Category Archives: Cryptography

Schneier:

Basically, you can tamper with a logic gate to be either stuck-on or stuck-off by changing the doping of one transistor. This sort of sabotage is undetectable by functional testing or optical inspection. And it can be done at mask generation — very late in the design process — since it does not require adding circuits, changing the circuit layout, or anything else. All this makes it really hard to detect.

The paper talks about several uses for this type of sabotage, but the most interesting — and devastating — is to modify a chip’s random number generator.

Which means that the crypto is sabotaged.

Neither Bruce nor I is willing to say the NSA isn’t doing this.

The Cowboy of the NSA: Inside Gen. Keith Alexander’s all-out, barely-legal drive to build the ultimate spy machine (Foreign Policy):

Alexander was fond of building charts that showed how a suspected terrorist was connected to a much broader network of people via his communications or the contacts in his phone or email account.

“He had all these diagrams showing how this guy was connected to that guy and to that guy,” says a former NSA official who heard Alexander give briefings on the floor of the Information Dominance Center. “Some of my colleagues and I were skeptical. Later, we had a chance to review the information. It turns out that all [that] those guys were connected to were pizza shops.”

A retired military officer who worked with Alexander also describes a “massive network chart” that was purportedly about al Qaeda and its connections in Afghanistan. Upon closer examination, the retired officer says, “We found there was no data behind the links. No verifiable sources. We later found out that a quarter of the guys named on the chart had already been killed in Afghanistan.”

Those network charts have become more massive now that Alexander is running the NSA. When analysts try to determine if a particular person is engaged in terrorist activity, they may look at the communications of people who are as many as three steps, or “hops,” removed from the original target. This means that even when the NSA is focused on just one individual, the number of people who are being caught up in the agency’s electronic nets could easily be in the tens of millions.

We could debate that “barely legal” part. But then again, like the Daily Show said way back at the beginning of this long strange trip, the biggest scandal might be that all this spying is in fact legal.

Bruce Schneier, explaining to Financial Times why US tech companies will get hurt by news that NSA got some of them to put back doors into their products while others complied with the FISA court orders — even setting up automated systems transfer the data:

“How would it be if your doctor put rat poison in your medicine? Highly damaging,” said Bruce Schneier, a US computer security expert.

Might make you shop around a just a little bit. When the dust settles though, it’s not clear what other country’s tech providers will seem more trustworthy. China? Korea? UK? France? Unlikely all. Not Switzerland. Certainly not Russia. Who then? Can Iceland grow a big enough tech sector?