[2394] in cryptography@c2.net mail archive
Re: Rivest's Wheat & Chaff - A crypto alternative
daemon@ATHENA.MIT.EDU (Rick Smith)
Mon Mar 30 15:29:16 1998
In-Reply-To: <199803272236.OAA21103@joseph.cs.berkeley.edu>
Date: Mon, 30 Mar 1998 14:01:29 -0600
To: David Wagner <daw@cs.berkeley.edu>, cryptography@c2.net
From: Rick Smith <rsmith@securecomputing.com>
>In article <2E54ADBA8A53D111904900A0C97278DFB28786@exchange.epicsys.com>,
>Nathan Spande <nathan@epicsys.com> wrote:
>> I often see us saying that strong cryptography will actually
>> reduce the number and severity of crimes, but I've never seen anybody
>> support such a statement. What percentage of crime involves failures of
>> authentication and/or disclosure by non-priviledged individuals of
>> confidential information?
At 2:36 PM -0800 3/27/98, David Wagner replied:
>The obvious example is financial transactions -- credit card numbers
>sitting around in the thousands at online merchants just waiting to be
>Mitnick'ed, ATM PINs encrypted under the bank's DES master key, and so
>on.
In Ross Anderson's work on ATM security, he found no cases where people
stole PINs by cracking crypto, they always stole them in plaintext form,
usually by being an insider. All the reports I've heard of people offering
computerized lists of CC#s have consisted of databases stolen in plaintext
form, not of numbers mined from encrypted messages. And it's not
particularly practical to keep such information eternally encrypted since
it slows down database transactions horribly. People *hate* that.
There are probably numerous cases where people have sniffed passwords and
caused damage, but I don't think that's a good example. As has been
established in earlier discussion, there's no export restriction on strong
crypto algorithms if they're used exclusively for strong authentication and
not for encryption. So people aren't prevented from using strong
authentication because of export restrictions, they're prevented because of
cost and implementation complexity.
>But here's one you might not have heard before: cellphone privacy.
There is exactly *one* celebrated case in which a breach of cell phone
privacy caused something akin to "damage," and that was the Newt Gingrich
case. Do we know of any others? If cell phone snooping is so common, why
haven't there been more reported cases of Bad Things happening? I think
this says something important about likelihood of public support for
relatively esoteric privacy protections, regardless of the intrinsic
benefits of such protections. Perhaps this is in fact a huge, hidden
problem. If so, then somebody needs to get out there and bang the drum.
>Clearly Congress considers eavesdropping on cellphones a major crime:
>they've imposed a series of increasingly-draconian restrictions on
>scanners, to the point where it's a federal felony to even own a
>cellphone-capable scanner (let alone actually use it to listen in on
>cellular calls), punishable by 10 years in jail.
My wife is an MD and she's *constantly* discussing patients' private
affairs over her cell phone. The nice thing about the way the law is
written is that it doesn't penalize speaker for disclosing the intercepted
information, it makes the listener liable for prosecution instead. The
structure of the law doesn't encourage strong privacy. Instead, it promotes
vulnerable use of cell phones by shifting the blame if information is
disclosed.
Rick.
smith@securecomputing.com
