Cryptography Expert Sounds Alarm At Possible Math Hack

netbuzz writes "First we learn from Bruce Schneier that the NSA may have left itself a secret back door in an officially sanctioned cryptographic random-number generator. Now Adi Shamir is warning that a math error unknown to a chip makers but discovered by a tech-savvy terrorist could lead to serious consequences, too. Remember the Intel blunder of 1996? 'Mr. Shamir wrote that if an intelligence organization discovered a math error in a widely used chip, then security software on a PC with that chip could be "trivially broken with a single chosen message." Executing the attack would require only knowledge of the math flaw and the ability to send a "poisoned" encrypted message to a protected computer, he wrote. It would then be possible to compute the value of the secret key used by the targeted system.'"

Comments

The NSA

[proudfoot]

The problem with backdoors, is that noone can guarantee who uses them. While it allows for (possibly) justified surveillance by our government, it also allows for it by others.

The United States, or the NSA, doesn't have all the world's best cryptographers. Russia, China, etc, other nations have excellent skill in these endeavors. Ironically, by trying to protect the nation, the NSA runs the risk of opening us up to foreign espionage.

Re:The NSA

[hax0r_this]

Which is why I, for one, doubt that the back door was intentional. The approval that NSA gives is primarily for use by the US government itself, and most of the obstacles that NSA faces in spying on our own government are bureaucratic ones, not technical ones.

Re:The NSA

[Anonymous Coward]

Exactly, which is sort of the best proof against the NSA trying to do something like this. If anything they aren't that stupid and they seem to take their mission pretty seriously. Don't forget that half of their goal is to protect US signals.

I'm not sure, maybe it's election season and so some of these guys are tying to raise the specters again. The Intel bug was with floating point operations and the vast majority of cryptography doesn't use any of that. Of course it's possible that there could be other errors but the logic and integer units on chips are tested so much more thoroughly... it's possible I guess but unlikely if you ask me that they'd know of it and the commercial world wouldn't.

Also, such a bug generally would require a specific implementation to be affected. I guess they could some how exploit the windows crypto code, but even that runs on dozens of different chips so you'd need the same error to be present on all of them.

If you look back, the NSA tampered with DES, they did so to increase it's security. Don Coppersmith even wrote about it in the IBM Journal of Systems Research. I can't think of any example of there being an error or weakness that suggested their tampering. I'm all about not using some algorithm that is showing any types of weaknesses which is really what Bruce first suggested which is a fairly healthy paranoia, and we must maintain our vigilance, but it's a long way from a believable example of NSA rigging something which, if you ask me, is an unhealthy type of paranoia.

Re:The NSA

[SuperBanana]

The problem with backdoors, is that noone can guarantee who uses them.

I can't believe you got modded up to 5, Informative for pointing out something utterly, trivially obvious to this audience.

Re:The NSA

[Matthew Strahan]

The backdoor mentioned in Bruce Schneier's article requires the knowledge of a key related to the numbers in the algorithm, and the key can only be generated when generating the numbers in the algorithm (which was done by the NSA, and I'd seriously doubt that the NSA would let the key get out). So while yes, you're right in that an unsecured backdoor can be exploited by "the enemy", you've picked a bad example.

Re:The NSA

[Workaphobia]

Just as I can't believe this article itself made it to the front page. Why the hell did someone think it was newsworthy to state that vulnerabilities are bad and flaws can be exploited? This just in: The NSA keeps secrets, Schneier fears the government, and bugs in hardware platforms can theoretically hurt their users.

Re:The NSA

[digitalchinky]

Ahhh, yes, but I'm not in your back yard, so what you feel as unjust or otherwise is of no consequence to me. :-)

While I can't speak for the NSA or US laws, in Australia anyone at all can set up an organisation like the Defence Signals Directorate. It is fully legal to monitor communications of foreign origin and destination. For private individuals the vast majority of domestic transmissions are also legal to intercept. (Some exclusions surrounding radio based telephony exist) The government does have far more restrictions imposed on what they can and can't do than the general population. The DSD is prohibited from monitoring all domestic transmissions - with some exceptions. Perhaps much less widely known is that it is entirely legal for the DSD to receive domestic non-communications type signals such as RADAR. The laws are all open for public viewing. Three letter agencies like the DSD are quite transparent in what they can and cannot do. How they do it is what remains secret.

--
Signed 'Ex one of Them'

Re:The NSA

[easyTree]

Excellent US-centric rebuttal =)

Re:The NSA

[Threni]

> I can't believe you got modded up to 5, Informative for pointing out something utterly, trivially obvious to this audience.

Hmm. I'm not too suprised actually, given that `this audience` appears to be a mixture of Star Wars fan boys, HTML hairdressers and Apple apologists. I'd be more surprised to learn that more than about 2% of Slashdot readers know the first thing about how encryption systems work.

Re:The NSA

[ConceptJunkie]

Better watch out... you're getting modded Insightful too... or maybe the mods just have a sense of humor.

So...

[teh moges]

So, if a security bug is present an exploit could happen...?

Re:So...

[Jay L]

So, if a security bug is present an exploit could happen...?

Yep, that seems to be about the point of the article from what I can see.

In other news: If my grandmother had wheels, she'd be a skateboard.

Re:So...

[__aawavt7683]

Well, no shit.

What the _article_ is saying, though, is that if a mere mathematical bug is present, an exploit could happen. Perhaps you could use it so that a virus signature is calculated in just the wrong way. There -- now you don't need to read the article. Or the summary.

As a comparison, think of the recent Excel (wasn't it?) bug about adding numbers to 65536 and getting 100 000. In that case, if you're selling something, and you can arrange the sale in just the right order.. imagine the profits! Or perhaps you can manage the same sort of thing if you're selling, imagine the savings.

-DrkShadow

Original article

[sk19842]

TFA is just a summary of an article yesterday in the NYT: http://www.nytimes.com/2007/11/17/technology/17code.html?ref=technology

Re:Original article

[RuBLed]

Yup and TFA really had nothing much to do or even related with NSA's officially sanction random number generator. Mr. Shamir is talking about math error in our processor's ever increasing complexities, much like what happened in Intel back then.

There are no terrorist mentioned!! Sensationalist networkworld...

Re:First Post?

[WillRobinson]

So, how expensive do you think it would be to create a terrorist group, so you can preform these atrocities on the very people you are supposed to protect?

how many encryption schemes us floating point?

[Kuciwalker]

It seems to me that the most likely source of a math error is in the floating point unit, since floating point math is far more complex than integer math. I've always understood that most crypto is based on integer math, both because it's based on number theory and because floating point math isn't exact. Doesn't that make this sort of exploit extremely unlikely?

Re:how many encryption schemes us floating point?

[EvanED]

What?

The point the OP was trying to say was that if the error is in the FPU, that isn't used for integer calculations at all, and so wouldn't be exercised by security code. I don't know if this is true, but for instance RSA in theory is all integers.

Re:how many encryption schemes us floating point?

[larry bagina]

what? Assume there is a fpu bug... how does that cause problems with integer math?

Re:how many encryption schemes us floating point?

[tgd]

Okay, fess up. You hit submit and your first thought was "D'OH!" and you wished, as we all have, that Slashdot let you edit posts...

Re:how many encryption schemes us floating point?

[Ann Coulter]

Maybe the FPU shares circuitry with the integer instruction circuitry.

Re:how many encryption schemes us floating point?

[Traa]

Compared to cryptographic algorithms, floating point math isn't that much more complex then integer math. Also, floating point math is exact since floating points representations (like IEEE 754) are eventually all calculations and representations in bits which are always exactly reproducible.

Re:how many encryption schemes us floating point?

[Kuciwalker]

Compared to cryptographic algorithms, floating point math isn't that much more complex then integer math.

Yet the claim is that an actual error in the implementation of elementary amthematical operations on the processor could weaken a cryptographic algorithm run on that processor, even if the algorithm itself is implemented flawlessly in source. Therefore the relevant question remains "where are processor bugs most likely to occur?"

Also, floating point math is exact since floating points representations (like IEEE 754) are eventually all calculations and representations in bits which are always exactly reproducible. Also irrelevant - most applications of floating point rely on the fact that floating point numbers are sufficiently precise approximations of the reals, therefore they base their algorithms on real-number math (with hedges built in to protect against numerical instability) and are satisfied with inexact answers. Encryption algorithms depend the exact answers produced, and would therefore have to be based on the specific IEEE-specified behavior of a specific precision of floating point number. While such an encryption scheme is possible, it strikes me as unlikely and unnecessarily complex.

Re:how many encryption schemes us floating point?

[evanbd]

In the past there have existed implementations of integer math that used the floating point unit. The only one I know of off hand is the Prime95 Mersenne prime search program. I imagine there are others, though. The reason for this is simply that the floating point units were faster -- more bits per operation. The x87 FPU instructions operate on 80 bit floating point numbers, compared to 32 bit integers (the floating point numbers can't use the exponent bits, but it's still more than 32 by a lot). If your code is sufficiently parallel, and you put forth the effort, there was a performance gain to be had. I don't know if this is still the case in modern CPUs (especially 64 bit ones), but it's entirely possible to do high-performance integer math on the floating point unit.

Re:how many encryption schemes us floating point?

[gweihir]

Actually IEEE 754 does not describe what algorithms have to be used. It does, however, require that calculations have to be exact in every result bit and recommends to use longer numbers internally and well-conditioned algorithms. Sometimes implementers screw up, though.

Re:how many encryption schemes us floating point?

[gweihir]

The point the OP was trying to say was that if the error is in the FPU, that isn't used for integer calculations at all, and so wouldn't be exercised by security code. I don't know if this is true, but for instance RSA in theory is all integers.

The FPU can be used for integer math. IEEE 754 states that all results from Integer calculations that can be exact, need to be. The exponent gets denormalized for this case. So DOUBLE, for example, can be used as 54 bit unsigned Integer plus sign bit. I have used this occasionally in languages with no 64 bit integers, wne 32 bit were not enough.

Re:how many encryption schemes us floating point?

[JensenDied]

Thats like saying my car stereo doesn't work because my passenger side window is stuck up.

Re:how many encryption schemes us floating point?

[EvanED]

Yes, but again, not likely to be used in security applications. Something like RSA needs either an entirely different representation of numbers or a BigInteger-style class for instance.

I could still be wrong, but I still think the poster who started this thread is onto something.

Re:how many encryption schemes us floating point?

[stephentyrone]

[pedantic]53 bits, actually. Double precision has an explicit 52 bit significand with one implicit bit for normal numbers. So all integers that can be represented in 53 bits are exactly representable in double, but half of the 54 bit integers are not -- those with the least significant bit set.

