 Encryption and hacking drones |
  |
 Aug 21 2006, 03:25 PM
Post
#26
|
|||
|
Runner  Group: Members Posts: 2,925 Joined: 26-February 02 Member No.: 948  |
Ah, now we are talking about Sniffer tests and electronic warfare, that's a completely different story where we can edit the commands/information as long as we have cut through the Encryption. Still, my example was ONLY about limiting Spoofing tests, those still take a lot less time than Sniffing for signals, decrypting signals and in the end editing them. I agree completely that with hacking and EW skills you can OWN drones - but Spoofing is the fastest in a pinch and such an order I described would curb it's use a bit. |
||
 |
 
|
||
|
Aug 21 2006, 05:00 PM
Post
#27
|
|||||||||||||
|
Hoppelhäschen 5000 Group: Members Posts: 5,807 Joined: 3-January 04 Member No.: 5,951 |
Good. Then it's breakable encryption, and SR4 has rules for doing that. End of the line.
Using PRNGs suffices.
If you re-use an OTP, if becomes a running-key cipher - those are trivial to break.
Bingo. |
||||||||||||
|
|
|
||||||||||||
|
Aug 21 2006, 05:03 PM
Post
#28
|
|
|
Mr. Johnson Group: Dumpshocked Posts: 3,148 Joined: 27-February 06 From: UCAS Member No.: 8,314 |
Excuse me while I wade in with my own 2¥ ...
I think Smokeskin's right. The OTP he describes would be easy, especially if the "page" to be used is broadcast each time. Could a hacker copy and store the signal, compare all of the transmissions, and find two uses of the same page and so crack part of the transmission? Sure. Sort of. If your OTP table has a million entries, and you change the page three times a second, you'll have enough entries to cover a constant stream of communication for a little over a hundred years without repeating. But what about the size of such a table? Let's say that one entry is about 4 kilobytes, about the size of a page of text (that's probably a bit high for an OTP page, but let's just say). That would put our million-entry table at around 4 gigabytes (give or take). Elder Scrolls IV takes 4.6 Gb of space. In either case, you can get machines today with that much RAM, never mind storage. A 4-gig file is trivial in a world where three-dimensional sensory rendering can be handled over any distance in real-time. Heck, a 40-gig file is, too. What Smokeskin is getting at is that there is a strong argument for subscribed systems (such as drones) being unspoofable without first getting a copy of the OTP file. Incidentally, after reading his (or her) argument, I agree with him. Note, please, that this does not render the Spoof program useless; there are plenty of items that take commands but would not be subscribed, such as garage door openers and hotel spa rooms and parking meters. This also does not make the drone un-crackable, but rather means the drone is part of the rigger's PAN, and so that PAN must be cracked to get at the drone, either by stealing the OTP file quietly, or hacking in hard and issuing commands from a more "legitimate" point. And if you're wondering about how to hack a drone that is being controlled remotely by a rigger who is hiding, well, I'll let you figure that one out yourself; you'll know it when you're on the right Track. If you're trying to drop a drone, shooting it would work better. If you're trying to dump a rigger who has jumped into a drone, hit it with a directional jammer. They're both faster. |
|
|
|
|
Aug 21 2006, 06:20 PM
Post
#29
|
|||||||||||||||||
|
Moving Target Group: Members Posts: 881 Joined: 31-July 06 From: Denmark Member No.: 8,995 |
Then you haven't understood the situation. Even if you had pattern recognition hardware that cracked anything in seconds, you would still need to collect transmissions for hours upon hours before getting enough to see a pattern in.
Which we obviously doesn't use. Getting random data isn't that hard. Buy some hardware that measures brownian movement and you're set. It may not have the perfect distribution to make it fit for monte christo calculations, but there won't be a pattern in it.
They're trivial to break if the cipher is used a lot of times. The major part of the OTP is enough random data to encode 2 hours worth of transmission. At 2 hours, you have nothing to pattern recognize on. Repeat it many times and you might get something. But we don't repeat it many times. We shuffle it with a PRNG every run. That means basically, you get to see 1 number from my PRNG every 2 hours (if you could crack the random stream encoding, which you haven't yet). You'll need quite a lot of these numbers to establish the underlying PRNG. But wait, we also feed the PRNG seeds from a smaller random OTP table. So you don't have a pattern there, that'll take a lot of effort to figure that one out. You get all these problems on top of each-other. You're looking at the very least at weeks of transmission and probably years before you have enough to begin breaking the code.
