Ask Slashdot: Can Bruce Schneier Be Trusted?

An anonymous reader writes "Security guru Bruce Schneier is, among other things, a world renowned cryptography expert, author of several popular books, and a second-order internet meme. He is also an outspoken critic of the NSA, in particular the massive NSA surveillance programs disclosed over the summer by Edward Snowden. Schneier has been involved in reviewing the leaked documents and has put in effort to determine which cryptosystems should still be considered safe. I'm a big fan of Bruce Schneier, but just to play devil's advocate, let's say, hypothetically, that Schneier is actually in cahoots with the NSA. Who better to reinstate public trust in weakened cryptosystems? As an exercise in security that Schneier himself may find interesting, what methods are available for proving (or at least affirming) that we can trust Bruce Schneier?"

Comments

Trust no one

[Bodhammer]

Seriously... Especially the Govt. (and clowns - clowns scare me...)

Re:Trust no one

[khasim]

You have to trust someone, somewhere along the line.

Even the compiler can be compromised. Ken Thompson showed that.

Where I think "anonymous coward" is wrong is that he's implying the Bruce Schneier would NEED to be compromised by the NSA. He wouldn't.

There are two aspects to "crypto".
1. The math.
2. The implementation.

Bruce can validate that the math seems to be correct (or he can be compromised into saying that it seems to be correct) but it is the implementation that gets used.

So even if Bruce actually believed that the math was correct, the NSA could compromise the people/organisation/company that turned that math into a product that you would use.

And it is much easier to claim that a flawed implementation was an innocent mistake than to compromise EVERYONE who can understand the math behind it.

Re:Trust no one

[Moryath]

And now, folks, it's time for "Who do you trust!" Hubba, hubba, hubba! Money, money, money! Who do you trust? Me? I'm giving away free money. And where is the Batman? HE'S AT HOME WASHING HIS TIGHTS!

So do you trust the Joker, or the Batman?

Re:Trust no one

[optikos]

Applying the mantra of open source to the underlying mathematics: Learn the mathematics of cryptography yourself to find the bugs within the mathematics. Don't place your trust in any person other than yourself. Especially don't worship some brand-name as a god who, as diviner-intercessor, is your sole information-provider on the subject.

Re:Trust no one

[Cro Magnon]

Seriously. The mere act of trusting someone will eventually lead to that person betraying said trust. Trusting someone puts them in a position of power, and power corrupts. You can't trust anyone.

That's a very good statement. I trust you completely.

Re:Trust no one

[godrik]

"Even the compiler can be compromised. Ken Thompson showed that."

Well, double compiling techniques can be used to certify a compiler. (Though it actually assume that you have access to an other safe compiler, which is a little bit complicated, but doable)

http://arxiv.org/abs/1004.5534

Re:Trust no one

[ShanghaiBill]

the NSA could compromise the people/organisation/company that turned that math into a product that you would use.

An obvious solution to this would be two (or more) independent implementations. The implementations wouldn't even need to be done by trustworthy entities, just entities unlikely to cooperate. If the NSA does one implementation, China does another, Russia does a third, and they all produce identical output, then that would be good enough for me.

Re:Trust no one

[Garridan]

You have to trust someone, somewhere along the line.

No. No you don't. You should always remain skeptical, consider motivation as well as message, and read between the lines. Think for yourself and check facts.

It is better to trust the math community (a large body of people of varying motives, hence less corruptible by a single source) than Schneier. It is even better to learn the math yourself. It's even better to kick down the doors of the NSA and demand answers. But that last one will probably get you shot or worse.

Re:Trust no one

[Anonymous Coward]

Well, if you know your comic-book history, you'd know that Batman had a homosexual relationship with Robin and was shown in the comics in bed with him.

If there's anything one learns from applying for a security clearance or worldwide politics in general, it's that nobody trusts homosexuals. I trust the Joker. Not only is he not a homosexual, and therefore trustworthy, but a proven innovator with plenty of experience thinking outside the box. I trust the Joker. Not Batman, as Robin has too much filthy blackmail on him.

-- Ethanol-fueled

I trust Cat Woman, and if she is homosexual that would be so hot.

Re:Trust no one

[girlintraining]

You have to trust someone, somewhere along the line.

The open source movement (Down people! It's just an umbrella term, not an excuse to rage about the nuaned differences in licensing) recognized early on that the only way to create reasonably secure code is to publish it and let anyone look at it. Politics demands that for every group of people out there wanting power for a specific purpose, there's another group willing to sabotage them. As long as the code is a black box, the war between those groups will be won and fought or lost without anyone being the wiser -- unless the code is published.

Then, regardless of individual motive, you're on one of either two sides: Publish or don't. If you publish, there's a big risk of being identified if you try anything and in covert operations anonymity is better than bulletproof armor. Nobody's going to risk having their real identity linked to a subversion attempt. So that leaves not publishing -- keeping potential exploits to yourself. This is what the NSA and other intelligence communities are doing.

When you play that game, however, you're stuck in an arms race where every participant is fighting a war on two fronts -- they can exploit the holes in the enemy's systems, but because the enemy uses a lot of the same technology, they can turn around and do the same to you... which means every weapon is 'single use' against hard targets. But I guess that's how the NSA likes it; As long as you have tons of money to waste, those with the most gold have the most power. It's direct proportionality.

