Schneier on Security

Clive Robinson • August 10, 2021 3:03 PM

@ ALL,

Many years ago I pointed out that Full Disk Encryption was at best problematical as it was an “all or nothing” solution and as with “communications” users need to take a layered approach with crypto to,

1, Protect data at rest (stored).
2, Protect data in transit (communicated).
3, Protect data in use (processing).

Whilst there are known structured and layered solutions to both 1 and 2 we are only marginally closer than we wwre last century on 3.

For data in “transit” you need a four layered approach currently,

2.1, Link encryption.
2.2, End to End encryption.
2.3, User level encryption.
2.4, Object level encryption.

Yes it’s a lot of encryption and a wise person would use different encryption types and modes for each layer. The first two 2.1, 2.2, in general will be automatically generated afresh for each new communications path establishment. The other two need to be selected with care in other ways (to long to go into here).

In the same way storage encryprion needs to be multi-layered and use multiple algorithms and modes.

That way if the FDE gets cracked whilst in use, little or norhing becomes available to the attacker.

A discussion on these could and has easily filled books in the past so don’t jump in thinking the water is warm and shallow it realy is deep, glacial, and with strong under tow to drag you down…

That’s not to say people can not design workable solutions, they can, they just need to be aware of what they are doing and how it can go wrong.

Clive Robinson • August 12, 2021 4:13 PM

@ Zeph,

So, this threat is mostly applicable to jet-setters?

No not in the slightest, it’s a threat to anyone who leaves the ICT equipment “unguarded” even for moments (so back in the old days a grab of a laptop in a coffee shop was applicable).

The quote of,

“but you leave it in your hotel room all the time when you go out to dinner.”

Comes from the original “Evil Maid Attack” definition from what feels like ages back before the major change in society caused by the recent but necessery “Home Working” which was in turn caused by the failings of our political leaders and the lobbyists of a year or so ago. Who kind of proved “Stupid is as stupid does” and in some cases killed themselves with their stupidity (but not enough for the message to get through).

So take your average new “home worker” what do they do with that “work computer” when they are not “home working”?

Lock it in a desk draw? Do they even have a desk? Maybe they work of the kitchen or dining table or one of those sofa “TV Meals” type trays…

Do they have a propper physical safe for the ICT equipment that is rated at 60mins or more by Underwrighters Laboratories (UL)? That is wired into an alarm system that will get an armed guard response in 15mins or less? Probably not, and even if they did what’s the odds they would not pop-off for a few minutes whilst not locking it all up?

So effectively No?

Well that means they are a potential candidate for “New age Evil Maid” or a “cat burglar”. Or unfortunately more likely a “quater of a dozen of mercenary thugs”. Who these days turn up with guns, sledgehammers, and optionaly a set of tools to extract information out of you via your finger and toe nails etc.

That’s what “Physical Security measures” are all about when very valuable “physical items” are moved from “physically protected interanal secure areas” to “physically unprotected external areas” and the “Security Perimiter” needs the correct “physical adjustments” to cope with it.

There is a huge crossover between “Physical Security” for tangible physical objects and “Information Security” for intagible non physical information objects.

Why? Because there are only three things you can actually do with “information objects”,

1, Communicate them.
2, Store them.
3, Process them.

That is the “information” has to be “impressed or modulated” on physical energy, matter, or both which makes it possible for “us” “physical objects” to interact with it.

Thus whilst we might use “encryption” it is only as good as the ultimate protection of the “encryption keys” held by the likes of a “secret” be it a password or passphrase in a persons head (prey to what ever gods you believe in that some idiot has not used bio-metrics in the security design you have to use).

That is the simple reality, if an employer puts information of high value on a laptop so someone can “Home work” or “work whilst travelling” sooner or later somebody will work out that the easy way to realise “the value” is to get at the laptop whilst the information they want is “unlocked”.

It’s why I consider “security” that only uses FDE a very dangerous joke at best. Hence my earlier comments about the requirment for a layered approach,

https://www.schneier.com/blog/archives/2021/08/defeating-microsofts-trusted-platform-module.html/#comment-386471

Which if you design it properly –and very very few will– it will keep all but a tiny fraction of the information encrypted for most if not all of the time. Thereby reducing the likely hood of direct physical attack being either carried out or successfull.

Remember at the end of the day there are two basic sorts of crime,

1, Ego Food.
2, Realisation of value.

There is little or nothing you can do about “Ego Food” attacks they are about the attackers self-view more than they are anything else. So a graffiti artist putting up a rude message and their tag on the front of a Political Leaders home is an “Ego Food” attack.

What you can do by the use of “Probabilistic Security” is significantly reduce the likelyhood of a “Realisation of value” attack. If the attacker knows the probability of files being unencrypted at any point in time is incredibly small likewise the access to encryption keys, it means the ROI on such an attack is very small thus they will look for other attacks with a higher ROI.