Schneier on Security

Clive Robinson • December 21, 2020 9:35 AM

@ #1 Schneier Fan,

Using RAM clocked at WiFi frequencies as very very local air gap crossing techbology from Ben Gurian Uni.

I’ve already commented on it over on the Squid page,

https://www.schneier.com/blog/archives/2020/12/friday-squid-blogging-christmas-squid-memories.html/#comment-361015

It’s not actually anything new discovery wise, infact it’s about as old as it gets. It uses the RAM busses on the motherboard for Carrier Wave (CW) transmission at a ~2.4GHz signal. In a way not much different from a “spark gap cenerator” used to send “Morse code” back before the Titanic took it’s Swan Song on it’s maiden voyage…

Due to a number of issues it’s average realisable signal range is going to be less than three or four meters (9-13ft) in a near ideal arangment. With a fairly significant inverse relationship between data rate and range.

Anyway best place to talk about it is over on the Squid thread fo now.

Clive Robinson • December 22, 2020 6:48 AM

@ David Rudling, xcv,

… most AES protected communications once decrypted end up immediately on a computer which is comparatively easily hacked so why bother to reach above the low hanging fruit?

AES implementations have been and in many cases still are fairly easily cracked when in use. It’s why you have to be careful when you say,

AES is still approved by the DOD for material up to Top secret so an indication of imminent success by any major player will be much headless chicken running around

The NSA has certified the “AES algorithm” for material upto Secret for “data at rest”.

Which in reality means AES is not certified “in use”, thus extra precautions for EmSec have to be taken to ensure that leakage of data, key, or functional state do not leak via timing, power, and other unspecified “side channels”.

So before anyone gets into a dust up can we atleast agree what we are arguing about,

1, Breaks against the Algorithm.
2, Breaks against implementations.

As I’ve indicated in the past I believe that the NSA set NIST up with the AES competition rules. That is they very knowingly excluded any side channel considerations from the competition, and insisted on having “made for best speed” implementations available for anyone to download. Knowing full well that,

1, Everyone would copy the code.
2, That “best speed” implementations suffer from the “Security-v-Efficiency” problem.

Thus would more than likely when “in use” would haemorrhage data, key, or functional state, due to the use of “loop unroling”, “branch timing”, etc, etc. Which is exactly what happened. Now two decades later you can still find very flakey implementations of AES that leak sufficient information for compromise in new products.

This is made worse by the way some people use the AES algorithm, by either inappropriate “mode usage” or home made modes or algorithms for the likes of “key generation” from user input. That is the designers of such systems are fully payed up members of the “Magic Pixie Dust” sprinklers club.

Key Dervivation from “master secrets” is hard at the best of times. Protecting the “master secret” under human agency is even harder if not impossible once access to the storage device is obtained.

Thus one way of breaking an entire crypto system is to get the “master key”. So knowing how the system keys are derived and how human memory is fairly usless at storing high entropy information… it’s not difficult to realise where a successful attack against an AES protected system could be fruitfully applied.

Clive Robinson • January 21, 2021 3:02 AM

@ Rachel,

Can Moxie Marlinkspike be trusted?

Wrong question… Try,

“Why should Moxie be trusted?”

To which the answer, in a security setting, is effectively “NO”.

This is not an assessment of “Moxie” in human terms, but of “any entity in a security system”.

The same applies from the LED on the front panel of a box[1] or even “apparently passive” components[2] upwards, and that includes the box it’s self[4].

So you quickly realise components / entities in a system are not secure, it’s how they work together to mitigate their inherent insecurities that makes a system secure. To do this requires knowledge, thoughtfulness, insight and above all enforcable control.

So the next question you should ask is,

“If an entity can betray you, how do you prevent or mitigate the betrayal?”

And the answer to that boils down to,

“What is the root of trust?”

Where “trust” is in “security terms” not “human terms”.

And in the case of “Signal”, it’s “developers”, and the “business model” you have no input, no control, and other people such as US legislators and judiciary have it all. So the penultimate question is,

“What effective control do you have on US Government entities?”

To which the sensible answer even for a President is “none”.

Oh and the ultimate question is,

“What can I do about it?”

And that opens a whole new discussion…

But at the end of the day, when people are involved as Benjamin Franklin noted,

“Three can keep a secret, if two of them are dead.”

The point most miss about that quote is “the three” are what we now call,

Alice, Bob and Eve…

And though Alice and Bob may come and go with time, there is always an Eve hanging around, watching, listening, noting, and nodding hiding behind lace curtains with a glass up against the wall or the more modern technological equivalents.

Does knowing this make people feel any better? Nope, will they take heed of it? In general nope, the very opposite in fact.

The reason is few see reality for what it is, thus they take comfort in the cognative bias or illusion of thinking it gives them control thus power. So “Snake Oil Sells” and as I’ve repeatedly noted,

“None of the current secure message apps are even close to being secure.”

