Schneier on Security

Time is random in small measures • June 4, 2024 8:32 AM

@ALL

When you see

“… unwisely tied the random passwords it generated to the date and time on the user’s computer­it determined the computer’s date and time, and then generated passwords that were predictable.”

You might get the impression that using “time” is a bad idea.

The answer is both “Yes and No” and depends in very large part on the measure or quantity you use and how you use it.

All clocks drift even those atomic clocks up in GPS satellites as far as we can tell the drift has some ideal properties as a source of entropy. The problem is extracting it and debiasing it.

The more accurate the clock the less entropy you get in any given time period. If you use say one of a series of fast rotating neutron stars

https://esahubble.org/images/potm2404a/

Then you are looking at thousands of years to get a bit you might be able to extract.

Use a water clock and you might get usable bits of entropy at a rate of several a minute.

The problem programmers face is “Computers are deterministic” and governed by an XTAL clock that gets multiplied by PLL circuits to the low microwave frequencies and every internal action is tied to it in some way.

So there is no entropy because you measure with the clock that generates the signal.

Which means using a signal that is fully independent of the XTAL clock in the computer, and that is not easy (there are tricks you can do in that there are usually two XTALs in a PC the AT-Cut CPU crystal at 30MHz or more and the B-Cut RTC crystal at 32KHz and you can “Waggon Wheel” them).

There are books written on this subject (and our host has written a couple of them) but they all only scratch the surface of the issues of time measurement and entropy. It’s very definitely a “here be dragons” subject and why most people should look for other sources of entropy that are easier to understand.

Time is random in small measures • June 4, 2024 7:07 PM

@Wannabe Techguy

“Ok this wannabe doesn’t understand why the date and time is used for passwords. Can someone explain this in “dummy proof” language without being a smart ass?”

If I understand you correctly you want to know why some one was stupid enough to use “time”?

The answer is sadly one that keeps coming up. It happened in Netscape back in the 1980’s and has happened repeatedly all to often since.

The only thing that to a programmer changes continuously on a computer is time everything stays the same unless changed.

So time is incorrectly seen by many as being two things,

1, Constantly changing.
2, Never repeating.

Well… There was talk of a “negative leap second” not so long ago

https://en.wikipedia.org/wiki/Leap_second

That might happen in 2029. Which would break both notions. But contrary to what many think time does not ever “change constantly” with digital clocks no matter how fast they tick. Even more fun time changes at different rates depending on where you are and how you move with respect to another point in space hence “inertial time frames” are one of those “just let me cover my ears” things. For a philosophical view point

https://plato.stanford.edu/entries/spacetime-iframes/

But remember they effect the way your mobile phone amongst other everyday technology we take for granted works…

If you are writing a computer game then using a simple encryption of time as a seed for the game PRNG was fine back in the 1980’s so each game you played was effectively different.

But from a security aspect using time no matter how you encrypt it is really very very silly.

Because “files have file times” and “locations in file systems”. So if the output of the password generation is written to a file as frequently happens then an attacker has a start point to do a “dictionary attack” over a very small search space. Even if the file is deleted the hole it leaves in the file system gives the time fairly well.

Time is random in small measures • June 5, 2024 7:41 AM

@ Keri B

“But to your point that it only looks random to the adversary… isn’t that sufficient? By definition, if I were worried about attacks by any other party, they’d be my adversary (one of them).”

Err no, “my adversary” is a very limited subset of “Attackers”.

Consider, you write a program, presumably not just for your use.

Then anyone attacking your program is attacking all your users as well as you.

Those who attack in a more systematic way are attacking an even wider group of people.

Those who attack things in a general way are like the NSA and other Five-Eyes they are attacking all on an industrialised basis.

It’s why in the past it’s been mentioned that attacking

1. Implementations
2. Interoperability
3. Protocols
4. National Standards
5. Industry Standards
6. International standards
7. Legislation
8. International treaties

Is more effective for the NSA the “further up the stack” they go.

But some attacks are very generic and very effective. Because they attack incorrect assumptions in security.

For example it does not matter what block-width the output of a block cipher is in bits, if the input alphabet is very small and in reality as little as one bit.

For example a “Command Line Interface”(CLI) menu system asking “y/n” as a response.

It’s one of the reasons nobody should use ECB as a mode but some chaining mode with changing IV for each new encryption session.

Hashes are in effect block ciphers with known key in ECB mode, they were never designed to protect data.

They are thus very vulnerable to “Dictionary Attacks” or “Rainbow Table attacks” that work against all “One Way Functions”(OWFs) no natter how strong when they are used with a limited input alphabet.

It’s why I said the NSA could easily attack the likes of the Intel on chip TRNG and similar that all used a D-type latch to sample one clock with another. You can prove graphically that a digitised sine wave results and if you actually feed it into an integrator or low pass filter, you get an extraordinary good sinewave as a result.

A sine wave crosses the zero axis twice thus it’s frequency is easily determined. Similarly it reaches other known points at known times. It’s a simple case of basic mathematics to determine the input to the hash from that point onwards and thus retain synchronisation by a simple staircase algorithm to search through a very very reduced search space.

So the TRNG is at that point broken and a known quantity to an attacker.

Thus in reality as the hash is unkeyed it provides no increase in security what so ever.

Hopefully that makes it a bit clearer?

But something else you need to consider.

‘Ever heard of PUFs or “Physically Unclobable Functions”?’

In short, when you power up semi-conductors such as logic gates they come up in more or less the same value every time.

This was noted by researchers who then found a way to make it like a random serial number on a chip.

You mention

“Linus’s proposal seems to be to read the hardware PRNG on startup, to seed the kernel’s.”

Depending on how it is done this might be an extraordinarily bad idea due to the effective PUF problem at start-up giving a very small range of values easily within range of a search strategy.