RE: radio net (fwd)

So much for "no domestic crypto restrictions." I really hate when people
say that, there are plenty, and export restrictions on cryptography
software and cryptography in software DOES indirectly but substantially
affect the availability and cost of domestic encryption, not to mention
that most people download export-grade crypto from the web for
convenience.

Isn't there a similar ban on encryption-capable telephones and other
electronic devices (other than computers).

	Matt


> > The FCC prohibits the transmission of encrypted data via 
> > analog or digital signals by amateurs.

On Thu, Sep 10, 1998 at 01:57:46PM -0700, Bill Stewart wrote:

> 
> But that doesn't mean there isn't a strong demand for voice privacy -
> just that the average consumer is satisfied having _some_ privacy,
> enough to keep casual observers out and neighbors from stealing phone service,
> and either doesn't believe the police would illegaly wiretap _him_,
> or (more cynically) doesn't believe the cellphone is enough protection
> if they do decide to target him.
> 
> 
	And it clearly isn't.   With the exception of cellphone to
cellphone traffic on one providers system (especially if it is GSM) the
traffic gets sent in the clear over trunking which is not particularly
well protected (and on occasion over microwave backhauls from cell sites
in the clear), to wire line phones which are often very vulnerable to
wiretaps.  And all of these are subject to CALEA access, and many also
to various  subrosa access via mechanisms provided for test and
maintainence and remote configuration of the system and trouble
diagnosis (mechanisms well and trully exploited by phreakers over the
years and well known and understood by the spooks as well).

	Without end to end encryption with secure key material the
security of any phone is weak at best, link encryption of vulnerable
links such as RF paths will keep the nosey out and raise the bar enough
so as to discourage that kind of penetration by professionals, but if
the call goes through switching and trunking infrastructure in the clear
it is  hardly difficult for large and powerful organizations to get
there hands on it if they really need it...

	And of course if they really get desparate, they can bug
the area the conversation is taking place in... or even the phones...


-- 
	Dave Emery N1PRE,  die@die.com  DIE Consulting, Weston, Mass. 
PGP fingerprint = 2047/4D7B08D1 DE 6E E1 CC 1F 1D 96 E2  5D 27 BD B0 24 88 C3 18

Bill Stewart wrote:
> 
> Not per se, though there _is_ still one major restriction -
> the Defense Department gets a crack at patent applications,
> so if you try to patent a crypto algorithm or crypto phone,
> they can seize and classify your patent application and
> working materials, using the excuse of "national security".
> There was a case in the late 70s where somebody tried to patent
> a wimpy analog scrambler for CB radios, and got it seized,
> and a number of patent applications that got delayed a long time.

It seems then to be advisable to apply for international patents
simultaneously. One can e.g. apply for a European patent that is 
valid for a number of countries.

M. K. Shen

Hi Bill,

Bill Stewart wrote:

> Not per se, though there _is_ still one major restriction -
> the Defense Department gets a crack at patent applications,
> so if you try to patent a crypto algorithm or crypto phone,
> they can seize and classify your patent application and
> working materials, using the excuse of "national security".
>
I suppose we need more altruistic gestures placing good stuff into the
public domain.

> Sure there are - my $150 cordless phone uses spread-spectrum,
> partly for better sound quality, partly for better privacy,
> and partly because it's simpler than picking individual channels.
>
The security is only between the handset and the base unit. Once the
signal hits the POTS it's the same old story - open line.

ALSO - the channels and the hopping sequence used in the
"spread-spectrum" systems are predefined. Kind of like making a stream
cipher with a very short bitstream you got from the government printing
orifice. Using any other sequence is a crime.

The real purpose of the spread spectrum phones is to allow increased
signal levels. The security is not robust.

Try this one:

Not particularly original - I would guess that Tim's 3DES phone is
something like this.

Wal Mart Plastics for the housing ( ever tooled plastics? $$$ )
Custom board
	Dedicated DSP for voice compression/decompression
	Modem chipset for POTS connect ( direct or ISP )
	Fast microP for encryption/protocol
	Any encryption algorithm you desire
	Software Developer's Kit ( roll your own algorithm )

This will work very nicely at home or with any cell phone that has a
modem port. It's really nothing but a dedicated version of a PC based
PGP phone. It's just smaller and cheaper than a PC and has no MS DLLs on
it.

Regards,
Mike

Matthew James Gering wrote:
> 
> Isn't there a similar ban on encryption-capable telephones and other
> electronic devices (other than computers).
> 
Not that I've ever heard of. Besides, what's the difference between a
crypto telephone and a computer? None that is significant.

