Schneier on Security

Clive Robinson • May 19, 2019 9:29 AM

@ George,

Thus, no amount of source code checking can fulfill this requirement. Signal as a platform is unverifiable to me, so I don’t trust it.

The same logic applies all the way down the computing stack.

You can not verify the code so you can not trust it…

Sounds bad untill you remember you can in a lot of cases “mitigate it”.

And “mitigate it” is realy the only solution there is. And it falls into doing two things,

1, Segregate the blocks.
2, Verify the interfaces.

In theory if you can see ALL the interfaces on a given block within a system then you can verify them whilst they are in use. In practice it is impossible to “Verify ALL interfaces” because you can not identify them all. So you use a design technique that minimizes the number of “known interfaces” but you do it in a way that catches “unknown interfaces” as well.

That is we know from the laws of physics that energy is transported by Conduction, Convection and Radiation in Solids or “working fluids” in all cases and across vacuums as well in the last case. Which means that to stop them we are looking at either Reflection or Absortion to contain energy. But the question then arises as to what energy and if we can actually contain it (gravity for instance) or only at best Mask it which is generally not a good option[1].

Thus in turn we consider the issue of how information gets modulated or impressed upon the energy and if that process can be contained or stopped if the energy can not. Which brings us to the idea of Bandwidth reduction and Amplitude, Phase, Frequency and Timing changing.

These are all methods of “Control by information Segregation” which have been practiced one way or another since the early days of mankind going hunting, right through to the supposadly still secret[2] Tempest and other EmSec techniques.

By in effect building a wall around the system block using the laws of physics, you can then “mandate an interface” that you can control to allow controled information to pass in or out of the block.

At the simplest the wall can be “distance” and what crosses the gap in or out can be just a hand written note. That is copied into the keyboard or down from the screen. This then gets further proceced by another block in the system.

Thus you can extend communications channels in various ways.

Back during WWII the British developed a high speed “on-line” telex encryptor called Rockex which had two inputs. The first was a cipher stream which was a truly randomly generated set of letters (A-Z) on punched paper tape, and secondly a plain text stream also on punched paper tape of a diferent colour and other charecteristics so the two tapes would not get confused. Importantly even though this was an OTP encryption system, the plain text was actually ciphertext from the British TypeX cipher machine that was sufficiently similar in the cryptographic mechanics that it could be down graded to be equivalent to the German Enigma.

Thus the security end points were significantly distanced from the communications end points with a carefully controlled gap crossing by paper tape.

It’s a lesson people need to take on board in this modern age where not only do they not own their communications devices, they have no control over them, and the designers of them do not in any realistic manner include security issolation in user communications.

For some reason though, each generation of system designers in the field of consumer markets appears never to have learned the lessons.

Thus if a consumer wants security they will have to build their own system around what are woefully insecure consumer goods and services. It’s pointless the consumer trying to understand to any level what happens in those goods and services because they will either be ignored or lied to at some point on the claim of “business edge” or “Intellectual Property” or some such, that is the same as the official “no comment” or “we can neither confirm or deny”.

Which means realistically the consumer has to “mitigate” after the communications end point of the goods and services made available to them.

Which for most means using “off consumer device” technology as these days you have to consider all consumer devices to be “bugged” by those who design or build them, so they can “data rape” to a higher profit. Thus everything you do on those consumer devices becomes a “business record” which can be bought, sold or grabbed by NSL or whatever is the favourite way these days by those who see themselves as above the ordinary taxpaying, voting and thus law abiding citizen.

Which leaves the question of what “off consumer device” opptions are open to the ordinary citizen.

Well a few technically competent individuals might make their own security devices, but that’s just a tiny fraction of the population, when you consider what “technically competent” actually means in the security domain. There are open source designs out there that do get mentioned on this blog and other places. But the reality is take up of such designs is pitifully low.

Which might be considered odd, because history shows that most people with sufficient practice, and regard for their own skin can use secure paper and pencil ciphers or codes. Further that there are not too difficult ways for them to make such ciphers and codes.

At which point you will probably discover the average citizen does not want to go through the effort to be secure…

And realistically that’s the bottom line, people only want what they see as “easy” security and the limit on that is “download an app”, it does not matter which app thus one with a “cool” name/graphics/options/etc or more prosaicaly “what all their friends use”.

[1] Masking or as it’s sometimes also called “Whitening” is the process of “raising the noise floor” such that all an attacker sees is noise, not a signal. The problem is “generating the noise” because if it’s not truely random it can be correlated thus removed and the information leak that you were trying to hide becomes clearly visable again. In fact the whitening signal can make things worse because it can give away internal state information that can make exploiting the information leak considerably easier…

[2] It’s kind of hard to keep the laws of physics secret, most first and second world children get taught them whilst in teenage or earlier classes. What those wishing to keep EmSec techniques secret work on is the difference between information and knowledge. In effect the laws of physics are information it’s only as you think about how to apply them that they become knowledge. Sometimes you get forced to think about them, the flip side of energy carrying information is the energy also causing harmful interferance hence as device density increases harmfull energy leakage becomes a real nuisance which has to be dealt with hence ElectroMagnetic Compliance (EMC) directives and legislation. Thus many people not signed to secrecy do get around to thinking and greating “Open Knowledge”. Thus things like the alledgedly secret “TEMPEST Design Rules” for engineers and technicians become less and less secret with time and as with all things fairly quickly surpassed with the aid of new technology.