Actively maintained open source though allows people to build reasonably secure systems without a big investment -- anyone can incrementally improve it. So if you aren't the NSA (ie, second place and below)... it makes sense to contribute to projects like Linux and build your security around them. The NSA has been 'caught' (as much as anyone can be caught in cyberwarfare -- attributation is a bitch, anyone who has researched it knows this) several times trying and failing to create exploits in Linux. This tells me that the cost of finding a linux exploit is now at least equal to that of its closed-source competitors, and may even be higher -- otherwise why risk exposure?

Any once you find a linux exploit, you're still on the clock -- this isn't like closed source. New people are constantly looking at code, even old code, and could discover your hard-won exploit and close it. Basically, if you're not a "top 10" government and you want security... use open source.

Re:Trust no one

[steelfood]

Neither. Did you not hear what GP said? Don't trust clowns.

Re:Trust no one

[bmearns]

But from whom do you learn the math? A teacher? A textbook? Unless you derive it all yourself from base axioms, you do have to trust someone at some point. Math is logic, pure and simple: that's true, but it is subtle enough and complex enough, especially at the level of cryptography, that you could be taught something which is false and yet verifiable (i.e., internally consistent, but externally incorrect). And of course, beyond outright misinformation, there is the very real possibility that the math is sound but someone has discovered a technique for busting right through it.

But I think the more important point is that our entire society breaks down instantly without trust. Specialization is the basis for all of human advancement, and trust is the basis for specialization. You don't learn to build a car yourself, you trust an auto mfr to do it for you. You don't spend time growing or hunting your own food, you trust the food industry to provide you with safe and sufficient sustenance. If you didn't trust anyone, you'd spend all your own time and resource attending to your most basic needs.

The same goes for cryptography and software: everybody uses crypto these days (TLS, for instance), but the vast majority of people don't have any where close to the expertise to verify even the algorithms, let alone the implementations. Sure, we could have a society of crypto experts and everyone could independently verify every algorithm and every piece of code that they use. But whose going to build the the cars and grow the food?

Re:Trust no one

[Idarubicin]

Applying the mantra of open source to the underlying mathematics: Learn the mathematics of cryptography yourself to find the bugs within the mathematics. Don't place your trust in any person other than yourself.

Which is why I always x-ray the concrete and perform a full metallurgical analysis on the structural steel before I drive across one of those government-built bridges. Sure, I had to do a four-year engineering degree, but it was worth it.

Seriously, "trust no one, and validate everything from first principles" breaks down very quickly if you try to apply it to any but the narrowest portion of your life. Figuring out workable and robust ways to evaluate trustworthiness of other parties is a damn useful (and equally damn difficult) problem.

Re:Trust no one

[queazocotal]

'The open source movement (Down people! It's just an umbrella term, not an excuse to rage about the nuaned differences in licensing) recognized early on that the only way to create reasonably secure code is to publish it and let anyone look at it. '

To make the claim that linux has been never been intentionally weakened in security, you need to know that every single security vulnerability in Linux (to take one example) was due to carelessness, not intended action.

Certainly - some classes of backdoor are trivially obvious 'if(sourceip==NSA)' - but others can be subtle logic errors.

Re:Trust no one

[Anonymous Coward]

No. Bodhammer has it right. Trust no one person. If you must trust because you lack skill, do not trust a single cryptographer, trust the community.

Re:Trust no one

[swillden]

Applying the mantra of open source to the underlying mathematics: Learn the mathematics of cryptography yourself to find the bugs within the mathematics. Don't place your trust in any person other than yourself. Especially don't worship some brand-name as a god who, as diviner-intercessor, is your sole information-provider on the subject.

Care to point me to the "mathematics" of AES? How about SHA-2? For that matter, will studying the mathematics of RSA make it clear why a chosen ciphertext attack renders RSA with PKCS#1 v1.5 padding vulnerable, and how using Optimal Asymmetric Encryption Padding instead addresses the issue?

Seriously, the above is laughable advice. Oh, by all means learn crypto if you're interested, it's a fascinating subject -- one which you can easily devote your entire lifetime to, though you'll have to pick a sub-specialty if you really want deep understanding of the sort that will let you meaningfully evaluate the security of some real-world elements.

The reality is that you must rely on someone else. Even serious academic cryptography researchers make no claims to be able to fully understand anything outside their narrow area of focus, and they're also quick to point out that even when the theory is great, implementations may contain subtle defects which are extremely hard to find. The "open source" mantra is indeed exactly what we need, but your average developer -- bright though he or she may be -- simply doesn't have the background needed to contribute very effectively, and it doesn't make sense for everyone to invest the time needed to acquire that much background.

Instead, what we need is what we have: An open security research community. It could be bigger, of course, and I'd encourage anyone who has an interest in this stuff to get involved. And I'd also encourage everyone else to become more informed. But expecting to be able to make a significant contribution to improving security with just a little math is misguided.

Re:Trust no one

[Garridan]

But from whom do you learn the math? A teacher? A textbook? Unless you derive it all yourself from base axioms, you do have to trust someone at some point.

