Schneier on Security

Clive Robinson • August 5, 2023 11:08 AM

@ RobertT,

“Clearly seeing faults where others see just a fantastic new technology is the domain of the elderly,”

Or perhaps “The more worldly wise” who have learned to recognise the oft centuries old behaviours of what we call “Confidence Tricksters” or as some call themselves more recently “Venture Capatilists”.

“Today it seems that the whole world has gone quantum crazy, it’s obvious that 9 out of 10 people don’t have the foggiest idea of why/how quantum processes / algorithms function but that doesn’t mean they keep their mouths shut, matter of fact there is zero correlation between real knowhow and how loudly their gums flap.”

Such are the joys of apparant magic. As Arthur C. Clarke is said to have observed,

“Any sufficiently advanced technology is indistinguishable from magic.”

Is actually more subtle than many realise, because it defines two subsets of people,

1, Those who understand the technology and work with it.
2, Those who do not understand the technology and are dazzled by it.

I suspect very few understand quantum technology, in fact there is an insiders joke about many people who practice in the field.

Where it is observed they are part of the,

“Shut up and caculate”(SUAC)”[1]

Club or “card carrying” Union.

But as far as Information Security goes there are three areas it covers currently,

1, Quantum Key Distribution (QKD)
2, Quantum Computing (QC)
3, Quantum Systems

A few years back all the noise was about QKD thatvstarted with the BB84 paper and physical hardware as a proof of concept.

Those early systems had so many holes in them that it got to the point it was embarrassing to shoot another one in, it was just not sporting. That’s not to say that the QKD idea is flawed, it’s not, it was a quater century ahead of what technology could support, thus it was the support technology that was failing. However being a creature of physics it is also a slave to physics and the limitations it imposes the most severe of which is the inverse relationship between speed and distance that brings a range limit on the technology.

An interesting area arising out of the technical developments that QKD helped push forward is things that get lumped under Quantum Systems. It’s an interesting area but we don’t get to here very much about it. One proponent indicated that what could be done with electrical and mechanical systems could be done with quantum systems more effectively, reliably and robustly. People tend to get things muddled with nano machines and “Micro Electro Mechanical Systems”(MEMS) devices that have made very rapid advancments to smart devices as micro miniture sensors which though small are not quantum devices.

But the real noise and confusion is over a suggestion made by Richard Feynman in 1982, and given theoretical flesh by David Deutsch in 1985 we call “Quantum Computing”.

Quantum Computing mostly started off with the likes of Feynman’s CNOT and Tommaso Toffoli’s and Edward Fredkin’s gates and similar based on Charles Bennett’s demonstration of the reversability of classical computation. As such QC did not really attract that much attention though. That is until 1994, when Peter Shor chucked the proverbial match in the firework box with his factoring algorithm.

That’s when it’s ICTsec implications became obvious to a few[2], the fast factoring of composite numbers would through a large rusty bolt in the gear box of the nascent engine of E-Commerce. Very shortly there after The US Government through NIST organized their first workshop on quantum computing (with the obligitory help from the NSA).

Since then Quantum Computing has been seen much like AI in that,

“It will be with us in a decade”

Well here we are thirty years later and both QC and AI still appear to be a decade away.

Though my viewpoint is that QC will happen befor Artificial Inteligence but a decade is some what optomistic.

Others think even five decades is probably optimistic

But the NSA through NIST has decided that we need to act and act now… hence the world and his dog has become “Post Quantum Computing” experts, in the same way as Fox News Talking Heads are experts on politics…

Back in the 1980’s a TV Script Writer wrote a Radio Script that got broadcast at some very odd time of day on BBC Radio 4. It strangly gathered a following. In it appears the largest computer in the universe to calculate “The Answer” which as we all now know is 42. However the realy funny side of “Deep Thought” was how it solved the problem of what to do whilst the next largest computer looked not for “The Answer” but “The Question”. It advised “talking head behaviour, with much in the way of mud slinging arguments”. Whilst we’ve not seen it quite that bad with QC we have however seen the “Sharks” that Venture Capitalists and the like are, have been circling looking for blood in the water to start a feeding frenzy… It appears they have been momentarily been destracted by the vast richescto be made in selling AI Start Ups pushing LLM systems with eye wateringly expensive but available technology.

And I suspect that’s what is holding back a QC Frenzy is the lack of available hardware.

But few ask the obviois question,

“Why all the theory but no hardware?”

