Re: TEMPEST laptops
Understand that my comments are just some "common sense with a little bit of physics" estimates, not direct knowledge of how best to shield laptops.
I'd do this in preference to worrying about what some 1978 government docs had to say about the subject. TEMPEST the specs are probably a mixture of "RF shielding" tips and standards, and a mix of Van Eck radiation tuner designs.
A long time ago I ran thermal measurement boards on a piece of equipment in liquid He under vacuum. Pretty icy. I used only standard components. My question is this - anyone know of any estimates of how weak a signal could be detected and actually rendered into useful information? The relevance of the low-T stuff is that it seems like a nice way to make low-noise receiving equipment. With an estimate of the capabilities of the receiver ( @exotic-lHe and commonplace-lN2 temps ) you could then address the emissions of the laptop with reasonable, quantitative target levels. Sort of reverse engineer the TEMPEST specs as it were. It would be nice to know what needed to be done to reduce emissions to the point that you could be fairly sure that an eavesdropper had to park on your doorstep to make his equipment work.
VERY FEW PEOPLE CARE ABOUT SECURITY.
Since they don't have anything to hide, why should they worry? Argh. ergo - if they're hiding something they are guilty of something. Bust the doors down boys. Mike
-----BEGIN PGP SIGNED MESSAGE----- At 1:24 PM -0500 on 11/2/98, Mr. Motyka vamps on Mr. May in cypherpunks:
VERY FEW PEOPLE CARE ABOUT SECURITY.
Since they don't have anything to hide, why should they worry? Argh. ergo - if they're hiding something they are guilty of something. Bust the doors down boys.
Naaawww.... It's not so bad as all that... Remember, fairly soon now, if not already, we'll be storing *lots* of encrypted data on our disks, not only in the form of encrypted, controlled-play software, or proprietary company information, or infotainment (however long *that* lasts), but also in the form of encrypted passwords, private keys, and, of course, digital bearer certificates ;-). In addition, every time you do a book-entry transaction, you're perforce (heh...) using an encrypted link with at least SSL, and, at some point, people will demand much cheaper and faster internet-level encryption ala IPSEC to move their money (and their other bits worth money) around. Or they'll be required to by their employers in various VPN/WAN systems. Or, frankly, they'll just do it without knowing it anyway, because their TCP/IP apps will be IPV6 (or something) compliant. Everyone here who does this stuff for a living knows that the amount of horsepower necessary to decrypt all those different kinds of encrypted stuff, even the weak stuff, is going to be positively prohibitive (instead of permitted? ;-)), since it all has different keys, lots of which are long gone. IPSEC keys, for instance, are positively disposable, and, if it's done right - -- which it will be, because nobody wants to lose *money*, after all -- the encrypted packets will originate at the client, and not the router, so all that "private doorbell" stuff is just a smokescreen for what is going to be superencrypted data anyway. And, of course, we all know now that KRAP / neé Key Escrow / neé GAK / neé Key Recovery / neé Clipper is logically, much less physically, impossible. Don't ask me, ask the likes of Diffie, and Rivest, and Schneier, et alia. All the "legislation" in the world ain't gonna change that, right? Digital Commerce is Financial Cryptography, folks. F=MA. It ain't just for physicists anymore... The black helicopters aren't flying over the hill any time soon, boys and girls. Why? Because, if they tried, soon enough, they couldn't afford the gas for a return visit. Their erstwhile tax revenue, like most money, being fungible and all, is, or soon will be, quite easy enough to bug out into the cyphersphere with. After all, who's to tell one encrypted blop of bits from