Crypto-Gram

July 15, 2016

by Bruce Schneier
CTO, Resilient, an IBM Company
schneier@schneier.com
https://www.schneier.com

A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise.

For back issues, or to subscribe, visit <https://www.schneier.com/crypto-gram.html>.

You can read this issue on the web at <https://www.schneier.com/crypto-gram/archives/2016/…>. These same essays and news items appear in the “Schneier on Security” blog at <http://www.schneier.com/>, along with a lively and intelligent comment section. An RSS feed is available.

In this issue:

CIA Director John Brennan Pretends Foreign Cryptography Doesn’t

Exist

Last week, CIA director John Brennan told a Senate committee that there wasn’t any strong cryptography outside of the US.

CIA director John Brennan told US senators they shouldn’t worry about mandatory encryption backdoors hurting American businesses.

And that’s because, according to Brennan, there’s no one else for people to turn to: if they don’t want to use US-based technology because it’s been forced to use weakened cryptography, they’ll be out of luck because non-American solutions are simply “theoretical.”

Here’s the quote:

“US companies dominate the international market as far as encryption technologies that are available through these various apps, and I think we will continue to dominate them,” Brennan said.

“So although you are right that there’s the theoretical ability of foreign companies to have those encryption capabilities available to others, I do believe that this country and its private sector are integral to addressing these issues.”

Is he actually lying there? I suppose it is possible that he’s simply that ignorant. Strong foreign cryptography hasn’t been “theoretical” for decades. And earlier this year, I released a survey of foreign cryptography products, listing 546 non-theoretical products from 54 countries outside the US.

I know Sen. Wyden knows about my survey. I hope he asks Brennan about it.

Blog entry URL:
https://www.schneier.com/blog/archives/2016/06/…

http://www.theregister.co.uk/2016/06/17/…

Herb Lim comments:
https://www.lawfareblog.com/…

My survey:
https://www.schneier.com/blog/archives/2016/02/…

Discussion:
https://it.slashdot.org/story/16/06/17/1621251/
https://news.ycombinator.com/item?id=11944552

Report on the Vulnerabilities Equities Process

I have written before on the vulnerabilities equities process (VEP): the system by which the US government decides whether to disclose and fix a computer vulnerability or keep it secret and use it offensively. Ari Schwartz and Rob Knake, both former Directors for Cybersecurity Policy at the White House National Security Council, have written a report describing the process as we know it, with policy recommendations for improving it.

Basically, their recommendations are focused on improving the transparency, oversight, and accountability (three things I repeatedly recommend) of the process. In summary:

* The President should issue an Executive Order mandating government-wide compliance with the VEP.

* Make the general criteria used to decide whether or not to disclose a vulnerability public.

* Clearly define the VEP.

* Make sure any undisclosed vulnerabilities are reviewed periodically.

* Ensure that the government has the right to disclose any vulnerabilities it purchases.

* Transfer oversight of the VEP from the NSA to the DHS.

* Issue an annual report on the VEP.

* Expand Congressional oversight of the VEP.

* Mandate oversight by other independent bodies inside the Executive Branch.

* Expand funding for both offensive and defensive vulnerability research.

These all seem like good ideas to me. This is a complex issue, one I wrote about in “Data and Goliath” (pages 146-50), and one that’s only going to get more important in the Internet of Things.

http://belfercenter.ksg.harvard.edu/publication/…

https://theintercept.com/2016/06/17/…

My writings:
https://www.schneier.com/blog/archives/2014/05/…
https://www.schneier.com/blog/archives/2015/09/…

News

This essay argues that teaching computer science at the K-12 level is a matter of national security. I think the argument is even broader. Computers, networks, and algorithms are at the heart of all of our complex social and political issues. We need broader literacy for all sorts of political and social reasons.
http://www.foxnews.com/opinion/2016/06/16/…

xkcd phishing cartoon. (The mouseover is the best part.)
http://xkcd.com/1694/

The New York Times is reporting that some women in China are being forced to supply nude photos of themselves as collateral for getting a loan. Aside from the awfulness of this practice, it’s really bad collateral because it’s impossible to ever get it back.
http://www.nytimes.com/2016/06/16/world/asia/…

Security behavior of pro-ISIS groups on social media:
http://spectrum.ieee.org/tech-talk/telecom/internet/…
http://science.sciencemag.org/cgi/doi/10.1126/…

Ronald V. Clarke argues for more situational awareness in crime prevention. Turns out if you make crime harder, it goes down. And this has profound policy implications.
http://www.asc41.com/Criminologist/2016/…