A proper math education starts from basic axioms. A teacher should merely guide a math student through derivation of that mathematical knowledge which is taught, all from base axioms. In my undergrad, math majors were required to take a course on the axiomatic foundation of math (set theory). The classes that depended on that built the foundations of algebra, analysis, etc. upon those same axioms. The subsequent built upon those results, etc.

One problem with crypto is that we've never seen a hardness result of any of this shit. Until somebody proves P!=NP and builds an NP-complete cryptosystem, I won't trust any of it. The math is inherently untrustable without a proof of trustworthyness. The other problem is in implementation. All the math in the world won't save your data from a shit implementation that leaves you open to side-channel attack, etc.

Society does not break down with a lack of trust, society proceeds, as always, with constant implicit and explicit cost-benefit analysis.

Re:Trust no one

[MightyYar]

Trust might be too strong of a word, but you do need to defer to authority if you interact with society at all. I don't think it is possible to be an expert in everything that you use or interact with on a daily basis and - unless you eschew medical care - you will defer to someone with a medical education at several times in your life. So no, you don't need to trust Schneier or anyone else in cryptography. But your only alternatives are to not use it at all for the purpose you were considering or become educated enough in the field to make your own judgements.

Back on topic, even if you don't trust that the encryption won't frustrate the NSA, it is probably fine for most people's business purposes.

Re:Trust no one

[hairyfeet]

I agree 100%,which is why I wonder why so many attack when I suggest that we should simply discuss whether Naomi Wolf is on to something when she suggests that Snowden may be a plant working still for the NSA. After all it DOES make sense, you can't have a chilling effect if nobody knows to be scared but at the same time there would be too much backlash (not to mention giving groups like the ACLU court standing) if they just came out and said it, so what to do? The answer is simple...disgruntled employee.

This way those that you want to be scared, the ones that read up on such things, your rabble rousers, WILL be scared and the clueless can be told "its just a disgruntled employee, nothing to see here" and they will go along, finally groups like the ACLU and FSF can't get a court case unless the gov admits they are spying on everyone (because the courts say you have to show you were targeted to have standing) so the disgruntled employee angle neatly sidesteps it. You have to admit, if he is a plant? Its WELL played. I have talked to plenty of folks at the shop and on forums that fear talking out about politicians or the gov for fear of getting a file started while at the same time most of the right wing teabagger types have parroted the disgruntled employee angle, well played.

As for TFA I'm sure if you ask Bruce Schneier he'll tell you the same, that you shouldn't trust him or anybody else. Of course the bitch is everything from SELinux to most of our crypto now needs to be looked at with an aura of mistrust because much of it ame from the NSA or won NSA contests so you have to wonder, did they choose it for a nefarious reason? Like they know how to break it? And after reading up on the Kickstarter I'm fully convinced Truecrypt is worthless thanks to the extra blob it has on Windows that nobody knows WTF it does and the fact it won't compile from source and work.

What we need now is a handful of guys like Schneier to come together and give us some basic crypto tools that can be independently compiled, tested, and retested to insure that it works. But if I were forced to choose between something that has been handled or approved by the NSA, something like Truerypt where we now know that the source and binary do NOT math and there are hidden extra bits on Windows, or something approved of by Schneier or worked on by him like twofish? I think I'd choose Schneier.

BTW does anybody know of a tool that does full disc encryption on Windows like Truecrypt that ISN'T a big question mark when it comes to sewcurity?

Re:Trust no one

[PopeRatzo]

If you were the NSA, wouldn't you plant stories in places like Slashdot suggesting that you can't trust the people who are fighting to protect you from the NSA?

Which Slashdot editor is so nearsighted that they couldn't see this obvious FUD?

Re:Trust no one

[sneakyimp]

Agreed. Of COURSE Bruce Schneier can't be trusted. I believe he himself would say, "trust is something you must determine for yourself." That said, I don't think there are many folks better at it than he is.

Re:Trust no one

[Crosshair84]

Anyone who knows anything won't be scared by this. The problem the NSA has is the EXACT same problem as the STAZI or whatever secret police anywhere has had, mass surveillance doesn't work.

The fundamental problem is that as the size of your data set increases linearly, the number of false positives increases exponentially. More computers will not fix this because humans can't be reduced to a series of if/then statements, the computer will either miss gobs of important info or spit so many false positives at you to be worthless. It takes annalists to sift through data making connections and with this data deluge their scarce time and effort is wasted chasing dead ends.

How ineffective is mass surveillance? The Soviet Union and Warsaw pact nations back in the day could not stop the illegal drug trade operating within their borders despite trying as hard as they could to do so. Think about that, nations where you need to apply for a frigin passport to go to the town 10 miles over for a weekend could not interdict and stop the illegal drug trade even while monitoring a massive portion of the population.

What kept the population under control at this time was the government controlling the information the population received. Do you think the North Korean government would last 10 minutes if everyone there was suddenly made aware of living standards outside their country? Likewise in the Soviet Block, people there only had vague rumors of the living standards of the west that could easily be disregarded as exaggeration or propaganda.

