New Threat Models for Cryptography 3 August 2016 Bart Preneel National Security Agency cryptologic intelligence agency of the USA DoD – collection and analysis of foreign communications and foreign signals intelligence New Threat Models – protecting government communications and information systems for Cryptography Bart Preneel COSIC KU Leuven and iMinds, Belgium Bart.Preneel(at)esat.kuleuven.be 3 August 2016 © KU Leuven COSIC, Bart Preneel 1 2 3 4 NSA calls the iPhone users public 'zombies' who pay for their own surveillance NSA: “Collect it all, know it all, exploit it all” www.wired.com 5 6 1 New Threat Models for Cryptography 3 August 2016 Bart Preneel Outline Snowden revelations most capabilities could have been extrapolated from open sources • Snowden revelation: the essentials But still… • Going after crypto massive scale and impact (pervasive) • Impact on systems research and policy level of sophistication both organizational and technical – redundancy: at least 3 methods to get to Google’s data – many other countries collaborated (beyond five eyes) – industry collaboration through bribery, security letters*, … • including industrial espionage undermining cryptographic standards with backdoors (Bullrun) … and also the credibility of NIST 7 * Impact of security letters reduced by Freedom Act (2 June 2015) 8 Snowden revelations (2) Most spectacular: active defense • networks – Quantum insertion: answer before the legitimate website – inject malware in devices • devices – malware based on backdoors and 0-days (FoxAcid) – supply chain subversion Translation in human terms: complete control of networks and systems, including bridging the air gaps No longer deniable Oversight weak 9 10 Rule #1 of cryptanalysis: Where do you find plaintext? SSO: Special Source Operations search for plaintext [B. Morris] 1. PRISM (server) 2. Upstream (fiber) AliceEve/NSA Bob CRY Clear Clear CRY Clear Clear PTO PTO text text text text BOX BOX Tempora 11 12 2 New Threat Models for Cryptography 3 August 2016 Bart Preneel 3. Traffic data (meta data) (DNR) TEMPORA architecture (1) Gain “access” to raw content: intercept (cable, satellite), hack, buy, ask. traffic data is not plaintext itself, but it is very informative Turbulence 3 days:125 Petabyte Tempora/Xks • who talks to whom from where and with which device (US$ 200M) • URLs of websites • locations of devices (2) “Selector” based Ring (3) Standard MetaMeta- “promotion” Queries • it allows to map networks and identify social relations Buffer Data Selectors (4) “Map Reduce” 4. Client systems (TAO) Target Queries Selectors Promoted Traffic Promoted Enrichment hack the client devices Signals Intelligence Traffic Promoted • use unpatched weaknesses (disclosed by vendors Queries Translation, or by update mechanism?) Target Collation, • sophisticated malware Selectors Long Term Intel. Database Analysis, products 13 Slide credit: George Danezis, UCL * Tempora ~ Deep Dive Xkeyscore (NSA) 14 Which questions can one answer with mass surveillance systems/bulk data collection? NSA is not alone Tempora (GCHQ) ~ Deep Dive Xkeyscore (NSA) • I have one phone number – find all the devices of this person, his surfing behavior, the location where he has travelled to and his closest collaborators • Find all Microsoft Excel sheets containing MAC addresses in Belgium • Find all exploitable machines in Panama • Find everyone in Austria who communicates in French and who use OTR or Signal BND has spied on EU (incl. German) companies and targets in exchange for access to these systems 15 16 Mass Surveillance panopticon If data is the new oil, data mining yields the rocket fuel [Jeremy Bentham, 1791] industry discrimination fear conformism - stifles dissent oppression and abuse users government 17 18 3 New Threat Models for Cryptography 3 August 2016 Bart Preneel Lessons learned Outline Economy of scale Never underestimate a motivated, well-funded and competent attacker • Snowden revelation: the essentials Pervasive surveillance requires pervasive collection and active • Going after crypto attacks (also on innocent bystanders) Active attacks undermines integrity of and trust in computing • Impact on systems research and policy infrastructure Emphasis moving from COMSEC to COMPUSEC (from network security to systems security) Need for combination of industrial policy and non-proliferation treaties 19 20 NSA foils much internet encryption If you can’t get the plaintext NYT 6 September 2013 The National Security Agency is winning its long- running secret war on encryption, using AliceEve/NSA Bob supercomputers, technical trickery, court orders and behind-the-scenes persuasion to undermine CRY CRY %^C& %^C& Clear the major tools protecting the privacy of Clear PTO PTO @&^( @&^( text everyday communications in