Schneier on Security

Clive Robinson • September 4, 2020 7:25 PM

@ vas pup,

OMG

Not realy, single chip microcontrolers can be had for as little as three cents… Yup over thirty to the dollar depending on which way the wind is blowing in the Fed, and rumour has it there is a lot of wind there “and it ain’t all hot air no suree feller no suree” 😉

Thus the power of a single chip microcontroler these days has very little to do with the silicon real estate but the chip price and the software development price. The chances are simple as the software actually needs to be it was probably written in a high level language not assembler and was probably “knocked out” in an afternoon as a prototype with a very high chance of working first time.

But we have to remember not all people have either good colour vision or good vision at all. We’ve seen issues with COVID-19 antibody tests where people can not clearly read the results on the test strip even with vision that alows them to drive on the roads.

But look on it another way, that strip of paper that detects the human chorionic gonadotropin hormone, which is produced during pregnancy is better than an older way… Which was to innoculate a female rabbit with an extract from the woman then after a predetermined time kill the rabbit and examin it’s overies for certain tell-tale signs…

Clive Robinson • September 5, 2020 6:02 AM

@ echo,

I am seriously done with you.

That is your choice to make, not mine.

However we have been here before and you are still making baseless accusations on your unwarranted assumptions. I do not know you other than as a near anonymous handle that makes comments on this blog. Even though I do use my name I can only assume you do not actually know me, what I do, nor how I do it. This is in part because I’ve the good sense not to talk about it for various good and propper reasons.

As for you throwing around terms like “gaslighting” and “mansplaining” I realy suggest you look up their origins and actual meaning. Just throwing them at people without actual cause is not just upleasent for the undeserving recipient it’s actually extreamly prejudicial in the eyes of others.

Which is why it also happens to be a disruptive tactic used more and more people and organisations to try and discredit those they have taken exception to on the basic principle of “throw enough mud…”.

From what you’ve repeatedly said on this blog recently under your “echo” handle, you appear from what you say to be having some problems with obtaining a UK passport. But you’ve said nothing other than blaim those who work for or act on behalf of the UK Government in very general terms. Thus unsuprisingly nobody has said anything of consequence, because nomater what their expertise you have effectively said nothing other than your generalized dislike for those who work for or on behalf of the UK Government.

I’ve actually made no comment on this, as I’ve likewise made little or no comment on other things you’ve said, even when directly accused by you. Thus what I think or do not think about what you’ve said is not known to anybody other than myself and I shall continue to keep it that way. However common sense should tell you that to accuse me or anyone else who has made no comment of “mansplaing” is realy down to you and no one else, as is how you made your assumptions on which you’ve made the unwarranted accusations you’ve bandied around.

Likewise you’ve also made generalised assumptions about others who sometimes post to this blog, which I have commented on above.

As I’ve indicated you know very little or nothing about the circumstances of people who do post here and some have indicated they do come from places other than America, contrary to one of your generalisations. Likewise you are not the only person who is not male who posts here, nor are you the only person with issues.

In fact it would appear from what they have indicated, some commenters are from countries I would not go to due to the nature of their Governments. Even though some I have been to in the past and not as a tourist, thus have good and sufficient reason not to return to them, even if my health alowed me to travel. Also there are other countries I would have to obtain prior consent to travel to which I’m unlikely to get, even though the Governments of those countries might be more than happy to alow me in.

The fact that you appear to regard “soft issues” with a much higher priority than “technical issues” is your personal choice. This blog originated from a highly technical news letter and even though it has softened over the years some have expressed the view that they come here for “technical comment” which is their personal choice. How many others agree or disagree with their viewpoint or your viewpoint I’ve know idea, as they have not made their personal views apparent, which is obviously their choice to make.

You have indicated again that you are leaving this blog, if that is so it is your choice, and I as others have said, wish you well for your future.

Clive Robinson • September 5, 2020 4:56 PM

@ Curious, ALL,

… a local university over where I live in Europe having broken a quantum crypto setup at the time, because the setup supposedly wasn’t implemented properly as I remember it.

The first Quantum Key Distribution (QKD) system was back in 84 –yup 36 years ago– and used an optical work bench. Now refrenced as “BB84” the setup was developed by Charles Bennett and Gilles Brassard.

In theory the protocol is provably secure as it relies on the quantum properties of the no-cloning theorem. In effect a single photon can not be intercepted or measured by a third party without the first and second parties finding out. Thus the non intercepred photons are used to build a One Time Pad protocol which is also theoretically secure due to the “all messages are equiprobable” rrasoning.

However as the old warning has it,

Whilst in theory it’s secure, in practice it’s probably not.

QKD realy suffers badly from this issue and for about two decades a serious number of QKD implementations had serious “side channel issues”.

