🚀 go-pugleaf

In article <434@ethz.UUCP>, wyle@ethz.UUCP (Mitchell Wyle) writes:
> An unnamed organization uses the following paradigm to pass secure
> information electronically:
> 
> Random bits, generated from a radioactive source and calibrated counter
> are collected, and distributed by courier to remote sites.
> 
> Messages are encoded via bit-wise exclusive-or, and transmitted via
> non-secure telecommunications.  The destinations use the courier-provided 
> random bits from the key tape to decode the messages.  Each bit is
> discarded after use.  Every few months, a new tape is sent by courier.

I was a participant in a startup company which produced a small, battery
powered machine which automated the above process.  (OK, we didn't
use radioactives- but we did take the trouble to balance our shot-noise
and then check for possible "tampering" by performing an entropy measurement
on every 4K block of keytape).  Including a battery powered acoustic
modem, a tiny printer, LCD display, keyboard, and a box of ten keytapes, 
it was smaller and weighed less than a copy of the CRC.
	
Your big problem is going to be a known-plaintext spoofing attack.  
If you can find out (or guess, because you've seen the plaintext of
several other transmissions and KNOW they always start with the
date, time, city of origin and sender's full name and title, in standard
format)  then you can XOR your guess against the transmitted block
and get back a good guess for the key FOR THAT BLOCK ONLY.  Given
that key, you can spoof (fake) a transmission OF THE SAME LENGTH.
You don't gain enough info to spoof the next block, however.  

To stop this, we had two checksums - an exterior one to verify that the block 
was transmitted correctly, and an interior one which checked for tampering,
spoofing, and known-plaintext attacks.  The probability of a known-plaintext
(or chosen-plaintext ) spoof succeeding (because of the way the interior 
checksum was generated) was one chance in 2^32.
	
Well, nobody wanted to buy our boxes... until an overzealous sales rep
tried to make a sale to Ghana!  (We had previously warned him NOT to sell
to foreign nationals or governments).  Well,  the entire R&D team (self and 
3 others) went down to the local FBI office and sang like canaries.
Case (and company) closed.
	
Conclusion - The straight XOR system can be spoofed GIVEN that the content
of a message can be guessed or is known beforehand.  That's the weakness.
If the uncertanty of the message is high, and the uncertainty of the 
keytape is complete, the system works.  (beware - an oversmplification
exists in the above conclusion.  Read a text on information theory
(such as Pierce's _Symbols, Signals, and Noise_ and you'll understand))

Second weakness - bribe a courier.  Any tape that can be read can
be read twice (or duplicated onto two simultaneous tapes).

Third weakness - Are the two "ends" (coderooms, computer rooms, terminals)
completely secure?  As in TEMPEST?  Like a copper room with a copper door?
How about the bozos who work there?  Can they be trusted?
 
	
	-Bill Yerazunis
	
	"I don't think we need any NSA line eater food on
         *this* message "