Death of antivirus software imminent
James A. Donald
jamesd at echeque.com
Sun Jan 6 14:54:35 EST 2008
Leichter, Jerry
> > Why not just require that the senders of malign
> > packets set the Evil Bit in their IP headers?
> >
> > How can you possibly require that encrypted traffic
> > *generated by the attackers* will allow itself to be
> > inspected?
Alex Alten wrote:
> You misunderstand me. We can for the most part easily
> identify encrypted data, either it is using a standard
> like SSL or it is non-standard but can be identified
> by data payload characteristics (i.e. random bits).
Steganography will beat that. If the government demands
non random bits, non random bits will be provided.
> If it is a standard (or even a defacto standard like
> Skype) we can require access under proper authority.
> If it is not (or access under authority is refused),
> then just simply block or drop the packets, there's no
> need to inspect them.
This means that only authorized, regulated, officially
registered data formats shall be permitted. It will be
almost impossible, most likely completely impossible,
for *my* format to get registered even though it sends
data completely in the clear. Skype will be
grandfathered in, but the next Skype will not be.
So I will do what the bad guys do - steganograph my
entirely innocuous application, which would not need
cryptography at all except to escape intrusive
regulation, forcing me to hide my actual data format
inside a registered and officially authorized data
format.
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com
More information about the cryptography
mailing list