If I remember correctly it was Gilles Brassard that mentioned that during the original optical bench setup he did not need to measure the polarisation of the photon, because the polarizing device used in the transmitter made not just sufficient noise to be heard on the other side of the room it had a noise characteristic that indicated what polarisation phase it eas set to…

I’ve noted several areas where defects were not only expected but could be easily exploited.

For instance a polarizer is a bidirectional device that is it cares not which direction a photon travels through it, and they are inherently broadband frequency wise.

Thus any equipment / device on one side of the polarizer can be seen on the other, and if such a device gives a 180degree reflection then the state of the polarizer can be found by shining a narrow band “monochromatic” pulsed light source in and see what comes back thus find out what state the polarizer is in… As the entire security of the system rests on an attacker not knowing the state the polarisor was in the security was a compleat bust if an attacker could find out the TX polarizer state. Unsurprisingly a number of QKD systems had this problem. There were a whole bunch of other attacks which enumerated the equipment but left the individual photons alone.

But QKD had two distinct issues,

1, The QKD fiber range was extreamly limited.
2, The QKD signal checking process ment you could not “switch” the QKD signal onto any other network.

Thus all QKD systems were of limited range and had to be setup as a “one-to-one” system… Both of these limitations were effectively deal breakers for most people… The other thing is “QKD” is effectively “A solution looking for a problem to fix” and a very expensive one as well.

Whilst some of the issues have been sort-of-fixed others have not. Which is a very big question mark to hang over QKD. Hence a lot of people in ICTsec have tended to view QKD technology as something to avoid being at the “bleeding edge” for.

Clive Robinson • September 6, 2020 4:02 AM

@ name.withheld…,

My work in control systems has lead me to much that is problematic in the space and it is easy to understand why we are where we are…cus we suck at forward thinking

In evolutionary terms untill fairly recently our forward thinking only had to go as far as the next meal or night up a tree etc. And guess what as we got just that little bit more “tool making” and started cooking our food we lost a lot… One eminent scientist in that area made the comment that we had not lost our fourth stomach we had simply swapped it for a cooking pot. But in the process what we did lose was the ability to generate a whole plethora of digestive enzimes. So it’s a choice we can not go back on…

Which if you think about it is a very very major security concern of existential dimensions.

And most of human evolution can be seen that way, that is we as a species make irreversible trades for “quick result short term gains” that we can not go back on. We see this behaviour refined to a point of idiocy in the managment of many corporate ventures these days.

The reason it’s seen in corporate ventures so vividly is currently assumed to be because of the need for “status” protected by “power” or it’s abstraction “money” in the hands of those with sociopathic and narcissistic personality disorders.

Apparently only a few in the general population have these disorders to any great extent, various tests over the past few years has suggested however they are significantly present in corporate executives. But a caution should be sounded at this point “correlation is not necessarily an indicator of causation”.

These disorders are probably more likely to be “spectrum disorders” that is we all have them to a certain extent. Simply because they do offer not just short term but individual evolutionary benifit over and above that of species benifit. This is not just via “breeding privilege” but also by an increased likelyhood of offspring survivability (which might explain “Politicians Wife” syndrome that is it’s not the individual who is lets face it often repelant by most objective standards, but the environment local to them which causes the wife to “stand by them”).

If they are “spectrum disorders” then we would expect to see traces of them in all human endevors even the “creative endevors” which includes all of the art, artisanal, engineering and science endevors. Which might be why some people want to “leave their mark on history” by making Empires and their trappings (Ozymandias Syndrome[1]).

In the case of corporates the Empires are traditionaly seen through departmental head count, budjet and placement in the corporate edifice or HQ building. All of which has survived the technology explosion that started post WWII, that many pundits had said would make such edifices and head counts irrelevant as the world “virtualised”.

However one little bug, that is not even DNA has caused the virtualization of many corporates almost in the blink of an eye, and it’s something for which they were totaly unprepared, even though red flags have been waving for decades.

Interestingly from this enforced virtualization it’s been found that the “high status jobs” are the easiest to switch to “home working”. Where the status and influance are quite minimal, as some have already experienced,

https://www.theatlantic.com/magazine/archive/2020/10/career-costs-working-from-home/615472/

It will be interesting to see what will happen as the COVID-19 pandemic recedes. That is will the desire for the trapings of status drive us back to unhealthy life styles with unhealthy commutes and unhealthy office environments high stress and rampant disease seasonal and otherwise, or to remain in a “homeworking environment” where neither the commuting or office edifice are needed or required and thus will be a clear candidate for “cost cutting”…

Whilst this might at first appear academic, it is very far from the truth. Take Briggs-Meyers testing many of us have been categorized by it and we get placed in one or two of sixteen little boxes half of which are for extraverts the other half for introverts. What we know is the more extrovert you are the less capable you are to handle “homeworking”. That is the extroverts need the interaction of the crowd, of peers, where they can find a niche of status. Whilst introverts can function in “officeworking” they find it unnecessarily stressful and take to homeworking quite readily…

But work at thr end of the day can be broken into three basic types,

1, Creation work
2, Administration work
3, Makework

Creation is a form of refining and is what the “value added” process is all about that is the taking of raw input goods, processing them to add utility and deliver it as refined input goods to a customer who pays for the added value because it increases to them the utility of the goods.

