was not happy with Viper for various –cost/power– reasons.

Judging by the refrence dates it was late 80’s early 90’s, thus has in effect lain unknown for over a quater of a century which is a shame because so far it looks very interesting.

Moving on to,

In CompSci, there’s lot of people working on formal verification of hardware for things like information flow. It’s been done down to the gates.

Whilst it’s a good idea it is, well at best late to the party… Plus it’s only likely to solve what is now in effect a diminishing series of problems. Like it or not the world of computers is moving to parallel processing and has been for some time. In effect going multi-core was the only way that Intel could hang in with Gordon Moore’s observation of market needs (it ain’t no law[1] 😉

But that aside parallel is the way we are moving, not just on chip but motherboard as well. With interesting array of “raid of raid” systems using high speed solid state drives and high speed networks as well “core memory” is becoming just another layer of “cache memory”, using VM techniques to pull tiny fractional parts of very large data sets in for processing.

Thus the problem is “core memory” has become all things to all processes and thus from a security aspect the bigest single point of failure as more and more “Efficiency-v-Security” hardware bugs come to light over the next few months to years.

The only way we can keep up with the speed needs is by being efficient at the expense of securiry in certain areas…

If you accept that as a “given” then you have to look at alternative security mechanisms. Luckily we have sort of been here before with mechanical hard drives. Thus one method we know is to use “encryption” to protect the data. Not the Full Disk Encryption type protection that only gives security for “Data at rest” but the equivalent of “File level Encryption” with different keys for each.

That is core memory needs to be encrypted not just under one key to keep external memory –DMA / IO style– attacks out, but at a much finer granular level to keep insiders off of each others grass or pearing over the VM fence.

That is each process and shared memory resource –such as IPC– needs it’s own individual key. But further the storage and use of keys etc needs to be held in non-core memory. In effect in registers when a process is running but otherwise held in an entirely seperate non cached etc key store that also holds the adjoining process page tables and read/write/execute and similar atributes.

The future, if we are going to remain “secure” is going to be quite different architectures, the academic community is only just showing signs of thinking of…

[1] Tricks aside Gordon Moore has tried to kill off “Moore’s Law” several times. The last time he went for it was back in 2015 when even Intel admited the curve was changing. However the shares marketers insisted otherwise… But last year Intel made it official in their SEC filling. Which might be another reason why selling those shares by the CEO was not a good idea insider trading wise. What did amuse was that kind of brought Intel back on line was the purchasing of Altira with their high end FPGA weighing in at 30billion transister equivalent on a chip.

Clive Robinson • February 11, 2018 10:46 AM

@ Nick P,

On hardware verification, she wrote that in 1988

Thanks I thought it might have been the later half of that decade from the dates in the refrences[1].

I remember Viper because it was being written up in journals as though it was the eleventh tablet for moses.

As you have no doubt found by now energy-gapping is more indepth than the name suggests, in that you can only mitigate energy channels you can not just identify but understand well enough. Further that there are darn few people who understand sufficient areas of science to see more than the obvious channels, or how knowledge from one channel domain can be transfered to another domain…

Oh and it does not help when certain people decide they are going to run their next “sad attack”. Which is why I’m going to go off this thread before talking further about the subject.

One of the reasons I stopped with personal email was a similar reason, the discovery that the signal to noise ratio had gone negative and trying to address the issues of the ratio were just a waste of time…

[1] Dating an actual contribution to a field of endevor is hard enough at the best of time due to publishers, but they are now making it worse as they try different money making models. You could come up with an idea write it up and send it to a journal. They would sit on it based on editorial selection before sending it out for peer-review, which could be quick or slow. The more revolutionary the idea the longer it would take. Thus there was a balance between incremental, new and original type ideas. So you could submit an original idea and not see it published for many months, if at all. Meanwhile somebody else could write three incremental papers and get all of them published in less time and end up in the same place as your yet to be published paper. They get the credit and you don’t even get a historical footprint. Now some publishers are developing new models, high end high priced journals that few will ever see, then a lower priced “best of the past six months” compendium that will not include all papers, oh and then a “dribble out” phase to the Internet that might or might not be free, but papers will no doubt be selected on their “free-click to premium-pay” convertion potential rather than their submission date. I suspect that is why some academics “self publish drafts/preprints” to try and draw a line in the sand. I’m guessing we are slowly seeing the end of the journal maffia, but it’s very certain thay they are going to fight tooth and nail to keep their money machine rooling. But some of the supposadly egalitarian web sites are anything but, in that you have to be invited to join by an existing member who will vouch for you…