I'm not sure what you mean by "the exponent gets denormalized for this case." Denormal, when used to talk about floating-point, refers to numbers with the smallest exponent, for which there is no implicit leading bit. In double, these numbers range from just below 2^-1022 to 2^-1074 -- i.e., way smaller than any integer.[/pedantic]

Floating point can be used, as you noted, to do integer arithmetic on systems that don't have efficient 64-bit integer operations, and IEEE-754 provides the inexact flag to confirm that no roundings occured in the course of a sequence of floating-point computations. That said, 53 bits (or even 64 bits, using the x87 fpu) isn't nearly large enough for serious cryptographic work.

Re:how many encryption schemes us floating point?

[gweihir]

Ah, did not look into my copy of IEEE 754. Could be 52 bits.

As to denormalized, if I remember correctly the matisse part of an IEEE754 number should be between 0.5 and 1.

Re:how many encryption schemes us floating point?

[lpontiac]

Maybe the FPU shares circuitry with the integer instruction circuitry.

I'm guessing the people modding you +1 funny don't realise that earlier (pre-Prescott) Pentium 4 processors implemented integer multiplication instructions using the floating point unit.

Re:how many encryption schemes us floating point?

[gweihir]

[pedantic]53 bits, actually. Double precision has an explicit 52 bit significand with one implicit bit for normal numbers. So all integers that can be represented in 53 bits are exactly representable in double, but half of the 54 bit integers are not -- those with the least significant bit set.

Hehe, no! It is 52 bits plus a sign. A 2s complement 53 bit number can represent one number more, namely the negativemost integer. But IEEE754 has both a negative and a positive zero, while 2s complement has only one.

So it is really 52 bit unsigned and a sign bit.

Re:how many encryption schemes us floating point?

[poot_rootbeer]

The x87 FPU instructions operate on 80 bit floating point numbers, compared to 32 bit integers

Surely the extra word-width for floating point operations is to effect greater precision, not speed? Those additional bits are used to ensure that a fraction like "1/3" is represented as 1365/4096 instead of just 11/32.

I suppose there are ways to misuse the floating point registers for fast parallel integer math, but I'm not a character on "Numb3rs" so I'm not familiar with them.

Re:how many encryption schemes us floating point?

[evanbd]

Well, of course that's their *intended* use. However, consider the problem of multiplying two 1000-bit integers. It's almost exactly analagous to multiply two 10-digit numbers on paper -- you use long multiplication. When those by hand, you'll find yourself doing 10*10 1-digit multiplication problems, and then 9 addition problems. Now imagine that instead of multiplying them 1 digit at a time, you had memorized the multiplication table out to 100x100, and were doing two digits at a time. You would now (effectively) be multiplying two 5-digit numbers, which requires 25 multiplications and 4 adds. (For example, you could do 1234*5678 as 1000*8 + 200*8 + 30*8 + 4*8 + 1000*70 + ... +4*5000, or you could do it as 1200*78 + 34*78 + 1200*5600 + 34*5600. The latter way is much faster, provided you have the ability to operate on 2 digits at a time instead of one.

When trying to multiply 1000-bit numbers (or, in the case of prime95, much larger), on 32 bit hardware you multiply in blocks of 32 bits. Since the 80-bit floating point format provides for 64 bits of significand (the non-exponent part), you can simply ignore the exponent and use it to do 64 bit integer math (well, almost, but close enough for our purposes). When you can process twice as many bits per operation, you need 1/4 the operations. With a floating point unit capable of a comparable number of operations per second to the integer unit (I think this was the case; it's been too long since I followed architecture details for me to be sure), you'd get a 4x speed improvement. By the time you accounted for weird registers and having to convert numbers back and forth between 64-bit ints and 80-bit floats, you'd have less than a 4x improvement in practice, but it would still be quite large.

Re:how many encryption schemes us floating point?

[ajs318]

That is done so that the mantissa begins with a one. You don't actually need to denormalise at all. You only lose accuracy if there are more digits in the answer than will fit in your chosen representation. Obviously, a recurring fraction won't fit into any representation (example: 0.1 in decimal is 0.0001100110011 ... 0011 ... in binary). Note that if you isolate the recurring part, the ratio between it and the same number of ones is the exact fraction. i.e. 0011 / 1111 = 3 / 15. But there is one extra 0 in front of it, so it should be 3 / 30 = 0.1. This works in other bases as well (if you replace "1" by "biggest digit") e.g. 0.66666... decimal = 6 / 9 = 2/3.

Historically, not all computer systems have used the same floating-point mathematics, especially when it was being done in software. British 8-bit micros in particular, unconstrained by requirements to line up word boundaries, used to use a 40-bit representation for floating-point values. Eight bits for the exponent and 32 bits for the mantissa. Now we have hardware to do floating-point maths, there probably is more consistency from one machine to another.

Re:how many encryption schemes us floating point?

[sexconker]

I think the error is in your bullshitting unit.
You obviously clicked a button and typed some words, but you really don't know what you're talking about.

This is the internet, and you will always get called on your bull.

Re:how many encryption schemes us floating point?

[stephentyrone]

Floating-point numbers are not 2s-complement integers, but neither are they sign-magnitude integers. They are a completely separate format. Double precision numbers have a 64-bit encoding, made up of a single sign bit, an 11-bit exponent, and a 52 bit significand. If you assign each field it's value as an unsigned integer, the floating point number has the value:

(-1)^(sign) * 2^(exponent - 1023) * (1 + 2^(-52)*significand)

for exponents that are neither zero nor 2047 (the maximum possible exponent). If the exponent is zero, then the floating point number has the value:

(-1)^(sign) * 2^(-1074) * significand

if the exponent is 2047, then the floating-point number is either an infinity or NaN.

The wikipedia page has a decent description of the format, I encourage you to read it: http://en.wikipedia.org/wiki/IEEE_754

What's the point of all this? All integers between -2^53 and 2^53 really are representable as double precision numbers:

-2^53: sign = 1, exponent = 1076, significand = 0x0.
-2^53 + 1: sign = 1, exponent = 1075, significand = 0xfffffffffffff.
-2^53 + 2: sign = 1, exponent = 1075, significand = 0xffffffffffffe.
.
.
.
-2^52 - 1: sign = 1, exponent = 1075, significand = 0x1.
-2^52: sign = 1, exponent = 1075, significand = 0x0.
.
.
.
-3: sign = 1, exponent = 1024, significand = 0x8000000000000.
-2: sign = 1, exponent = 1024, significand = 0x0.
-1: sign = 1, exponent = 1023, significand = 0x0.
-0: sign = 1, exponent = 0, significand = 0x0.
+0: sign = 0, exponent = 0, significand = 0x0.
1: sign = 0, exponent = 1023, significand = 0x0.
2: sign = 0, exponent = 1024, significand = 0x0.
3: sign = 0, exponent = 1024, significand = 0x8000000000000.
4: sign = 0, exponent = 1025, significand = 0x0.
5: sign = 0, exponent = 1025, significand = 0x4000000000000.
6: sign = 0, exponent = 1025, significand = 0x8000000000000.
7: sign = 0, exponent = 1025, significand = 0xc000000000000.
.
.
.
2^53 - 1: sign = 0, exponent = 1075, significand = 0xfffffffffffff.
2^53: sign = 0, exponent = 1076, significand = 0x0.

(Note that the floating point number with sign = 0, exponent = 1076, and significand = 0x1 has value 2^53 + 2, so there is no floating point representation of 2^53 + 1. Ditto for -2^53 - 1).

Re:how many encryption schemes us floating point?

[stephentyrone]

Now we have hardware to do floating-point maths, there probably is more consistency from one machine to another.

Yes, IEEE-754 (or IEC-60559:1989, for non-americans) pinned down single and double precision floating-point arithmetic over 20 years ago (up to a couple very rarely encountered corner cases).

Re:how many encryption schemes us floating point?

[ajs318]

If according to IEC-60559:1989, (2007 - 1989) > 20 then it probably isn't a very good standard to follow.

Perhaps that's what happened with Microsoft Excel .....

Re:how many encryption schemes us floating point?

[stephentyrone]

IEEE-754 is from 1985. It took 4 years for the rest of the world to get on board. 2007 - 1985 > 20. For the record, Excel's arithmetic is *not* IEEE-754 compliant, much to the numerical community's chagrin.

WTF "terrorist"

[Timothy Brownawell]

Wouldn't pulling off something like this require a level of knowledge and togetherness more in line with a government agency, rather than a "terrorist" group? The results would also be more in line with what a government agency would want ("we have your secrets, ha!"), rather than what a terrorist would want ("Maybe I can't blow up a bridge / poison your water supply / whatever. But then maybe I can. So while you're deciding whether to go do things or hide under your bed all day, I have a question for you: do you feel lucky?").

Re:WTF "terrorist"

[the eric conspiracy]

While government agencies surely have the upper hand here, there is always the possibility that a mole in the NSA gets their hands on the backdoor information, or a lone genius working in say Russia finds a mathematical flaw in the system.

As far as poisoning your water supply etc. lookie here:

http://sandia.gov/scada/home.htm

Hardware errors are a potential problem, but they are #3 on the list after human and software problems. Why search for hardware problems when the first two are far more likely to bear fruit?

Re:WTF "terrorist"

[Anonymous Coward]

...more in line with a government agency, rather than a "terrorist" group?

You speak as if the two are mutually exclusive...

Re:WTF "terrorist"

[gnasher719]

Wouldn't pulling off something like this require a level of knowledge and togetherness more in line with a government agency, rather than a "terrorist" group? Not necessarily. If you have a fault in a processor that will get a certain calculation always wrong in a predictable way, and the source code for a decryption engine available, then this _may_ be enough for a talented hacker with lots of time, with the help of a good mathematician, to crack the system. Depends on what the fault is.

Re:First Post?

[andruk]

"Lopez, bring up the vehicle"
"Shotgun"
"Shotgun...fuck"

Terrorists?

[Anonymous Coward]

Why does everything have to come back to terrorists? They kill a small number of people and people go nuts about them. Hunger, disease, motor cars, lightning, ... All these things have killed far more people than terrorists and they don't get brought up at every *FUCKING* opportunity. Yeah. I'm pissed off. If the terrorism obsessed turned on their brains for a picosecond they might realise that they have caused far more damage than any terrorist has.

Re:Terrorists?

[Ant P.]

I turned off my mod ability when I realised all the mod points in the world won't make it a better place to live in.

Re:Terrorists?

[zsouthboy]

parent +1 excellent point, please, mods.

Re:Terrorists?