The also part was just to add a further complication, that perhaps isn't a complication in SR4. Breaking key encryption method is different though, they really just require you to get the public exchanges and a lot of number crunching. With this "extended use OTP system" you need so much transmission to crack it that for all practical intents of purposes, it is uncrackable. |
||||||||||||||||
|
|
|
||||||||||||||||
|
Aug 21 2006, 06:43 PM
Post
#30
|
|||||||
|
panda! Group: Members Posts: 10,331 Joined: 8-March 02 From: north of central europe Member No.: 2,242 |
and thats when you change the time between tests from 1 combat turn to maybe 1 hour or even 1 day, as that will be about the only diffrence... |
||||||
|
|
|
||||||
|
Aug 21 2006, 07:00 PM
Post
#31
|
|||
|
Moving Target Group: Members Posts: 881 Joined: 31-July 06 From: Denmark Member No.: 8,995 |
Yeah. If you make the decrypting extended test periods that long, and you need full-bandwidth transmission of that length to even make the test, then for pretty much any practical comms application it will effectively unbreakable. If you transmit continously on the same onetime pad for hours or days on end, you deserve to be listened in on. |
||
|
|
|
||
|
Aug 21 2006, 07:08 PM
Post
#32
|
|||
|
Mr. Johnson Group: Dumpshocked Posts: 3,148 Joined: 27-February 06 From: UCAS Member No.: 8,314 |
I thought it might aid the discussion to explain a bit more about OTP use. But I'm feeling lazy, so I'll just copy and paste from Wikipedia:
|
||
|
|
|
||
|
Aug 21 2006, 07:09 PM
Post
#33
|
|
|
Shooting Target Group: Members Posts: 1,706 Joined: 30-June 06 From: Fort Wayne, IN Member No.: 8,814 |
Based on what I have been reading here, it seems the most logically way is just extending the period on when you can do your extended test. I know for my group, forcing a successful decryption to hours is going to effectively make it unbreakable for a specific run, as none of my players are going to wait that long if they are doing everything else on the fly.
As to the reality of unbreakable encryption or just ones that take a long time...I don't think I, nor any of my players, care to try to parallel the realworld with these kinds of mechanics... I think I am also fine with making a subscribed drone unabled to be hacked unless the riggers comm is hacked first and then spoofed. I would still allow sniffed traffic, but that is of limited usage, IMO, when you are trying to gain control or get past a drone quickly... |
|
|
|
|
Aug 21 2006, 07:20 PM
Post
#34
|
|||||
|
Hoppelhäschen 5000 Group: Members Posts: 5,807 Joined: 3-January 04 Member No.: 5,951 |
That was thought for WEP, too - and proven wrong.
No problem with that houserule, apply it to every encryption and proceed. |
||||
|
|
|
||||
|
Aug 21 2006, 07:24 PM
Post
#35
|
|||||
|
Moving Target Group: Members Posts: 881 Joined: 31-July 06 From: Denmark Member No.: 8,995 |
Generating random one-time pads isn't a problem anymore. In 2070 it certainly won't be. Exchange of OTP takes preparation, which means it won't be used for "casual", daily use. Military, high-end security, black ops, shadowrunners - they'll prepare properly. Securing the OTP is a great hook. You need to find the rigger instead of just hacking the drone. Or you infiltrate the corp's security before the raid to get their OTPs. Or someone steals your team's OTP. Imo much of this stuff is better than random, on the fly generated encryption. The reason OTPs are relatively uninteresting today is that public key encryption is a lot easier and still effectively unbreakable - it takes enormous resources and a very long time. There just isn't much reason to use OTPs. If you give every hacker access to a quantum computing module that'll crack public key encryption in seconds, that all changes. |
||||
|
|
|
||||
|
Aug 21 2006, 07:37 PM
Post
#36
|
|||||
|
Moving Target Group: Members Posts: 881 Joined: 31-July 06 From: Denmark Member No.: 8,995 |
Well, that doesn't really have much to do with this situation, does it? If you have 2 hours worth of random stream to encode with, you of course will need several hours of transmission to begin pattern matching. You need 4 hours to just get 2 passes, the absolute minimum to match anything. |
||||
|
|
|
||||
|
Aug 21 2006, 07:41 PM
Post
#37
|
|
|
Target Group: Members Posts: 71 Joined: 29-July 06 From: Orlando, FL Member No.: 8,981 |
Has anyone stopped to think.... Maybe its something new.... Maybe we're bringing an overcomplicated view to the table.... Maybe this view is going to overcomplicate things... Maybe this overcomplication isnt going to be fun....