Intelligence needs to be focused. Casting a bigger net doesn't do you any good when doing so gets you more bycatch than fish. Sure the intelligence agencies love it because it gets them big budgets, but it doesn't make them more effective. If anything, it makes them LESS effective.

Re:Trust no one

[killfixx]

Hrmmm... You have a great point... More computers won't make the job easier... Smarter computers will...

Look at Watson... Specifically designed to measure the value of information in both directions and use these values real time as it sorts through massive amounts of data...

Areas where humans were thought to be the only solution, here comes Watson...

Law, medical diagnostics, computer software troubleshooting, etc...

These are all areas where Watson will soon dominate...

We can only hope the Utah data center will NOT have IBM as one of the contractors...

Re:Trust no one

[HiThere]

No. You don't need a compiler you can trust to start with, merely one that you know hasn't been compromised by people colluding with those who may have compromised the first one.

E.g., you could take a C compiler written in, say, Algol and use it to compile the GCC C compiler. That would give you a full C compiler that you could trust. You can be pretty sure that whoever wrote the C compiler in Algol wasn't talking to the people who wrote GCC, so any tricks they slipped into the C compiler wouldn't be recognized. And a compiler written in Algol is unlikely to have sneaky C routine recognizers.

Actually, most Algol implementations were interpreters, so change that to Modula 2. But then you need to pick a Modula 2 compiler that wasn't written in C.

Notice that you never get truely trustable computation. E.g., all current CPU chips are microcoded, and nobody that I know of understands what those microcodes do. Even if you compiler is good, your CPU could sabotage you. Of course, the problem there is it needs to figure out what it's executing to know how and whether to sabotage it. So with every level of remove it gets trickier.

Re:Trust no one

[Crosshair84]

Watson will suffer the exact same problem, false positives increase exponentially when your data set increases at a linear rate.

Just because a computer can compete on Jeopardy and do a decent job of recommending cancer treatments, which are all double checked by humans BTW, does not mean it won't spew garbage when given terabytes of new data every day. Real intelligence is non-algorithmic, a computer will never be be to match it, only perform a crude simulation of it.

Re:Trust no one

[SleazyRidr]

Bruce probably doesn't want you to trust him implicitly. You should always keep your wits and take actions to make sure you're not being taken advantage of. I read a while ago about a guy who tricked his son into running into a mirror and was flamed for not wanting his son to trust me: but trusting someone can be dangerous. The lesson is to not let yourself get into a position where you're trusting someone else and not protecting yourself.

Re:Trust no one

[swillden]

But expecting to be able to make a significant contribution to improving security with just a little math is misguided.

That's a huge jump, and a red flag for a shitty argument. As you wrote it, yes it is misguided. You don't have to make a significant contribution, just understand what's already out there. And it's way more than "a little math".

For that matter, will studying the mathematics of RSA make it clear why a chosen ciphertext attack renders RSA with PKCS#1 v1.5 padding vulnerable, and how using Optimal Asymmetric Encryption Padding instead addresses the issue?

Yes. That was simple, wasn't it?

Actually, no. Simply understanding the mathematics will not make it clear. Understanding the math, then having it pointed out, or reading Bleichenbacher's paper, will make it clear. But merely learning the math will not... else it wouldn't have taken decades for someone to discover that problem.

The MD5 collision was an algorithm based on math.

No, it wasn't/isn't. MD5, like all modern hash functions, are based on repeated mixing. It can be modeled mathematically, but it's not "based" on math in any meaningful sense.

But the basic statistical analyses which show whether something may be vulnerable, is all math.

Yes, statistics is math. Do the stats for me and tell me if SHA-256 is vulnerable, would you?

The math for AES can be found on the wikipedia.

The algorithm can. Block ciphers aren't really based in any meaningful sense on mathematics either. Mathematical tools are used to model them and look for weaknesses... but there's also a healthy dose of good "intuition" that goes into cipher design.

The current choices for Dual ECC were proven suspect by math.

Partly. The concern derives as much from observation of process as from the math.

The advice is not laughable in context- trust no one. And, it's not impossible to learn this stuff, you can either choose to or choose not to.

I've spent a big part of the last 20+ years learning it (among other things; I'm not a researcher and crypto is only part of my job), and I work with a bunch of other people who've devoted their whole lives to it. And you know what? If you ask them if anything is good, they'll immediately start looking for research papers to find out... because there is no realistic option but to trust the work that others have done, and which has been peer reviewed and vetted.

Don't trust the researchers - verify it yourself. That's not original research, it's just common sense (for the paranoid).

That's not what the researchers do. But you're smarter and more paranoid than they are. Gotcha.

Re:Trust no one

[Jakeula]

Ok, so let's say that we do have NP-complete cryptosystems. Did you manufacture your own hardware? The point, however abstract it gets, is that trust has to be somewhere or you get no where. You simply cannot know everything about everything well enough to validate all information around you, at some point you have to give up control and trust that the people in charge of that portion of your life are doing the job they are tasked with. This is not to say that you do not verify the sources in which you place trust at all! Remain skeptical, but trust to any varying degree is a must.

Re:Trust no one

[kimhanse]

The fundamental problem is that as the size of your data set increases linearly, the number of false positives increases exponentially.

