News for hackers. Stuff that matters.
Re:Technical feasibility of decrypting https by replacing th... by tptacek on Sunday July 14, 2013 @11:23AM (#6041084)
See Julian Morrison's comment upthread. If you don't trust Intel, don't kid yourself; you can't use their CPUs for crypto at all.
Re:Technical feasibility of decrypting https by replacing th... by captainmuon on Sunday July 14, 2013 @01:17PM (#6041416)
I believe that is fallacious.

For example, I don't trust Microsoft. We now know that they have some kind of backdoor in Skype. They are able to give the contents of my conversations to law enforcement or intelligence agencies. If I'm targeted, they can just flip a switch and record anything they want. But that doesn't mean it's impossible to have secure conversations if you use a Microsoft OS. It's unlikely that there is an actual remote admin backdoor in Windows itself, and even if it was, you'd have to be targeted, your PC identified, and the backdoor has to be activated before someone can siphon off data. And if you have a decently secure network, and use secure, open source software that doesn't route your traffic over microsoft's servers, it's much much harder to identify, let alone eavesdrop on you.

The existence of one highly specific access vector does not imply that the whole platform is compromised. Conversely, just because there is the theoretical possibility that the platform may be compromized on a low level, one should not forego additional security measures.

Just because the NSA might install a camera above my keyboard, I shouldn't stop encrypting my emails. Just because Intel might subvert my CPU in multiple ways doesn't mean I shouldn't be wary of them introduce specific potential security weaknesses.

*) Let's look at a potental tinfoil-hat attack mode. Intel might have some entity in their processors that detects whether I'm a potential target for surveillance and then weakens the hardware crypto. It would have to be pretty clever to find out from the CPU instructions that I'm doing something suspicious, or that I'm visiting a website containing a secret "enable weak crypto" byte sequence. While we're at it, it might also rewrite instructions to weaken 'software' crypto too, or even inject instructions to phone home. While theoretically possible, I believe this is highly unlikely. It is much, much more likely that they'd introduce a subtle weakness in the RNG that would let them crack keys a bit easier.

Being afraid about the former surely is paranoia, being afraid about the latter is rational distrust in a black box, IMHO.

Re:Technical feasibility of decrypting https by replacing th... by yuhong on Sunday July 14, 2013 @03:33PM (#6041915)
Besides, I think the Skype backdoor started before it was acquired by MS: http://www.slate.com/blogs/future_tense/2013/07/12/skype_sur...
Re:Technical feasibility of decrypting https by replacing th... by tptacek on Sunday July 14, 2013 @03:28PM (#6041899)
This looks like more of a speculative political comment than a technical one. Your last paragraph is the only one that makes direct observations on crypto implementation, but gets crypto so wrong that I'm not encouraged to answer it; as a starting point, the problems in Intel microarchitecture that have led to actual attacks on cryptosystems have all targeted pure software crypto so far.
Re:Technical feasibility of decrypting https by replacing th... by acqq on Sunday July 14, 2013 @11:34AM (#6041117)
Sorry I don't see the relevance of CPU having any hidden global state in the thought experiment I've addressed. If all I give you is a PGP file made on the Intel CPU you simply don't have access to the global state of my CPU and I can be sure that I'd get exactly the same file up to the last bit using non-Intel CPU starting from the same inputs (including same 'seeds'). So I can actually be absolutely sure in AES instructions for any scenario where I only give you the results of encryption.
Re:Technical feasibility of decrypting https by replacing th... by lucian1900 on Sunday July 14, 2013 @12:14PM (#6041252)
You're open to a different attack: If someone has access to (part of) your CPU state before and after you make the PGP file, they may be able to decrypt the message if they manage to intercept it.
Re:Technical feasibility of decrypting https by replacing th... by nknighthb on Sunday July 14, 2013 @01:21PM (#6041432)
And who is likely to have that access on an air-gapped machine in a faraday cage, exactly?
Re:Technical feasibility of decrypting https by replacing th... by chacham15 on Sunday July 14, 2013 @11:36AM (#6041128)
Just as a thought experiment: what sort of attack could Intel make if you limited your instruction set to the bare instructions (i.e. no special crypto assembly code)? Wouldn't it be unfeasible to attempt to detect crypto operations using normal assembly functions without even knowing whether crypto is taking place or not?
Re:Technical feasibility of decrypting https by replacing th... by tptacek on Sunday July 14, 2013 @11:47AM (#6041160)
Practically every hardware side channel paper considers exactly this scenario. Start with Osvik and Tromer.