At 08:41 AM 4/10/96 -0400, Perry E. Metzger wrote:

Anonymous writes:

...

Location-based System Delivers User Authentication Breakthrough

By Dorothy E. Denning and Peter F. MacDoran Copyright(c), 1996 - Computer Security Institute - All Rights Reserved Top - Help

A bunch of us heard about this a while back, and I was in on an exchange between several people including Phil Karn and Dorothy Denning. The gist of it is that Denning et al believe they have something -- and they are smart people -- but all the smart people who understand both GPS and crypto think its total bunk and not at all hard to fake being anywhere at all. I would say that I go with the latter.

The latter is far closer to the truth. First off, GPS signals can be faked. In fact, there are commercial boxes sold that generate a full synthetic constellation of GPS signals; these boxes are usually intended to simulate motion of a vehicle when the GPS unit under test is actually stuck in a laboratory or factory floor. If such a box were connected to an amplifier of a few tens or hundreds of milliwatts, it would be possible to park near a potential target and deny him service by making it look like his signal came from anywhere else around the world. (Military boxes would detect this because of A/S, however.) And if you had a receiver at some specific location at which you intend to appear to be connected at, it is likely that full data describing the motions of the satellites could be supplied to any other location on the Internet needing well under 14,400 bps. Jim Bell jimbell@pacifier.com