That makes no sense, if it was true NSA would end up with more false positives than data if they just collected enough data.

Re:Trust no one

[Crosshair84]

Exactly. The more data you have, the more potential connections there are between those points of data.

Here is a link that will explain it in better detail.

http://www.wired.com/opinion/2013/02/big-data-means-big-errors-people/

Just like bankers who own a free option — where they make the profits and transfer losses to others – researchers have the ability to pick whatever statistics confirm their beliefs (or show good results) and then ditch the rest.

Big-data researchers have the option to stop doing their research once they have the right result. In options language: The researcher gets the “upside” and truth gets the “downside.” It makes him antifragile, that is, capable of benefiting from complexity and uncertainty — and at the expense of others.

But beyond that, big data means anyone can find fake statistical relationships, since the spurious rises to the surface. This is because in large data sets, large deviations are vastly more attributable to variance (or noise) than to information (or signal). It’s a property of sampling: In real life there is no cherry-picking, but on the researcher’s computer, there is. Large deviations are likely to be bogus.

Re:Trust no one

[Solandri]

This is a dangerous attitude I've been seeing increasing over the last decade. The notion that disagreement is synonymous with weakness and thus should be stomped out.

That slashdot has topics which question sacred cows and widely-held beliefs is a good thing. If the site parroted one and only one viewpoint, then I'd be worried that there was some higher force manipulating it. The fact that contrary viewpoints are presented and moderated up is what tells me it's a functioning system of free expression.

Diversity of opinion and self-questioning is a strength, not a weakness.

Re:Trust no one

[moortak]

I think it is great to question Schneier, for the same reason we do security audits. You need to examine your trust anchors from time to time. So for Schneier, we ask ourselves a simple question, is the advice sound? The idea that the math is sound, but the implementations are broken has been a constant refrain from everyone for decades. There would be no benefit to paying or threatening Schneier to make him say that, as it has been his refrain for ages. Tomorrow the people in the field with the skills to attack the math will do so, just as they were doing a year ago. The people with the skills to attack the implementations will do so like they did a year ago, but with a few more obvious targets. We'll all continue to harden our security the same way we have for ages, by assuming that there is a flaw and that it must be found.

Re:Trust no one

[Garridan]

I didn't say 'trust nothing'. Trust in a large and diverse community is preferable to trusting a single entity, be it a person, government agency, or corporation. If your entire hardware and software stack is open and verified by a large number of people representing a diversity of motives, then and only does it derserve any trust. "Trust no one" does not rule out trust in humanity. Crowds can either be much smarter, or much stupider, than their constituents -- use them wisely, and trust no one.

Just double the encryption

[bhlowe]

I use two cyphers, just in case. In my case, I found ROT13 and XOR excellent for speed and obfuscation.

Re:Just double the encryption

[Gibgezr]

This is why we need a "+2 insightful AND funny" category, dammit.

Re:Just double the encryption

[Shienarier]

I use 2ROT13.

Re:Just double the encryption

[Empiric]

Chained-XOR (say, XOR-ing with the key byte sequence -and- the preceding file bytes in the last XOR-ing round, with an arbitrary key length) is actually quite secure.

IIRC, it is one of the techniques that automatically qualified an algorithm as an unexportable "munition".

Re:Just double the encryption

[Anonymous Coward]

If you develop your own crypto system and never share it with adverse parties that really want to show you up publicly - then

A.) Your system isn't secure
B.) You will have a false faith in the security of your system.

If you don't already understand this, that's fine, but it means you shouldn't be giving out advice about crypto systems, as either you haven't actually done any research into the history of crypto OR you want to mislead people.

Re:Just double the encryption

[TheCarp]

Whats funny about that is, I am pretty sure I suggested XOR in CBC mode to someone recently as a joke. Didn't even realize I was suggesting they use unexportable munitions :)

Re:Just double the encryption

[i kan reed]

Blah blah blah, of course I understand cryptosystems. But the fact of the matter is, you shouldn't inherently trust that the system itself is secure. If party C can't figure out how a message was encoded, they can't exploit gaps in that encoding to extract your message. There's no ifs ands or buts about that.

The fact is that people with the will and money to crack RSA can, given just a public key and a ciphertext. You can talk about the theory of interception all day, but the practice is all that matters.

Re:Just double the encryption

[Anonymous Coward]

Blah blah blah, of course I understand cryptosystems. [...] If party C can't figure out how a message was encoded, they can't exploit gaps in that encoding to extract your message.

This statement proves that you do not, in fact, understand cryptosystems.

Re:Just double the encryption

[vux984]

There are *large* *families* of attacks that are higly paralelizable and automated that will break any combination of, e.g. XOR+substitution. It won't even *notice* you layered two levels, it will break both at the same time as it goes because it is actually attacking the composite transformation.

You missed the part where he ran it through the 'industry standard' encryption as well.

Don't fucking try to cook your own cypher. Just use the correct chain mode for what you need, one of the highly studied block cyphers that were not chosen due to resource usage (e.g. serpent is likely to be stronger than AES).

The encryption which we presume the NSA may have backdoored the implementation we are using?