[LaughingCoder]

Hunger, disease, motor cars, lightning, ... All these things have killed far more people than terrorists

It's about the derivative. Terrorism deaths are growing geometrically. The other causes of death you mention are essentially steady-state. Think about it. In the 70s terrorism acts killed in the single digits (Munich). In the 80s, individual acts of terror killed in the 100s (Lockerbie). In the 90s/00's they have upped the ante to 1000's. And if they get their hands on a dirty bomb or chemical weapon, they will kill 10s or 100s of thousands. This is called geometric growth, and it doesn't take more than a 7th grade math background to easily predict that deaths due to terrorism will eventually (within 10 years at current rates) eclipse all those examples you gave. This is why people are concerned.

Re:Terrorists?

[Wog]

"All these things have killed far more people than terrorists and they don't get brought up at every *FUCKING* opportunity."

So it doesn't bother you, because such opportunities rarely present themselves. Right?

Re:Terrorists?

[gweihir]

Terrorists will not kill millions. Far too bad press for them. They are not waging a physical war, but one of the mind. As long as uou US sheep keep being afraid, they may not even consider serious new killings. After all they do want terror, not real damage. 9/11 was a bit excessive on the damage side, but, to misquite a Geman banke, 9/11 was "peanuts" in the greater sheme of things. The reaction to 9/11 was not, unfortunately. The reaction may by now have caused a damage multiplication by 1000 or even more. And the reaction is mainly driven by a fundamental non-understanding how terrorism works.

The right reaction to terrorist action is to call them common criminals and set ordinary law enforcement on them, but otherwise mostly ignore them. Maybe a "This is the best you can do? We did not even suffer a serious scratch! See, a week later we are back to normel!". That would rob them of their triumph entirely. Effective, cheap and of immense deterrent value. Unfortunately this reaction needs a greatness that most politicians do not have today. I am certain that the backers of 9/11 did not gloat the most at the towers falling. They did gloat the most at the panic, fear and uncertainity in the years after. Because only then could they see that they had dealt a devastating blow.

Re:Terrorists?

[LaughingCoder]

extrapolating way off into the future and treating it as fact.

Where did I treat it as fact? I cited facts. The trend is undeniable. True, the trend could stop, or reverse. But so far, it hasn't. Ignore trends at your own peril.

Re:Terrorists?

[at_slashdot]

You have a point but I would rather talk about wars not about terrorism because wars killed million of people. As for lightning there's not much we can't do about it, unless you prefer to walk in Faraday cages for the rest of your life -- btw, I assume that caged terrorists cannot be hit by lighting...

Re:Terrorists?

[bigberk]

I agree, and I'd say the bigger threat in the context of this article is organized crime. Take for example the botnets/zombie networks, which are an advanced network technology made possible through software exploits. These technology attacks are leveraged for spamming, marketing, denial of service and other forms of extortion.

As far as threats to the nation, the spam and popups are just the "tip of the iceberg".

Obviously, the criminals use some pretty smart minds to seek and exploit software weaknesses. I think it's totally feasible that such a criminal group could be involved in more serious attacks that could compromise economic systems, national infrastructure, financial systems, etc.

Re:Terrorists?

[jimicus]

A very good friend of mine unwittingly gave me an insight which I think explains it very nicely.

As far as I can tell, his source of news is "whatever the headlines in the mainstream media are this week". When the corrections come out much more quietly six months later, buried underneath an advert for a home course in Swahili, he misses them entirely.

As far as he's concerned, Osama bin Laden is from Afghanistan (and is probably still living in a cave there), Saddam Hussein had weapons of mass destruction and Jean Charles de Menzes was wearing a heavy coat and running away from men shouting "Armed police, stop!". None of which are true, but all of which were reported as such when the news first broke.

Re:Terrorists?

[synthespian]

It's about the derivative. Terrorism deaths are growing geometrically. The other causes of death you mention are essentially steady-state.

They are? I don't know about that, have you read the recent numbers on hemorrhagic Dengue fever in Brazil, for instance? Did you consider the recent Bangladesh cyclone? I'd like to see how you treated the 1970 one that killed 500,000 people.

LOL :-)

Anyways, didn't the US military say terrorist attacks in Iraq were going down?

Where the hell do you get your facts from?

Re:Terrorists?

[djmurdoch]

Bruce Schneier is brilliant, no question about it, but the man has terrorists on his brain, and ever since 9/11 they have been the perpetual example in Crypto-Gram.

Are there two Bruce Schneiers? The man you are describing is nothing like the one I read (other than being pretty smart, I guess). This is a typical recent example. His main message about terrorists has been to put the terrorist threat in perspective and not to overreact to it. (He was mentioned in the summary because another theme he pursues is cryptography.)

Re:Terrorists?

[KevinIsOwn]

As an AC pointed out, you absolutely did not cite facts. You mentioned events, but even so, some years have had more acts of terrorism than others, and you are selecting events to try to fit into a trend you just thought up. If you find an actual study that takes into account all acts of terrorism and can find a geometric relationship, I'd be extremely surprised.

(Even your suggestion of terrorism killing people in the single digits is wrong)- The RAF group is just one quick mention of a group that was actively involved in terrorism and would bring the numbers out of the single digits for the the 70s and 80s)

Re:Terrorists?

[LaughingCoder]

Well, I can't really vouch for the accuracy of this reference (http://users.erols.com/mwhite28/warstat8.htm#Total), but according to a chart on that web page the overall worldwide death rate per capita (due to all causes, old age, disease, war, famine, etc) has been steadily (roughly linearly) falling, and is at its lowest level ever. Now, as I pointed out, the number of deaths resulting from individual acts of terrorism (not the aggregate) has been increasing geometrically over the past 3 decades. This is not rocket science, and it is not debatable. The 3 major terrorist incidents I cited demonstrate this phenomenon. And only a fool would "pretend" that those responsible for these terrorist acts would not use a nuke or chemical weapon in a large Western city if they had the chance. And I think we all know that would kill 10s or 100s of thousands. It amazes me that people on \. are so limited in their mathematical skills that they cannot recognize a simple geometric progression when they see one. Or they simply refuse to extrapolate it to its logical next data-point. Regardless, I stand by my original comment and await someone with a clue to refute it.

Re:Terrorists?

[xouumalperxe]

Working as intended.

At least from the terrorists' point of view. I mean, this is exactly what terrorism is, right?

Re:Terrorists?

[arkanes]

You imply that within the next 30 years (my lifetime, and probably yours), terrorists will extinguish human life on earth. HOLY SHIT EVERYBODY PANIC.

Re:Terrorists?

[LaughingCoder]

I implied nothing of the kind. What I "implied" is clearly written up above. I merely took issue with the OP's sarcastic claim that we should not be so worried about terrorism because the real killers of people are famine, disease and car accidents. I pointed out that, at the rate at which terrorists are increasing their capabilities, it is plausible, perhaps even likely, that there will be a terrorist act that kills 10s or 100s of thousands of people at one time, within the next decade. As regards extinguishing all human life (by extrapolating a factor of 10 per decade for 30 years), this is obviously not going to happen until/unless some developed nation produces a weapon capable of such a deed, and the terrorists manage to get their hands on it. Of course should such a weapon become available, the probability does then become non-zero, unfortunately.

Re:Terrorists?

[LaughingCoder]

I specifically stated that I was talking about individual acts of terrorism. Basically, put another way, I was pointing out that the capabilities of terrorists to kill are geometrically increasing. This is undeniable, and I cited 3 well-known "events" that demonstrate this. Of course that does not mean that every terrorist act reflects their full capabilities. Obviously there will still be lesser-scoped acts of terrorism.

So just to be clear, is it your position that it will never be possible for terrorists to kill 10s or 100s of thousands of people with one strike? If that is the case, then we are indeed foolish to worry about terrorism as the OP claimed. We could simply let them kill thousands of people at a time (their current demonstrated capability) and treat each "event" like a crime and try to lock up the perpetrators (if they haven't incinerated themselves already).

Re:Terrorists?

[arkanes]

There was another poster who quite clearly, rationally, and correctly identified why people tend to react (much) more strongly to terrorism (or even the threat of terrorism) than they do to concrete but impersonal threats. Your post, to the extent that it had anything of factual value in it, was that terrorism is an exponentially growing threat. It's obviously *not* an exponentially growing threat - you're just choosing timescales that let you make that claim. For example, deaths due to individual terrorist attacks have been dropping since 9/11. While it's certainly possible that there will be a massive nuclear terrorist strike sometime in the future, it's not some sort of "geometric progression" of threat that will be responsible. The means for such an attack have been around for decades, just as the ability to crash a plane into a building has been around since the first time someone hijacked a plane.

Your argument is useless and trivial. To the extent that it provides any useful information, it does so entirely on accident.

Re:Terrorists?

[LaughingCoder]

Apparently the fact that the capabilities of terrorist organizations to kill has been demonstrably increasing in the past 3 decades is lost on you, and many here on \. Of course it is no accident that their ability to kill on a large scale is increasing. There are nation-states sponsoring and harboring them; they actively recruit; they have well-funded training camps. Theirs has been a deliberate and steady progression from a ragtag group that could do little more than threaten a few Olympic athletes, to an entity that can bring down two massive skyscrapers and kill thousands in one act. Please forgive me for pointing all of that out. Let's just ignore them and focus on car accidents then, like the OP suggested.

Re:Terrorists?

[arkanes]

They've had this *capability* for decades. If you want to actually think anything useful about terrorists (as opposed to politically motivated fearmongering) you need to talk about why they've had more *success* lately. This is totally unrelated to any made up geometric progression you may think you see.

Terrorism is not a significant threat to human life right now. It never has been - we've had reasonable safeguards in place for years. They aren't any more of a threat now than they were before 9/11 (although there are more of them, due in no small part to ridiculous and counter-productive foreign policy on the part of the US). If your goal is to actually reduce human deaths worldwide, stopping terrorism should be way, way down on your list of priorities. If it's not, then your goal is something other than preventing deaths.

Re:Terrorists?

[LaughingCoder]

If the terrorists had the "capability" for decades as you claim, they would no doubt have used it. 9/11 was not a simple plane hijacking. It was planned years in advance. The hijackers were enrolled in flight school to learn to fly large jets. All the while a government, the Taliban, protected and supported them. This is a long way from some nut-job whipping out a gun or a bomb and hijacking a plane. Do you honestly believe a pilot would ram his jet into a skyscraper on the orders of a hijacker? No, the hijackers had to be able to fly the jet. This required years of advanced planning and lots of money, and a well-oiled organization. This represents a quantum leap in capabilities for these terrorist groups. I know you wish this wasn't the case as do I, but we cannot simply bury our heads in the sand and pretend it isn't so.