another? "Awwwww, C'Monnnn. Niiiice taxpayer. Staaaaay. *Don't* go anywhere. Pleeeeease?" A cowardly lion indeed. Cheers, Bob Hettinga -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.5.5 iQEVAwUBNj4wNcUCGwxmWcHhAQEsewf9GbZ2OxeczWZzeNAuBwBm+PlWvZAdOmml UYmik/U4s41x310HtXdPg2ixnUJ/i67rWXYGHeGeAZrbn0IYH69dM7l0qSROSHnM dDMLA18nZjIy1XKzcG0yrRfsbLKtfFpe3Y4SN8dHoTRKzzfoskhmQJWu9/2twVKi Y3gFgd5Qawu4a23jmMOGRJ1pLUpo9jjTu2qs8uA0Q42aeWcm4Zm1QhaK9/9FV9Sm FkbHTgzK6RwaLiKySkqf22KNsy6WLa9ypVLK03tMrJNgILqY2S3xxoM/2EOhf+FF 5yt16/bABw3YvS8WWp2PkmHMn1rxXgBy1iodioFI79Cf35Yu36/O4Q== =GPbv -----END PGP SIGNATURE----- ----------------- Robert A. Hettinga <mailto: rah@philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'
Hello, Sorry for any cross-posting. Just thought this group would be interested in this new s/w. The most startling thing about it is the price Rs. 1,650. (approx US$ 40) per copy ... I'll be at the Bangalore IT fair morrow, and will try to give a first hand update of this stuff after meeting with the reps. http://www.timesofindia.com/031198/03mban19.htm Indian firm unveils 448-bit encryption package It is called EMD Armor -- an award-winning encryption software package using a powerful 448-bit key, developed by an Indian company. It beats the United States at its own game, for, even today, US companies are not allowed to export encryption software that uses keys higher than 128 bits. -- snip ---- EMD Armor, which is used to secure your personal computer, also goes by the name of Sigma 2000. It has picked up the Editors Choice award. The product range covers security for PCs, e-mail, networks. `Our product combines the highest key strength, fast encryption speed (60 MB per minute), and online encryption. That means non-encyrpted data is never stored on your hard disk. Anything that is there is encrypted. Complete security,'' says Kundu. -- snip -- K. Kundu, Signitron India Director, an IIT Kharagpur alumni, told The Times of India that the key algorithm they have used is `Blowfish', developed by cryptography guru Bruce Schneir. regards, narry
At 03:43 AM 11/3/98 +0530, Narayan Raghu wrote:
Indian firm unveils 448-bit encryption
448 bits sounds a lot like MD5-based encryption - perhaps Luby-Rackoff or MDC? Or a homegrown system, doing successive MD5s or something? MD5 is no longer the safest hash these days.... Thanks! Bill Bill Stewart, bill.stewart@pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639
Bill Stewart writes:
448 bits sounds a lot like MD5-based encryption - perhaps Luby-Rackoff or MDC? Or a homegrown system, doing successive MD5s or something? MD5 is no longer the safest hash these days....
More likely Blowfish for two reasons i) the article mentioned blowfish at the bottom (;-), and ii) blowfish keys can be up to 448 bits. Could be snake oil, or could be result of letting marketroid near press release. The press release was very confused in general. Adam
Bill Stewart wrote:
At 03:43 AM 11/3/98 +0530, Narayan Raghu wrote:
Indian firm unveils 448-bit encryption
448 bits sounds a lot like MD5-based encryption - perhaps Luby-Rackoff or MDC? Or a homegrown system, doing successive MD5s or something? MD5 is no longer the safest hash these days....
Thanks! Bill
Nopes. It's an implementation of blowfish. you might get some info at www.signotron.com the guy at the fair claimed that it's the strongest existing implementation of cryptography available in the world to date .. and he was no "sales" guy - seemed technical enough ... what this s/w seems to be doing is that it gets into ur windows OS, (works ONLY on windows) and everytime you "save" a file, it captures it, encrypts it, and stores it .. so nothing on your disc is ever left unencrypted. ofcourse there must be a lot of such packages in the US .. but the novelty here, according to this guy was that it was developed outside the US, and it's price (USD 40) .... rgds nar
participants (5)
-
Adam Back -
Bill Stewart -
Michael Motyka -
Narayan Raghu -
Robert Hettinga