Well, I suspect you are more than aware of it.

A conventional bit of data has two discrete states that represent zero or one.

A Quantum Bit or Q-Bit is not discrete but continuous thus in theory has an above measurable range of values it can represent as a complex number. Most engineers that have built hardware the hard way know there are various problems with not just measurments but power supplies. As far as I can tell currently we can not have more than about 1:1000 levels for the real and imaginary parts of the complex number…

Which is why I suspect usefull QC is longer away than you or I are ever going to see.

However the fear of large composit factorisation should keep the money tap on for a decade or so more…

And solving the Post-QC problems that are not likely to happen should keep many “well tenured” for a half century or more.

But hey what do I know 😉

[1] It’s been attributed to a few people over the years,

https://quantumformalism.substack.com/p/shut-up-and-calculate

[2] The big problem with cryptography has always been “Secure key distribution”. At the very least cryptography needs a “shared secret” to become a “root of trust” upon which all else is built, establishing it between individuals had always involved a “secure channel” which implied a “face to facr” meating to exchange the “root of trust”. Then in the 1970’s it was realised that the use of “One Way Functions”(OWFs) with “Trapdoor functions” could be used. One of which is the idea of multiplying two large Prime Numbers which is trivial in comparison to factoring them back out of the composite.

Clive Robinson • August 5, 2023 5:15 PM

@ Jon, ALL,

“And just how does one Winterize Squid oil?”

Simple answer is cool it off and filter out the results.

Winterizing is a dewaxing process that a lot of people actually do in their kitchen without realising there is a “scientific term” for it.

Put simply due to different phase state change tempratures lipids of all forms have changing mechanical properties at different tempratures, that alow simple mechanical processes to seperate them.

In the kitchen gravy left to cool in a glass dish undergoes stratification that you can see. If you use that cooling temprature grade stratification to make mechanical seperation easy then you’ve basically done a “winterisation de-waxing” process.

But as for your first question,

“Was the Squid Oil Global Market Report written by AI? So much useless, trivial and barely related info. Chunks of copy/paste boilerplate.”

Contrary to the old joke about it needing a computer to “realy f-up” if it was AI you would expect a smother more polished result…

So I suspect it was produced by a “ten cents per word turk” that has become a fashionable way for certain “News Organisations” to fill web pages. I don’t know who started the modern varient, but I do know Rupert “the bear faced liar” Murdoch of “News International informy” was so badly obvious about it quite a few blaim him for it.

There used to be a song,

“Mammas, Don’t Let Your Babies Grow Up To Be Cowboys”

That in the 1970’s described the death of not just a job but lifestyle as well… Well today’s version would swap “Journalists” for “Cowboys” and a few other words, but would say much the same…

Clive Robinson • August 7, 2023 4:37 AM

@ Ismar,

“You don’t travel much, do you?”

A curious question…

But as I’ve indicated in the past for medical reasons I’ve been told to keep below the equivalent of 8000ft ASL which is also called “cabin altitude” so can no longer fly on international jet airline flights.

Which limits not just low cost international travel, it means other hobbies have had to stop.

However I used to be almost continuously on the move one way or another. And I had a passion for high ground so mountains, moorland, hills and even high buildings, attracted my feet and my boots.

Mind you as I used to joke,

“I’m not scared of hights, I can stand and look up at them all day, it’s drops that worry me.”

However for the past few weeks even a flight of stairs has been dangerous. Due to blood poisoning both my feet are significabtly swollen and extreamly painfull at the ball of the foot. And I can not stand or balance properly, which makes getting down a flight of stairs hazardous…

Clive Robinson • August 7, 2023 12:34 PM

@ RobertT,

“lots of useful techno mumbo jumbo but my point was that it is the system itself which is insecure.”

The two basic reasons most systems are “insecure” are,

1, They have “entities with agency” within the loop.
2, The designers fundementally do not understand “why secrecy is not security”.

But as Arthur C Clark noted, about advanced technology looking like magic, to 99.9…% of the population we are always going to have “magical systems”. The difference is how much you become “enslaved by you beliefs”.

If I hold up my hand pointing a finger and say bang, and a hole appears where I’ve been pointing, how soon before you say it’s not coincidence?

Three times, ten times a hundred? Eventually you will accept there is some “cause and effect” and that it’s not just coincidence.

The question then is having accepted it’s not coincidence,

“What do you think is happening?”