The processes form both a value added chain as well as a supply chain and like all processes they require feedback and control which is what administration is all about at the end of the day. That is administration is managment of processes.

As noted “status” is measured in various ways one of which is “head count” thus the more people you manage the greater your status. Unfortunatly this is a positive feed forward process and is thus entirely unstable unless subject to quite forcefull constraint via negative feedback. The result though is usually that head count creeps up at any opportunity by a ratchet processes, one of which is “peek demand staffing”. Thus if you take on staff to meet peek demand what do you do with them at non peek times. Well this is where makework arises once aptly described by

“We trained hard, but it seemed that every time we were beginning to form up into teams, we would be reorganized. I was to learn later in life that we tend to meet any new situation by reorganizing; and a wonderful method it can be for creating the illusion of progress while producing confusion, inefficiency, and demoralization.”

(often attributed to Roman arbiter and satarist Gaius Petronius).

In essence makework alows a senior administrator to gain status by head count and keep those excesses hidden from others. Interestingly makework like peek demand is a headcount ratchet, which is why some estimate that around one third of the working population is performing makework.

Almost entirely makework is hidden away in administration work, though it can also be disguised as low grade creative work in non-core activities. One danger of makework is that it can become both embedded by accident and grow organically. That is you create a process the output of which is irrelevant other than it sounds plausable, one such is the collecting and collating of data on the excuse the data will be used to save costs. It ticks several senior managment boxes thus the process happens. Then some idiot often with their own makework scheme starts using the collated data and thus the first makework becomes a requirment –thus embedded– of the second makework and so it grows like weeds in a vegetable patch but harder to “weed out”…

Thus a switch from “office working” to “home working” will eradicte much of the current makework as well as the need for office space and the personnel required to maintain it. Also those who support offices such as those who provide transport for commuting food and similar for the office workers and so on. Which could be as much as two thirds of the current workforce, based on what happens in single industry towns when the industry shuts down.

But as I’ve pointed out the switch from officeworking to homeworking is not just a human security issue, it’s a much larger security issue of which information security is just a small part.

At the end of the day even virtual companies need “physical space” even if it’s the bottom rack in some cloud service providers data center. If you don’t own that physical space then you can not make it secure thus you are unnecessarily vulnerable to attacks you have absolutly no control over as current online criminal enterprises and their customers have found.

Thus I suspect that whilst offices may remaine empty for a while, security concerns, alied with extroverts need for crowd/peer interaction for status, and the need for makework that implies, will cause offices and corporate HQ edifices and the empires they contain to come back.

However what happens in the meantime might be a major financial colapse. Those buildings are usually rented or mortgaged to the hilt for “fiscal efficiency” or the “don’t leave money on the table mantra” thus when you trace it back “the paper” is owned by the banks and has produced a significant petcentage of their stable income thus base liquidity.

Empty offices don’t pay thus that base income will go if homeworking takes hold for even a year. But banks other base liquidity comes from depositors mainly peoples pay cheques, if between 30_60% of workers do not have jobs then not only will they not be depositing they won’t be making rent or mortgage payments nor will they be buying even essentials like food. Which means shops and their employees get hit financially and so it goes on hence can build into a major recession that could be decades in effect…

Thus the “short term thinking” and the unsustainable financial bubble growth it’s caused could see the death of many of us and the very real possibility of the first world dropping down to third world standards fairly quickly. Which realy would be a security concern across the board…

[1] Ozymandias Syndrome has no official definition and some who use it as an expression have little or no idea as to it’s origins which is from “Ozumandian behaviour” that was first highlighted in two sonets written by different English poets in a friendly competition. Both are on the surface about a traveler who finds an immense pedestal to a long ago broken and abandoned statue in a desolate wilderness. However they are actually morals in verse to the futility of hubris, and turn around the words written on the pedestal. In the case of Percy Shelley’s sonet the words are,

“My name is Ozymandias, king of kings: Look on my works, ye Mighty, and despair!”

And in in Horace Smith’s,

“I am great OZYMANDIAS, The King of Kings; this mighty City shows the wonders of my hand.”

