� Liberty Sucks | Main | Antisubordination �

March 06, 2005

Driven to Security

Apart from the fact that I am doing it between 9pm and 2am, my quest to master elements of electronic security are very good for me.

When I took my first full-time job in 1979, it was at the radio department at Fedco La Cienega. As much as it's possible to be something of a local celeb, it was a very cool job to have back in those days. Hmm. I do need to do some more writing about those days. At any rate, I spent a lot of time at the high end audio concession and had a serious case of audiophilia, traces of which infect me to this day. What astounded me was that I discovered that there were turntables which didn't wear out records or skip. In my entire life up until that point, I took it as the nature of the beast that eventually all vinyl records skip and that you need to tape coins onto the tonearm so they wouldn't. Then I started learning about the subtlties of tracking force, anti-skate and the rest of turntable physics and I began to understand a new dimension. I soon purchased a Dual 440 and showed off the fact that I could play records upside down. Freaked people out, and underscored my lust for the technology. These days I am lusting after the unattainable beauty of perfect security. I'm actually starting to have dreams about it.

I've gotten my GnuPG working through Enigmail and a crufty little tray app called WinPT, but I'm digging the CLI. I've also been coming up with a series of code schemes to assist me. As I continue on this quest, several aspects of security are becoming clearer to me - to the point at which the hitherto impenetrable language is actually starting to make sense. But that means bigger questions.

Fzample, a PRNG is a pseudo-random number generator. This is something that a computer does because a computer is not a random machine. Certain algorithms do what they can to be as random as possible to generate a stream... The idea is that a computer can approach the perfect security of a one-time pad, but can't match it because the very fact that computers can be emulated make them incapable of perfect randomness. The idea of a one-time pad is that if you have a message that is x characters long and you mate it with a totally random key that is the same length and never use that key again, you basically have perfect security, because there is never a clue or a reason for that key to be determined. So the point is to come up with as random a key as possible.

How? Well that's the science. There are lots of ways to try to come up with random sequences of numbers but you have to start somewhere. That's called a seed. It's more difficult than it sounds. Take for example the first idea that I came up with:

Get yourself a baseball bat and a digital camera. Go out into the yard and make like one of those idiots on America's Funniest Videos. Put your head down on the upright bat and spin around until you are sick dizzy. As you are about to fall, wip out your digital camera and take a picture. Now come to your senses, download the digital picture and point to a random part on the screen. Find the color of the pixel you pointed to and use the digital code of that that as your seed.

Now how could I attack this method and come up with ways to guess the seed? I could look at green grass and blue sky and figure out the percentages of the time those numbers come up. I could guess that most people are right-handed when they point that their pixels could tend toward the right. I know most people won't try this at night and that they are not so likely to point at pitch black and a few degrees away from that, or perfect white and a few degrees from that. So what might seem to be random is actually not because of limitations of human perception. What we think might be a good random number simply isn't because of the ways humans think. Magicians do this kind of stuff when they're guessing your card.

One of the ironic principles of security is that 'security through obscurity' is a fallacy. Simply because a human being is highly unlikely to think of something does not make that something more secure. This is the challenge that I face in coming up with my coding schemes, and I'm trying to work my way through it. I am coming up with several coding schemes of varying strengths. The first one is called 'X' which is all of the memorized passwords I have used in my life, which could be reduced to a set of about 30. That includes bank PINs and simple passwords I use for website accounts and other kinds of stuff like that. (I've also been using PWS for several years and several other methods, so I'm not so vulnerable.) But of course I forget some of these passwords. Then there is 'Q' in which I take the chapter titles from certain a certain book and run an MD5 hash on it. The result gives me a nice 32 character passphrase which I use in a blowfish cypher. The cool thing about this method is that I can name the encrypted file with a Q10 and know that to generate the passphrase, I just need MD5 and a copy of the book (and a blowfish decoder of course). But what I don't need to do is remember the actual password for the file. What I do have to remember is the 'Q' coding scheme.

The question I have is whether coming up with coding schemes that help me systematically generate strong passwords is actually useful. In other words, does naming a file with some clue to its decryption key make that file more secure because the passkeys are immediately unknown to me, or should I use one master passkey and encrypt all files with that passkey?

I understand that the encrypted file is only as safe as the encryption method. The essential question is whether using multiple passkeys (not to encrypt the same file, for heavens sake) makes a single cipher better, and if so what is a good repeatable scheme?

I know that if I use codewords in the plaintext, that makes message that much more safe in case the cipher is successfully attacked, but my problem is password management. I don't like the idea of having all of my passwords to everything in one file under a master password. I'd like some files to live independently of my having a stored password.

Posted by mbowen at March 6, 2005 10:56 AM

Trackback Pings

TrackBack URL for this entry:


Are you for real? Anon.

Posted by: Anonymous at March 8, 2005 09:03 AM

That depends upon who's asking.

Posted by: cobb at March 8, 2005 12:43 PM

Some random number generators use data from seemingly random events like mouse position and the number of clicks performed, but I'd wager you already knew that.

Posted by: Matt at March 18, 2005 07:52 AM