Just My Opinion... |
|
|
|
|
Aug 21 2006, 07:59 PM
Post
#38
|
|||
|
panda! Group: Members Posts: 10,331 Joined: 8-March 02 From: north of central europe Member No.: 2,242 |
any encryption is in theory breakable, its just that the brute force way (trying every key until one works) takes so long time that its not practical. same thing with physical security. you cant make something 100% secure. instead you make it take so long that most others will go look for a quicker target. |
||
|
|
|
||
|
Aug 21 2006, 08:23 PM
Post
#39
|
|||
|
Moving Target Group: Members Posts: 881 Joined: 31-July 06 From: Denmark Member No.: 8,995 |
Onetime pads aren't breakable. You're literally just as likely to get Legally Blonde 2 or next year's trideo hit as the drone's sensor feed if you try a bruteforce approach. You get the pad or you don't break the encryption. |
||
|
|
|
||
|
Aug 21 2006, 08:49 PM
Post
#40
|
|||||
|
Hoppelhäschen 5000 Group: Members Posts: 5,807 Joined: 3-January 04 Member No.: 5,951 |
It does, as there was the same claim you just made. What you need are some packets with the same code, and as you choose pseudo-randomly, that can happen pretty fast.
If perfectly implemented. If you don't like easily breakable encryption, increase the interval. While you are at it, increase firearm damage, the thresholds for breaking mag-locks, etc. Just going going for a 'more realistic' approach on one aspect of the game unbalances it. |
||||
|
|
|
||||
|
Aug 21 2006, 10:34 PM
Post
#41
|
|
|
Immortal Elf Group: Members Posts: 11,410 Joined: 1-October 03 From: Pittsburgh Member No.: 5,670 |
there's no such thing as a perfectly-implemented OTP. to do that, we'd first need a way to generate perfectly random numbers, and at the moment, all we have are ways to generate usefully (but imperfectly) random numbers. key word being 'useful'; for most intents and purposes, OTPs are unbreakable--as long as we understand 'unbreakable' to actually mean 'unbreakable within any useful timeframe'.
using OTP encryption on drones is, basically, using it wrong. there's nothing one-time about drone communication; by its nature, drone control is generally managed through a stream of constant communication. same with using it for team commo. to use OTPs correctly, you have to do what the name implies--use them one time. every time you use them, the chance that your code will be broken increases. but i think there's a good way to mimic the behavior of OTPs in the rules, without unbalancing things. here's how i'd do it. i think it's pretty balanceable (i'm providing the framework the rules should be based on, not the rules). basically, OTP encryption should be very strong, but should degrade over time, if used for something like team commo or drone control. i'd suggest something like this: give OTP encryption an effective rating equal to the square of its actual rating, for the purposes of decryption. in other words, if i'm using rating 4 OTP encryption, you have to decrypt it as if it were rating 16. however! the actual rating (4) would decrease over time. let's say something like -1 actual rating per hour. after an hour of drone control, the OTP's actual rating would be 3, effective rating 9. after two hours, 2 and 4. and so on. the reason it degrades is, there are lots of transmissions out there to collate, and the number of transmissions available for collation increases as time goes by. we just assume that searching for transmissions sent from the identified source is part of the decryption process. et voila. |
|
|
|
|
Aug 22 2006, 12:20 AM
Post
#42
|
|||
|
Decker on the Threshold Group: Dumpshocked Posts: 2,922 Joined: 14-March 04 Member No.: 6,156 |
Yes, but the drone is never going to be in constant use, is it? Even the most self-sufficient drone will need to be brought in for occasional repairs or preventative maintenence, and most will be running off of batteries or fuel sources that need to be replinished. At this point the OTPs can be exchanged, just as the oil is being changed. A smart runner will probably be changing his OTPs daily, or at best weekly. I mean it's not like drones have to be permenant or even semi-permenant installations. |
||
|
|
|
||
|
Aug 22 2006, 12:35 AM
Post
#43
|
|
|
Immortal Elf Group: Members Posts: 11,410 Joined: 1-October 03 From: Pittsburgh Member No.: 5,670 |
i meant "in constant use", eg for streaming traffic as opposed to single, discrete messages. yes, a rigger can (and should, since it won't last forever) change his 'OTPs' frequently. that's the downside to using them.
|
|
|
|
|
Aug 22 2006, 03:58 AM
Post
#44
|
|
|
Decker on the Threshold Group: Dumpshocked Posts: 2,922 Joined: 14-March 04 Member No.: 6,156 |
Not much of a downside for a rigger, as he gets direct access to the drone every once in awhile, albeit intermittently. During those times it would be pretty trivial to hook up a hard line to transmit that week/month's OTP set. It'd just be part of routine maintenence; heck by 2070 a good random number source would probably be a standard part of any good set of mechanic's tools, rather like laptops and other electronics gadgets are quickly becoming standard tools for dealing with the onboard computers of most newer cars.
