[extropy-chat] Encryption revolution

Harvey Newstrom mail at HarveyNewstrom.com
Sun Dec 7 17:53:00 UTC 2003


Mike Lorrey wrote,
> > --- Technotranscendence <neptune at superlink.net> wrote:
> > Does anyone seriously think it is unbreakable?  I believe
> > it's more of a matter of not yet finding a way to break it.
>
> Well, the system is merely a means of key transmission that
> is not crackable, in that it is able to easily detect 
> interception and take countermeasures. It says nothing about 
> the security of the cryptosystem that generates the keys 
> themselves.

Technotrascendence is right about this merely being temporarily unbreakable.
Unbreakable techniques come and go all the time.  They are theoretically
unbreakable until someone figures out a way to break it.  Sometimes there
was a flaw in the theories.  Usually, it is cracked using an unexpected
trick that does not violate the theoretical proof in any way.  For example,
encrypted passwords were once thought to be unbreakable.  People calculated
that it would take billions of years to try all the passwords to find the
right one.  But hackers noticed that people didn't really choose random
passwords.  They chose English words from their small vocabularies of a few
thousand words.  The key space was magnitudes weaker than theoretically
predicted.  A dictionary attack trying English words broke most
English-speakers' passwords fairly quickly.  In this day of new physics and
rapid advancement, even the laws of physics may be subject to change and/or
new methods discovered that will invalidate previous theories.

Mike is exactly right that this only solves the key-exchange problem, if it
even does that.  It does not address algorithmic flaws or operations flaws.
Common operational attacks are still available for use against this
technology.  Even if the keys are created and exchanged securely, other
methods of attack are not blocked.

A timing attack, for example, can greatly limit the key range required for
guessing if we can somehow detect the beginning of the key generation and
then detect when it comes back with an uncrackable key.  Different
algorithms take different lengths of time to calculate different keys.  By
measuring the time exactly, we can figure out how long it took the algorithm
to develop the key.  This limits the keys to only those taking this length
of time.  Based on the random mathematics involved, some keys take more time
while others take less.  Being able to limit the key range limits the
strength of the key.  The best example of a timing attack was a timing bug
in SSH using remote password encryption.  Theoretically, the system
shouldn't tell you if you have a good username with a bad password, or if
the username is bad as well.  Hackers noticed that a good username took a
few seconds to respond because the system had to decrypt the password for
comparison.  While a bad username came back immediately because there was no
password to decrypt because the username was wrong.  By timing the
responses, hackers could tell whether a username existed or not.  They could
go down a list of common names and have the system tell them whether they
were valid or not.  Theoretically, the encryption was not cracked.  But
timing differences revealed the answer anyway.  Quantum communications won't
protect from this kind of attack.

A man-in-the-middle attack, for example, is when a person masquerades as the
intended party and tricks the security system into exchanging keys with the
fake person rather than the real person.  Then all messages sent to the fake
person are readable by them, and then they re-encrypt it and forward it to
the real recipient.  The sender and the real recipient talk back and forth
using "uncrackable" encryption (which technically has not actually been
cracked), never knowing that a third party is reading all their encrypted
communications.  Quantum communications won't protect from this kind of
attack.

Plain old spying, for example, still allows a person's office or PC to be
bugged so that the spy sees everything going on, even if the data is
encrypted over the network.  They spy sees the human-readable data at each
end before it is encrypted or after it is decrypted.  The data must be made
human readable for the humans at each end to read it, and that is where the
spying occurs.  Quantum communications won't protect from this kind of
attack.

Plain old social engineering, for example, is when a bad person fools a
target into lowering security without them realizing it.  A fake e-mail
message to the person saying that they need to give their uncrackable key to
the sysadmin for backups might get the uncrackable key from a gullible
person.  Or consider fake directions on how to verify that their quantum key
generation is really secure, where the complicated directions include
resetting the key to a known key instead of the randomly generated one.
Quantum communications won't protect from this kind of attack.

A Tempest attack, for example, measures very fine changes in power draw or
electromagnetic interference to determine what a device is doing.  Imagine a
graph showing the power consumption to your device.  Random fluctuations on
the power grid are large and broad on this graph.  Power draw from most
appliances are also large discrete changes.  However, a fast computer might
be drawing different micro amounts depending on what data it is
transferring, and these changes are fast and minute.  It is theoretically
possible to extrapolate such data from the power draw.  Another example of
Tempest leaks is the slight radio static click that each keystroke makes.
Each key has a little switch inside it that makes a connection as you type.
They keys are not microscopically similar, and each one gives a slightly
different static burst that is unique.  A person doesn't even have to
recognize each key, they can statistically deduce them like a coded
cryptogram, where "e" is the most common letter in English, "the" is the
most common three-letter word, etc.  A third example of Tempest leakage is
the power leakage from your screen as you type.  Between keystrokes, it is
constant while the screen isn't changing.  With each keystroke, the screen
only changes by one letter difference.  Repeating the letter will repeat the
same delta change.  Different letters with a different number of pixels take
a different amount of energy to display.  This also gives a Tempest spy the
ability to remotely read what is on your screen as it displays.  Quantum
communications won't protect from this kind of attack.

In other words, the quantum key generation and/or transmission only solves a
specific case of security and makes it secure.  All the other security
problems still exist.

-- 
Harvey Newstrom, CISSP, CISA, CISM, IAM, IBMCP, GSEC
Certified IS Security Pro, Certified IS Auditor, Certified InfoSec Manager,
NSA Certified Assessor, IBM Certified Consultant, SANS Certified GIAC
<HarveyNewstrom.com> <Newstaff.com> 





More information about the extropy-chat mailing list