In either case it depicts the folly of trying to get immortality of fame through near pointless and ill conceived endevors, as you can not foretell the near let alone distant future,

https://en.m.wikipedia.org/wiki/Ozymandias

Back a half decade or so ago, this behaviour with respect to corporate endevors was pointed out by the Financial Times newspaper,

https://www.ft.com/content/c9687a70-7d79-11e5-98fb-5a6d4728f74e

(The “FT” or the “Pinkun” as the Financial Times was also called, appears to have suffered Ozymandias’s fate, and has gone from being “An estimed organ” of thrusting financial news to a mear “insipid rag” of placed corporate marketing blurb.)

Clive Robinson • September 9, 2020 5:54 AM

@ SpaceLifeForm,

So, a bad thing happens, yet no one reacts?

Actually if you look they did react their monkey/lizard brain tracked them all in on the noise. Then as with most people and the unexpected they froze whilst the monkey brain hands over to the conscious brain which just says “WTF!” and they stand there frozen to the spot not knowing if to fight or flee making perfect targets of them selves… (something snipers are trained to take advantage of).

By the time they started to unfreeze you can see the “drop in” was already out of the back of the car and on their feet…

Back when I was wearing the green I saw two parachute accidents. One was a “roman candle” where they “creamed in” at Headcorn “Lashenden” as was (Kent). The second I only saw a bit of was when an inexperienced parachutist dropped into the rota of a hovering helicopter just over 33years ago at Thruxton (Andover Hampshire). She was doing her first jump…

Which by the way was also the first of two helicopter crashes I’ve experienced close up. The second was seven and a half years ago where a helicopter flying at about 650ft smashed into a crane on a very tall building in Vaxhaul South London just up from the MI6 / SiS “Vauxhall Cross” building. Which I bloged about on this site, because it could have been a botched terrorist attack (Vauxhall Cross had been attacked by PIRA with an RPG a few years befor that).

Turns out it was a very experienced helicoptor pilot given incorrect information in very reduced near zero visability and the red lights on the crane had been switched off as it was not nighttime…

And that’s just some of the things I’ve experienced “at home” or close to, and my Dr tells me I need to get out more…

Clive Robinson • September 9, 2020 11:01 PM

@ SpaceLifeForm,

When the Signal is the Noise.

Mat Blaze is telling two stories hear and you need to understand the difference.

The first story is a “cryptanalysis” story in that there were “no nines” in the Numbers Station output.

The second is a “traffic analysis” story in that people were caught because their secure signals had a unique transmission fingerprint.

And whilst the stories happen to be linked you need to keep them separately in your mind.

So on with the first story… By tradition “Ontime NUMBER pads” use just the digits 0…9 or Base 10, also called “an alphabet set of size 10”. Likewise “Ontime ALPHA pads” use just the letters A…Z or Base 26 or “an alphabet set of size 26”.

However from a cryptanalytic security perspective there is no reason why the OTP should be Base 10 or Base 26. In fact Base 25 has been used in the past as has Base 36 (in both cases because they are squares).

From the messege security asspect the Base size is unimportant thus Binary Base 2, Octal Base 8, and Hexadecimal Base 16 would all work, and Base 2 is now in the Digital Age considered by many to be the standard which is why the Random Number Generator (RNG) is now often called a Random Bit Generator (RBG) by many people.

But from the message security asspect the only things that are important “in theory” is that what ever Base size you use that the statistics of the respective members of the alpabet set are flat and unpredictable. However in practice there is another requirment that it is unpredictable in the short term so you do not have long runs of any given member of the alphabet set alowing message text statistics to “leak through”[1].

So the fact that the Cuban station used Base 9 rather than Base 10 should not have effected the message security, and probably may not have done.

The reason being is that as long as the statistics of each member of the alphabet set are correct you can simply strike one or more of them out and the statistics of the others remain uneffected. This is a very usefull property in that if you have a Random Bit Generator (RBG) and you need to genetate a Onetime ALPHA Pad you simply take the output of the RBG five bits at a time to get Base 32 and simply throw away any number that is 26 or greater.

So it’s possible that even if the Base 9 of the Cuban transmission was due to faulty generation equipment the actual message security was uneffected.

But the use of Base 9 rather than Base 10 makes the use some what “unique” which brings us into the second “traffic analysis” story… Because the security of a system is dependent on all of it’s parts. The fact that the actual transmissions were “unique” was a dead give away.

So even though the messages may be unrecoverable that does not make the transmitted signals not usefull as a the unique fingerprint would have been almost instantly spotted. Thus the persons using it almost instantly identified by correlating their real world activities with their unique transmissions…

Whilst keeping the stories seperate might not be important for book narration, it is important to keep them seperate for “failure analysis” purposes.

[1] In fact the real alphabet size in most OTPs is “the five letter group” so a maximum of Base 100,000 for Number pads and likewise Base 11,881,376 for Alpha pads. It’s the statistics and “unpredictability” of these that need to be also considered when generating pads to be secure and stop message statistics leakage which is why the actual “five letter group” base size is less than the maximums.