Sadly, it is you who is politically motivated. I am merely pointing out that which should be obvious to anybody who has been paying attention these last 30 years. You are no doubt among those who believe the US "had it coming" (you suggest as much in your comment). And it upsets you that the US is trying to do something about the problem. So you and your ilk make silly statements like "what about car accidents?" I have seen this pathetic attempt at misdirection many times here on \., which is why I chimed in on this thread.

One last comment. You state that terrorists are not any more of a threat than they were before 9/11. On this I think we agree, though the reason why that is true would probably not be something we can agree upon. I see a steady and deliberate progression of terrorists capabilities starting in the 70s which has been stalled, and perhaps even reversed by the actions taken by the West since 9/11. Nations that formerly supported terrorists are now under new leadership, or are backing away from those positions. Many training bases have been dismantled. Many terrorist leaders have been captured or killed. Had we simply shrugged and turned our attention to adding side airbags to our cars after 9/11, leaving the Taliban (and countless others) alone, do you really believe they would not have used that time to inflict further damage on the West? Based on the evidence that is a preposterously naive position.

Re:Terrorists?

[arkanes]

Acknowledging that behavior has consequences isn't the same as saying that America had it coming. I deplore what happened on 9/11, and every terrorist incident before or after. But that doesn't meant that I'm just going to stuff the flag in my ears and ignore the fact that yes, Americas policies have a great deal to do with engendering the kind of hate that leads to terrorism. Nobody suicide bombs Switzerland. I also am not shy of denouncing reprehensible acts that the US has undertaken, both the current administration and past ones. Ignoring it, or, worse, saying it's okay because we're the good guys, isn't doing anyone any favors.

Car accidents kill more people than terrorism ever has. Therefore, making terrorism the top priority is not justifiable *on the grounds of saving lives*. The "war on terror" has in fact killed (many) more innocent people, both directly and indirectly, than 9/11 did. Again, unjustifiable on the grounds of saving lives (at least as planned and executed - I certainly am willing to speculate about possible strategies that wouldn't have killed so many people and created an entire new generation of people who hate the US).

If your priority is terrorism, then saving lives is not your real objective. You have some other goal, whether you're willing to admit it or not.

But you're deluding yourself if you that an actual reduction in worldwide terrorism, or even the capabilities of terrorism, is the actual result (or, I suspect, even the intention) of the war on terror. Certainly the invasion of Iraq, a nation with at best very tenuous ties to terrorism (Saddam was a secular, military dictator and Iraq was one of the least Islamicist nations in the middle east prior to the US invasion - because we'd set up Saddam as a counterpart to the Ayatollah in Iran), has done nothing to help. To the extent that "we fight them over there so we don't fight them here" is true, it's because we're essentially using US troops as human decoys. I bet that hurts morale a lot more than people who don't wear yellow ribbon pins.

All this doesn't mean that terrorism should simply be ignored as a threat - it's real, even if many of the scenarios bandied about are more fantasy than reality. But we're going to spend a trillion and a half dollars - an amount of money so vast I have trouble comprehending it - on just the Iraq invasion, along with a quite large loss of life. That's not about making the world any safer.

Also, the fact that you'd accuse me of thinking 9/11 was justified says far more about you than it does about me. Fuck you, you bigoted mother fucker.

Re:Terrorists?

[LaughingCoder]

First off, I owe you an apology. When I accused you of sanctioning what happened on 9/11, I stepped over the line. Your reaction to my accusation was completely justified and I accept your criticism. I offer in my defense only the meager observation that I am so accustomed to dealing with rampant and rabid anti-Americanism on this forum that sometimes I see it where I shouldn't. You never said anything that would suggest you thought the US deserved 9/11. All you said was that US policies have contributed to an increased number of terrorists. I don't agree with that assessment, but your statement is far from a justification of terrorism against the US.

Car accidents kill more people than terrorism ever has.

There you go again. This whole discussion started with my observation that it's the trend that matters. I stated that deaths due to car accidents are not on the increase (per capita), but that deaths due to terrorism are increasing dramatically. This is a true statement that cannot be refuted. I stated that terrorist organizations are significantly more sophisticated and capable now than they were 30 years ago. Again, the facts support my argument. Lastly I postulated that, at the current rate of expansion, left alone, the terrorists would likely gain the ability to kill 10s or 100s of thousands of people in one attack. This is a simple extrapolation of an undeniable trend. Because of this, I believe that we need to be vigilant and proactive to prevent such a catastrophe from occurring. Clearly the threat is on a completely different level from car accidents and to compare it with deaths due to car accidents is disingenuous and, frankly, irrelevant.

You raise some valid points as regards Iraq. Clearly the expense in lives and dollars is not commensurate with the risk. However, your characterization of US troops as decoys is, I believe, misguided. The purpose of the military is two-fold. First, the reason we have a military is to prevent "the bad guys" from attacking the homeland. Second, we have a military to defend the homeland from attackers. Your statement implies that anytime the military is used in a proactive, preventative way, the troops are decoys. This, I think, is a gross over-simplification, and is frankly insulting to those who serve to protect and defend.

Re:Dupe

[sk19842]

Sorta, but not quite a dupe. This post also includes speculation about what would happen if there were math errors in chips. The reference to Schneier's discovery about elliptic curve PRNG's was just to whet our appetite. But deliberate backdoors and ones created by mistake are two different things.

Unlikely

[Anonymous Coward]

The math errors tend to be in obscure and complex operations - store long double, divide double, etc.
Important cryptographic stuff tends to use extremely primitive operations, often just shifts, adds, xors, and indirection.

Re:Unlikely

[dominious]

extremely primitive operations banging stones, throwing chairs, monkey boy dance?

don't understand

[TheSHAD0W]

I'm not sure how Mr. Shamir envisions a simple "math error" causing a problem. A buffer overflow exploit, perhaps, but not a math error... A user on a flawed but protected computer receives a "poisoned" encrypted message, opens it... And what happens? The math error, say, elicits some aspects of the user's private key in the decoded message; but how does the attacker then obtain that information without already having access to the machine? Further outgoing messages wouldn't have any usable information, no modern cryptosystem allows a received message from affecting any such message; a code exploit might affect the system's PRNG, but a math error shouldn't feed back to the PRNG unless it was horribly implemented. Without something affecting the user's machine's code execution, I can't see any way for an attacker to utilize a math error in a decryption function.

Re:don't understand

[SiliconEntity]

I can't see any way for an attacker to utilize a math error in a decryption function

Actually this is a common attack scenario in security protocol analysis. While it does not always happen in real life there are ways it can occur. For example, you try to decrypt the message and get garbage. So what do you do? You send the garbage back to the guy, saying, I couldn't read your message, all I got was this junk. Now you have been tricked into acting as what is called an "oracle" for the decryption function. This opens up a number of attacks which is why the best cryptosystems are immune to such problems.

Re:don't understand

[iminplaya]

I'm not sure how Mr. Shamir envisions a simple "math error" causing a problem.

From the horse's mouth Also note the update at the top of the page.

Re:don't understand

[TheSHAD0W]

But the point I was trying to make was, how would the attacker retrieve that information?

Re:don't understand

[TheSHAD0W]

Okay, I understand the attack now, but I don't see how an attacker can utilize this bug without access to the output of the decryption of the "poisoned" message. Given such access, the attacker doesn't need to use such an exploit, he already knows what is on the target's computer.

Re:don't understand

[Jarjarthejedi]

Wow...and I thought I knew the extend of user stupidity, sending back an unsolicited message because you couldn't decrypt it (since it's fairly obvious these people wouldn't be simply sitting around waiting for people to ask them to send an encrypted message) seems to me to be quite absurd, sending it back partially decrypted even more so.

I mean, I could understand it if it was solicited communications, but what are the odds you'll happen to start into an encrypted conversation with someone who just wants your key?

Re:don't understand

[garompeta]

>I can't see any way for an attacker to utilize a math error in a decryption function.

In the same way you aren't the "S" in RSA. Give him some credit, will you?

Re:don't understand

[eli pabst]

In the same way you aren't the "S" in RSA.

He's also the same 'S' in the FMS attack that first cracked the WEP encryption protocol. Like Schneier, I'd trust his opinion until it's proven otherwise.

Re:don't understand

[PitaBred]

On the other hand, if you had taken control of someone's account, then you'd be masquerading as the intended recipient. Seems perfectly reasonable to work with someone who they'd think should be getting the message.

Re:don't understand

[drfireman]

You send the garbage back to the guy, saying, I couldn't read your message, all I got was this junk. While this could certainly happen, the brief reports I've seen suggest that the math error is in itself sufficient, you don't also need the targeted user to be incredibly stupid.

Re:don't understand

[drfireman]

From the brief report, it sounds like any bug whatsoever would be sufficient to compromise any system. In the slightly more detailed version to which someone posted a link, you see that the vulnerability requires knowing of a pair of integers whose product is computed incorrectly. It also requires some more minor assumptions.

Alas, Shamir's post didn't clarify, at least to my undereducated ears, how the targeted machines are coerced into producing a reply. Do most machines have ports open that will engage in RSA-based dialogues?

Re:don't understand

[dgatwood]

I think the issue is that an incorrect value in a certain critical operation in the construction of the private and public keys creates a mathematical relationship between the public and private keys that otherwise would not exist, and therefore you can then determine enough information about the private key to significantly weaken it, if not extract it outright, merely by encrypting a particular message using the public key. That said. I only skimmed the article, so I could be way off.

Re:don't understand

[poot_rootbeer]

A user on a flawed but protected computer receives a "poisoned" encrypted message, opens it... And what happens?

Think about how robots' heads explode in sci-fi when they are asked to consider a paradox such as "This statement is false."

Obviously the same thing will happen to a Celeron processor if it attempts to reconcile with itself the impossibility that 4.0 and 3.99999999901 are equal! THEY WILL USE THE EXPLODING COMPUTERS AS BOMBS

Ron Harris did some thing like this with slots

[Joe The Dragon]

Is this chip / software used in any slot / video poker games?

Re:First Post?

[Anonymous Coward]

Um, no. "The terrorists" (a pretty vauge term but I'm assuming you mean those from middle eastern countries by the way you're wording your statement) don't give a rat's ass how we live, whether we have free elections or live with an oppressive government nor do they really care much about how we go about our daily lives, etc, etc. The terrorists wants the US and western countries to stop fucking around in their countries- supporting/installing dictatorships that happen to ally with our interests while bombing and invading countries that we don't like, setting up permanent military bases and just generally exerting our will on them. After a few generations of having western powers screw with their countries and lives it should be little wonder we're not well liked.

Of course, if you were refering to China or someone else then that might be a different story (but again, the wording sounded like someone regurgitating the drivel that gets thrown out by politicians and pundits in the mainstream media).

Re:First Post?

