Subject: Re: [Raven] Three Questions and Some Examples

From: Vernon Schryver <[email-masked]>
Date: Wed, 17 Nov 1999 12:34:45 -0700 (MST)

> From: "chefren" <[email-masked]>

> ...
> If communication providers by law have to encrypt the data 
> they exchange it's nearly impossible to inject TCP 
> segements there. So the vulnerable place is within the 
> technical rooms of the communication provider. And those 
> should thus be "sealed". Most of them I know of are more or 
> less sealed already but I do believe international 
> standards can help here.

That assumes that a model of how the Internet and the current phone system
work that makes no sense.
For one thing, if only the "communications providers" do any encrypting,
then the data on the local loops is in the clear.  That implies that taps
can be put on local loops, outside those sealed rooms.  It also implies
that forged data can be "injected" on those local loops, again outside
those sealed rooms.

For another thing, that model imagines that all links among the "technical
rooms" of communications providers use something like PPP link layer
encryption, and never mind the difficulties in doing even the simplest,
easiest to break encryption in routers that run at 1,000,000,000 bits/sec.

For yet another inconsistency, it assumes that all of the traffic that
the police might want to tap goes through those sealed technical rooms,
which is to say that there are no ordinary Internet Service Providers with
routers, or even commercial outfits with routers for intranets, or none
of the traffic through ISP or commercial routers is interesting, and never
mind that we're talking about Voice over IP.

Restricted to the current phone system, that model imagines that there
are no such things as PBX's and that absolutely all phone circuits go
through PTT central offices.

Vernon Schryver    [email-masked]

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Wed, 17 Nov 1999 22:29:38 +0100

> that forged data can be "injected" on those local loops, again outside

This is all how it works with telecom taps now. Half a 
meter of mud and a tile is generally accepted as shield 
against misuse.

However: Such telephone taps are neighter necessary nor 
accepted here. Challenge response authentication between 
communication provider and tapping room is standard for GSM 
and ISDN tapping.

> easiest to break encryption in routers that run at 1,000,000,000 bits/sec.

OK, technical problem that should be adressed.

> mind that we're talking about Voice over IP.

I'm definitely not talking about Voice over IP, I'm not 
interested in the data.

In practice taps are placed at access providers and service 
providers. About the same as with telephone taps. If the 
tapped person uses another phone he isn't tapped.

In practice it's sometimes a big problem that there are so 
much service providers.

  At first we had only one, "state" telecom provider in The
  Netherlands. Tapping was easy each phone was connected to
  the same network. Now we have one physical network stil
  maintained by a new version of the old state telecom
  provider and used by numerous other providers. Still
  doable for law enforcement. For GSM our picopico country
  has FIVE providers and it's a lot of work to find out
  which provider a to be tapped person uses. It has come so
  far that I have heard they are busy with a law that make
  it possible for law enforcement to =ask= if a person is
  customer of provider and what's his number. AND: Lot's
  of criminals use GSM phones that are from a provider in
  another country. So a tap has to be asked at all 5 GSM
  access-providers for the same GSM phone. 5 taps to
  follow one phone... 

> through PTT central offices.

Internet communication is definitely a BIG challenge for 
the law enforcement part of our society. There are 
definitely nog 100% solutions but there are enough 
technical possibilities to make it workable,

Thanks for your comments,

+++chefren

= =
ii.nl ontwerpt, bouwt én onderhoudt websites
100 Euro aanbrengpremie: http://www.ii.nl/premie