[148684] in cryptography@c2.net mail archive
Re: [Cryptography] how reliably do audits spot backdoors? (was: Re:
daemon@ATHENA.MIT.EDU (Tom Mitchell)
Tue Dec 24 20:23:27 2013
X-Original-To: cryptography@metzdowd.com
In-Reply-To: <alpine.BSO.2.03.1312221639590.23573@astro.indiana.edu>
Date: Tue, 24 Dec 2013 17:04:46 -0800
From: Tom Mitchell <mitch@niftyegg.com>
To: Jonathan Thornburg <jthorn@astro.indiana.edu>
Cc: crypto@senderek.ie, "cryptography@metzdowd.com" <cryptography@metzdowd.com>,
Peter Gutmann <pgut001@cs.auckland.ac.nz>
Errors-To: cryptography-bounces+crypto.discuss=bloom-picayune.mit.edu@metzdowd.com
--===============1680224505858856458==
Content-Type: multipart/alternative; boundary=001a11330aba743be604ee517288
--001a11330aba743be604ee517288
Content-Type: text/plain; charset=ISO-8859-1
On Sun, Dec 22, 2013 at 4:51 PM, Jonathan Thornburg <
jthorn@astro.indiana.edu> wrote:
> On Sun, 22 Dec 2013, Bill Cox wrote:
> [[re Peter Gutmann's claim that backdoors in source-code
> may escape discovery in audits]]
> > Nonsense. Most other equally capable developers should be able to
> discover
With open source code the NSA would be foolish to install a true back door.
i.e. The NSA would be foolish to assume that they could craft a side door
in open
source code that would withstand the scrutiny of another nations security
agency
(ANSA). The folk I have encountered that work there (short and old list)
are not
foolish or stupid. Their data integrity folk are darn good.
I can see weaknesses to establish a class of ability or a time window.
For example in
the days that RSA and the NSA negotiated the $10M contract FPGA and ASIC
attacks
were the tools of a rare and limited set of nations and corporations. My
memory may
be fading but I recall this time frame and believe I heard "smart" folk
indicate that this was
not clearly beyond the tools of the spooks but was beyond the tool reach of
even organized
crime at that time. Key concept "at that time".
I make weakness level security decisions all the time. I do not have the
worlds strongest
lock on my home. I have also not replaced the locks on my car. My gym
locker lock is
an easy to open high school grade combination padlock. Most of these
locks I can still
open with my eyes closed in moments the same as I could back in high
school.
Down the road is a high voltage transformer with a lock on it. OK it
looks like a lock
but is a seal in the shape of a padlock. It is made of aluminum(?) for
the most part and
is designed to be cut off with cutters. The same as used to cut heavy
aluminum and copper
cables. It is tamper evident, it should withstand an attack for a little
bit of time with
a hammer or bashing with a rock. If a teenager busted in and fried his
little brain till
it burst the power company clearly is not maintaining an attractive
nuisance. There is
no master key to be lost. It could be made of more durable material like
hardened steel
and more but it does not need to be.
My thoughts on this is that if you wish to be NSA proof you have some work
to do.
All of this does take me to a couple places:
First is a reminder of the Morris worm attacks.
The Dad wrote a book and none in the community addressed these design flaws
and bugs
Jr. crafted a worm that escaped or was let free on the world. Not zero
day, no criminal
element, no national security enemy. The BSD folk seem to have learned
this lesson.
Second: "Target"... clearly criminals were involved , national interests
& government sponsored... not likely.
The Price tag of the breach at Target is possibly astounding. Some credit
card
companies have eviscerated their limits to limit their risk. All they
have to do is
write a report.... "if Used @ Target establish limits and throttle the
limit of abuse
and liability". There are many lessons to be learned here.
Third: can wait for the new year.
Forth/Fourth: All things are not equal and too many take two things as
all the proof
needed to take a product to market. Code reviews and code review tools
need
work today. The bad guys are looking at the same code you have. Clear,
precise,
testable.... etc... It is interesting that the word code is used in so
many ways.