And don't screw up on the random numbers, variable initalization vectors, and key exchange. Really, *don't*, because if you ever repeat the IV on DH or GCM, or implement GCM incorrectly, you will most likely leak the secret key.

Well that is reassuring.

This is the absolutely WORST advice you could ever give anyone about crypto for security!

His advice amounted to: use standard encryption, plus some simplistic cipher.

And you are right. The former is the real security, the latter is putting your jewelry in an ice cream container in the fridge instead of the jewelry box.

But if you assume the NSA etc can break the standard encryption with relative ease, and in an automated fashion -- then what?

Suppose the automated NSA dragnet backdoors your PGP email and they got gibberish out, now what?

So is it AES, TEA, ECC, rot/cipher/xor, 3DES... unless you are a high priority are they even going to bother flagging it to break it find out? And if you really fuck with them and 1 message in 5 actually just contains randomly generated gibberish xored with the first couple paragraphs of moby dick? How many resources are they going to work on that?

witch

[stormpunk]

Obviously we burn him at the stake. If he burns he was innocent.

Re:witch

[Dracos]

I am absolutely certain that Bruce Schneier weighs the same as a duck.

Easy

[TubeSteak]

and has put in effort to determine which cryptosystems should still be considered safe.

Have someone(s) double check his work.
We should be doing that anyway, even for someone who is 100% trusted.

Re:Easy

[JigJag]

and who do you trust to double check his work?

I will never trust ...

[Skapare]

... Anonymous Coward. There are some very suspicious posts he makes. And besides, he seems to never sleep.

Trust him to do what?

[Hypotensive]

If you're talking about absolute trust, i.e. "I trust him" = "I trust him to do anything", you should probably have your head examined.

Phrase your questions better and you will get more useful answers.

Oh please

[weav]

If we can't trust old Bruce, we're all screwed. Though possibly we are anyway. But if he's an asset, he's pretty well disguised.

Re:Oh please

[Anonymous Coward]

Dude, Bruce Schneider doesn't even trust his own private keys. That should be a lesson to us all.

I'll trust Schneier ...

[PPH]

... to point out the systems that should not be trusted. IMO, there is nobody I'll trust to tell me that a system is safe. Only time and repeated inspections will get something close to a state of trust.

Re:I'll trust Schneier ...

[Anonymous Coward]

And how Al Queda won the war on terror.

Here you are an answer, which you might not like

[trifish]

Problem: Paranoia
Solution: None

seriously? because SCIENCE!

[new death barbie]

Bruce Schnier may be the front-line spokesperson for the security community, but that should be completely separate from his body of work in cryptography. At the bottom line, he's doing mathematics, and mathematical proofs can be reproduced and confirmed -- or debated and disproven -- by anyone else in any country with sufficient background to understand them.

He is not some guru spouting unprovable wisdom from a mountaintop, he is a member of a scientific community, and if he is able to earn and keep the respect of that community, then that's a pretty good indication that he knows what he's talking about.

See if you can build a bridge out of him

[Boawk]

That's the best way to tell

Logically retarded

[Ralph Spoilsport]

An assumption of bad faith is self defeating. How can we trust YOU???

Has Schneier given us bad advice? So far, so good it seems.

Has Schneier been a vocal critic of the NSA? Yes.

Has Schneier been on this file for a really long time? Yes.

Do you have any evidence that he's in cahoots with the cryptofascists? No.

So, all you have is a speculation to tear down the reputation of one of the good guys, a thought experiment, based on no evidence, but one that has real world consequences of spreading fear, uncertainty and doubt regarding someone who is fighting the good fight.

Therefore, I would humbly suggest that I could and do logically conclude that YOU are a tool of the NSA, not Schneier, and furthermore, I have more evidence than you do: Your suggestion to consider Schneier as less than reliable based on zero evidence.

Re:Logically retarded

[Anonymous Coward]

1. They are playing devil's advocate, not to tear down someone's reputation, but actually to question it in order to put it on a more solid foundation. That is not self defeating, but rather a typical method of proof by dialogue.
2. Your argument seems to be based on deflecting the claims back on the questioner. That doesn't answer the original question about Scheier. Also, your evidence against the writer of the summary is circumstantial.
3. If anyone actually has any evidence against Schneier's trustworthiness, they can present it here. I have seen other Slashdot articles produce just such informed criticism. Therefore this is not a waste of time. The original poster doesn't have to do all the work, you know.
4. One could use similar reasoning to claim that NSA is doing good work.
* Has the NSA visibly harmed America?
* Has the NSA been a vocal critic of America's enemies?
* Has the NSA been on the job for a really long time?
* Do we have any evidence that the NSA is favoring our enemies?
Conclusion: trust the NSA. Isn't that rather shallow reasoning, to put your trust in someone or something merely on the basis of appearances?

Re:Logically retarded

[Anonymous Coward]

Therefore, I would humbly suggest that I could and do logically conclude that YOU are a tool of the NSA, not Schneier, and furthermore, I have more evidence than you do: Your suggestion to consider Schneier as less than reliable based on zero evidence.

Valid point: Me and my question would be another cute way for the NSA to influence society. I can't completely discount the possibility that I'm a sleeper agent, myself.

