 |
 |
Alan Hassey wrote > > I hate PS files.!!! Andrzej Glowinski observed > > It is a de facto standard in the academic world. If you want to be > part of this, there is little choice. I make articles available in html where there is a demand - as with the BMA Security Policy and the recent update to it - and where it is feasible. With the Euroclipper paper, it is not feasible, as there are too many mathematical expressions in the text. So here is a brief synopsis of what is wrong with Euroclipper. GCHQ has not only specified it for securing interdepartmental email, but they want it widely used in commerce, industry, the NHS - and indeed in Europe. I am going to the OECD next month to try and persude them that it would be disastrous to standardise on it. But I expect that the government will keep on trying to use it regardless - I understand that the incentives will include being able to file tax returns and apply for government grants electronically. I expect that variants of it will pop up in the encryption pilots we have been promised, so we will have to reject them as unacceptable, unethical etc etc. Then Ray Rogers will say that the BMA is being Luddite, etc etc. So here are the facts: (1) The design is extremely inefficient. Although public key algorithms are used, with the resulting computational cost, the functionality provided could be delivered much more cheaply using secret key algorithms in a Kerberos-like protocol. In effect, the GCHQ offering gives you the negative features of both public key and secret key cryptography without the benefits of either. (2) It won't scale. It might (just) sort of work in a universe of 25 government departments, each with 20,000 civil servamts under the control of a single departmental security officer. It will not work in a world of 12,000 separate healthcare provider organisations, most of which have only a dozen or so staff, and almost all of whom are responsible for controlling their own personnel. (3) Keys are escrowed - but unlike in the American `Clipper' proposal, where only the sender's version of the key was held (and held in two pieces by two separate agencies), GCHQ proposes that both the sender's and the receiver's key will be held (and in each case by his own departmental security officer). This is just asking for abuse. (4) GCHQ appears to propose setting up an infrastructure of escrowed confidentiality keys first, and then using this to distribute signature keys as required. This is an extremely bad idea, as the departmental security officer will be able to get hold of the signing keys of all the staff in that department. Incidentally, the crypto custodians attached to the DSOs will be GCHQ personnel. This leads me to ask whether that the real client for escrow is law enforcement - as ministers claim - or the intelligence community. Any policeman could tell you that while access to bank statements may provide useful evidence, a system that enabled him to forge cheques tracelessly would destroy whatever evidential value the statements had. In the healthcare context, I do not think that any sane chief constable would want his officers to be able to forge prescriptions. (5) The keys issued to individuals are a deterministic function of their names. So if your key is compromised, all your departmental security officer can do is reissue you the same old compromised key. To reestablish security you have to change your name. Also, the frequent name changes of which government organisations seem so fond will be even more expensive than at present. (6) The compromise of the system's master keys would be disastrous, and it appears impossible to do anything about this. Organisations have often disregarded this risk, but shouldn't: I know of both banks and satellite TV channels who had to reissue all their customer cards after a master key compromise. Having to reissue keys to a million health service workers would be both expensive and disruptive. Not being able to rely on the signatures on the nation's electronic medical records any more could have nasty consequences. (7) The certificates that it is proposed to use have only a two digit date field. The millenium bug will cause enough problems without adding to them! (8) The security labels on messages are sent in clear and there is nothing to stop people changing them, for example, from `Top Secret' to `Restricted - Management'. This is by no means all. There are other problems I won't go into here as they are a bit more technical. However let me say that GCHQ's protocol is a disgraceful piece of engineering; I would expect better from the average undergraduate project. If this is their bext effort, then it is a matter of national concern, as they are also responsible for the security of classified defence and diplomatic traffic - and, one must assume, for the cryptosecurity of our nuclear arsenal. If these systems are as bad, then they are putting our soldiers' lives at risk, and quite possibly our lives as well. Ross %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%