[andruk]

How much money is spent in black ops? How much money is "wasted" by the government?

Probably about that much. ;-)

I think the terrorists have already won, because the whole point of terrorism is...terror, and there are very few *thinking* people who are not afraid of the Patriot Act. The way I see it, the number of people killed in these attacks is miniscule to the number of people affected, but it seems to me that the best/only thing we can do is keep being the land of the free, and try not to provoke other countries (looking at Iraq/Iran).

My 2c/pointless ramblings. Take them with a mound of salt.

In other words...

[3seas]

how to cause the blue screen of death to happen simultaneously across all computers...

No.

[Valdrax]

Terrorists want us to stop screwing around in the Middle East and Central Asia -- specifically they want us to stop supporting Israel and to stop propping up various dictatorships in countries where there'd be a good chance of overthrowing the government and creating a theocracy.

They don't give a flying f--- about "our freedoms" except where they think that shows we are "morally corrupt." Islamic militants are under no illusions that they're going to change our culture any time soon, though. They've got bigger fish to fry back home trying to establish a power block.

How we govern ourselves beyond our foreign policy is utterly unimportant to their larger goals.

Re:No.

[ScrewMaster]

How we govern ourselves beyond our foreign policy is utterly unimportant to their larger goals.

Which, in some cases, involves the elimination of us infidels. So you can't say that we're relevant to them only in terms of foreign policy: we're relevant simply because we exist, and that fact is intolerable to some people.

Re:No.

[Anonymous Coward]

Those people are an absolutely tiny minority and can be dealt with sensibly. The majority of people would just like us to stop meddling.

Stop pissing people off and the nut-jobs who do want us removed will have lost their primary recruitment method.

Re:No.

[funwithBSD]

Really? Then can you explain why they kill swiss and Japanese tourists?

http://news.bbc.co.uk/onthisday/hi/dates/stories/november/17/newsid_2519000/2519581.stm

The Swiss are not US allies, they are nobodies allies.

More importantly, why do they SAY they are concerned with our freedom and establishing a world caliphate if that is not what they want?

Oh, I know, reverse psycology.

The USA says they are not interested in world domination, so they must be.

Muslims say they are interested in world domination, so they must not be.

Bizzaro world I guess.

Re:No.

[DigiShaman]

Define Terrorists please. If you're talking about Al-Queda, you're wrong. This group hates democracy as it goes against Sharia law to the most extreme. Anything governed outside this religious foundation is seen as an act of Hubris and thus punishable by death in the eyes of Allah (Arabic word for God).

Next time, educate yourself about our sworn western enemies before justifying their cause. Bluntly put, I don't give a damn about their cause. These people need to die like the parasites they are on humanity.

Thank for America, and thank God for our men in uniform protecting the freedoms you take for granted!

Re:No.

[Valdrax]

Define Terrorists please. If you're talking about Al-Queda, you're wrong. This group hates democracy as it goes against Sharia law to the most extreme. Anything governed outside this religious foundation is seen as an act of Hubris and thus punishable by death in the eyes of Allah (Arabic word for God).

Yeah, but al-Qaeda doesn't care about our democracy. And seeing us turn into a secular or Christian dictatorship in no way helps further their goals. The more crazy fascist our government becomes, ironically, the less accepting of Islamic fundamentalism it becomes even as it becomes equally repressive. If anything, it's against their long term goals to see us harder ourselves against them.

Next time, educate yourself about our sworn western enemies before justifying their cause. Bluntly put, I don't give a damn about their cause. These people need to die like the parasites they are on humanity.

What does explaining their motivations have to do with justifying them? You seem to be the sort of reactionary type that associates any attempt to understand your enemy with accepting them and capitulating to them.

Geez, it's no wonder you people are losing the War on Terrorism for us.

Re:No.

[at_slashdot]

How about our freedom to meddle in Middle East if we consider that morally correct? Don't they hate that freedom?

Re:No.

[Bert64]

Pushed to it's ultimate ends, they could end up turning the west into a nazi style dictatorship, run by someone like Hitler who has decided that muslims are to blame for everything in the same way hitler blamed jews. I doubt al-qaeda would be very happy with this eventuality, with such a powerful well armed force aiming to exterminate them all.

Re:No.

[Fuzzums]

There are so many things I hate, but that doesn't give me any right to send in my army and kill everything that disagrees.

Re:No.

[blackest_k]

Next time, educate yourself about our sworn western enemies before justifying their cause. Bluntly put, I don't give a damn about their cause. These people need to die like the parasites they are on humanity. That is an interesting line, because it could just as easily be said about Americans and Europeans.

We dehumanize these people who are living in poverty supplying the western world with its toys.
They see us getting fat from our gluttony, while people are starving and dieing around them.

I don't know what we can do about this, I would hope killing them is only a stop gap, perhaps it isn't, perhaps they think along similar lines about us.

Our governments seem to be readying for a terrorist war on our streets, only a few weeks ago in the uk it was announced that concrete barricades would be going up round the UK's Train Stations and Airports.

It is pretty much impossible to get a grasp on the whole situation, how different aspects interact but the west seems to be in denial we are spending future earnings now building up debt and pretending our credit card bills will take care of themselves.

Education is needed not just about our sworn enemies but about ourselves and the role we play in this situation.
we won't be fiddling while rome burns we will be playing on consoles watching realty tv shows just escaping from reality.

Re:No.

[TheRaven64]

Nutcases who want to establish a world-wide caliphate under sharia law? The only "sensible" way to deal with them is bombs, and lots of them. No, the sensible way of dealing with them is to lock them up somewhere where they can receive psychiatric help or, failing that, shoot them. Dropping lots of bombs just serves to cause otherwise rational people that they might have a point and that the world would be a better place without the people responsible for the death of their family.

Re:No.

[JasterBobaMereel]

This would seem to contradict reality?

There is a country that is part of the evil empire, the current target of the USA, and excepting Iraq (now) and Israel is the most democratic country in the middle east? It is a theocracy, with Sharia law as the highest law, but with a democratically elected government, elected president, and civilian law courts and judicial system that runs alongside Sharia Law, it still manages to have a relatively good (but far from perfect) human rights record?

There is however a country that opress the majority of it's citizens, is a dictatorship run by one family, who are of different origins and religion to the majority of the population, (and who are related to the Bin-ladens), have the most Al-Queda training camps of any country, and where the majority of the 9-11 terrorists came from, and is often berated for it's woeful human rights record

The first is Iran (an evil, anti-american country), the second is Saudi-Arabia (a friendly pro-american country)

Re:No.

[CmdrGravy]

There was an interesting article in the news last week about a woman in Saudia Arabia who had been gang raped by several men and was then sentanced to a few years in prison for the crime of consorting with men without permission. I don't think that sort of thing even happened in Iraq and yet, as you quite rightly say, they are a key ally of the west in the war on terror and inappropriate regimes.

Re:No.

[Lars T.]

Pushed to it's ultimate ends, they could end up turning the west into a nazi style dictatorship, run by someone like Hitler who has decided that muslims are to blame for everything in the same way hitler blamed jews. I doubt al-qaeda would be very happy with this eventuality, with such a powerful well armed force aiming to exterminate them all. In the same way Nazi Germany was bad for Israel?

Re:No.

[Bert64]

Nazi Germany would have been very bad for any jews had Hitler not been stopped. Had he been successful invading the UK and USSR he would only have continued to other countries, executing any jews he found there.

Re:No.

[Lars T.]

Nazi Germany would have been very bad for any jews had Hitler not been stopped. Had he been successful invading the UK and USSR he would only have continued to other countries, executing any jews he found there. And if Hitler hadn't existed, Israel probably wouldn't either, because millions of Jews would have stayed in Europe.

BTW, even your strawman of killing all Jews in Europe wouldn't necessarily be bad for Israel and the Zionist movement - just like America's reactions to 9/11 aren't in any way bad for the Islamic extremism, because making people feel prosecuted helps making them more extreme.

Re:No.

[Bert64]

Depends on their level of success... Had Hitler been successful in his ultimate plans then there wouldn't be any jews left to be extreme. Hitler even killed people who were *suspected* of being jews.

Re:No.

[Lars T.]

Depends on their level of success... Had Hitler been successful in his ultimate plans then there wouldn't be any jews left to be extreme. Hitler even killed people who were *suspected* of being jews. Sure, and if the Jews had killed all the non-jews (or those who were unfortunate enough to have a speech impediment that kept them from properly pronouncing "Shibboleth"), it would just be the opposite. Do you intentionally misrepresent what I wrote, or do you really can not tell the difference?

National Safety Administration?

[dohzer]

the government - specifically, the terrorist-fighting National Safety Administration - may have left itself a secret back door Who are the "National Safety Administration"?

Re:National Safety Administration?

[ScrewMaster]

Who are the "National Safety Administration"?

They're the sister outfit to the "National Highway Traffic Security Administration".

Re:National Safety Administration?

[Cassius Corodes]

It was the winning submission for a new name for the NSA, just edged out ministry of love.

Will the lemon factor of chips affect tis?

[FutureLuddite]

I had a computer arch prof who used to refer to self-tests in digital logic as the ability for circuits and chips to test for their own sanity. As the implementaiton gets smaller, the ability to test for sanity could get more difficult. For example, some of the experimenetal nano-media are prone to faults and its only in the massive redundncy, that they are usefull. I wonder about the ability of an attacker in the future to manipulate the fault level of digitial logic/memory, or the self-tests of digital logic. Could the attacker able to introduce this fault manipulate a higher order operation like a math op and therefore gain access to some variation of Shamir's attack.

Re:Will the lemon factor of chips affect tis?

[uofitorn]

Either you're 10x smarter than the rest of us, or you're commenting on the wrong story. Either way, I'm afraid to use my mod points on you.

I take that back

[TheSHAD0W]

Sorry, I was looking at this the wrong way. The "math error" Mr. Shamir must be talking about, with regard to "chips", must be an error in the logic system in an arithmetic logic unit. An error that might, for instance, cause one or more bits in a register to stick in one state or another, would indeed affect future messages, disrupting PRNG (both encryption algorithms and one-way) and public-key computations. I doubt a system so badly affected could continue to operate for very long, but an attacker who monitors outgoing messages after sending that "poisoned" message to trigger such an error would learn valuable clues to the machine's cryptosystem and keys, perhaps enough to trivialize breaking its keys.

Depending on what sort of application the user's machine performs, I can think of a few ways, offhand, to help guard against this sort of attack. A simple self-test prior to encrypting each message might work but might be onerous with a heavily-utilized system. Reducing the number of registers used for encryption might help, surprisingly, because any error would tend to cascade more quickly, reducing the output to a complete mess rather than something analyzable. Also, where practical, decrypting part of the message after encryption would work as a fast check for this sort of corruption.

