[Cryptography] IAB Statement on Internet Confidentiality

[Andreas Briese]

> Thanks to RS for forwarding the IAB statement.
> 
> Then on 17/11/2014 04:54 am, alex at alten.org wrote in part:
> 
>>> 2. You can't just encrypt/authenticate without dealing with key
>>> management
> 
> Agreed.
> 
> On 11/17/2014 02:00 AM, ianG disagreed, saying:
> 
>> The goal is unauthenticated encryption, first and foremost.
> 
> 
> I vote with Alex on this one.
> 
> a) Obviously, unencrypted communication is like walking
> around in a bad neighborhood pushing a wheelbarrow full
> of cash.  You are going to get mugged.
> 
> b) Encryption without authentication is like putting a
> tarp over the wheelbarrow, with a big sign that says 
> "please do not passively eavesdrop on all this cash".
> 
> To repeat:
> 
> a) Obviously, the era is over when we can leave the IP
> networks and (!) the phone networks unprotected.
> 
> b) Evidently less obvious, and in need of emphasis:
> The era is *also* over when we can pretend that high-
> power active attacks are infeasible or even rare.
> 
> Defending the Home Despot PoS terminals against the
> script-kiddie-with-a-laptop-in-the-parking-lot is
> nice, but nowhere near sufficient.
> 
> c) Furthermore, we must add traffic analysis to the
> list of things to worry about.  The IAB statement
> did not even hint at this.
> 
> For example, traffic to https://firstlook.org/theintercept/
> is encrypted, but even a passive observer can tell
> what articles I've read, just by looking at the file
> sizes.
> 

Do’nt know, if the example is valid here, since encryption says nothing
about traffic size. The interesting equation would be, if your IP
calling the site will be protected by standard or not, and if all nodes
between you and the site need to know about you calling for an article.

I get the IAB call for system admins, to make crypto (TLS) available within their 
controlled node space (i.e. internal comm between mailbox servers, vpn-systems)
shall be the first goal to hit. Even that will be hard work but i personally think, it will 
have much positive effect on customers security.


> 
> When the bad guys read "unauthenticated encryption, 
> first and foremost" they start joyfully singing to 
> themselves:
> 
>  M-T-M all night,
>  M-T-M all day,
>  Traff'c analysis five miles long,
>  Oh, de doo dah day.
> 
> ================
> 
> Did you see the recent exposé in the WSJ about the
> dirtbox aka DRT Box?  Here's a rehash:
>  http://www.theguardian.com/world/2014/nov/14/government-planes-mimic-cellphone-towers-to-collect-user-data-report
> 
> I'm not surprised to hear that most of the population
> is subject to more-or-less continual tracking.  Rather,
> I was surprised that they bothered with aircraft and
> dirtboxes rather than just vampiring the data out of
> the phone companies.  Note the contrast:
> -- I can understand that a Stingray confers an
>  advantage, namely pinpoint accuracy;
> -- but dirtboxes on aircraft?  Huh?
> 

DRTboxes weigh 1kg to 5 kg (see http://www.drti.com/products.htm) 
i guess no aircraft is needed but a drone will do in case. 

Andreas