Schneier on Security

Clive Robinson • May 30, 2019 12:58 PM

@ Bruce,

As you are aware there is also the stealing of the work and ideas of others, you yourself had one of your papers copied to the point that there was little doubt your work had been stolen.

As @Thoth pointed out the other day, yet another paper has appeard where his and my discussions have been stolen by those in the academic field of endevor.

I’ve even had ideas taken by those at the Cambridge Computer lab, which earn’t the person a best paper award

It’s also clear that other leading edge discussions have been taken from this blog by companies and even national SigInt agencies.

There is little honour amoungst those who do this deliberatly and for profit.

It’s a shame because it brings discredit on others that try to do things more honestly.

The appearance of so many “essey writting services” should tell people just how many people are prepared to cheat just to gain an advabtage that rightfully belongs to others.

In a way, they are not just cheating, thay are actually stealing opportunities from others, and I find it at best distasteful.

Clive Robinson • May 30, 2019 4:36 PM

@ LorenR,

I am highly skeptical of any calls, even indirect, for a return to the gatekeeper “we know better” system of “prior peer review” academic research publication.

And so you should, “prior peer review” especially when anonymous has been called into question in a number of areas in the past.

The two big ones being “starving out” and “non mainstream thinking”.

The clasic of the latter in the ICTsec area being the Wiesner’s original paper about “Quantum Banknotes” that eventualy gave rise to the ideas of Bennet and Brassard of Quantum cryptography. It was only belatedly that Wiesner’s paper got published, most to whom this happens to are not so lucky.

The other problem is in part abother form of don’t rock the boat. If you want to see how bad it can be follow up the history of “Pure White and Deadly”.

But anonymous peer reviewers for so called prestigeous journals have another issue which is they don’t want to loose the position, thus they tend to take a very conservative view…

Personally I’d rather see the “raw ideas” of an inventive mind be the ideas sound or not.

But public post published review has an interesting asspect. We know that the “Publish or be damed” rule applies these days where if you are not getting atleast as many papers published as your peers you get “de-rated”. Thus science has become not just timid it has become salami slicing and papers worth less and less.

In essence if you are not yet “established” and have a good idea, you are better served by writting a half dozen or so mediocre papers than you are a single outstanding paper. Also you can punt them around many journals untill one bites.

Public post publication review has the potential to kill both of those defects off and in the process make papers worth reading again.

Speaking of which,

@ ALL,

Of those interested in Quantum Cryptographies failings in practice might be interested in this,

https://www.technologyreview.com/s/613079/theres-a-new-way-to-break-quantum-cryptography/

I’ve explaind injection locking and how it can be used to enumerate the security of EM systems in the past, along with a whole bunch of other ways to make practical QC a pile of wasted q-bits. So in some respects there is actually nothing new in that particular part of the idea behind the attack, but getting it all to work as an attack in a new domain is actually more than a bit niffty, so q-dos to them 😉

Clive Robinson • May 31, 2019 2:51 PM

@ Bob Paddock,

I’m curious on your insights to using ‘Chaos’, in the mathematical sense, for things like secure communication?

I would try and avoid using it.

Firstly whilst it is very sensitive to it’s initial or starting conditions it is effectively determanistic. Which in of it’s self is not sufficient from disbaring it’s use, after all the majority –but not all– crypto algorithms are fully determanistic.

What concerns me is it’s input to ouput mapping depending on where you are in it’s mapping it can have undesirable characteristics especially in the short term. Look at the behaviour of the solar system, although it is chaotic you’ld have to wait for five to ten million years for it to appear to be so. Likewise look at the behaviour of a double rod pendulum, again it’s chaotic in the long term, but in the short term when you are watching it you can mentaly predict where it’s going much like you do when someone throws a tennis ball for you to catch. One of the more famous chaotic systems is the Korenz Attractor, that makes those rather beautiful “butterfly wing” patterns. As their “finder” Edward Lorenz has observed of chaos theory

When the present determines the future, but the approximate present does not approximately determine the future

Where things go is dependent on things like rounding errors. Therefore running it on a computer that uses 64bit ints will produce a different result than 32bits over time, thus there are in effect almost hidden dependencies waiting to take a chunk out of you.

Whilst I would not use typical Chaos Theory algorithms “raw” they can be used to replace some other functions such as simple counters that then go through a CS algorithm before use in a small subset of CompSec functions. That is if the CS algorithm is of any use it should act as a oneway function with a sensible avalanch criteria. Thus they could be used for the likes of “entropy pool” mixers/stirrers.

However as with other domains that cover a large amount of ground, you could ask half a dozen practitioners and get two dozen answers over a shortish period of time 😉

As for the apparent relationship to nural activity, I’ve seen very little on the subject, but I would be cautious.