(Edit): Yes, much data is going to have to change hands for a rigging interface to work. This does mean a whole lot of storage will be necessary to keep up with a true OTP encrypt, but then storage is aparently very cheap in 2070 so it's no big deal. |
|
|
|
|
Aug 22 2006, 06:23 AM
Post
#45
|
|
|
Immortal Elf Group: Members Posts: 11,410 Joined: 1-October 03 From: Pittsburgh Member No.: 5,670 |
there are balancing factors you can fudge to make it workable. the time it takes the OTP to degrade, for one; if your rating 6 OTP degrades to 0 after 6 hours, you might not want to use it on extended operations. i'm not suggesting these rules are strictly realistic; if you're looking for strict realism, i can think of a lot better places to start no matter what edition of the game you're playing. but i think rules like these could help make encryption a bit more believable--if not, as i said, make them actually realistic.
|
|
|
|
|
Aug 22 2006, 06:32 AM
Post
#46
|
|||||
|
Moving Target Group: Members Posts: 881 Joined: 31-July 06 From: Denmark Member No.: 8,995 |
Could you go back and re-read it? There is a 2-hour stream of random data to encode with - this is the perfect part of the OTP. Encrypting something with a stream of random data IS completely unbreakable. The PRNG is only used to mix the random stream after there's been transmitted for over 2 hours. The first 2 hours the enemy has recorded perfect static. The next 2 hours, they also get static, but there is some artefacts from the PRNG. If the enemy had the 2-hour random stream part of the OTP and they had the plaintext too, they'd effectively get to see one number from the PRNG. After 8 hours, they'd have 3 numbers from the PRNG. Breaking a PRNG, even with any amount of technical advancement, is impossible with only 3 numbers. Having the random stream at this point is also completely impossible, unless they got hold of the plaintext. They might have a few parts of it, but without the PRNG they can't decode it yet. Sure, this system can't run indefinately. But the enemy only gets one glimpse at the guts of the PRNG every 2 hours. Just becasuse there is a PRNG in there, it doesn't mean that it is easily breakable. You need to get a lot of samples from a PRNG before the numbers start being predictable. And too add further complications, the PRNG is fed random numbers from another random OTP table. And in the original example I even had different PRNGs also selected from a random OTP table. |
||||
|
|
|
||||
|
Aug 22 2006, 06:45 AM
Post
#47
|
|||
|
Moving Target Group: Members Posts: 881 Joined: 31-July 06 From: Denmark Member No.: 8,995 |
You're mixing up 2 different properties and uses for random numbers. For cryptology, you really just need unpredictability. It doesn't really matter that the bit-stream only has 49% 0s and 51% 1s, as long as it is unpredictable. The encryption strength doesn't really suffer from this lack of perfect distribution - it makes pattern matching a tiny little bit easier if you keep on re-using the OTP, but it doesn't give any decryption risk at all for the first pass. It isn't hard to make random numbers like that, basically some equipment measuring any natural random process will do, like a sensor looking at brownian movement in a liquid, or perhaps something looking at properties of air currents, with the feed recorded by your computer. You can buy packages that do this today. For many other applications, you need perfect distribution. That's the really hard part to get, and what most refer to when talking about how hard random numbers are to generate. Using OTP on drones wouldn't be using it wrong. You just need a large OTP. How much recording capacity do you assume a drone has? 8 hours? Use 25% of that space for an OTP, and you have 2 hours of continous full-sensor transmission completely secure. |
||
|
|
|
||
|
Aug 22 2006, 08:07 AM
Post
#48
|
|
|
Immortal Elf Group: Members Posts: 11,410 Joined: 1-October 03 From: Pittsburgh Member No.: 5,670 |
unpredictability works, for cryptology, but not as well as true randomness. if it's truly random, there's basically no breaking it. if it's just unpredictable, it's possible to find patterns if you have enough material to work with. generating less-than-random OTPs means that, eventually, someone's going to crack the system that you use for generating OTPs. at which point, you're screwed.
|
|
|
|
|
Aug 22 2006, 04:11 PM
Post
#49
|
|||
|
Mr. Johnson Group: Dumpshocked Posts: 3,148 Joined: 27-February 06 From: UCAS Member No.: 8,314 |
By "random" we mean "without a discernable mathematical pattern." Certainly, mathematically-generated random numbers will have a discernable pattern. However, a non-mathematical algorithm, such as a random list generated by the the keyboard mashing common to PGP key generation, is suitably random for an unbreakable OTP table. |
||
|
|
|
||
|
Aug 22 2006, 04:19 PM
Post
#50
|
|||
|
Hoppelhäschen 5000 Group: Members Posts: 5,807 Joined: 3-January 04 Member No.: 5,951 |
No. It may suffice for some time. Even atomic decay or interstellar radiation were found having patterns. |
||
|
|
|
||
|
|
Lo-Fi Version | Time is now: 31st July 2026 - 03:29 PM |
Topps, Inc has sole ownership of the names, logo, artwork, marks, photographs, sounds, audio, video and/or any proprietary material used in connection with the game Shadowrun. Topps, Inc has granted permission to the Dumpshock Forums to use such names, logos, artwork, marks and/or any proprietary materials for promotional and informational purposes on its website but does not endorse, and is not affiliated with the Dumpshock Forums in any official capacity whatsoever.