安全与密码学2021apple.com
苹果儿童安全功能的安全威胁模型审查
Security Threat Model Review of the Apple Child Safety Features
入门 · 约 45 分钟读完前置知识：密码学哈希基础、iCloud 与端到端加密概念、CSAM 检测背景
导读
这篇文档是苹果对其儿童安全功能（扫描上传至 iCloud 照片的 CSAM 哈希匹配系统）的安全威胁模型评估，分析了该系统可能被滥用的风险及防护设计，如数据库根哈希可被用户验证、仅限 iCloud 上传流程等。HN 讨论焦点在于这类设备端扫描是否为政府滥用开了先例。
HN 关注点：苹果 CSAM 扫描功能引发隐私与监控的激烈争论，HN 读者关注其技术设计是否真的能防止'滑坡'式滥用。
HN 评论精选
这几条评论里：质疑 3 补充 1
质疑认为该系统的实际实现（服务端+设备端结合）并不像批评者说的那样容易被滥用为监控工具
我在其他评论中已表明并不支持苹果这个项目，也承认'滑坡'论证有其道理。但我一直纠结一个反主流的问题：假设坏行为者（政府或其他）想利用联网智能手机打击政治异见者，随着我们越来越了解苹果的实际实现方式，这项技术似乎并不太可能让他们的行动变得容易得多。比如'只扫描上传到 iCloud 的照片'并非某些人以为的可以一行代码就改掉的随意限制。苹果隐私工程负责人 Erik Neuenschwander 在 TechCrunch 采访中解释：系统包含设备端组件（生成凭证但不学习任何内容）和服务器端组件（凭证随上传数据发送，跨账户处理以判断是否存在非法 CSAM 集合），这意味着它是一项服务功能。这能阻止有决心的坏行为者吗？当然不能，但他们已经有很多其他手段：可以让云存储提供商交出数据，不行就让网络运营商……
chipotle_coyote查看英文原文
In other HN comments on this subject I've (hopefully) made it clear that I'm not really in favor of this project of Apple's, and that there's a legitimate "slippery slope" argument to be made here. So I hope people will entertain a contrarian question without downvoting me into oblivion. :) Here's the thing I keep circling around: assume that bad actors, government or otherwise, want to target political dissidents using internet-enabled smartphones. The more we learn about the way Apple actually implemented this technology, the less likely it seems that it would make it radically easier for those bad actors to do so. For instance, the "it only scans photos uploaded to iCloud" element isn't just an arbitrary limitation that can be flipped with one line of code, as some folks seem to think; as Erik Neuenschwander, head of Privacy Engineering at Apple, explained in an interview on TechCrunch[1]: > Our system involves both an on-device component where the voucher is created, but nothing is learned, and a server-side component, which is where that voucher is sent along with data coming to Apple service and processed across the account to learn if there are collections of illegal CSAM. That means that it is a service feature. Will this stop those bad actors if they're determined? No, of course not, but there are so many ways they can do it already. They'll get cloud storage providers to give them access. If they can't, they'll get network providers to give them access. And if those bad actors are, as many people fear, government actors, then they have tools far more potent than code: they have laws. It was illegal to export "strong encryption" for many years, remember? I've seen multiple reports that European lawmakers are planning to require some kind of scanning for CSAM. If this goes into effect, technology isn't going to block those laws for you. Your Purism phone will either be forced to comply or be illegal. I wrote in a previous comment on this that one of Silicon Valley's original sins is that we tend to treat all problems as if they're engineering problems. Apple is treating CSAM as an engineering problem. Most of the discussion on HN about how horrible and wrong Apple is here still treats it as an engineering problem, though: well, you can get around this by just turning off iCloud Photos or never using Apple software or throwing your iPhone in the nearest lake and switching to Android, but only the right kind of Android, or maybe just never doing anything with computers again, which admittedly will probably be effective. Yet at the end of the day, this isn't an engineering problem. It's a policy problem. It's a governance problem. In the long run, we solve this, at least in liberal democracies, by voting people into office who understand