Look at it this way the movment of “heavenly bodies” appears sufficiently like clockwork that not only can you make acurately predictive models using gears and clockwork escapments, you can actually set your watch more acurately with the transit of Venus than you can with time keeping systems that predate the first of the atomic resonance refrence systems.

However the similarity in behaviour and accuracy in no way indicates that the heavenly bodies run by clockwork. It’s the old “If it looks like a duck, quacks like a duck, and waddles like a duck, why doubt it is a duck?” question, to which the answer is “Because it knows it’s not a duck but a goose”.

Thus you would need quite a few hypotheses and ethical experiments to show actuall correlation not coincidence.

I would be especialy be carefull about rings of inverting logic gates, especially CMOS ones. As I said a few days ago CMOS gates are actually very high gain amplifiers that hit the rails. Their analog behaviour region is very close into their input bias point. Which means you get phase jitter on the switching time. In certain kinds of logic circuits such as SR latches and other latches this input bias error can cause “soft faults” which you can read about under metastability. If you connect the output of an inverting amplifier through a second amplifier and back to the input of the first you get a 360deg phase rotation if the total gain is one or more it is going to oscillate at a frequency dependent on other circuit parameters such as roll of frequency and transmission line delay. A large number of people incorectly believe that two or more of these oscillators can be mixed together via a latch to give you “entropy”… Because close in on an oscilloscope the resulting logic signal “looks random”. However the actual result is a “digitized sinewave” of the difference frequency with a little noise generated jitter… Which becomes fairly obvious when you set the oscilloscope time base such that it’s display period is between one and two cycle periods of the difference signal.

What’s worse is those ring oscillators generally have one or more paths “in common” between them via the likes of power supply rails… Thus just like pendulums over time they will tend to synchronize to a near harmonic of any signal that may be present on those common lines, which is just another form of injection locking. And when this happens any ebtropy you thought you were getting will drop down to below the far from random system noise[1].

So I would be cautious and look for ways to “disprove” the hypothesis.

[1] In most systems the “noise” is not “random” from the likes of thermal noise, it’s actually a summation of lots of little usually determanistic signals, that just “look like” Gausian White Noise. You can easily see this by using a Linear Feedback Shift Register (LFSR) if you feed it through a low pass filter the result is very “white-noise” like in most test instruments, which is why they are used in testing of analoge systems like audio amplifiers etc.

Clive Robinson • June 2, 2019 7:12 PM

@ Neil Prestemon,

The Lancet Paper – itself, was not necessarily indicative of a flawed process; because this paper was EVENTUALLY investigated, reviewed, and debunked.

Actually it was politically attacked by the UK Government, and major threats were issued against a number of people long before the Lancet withdrew the paper (after 12years and the reasoning quoted in the withdrawal is it’s self suspect). Likewise the GMC eventually spent 217days looking into it, an unheard of time.

The reason the whole thing was “political” from the outset was that parents had the temerity not to follow yet more bad medical advice from the UK Gov[1] made on what turned out to be purely financial motivation…

The supposed “debunking” did not follow any kind of real unbiased scientific process, just the hackned old trick of “reviewing selected papers” of interpreted population studies[2]. With such a process you can argue almost anything you selectively like.

Now it does not matter what you think about Dr Wakefield the other authors or the Royal Free Hospital in Hampsted North London. Put simply the water has been too muddied to make reliable observations. The only things we can say is that the study size was small, that due to lack of patient records[2] the study had to go in part on parental recolections, and for some reason unexplained three conditions were linked in the paper. Anything after that you will not be able to find out much that can be seen to be in anyway independent due to the political hatchet job done by the UK Gov.

But if you can find the paper and look there were thirteen authors on that paper. Can you name them or what happened to them? Journalists have made claims about “dishonesty” but if that is true of one what about the others? Surely they are not all innocent dupes? Ten apparently have claimed they actually never saw the paper that had their names on it!

We have no idea if this statment is true or not, it certainly did not come out for some time… Which raises the question is this sort of thing uncommon or common in medical research? Or perhaps we should ask was it a convenient or concocted way for those ten to try to get out of the firing line? If so where they in effect threatened or bribed. We know from the death of Dr David Kelly, the UK Gov will quite happily try to force people to be dishonest in giving evidence, and possibly worse, “kill the messenger”.

The only actual independent information you might still be able to find was the insurance risk costs set in the US were considerably higher for the combined MMR than that of the three seperate injections. As this was decided on information obtained prior to the Wakefield et al paper then the old question about “smoke without fire” arises.

