Denning's Geo-crypto

[Trei, Peter]

Curious. 4-5 years ago Denning and another associate (I 
forget who, it's in the archives :-) tried to market an authentication
scheme which purported to authenticate the location of a remote
user using GPS. 

The idea was that the user's machine would pick up the 
aggregate analog GPS signal available at it's location 
(either the regular, non-classified version or the 
high-precision classified signals), and transmit it to 
the server, which would use it to work out the 
location of the user - a user who was located at 
'Pentagon, third ring, fourth floor, Army segment' 
would be accorded different privilieges than one whose 
location decoded as 'Presidential Palace, Baghdad'.

I and several other list subscribers pointed out numerous
issues. Among them were:

1. GPS signals don't work well in buildings of substantial
construction, and the chance of them working at all in a 
TEMPEST shielded building are about zip.

2. There are numerous DOS attacks available - the GPS
signals are easily jammed. One amusing approach would
be to use GPS test equipment to generate signals 
appropriate for a different location (eg, Pyongyang) and
beam them at the site to be DOS'd. 

4. Conversely, an  attacker could use the same test equipment
to make it look like he's in the Pentagon, when he's actually
in Kandahar.

5. GPS is based on the relative time delays of signals from 
different satellites. Since network lag of hundreds of 
milliseconds must be accepted, anyone who can see 
the same set of satellites as the location to be spoofed 
can separate the signals from the different satellites, 
modify the lags appropriately, and remix to generate a
spoofed analog signal.

--------
I sent these concerns to Denning, who replied that she
would address them only under NDA, which I declined to
enter.

This sounds an awful lot like old wine in new bottles. Many
of the same concerns arise.

Peter Trei
Disclaimer: The above represents only my personal 
opinions.

> ----------
> From: 	John Young[SMTP:jya at pipeline.com]
> Sent: 	Thursday, November 22, 2001 2:06 PM
> To: 	cypherpunks at lne.com
> Subject: 	Denning's Geo-crypto
> 
> Time Magazine, November 26, 2001:
> 
> Denning's pioneering a new field she calls geo-encryption.
> Working with industry, Denning has developed a way to keep
> information undecipherable until it reaches its location, as
> determined by GPS satellites. Move studios, for example,
> have been afraid to release films digitally for the same reasons
> record companies hate Napster: once loose on the Internet,
> there's little to stop someone from posting the latest blockbuster
> DVD on the Web for all to see and download. With Denning's
> system, however, only subscribers in specified locations --
> such as movie theaters -- would be able to unscramble the
> data. The technology works as well for national security
> as it does for Harry Potter. Coded messages that the State
> Department sends to its embassies, for example, could only
> be deciphered in the embassy buildings themselves, greatly
> reducing the risk of interception.
> 
> For now, Denning says, terrorists "may want to bring down
> the power grid or the finance system, but it's still easier to
> blow up a building." If she's right, it's due in large part to her.