Subject: RE: [Raven] Nevermore ...

From: [email-masked]
Date: Wed, 3 Nov 1999 15:11:43 +0200

[chefren:]
> Tools don't do crimes, people do crimes. IETF would do 
> serious justice if it would supply an auditable version of 
> tcpdump to the world.

 - And what would make me (or e-Cop or anyone) to use the 
auditable version instead of non-auditable one? Hell, anyone
with little coding/networking experience can configure 
network card to promiscious mode and write whatever sniffer
program on top of that (here my meaning being that you don't 
even have to go according to tcpdump/RMON1or2 if you don't care
about interoperability issues)... 
 It's really not rocket science.

 - As for your doubts against the 'strong' crypto: You don't 
have to believe anything. Use algorithms and protocols that are
published and scrutinized by experts (or verify them yourself if
you have very good math background). Sure, nothing is ever 100%.
There can always be some 'Gyro Gearloose' working for NSA who 
doesn't want to tell his 'findings'. But, if N academic and commercial
researches have concluded that best way to break algorithm X is 
to use brute-force (i.e., go through key space) or to use some 
mathematical method, the complexity of which is key-length dependent 
(e.g. factorizing), then I just make sure that my key space (length) 
is big enough and use the algorithm (of course it pays to check the
implementation closely too).

 - What do you mean by 'making strong crypto' illegal? How can you
say whether random noise-like stream is really random noise or 
well-encrypted data stream (the better encryption methods 'tend to' 
make cryptotext seem random)? What if, e.g. a criminal sent an 
encrypted message to 1000 recipents (1 that it is meant to and 
999 others to make it harder to pinpoint the *real* target). Now,
would all those 1000 be required to give e-Cops the key? How could 
they (except the targeted one)? What if the originator had added a 
virus (e.g. attached .exe (there are always fools that click these))
that further sends copies of the message to, say another 1000 
recipents (just to make it harder to pinpoint himself as the original
sender)... now, from the e-Cops point of view it would seem that 
you have send an encrypted (i.e., illegal) message, right? Yeah,
let's make encryption illegal... bye, bye e-Commerce too... or
any meaningful (containing data worth hiding from everyone) 
transaction for that matter...

 Just my opinions as a private person,
 Janne H.

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Wed, 3 Nov 1999 18:45:43 +0100

On 3 Nov 99, at 15:11, [email-masked] wrote:

> auditable version instead of non-auditable one?

Human rights groups, the laywers of the accused. Plain 
tcpdump taps shouldn't be accepted by the people.

Governments that keep on using unauditable taps should be 
rejected.

+++chefren

= =
Verdien 100 Euro bij aanbrengen van een nieuwe
klant voor een website: http://www.ii.nl/premie