Super teen extraordinare.

[Xac]

*scottish accent* NO! I warned em about tha' Pinnacle Chip! I told them it had a' flaw where if you logged onto the internet then entered in *@[=g3,8d]\&fbb=-q]/hk%fg it would suck you into the internets and make you some sort of a' freakazoid!

Re:Super teen extraordinare.

[Faylone]

and the delete key, how could you forget the delete key?!

Re:Super teen extraordinare.

[GameboyRMH]

Hey, Mr. Chubbykins put the code in! He had no clue what he was doing!

Or did he? O_o

Has it been that long since the intel goof

[tie_guy_matt]

Where has the time gone? Anyway as I recall that error only really affected the low megahertz pentiums and were fixed extremely early. I think that is probably because with millions of chips sooner or later someone is going to notice their code not executing correctly on brand X chip while working just fine on brand Y.

Let's say that this error does get out somehow though. Lets assume that the error only creeps in when a freakishly rare set of instructions is executed. It seems the companies upgrade their designs every couple of years. So I doubt that the problem would affect all intel super duo core whatever processors. Likely it would be all chips made between this date and that date and of this specific model.

So hackers would likely not know ahead of time which servers are affected so they would likely have to try to send the signal to as many servers as possible hoping that some would be affected.

Are you going to tell me that no one is going to notice that hackers are trying a specific exploit on so many machines?

And if there did exist such a problem in hardware how would it be that much worse or different than finding a big bug in software. In the end people would be forced to replace their chips or get a software patch. The company would get a big black eye and life would move on.

Yes there could be such exploits out there right now that we don't know about. But there are also many many more software exploits out there that we don't know about. How is the hardware problem worse or even much different?

Just wondering?

Any Error == Broken SSL and HTTPS

[flyingfsck]

In my experience, the slightest error will render the whole cypher text unreadable, so it won't take long for people to complain that all HTTPS shopping sites don't work with a specific computer system and then that system will end up in land fills really quickly.

Re:First Post?

[masterzora]

shotgun's laaaaaaaaaaaaaaaaaap

Terrorist & government symbiosis.

[EmbeddedJanitor]

Of course there's all the stuff that terrorists want you to do, but governments need terrorists too.

Want the citizens to give up some freedom/pay some new tax/whatever? Easy! Play the terrorism trump card.

Without some Evil Empire force (that the US plays so well), it is very hard for terrorists to get the emotions going either. Terrorists & empire building governments need each other.

Pentium FDIV Bug

[rubicon7]

Remember the Intel blunder of 1996? Don't you mean 1994?

Re:Pentium FDIV Bug

[The New Andy]

Don't you mean 1994?

Don't you mean 1993.9999999999987

Re:Pentium FDIV Bug

[Nullav]

Apparently the submitter is using the chip in question, as the article clearly says 1994. (Though 1996 did have the F00F bug.)

NSA "Suite A" is the real problem.

[Kadin2048]

Which is why I, for one, doubt that the back door was intentional. The approval that NSA gives is primarily for use by the US government itself, and most of the obstacles that NSA faces in spying on our own government are bureaucratic ones, not technical ones. I agree, for what it's worth (not much, but we're mostly all armchair generals here, why not join in the fun?).

The flaw seems too obvious to really have been something illicit. If it was an attempt at a backdoor, it was pretty stupid. And it was a weird/improbable way to create a backdoor -- it was PRNG, not really a cryptographic function per se, and while knowing its output could help you break a system, it wouldn't guarantee it. The people at the NSA had to know it would be combed over.

But the fact that it seems to be incompetence rather than malice doesn't make me feel a whole lot better. There are still a bunch of secret-algorithm ciphers around and in use (and which the government, in its infinite wisdom, treats as more secure than the openly-reviewed ones), that the NSA is basically the only organization that has any access to. If they could miss such a trivial flaw in a PRNG that they knew was going to go out for public scrutiny, what could they have let slip by in a cryptographic function that was supposed to be a state secret?

Re:NSA "Suite A" is the real problem.

[dshadowwolf]

1) It's not clear that the ECC PRNG is "backdoored" - everything I've seen says that it "may" or "might" have a weakness where there is a second, related set of numbers - not that there IS a second set of numbers.

2) This article doesn't say anything new. If a processor has a flaw in its math processing then exploiting that flaw could lead to any result - but it's unlikely that it'd just cause the processor to kill the security software. Look at the F00F bug on older Intel chips - it caused the processor to fault and lockup. So a processor fault causing a single process on a system to fault seems like a non-starter.

3) Almost all modern processors actually "decode" a single instruction (like movb %ah, %al) into a series of very low-level instructions. Intel has actually built a way to update this translation process into its newer processors - the "microcode update" system. On Linux and Windows, at least, you can install a new version of the microcode on a processor.* This process could be co-opted by someone with the proper resources to cause a processor to mis-function.

*I think the reason they don't offer things like SSE3 as a microcode update has more to do with economics than limitations of the silicon

---
Sometimes, I wonder if the world isn't just a dream and me the dreamer. Then I stub my toe and know it isn't

Re:NSA "Suite A" is the real problem.

[0xygen]

1) is a serious problem though. We can never PROVE it is backdoored unless someone steps forward with those numbers. We can NEVER prove it is NOT backdoored, as we cannot PROVE that no-one has the numbers, so are compelled to treat it as backdoored.

2) is about specific cases where particular categories of mathematical failures actually lead to the compromising of the private key, which is significantly more dangerous. It is not about utilitising typical exploits like buffer overflows to take over and kind of security software. For example, once they private key is known, it may allow the third party to fake messages appearing to originate from the target of the attack.

3) indeed, the problem here is typically relating to very specific edge conditions, eg overflows, underflows, carries which are handled incorrectly, and have been known to go undetected for years. If you do not believe there are issues in the microcode, take a quick look at the current errata list for the Core2Duo, showing many unfixed bugs (and many of them unimportant due to the impossibility of them occurring in modern operating systems).

As for "installing bad microcode", the microcode is something done purely from the software each time the OS boots into volatile memory on the cpu, and so is reset back to the original shipping microcode each time the machine is power-cycled.
If an adversary has access to the booting OS to update the microcode, the adversary already has access to superuser priveleges on your system anyway, so I feel it is irrelevant.

Re:NSA "Suite A" is the real problem.

[0xygen]

1) The RNG being completely unpredictable is the very basis of many encryption algorithms.
Often, any, even a very small weakness in the RNG decreases the strength of an algorithm by a factor much higher than the slight loss of randomness. For example, it may means you only have to attack a small block of the output, as you have can narrow down the possible values of the remainder of the block. It basically allows you to take educated guesses as to the state of the RNG later in the block, giving you a much smaller space to attack.

2) these errors could reveal data in an encryption algorithm. For example, in the simplest case, if you have a list of possible states, and you see a particular set of values come out that would only be possible in circumstances where the bug has been triggered, you then know extra information about the data that went in. In crypto, ANY slight known deviation from the algorithm will essentially decrease the keyspace. It means you know more about the data that went into the algorithm in the first place than you should.

3) The microcode updates requires priveleged instructions to execute. It requires the equivalent of driver-level access. If it has this, there's no need to play with the microcode, you already have full access.

The microcode update system can only be a good thing, provided that the hardware does only allow privelged access to it, which in all of the released Intel and AMD processors to date, has been correctly implemented.

The only way I see of it being better by not existing is that the hardware might get deeper testing before release. Experience says this is unlikely, as time is a crucial factor in the current processor arms race.

Given that microcode update exists, it means that when flaws are inevitably found, they can be patched, rather than being stuck with a broken, potentially insecure machine. The situation is very like the "oh no, PS3 and 360 games are now going to be as badly tested as PC games, because they can be patched" argument.

Re:First Post?

[piojo]

You wrote a bunch of counterexamples to show that the poster was wrong, and that his statement really just meant, "everyone that doesn't agree with me is an idiot." And then you called him an idiot. Good job.

Re:First Post?

[osopolar]

No, "THE TERRORISTS" if you believe such a label do not want our government to become more powerful. THEY want to strive on understanding and hope. Governments strive on power alone. Now that that is out of the way we can focus on real matters. Who cares if someone knows the back door math equation to some intel chip or whatever it was. Have you seen the price of gold lately? Information is only good when it can help procure material wealth. No one cares about what happens to unwealthy nations no matter how much information we gather on them ... the main two points of my story - when you have everything then you have everything to loose and if you have nothing then you win because they can take nothing away from you. But we must always be mindful of THE TERRORISTS because we like to believe that their value system is some how the same as yours, shallow monetary and largely based on illusion.

Random Numbers in .NET and in General

[randomErr]

Yeah know, I've noticed this problem on a series of processors at my college. I had to write a basic key based cryptography program in C#. Well I created the system with no problem. But if you ran the program in a certain lab where all the computer are identical (hardware and software) I could generate the same 4 key sets each time. My solution was just to use and external DLL with my own generator from another language.

My point for this example is that I don't believe its the processors fault. If the software engineer can't write a decent algorithm to generate random numbers then it the engineer at blame, not the processor. I wrote great random number generator back on the Apple IIe years ago. Why can't people do the same now?

Re:Random Numbers in .NET and in General

[DrJokepu]

You are aware that computers can only generate pseudo-random numbers, right? The random number generator in C# actually doesn't generate random numbers but numbers that look random. These numbers are generated by a 'seed'. If you give the same seed to the computer, it will generate the same set of numbers. The C# implementation (if you don't supply a seed yourself) uses the system clock as seed, hence if you start your random-number-generation session in the same millisecond on same computers, they will generate the same numbers! The rest of the hardware & software is irrelevant here. If you need a REAL random number generator, you should connect your computer to something naturally random, e.g. a Geiger device, because your external DLL from an other language just uses a different model to generate the default seed but it is still predetermined.

Re:Random Numbers in .NET and in General

[hhawk]

IHMO, a RNG is really a hard problem because if it isn't truly random you weaken the crypto. IHMO, you really need to use a physical source to generate the randomness and not some direct method as a chip, esp. a built in RNG function. A physical source might be radioactive decay but there are other things that could be sampled.

Re:Random Numbers in .NET and in General

[evanbd]

It doesn't have to be a geiger counter. There is plenty of randomness to be had in the exact timing of key presses, exact behavior of rotating media, incoming network information, etc etc. It can be harder to make use of (poor or unknown distribution, patterns that you might not know about), and it might be insecure (especially if it came from the network card), but there are plenty of physically derived things a modern computer can measure and generate randomness from with enough processing of the raw data.