But just to clarify, I had no intention of discrediting the man, this is strictly a thought experiment, not even conjecture or speculation. I do not mean to suggest that Schneier actually is untrustworthy or working for the NSA. If nothing else, this question has highlighted what may be a flaw in your own security model: you assume that he hasn't "given us bad advice", but you really have no way of knowing that.

Trust no one

[Dunbal]

Seriously. The mere act of trusting someone will eventually lead to that person betraying said trust. Trusting someone puts them in a position of power, and power corrupts. You can't trust anyone.

Learn to Judge by yourself / dont just trust

[burni2]

Hi,

read his papers check the hints within, its even possible for non crypt-math geeks to get a background understanding, because
there are many more out there. Work out differences in their argumentation, dont just think because there is a citation it can be trusted, check what`s
behind a citation.

Wikipedia is the best entry point for you.

Check Argumentation on a logical level, and question the argumentation, especially if it fits the known problems till know, when it remains true, you have a good chance that its really true.

...and it's come to this, hasn't it?

[StandardCell]

I guess people's paranoia with the NSA revelations have been difficult to swallow. Now everyone is slowly becoming suspicious of everyone else.

Anything is possible I suppose. To me, it was no surprise really. I do have to say that, having worked with individuals in the security community, the primary focus really is the safety of our way of life at the hands of those who would subvert it.

The problem comes when those of less character use the government apparatus for control, political or other purposes. It's the same reason police and military need to be kept separate - one enforces the rule of law, and one protects against enemies. When those lines are blurred, history has demonstrated repeatedly that individual rights suffer. The degree to which this happens is the degree of the moral compass of those at the helm of this extremely powerful surveillance apparatus.

I'm not sure how many true boy scouts are really left running the show up there, but I do know this: the more paranoid we get, the more we lose. All of this need not come to pass in this way. One of the most important things I learned in my time in this world was "trust, but verify" and it rings true today. You can still trust the message that Bruce Schneier has. We have to, for otherwise we will be consumed by our own paranoia. But to verify is probably the most important point. That's where openness and information sharing in the spirit of open source is paramount and what will lead us to the proper conclusion on this matter.

Why?

[oldhack]

Agree/disagree with what he writes/says, but why do you have to trust him? Is he dating your daughter?

He Would Agree

[wisnoskij]

This question is stupid. It would not matter if he was the most honest, intelligent, and experienced security expert in existence, he would tell you the same thing, do not trust him.

What about ourselves?

[Dzimas]

Forget Schneier. The critical question is actually "Can we trust ourselves?" I'd argue not. Many of us post all manner of information about ourselves, our family, friends and work acquaintances on Facebook, LinkedIn, Twitter, Four Square and other sites. Our GPS-equipped phones know where we are, where we've been, and can probably predict where we're going and when. Short of unplugging, there's little we can do to assure that we're trustworthy electronic citizens.

The Schneier AI:

[Hartree]

He's really version 2.0 of a long term general intelligence project running on a supercomputer at Fort Meade.

Version 1.0 was called Henry Spencer and was developed in Canada.

(The original graphics version now used for videos of him started out as Max Headroom. This demonstrates yet again, it's much easier to improve on the presentation than the underlying system.)

Re:SubjectsInCommentsAreStupid

[Experiment 626]

Let the whitch hunt begin!

Whitch hunt would that be?

Can Bruce Schneier Be Trusted?

[Jeremiah Cornelius]

Why not? I have his SHA256 hash, right here, on this USB stick.

But wait! Am I sure I spelled "Schneierer" correctly?!?

Re:Can Bruce Schneier Be Trusted?

[gmanterry]

This could become a circus. If the NSA can get you to not trust Bruce, Then you couldn't trust any encryption system. If you trust none then you are just where the NSA want's you. Sometime we are going to have to pick someone we trust. Until proven otherwise, I trust Bruce.

Diverse Double-Compiling (trust but verify)

[dwheeler]

Thanks for pointing out my Diverse Double-Compiling (DDC) paper!

My page on Fully Countering Trusting Trust through Diverse Double-Compiling (DDC) has more details, including detailed material so you can duplicate the experiments and re-verify the proofs. Note that you do not have to take my word for it.

You have to trust some things. But you can work to independently verify those things, to determine if they're trustworthy. I don't always agree with Bruce Schneier, but after watching what's he's done for years, I've determined that he's quite trustworthy. This is the same way we decide if we should trust anyone or any thing. In short: "trust, but verify".

Re:Diverse Double-Compiling (trust but verify)

[dwheeler]

I've gotten a lot of hits, and that's a good thing. As I noted in another post, I got hit by reddit earlier this year. In general people are becoming more interested in protecting and verifying build environments, as this post about Tor demonstrates.

So please take a look at my Fully Countering Trusting Trust through Diverse Double-Compiling (DDC) page!

Re:seriously? because SCIENCE!

[guruevi]

I think misinformation in mathematics can be easily detected. Not only is math universal, it's also impossible to launch satellites or go to the moon without it. We would've noticed AND corrected any deliberate diversion of the sciences.

Re: Learn math

[Anonymous Coward]

Schneier isn't even a credentialed cryptographer.

You know he's designed several ciphers, right? Blowfish, Twofish, perhaps you've heard of them? Twofish was an AES finalist. If that doesn't give him credentials, what does?