--
T o m M i t c h e l l
--001a11330aba743be604ee517288
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On S=
un, Dec 22, 2013 at 4:51 PM, Jonathan Thornburg <span dir=3D"ltr"><<a hr=
ef=3D"mailto:jthorn@astro.indiana.edu" target=3D"_blank">jthorn@astro.india=
na.edu</a>></span> wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex">On Sun, 22 Dec 2013, Bill Cox wrote:<br>
[[re Peter Gutmann's claim that backdoors in source-code<br>
may escape discovery in audits]]<br>
> Nonsense. =A0Most other equally capable developers should be able to d=
iscover</blockquote><div><br></div><div><br></div><div>With open source cod=
e the NSA would be foolish to install a true back door.</div><div><br></div=
>
<div>i.e. The NSA would be foolish to assume that they could craft a side d=
oor in open=A0</div><div>source code that would withstand the scrutiny of a=
nother nations security agency</div><div>(ANSA). =A0The folk I have encount=
ered that work there (short and old list) are not</div>
<div>foolish or stupid. =A0 Their data integrity folk are darn good.</div><=
div><br></div><div>I can see weaknesses to establish a class of ability or =
a time window. =A0 For example in</div><div>the days that =A0RSA =A0and the=
NSA =A0negotiated the $10M contract FPGA and ASIC attacks</div>
<div>were the tools of a rare and limited set of nations and corporations. =
=A0 =A0My memory may=A0</div><div>be fading but I recall this time frame an=
d believe I heard "smart" folk indicate that this was=A0</div><di=
v>not clearly beyond the tools of the spooks but was beyond the tool reach =
of even organized=A0</div>
<div>crime at that time. =A0Key concept =A0"at that time".</div><=
div><br></div><div>I make weakness level security decisions all the time. =
=A0 I do not have the worlds strongest=A0</div><div>lock on my home. =A0 I =
have also not replaced the locks on my car. =A0 My gym locker lock is</div>
<div>an easy to open high school grade combination padlock. =A0 Most of the=
se locks I can still</div><div>open with my eyes closed in moments the same=
as I could =A0back in high school.</div><div><br></div><div>Down the road =
is a high voltage transformer with a lock on it. =A0 OK it looks like a loc=
k=A0</div>
<div>but is a seal in the shape of a padlock. =A0 It is made of aluminum(?)=
for the most part and</div><div>is designed to be cut off with cutters. =
=A0The same as used to cut heavy aluminum and copper=A0</div><div>cables. =
=A0 It is tamper evident, it should withstand an attack for a little bit of=
time with</div>
<div>a hammer or bashing with a rock. =A0 If a teenager busted in and fried=
his little brain till</div><div>it burst the power company clearly is not =
maintaining an attractive nuisance. There is=A0</div><div>no master key to =
be lost. =A0It could be made of more durable material like hardened steel=
=A0</div>
<div>and more but it does not need to be.</div><div><br></div><div>My thoug=
hts on this is that if you wish to be NSA proof you have some work to do.</=
div><div><br></div><div>All of this does take me to a couple places:</div>
<div><br></div><div>First is a reminder of the Morris worm attacks.</div><d=
iv>The Dad wrote a book and none in the community addressed these design fl=
aws and bugs</div><div>Jr. crafted a worm that escaped or was let free on t=
he world. =A0Not zero day, no criminal</div>
<div>element, no national security enemy. =A0The BSD folk seem to have lear=
ned this lesson.</div><div><br></div><div>Second: =A0"Target"... =
clearly criminals were involved , =A0national interests & government sp=
onsored... not likely. =A0</div>
<div>The Price tag of the breach at Target is possibly astounding. =A0Some =
credit card=A0</div><div>companies have eviscerated their limits to limit t=
heir risk. =A0 All they have to do is=A0</div><div>write a report.... "=
;if Used @ Target establish limits and throttle the limit of abuse</div>
<div>and liability". =A0There are many lessons to be learned here.</di=
v><div><br></div><div>Third: =A0can wait for the new year.=A0</div><div><br=
></div><div>Forth/Fourth: =A0 All things are not equal and too many take tw=
o things as all the proof</div>
<div>needed to take a product to market. =A0 Code reviews and code review t=
ools need</div><div>work today. =A0 The bad guys are looking at the same co=
de you have. =A0 Clear, precise,</div><div>testable.... =A0etc... It is int=
eresting that the word code is used in so many ways.</div>
<div><br></div><div><br></div><div><br></div><div><br></div><div><br></div>=
<div><br></div><div><br></div><div><br></div></div><br clear=3D"all"><div><=
br></div>-- <br><div dir=3D"ltr">=A0 T o m =A0 =A0M i t c h e l l</div>
</div></div>
--001a11330aba743be604ee517288--
--===============1680224505858856458==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
The cryptography mailing list
cryptography@metzdowd.com
http://www.metzdowd.com/mailman/listinfo/cryptography
--===============1680224505858856458==--