The answer to that depends on two things,

1, What you known
2, What you believe

From which we can say,

“The more you know the less you need to believe.”

Hence the more technically sophisticated you are the less like magic it looks.

Now I don’t care what some may say, the reality is none of us are going to be sufficiently sophisticated that there can not be the magic of a little unknown in our lives.

For instance there is sufficient evidence around that hypnosis can change the way people respond to various stimuli. We don’t know why but it does for many people (but not all).

There is also abundent evidence for cognative bias, and I’m sure many can think of many quite public examples in recent times.

But it actually runs deeper, due not to what you know by experience or observation but only by what you have been told before you could reason sufficiently to question… That is arguably something like 300million people in the US with “Cargo Cult” like beliefs on the existance of a “Higher Power”[1] that controls their existance…

I’m cautious about “quantum security” for a number of reasons. First and foremost those who actively research into that side of science themselves are quite cautious. Yes we joke about “Shut Up And Calculate”(SUAC) but most of it is theory with insufficient experimental confirmation. In part because we don’t yet have the technology to test. But also we know there are hard limitations on what can be done due to environmental limitations.

But also, I see to many claims where secrecy and security are confused or muddled in peoples thinking and that does not give me confidence in what they say let alone claim.

As for Quantum Computing I realy don’t think we are even close to having the technical sophistication to turn the multitude of theory into practical fact.

But consider that it’s argued that we need a minimum of 1000 Qbits to have the practical computing power to rival a high end laptop.

Unlike discrete digital bits that have only two states, Qbits to work need to have a continuous state that covers all potential values simultaniously. So they are effectively analog and would need a 2^1000 or 10^301 state range. How do we keep the noise out let alone measure accurately enough to be of use?

[1] Pew Research after various polls concluded ~90% of US adults believed in a “Higher Power” with an inverse ratio based on educational attainment,

https://www.pewresearch.org/short-reads/2018/04/25/key-findings-about-americans-belief-in-god/

Clive Robinson • August 8, 2023 7:23 AM

@ pilot,

“Recent models have even lower cabin altitude”

But don’t have to be as the highest airports are well above 8000ft.

So it’s not a certainty, and you can not buy a ticket guaranteeing they will keep to 7000ft ASL and they won’t sell you a ticket if you ask for such a guarantee.

So do you keep your feet on the ground or flip a coin to see if you will have dangerous if not fatal issues to your brain?

Just let me stand here awhiles and think about it 😉

Clive Robinson • August 8, 2023 3:24 PM

@ Bruce, usuall suspects, ALL,

Don’t type whilst on the phone

Yet another “acoustic side channel” that enables typing to be recovered about 95%…

https://arxiv.org/abs/2308.01074

It’s less reliable with fast touch typists and does not pick up the shift key –and presumably control ESC key combos– very well.

From the Intro,

“This paper presents a practical implementation of a state-of-the-art deep learning model in order to classify laptop keystrokes, using a smartphone integrated microphone. When trained on keystrokes recorded by a nearby phone, the classifier achieved an accuracy of 95%, the highest accuracy seen without the use of a language model. When trained on keystrokes recorded using the video-conferencing software Zoom, an accuracy of 93% was achieved, a new best for the medium. Our results prove the practicality of these side channel attacks via off-the-shelf equipment and algorithms.”

Note,

1, No language model needed.
2, Off-the-shelf equipment and algorithms.

So well within “high school kid” attack cabilities.

Clive Robinson • August 9, 2023 12:09 AM

@ RobertT,

Re : Economics as the quick sand beneath ICTsec.

“Traditional economics puts too much emphasis on money itself and too little emphasis on complexity and diversity which imo are the foundations of a 21st century economy.”

I’ve been mulling over a reply…

It’s no secret I have little regard for economics for many reasons, not least it’s based on way to many assumptions that can not be considered axiomatic just get built in.

The big failing it’s had with the Internet as I’ve indicated in the past is the implicit assumption built in in much general economics is that “distance raises cost” thus a “market must have a home advantage” compared to a distant manufacturer.

I think most here realise that the only cost the internet has for by far the majority is “connection fees” that have no effect on the distance data travels, thus no “home market advantage” and so “first to market takes all” which is what we’ve seen.

But not as many have realised that even when distance does cost these days it’s actually a very small fraction of other costs. Thus manufacturing in the far east of Europe where land and labour are inexpensive compared to west Europe is why we had the horsemeat scandle a decade ago and worse has been building up since.

