Re: Notes from the SF Physical Cypherpunks meeting

Thanks to everyone who took the trouble to correct errors in my
notes from Saturday's Cypherpunks meeting. They were written
for my own benefit -- and for the benefit of some friends who
couldn't be there. Since I can give away information without
losing it (to misquote Thomas Jefferson), I'm happy to share it
with the cypherpunks.

A comment from Matts Kallioniemi might be worth some further discussion:

>>COM e-mail/bbs system (Sweden) -- operator could backup
>>e-mail, but not read it.
>
>Sure. The database was encrypted by using XOR with the string
>"KOM". That was the sorry state of encryption in the early eighties.
>

Encrypting the database with a fixed string offers a good example
of how "locks keep honest people honest." This would prevent an
operator from unintentionally reading a message in case it was
revealed by, perhaps, a disk sector editor or crash dump.

I suspect that the state of encryption in Sweden in the early
eighties was somewhat stronger than XOR (wasn't Hagelin a Swede who
moved to Switzerland to start Crypto AG?), but not necessarily
visible to the general public.

The Swedish government has a rather strong tradition of protection
of individual privacy (encrypting COM e-mail is one example).
For example, the initial Swedish implementation of a national
criminal database in the mid 1970's (equivalent to the US NCIC) used
dialback telexes to prevent unauthorized (and untracked) access.
A recent newspaper article noted that some police officers were
being investigated for unauthorized access to the personal information
of a collegue who had complained of sexual harassment.

Martin Minow
minow@apple.com

Dial-back does not add security to a system, and in fact, often
reduces system security.

	Dial back takes responsibility for authentication from your
system (where it belongs), and transfers it to the phone company.
Telco switches have a long history of being comprimised.  Assuming a
telco switch gets back to the right number when you're under attack is
bogus.

	Relying on an external system like this is evidence of shoddy
thinking about security issues.  That should have been obvious in the
mid 70's, when telcos knew that their switches were being abused by
phreaks.

Adam

(playing catch-up, but this is a pet peeve.)

Martin Minow wrote:

| For example, the initial Swedish implementation of a national
| criminal database in the mid 1970's (equivalent to the US NCIC) used
| dialback telexes to prevent unauthorized (and untracked) access.
| A recent newspaper article noted that some police officers were
| being investigated for unauthorized access to the personal information
| of a collegue who had complained of sexual harassment.


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

[I've cc:ed this note to one of the designers of KOM,
 Jacob Palme. Hi Jacob! -cwe]

| Thanks to everyone who took the trouble to correct errors in my
| notes from Saturday's Cypherpunks meeting. They were written
| for my own benefit -- and for the benefit of some friends who
| couldn't be there. Since I can give away information without
| losing it (to misquote Thomas Jefferson), I'm happy to share it
| with the cypherpunks.
| 
| A comment from Matts Kallioniemi might be worth some further discussion:
| 
| >>COM e-mail/bbs system (Sweden) -- operator could backup
| >>e-mail, but not read it.
| >
| >Sure. The database was encrypted by using XOR with the string
| >"KOM". That was the sorry state of encryption in the early eighties.
| >
| 
| Encrypting the database with a fixed string offers a good example
| of how "locks keep honest people honest." This would prevent an
| operator from unintentionally reading a message in case it was
| revealed by, perhaps, a disk sector editor or crash dump.
| 
| I suspect that the state of encryption in Sweden in the early
| eighties was somewhat stronger than XOR (wasn't Hagelin a Swede who
| moved to Switzerland to start Crypto AG?), but not necessarily
| visible to the general public.
| 
| The Swedish government has a rather strong tradition of protection
| of individual privacy (encrypting COM e-mail is one example).
| For example, the initial Swedish implementation of a national
| criminal database in the mid 1970's (equivalent to the US NCIC) used
| dialback telexes to prevent unauthorized (and untracked) access.
| A recent newspaper article noted that some police officers were
| being investigated for unauthorized access to the personal information
| of a collegue who had complained of sexual harassment.
| 
| Martin Minow
| minow@apple.com
| 
| 
| 
| 
| 
|