technology, understand the value of personal encryption, and last but certainly not least, understand the value of, well, liberal democracy. I know that's easy to dismiss as Pollyannaism, but "we need to protect ourselves from our own government" has a pretty dismal track record historically. The entire point of having a liberal democracy is that we are the government, and we can pull it back from authoritarianism. The one thing that Apple is absolutely right about is that expanding what those hashes check for is a policy decision. Maybe where those hashes get checked isn't really what we need to be arguing about. [1]: https://techcrunch.com/2021/08/10/interview-apples-head-of-privacy-details-child-abuse-detection-and-messages-safety-features/
质疑质疑可验证哈希等承诺只是安全表演，无法真正审计数据库内容，功能范围也随时可被扩大
'苹果将发布知识库文章，包含每个支持该功能的操作系统版本中加密 CSAM 哈希数据库的根哈希，用户可检查设备上数据库的根哈希并与知识库比对。'这纯属安全表演：操作系统镜像本来就是签名的，而且根本无法审计数据库是否如其所称，是否包含可在特定条件下激活的多个数据库。至于'该功能仅作为 iCloud 照片上传流程的一部分运行，不能作用于设备上其他图像内容'——直到某天一行代码改动把它挂到 UIImage 上。
almostdigital查看英文原文
> Apple will publish a Knowledge Base article containing a root hash of the encrypted CSAM hash database included with each version of every Apple operating system that supports the feature. Additionally, users will be able to inspect the root hash of the en- crypted database present on their device, and compare it to the expected root hash in the Knowledge Base article. This is just security theater, they already sign the operating system images where the database reside. And there is no way to audit that the database is what they claim it is, doesn't contain multiple databases that can be activated under certain conditions, etc. > This feature runs exclusively as part of the cloud storage pipeline for images being up- loaded to iCloud Photos and cannot act on any other image content on the device Until a 1-line code change happens that hooks it into UIImage.
质疑反对设备端扫描的根本逻辑：消耗用户资源却只为监视用户是否违规
我不喜欢在我的设备上运行东西，消耗我的电池和数据流量，而唯一目的却是检查我是否在做错事？我能想到的类比是：政府雇人每天到你家拜访，他们在那里还需要消耗你的资源（比如食物、水和电）。换句话说，他们持续占用你本可独用的资源，而他们在那里的唯一理由就是看你有没有做错事。你为什么要忍受这个？
makecheck查看英文原文
I don’t like the idea of stuff running on my device, consuming my battery and data, when the only point is to see if I am doing something wrong? An analogy I can come up with is: the government hires people to visit your house every day, and while they’re there they need your resources (say, food, water, and electricity). In other words, they use up some of the stuff you would otherwise be able to use only for yourself — constantly — and the only reason they’re there is to see if you’re doing anything wrong. Why would you put up with this?
补充指出数据库来源设计的新细节，但仍担心五眼国家投毒及政府强制扩展该功能
这是他们第一次提到你可以将设备上数据库的哈希与其知识库文章中发布的哈希进行比对。他们还说明该数据库仅是来自两个分属不同政府管辖辖区的儿童安全组织的哈希列表的交集。我的第一反应是：这仍可能被'五眼联盟'成员投毒，而且这并不能排除国家行为者迫使苹果为其他目的复制此功能（那样不会动 CSAM 数据库本身的完整性，因此不会触发警报）。
sylens查看英文原文
I think this is the first time they have mentioned that you will be able to compare the hash of the database on your device with a hash published in their KB article. They also detailed that the database is only the intersection of hash lists from two child safety organizations under separate governmental jurisdictions. My immediate thought is that this could still be poisoned by Five Eyes participants, and that it does not preclude state actors forcing Apple to replicate this functionality for other purposes (which would leave the integrity of the CSAM database alone, thus not triggering the tripwire).
相关资源
从这篇论文所有 HN 讨论帖的全部评论里整理出来的链接。
- 视频与演讲
历次讨论
- 2021Hacker News 讨论帖325 分 · 374 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选