Likewise why for instance the US-China issue is such that the US can not solve the trade imbalance in the idiotic ways it is going about it.

This then brings in “National Security” not just in the general sense, but from this blogs perspective the ICTsec sense.

I think it’s no secret that the US spys on everyone every which way it can and,

1, Being the center of the Internet.
2, Being the center of software.
3, Being the center of hardware.

Has for three decades given the US the “Spider at the center of the web” advantage which they have significantly abused along with the Five-Eyes stradling the global “choke Points” for data communications.

Well it’s hardly suprising other nations are now retaliating.

The problem is “the US has bet the farm” on the Internet with all it’s weak protocols and easy to attack hardware. Thus the US is extreamly vulnerable economically on the Internet whilst the likes of China and India are not. The fact that they have taken away hardware and software development from the US due to short sighted outsourcing and the like means US entities are much more vulnerable to ICTsec issues than China or India…

So yes the economics side is very much not “the feet of clay” in ICTsec, but “the shifting quick sands of doom”.

Clive Robinson • August 9, 2023 7:09 AM

@ SpaceLifeForm, ALL,

Re : NOAA changes to satellite imaging.

It was to be expected, the US Gov has been dragging their heals every which way they can on space imaging.

It got well past the point where you could walk into “high st” shops and buy cameras and lenses that if put in low earth orbit would CubeSats would out perform what the US Gov would alow one way or another.

The final nail in the coffin as it were was India which has progressed more rapidly than some expected. Basically India has seen the economic benifit in ignoring the US Gov’s wishes to control space. It’s part of what went on that led up to India’s anti-sat experiment carried out four and a half years ago,

https://www.spaceflightinsider.com/organizations/isro/reactions-mixed-regarding-indias-anti-satellite-test/

You might note that the sat India destroyed was in a very low and quickly decaying orbit, and at 740kg was a distinct oddity having been launched only a just two months before,

https://en.m.wikipedia.org/wiki/Microsat-R

Clive Robinson • August 9, 2023 9:51 AM

@ SpaceLifeForm, ALL,

Re : That Xmas gift keeps giving…

Those silicon turtles are certainly getting the Elvis “way on down” jive.

https://www.bleepingcomputer.com/news/security/new-downfall-attacks-on-intel-cpus-steal-encryption-keys-data/

Called “downfall” CVE-2022-40982 Intel are in the frame for this one for several of their server CPUs (Skylake through Ice Lake). Oh and SGX gets the end run…

“A threat actor exploiting the security issue can extract sensitive information that is protected by Software Guard eXtensions (SGX), Intel’s hardware-based memory encryption that separates in memory code and data from software on the system.”

So potentially not what you might want if you are developing certain kinds of user to user communications that you want to keep a third party “nose prod” camel out of the tent.

But as normal with such “specmanship failings”,

“Eliminating the risk of Downfall/GDS attacks requires a hardware redesign, which comes at a cost that the industry is not yet ready to pay.”

Clive Robinson • August 10, 2023 4:57 PM

@ SpaceLifeForm, ALL,

I’m begining to suffer from “silicon turtle fatigue” with AMD…

It appears that not only do they go way on down, it’s a family affair with not just grand parents and grand children but a whole historic lineage longer than a beggers arm…

https://www.theregister.com/2023/08/09/amd_inception/

I guess we’ll hear the same or similar about Intel and Arm in the very near future, as that’s the way these things tend to go…

Clive Robinson • August 10, 2023 11:13 PM

@ Bruce, RobertT, ALL,

Static key as bad as no key.

A few hours ago I mentioned that one of the problems with On-Chip RNGs was the use of Encryption where the user had no control of the key…

Little did I expect to read an article within the day and get that “synchronicity feeling”,

https://www.bleepingcomputer.com/news/security/dell-compellent-hardcoded-key-exposes-vmware-vcenter-admin-creds/

Yup falling under the “they should have known better” banner Dell have hardcoded an AES key in their “Compellent” systems (one of their major enterprise lines),

“discovered in a penetration exercise that Dell CITV contains a static AES encryption key that is identical for all Dell customers across all installs.”

This includes all the admin credentials etc… So unlike using a hard coded password which gives just access to the effected systems, if the sysadmin password is the same on other machines then because AES is not one way like a hash, an attacker gets the plaintext password…

So Dell get “a double SmackFoo” on this one…