>         Matt

I suspect that the reason that there aren't any $99 cryptophones at
Wal-Mart is that there really is not a significant market. The average
person just doesn't care. And the consumer electronics business is so
competitive and cost-sensitive that adding cost as a matter of principle
is just not going to happen. Oh, I suppose it's possible that anyone
trying to introduce a product like this could run into LEA interference
- endless audits, supplier problems, FCC approvals, you name it but lack
of market is probably the simplest explanation.

Mike

>Matthew James Gering wrote:
>> Isn't there a similar ban on encryption-capable telephones and other
>> electronic devices (other than computers).

Not per se, though there _is_ still one major restriction -
the Defense Department gets a crack at patent applications,
so if you try to patent a crypto algorithm or crypto phone,
they can seize and classify your patent application and
working materials, using the excuse of "national security".
There was a case in the late 70s where somebody tried to patent
a wimpy analog scrambler for CB radios, and got it seized,
and a number of patent applications that got delayed a long time.

The RSA and Diffie-Hellman algorithms were published first,
and then the patents applied for, which works in the US and Canada
but makes them unpatentable in much of the rest of the world.
Steve Bellovin also got lots of legal advice about what order
to submit his patent applications and academic papers to
avoid the risk of getting them stolen by the Feds.

At 09:22 AM 9/10/98 -0700, Michael Motyka wrote:
>I suspect that the reason that there aren't any $99 cryptophones at
>Wal-Mart is that there really is not a significant market. The average
>person just doesn't care. And the consumer electronics business is so
>competitive and cost-sensitive that adding cost as a matter of principle
>is just not going to happen. 

Sure there are - my $150 cordless phone uses spread-spectrum,
partly for better sound quality, partly for better privacy,
and partly because it's simpler than picking individual channels.
I think it's probably the frequency-hopping form of spread-spectrum,
and the hopping speed is probably deliberately low because of
Federal pressure, but it's still reasonable voice privacy.
(And the digital phones that don't do spread-spectrum still advertise
using "digital" for privacy...)  My phone's a couple of years old;
you can probably get one for <$100 now.

Analog cell-phones aren't secure, but the digital cell-phones
on the market all provide cryptography for voice privacy,
though not all cellular service providers support it.
CDMA provides some inherent security, and it, TDMA, and GSM
all offer some encryption features - having prominent politicians
get caught talking to their girlfriends on their cellphones
has helped raise the awareness of privacy.
(The real price of a cell-phone in the US is hard to determine;
most range from about $100-700 without service activation,
and $0-400 with a service contract of typically 1 year.
But the low end's close to $99.)

>Oh, I suppose it's possible that anyone
>trying to introduce a product like this could run into LEA interference
>- endless audits, supplier problems, FCC approvals, you name it but lack
>of market is probably the simplest explanation.

The NSA and FBI did the best job of FUD they could arm-twisting the
US digital cellular standards committees into using wimpy encryption,
and GSM had its own set of wrangling that went on, producing a
primary algorithm that's weak, and a bunch of alternative algorithms
that are progressively weaker.  I probably couldn't break the GSM 
main code myself, but I know where to find people who can,
and just about any of the frequent readers of this list could break
some of the other systems used.

But that doesn't mean there isn't a strong demand for voice privacy -
just that the average consumer is satisfied having _some_ privacy,
enough to keep casual observers out and neighbors from stealing phone service,
and either doesn't believe the police would illegaly wiretap _him_,
or (more cynically) doesn't believe the cellphone is enough protection
if they do decide to target him.


				Thanks! 
					Bill
Bill Stewart, bill.stewart@pobox.com
PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639

Pig Latin or even the old 10 codes as in 10-4 are against the amateur
rules.  The only allowed code scheme is morse code and Q codes.  Both are
clasified as a well defined language.  Using english and having a
conversation that means something other than the standard usage is also
prohibited.  If you don't like it then stick to CB-Radio.  At least that is
the FCC's position.




>So much for "no domestic crypto restrictions." I really hate when people
>say that, there are plenty, and export restrictions on cryptography
>software and cryptography in software DOES indirectly but substantially
>affect the availability and cost of domestic encryption, not to mention
>that most people download export-grade crypto from the web for
>convenience.
>
>Isn't there a similar ban on encryption-capable telephones and other
>electronic devices (other than computers).
>
>	Matt
>
>
>> > The FCC prohibits the transmission of encrypted data via
>> > analog or digital signals by amateurs.



Matt <mailto:melliott@itmail.ncsa.uiuc.edu>