Amy Zegert has some good questions about how to prevent lone-wolf terrorism, comparing the Orlando Pulse massacre to the Fort Hood massacre from 2009.
https://www.lawfareblog.com/…

IPv4 addresses are valuable, so criminals are figuring out how to buy or steal them.
http://www.theregister.co.uk/2016/06/16/ipv4_hijacking/
https://www.youtube.com/watch?v=i7FGChQNUtA

Micah Lee has a nice comparison among Signal, WhatsApp, and Allo.
https://theintercept.com/2016/06/22/…
BTW, don’t use Telegram.
http://gizmodo.com/…

Stories of burglars using social media to figure out who’s on vacation are old hat. Now financial investigators are using social media to find hidden wealth.
https://www.theguardian.com/technology/2016/apr/03/…

There’s an app that allows people to submit photographs of hotel rooms around the world into a centralized database. The idea is that photographs of victims of human trafficking are often taken in hotel rooms, and the database will help law enforcement find the traffickers. I can’t speak to the efficacy of the database—in particular, the false positives—but it’s an interesting crowdsourced approach to the problem.
http://www.stltoday.com/news/local/crime-and-courts/…
http://wgntv.com/2016/06/23/…

Facebook seems to be using physical location to suggest friends.
http://fusion.net/story/319108/…
https://boingboing.net/2016/06/27/…
Facebook backtracks:
https://tech.slashdot.org/story/16/06/28/1519246/…

Interesting research: Mark G. Stewart and John Mueller, “Risk-based passenger screening: risk and economic assessment of TSA PreCheck increased security at reduced cost?”
http://hdl.handle.net/1959.13/1313869

Peter Maas interviewed the former NSA official who wrote the infamous “I Hunt Sysadmins” memo. It’s interesting, but I wanted to hear less of Peter Maas—I already know his views—and more from the NSA hacker.
https://theintercept.com/2016/06/28/…
https://theintercept.com/2014/03/20/…

This anti-paparazzi scarf reflects light from camera flashes.
http://www.thisisinsider.com/…

Funny: “Dogs Raise Fireworks Threat Level to ‘Gray'”
http://m.huffpost.com/us/entry/7688280.html

Interesting research: Debora Halbert, “Intellectual property theft and national security: Agendas and assumptions”:
http://www.tandfonline.com/doi/full/10.1080/…
Preliminary version, no paywall:
https://www.academia.edu/s/c920454934?source=link

The New York Times wrote a good piece comparing airport security around the world, and pointing out that moving the security perimeter doesn’t make any difference if the attack can occur just outside the perimeter. Mark Stewart has the good quote: “‘Perhaps the most cost-effective measure is policing and intelligence—to stop them before they reach the target,’ Mr. Stewart said.” Sounds like something I would say.
http://www.nytimes.com/interactive/2016/07/01/world/…

Interesting research: “Characterizing and Avoiding Routing Detours Through Surveillance States,” by Anne Edmundson, Roya Ensafi, Nick Feamster, and Jennifer Rexford.
https://arxiv.org/abs/1605.07685

BBC has a story about hijacking someone’s Facebook account with a fake passport copy. The confusion is that a scan of a passport is much easier to forge than an actual passport. This is a truly hard problem: how do you give people the ability to get back into their accounts after they’ve lost their credentials, while at the same time prohibiting hackers from using the same mechanism to hijack accounts? Demanding an easy-to-forge copy of a hard-to-forge document isn’t a good solution.
http://www.bbc.com/news/technology-36661557

Two researchers have discovered over 100 Tor nodes that are spying on hidden services.
https://boingboing.net/2016/07/01/…
https://motherboard.vice.com/read/…
https://www.defcon.org/html/defcon-24/…

Dallas police used a robot to kill a person. It seems to be a first.
http://arstechnica.com/tech-policy/2016/07/…
https://www.washingtonpost.com/news/the-switch/wp/…
http://www.theverge.com/2016/7/8/12129348/…
https://theintercept.com/2016/07/08/…
https://www.wired.com/2016/07/…

Interesting paper: “Anonymization and Risk,” by Ira S. Rubinstein and Woodrow Hartzog.
http://lsr.nellco.org/nyu_plltwp/530/

In a truly terrible ruling, the US 9th Circuit Court ruled that using someone else’s password with their permission but without the permission of the site owner is a federal crime. This means that if you give someone else your Netflix password without Netflix’s permission, you’re a criminal.
https://motherboard.vice.com/read/…
https://www.washingtonpost.com/news/…
https://www.eff.org/deeplinks/2016/07/…

While we’re on the subject of terrible 9th Circuit Court rulings, visiting a website against the owner’s wishes is also a federal crime:
https://www.washingtonpost.com/news/…
Both of these ruling demonstrate how badly written the Computer Fraud and Abuse Act is.

