Schneier on Security

Clive Robinson • October 14, 2019 4:29 PM

@ TimH,

Perhaps the trick is to make the plaintext of a secret document not look like plain text.

This is an old problem and you can read more in the history of “Super Encipherment”.

The real problem is that to recover the plaintext in the pressence of noise means that you have to have some kind of structure to either the plaintext, or the resulting obfiscating first cipher text.

To see why you have to with block ciphers either have a rediculously and impractical block size, or reduce the block size to the point it is the same as the alphabet charecter size. To avoid ECB issues of simple substitution you need to add some kind of mode that often involves chaining which encorages error propergation. If you use a stream cipher then whilst you protect against error propergation you face synchronization issues due to drop outs. Generally what ever you do you have to have some kind of error error protection / correction added to either the first obsficating ciphertext or the second super encipherment cipher text.

In the past the use of a chaining or synchronised obsficating cipher has been used and this has then been super enciphered with a fixed short block size One Time Pad (see UK Diplomatic Wireless Service “Rockex” super encipherment machine).

Unless you have a very loe noise very low drop out communications link Super Encipherment gives rise to an increased “resend” of traffic issue, which introduces a whole load of other problems as well.

Clive Robinson • October 14, 2019 5:01 PM

@ MarkH,

It’s an approach which might yield practical results before large fully-entangled systems with coherence times on the order of 1000 seconds. I’m skeptical whether the latter will ever be achieved.

History shows us that applying a “binary chop” to a problem significantly reduces the difficulty, thus our ability to solve larger problems. So if possible in some way it would be the sensible way to progress.

As for the “coherance” issue, the paper refering it to noise is actually a sensible way to assess it. Because “noise” appears to be as fundemental to the physical universe as the speed of light, and a direct consequence of it’s formation. Further the current belief in science is that the universe is not analog in nature, that is at a fundemental level the universe is in fact discreetly quantitized, with some believing that those fundemental components actually “vibrating” thus generating noise from the fundemental lack of coherance.

When we look at what is practical, with current microwave cryogenically cooled systems, there is still very much a noise floor that we can not get below. You will find that it is above the 4KTBR level –often quoted as -174dBm in a 1Hz bandwidth– by a couple of dB. Modern receivers only have a linear dynamic range of a little over 100dB. You can take the noise level down by either reducing the bandwidth or by putting 2^N receivers in parrallel. The former is not realy practical in fixed time processing, the latter only reduces the noise by 6dbV for each increase in N, which is likewise quickly not practical especially at high bandwidths or high frequencies (due to speed of light issues).

Now if you work out the equivalent noise voltage for 20 million Qubits it’s very easily going to exceed the 100dB dynamic range by a very long way, as well as having equivalent voltages that would destroy any Qbit we can currently design, or are ever likely to.

Thus the “divide and conquer” route of the “binary chop” may actually be the only way QC will be of any real use as a processing speed up…

Clive Robinson • October 14, 2019 9:17 PM

@ Rodney Van Meter,

but it’s apparently not possible to edit posts

The software alows it, but as this site alows anyone to use what ever handle they please (appart from Admin accounts) that means an “edit function” after posting would in effect alow anyone to edit someone elses post. Which would be undesirable.

However if you are ready to post but want to see how your post would be displayed hit the “preview button” and the site will refresh the page, in reverse time order with your post at the top followed by the entry window, followed by everyone elsed posted comments. You can obviously edit then refresh with the “Preview” button as often as you want, when done hit the “submit” button. This will then post it and in effect lock it.

Clive Robinson • October 15, 2019 8:21 PM

@ Bruce and others,

… so it’s possible that public-key cryptography will simply not be possible in the long run. That’s not terrible…

Hmmm… I’m not certain on that, it kind of depends on not just your point of view but in which direction you are looking…

There are three directions that are relevant “Past, Present, and Future”. I would suggest from your slightly optimistic prognosis it is because you are looking into the “future”, which leaves the issues of “past” and “present”.