And that’s not just on commodity hardware, using commodity OS’s. They are fundementaly flawed by design.

[1] Yes the LED on the front panel of a box can betray you, because somebody wants to minimise components or physical size or a whole bunch of other design time issues. In short they want to show some system functional state to the user/operator, thus they put an LED on the signal line via a current limit resistor, job done. Only that LED has a very fast response time and the resistor does not store energy so does not integrate, or “low pass filter” the signal thus the LED transmits optically everything going on on that signal line… Not good ever, but realy bad as it was with a NATO level signal encryptor where it was in effect connected to the output of the KeyStream generator…

[2] When you get taught electronics, as in physics you get taught a series of more accurate lies as you progress. We call them things like “first approximations” but the reality is they are simplifications to some ideal where the principle or mathmatics is easy to get over to the student so they can learn something usefull in a bite sized lump and move forward[3]. So passive components like Resistors, Capacitors, and Inductors get taught as being “ideal” so you learn how capacitors and inductors store energy by the movment of charge and how they are “lossless”. Which unfortunalely is not true, inductors are a coil of wire, often around some feromagnetic or similar core and it you put a pulse of energy in them that coil being in a magnetic field will behave like a tiny tiny motor and will move. We call it magnetostriction, which means in short it mechanically vibrates in relation to the charge moving through the coil, and it thus also acts as a very small speaker, thus radiates out sound waves… Thus the operation of the circuit is radiated out acousticaly, oh and as an EM field as well, as coils are also antennas of a form[4].

[3] This is the “Grab a bull by the horns” teaching method. Or to put it another way if I toss a pound of beef mince at you gently, you can fairly easily learn how to make burgers out of it… But if I instead chuck you in the bull ring with an angry, frightened, thus enraged bull learning how to make a burger well is going to be a tads harder.

[4] What is an antenna? Well in all honesty they can be anything including a stack of plastic disks of differing dielectrics. What they do simplisticaly is take a movment of charge and turn it into an EM signal that radiates away. Supprisingly to many you do not need a conductor to move charge as the belt on a “van de graaff generator” rather graphically shows. The traditional notion of an antenna is a length of wire but due to what is half jokingly called “The law of inverses or mirrors” if you cut a slot in a sheet of metal it to will act as an antenna. Thus all the joints at box edges, all the ventilation and other holes for displays, indicators, switches, cables etc can act as antennas. Oh and as the size of the hole goes down the bandwidth it has goes up… So not exactly intiative, or something you want when you are trying to keep things “inside the box”.

Clive Robinson • January 22, 2021 6:42 PM

@ Rachel,

I am unclear about whats appears to me as a couple of leaps

I think you are refering to this,

“And in the case of “Signal”, it’s “developers”, and the “business model” you have no input, no control, and other people such as US legislators and judiciary have it all.”

As far as Moxie and friends are concerned, they want to eat have a roof over their head as well as a place to work and pay for the server(s) Signal uses. Thus they have to have some kind of business model to do the above even if it’s only “pass the hat around” at the bar on a Friday night.

All of which is done or run from the US, which means US legislators and Law Enforcment have a degree of control you and I will never have over Moxie, Signal and it’s effective employees. Being stuck in jail in Special Administrative Measures in full incommunicado because the head of the US DoJ (AG) decides that’s what is going to happen to you is a fairly powerful incentive to do what the AG asks. After all can you see Moxie or any of the others taking an extended out of the country sojourn like Ed Snowden or face the treatment Julian Assange went through. Then there was Lavabit and it’s owner Ladar Levison if you remember back to 2013 (though they appear to be back in business with a much more P2P with E2EE system so there is less of a target in the middle).

With regards,

How many of my dinner dates, colleagues, clients, students, is going to use a one time pad with me?

Oh somewhere between zero and none I should think unless they are crypto geeks. But then that’s just the start of the issues involved with ensuring end point security. In turn thats befor the very thorny subject of KeyMan in all it’s many and messy parts.

Some of the reasons I tend to talk about OTP’s is,

1, They require no technology.
2, The security model is easy to understand, or quickly explainable including the proof.
3, Conceptually they are easy to see how the proof of security transfers across into other activities such as reliable authentication to the 2nd party whilst being deniable to third parties.
4, It’s also easy to see how they can be used for making secure covert channels in plaintext thus having deniability to third parties.

Would I use them in “real life” I guess only if I had to, or I could use them instead of PKcerts to transfer a crypto key and IV securely so a Crypto Secure Key Stream Generator (CS-PRNG / CS-SKSG) could be primed/seeded etc.

For “usability” what we realy need is a “token” that uses a secure smart card to make life easier both in design and adaptability. However I’ve talked about the issues with tokens since the mid 1990’s some years after being the idiot who suggested the idea not just of using SMS messaging as a usable side channel but how to get around some of the “SMS is a secondary service” issues… Not as they say “One of my finer moments”, though it seemed a good idea at the time.