4 ms·

Since he knows Niels Ferguson and understands cryptography, why doesn't Bruce get some proper analysis or statement regarding the damage of removing the diffuse

Since he knows Niels Ferguson and understands cryptography, why doesn't Bruce get some proper analysis or statement regarding the damage of removing the diffuser? Seems like that's one obviously big elephant in the room here.

bradford 11y ago
Bruce's article linked to this article (https://firstlook.org/theintercept/2015/06/04/microsoft-disk-encryption/ https://firstlook.org/theintercept/2015/06/04/microsoft-disk...), which does have a statement about the elephant diffuser, including why MS removed it and its overall impact to bitlocker. I think it's best summarized as: "Removing the Elephant diffuser doesn’t entirely break BitLocker. If someone steals your laptop, they still won’t be able to unlock your disk and access your files. But they might be able to modify your encrypted disk and give it back to you in order to hack you the next time you boot up"
- tptacek 11y ago
  That is true of practically every full disk encryption package, because of the nature of encrypting disk sectors rather than files: with no format flexibility or straightforward place to store metadata, and no awareness of message boundaries, it is difficult to meaningfully authenticate data. Vanilla CBC makes it easier to mount attacks, and XTS makes it harder, and the diffuser may have even made it incrementally harder. But no notion of difficulty here deserves the uppercased "Hard" we're looking for with cryptography: at best, you concede attackers "only" the ability to randomize targeted ranges of stored bytes, which --- especially for the mountains of C code we call "operating systems" --- is a devastating vulnerability. If you are seriously worried about Highly Capable Attackers, and you lose custody of your laptop, you should consider writing it off.
tptacek 11y ago
What analysis are you looking for? The purpose of the "diffuser" is well-understood, as are the security implications of losing it. This comes up on HN about once every other month, on threads you've been a part of. What part of the explanation you've gotten here seemed inconclusive?
- MichaelGG 11y ago
  Bruce cites removal of the diffuser as a specific reason he no longer thinks Bitlocker is OK. If that's really what he thinks, why doesn't he say exactly why? There are practical attacks on Bitlocker without the diffuser, but Ferguson stated he didn't believe there would be with the diffuser (in the original Bitlocker paper, I think). Your explanation, that the diffuser doesn't make it Hard, is understandable and it's not something I'd worry about. And the way you phrase it, it seems unarguable and straightforward that it isn't a big deal, that no one should ever rely on FDE for integrity. But Bruce understands a lot more than me, and he's citing this as a big deal. And MS/Ferguson originally made a big deal out of it. So was it always just a useless add-on? Wouldn't someone have published a paper showing how Elephant doesn't really help? Certainly a practical attack on it would be notable? I hope you can appreciate my confusion.
  - tptacek 11y ago
    We don't have to read tea leaves about what Schneier does or doesn't think, because the engineering issue here is straightforward. Ferguson wrote a paper about the CBC+diffuser construction, and what it's goals were. On a previous thread, 'pbsd even pointed out that the performance issues made sense: the CBC+diffuser construction couldn't easily benefit from hardware AES instructions, which harmed performance.
    - MichaelGG 11y ago
      I'm only trying to be rigorous in my evaluation of the evidence, since I'm in no position to judge the actual strength of the diffuser. Yes, this is probably just academic, as I wouldn't trust a disk with suspected tampering. (Or if that was required, like storing VHDs on a hosted block device, I'd store a hash of the disk or executables.) Anyways, my reasoning: 1. The diffuser didn't really help for serious threat scenarios, and hurt perf, so no one should be upset by its removal. This seems to be true. 2. But MS previously called the diffuser critical and has made no statements as to the security impact of the removal. (Indeed, there are easy attacks without the diffuser, but no known attacks with it.) 3. A well-known cryptographer (Bruce's actual cryptography credentials are undoubted, correct?) cites the removal as a reason to be suspicious. If 1 is true, which I think it is, then 2 and 3 are at odds with how reality should be. No matter how confident I am in 1, points 2 and 3 require a shift in the probability of 1. Or, I am misunderstanding 2 and 3. How else should I evaluate these things? Sorry for being dense or wasting your time.