The old saying of “What is past is past”, nolonger applies with the SigInt Agencies “Collect it all” policies it now has the rider of “and live with the future consequences” attached. This is especially relevant with the recent news about the FBI getting hundreds of thousands of search records from the so called “702 Databases” the NSA and others put together in a very unconstitutional way.

The FBI are obviously in the “no stone left unturned” mode for “easy pickings” where people have been incautious in what they did about protecting their communications. We have seen similar in the past where the FBI have taken over or gained illegal access to websites or gateway sites and used them to harvest user data prior to going after the users[1].

Appart from becoming a citizen of another country without extradition links to the US and never returning to the US nor ever going to countries that have extradition arrangments with the US I can not honestly say that even quite minor misdemeanors are not going to come back and haunt people in some way. In theory the statute of limitations should apply, as would other limitations for those that were minors at the time. But recent FBI cases have shown that they will find some way of punishing people. The problem being that once the FBI start, as they run on public money they see no reason not to keep doubling down untill they have a conviction for something or anything just to prove they were right to those that hold their purse strings[2]. Often their game plan appears to be by bankrupting their chosen victim in the process thus stripping them of their rights to a defence. Thus it appears that the FBI and DoJ are not about justice in anything other than the “show trial” manner “of might is right” and only back off when their victim has greater resources and every intention of using them publically in what becomes in effect a game of high stakes poker (Apple v FBI/DoJ).

However the FBI does have limited manpower resources, and whilst politicians talk a good game on being tough on crime, generally that does not translate into money for more manpower, which some politicians regard as a funding black hole and as big if not bigger political hobby horse than crime.

Thus I suspect quite a few very minor indiscretions will not get prosecuted, simply because it’s going to be a “target rich environment”. But not prosecuted does not mean unpunished…

But what of the current “here and now”, and how to protect yourself from future attentions of the likes of the FBI. Whilst many Public Key algorithms are very susceptable to Shor’s Algorithm it’s likely that many symetric key crypto systems will not be greatly effected by Quantum Computing unless some mathmatician or engineer comes up with a new wriggle on Grover’s algorithm. But what does “not be greatly effected” mean at the nuts and bolts level, Grover’s algorithm does mean quite a significan speed up of attacks against symmetric ciphers. But that can be offset by doubling the key size in certain ways thus effectively countering the speed up Grover’s algorithm gives whilst only increasing the encryption algorithm work factor linearly. Thus post-quantum symmetric cryptography may well not need to differ significantly from current symmetric cryptography except in the issues to do with key managment (KeyMan).

There are three basic ways of making key lengths increase

1, Design a new algorithm.
2, Modify an existing algorithm.
3, Chain existing algorithms.

AES is regarded as “128bit” however the original AES competition entry could work with 256bits. Block ciphers designed around Fiestel rounds, can have the round numbers increased without change to the individual round structure, but require the key expansion process that makes the individual keys from the master key to be modified appropriately. To get around the issue of modifying round key generation the notion of chaining ciphers together using different keys natutally arose. However it does have issurs which is why we have 3DES made from the 1970’s DES algorithm rather than the simple idea of 2DES.

Importantly the ciphers you chain together do not need to be the same. They only require thst the ciphertext block size passed along the chain remains the same size. Which alows for different algorithms to be used not just as a serial chain which is a 1D vertical structure, but in a parallel 1D horizontal structure or both to give a 2D structure and obviously in higher dimensions as well. The idea of 2D combinations has actually been seen in cipher designs where the Fiestel rounds divide the data horizontally not just into two but four or more parts.

Thus one thing people can do to increase their security is to chain ciphers.

However as I’ve noted for several years symetric ciphers based on similar constructs can be fragile and lead to knew attack methods (see the history of FEAL and Differential Cryptanalysis). Thus I peresonaly would use ciphers that had fundementaly different base functions and structures as it reduces the likelyhood that an advance in cryptography is going to have a significant impact on both cipher algorithms. You could further use multiple cipher algorithms in multiple structures, thus alowing which structure and which algorithm in which position become part of the “Key Material (KeyMat).

