Schneier on Security

Clive Robinson • April 18, 2018 11:40 AM

@ Who?

In my humble opinion “security through obscurity” does not work.

It does and it does not, the trouble is it has become a mantra that gets quoted all to often, the follow on result is pro and anti positions.

You need to look at the evoloution of security to understand how security is by no means an absolute but is instead a question of resources available to both sides of the question.

Security started of as a survival advantage mechanism before we even learned to talk let alone write, and it can still be seen in creatures that are herbivores or omnivors.

To get a survival advantage sole knowledge of a ripening source of fruit or a bees nest etc gives significant advantage. The problem is trying to keep the “sole knowledge”. You only have to basic options open to you,

1, Hide the location
2, Hide the source existance

Both of these are “obscurity” methods the first on it’s own is largely ineffective as others seeing you with some of the source will know it exists thus will deploy their resources against you either overtly with fist or club or more covertly by following… The second method reduces but does not eliminate the attacks.

Obviously with increasing development and the forming of groups other tactics can be employed by both sides.

For some considerable period of time this aspect of security had no reason to change. In fact it was the development of “stock keeping and herding” gave rise to the next aspect which is the need to get a physical resource from one place to another and keeping it secure at any given place.

From this you can see the basics of all physical security we still use today for tangible physical things.

The development of writing however took security into a new direction from the tangible physical to the intangible informational. Which is a problem in a number of ways, because most humans do not see the difference thus make the mistake of transferring physical world assumptions into the information world where more often than not they don’t fit or fit well. You see this in explinations of crypto as being a “lock” or a “safe” which puts the wrong image in peoples heads. In their head they see a physical object that is in effect unique thus do not see how an encrypted file can be endlessly duplicated and worked on in parallel. They also don’t tend to see the idea of “inteligent agents” that in effect turn an individual into an army of attackers that can come from any direction.

Thus even though many humans do know about “broadcasting” from radio and television they don’t see it provides security by obscurity. Various Navys realised that you could broadcast a message from headquaters that anybody and everybody could receive, but that also ment that an attacker had no way of knowing where the intended recipient of the communications was provided they sent no response. So the attacker would know that a message had been sent at what time and even it’s length, but assuming the crypto was secure not anything else. It was later realised during WWII that other information did leak in the frequency and length of what were in effect standard messages (traffic analysis). Therefore various militaries adopted “channel stuffing” where a link would be fully occupied much like some “numbers stations” are reputed to work.

Both these forms of obscurity are quite effective thus there is a place all be it narrow for “security by obscurity” even in the information communications world.

However you can also use the idea of “security by obscurity” even in a wired network where the location of all the nodes are known. I’ve explained this before on this blog along with how the use of store and forward, interleaving and indeterminate retransmission can make traffic analysis ineffective.

So yes security by obscurity is something I expect to see more of built into neyworks over time.