I was wondering about that as well

[IvyKing]

About the only way for the attack to work without all of the SSL and HTTPS implementations breaking is if the bug affected less than say 10E-9 of normal HTTPS/SSL sessions, and the attacker knows exactly which operands produce a broken result. The attack also depends on the broken hardware being either very common or the attacker knows that his/her target is using the broken hardware. This is a great agument against a hardware monoculture.

I'd think it more likely that a bug in a popular encryption related software package/library would lead to more exploits than a hardware bug. My guess is this would be true for both open and closed source projects. While open source projects can have 'many eyes' looking for bugs, my guess is that more bugs are found when trying to port to multiple architectures than by people casually glancing at the core (the OpenBSD developers maintain ports to multiple architectures for precisely that reason).

Re:First Post?

[gweihir]

I think the terrorists have already won, because the whole point of terrorism is...terror, and there are very few *thinking* people who are not afraid of the Patriot Act.

There is strong indication that the main goal of 9/11 was actually against individual freedoms, which this particular brand of "Islam" (they could be fundamentalists of any other religion) does not like. In fact they do not like if people have their own opinions. And they did manage to shiff the US massively in their own direction of thinking. In the end, it seems one fundamentalist is far closer ro another, than to people that are open-minded and tolerant. As an atheist, I believe the main danger of religion is that it can be used as a booster-package for fundamentalists. Many people manage to have religion and still respect others, but a significant number can be coerced into thinking that everybody should subscribe to their particular (and usually bizarre) world-view.

Way to surrender to violence, kaffir

[Anonymous Coward]

So, because they don't like US foreign policy, they think it's alright to kill, and it's the fault of the US?

What the flying fuck planet of twisted "logic" are you living on? You're blaming the victims of murder for the acts of the murderers.

If someone doesn't like people who paint their houses pink and purple and then goes and kills anyone living in such houses, the people who painted their houses in garish colors are not the ones at fault.

And it's not "US foreign policy" that's fueling terrorist rage.

It's Islam. Plain and simple.

Specifically, the concepts of dar al-Harb and dar al-Islam. In the case of Israel, the utter insult it is to Islam to have that part of dar al-Islam revert back to dar al-Harb.

The mere existence of Israel is an affront to fundamentalist Islam.

And if the jihadis manage to "wipe Israel off the map" (gee, they wouldn't ever slip up and actually say that, now would they?), then those other areas of the world that were once part of dar al-Islam but reverted to dar al-Harb will be returned to the ummah. Say, like the Balkans, or Spain, er, I mean ar-Andalus.

And if any kaffirs get in the way, too bad. They're subhumans, anyway.

Maybe you'll get your head out of your ass before the jihadis lop it off - as their holy book directs...

Re:Way to surrender to violence, kaffir

[Eli Gottlieb]

Let's just be frank: Islamism is nothing more or less than a religious twist on the old pan-Arabic-nationalism.

Islam can coexist with the rest of the world. The type of pan-Arabism that sees all land conquered by the Arab empires of old as rightly belonging to the Arabs of today, cannot, whether or not it drapes itself in a burqa to avoid the eyes of the West.

Re:Way to surrender to violence, kaffir

[ajs318]

No, Islam is incompatible with anything else. Islam is not even compatible with democracy as we understand it ..... more like "one man [and they mean that literally], one vote, once -- and only then if the vote is for a global Caliphate under Shariah law." Sharia law is fundamentally incompatible with Human Rights, since it prescribes punishment by death for crimes against property, as well as some "crimes" which are nothing more than an exercise of Human Rights. Remember, "Islam" literally means "cowering in abject terror". Men cowering in abject terror of Allah, women cowering in abject terror of men and non-Muslims cowering in abject terror of Muslims.

Unfortunately, it is a logical impossibility to prove that Allah doesn't exist. You could prove that Allah existed, if he did, by catching him -- but since he doesn't exist, you can't. Therefore, we're stuck with Muslims -- unless we can convince enough of them that their religion is a steaming heap of camel shit.

Re:Way to surrender to violence, kaffir

[Eli Gottlieb]

Could you please give a strict definition of these Human Rights (TM) that you love defending so much? In my experience, "human rights" tends to mean one of three things:

1) Whatever the speaker wants from society that it won't give him.
2) Let's be nice to brown people (preferably Muslims), because not doing so is Racism and a violation of Human Rights.
3) A vaguely notion of ethics whose fundamental idea is "Let's not kill people different from us." It lacks any moral or ethical dimension beyond that retarded little slogan.

P.S.: I'm not defending Islamists. I'm Jewish, so they're far more my enemy than yours (unless you're Israeli).

Re:Way to surrender to violence, kaffir

[ajs318]

Could you please give a strict definition of these Human Rights (TM) that you love defending so much?

Try here. Sharia Law necessarily contravenes at least article 1, article 7, article 18 and article 21.

Re:Way to surrender to violence, kaffir

[Eli Gottlieb]

Holy shit. I didn't realize anyone actually believed in the bull-loaded propaganda piece otherwise known as the UN Declaration of Human Rights.

Of course it's your right to have me give up my hard-earned money so your kid can have a Special Education for their learning disability in a Sexual-Preference-Neutral School.

Greedy bastard UN.

Re:Dupe

[gweihir]

But deliberate backdoors and ones created by mistake are two different things.

True. But a seemingly accidential backdoor may just have very good camouflage. Crypto also deals with making proof of intent impossible.

There's more to it that email exchanges

[apankrat]

Consider low-level handshake protocols. There is, for example, an attack on SSL that allows recovering private RSA key by measuring response delays of a victim. These responses are mandated by a protocol, so they are (in a way) solicited.

Re:There's more to it that email exchanges

[yabos]

Can you post a reference for that? If that's true how come people aren't breaking SSL all the time?

Re:There's more to it that email exchanges

[arkanes]

Because SSL has been hardened against it by normalizing response times, so they don't leak information.

Google for "ssl timing attack", the first hit is a paper on the subject.

There's a similar old school attack that you could use to identify valid accounts, by measuring the response time to a login attempt - an invalid account would fast-path fail, while a valid account with the wrong password would have to validate the password, taking longer.

Re:There's more to it that email exchanges

[yabos]

Thanks. It's good timing since I'm actually studying for my cryptography class right now.
Your comment seems to be a little contradictory for at least OpenSSL, mod_ssl(default settings), which the paper finds is vulnerable, at least some versions of it.

Reading this, it's a wonder how this doesn't happen more often. Especially within a data center. Some malicious person could rent a server in a data center where the latency to other servers is very low and perform timing attacks on other web servers.

Re:There's more to it that email exchanges

[Eivind Eklund]

mod_ssl / OpenSSL was vulnerable in 2003; this was fixed with a release the 17th of March 2003. The original vulnerability was published on the 19th of Feburary 2003.

At least as far I can tell from a quick check, and that match my somewhat vague memory.

Eivind.

"God bless america", "In God we trust"

[skynexus]

Terrorists want us to stop screwing around in the Middle East and Central Asia -- specifically they want us to stop supporting Israel and to stop propping up various dictatorships in countries where there'd be a good chance of overthrowing the government and creating a theocracy.

And hopefully some other saviour country may apply your +5 insightful comment to the US and put in place a strong american dictatorship lest it slip into a theocracy...

Re:first post. TFA = WTF?

[NoTheory]

What are you talking about? How is this hard to understand? This is one of the grand daddies of practical encryption stating that a huge freaking security hole could be opened if encryption is performed on faulty hardware. If a piece of hardware with such a fault was in wide spread use, then a large number of people would be susceptible to exploits which would be able to defeat public key encryption (e.g. HTTPS, ssh, etc).

Re:First Post?

[ozmanjusri]

A little over a trillion dollars, so far.

Your straw man's on fire.

[Valdrax]

So, because they don't like US foreign policy, they think it's alright to kill, and it's the fault of the US?

What the flying fuck planet of twisted "logic" are you living on? You're blaming the victims of murder for the acts of the murderers.

You're attacking a straw man. I never once said that in my post that the terrorists were justified by these beliefs and goals. I merely stated that "destroying our freedoms" is not anything close to what they actually care about. Big logical leap there.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Useless

[MBHkewl]

So the "expert" is making a fuss over an issue which is possible in ALL existing processors, and making a hype over a theory?

It's like saying: "If a terrorist organization was able to construct portals, they'd be able to attack and vanish!"

i know the secret

[rice_burners_suck]

Heh heh... backdoors, shmackdoors. Private/public key pairs are used only on the faith that it is mathematically impossible to figure out one given the other. Supposedly, if some wise mathematician someday figures out a theorem that allows you to do that, all the public/private key pair encryption systems in use today become WORTHLESS. Luckily that hasn't happened yet. Or has it? Well I happen to know just that... a secret math theorem that makes it possible to generate a private key given a public one. It goes like this: Let A equal Alice's private key, and let B equal Bob's public key. Divide A by B and let Q equal the quotient and let R equal the remainder. My top secret theorem, which is known to NOBODY except ME, is that all I have to do to obtain Alice's private key is multiply B by Q and add R. Heh heh heh... It never fails. We are 1337z h4x0rz d00dz, bwaaaaahaaahaaahaahaahaahaahahahahahahahahahaha!!!

That's the way you'd do it

[slashdotmsiriv]

Step 1: The attacker an SSL session with a web server

Step 2: Generate the "poisoned" SSL session shared key K1, and encrypt it with the server's public RSA key

Step 3: The server decrypts the poisoned SSL session shared key K1 with its private key and obtains a value K2, which is
different than the original poisoned shared key K1. If the shared key K1 was not poisoned, K2 would be equal to K1,
but the attacker is exploiting an error in the CPU implementation that causes K2 != K1.

Step 4: All the AES-encrypted messages from the server will now be transformed with the poisoned K2, which the attacker does not know yet.

Step 6: Carefully select the messages that you send to the server, so that when you get the AES-encrypted with K2 replies to these messages, you
can use them to infer K2.

Step 7: Use K2 to infer the server's private RSA key

And that's the way you do it ...

This is a chosen ciphertext attack, which does not exploits weaknesses of the RSA scheme, but instead exploits the faulty
hardware.

Would you kindly....?

[neoyao07]

That basically means sending the target the secret message: "Would you kindly....?"

When I read between the lines..

[mrbluze]

All I see is whitespace.

... but for a second I could swear that I saw "Math Coprocessor Error: N$A"

Mr. Potatohead

[Barkmullz]

The first thing that went through my head as I read the story was:

"Mr. Potatohead! Mr. Potatohead! Backdoors are not secrets!

Risk evaluation

[mcrbids]

People generally evaluate risk on largely emotional terms. For this reason, we frequently make gross errors in risk assessment.

