🚀 go-pugleaf

Ronnie Sahlberg asks advice about what kind of crypto system to use en
an environment that broadcasts lots of 10-15 byte messages to 1-N receivers,
some of which don't always stay on line.  The hard questions are about
- what is the security threat?  NSA or KGB?  competitors?  insiders?
	I will assume DES is good enough.
- what do you want the encryption to do for you?  make the data unreadable?
  make the data unforgeable but reading is ok?  unreadable AND unforgeable
  but you don't mind discarding bad messages?  do you care if somebody
  plays a message back to the receivers more than once?  you mentioned
  a limit on how much time could be spent on encryption - what about
  the amount of memory available?  Can you use DES chips?
- How do you distribute keys to the units?  I will guess the following:
	- secret keys, with the same key for every unit
	- each unit is secure enough that you don't worry about
		somebody taking it apart to find the key
	- if this is NOT true, then broadcasting to more than one unit is hard
		if you can only send each message once.
- Is there just one central station transmitting?  This is easier,
	but the method I'll suggest can be used more generally.
	Does everybody have a clock that stays in sync?

Here's one proposed method:
- At the transmitter, generate a message M and a random number R.
	The number R should be generated carefully - 
	- if you are afraid because the NSA is trying to read your messages,
	  use DES or similar encryption to generate the numbers.  
	- if you aren't that worried, use a multiplicative random number 
	  generator, with a period 2**32 or close.
	- if you are worried about playback attacks, use a timestamp 
	  AND a random part R = (t,r), so the units can check.
	  (REAL experts will probably point out weaknesses in this approach,
	  besides the obvious weakness that a Bad Person can transmit
	  a message using the next time stamp which will prevent your
	  real message from being accepted.)
- transmit a message containing DES( (R,M), k), where k is the key 
	used in all the units, and DES is encryption using DES in
	Cypher FeedBack Mode, so that the message will be different every time.
	The message may also include the destination unit, if you are willing
	to transmit that information unencrypted.
	The receiver decrypts the message, and ignores R, or checks
	the timestamp part of R to see if it's newer than the last one,
	and does something useful if the time variable overflows.
	This assumes you can program your equipment in a country where
	encryption is legal and exportable.  If you can't, 
	either use a simpler algorithm than DES and get a specific
	license from the US Export Bureaucrats to use it (people have discussed
	RSA's RC-2 and RC-4 here).

- If all you need to do is make sure the message came from the real sender,
	and not from a Bad Person, then you can use methods that are exportable.
	- transmit a message containing R, M, CHECKSUM( R,M,Key ),
	where CHECKSUM is a secure enough checksum algorithm.
        If you want real security, it should be something like MD4 or MD5
	(which may be too slow for your application?); 
	otherwise uses a CRC-32 or longer checksum.
	The receiver makes sure the checksum matches, and 
	rejects the message if it doesn't.

--
#				Pray for peace;      Bill
# Bill Stewart 908-949-0705 wcs@anchor.att.com AT&T Bell Labs 4M312 Holmdel NJ
# Nov 12 - Anniversary of Indonesian massacre in East Timor, 1991
# Indonesia first invaded in 1975, and about 1/3 of the people have been killed.