[Embedlets-dev] [Security] The Importance of Authentication

[Andrzej J. T. <an...@ch...>]

From the latest issue of Crypto-Gram, Bruce Schneier's security newsletter (full newsletter 
available at: http://www.counterpane.com/crypto-gram-0302.html ).  It seemed relevant to 
our recent security discussion, so I've quote the pertinent stuff here.

> Authentication is more important than encryption. Most people's
> security intuition says exactly the opposite, but it's true. Imagine a
> situation where Alice and Bob are using a secure communications channel
> to exchange data. Consider how much damage an eavesdropper could do if
> she could read all the traffic. Then think about how much damage Eve
> could do if she could modify the data being exchanged. In most
> situations, modifying data is a devastating attack, and does far more
> damage than merely reading it. 

> Here's another example: a Storage Area Network over IP within a
> corporate LAN. Eavesdropping on traffic is passive, and doesn't
> necessarily expose private data (particularly on a switched network).
> But a lack of authentication allows sector-level data tampering that
> was never possible with direct-attached storage. Adding authentication
> avoids that problem entirely. 

> Or consider your own personal computer. Because data isn't
> authenticated, you are much more likely to be the victim of viruses,
> Trojans, and malware. Encryption is important; authentication is more
> important. If your computer is controlled by someone on the other end
> of a Trojan, it doesn't really matter what kind of encryption you've
> implemented. 

> Of course any secure system should have both encryption and
> authentication, but to the novice, per-packet authentication seems
> like a painful and superfluous overhead. Again and again I see
> protocols designed by otherwise-intelligent committees that mandate
> encryption but not authentication: WEP, Bluetooth, etc. An early
> version of the IPsec standard had a mode that encrypted but did not
> authenticate. 

> Last year I had a conversation with an engineer involved with security
> for the Bluetooth wireless protocol. I told him that Bluetooth has
> only privacy and not per-packet authentication. He responded with the
> prototypical lame responses: 1) pseudorandom frequency hopping makes
> it "nearly impossible" for an attacker to get in, and 2) the range is
> only 8 feet, so the attacks are naturally limited. 
 
> I tried to argue the point, but eventually gave up. Then I said
> something like: "I can hardly wait for Bluetooth to become universal,
> because I really want a wireless keyboard and mouse with the "base
> station" built into my computer." He said: "Yes, but you really
> probably don't want to use Bluetooth for that, because then somebody
> could stuff keystrokes or mouse clicks into your system." I didn't
> know whether to laugh or cry. Talk about not getting it. 


...Andrzej

Chaeron Corporation
http://www.chaeron.com