bradford 11y ago

Bruce's article linked to this article (https://firstlook.org/theintercept/2015/06/04/microsoft-disk-encryption/ https://firstlook.org/theintercept/2015/06/04/microsoft-disk...), which does have a statement about the elephant diffuser, including why MS removed it and its overall impact to bitlocker. I think it's best summarized as: "Removing the Elephant diffuser doesn’t entirely break BitLocker. If someone steals your laptop, they still won’t be able to unlock your disk and access your files. But they might be able to modify your encrypted disk and give it back to you in order to hack you the next time you boot up"

tptacek 11y ago
That is true of practically every full disk encryption package, because of the nature of encrypting disk sectors rather than files: with no format flexibility or straightforward place to store metadata, and no awareness of message boundaries, it is difficult to meaningfully authenticate data. Vanilla CBC makes it easier to mount attacks, and XTS makes it harder, and the diffuser may have even made it incrementally harder. But no notion of difficulty here deserves the uppercased "Hard" we're looking for with cryptography: at best, you concede attackers "only" the ability to randomize targeted ranges of stored bytes, which --- especially for the mountains of C code we call "operating systems" --- is a devastating vulnerability. If you are seriously worried about Highly Capable Attackers, and you lose custody of your laptop, you should consider writing it off.

tptacek 11y ago

What analysis are you looking for? The purpose of the "diffuser" is well-understood, as are the security implications of losing it. This comes up on HN about once every other month, on threads you've been a part of. What part of the explanation you've gotten here seemed inconclusive?

MichaelGG 11y ago
Bruce cites removal of the diffuser as a specific reason he no longer thinks Bitlocker is OK. If that's really what he thinks, why doesn't he say exactly why? There are practical attacks on Bitlocker without the diffuser, but Ferguson stated he didn't believe there would be with the diffuser (in the original Bitlocker paper, I think). Your explanation, that the diffuser doesn't make it Hard, is understandable and it's not something I'd worry about. And the way you phrase it, it seems unarguable and straightforward that it isn't a big deal, that no one should ever rely on FDE for integrity. But Bruce understands a lot more than me, and he's citing this as a big deal. And MS/Ferguson originally made a big deal out of it. So was it always just a useless add-on? Wouldn't someone have published a paper showing how Elephant doesn't really help? Certainly a practical attack on it would be notable? I hope you can appreciate my confusion.
- tptacek 11y ago
  We don't have to read tea leaves about what Schneier does or doesn't think, because the engineering issue here is straightforward. Ferguson wrote a paper about the CBC+diffuser construction, and what it's goals were. On a previous thread, 'pbsd even pointed out that the performance issues made sense: the CBC+diffuser construction couldn't easily benefit from hardware AES instructions, which harmed performance.
  - MichaelGG 11y ago
    I'm only trying to be rigorous in my evaluation of the evidence, since I'm in no position to judge the actual strength of the diffuser. Yes, this is probably just academic, as I wouldn't trust a disk with suspected tampering. (Or if that was required, like storing VHDs on a hosted block device, I'd store a hash of the disk or executables.) Anyways, my reasoning: 1. The diffuser didn't really help for serious threat scenarios, and hurt perf, so no one should be upset by its removal. This seems to be true. 2. But MS previously called the diffuser critical and has made no statements as to the security impact of the removal. (Indeed, there are easy attacks without the diffuser, but no known attacks with it.) 3. A well-known cryptographer (Bruce's actual cryptography credentials are undoubted, correct?) cites the removal as a reason to be suspicious. If 1 is true, which I think it is, then 2 and 3 are at odds with how reality should be. No matter how confident I am in 1, points 2 and 3 require a shift in the probability of 1. Or, I am misunderstanding 2 and 3. How else should I evaluate these things? Sorry for being dense or wasting your time.