From my point of view if the parents of a child wanted to go for what the US considered at the time to be the less risky three seperate injections rather than the classified as higher risk triple would you tell them they could not? Would you actively take steps to prevent them doing so? Would you make threats to criminalize such parents and take their children away from them?

Possibly not, but that is what the UK Gov decided as suitable tactics early on…

Oh of those involved on both sides the question of “did they have clean hands?” arose. Quess what was found some were in effect being payed by the drugs companies, but kind of forgot to mention it in research findings etc. Even the most senior Gov Dr was found to have been less than scrupulous in declairing where their money was comming from… However about the only thing you will find now is that Dr Wakefield had been used by the US legal profession as an “expert witness” or advisor, and he had some dealings in a similar capacity with the UK legal system, things that actually carry “A duty of confidentiality”…

So all we realy know is that after a lot of mud and threats were thrown about the Lancet eventualy gave way to political preasure in as minimal way as possible, due in the main not to the co-writers of the original paper disowning the paper, but due to a General Medical Council finding that was in essence unreliable linking of paper data to actual subject data…

But something else that rarely gets mentioned was the poisonous state in the GMC at the time. Junior Doctors had in effect declaired “no confidence” in the GMC seniors over their “too close relationship” with the Government and in effect selling junior doctors down the river. Something subsequent history suggests is rather more than an allegation, as can be seen by the number of GP practices now closing down.

What you also might not know is that UK Politicians and Civil Servants have a very long history of interfering with medicine and actively going against well found scientific and other competent advice, even when they have selected the advisors.

The result is many many unnecessary deaths can easily be laid at the UK Gov door[1]. However if you do so you get from them the same lie of “Best scientific evidence made available at the time” every time even when it can clearly be shown otherwise.

Yes I read a lot about things at the time and tried to find out what I could trying to sort the UK Gov propaganda from something approaching independent evidence. Personaly on what I found I can in no way blaim any parent who decided to go for the single jabs. However I can very much lay considerable blaim on the UK Government as to why now there is no actual research being carried out in this area, and it may be three or four generations before anyone dares.

But there is another thing we do know, which is autism is still rising and we do not know why[3]. Even though certain parts of the medical profession “Keep rearanging the deck chairs”.

But then this is not the first time we’ve seen this. Look into the history of “Pure White and Deadly” and the hand US “Big Agro” had in pushing what became a “Government vested interest” which has resulted in the premature deaths of millions and still does… Sugar is not “empty calories” it’s “Death loaded addictive calories” that you easily get hooked on, then go on to developing old age diseases in midlife or earlier. Oh and don’t forget life expectency is dropping in the US unlike other Western Nations (mainly in those who eat processed foods).

[1] For example have a look into hemophilia and the blood bourn diseases including HIV that those suffering from hemophilia have contracted and died from because of UK Gov insistence to carry on using low cost imported blood products that had not been tested or screened…

[2] Any time you see a paper that is a review of papers on population studies, you should throw it in the bin. The thing is population studies are based on medical record keeping that is at best scant, to actually being down right dishonest. If you have a dig around about drug follow ups they were rarely carried out longer than six months. Frequently they were payed for by the drugs companies who collected the raw data and almost invariably the raw imput data is never revealed, to even those with oversight requirments on drug safety thus independently verifying the results is virtually impossible. Thus reviews of such studies are often what programers call “GIGO” likewise reviews of such reviews… This poor medical record keeping is one of the reasons many doctors in the UK ask patients or their relatives for “life histories” because experience has taught them the unreliability of medical records…

[3] There is however a correlation between the inteligence of the fathers and the risk of their children having autism. If you are an “engineer” then your childrens risk is about 1/7th higher… But is it “intelligence” or the consequence of behaviours intelligent men tend to have in common in modern society…

Clive Robinson • June 4, 2019 9:33 PM

@ Faustus, Alyer Babtu,

That, and the extortionate fees for a generally mediocre education, from professors generally little interested in teaching when their career depends on publishing.

There are three things there,

1, Extotionate fees,
2, Mediocre teaching,
3, Publish or be damed.

That hide that Universities are atleast bi-polar in form.

That is there is two value added streams,

1, Research,
2, Education.

The question thus arises as to why historically these two mainly non complementry streams were forced to co-exist? And why they are still together currently and I presume for the foreseeable future?

Look at it this way you don’t expect your high school physics teacher to have a Nobel Prize or be looking to be put forward for one. In fact you would probably be more than somewhat discoraged if they did.

That is there is a clear distinction between imparting knowledge in a way favourable to a teaching process and finding new knowledge by research, and the two are not realy complementary so you actually would not expect to find many effective researchers who can also be effective teachers and vice-versa.

