Subject: RE: [Raven] Three Questions and Some Examples

From: Vernon Schryver <[email-masked]>
Date: Tue, 16 Nov 1999 17:32:07 -0700 (MST)

> From: "Lyal Collins" <[email-masked]>

> It may be considered nonsense if looked at in the narrow context if everyone
> using plain-text communications.
>
> Many people on this list have expressed a desire for encryption on all data
> transfers, wherein the vanilla tcpdump tools become far less useful.

No, if most data is encrypted, it is all even sillier, since the
tap rooms would be useless.  Even the advocate of tap rooms and
auditable tcpdump seems to acknowledge that fact.

> Let's take that thought a litte way forward:
> It would be silly to suggest every system/LAN/backbone will magically be
> upgraded overnight.

Whether backboones (whatever those are today) or LANs are upgraded is
irrelevant to the fact an auditable tcpdump is technically silly.  The
idea is predicated on the assumption that real encryption is somehow
"regulated," and never mind that program source that implements it for
text has been distributed world-wide on t-shirts and is exported from the
U.S. millions of times every day in netnews signatures.  I think that
assumption also makes the idea of an auditable tcmpdump silly, but that
is more of a political consideration.  (visualize armies burning copies
of PGP and PERL)

Backbones and LANs are also irrelevant to whether real encryption is used,
since encryption is a purely end-system to end-system thing. (modulo
traffic analysis)

> However, those services providers offering a better level or privacy have a
> marketeable point of differentiation, at effectively no cost differential,
> can attract more users (personal and business).
> (gasp - a non-technical comment!)
>
> Current systems will slowly get upgraded and or replaced. Again, phase-out
> of the old will occur over time.

That's irrelevant.  Service providers cannot offer real encryption.  Anyone
who says or implies otherwise does not understand encryption or is trying
to mislead the masses.  (There are plenty of both kinds of people.  Were
Cisco and the other router vendors trying to mislead the masses with their
silly, U.S.Government approved hop-by-hop encryption nonsense?--I don't
know about individuals, but organizationally the answer is clear.)

Again, as we all know, real encryption is an end-to-end thing.  If you
give your keys or your cleartext to any third party, including your
service provider, then you have no rational expectation of privacy.

> Under this concept, interoperability with legacy environments is the only
> issue to consider going forward.  I expect the vendors will implement the
> usual translation/conversion functional model they have for every other
> device that spans 2 or more network protocols.

I do not understand how anything that involves "translation/conversion"
is related to real encryption.  Again, real encryption is end-to-end.
You might translate packet headers between IPv4 and IPv6, Ethernet and
FDDI, or TCP/IP and x.25, but if you're translating payloads, whatever
you're doing has nothing to do with genuinely private communications.

> There is no  cohesive security environment to the core Internet
> architecture.
>
> Let's design such a cohesive security environment, or leave it to the 3l33t
> doods and use something better, like the PSTN and BBS's.

I do not understand any technical content in those two sentences,
or at least nothing to do with real encryption or auditable tcpdump.
(That could be merely my habit of playing buzz bingo.   What with
"cohesive," "security," "environment," "core," and "architecture,"
I almost won.)

Note that we do have IPSec, PGP, S/MIME, PGPPHONE, and plenty of other
things that guarantee privacy.

Vernon Schryver    [email-masked]

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "chefren" <[email-masked]>
Date: Wed, 17 Nov 1999 02:02:34 +0100

> auditable tcpdump seems to acknowledge that fact.

Not useless: Of less use, as much as fingerprints don't 
stand for a "3d image" of a criminal scene.

> "regulated,"

No, it isn't. I definitely don't assume that. I admit that 
I personally think unregulated strong encryption is pretty 
silly for a community. A community that seems to want to 
ignore criminal organization.

..

> service provider, then you have no rational expectation of privacy.

You can have a community expectation of privacy if your 
provider is by law required to use strong encryption for 
your communication.

(Eh and please don't let we forget telco's operate that way 
for about 150 years... who from this list has other than 
for trying or use in the army =ever= used a vocoder to 
defend his "privacy"??? )

..

> things that guarantee privacy.

How much? As far as I know they leave pretty perfect 
fingerprints of the sender.

If law enforcers thinkt that's enough and democracy gives 
them the right to fish for them in specified cases: OK. 
Shouldn't be any discussion about it.

And still they shouldn't fish with raw tcpdump but with an 
audited version...

+++chefren

= =
ii.nl ontwerpt, bouwt én onderhoudt websites
100 Euro aanbrengpremie: http://www.ii.nl/premie