Security effectiveness of the Israeli West Bank barrier:
https://link.springer.com/article/10.1007/…

Schneier News

I have joined the Board of Directors of the Tor Project.
https://.torproject.org//…
http://www.nytimes.com/2016/07/14/technology/…
http://www.theverge.com/2016/7/13/12176262/…
https://yro.slashdot.org/story/16/07/14/0034225/…
https://news.ycombinator.com/item?id=12088419

I’m giving a keynote talk at RSA Asia in Singapore on 21 July.
https://www.rsaconference.com/events/ap16

I was a guest on an “Adam Ruins Everything” podcast.
http://www.maximumfun.org/adam-ruins-everything/…

I was a guest on “The Legal Edition,” where I talked about encryption and the going-dark debate.
https://www.schneier.com/news/archives/2016/06/…

Apple’s Differential Privacy

At the Apple Worldwide Developers Conference earlier this week, Apple talked about something called “differential privacy.” We know very little about the details, but it seems to be an anonymization technique designed to collect user data without revealing personal information.

What we know about anonymization is that it’s much harder than people think, and it’s likely that this technique will be full of privacy vulnerabilities. (See, for example, the excellent work of Latanya Sweeney.) As expected, security experts are skeptical. Here’s Matt Green trying to figure it out.

So while I applaud Apple for trying to improve privacy within its business models, I would like some more transparency and some more public scrutiny.

https://www.wired.com/2016/06/…
http://www.technobuffalo.com/2016/06/15/…

Commentary:
http://.cryptographyengineering.com/2016/06/…
http://emergentchaos.com/archives/2016/06/…
http://www.tomsguide.com/us/…

Here’s a slide deck from the WWDC.
http://devstreaming.apple.com/videos/wwdc/2016/…

Latanya Sweeney:
http://dataprivacylab.org/people/sweeney/

Google’s Post-Quantum Cryptography

News has been bubbling about an announcement by Google that it’s starting to experiment with public-key cryptography that’s resistant to cryptanalysis by a quantum computer. Specifically, it’s experimenting with the New Hope algorithm.

It’s certainly interesting that Google is thinking about this, and probably okay that it’s available in the Canary version of Chrome, but this algorithm is by no means ready for operational use. Secure public-key algorithms are *very* hard to create, and this one has not had nearly enough analysis to be trusted. Lattice-based public-key cryptosystems such as New Hope are particularly subtle—and we cryptographers are still learning a lot about how they can be broken.

Targets are important in cryptography, and Google has turned New Hope into a good one. Consider this an opportunity to advance our cryptographic knowledge, not an offer of a more-secure encryption option. And this is the right time for this area of research, before quantum computers make discrete-logarithm and factoring algorithms obsolete.

http://mashable.com/2016/07/08/…
https://techcrunch.com/2016/07/07/…
http://www.extremetech.com/extreme/…

Google announcement:
https://security.googleblog.com/2016/07/…

New Hope algorithm:
https://eprint.iacr.org/2015/1092.pdf

Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. You can subscribe, unsubscribe, or change your address on the Web at <https://www.schneier.com/crypto-gram.html>. Back issues are also available at that URL.

Please feel free to forward CRYPTO-GRAM, in whole or in part, to colleagues and friends who will find it valuable. Permission is also granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety.

CRYPTO-GRAM is written by Bruce Schneier. Bruce Schneier is an internationally renowned security technologist, called a “security guru” by The Economist. He is the author of 13 books—including his latest, “Data and Goliath”—as well as hundreds of articles, essays, and academic papers. His influential newsletter “Crypto-Gram” and his blog “Schneier on Security” are read by over 250,000 people. He has testified before Congress, is a frequent guest on television and radio, has served on several government committees, and is regularly quoted in the press. Schneier is a fellow at the Berkman Center for Internet and Society at Harvard Law School, a program fellow at the New America Foundation’s Open Technology Institute, a board member of the Electronic Frontier Foundation, an Advisory Board Member of the Electronic Privacy Information Center, and the Chief Technology Officer at Resilient, an IBM Company. See <https://www.schneier.com>.

Crypto-Gram is a personal newsletter. Opinions expressed are not necessarily those of Resilient, an IBM Company.

Copyright (c) 2016 by Bruce Schneier.

Sidebar photo of Bruce Schneier by Joe MacInnis.