However people need to remember is that all you are building by chaining ciphers what ever the structure is a block cipher with a bigger key space. That is all the failings of a block cipher still remain thus you still would not want to use it in ECB mode but one of the other standardized modes for block ciphers (or other cipher types, see Ross J Andersons work on Bear and other algorithms).

Which brings up the question of synchronisation. Cipher modes have issues when the encryption and decryption get out of step, thus you need to take precautions to prevent this or ensure that any effects are not propagated far or indefinitely, thus requiring a restart or resend which brings up all sorts of issues and attack vectors as well as leaking information.

The fact that synchronization has to be done opens up other possabilities. In the design of DES there is a “whitening” stage where the data is simply XORed with in the case of DES a fixed value. As you have to synchronize both ends there is no reason why the whitening value should be fixed. That is in effect you “stream cipher” not on a bit or charecter size but on a block size (it’s also in effect what some of the block cipher modes do). You can further this idea by not having a “fixed key” for the block cipher but an “evolving/changing key” for the rounds in the block cipher.

What you do and how, again becomes part of the KeyMat. Thus simply by increasing your KeyMat size and complexity of the resulting cipher, you lift yourself above other users. Thus they become the low hanging fruit for the likes of the FBI to chose in prefrence to you unless you give them reason to make you a “Person of Interest” (which is a more general OpSec issue).

Importantly though as long as each individual instance of a key use is unique, non determanistic and kept secret the symetric algorithms if chained sensibly will remain secure over the likely period of a human life or that of most companies/corporations.

The problem with this is how do you ensure KeyMat is unique, non determanistic and kept secret. This job falls under the little understood “Key Managment” (KeyMan) processs and it’s sub processess of,

1, Key Generation (KeyGen).
2, Key Distribution (KeyDist).
3, Key Destruction (KeyDest).
4, Key Storage.
5, Key Audit.

Because each of these are actually a very hard process to get right in of themselves even when all the pieces are in place, they are a subject not much talked about for systems not involving in any way the now assumed to be vulnerable Asymmetric / Public Key systems.

The primary problem is working out how to transfere an initial secret between two parties that whish to communicate. It needs some kind of “secure channel” but to get one of these you need to transfere a secret… Which is “Turtles all the way down” if you only have a monitored communications channel available, which is generally the default case these days.

Thus you need another or side channel other than the monitored communications channel. Obviously this side channel has to be one that can be secured in some way. In the past this was done by person to person contact where a code book or cipher schedual would be transfered on easily destroyed and not easy to copy paper etc.

The problems with this can often be seen when people talk about “One Time Pad” (OTP) systems. Unfortunately what these discussions rarely make clear is that the only difference between OTP KeyMan and Symmetric Cipher KeyMan is the physical quantity of KeyMat involved.

It’s why Asymmetric / PubKey systems for all their problems with multiple CA’s and hierarchy security issues were lept on. Brcause they fundementally made E-Commerce and “no contact” secret communications over a monitored communications channel possible.

Making oneself secure currently means loosing the “no contact” element of PubKey systems. Thus anything you need to do privately requires a secure side channel, for the initial secret transfer. Which due to the “Collect it all” policy of the SigInt agencies can not be done by electronic communications, or for that matter any method assisted by electronic communications. Which rules out getting on a plane or many forms of modern transport including your private car. Likewise you can not use a courier service like DHL, TNT, etc or any other service that involves some form “tracking”.

Whilst the details are unclear it appears that even postal services are now recording the destination details of letters and parcels against the entry point in their systems to help them better optomize their service. These “third party records” have no legal protection and the length of time they are kept is unknown.

And in this age of “that will do nicely” where credit cards are seen as preferable to “cash” this makes more third party records we know get traded and kept effectively indefinately, thus making maintaining yourself on a journy longer than a quater of a day difficult unless carefully planed beforehand.