I should be clear here I am making a clear distinction between,

1, Diseminating new information.
2, Teaching existing knowledge.

And they clearly have two seperate paths that is “Publishing papers” ment for other practicioners at peer level in the field of endevor. Production of books and learning materials for teaching entrants into a field of endevor.

Yes there is a cross over point from learning to be and actually being in a field of endevor. In the past where the theoretical knowledge was low but the practical “hands on” skills high we used to call such people a “Journeyman”. With time and as more theoretical knowledge had to be learned we moved from the “artisan and journeyman” model we had “apprentices” and “teachers” for the theoretical knowledge and “Craft Masters” for the skills. In both cases the journeyman / apprentice was supposed to pay for their education by producing actuall work their master could sell and in so doing pay the teacher usualky through Guild contributions / thiething. However as the required theoretical knowledge to practical skill level increased to the point practical skills might not even be required “students” from the notion of studying derived from observation. Students were expected to pay their tutors and teachers, thus for several centuries theoretical knowledge was held within the provinence of Churches, Guilds and Universities in effect captured and held by the landed wealthy and some skillful artisans. Thus ther was a political powercsystem in place which remained in effect as artisans started to transition to scientists and engineers. Where work was nolonger carried out to time evolved “patterns” that were information / recipes held as Guild or Trade Secrets but to the rigours of mathmatics and the meritocracy it and the laws of natural philosophy brought forth, from the use of what we call “the scientific method” of “true enquiry” not “conjecture”.

For some reason the tutor / teacher model which is considered fine for schooling, was not considered fine for Universities and the Churches behind them. In effect they were considered almost as “work places” thus the journeyman or apprentice model was considered more appropriate. As a result we have a three tier system of the taught degree, the research doctorate and between them the masters degree which is where the product of the taught degree is applied to the field of endevor to the point the person should have mastered the field of endevor to be either an practitioner/engineer or researcher/scientist. The research degree or doctorate did not as such become either popular or a requirment in Europe untill after the First World War, and even after WWII it was possible to enter acadenia and become tenured without having a Doctorate. There are even now places in Europe where the title “Doctor” is by position/post not qualification with in some places an actuall Doctorate issued much as some Masters were by working in the field of endevor for a minimum period of time. I have a friend who went to a well known English University who jokes about his “Five pound Masters diploma”.

Interestingly is what has happened to the “Guilds” these are now our trade institutions who can and do award professional rather than academic certifications. These still very much have the notion of “time served” built into their award structures, thus no matter how cleaver you have to have been a “practicing/full member” for a number of years or “over a certain age”. Unfortunatly such institutions for reasons of power and prestige are trying to become “Profesional Institutions recognised under law” that is you have to be not just a registered member kow-towing to the regime, you have to in effect beg their indulgance for a licence to be able to practice what is at the end of the day your trade by which you earn your living. It is in effect a “protection racket” where in effect the unacountable hand down commandments and edicts like tablets of stone by devine right. Which at the end of the day is just another “King Game” enforced by authoritarian followers onto the masses under some illusion of “quality standard regulation” to form a “closed shop” cartel or Monopoly primarily designed to enrich those “inside the club” at the expense of those outside by creating an artificial scarcity.

This “closed shop” racket also moved into academia ably assisted by others in the “King Game” thus “tenured position” is actually an “insiders club” which can also be a sinecure as originally intended if the insider wishes it to be so. Which is where the idea of getting those further through their taught degree to actually teach those at an earlier stage. Often such tutoring was done mearly for academic standing which is yet another “insider club” however in the current world it is also payed a pittance via the University administration or bursary. Some current Universities have realised that they can do away with the sinecure positions and their trappings and replace tenured proffessors with pittence paid tutors and research grant finding academics who are in effect “fee arrangers” for PhD contenders. They do the research, again for a pitance, and if they keep their noses clean and cead any entitlement to what they might discover they might eventually be awarded a PhD. Whithout which of course they can not hope to cross over from being an outsider to an insider. The reality is this in no way benifits original research, just the pockets of a small self elected clique.

But this clique is seen by others to be of no benifit, thus should be starved out… Because the new game in town is the “Hedge Fund University”. That is some see well known Universities as “cash rich investment instruments”. That cash is the students tuition fees and bequests and the like.

Thus the trade is big bucks fees for second rate tuition at best, for a prestigious name on your degree certificate. And with luck you will make an entry into certain circles that become “old boy networks” that you can use to “network” your way up the greasy pole for the rest of your life…

Such are the ways of “insider club” protection rackets that are just a variation on the King Game. Which is all many Universities in various nations have become.