Schneier on Security

Clive Robinson • September 27, 2021 8:07 AM

@ Bruce, ALL,

It’s not that surprising that there is tracability, thus forensics. Due to fundamental crypto-currency requirments, it’s effectively “built in”.

So the “obfuscate arms race” applies. The result as always will be that people will “move on” to other technologies as they become available, and the game start again.

The thing is, the advantage is not with the libertarians, but the governments.

The detection and tracing methods are going to improve, as are prevention methods. As China is indicating the whip hand is under the control of the “guard labour” and their masters. Likewise the US idea of “whitelisting” or more importantly “black listing” crypto-coins as they see as not meeting their approval.

But at the end of the day all crypto-currencies so far have the seeds of their own destruction built in.

So the question arises as to if these issues can be designed out, such that governments do not have the upper hand?

I guess we will have to wait and see but I’m not hopefull.

Clive Robinson • September 27, 2021 5:19 PM

@ Jesse Thompson,

Re – Monero and others.

Monero already has a checkered past, and is still effectively in “development”.

One of the “health warnings” all crypto algorithms should come with but usually don’t, is “time based side channels” in “practical implementations” leaking information to anyone who cares to look for it, sometimes at considerable distances (think of jitter on network packets still visable several routers down the line).

Whilst the Ring Signitutes may be “mathmatically secure” you realy should be asking “Are they practically secure?”. The answer is most likely “not at all”.

As I’ve indicated in the past, we have good reason to believe the NSA “backdoored” the NIST AES competition by hoodwinking NIST thus “finessing” the rules. The result was very fast but very insecure code was available to all to download without restriction. Even though a proof of concept attack against the AES implementation via cache based time side channels was found in short order, it did not change things. Because but by then “the code” that contained the side channel was in lots and lots of code libraries etc. If you know how to look you will find that there are still many AES using applications out there with time based side channels that can be exploited across a communications connection…

It’s why I advise the use of two computers at any user “end point”.

One is connected to the communications network and does no cryptography or handling of confidential information in plain text or other cipher text form (some File/disk encryption is shall we say not what it could be). I used to suggest the use of CD/DVD ROM based linux distributions that require no hard drive. However the use of “Flash ROM for Everything” in PC’s and the like this century kind of negates that advice, and the problem is getting worse with time (it’s why I use older microcontroler family based communications nodes I’ve designed and built myself).

The second computer is NEVER EVER connected to any communications and these days it’s advisable due to Flash ROM devices getting every where not to “share” any hardware between the computers lest the trick I came up with to attack “voting machines” is used not just via the likes of USB devices, but even power supplies you plug into the mains supply… It is on this computer you do your confidential / private work and encryption / decryption.

Whilst “air gapping” is the minimum you should consider if your privacy / finances are important, full on “energy gapping” would be prudent if you are using crypto-currency above a thousand dollars or so.

If you can, investigate and use “smart cards” or other external crypto devices to do certain “crypto functions” off of the second computer (think HSM). That way if the second computer is “physically accessed” you have some degree of protection as long as the crypto device is kept separately.

I won’t go into how to safely cross air or energy gaps, it’ll take up to much space. I’ve mentioned a few ways in sufficient detail on this blog in the past so looking it up is there as an option. But what ever method you use, remember the most important feature is “the ease of secure destruction”. Whilst a piece of paper may not hold much data even in digital form, it does burn to unusable ashes in less than ten seconds, faster if you “strip shred” it first to get a good volume of air in it.

Clive Robinson • September 28, 2021 7:07 AM

@ Bill, ALL,

I only chose Norton at the time because it was Phil Zimmermanns original PGP and I didn’t believe they had built in any backdoors.

As you note, that was then… It probably would not run on OSs and hardware of now.

Which brings us to a point @Nick P and myself used to have a minor disagreement on which you can see if you look back on the blog.

I favoured hardware pre 1995 and he thought 2005 was the cut off point. Turns out “meltdown” and similar was visable in 2005 CPU’s. I suspect but can not say that even 486 CPU’s had security faults due to “specmanship” so that takes us back to the early 1990’s[1].

Which raises the question of other hardware faults in practical implementation,

@ Z.Lozinski, ALL,

The challenge as ever with high grade security is in the implementation.

Leqving asside for the moment the “high grade security” argument[2], I’ve yet to see a consumer, or commercial grade OS or bit of hardware I would consider sufficiently secure for ordinary privacy. It’s why so many crooks make large amounts of money…

In fact I would argue, that the situation is getting worse on an almost daily basis.

As our host @Bruce has been known to point out a security system is in effect a chain of links, that is onlyvas strong as the weakest of the links.

I am known to point out the issues with “user end points” that are just one part of the overall security chain.

