Re: Notes from the SF Physical Cypherpunks meeting
Thanks to everyone who took the trouble to correct errors in my notes from Saturday's Cypherpunks meeting. They were written for my own benefit -- and for the benefit of some friends who couldn't be there. Since I can give away information without losing it (to misquote Thomas Jefferson), I'm happy to share it with the cypherpunks. A comment from Matts Kallioniemi might be worth some further discussion:
COM e-mail/bbs system (Sweden) -- operator could backup e-mail, but not read it.
Sure. The database was encrypted by using XOR with the string "KOM". That was the sorry state of encryption in the early eighties.
Encrypting the database with a fixed string offers a good example of how "locks keep honest people honest." This would prevent an operator from unintentionally reading a message in case it was revealed by, perhaps, a disk sector editor or crash dump. I suspect that the state of encryption in Sweden in the early eighties was somewhat stronger than XOR (wasn't Hagelin a Swede who moved to Switzerland to start Crypto AG?), but not necessarily visible to the general public. The Swedish government has a rather strong tradition of protection of individual privacy (encrypting COM e-mail is one example). For example, the initial Swedish implementation of a national criminal database in the mid 1970's (equivalent to the US NCIC) used dialback telexes to prevent unauthorized (and untracked) access. A recent newspaper article noted that some police officers were being investigated for unauthorized access to the personal information of a collegue who had complained of sexual harassment. Martin Minow minow@apple.com
Dial-back does not add security to a system, and in fact, often reduces system security. Dial back takes responsibility for authentication from your system (where it belongs), and transfers it to the phone company. Telco switches have a long history of being comprimised. Assuming a telco switch gets back to the right number when you're under attack is bogus. Relying on an external system like this is evidence of shoddy thinking about security issues. That should have been obvious in the mid 70's, when telcos knew that their switches were being abused by phreaks. Adam (playing catch-up, but this is a pet peeve.) Martin Minow wrote: | For example, the initial Swedish implementation of a national | criminal database in the mid 1970's (equivalent to the US NCIC) used | dialback telexes to prevent unauthorized (and untracked) access. | A recent newspaper article noted that some police officers were | being investigated for unauthorized access to the personal information | of a collegue who had complained of sexual harassment. -- "It is seldom that liberty of any kind is lost all at once." -Hume
[I've cc:ed this note to one of the designers of KOM, Jacob Palme. Hi Jacob! -cwe] | Thanks to everyone who took the trouble to correct errors in my | notes from Saturday's Cypherpunks meeting. They were written | for my own benefit -- and for the benefit of some friends who | couldn't be there. Since I can give away information without | losing it (to misquote Thomas Jefferson), I'm happy to share it | with the cypherpunks. | | A comment from Matts Kallioniemi might be worth some further discussion: | | >>COM e-mail/bbs system (Sweden) -- operator could backup | >>e-mail, but not read it. | > | >Sure. The database was encrypted by using XOR with the string | >"KOM". That was the sorry state of encryption in the early eighties. | > | | Encrypting the database with a fixed string offers a good example | of how "locks keep honest people honest." This would prevent an | operator from unintentionally reading a message in case it was | revealed by, perhaps, a disk sector editor or crash dump. | | I suspect that the state of encryption in Sweden in the early | eighties was somewhat stronger than XOR (wasn't Hagelin a Swede who | moved to Switzerland to start Crypto AG?), but not necessarily | visible to the general public. | | The Swedish government has a rather strong tradition of protection | of individual privacy (encrypting COM e-mail is one example). | For example, the initial Swedish implementation of a national | criminal database in the mid 1970's (equivalent to the US NCIC) used | dialback telexes to prevent unauthorized (and untracked) access. | A recent newspaper article noted that some police officers were | being investigated for unauthorized access to the personal information | of a collegue who had complained of sexual harassment. | | Martin Minow | minow@apple.com | | | | | |
participants (3)
-
Adam Shostack -
Christian Wettergren -
minow＠apple.com