P.S. David Kahn's editorial today

-----BEGIN PGP SIGNED MESSAGE-----

I just sent the following P.S. to newsday.com

			----------------------

There is another reason to have cellular phones which encrypt only the 
over-the-air portion of a call, besides the fact that we can leave normal 
wiretap access procedures in place and not surrender civilian crypto keys to 
the government.

If I have a cellular phone which encrypts over the air (between the phone 
and the base station) and I call you, while you have a normal wired phone, 
our call is protected by cryptography from interception off the air.

If I use an AT&T Clipper-style cellular phone, as David suggested, and I 
call you on a normal wired phone, we can't encrypt the conversation and it 
is vulnerable to interception.  The protection works *only* if both parties 
have encrypting phones while interoperate.

  - Carl

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMubl6lQXJENzYr45AQEYagQAmVL47KGCHUyee8246VjGqr7+uubTBhHA
s/TtgFiMW7a9W5jbni5ov+kjTDeGpRULfrbyEwYR2fd1E1laNeu+EAQkE56KuU9g
iiB0S7TBd290MSHJZ6wQUWsDVgCzOi9gHbCQwY+GMQMXKfphuC4kDavwdSxjAXAM
MeZsitFRM1w=
=TzsP
-----END PGP SIGNATURE-----


+------------------------------------------------------------------+
|Carl M. Ellison       cme@acm.org    http://www.clark.net/pub/cme |
|   PGP 2.6.2: 61 E2 DE 7F CB 9D 79 84  E9 C8 04 8B A6 32 21 A2    |
+-Officer, officer, arrest that man. He's whistling a dirty song.--+

Carl Ellison wrote:

| I just sent the following P.S. to newsday.com
| 			----------------------
| 
| If I use an AT&T Clipper-style cellular phone, as David suggested, and I
| call you on a normal wired phone, we can't encrypt the conversation and it
| is vulnerable to interception.  The protection works *only* if both parties
| have encrypting phones while interoperate.

	Its worth thinking about multiple layers of protection for a
datastream.  The end to end encryption issue is seperate from the
issue of mobile to base encryption (and mobile to base authentication,
for that matter.)  Compute power is getting cheap enough that doing
both seems roughly feasable to me.

	Multiple protective layers is also nice in an environment
where theres policy checking going on, ie, a firewall.  SSL only gets
plugged through a firewall because it can't be partially unwrapped.  I
can't proxy in any meaningful sense.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume