🚀 go-pugleaf

karn@servo.qualcomm.com (Phil Karn) writes:
: In article <1993Jan4.215027.17258@netcom.com> rcain@netcom.com (Robert Cain) writes:
: >This all assumes that you have a secure means of getting your public key
: >to the other or an authenticated one.  Both seem equivalent in the end
: >to swapping a secret key to me.  This makes me question the fundamentals
: >of PK actually.
: 
: Why do you say that? An authenticated channel is much easier to get
: than an authenticated and secret channel. I can get pretty good
: authentication right now by calling up somebody on the phone whose
: voice I know well and exchanging MD5 hashes of whatever information we
: want to authenticate (e.g., a public key).  I could care less if
: somebody eavesdrops this call, but I certainly *would* care if we were
: exchanging secret DES keys instead.
: 

Phil,

Because even though it is much easier now that need not be true very
long.  DSP advancing as it is, I don't think that voice validation is a
very good thing to count on even though it is the best I can come up
with.  It is far from spoof-proof, just non-trivial.  I can envision a
DSP based system that does a frequency domain transformation to convert
the spectral content of one voice to another in real time.  You are
left of course with the nuances of voice that remain but I'll bet that
if the spectral transformation were performed those nuances would be
overlooked for the most part.  Hell, just do a simple frequency shift
of a voice and you probably will not recognize the speaker even if
well known.  Whether the converse is true, false recognition, I don't
know because I have never heard it but I just have a feeling.

Bob
-- 
Bob Cain    rcain@netcom.com   408-358-2007

    'The meek shall inherit the earth--the rest of us will move on..'
                                                    Sameer Parekh


               PGP 1.0 or 2.0 public key available on request.