Subject: Re: [Raven] CESA

From: Vernon Schryver <[email-masked]>
Date: Tue, 9 Nov 1999 18:38:55 -0700 (MST)

> Haven't you read a word here? As far as I know nobody asked 
> for more than a auditable version of tcpdump.

No matter what kinds of timestamps or hashes an "auditable version of
tcpdump" provided, a crooked cop could cause it to produce any evidence
the cop wanted.  It is at possibly foolish but probably intentionally
misleading to continue to imply otherwise.  Never mind that people in
governments would have access to the secret keys of the pairs used by the
"auditable version of tcpdump" to sign the "audited" output, and so could
sign any cooked traces needed for "the good of the society" or to "combat
organized crime."  Even without any keys, an individual bad cop or
"organized crime" minion could inject packets with forged IP addresses
and desired contents into the network, wait for the timestamped packets
to come out of the "auditable version of tcpdump," and use the supposedly
"audited" so called "record".  (Elaborations such as TTL's to keep the
two IP destintations from seeing the forged packets would probably not be
needed, since in practice ICMP errors would not be captured by this
"auditable version of tcpdump".   Short TTLs would not be noticed because
the IP header would probably not be captured and would not be understood
if it were.  For injection points, think about the Ethernets and FDDI
rings on which RAS's and ISP routers sit.  "Law Enforcement" would have
plenty of LANs on which forged packets could be injected, and necessarily
upstream of any inconvenient RFC 2267 filters so the official infowarriors
can defend the rest of us.  The injection points could be far from the
supposed sources, provided only that they are on the right sides of the
so called "tapping room.")

The use of "audited" is evidence of complete and willful ignorance of its
standard meaning, or intentionally misleading.  When the rest of us talk
about audited financial transactions, we are not talking about situations
where two or more (!) sets of books are kept, one public, the others
secret, and where those keeping the secret books decide which transactions
are recorded in the open books, without the auditors knowing that the
other books exist.  However, that is exactly the situation envisioned for
this "auditable version of tcpdump."  There would be no way to prevent
the authorities from using classic tcpdump at the same time as the
"auditable version of tcpdump," and presenting to the public only those
few "audited" packets that are convenient, all in the name of "public
safety" or "internal security."  Worse, unlike financial accounts, it
would be impossible to prove the existence of those other books.

In passing, those condemning the use of the word Fascist should look it
up its definition, and notice that its application is at least partly
appropriate.  Also note that 1940 was a very long time ago for people born
after 1970.  Lessons learned from those years would have to have been
passed down not merely from parents but grandparents.

Vernon Schryver    [email-masked]

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Wed, 10 Nov 1999 03:16:03 +0100

On 9 Nov 99, at 18:38, Vernon Schryver wrote:

> the cop wanted.

Why? He has no access to the tapbox and if you really don't 
believe the procedings will be OK I propose you personally 
get hashes from all states of the workings of the tapbox 
during every tap?

How could your cop tamper? As with all locks: We should 
just make the cost VERY high to tamper it. If you don't 
believe in  MD5 you may personally ad another hashing 
algorithm.

The problem you state is precisely the kind of thing the 
new standard should prevent.

> It is at possibly foolish but probably intentionally
> misleading to continue to imply otherwise.

Well well well, please shoot at idea's but don't start this 
kind of misleading factless talk.

> Never mind that people in governments would have access
> to the secret keys of the pairs used by the "auditable
> version of tcpdump" to sign the "audited" output, 

If you would personally distribute them, how would they 
have access to the key's?

> and so could sign any cooked traces needed for "the good
> of the society" or to "combat organized crime."  Even
> without any keys, an individual bad cop or "organized
> crime" minion could inject packets with forged IP
> addresses and desired contents into the network, wait for
> the timestamped packets to come out of the "auditable
> version of tcpdump," and use the supposedly "audited" so
> called "record". 

OK here you have a more or less new point. You assume the 
police has access to the backbone of the provider and can 
inject packets.

Is there someone with idea's about how the standard can 
encounter this? Or how it can be detected?

> (Elaborations such as TTL's to keep the two IP
> destintations from seeing the forged packets would
> probably not be needed, since in practice ICMP errors
> would not be captured by this "auditable version of
> tcpdump". 

So probably ICMP errors should be captured to counter this?

> Short TTLs would not be noticed because
> if it were.

Can we log that too?

> For injection points, think about the Ethernets and FDDI
> rings on which RAS's and ISP routers sit.  "Law
> Enforcement" would have plenty of LANs on which forged
> packets could be injected, and necessarily upstream of
> any inconvenient RFC 2267 filters so the official
> infowarriors can defend the rest of us.  The injection
> points could be far from the supposed sources, provided
> only that they are on the right sides of the so called
> "tapping room.") 

We have to think about methods to signal/log or circumvent 
those problems.

> standard meaning, or intentionally misleading.

It isn't, it's just a way to describe a basic feature of 
evidence in courts.

Digital evidence will appear in courts so auditable 
versions will definitely be needed.

> When the rest of us talk about audited financial
> transactions, we are not talking about situations where
> two or more (!) sets of books are kept, one public, the
> others secret, and where those keeping the secret books
> decide which transactions are recorded in the open books,
> without the auditors knowing that the other books exist. 
> However, that is exactly the situation envisioned for
> this "auditable version of tcpdump."  There would be no
> way to prevent the authorities from using classic tcpdump
> at the same time as the "auditable version of tcpdump,"
> and presenting to the public only those few "audited"
> packets that are convenient, all in the name of "public
> safety" or "internal security." 

Seems impossible to me with the proposed design.

> Worse, unlike financial accounts, it would be impossible
> to prove the existence of those other books. 

Seems impossible to me with the proposed design.

Thanks for your input!

+++chefren

= =
ii.nl ontwerpt, bouwt én onderhoudt websites
100 Euro aanbrengpremie: http://www.ii.nl/premie