Secrets & Lies Bruce Schneier Wiley, 2000 Reviewed November 14, 2000 Bruce Schneier has long been known as the author of Applied Cryptography, the definitive nuts-and-bolts guide to how cryptographic algorithms work and their implementation. That book became a bible for aspiring cypherpunks everywhere, both for its technical information and for its enthusiasm for what cryptography can do. Cryptography was the answer to many of the world's problems. Mr. Schneier has changed his perspective somewhat in the years since Applied Cryptography came out, which is why Secrets & Lies begins with: "I have written this book partly to correct a mistake.... It's just not true. Cryptography can't do any of that." Has he lost his belief in cryptography? A number of people have described Secrets & Lies as a dark book. Certainly much of it comes off that way. It describes numerous cryptographic and security techniques, and how vulnerable they all are. Cryptography may seem unbreakable mathematically, but that doesn't help much. The implementation of a cryptographic algorithm is certainly buggy, the computer the code runs on may be compromised, the keyboard could be bugged, and the user will probably simply tell you his or her key if you call up and pretend to be somebody with a right to know. What this book tells us is that we've been trying to fix the wrong threats. Cryptography is great, firewalls are great, and so on, but the bad guys will probably just find a way to go around it all. Example: the Secure Socket Layer (SSL) uses encryption to protect conversations between web servers and browsers. To that extent, it prevents casual eavesdropping. But somebody who really wanted to steal credit card numbers can work, instead, at subverting the domain name system so that a site under his control masquerades as an e-commerce site. Digital certificates are supposed to prevent this attack, but nobody ever looks at them; a victim would never know until the credit card bills came in. According to Schneier, "Digital certificates provide no actual security for electronic commerce; it's a complete sham" Even if the protocol made more sense, the increasing complexity of software systems makes security impossible. In particular, component-oriented systems are pointed out as sources of trouble. Much Microsoft software is heavily oriented around components now, and both GNOME and KDE are heading quickly in that direction, so this is a warning that should be heeded. Component applications piece themselves together as they go, to the point that any individual user can be running a software configuration that is unique in the world. There is no way to test all of the possible interactions between the components - and it does happen that particular combinations create bugs that do not exist in the individual components themselves. The core point in the book is that technical measures can never be expected to provide security for computers and data. There will always be ways to defeat those measures; all that can really be done is make it harder. And, in this respect, computer security is just like security in the real world. Door locks are not an absolute solution to burglary; heavy vaults are not sufficient to make a bank secure; car alarms do not keep a car from being stolen. In the same way, cryptography, firewalls, and passwords will not make a computer unassailably secure. The physical world gets by, usually, even with imperfect preventive measures against crime. The key is to not rely on prevention only. What is needed, along with prevention, is detection and response. A bank vault is a preventive measure; the alarm system supplies detection, and guards, police, and the court system handle the response. All of these measures, together, make most banks secure enough. Most of the time. Then there's insurance for the remaining cases. Security in the computing world has concentrated on preventive measures, but they will never do the complete job. Prevention needs to be complemented with comprehensive intrusion detection and with competent and decisive response. Mr. Schneier thinks that systems security in the future will be outsourced to companies that are skilled at detection, and which have a crowd of experts on hand, 24x7, to figure out appropriate responses. Companies that provide that kind of service will be able to provide reasonable security; less comprehensive approaches will fail. The reader only gets one guess as to what business Mr. Schneier's newly refocused Counterpane Internet Security is in. Bruce Schneier is a an interesting writer with a good sense of humor. The book is amazingly nontechnical given its subject; the reader need have very little understanding of computers, networks, mathematics, or cryptography to follow the discussion. Mr. Schneier does have a large vocabulary, confronting readers with words like "daedal," "operose," "psephologist," and "neoteric." It's a learning experience. Openness of cryptographic systems is brought up many times; a closed, proprietary cryptographic program is almost certainly insecure. Open source software as such is only touched on briefly; Mr. Schneier believes that open source can be more secure, but is not necessarily so. Just because the code is out there does not mean that somebody has taken the time to look at it. One interesting comment: Also note that this analysis completely sidesteps the relevant question of which process is more likely to produce secure software, by design, in the first place. Open source is a business model first, and a security strategy second. Unfortunately, the traditional proprietary software methodologies are probably more likely to produce high-quality large software. Maybe the best thing for security is to create proprietary software and then, after the fact, turn it into open source... I find his lack of faith disturbing. Nonetheless, this book is quality stuff, and should probably be required reading for anybody who is concerned with the security of digital systems. Mr. Schneier's vision of the directions digital security will take is probably accurate, and it is well and clearly expressed. --jc