1) When we think there's somebody out to get us, we evaluate that risk very highly, even when there are more immediate but "random" risks clearly at hand. For example, a "terrorist" is a bogey-man, it's somebody out to get you. But hunger has no bad guy, and neither do disease, auto accidents, and lightning.

2) We evaluate as "risky" situations where we are not in immediate control, even if they are carefully situated to protect us. For example, riding a horse is far more risky than flying, even in the most dangerous category of flying, single-engine piston planes. Yet people routinely are more concerned about the "motor stalling" in a carefully watched and maintained airplane than they are about their kids riding around without protection on a champion racing horse.

3) Because of our intense pattern-matching, our ability to relate to other people, and our social nature, we routinely underrate risks that are impersonal - the flip-side of #1 above. For example, auto accidents are seen as a "way of life" and "can't be changed" by most, but freak out when the local high-school is held up for a few hours when some teenie gets involved in a love triangle and holds a SINGLE person "hostage" with a pocket knife. Look at the dichotomy - people who don't attend school drive right by a smashed up car on the way to work, tisking as they go, but sit glued to the telly when something happens at the High School.

It's reality. Get used to it. And no, it doesn't make sense.

Re:Risk evaluation

[downhole]

That's true, as far as it goes. The trouble is that we aren't the only ones thinking in this way - the various Islamic Terrorist groups that carry out these acts do it too.

If they carry out a large, dramatic attack and, from their perspective, nothing significant happens to them and their supporters, then they are encouraged to carry out yet more attacks until they achieve their political goals. Meanwhile, the other countries in the rest of the world are watching as well. If they see us suffer a vicious attack and not respond forcefully, then they will believe that they can take advantage of us as well and we won't do anything about it.

On the other hand, if they carry out a large, dramatic attack and see the Government that supported them overthrown seemingly in the blink of an eye, their comrades killed or captured, their adopted homeland reject their form of government, seemingly the whole world hunting them down, that tends to discourage further attacks. And other countries are more likely to see us as strong and respected, unlikely to take abuse lying down and likely to keep our obligations to them if the going gets tough.

Whether these results have been achieved by our actions is of course for the individual to decide.

Re:So..

[Artifakt]

I don't particularly see worrying about it, but the point is that a particular type of hardware based flaw, which we have seen at least a couple of times, could make it easy for people who aren't nearly math geniuses to do something that normally takes a grande el-supremo lot of computer science skills.

Re:First Post?

[easyTree]

That's just stupid. You can't have countries running their own affairs. How would that benefit the US?

Re:first post. TFA = WTF?

[TheRaven64]

When you send someone an encrypted message, their software will typically try to decrypt it. This means that it will run a known algorithm (you typically identify the decryption algorithm along with the cyphertext).

Most chips have flaws of one kind or another. Most of these are trivial and can be worked around in microcode. The article mentions the Pentium floating point bug. This caused the original Pentium to return the wrong result for some calculations. In theory, it would be possible to produce a cyphertext that would generate this error if the key contained one of the two values that you needed to generate the error. This then lets you dramatically reduce the key search space.

Other CPU flaws are more serious. There are a few in the Core 2 which allow a process to violate the page protection mechanism, for example. If an attacker found one that caused the program counter to be modified as a side effect of an arithmetic operation then they could create a cyphertext which contained a program at the end and some data at the beginning that caused execution to jump into the exploit code. This is much easier for cypertexts than arbitrary data because the attacker has can make some good guesses about how a cyphertext will be processed.

It seems like this is a very theoretical category of vulnerability to use for anything more than a DoS. On the other hand, as Theo de Raadt says, the only difference between a bug and a vulnerability is the intelligence of your attacker.

Gieger Counters are too expensive...

[JetScootr]

Just use a lava lamp or a camera with the lens cap on.

NSA/GCHQ Private IS open review, practically

[igb]

There are still a bunch of secret-algorithm ciphers around and in use (and which the government, in its infinite wisdom, treats as more secure than the openly-reviewed ones),

The breadth and depth of cryptographic skill,. experience and knowledge behind the wire at Cheltenham and Fort Meade is orders of magnitude than that outside. The review process internally is actually far higher quality than that externally. This isn't like software, where even Microsoft doesn't employ a measurable fraction of the software engineers in the world. GCHQ plus NSA is the vast majority of the cryptographers, plus they have libraries and testcases and methodologies dating back fifty years that the rest don't have access it.

In that case, the benefit of open review (that, just possibly, someone in the small pool of non-spook cryptographers who know what they're doing might find a flaw) is far less than the downside (that your opponents get to see what a modern code system looks like). The lowdown on a modern close-world cipher system would reveal attacks they are defending against, give a good impression of their real capabilities and so on. Yes, in a real shooting war, the spooks have to allow for their crypto systems falling into the wrong hands. But in the current climate, the tactical stuff will be exposed, but the strategic stuff can be closed algorithms and closed keys: what's not to like?

This reminds us all of the S Box hoo-hah, where elaborate theories were put forward by open community `experts' about the `flaws' in the S Boxes in DES. It turned out, of course, that they were optimal against an attack that wasn't even public, and close to optimal against other attacks that (allegedly) weren't known to anyone. I'd take a cipher system that the NSA or GCHQ approves for government use over anything advocated outside the wire., simply because the chances of an intentional weakness in the former are far smaller than the chances of an accidental weakness in the latter.

We went through all this is the discussion about the S Boxes

Re:NSA/GCHQ Private IS open review, practically

[pthisis]

The breadth and depth of cryptographic skill,. experience and knowledge behind the wire at Cheltenham and Fort Meade is orders of magnitude than that outside. The review process internally is actually far higher quality than that externally. This isn't like software, where even Microsoft doesn't employ a measurable fraction of the software engineers in the world. GCHQ plus NSA is the vast majority of the cryptographers, plus they have libraries and testcases and methodologies dating back fifty years that the rest don't have access it.

That used to be absolutely true. Over the last 15 years, there's been a huge boom in private-sector cryptography.

This reminds us all of the S Box hoo-hah, where elaborate theories were put forward by open community `experts' about the `flaws' in the S Boxes in DES. It turned out, of course, that they were optimal against an attack that wasn't even public, and close to optimal against other attacks that (allegedly) weren't known to anyone.

Yeah, at the time the NSA was about 20 years ahead of the open community on things like differential cryptanalysis.

Since then, the lead has deteriorated significantly with the proliferation of public-sector mathematics. Even former NSA employees have been quoted as saying that they're still ahead, but not by very much.

Re:NSA/GCHQ Private IS open review, practically

[WNight]

The S-boxes were produced by a different NSA. This one supports spying on the American people in a way that the old NSA didn't. Since then governmental respect for individual privacy has gone way down.

Also, feel free to believe in the security of undisclosed code, but remember that far more crypto is broken because it's improperly used (ie, using a OTP twice, encrypting known plaintext, program stores plaintext key which is written to swap.) than because its algorithm has a technical hole.

Had the Enigma been used properly it would have been much harder to break than it was. I'm pretty sure any proprietary system in use will have its share of holes, in the algorithm and the implementation. There's simply no alternative to massive testing.

I'd listen to him. He's the crypto supergenius.

[Qbertino]

If a guy like Shamir says this, I'd say it's full-red-alert for all those manufacturing this sort of chip. We are just doing asymetric crypto in Math 1 (Bachelor CompSci) and my brain goes into overload-error every 5 minutes or so as soon as the professor starts talking about it. Someone like Shamir (the "S" in "RSA" btw.) who can come up with this sort of thing should be considered 'God' in the field of cryptography and his call upon action should be noted duely.

Time to test your CPU

[AmiMoJo]

I'm sure Intel test their chips very carefully now, to avoid further embarrassment, but even for the average user it wouldn't be hard to do. A program that tests all mathematical functions of a CPU over the entire range of 8, 16, 32 and 64 bit numbers (both float and integer) for errors would be fairly easy to craft. Might take a while but would only need to be done once per revision of CPU.

Re:Time to test your CPU

[k.ovaska]

In fact, this would take a very long time. There are 2^64 = 1.84*10^19 64-bit numbers, and if you could test 10^9 of them per second, it would still take 10^10 seconds. Using a large cluster of machines this could be feasible, but even that might not be able to test all common CPUs before a new revision comes out.

maths == terrorism

[thomasa]

I have thought about this a lot. Perhaps mathematicians should be locked up as terrorists. They would not be able to get out unless the can factor rsa120 in their head. Clearly math is a subversive activity. It leads to all sorts of hack attacks on computers and computer communications. It leads to dangerous things like atomic bombs and bridges that collapse under heavy winds. It leads to wet naked men running down the street yelling Eureka. (A small city in California - how did he know about Eureka? Was he a mole planted by the Romans?)

Re:First Post?

[synthespian]

I'd like you to meet my close personal friend, Osama Bin Laden, a leading terrorist. He thinks we're all infidels, that this country is full of fornication, homosexuality, intoxicants, gambling, and usury.

Man, that sounds so...neo-con. LOL :-)

Excellent point

[hansraj]

and also if you look at the number of blades in a shaving razor, it has been increasing geometrically over the last couple of years. It is equally clear that all those HUGE number of future deaths will be caused by terrorists weilding razors with HUGE number of blades.

Re:Excellent point

[FauxPasIII]

Maybe with a Gilettte Mach-512 I will finally be able to get a clean, close shave without nicks and cuts!

Re:No politician in their right might would say th

[xouumalperxe]

Most politicians worth a damn have enough skill with rhetoric to be able to make a decent speech with the general meaning of "the best way to honour your deceased loved ones is to not give the scum who killed them the pleasure of living the rest of your life in fear and anger". And I bet a good enough politician would make a damned good speech out of it. Nobody wants to take that chance though.

SSL

[Via_Patrino]

Protocols like SSL (TLS Handshake) can make others send you feedback according to your input.

Gee

[Impy the Impiuos Imp]

So...there could be a hardware hole on top of numerous software holes that would let an attacking stream of bits take control of a target machine?

Golly!

I still don't understand

[jmichaelg]

Some older CPUs and apparently, Via's C7 and some AMD chips, had True Random Number Generators built into the chip.

Why were the circuits dropped? It's not as if there was no demand for the feature. If nothing else, Internet shopping relies on solid crypto which as the article illustrates, crypto relies on good random number sources.

I hate to sound paranoid but (sounding paranoid) I'm wondering if the NSA got the chip companies to remove the functionality.

What if you could break PKI ...

[acube123]

If you could break the PKI(Public key infrastructure) would you .. (a) publish a paper on it .. get famous .. and close down the RSA? or (b) quietely snoop over the world's conversations .. and possibly break banks' security systems to make billions? If (a) is not the chosen option .. why would anyone publish such a result, even if they found one?