It’s all fine and dandy having the strongest encryption system known for the “communications link” but…

1, What real use is that if the OS Comms stack, alows an attacker to get almost effortless access to the User Interface where everything is in “plaintext”.

2, Likewise if the encryption software creates multiple time based side channels that can be seen on the comms network several nodes away.

3, Also if the hardware creates,multiple time based side channels…

Which brings us onto Quantum Key Distribution (QKD) it’s had a long history from before 1984 to today it has been plagued with side channels. The first was noted by one of QKD’s inventors, he used an “optical light bench” to build an experimental version and the electronically controlled polarizers made so much noise he could tell what state they were in just standing there.

Over the years I amongst others have pointed out that there were various tricks you could do to tell the state of the polarizers, one obvious one is monitor the power usage of the QKD device either directly or due to the EMC issues. But as most QKD devices did not have frequency specific filters, it was possible to use a coherant light source of an entirely different frequency and inject it into the QKD optical channel and see what got reflected off of the polarizers thus know how they were set. Then there was the issue that the early photon sources actually emitted multiple photons… Oh and lots of other stuff as time went on. But it’s major issue is path loss that limits the range of use significantly.

So QKD was actually of very limited use even on point to point links…

As most people who have payed attention to ICTsec over the past half decade or so now know, “link security” is not what is wanted. What is wanted is “end to end security”. That way you as the first party and the second party you are communicating with do not have to trust any chanbels or nodes beyond your control and subject to third parties evesdropping or subversion etc.

QKD can only give end to end security over very short fixed lengths as such it’s fairly usless for most communications networks, that require switching between multiple network nodes.

It’s the same reason “monorail” trains never took off in the 1960’s nobody could work out how to make the switches…

Whilst things are improving with repeaters and switches, they all currently have “security issues”. Whilst they can be solved for Nation State actors who can throw the resources, legislation, and enforcment at the problem, the same is not true for anyone else, especially where a Nation State regards everyone else as the “enemy” thus has a “collect it all” policy and who can also “throw the resources, legislation, and enforcment at the problem” of ensuring it…

But realistically the massive cost of designing and operating secure nodes is commercially prohibitive and this will keep QKD sidelined from all but a few niche areas.

Will this change? Probably not a lot, the communications channel security rests on one law of physics and the communications channel range limitation on another law of physics. There is actually not much room in between to play with.

But even when you only use two end points, the engineering is such that stopping all side channels in them is not possible. So there is the distinct probability of information leakage.

[1] However I do have an 8088 machine I still use with MS-DOS 3, it only has old fashioned ROM technology in it and no fancy Flash ROM.

[2] The “high grade security” argument, should be one of symantics, but unfortunately prosecutors use it as a method of arguing that a person is some how a criminal because they have something to hide, rather than just have an acceptable level of “privacy” which is a primary requirment for the society we currently have.

Clive Robinson • September 28, 2021 10:05 AM

@ Winter, ALL,

I am not qualified to judge the quality of the anonymity.

I don’t think anybody is realy, as it’s a fairly fast moving game. So what was anonymous last week, may well not be this week etc.

There is a physical forensics principle thought up by Dr Edmund Lockard around a century ago.

Called the “Exchange” or “Contact” Principle” put simply it argues that when two objects come into contact they leave trace evidence of each other on the other object.

Whilst information has no physical form and is thus not effected by forces, the use of information for,

1, Communication.
2, Storage.
3, Computation.

Requires it to currently “interact” with the physical world, which can only be done presently by impressing information onto either energy or matter, which are constrained by forces and other laws of nature.

Thus the question arises “Does Dr Locard’s principle apply?”[1] to which the answer at some level is almost certainly yes. But the secondary question of “Is it currently of practical use or not?” arises. History tends to suggest if there is sufficient need technology will at some point become available. So most likely the subject of anonymity is going to change.

But since Dr Locard came up with his principle things have changed. Back then the notion of meta-evidence had not received much consideration. Since the realisation of “traffic analysis” and similar during WWII meta-data has had a good toe hold on the intelligence arena. Forensics in effect is associated with intelligence, thus we should now consider “information” as a form of “object” and ask what traces follow information in communication and processing of it.

I suspect we will see quite a bit of effort go into developing methods. Not because of “crimes” –though that will be the excuse– but because of the desire to “tax” and raise revenue to “buy influence”.

Which for me is probably the best reason to avoid crypto-currencies there is, and speculators real should take that into account when making their “bets”.

[1] Locard’s Principle and information forensics, has been discussed in atleast on academic setting,

https://www.usna.edu/Users/cs/wcbrown/courses/si110AY13S/lec/l30/lec.html

https://whatisdigitalforensics.blogspot.com/2005/01/locard-exchange-principle-in-digital.html