the Internet age text BOX BOX [Bullrun] Ask for the key! 21 22 Find the Private Key (Somehow) Asking for the key • Logjam: TLS fallback to 512-bit export control legacy • (alleged) examples – through security letters? systems • Lavabit email encryption • 1024-bit RSA and Diffie-Hellman widely used default • CryptoSeal Privacy VPN option not strong enough • SSL/TLS servers of large companies? • GCHQ Flying Pig program • Silent Circle email? • Truecrypt?? [Adrian+] Imperfect Forward Secrecy: How Diffie- Source: SSL Pulse Hellman Fails in Practice, CCS 2015 23 24 4 New Threat Models for Cryptography 3 August 2016 Bart Preneel If you can’t get the private key, If you can’t get the key substitute the public key 12M SSL/TLS servers make sure that the key is generated using a fake SSL certificates or SSL person-in-the-middle as random number generator with trapdoor commercial product or government attack – 650 CA certs trustable by common systems Pseudo- – Comodo, Diginotar, Turktrust, ANSSI, China Internet Network Information Center (CNNIC), Symantec random – Flame: rogue certificate by cryptanalysis seed number live since November 2015 generator https://letsencrypt.org/isrg/ (PRNG) [Holz+] TLS in the Wild, NDSS 2016 trapdoor allows to predict keys [Stevens] Counter-cryptanalysis, Crypto’13 25 26 Dual_EC_DRBG Dual_EC_DRBG Dual Elliptic Curve Deterministic Random Bit Generator • 10 Sept. 2013, NYT: "internal memos leaked by a former NSA • ANSI and ISO standard contractor suggest that [..] the Dual EC DRBG standard […] • 1 of the 4 PRNGs in NIST SP 800-90A contains a backdoor for the NSA." • draft Dec. 2005; published 2006; revised 2012 • 16 Sept. 2013: NIST “strongly recommends" against the use of Dual_EC_DRBG, as specified in SP 800-90A (2012) • Two “suspicious” parameters P and Q • Nov. 2013: RSA’s BSAFE library chooses DUAL_EC as default • Many warnings and critical comments • Dec. 2015: Juniper announces Dual_EC problems for Netscreen • before publication [Gjøsteen05], [Schoenmakers-Sidorenko06] • 08: 6.2.r01 uses Dual_EC in a way it can be exploited • after publication [Ferguson-Shumov07] • 12: someone changed the backdoor (6.2.r015) Appendix: The security of Dual_EC_DRBG requires that the [Checkoway+] On the Practical Exploitability of Dual EC in TLS points P and Q be properly generated. To avoid using Implementations, Usenix Security 2014 potentially weak points, the points specified in Appendix A.1 [Checkoway+] A Systematic Analysis of the Juniper Dual EC Incident, should be used. Cryptology ePrint Archive, Report 2016/376 27 28 Cryptovirology [Young-Yung] NSA can (sometimes) break SSL/TLS, IPsec, SSH, PPTP, Skype http://www.cryptovirology.com/cryptovfiles/research.html end 2011: decrypt 20,000 VPN connections/hour • http://www.spiegel.de/international/germany/inside-the-nsa-s-war-on-internet-security-a-1010361.html • http://blog.cryptographyengineering.com/2014/12/on-new-snowden-documents.html 29 30 5 New Threat Models for Cryptography 3 August 2016 Bart Preneel Fighting cryptography Encryption to protect industry ~18.3B • Weak implementations: PRNG or more log10 • Going after keys 12 • Undermining standards 6.2B 6B 10 3B 2.4B • Cryptanalysis 250M 200M 200M 8 37M • Increase complexity of standards 6 • Export controls 4 • Hardware backdoors • Work with law enforcement to promote backdoor 2 access and data retention 0 31 © Bart Preneel 32 Not Encryption to protect user data ~12.5B end to (not meta data) Browser Outline end http:// https:// SSL Transport System log10 HTTP over SSL 12 • Snowden revelation: the essentials 6.3B 10 3.5B • Going after crypto 1B 700M 500M 500M 20- • Impact on systems research and policy 8 50M? 12 M 6 ? ? 4 2 0 Mobile Browsers WhatsApp iMessage Skype Harddisk IPsec SSL/TLS © Bart Preneel 33 34 COMSEC - Communication Security COMSEC - Communication Security meta data Secure channels: still a challenge Hiding communicating identities • authenticated encryption studied in CAESAR http://competitions.cr.yp.to/caesar.html – few solutions – need more Forward secrecy: Diffie-Hellman versus RSA – largest one is TOR with a few million users – well managed but known limitations Denial of service • e.g. security limited if user and destination are in same country Simplify internet protocols with security by default: DNS, BGP, TCP, IP, http, SMTP,… Location privacy: problematic 35 36 6 New Threat Models for Cryptography 3 August 2016 Bart Preneel COMSEC - Communication Security COMPUSEC - Computer Security Do not move problems to a single secret key Protecting data at rest – example: Lavabit email – well established solutions for local encryption: – solution: threshold cryptography; proactive cryptography Bitlocker, Truecrypt Do not move problems to the authenticity of a single public key – infrequently