Re: [gentoo-nfp] Developer Crypto Hardware (AGM)

[Alec Warner]

On Wed, Aug 22, 2018 at 12:13 AM Andrew Savchenko <bircoph@g.o>
wrote:

> Hi!
>
> On Mon, 20 Aug 2018 21:59:22 -0400 Alec Warner wrote:
> > On Mon, Aug 20, 2018 at 7:26 PM, Andrew Savchenko <bircoph@g.o>
> > wrote:
> [...]
> > > The problem is that people are considering a token as a silver
> > > bullet protecting them reliably. While protection will be indeed
> > > improved a bit, this is all the gain; and relaxed state of false
> > > security may prove to be more dangerous than not to have tokens at
> > > all.
> > >
> >
> > In security, the goal is to protect an asset valued at Y. We may spend X
> to
> > protect that asset. Generally X << Y; if you spend more than the asset
> was
> > worth in protection, it would be a waste of resources. So my goal here is
> > not to "build a system no one can hack into" that is a silly idea.
>
> Sure. The only question here is how much is they value of Y? How
> much all work hours spent on Gentoo cost? How much its reputation
> acquired over ~20 years costs? I have no easy answers for these
> questions, but I assume Y is not small.
>

My point is perhaps less the size of Y, and mostly that the size of X is
small. The Foundation has about 120k in the bank, so the security we can
fund is limited. E.g. below you discuss supply chain attacks, but the
foundation cannot afford to build a secure supply chain for the hardware it
might purchase; and developers use hardware outside of this supply chain
anyway. This basically leads to an security assumption:

 - Our supply chain is not secure (because we don't really have one.)
 - Attackers who can attack the supply chain can attack Gentoo.

Note that this is no different than most companies; so I don't think we are
*worse* off for having this stance. Is it not ideal? Sure. But its what we
can afford.


> > This is true throughout the industry. Security is a series of cost
> benefit
> > tradeoffs. For example, car keys are generally fairly high quality with
> > extra security features (e.g. an Immobilizer and encrypted or rotated
> > codes) vs a set of housekeys. Housekeys can typically be made for < 5$
> per
> > key at a machine in a store, and the locking mechanisms range from about
> > $20 to $400+. All of these features are moot if the attacker wants to be
> > loud. The CIA lockpicking manual[0] for instance has a conclusion that is
> > basically "you can probably drill out the lock and replace it faster than
> > you can pick it."
>
> There are plenty of doors and locks with protection from drilling
> out locks or cutting hinges protection :) And they are not that
> expensive at all.
>

I'm not aware of anyone selling an unbreakable door. Even the 'protection'
you mention is not full proof. What it does is requires more noise (bigger
saw, for locks, typically) and more time for the attacker to spend; and
more noise for the attack. These are all good attributes as they increase
attack risk. The security key is IMHO, similar. Attackers have to spend
1000$, they need to find someone who can extract the material (maybe the
attacker lacks this capability in house, etc.)


>
> > Safes are similar[1], and are rated for various 'times it takes a skilled
> > person to break into"; many of the higher ratings require anchoring as
> its
> > unlikely for attackers to gain lots of time with a safe unsupervised, so
> > they steal the safe and work on them offsite where time is more easily
> > available.
>
> The only goal of every physical safe is to give some *time* if an
> attack (either break-in or fire) is ongoing. This doesn't apply to a
> repository or infrastructure protection we're discussing — unless
> we're discussing how long it will take to break through good
> symmetric encryption, but apparently we want to protect from other
> attack vectors.
>




>
> > So when you make a counter argument like "well the attacker could
> > physically come take your token and spend 1000$ extracting the key" my
> > assertion is not that "well that is impossible" my assertion is that
> > "Great, the attacker has to *physically steal my key* and commit a crime,
> > then spend 1000$." The whole point is to make the attack annoying and not
> > worthwhile, not to literally make it impossible.
>
> One may loose a key accidentally or it will look like an accident,
> especially after a social event. It will be hard to impossible
> prove any criminal intent if someone will just find your token.
>

Again, this is a very expensive attack. I'm not worried about it, because
people willing to spend money can already break into Gentoo.


>
> Furthermore tokens may be busted during shipment or production.
> This will almost nullify their security. These are very vulnerable
> operations easy to backdoor and hard to make them secure.
>

The computer I generated my keys on also lacked a secure supply chain...so
I'm not sure how this is any worse. At some point you must accept risks;
otherwise building anything becomes too expensive.


> And last but not the least: laws are quite different in different
> areas and it is dangerous to rely on them for information security.
> Usually they are the last line of defense when technical means fail.


I'm seeing a lot of 'security keys are bad' and FWIW I appreciate the
skepticism of the idea. However, I am looking for a bit more constructive
feedback here. Lets say we don't buy keys; do you have any ideas on how we
can improve the security of our GPG infrastructure?

-A


>
> Best regards,
> Andrew Savchenko
>