All of this kind of makes transfering secrets secretly more than a little difficult. Which is the sort of advantage the FBI and DoJ want over people[3] as do other Governments and their entities as it gives them power in various ways, most of which are considered illegal if you or I were to do the same to others. We might make complaint about what the Government of China is doing on the way of overt surveillance, yet we don’t complain when Global Corporations willingly do the same and various Western “Five Eye” Government entities benifit covertly for free… So for our own safety we have to assume we are under significant surveillance all the time irrespective of where we are, and more importantly we have no control over the product of that surveillance or when it will be revealed if at all. Because the old adage of “What you don’t know, can’t harm you” now belongs to an era long long gone, if it ever realy existed, our futures can be decided by others. An obvious example is the “Oh so secret” “No Fly” lists, if you are not allowed to fly many advancments in occupation stop dead and whole career paths closed off to an individual.

Thus how an individual gets a secret secretly to another person is a much wider security issue. One that is actually less difficult for criminal and similar networks that have already got their own “trusted courier” networks in place and have done since before “collect it all” became inflicted on the average citizen.

But I do know of technological ways to do these things, but they require both parties to participate. Which means either they have to be given a secret secretly, or there has to be communications channels in common use that can not be monitored by others.

Tor was an idea to implement publicaly available communications channels that could not be monitored. Unfortunatly it was predicated on a couple of assumptions that are not true, and were not true when originally thought up. Also due to the fact it needs PubKey systems to work it is not going to work for people now either, it just delays the inevitable disclosure. That is it will in no way be “Post Quantum Computing Secure” and as “collect it all” actually focuses on such traffic and it’s preservation, it will almost certainly be amongst the first communications looked at and stored in a “702 Database” or equivalent. Thus in turn be looked at by the likes of the FBI and similar entities in all Governments who can get their hands on either QC or the results of using QC on recorded Tor traffic.

Thus we realy need Post Quantum Computing Secure algorithms in place NOW. Not just to replace symmetric crypto algorithms but asymmetric / Public Key algorithms that give us the “no contact” ability to secretly transfer secrets that enable us to have the privacy society as we know it needs to have to survive.

We have seen what we will get without them, in those old East European nations and current tyrannies and police states that are proliferating and getting closer not just step by step but by the leaps and bounds of “Surveillance Capitalism”.

[1] I’m very definitely not using the term “illegal” here for the users of the systems, just for the FBI oparatives and those they have coerced. Because in the case of many sites for the likes of “Gambling” they are quite legal where they are located –ie not on US jurisdiction– and for by far the majority of the worlds population quite legal –if ill advised– to use. Thus the FBI are gaining unauthorised thus illegal entry into these systems in Sovereign Nations where neither the US judicial system or US Gov entities have jurisdiction. Further under the DOJ and FBI justifications of locality the FBI are breaking the laws of that Sovereign Nation. Thus if taken to court in those countries they would become criminals and subject to the the tarifs the judiciary of that Sovereign Nation choses to impose.

[2] It’s hard to work out which is actually worse show trial seeking FBI/DoJ or hard on crime politicians on approproations committies. One thing is certain though, one heck of a lot of money is involved and it’s hard to work out from which pocket to which pocket it goes or why. None of which gives any confidence in the “justice process” being equitable or for all.

[3] Importantly the one thing people must get out of their heads is that there is anything wrong with,

Doing secret things secretly.

It is after all a good definition of what our “private lives” are, that is “doing private things privately”. Like technology, secrecy is agnostic to use and without it society as we know it can not nor will not survive. Every one has secrets even if it’s the fact they fart when getting up in the morning and their pet dog gives them a sideways look. If you think it has the potential to embarrass you or some how diminish you in the minds of others then it’s something you wish to keep private thus unknown to others which means you are keeping secrets, not doing anything wrong.

Clive Robinson • October 18, 2019 10:31 AM

@ SpaceLifeForm,

Human networking.

All the rage for Serious Organised Crime, Drug Lords, Terrorists, CIA and a few others such as those who are just plain cautious these days.

No by,

But I do know of technological ways to do these things, but they require both parties to participate.

I was thinking on a work still in progress have a search on this site for “Fleet Broadcast”

Doing anonymity from observers as well as privacy in message contents and message transmission/reception is fairly easy…

However it’s coming up with the initial anonymous “Rendezvous Protocol” without a nexus or root of trust that is causing me problems still…