Trust No One

[EmagGeek]

They really are out to get you.

Re:have a Bruce Battle Royale

[Arker]

"Put Schneier in a ring with Bruce Wayne, Bruce Willis, and Bruce Lee. See who survives."

Obviously the answer is no one. Lee is already dead, and he will still kill all the others before they can make it over the rope.

Schneier Facts

[otaku244]

"Bruce Schneier intercepts all your internal monologues by a man-in-the-middle attack."
^Seems legit to me

Re: Learn math

[Anonymous Coward]

He isn't licensed by the NSA to do crypto work. You wouldn't trust an unlicensed lawyer, or an unlicensed doctor, now would you (well, you might, but not for very long)? Better play it safe and keep your child porn and assassination plots securely in a DES container, potential criminal.

Linux backdoor of 2003 & Underhanded C Contest

[Valdrax]

To make the claim that linux has been never been intentionally weakened in security, you need to know that every single security vulnerability in Linux (to take one example) was due to carelessness, not intended action.

Certainly - some classes of backdoor are trivially obvious 'if(sourceip==NSA)' - but others can be subtle logic errors.

You mean like this attempt in 2003?

Personally, I'm not longer all that impressed by the IOCCC. Don't get me wrong, some of the code submitted there shows utterly insane levels of skill. However, the above is an excellent example of a good submission for the Underhanded C Contest, which is an excellent teaching tool for discovering exploits as well as for learning about subtle bugs that may drive you utterly mad trying to find.

Trusting US Persons?

[cpghost]

Since Bruce Schneier himself said that you can't trust US-based cryptography companies, because such companies can be compelled by law to cooperate with the CIA... doesn't it also mean that NO US Person who is under the jurisdiction of the NSA can be trusted w.r.t. crypto advice? Is there a law of some kind in the US that muzzles US crypto researchers and forces them not to disclose certain facts that could harm the NSA's ability to operate? I'm just curious.

Bruce Schneier

[david_a_eaves]

I am sitting next (or at least across) from Bruce right now. He is definitely interested (and humoured) in this conversation. As he notes, he's written a book on it. I'd say that a conversation about Bruce's trustworthiness is definitely worthwhile. One should have it about everybody. Of course, it means we should also have it about the people who are most interested in trying to attack Bruce's trustworthiness.

Bruce Schneier connection

[dwheeler]

Oh, and a Bruce Schneier connection: In 2006 Bruce wrote a summary of my ACSAC paper on diverse double-compiling (DDC). Bruce's article is simply titled Countering "Trusting Trust".

Bruce completely understood the approach. He explained it very well in his blog, and he also did a nice job explaining its larger ramifications. His conclusions are still true: the "trusting trust" attack has actually gotten easier over time, because compilers have gotten increasingly complex, giving attackers more places to hide their attacks. Here's how you can use a simpler compiler -- that you can trust more -- to act as a watchdog on the more sophisticated and more complex compiler.

Re:Bruce Schneier connection

[godrik]

I picked up your paper on slashdot actually (and probably from one of your posts). But I had never realized that you (as in the author of the paper) was posting on slashdot. That's pretty cool.

What is interesting about diverse double compiling is that it is feasible by a large technically savvy entity (but difficult in practice).

I must say that the trusting trust problem has become huge in the recent years. We pretty much have to rely on somebody for compiling our software and not just compilers. Compiling your own firefox or chromium or vlc is close to being impossible. There are too many dependences or the build chain is too complicated. (A friend of mine run out of disk space compiling chromium...) But assuming that you trust debian (or anyother large entity with technical expertise), you can rely on debian to make sure trusting trust problems do not appear. (And provided writing a C compiler is a standard student project, it should be easy to get multiple compilers to make sure none is backdoored.)

Reverse Engineering

[The Other White Meat]

Clearly, the only way we can be sure is to disassemble Bruce Schneier. Glove up.

A little history here...

[cstacy]

Is it reasonable to ask if Bruce Schneier can be trusted? WWBSD? A little history might inform your thinking on this question.

One of the early projects that Schneier lead, precipitated by the Y2K date crisis, was a security evaluation of old COBOL system (code-named "ZEBRA") that was still being used by a certain un-named U.S. Government agency.

This mainframe software had not been maintained for some years, except by patching the binary image; no online version of the source code was available. It would be too hard to audit that way, so they decided to upload the original code (from paper), recompile, diff against the binaries, and eventually reconstruct accurate source code for the Y2K bugs and security issues.

Schneier's group decided to use OCR. The source code had been "line printed" on "greenbar" paper, where alternate lines have a light green background stripes for contrast. The problem was that OCR scanners of the day were designed only for black-and-white, and would get confused by the green stripes, and sometimes mis-scan some letters and numbers, making this source code unreliable. This required them to manually read and type in corrections, to about half the code!

Bruce Schneier is an outspoken critic of agencies like the DHS and the TSA, but he has been a consultant for the Government in the past. And as you can see from the above story, he was originally an early proponent of scanners, and only in more recent years has spoken out against them. So it is quite reasonable to ask if Bruce Schneier has ever changed his stripes.