- Secure communication
Secure communication includes means by which people can share information with varying degrees of certainty that third parties cannot know what was said. Other than communication spoken face to face out of possibility of listening, it is probably safe to say that no communication is guaranteed secure in this sense, although practical limitations such as legislation, resources, technical issues (interception and encryption), and the sheer volume of communication are limiting factors to surveillance.
The purpose of this article is to describe the various means by which security is sought and compromised, the differing kinds of security possible, and the current means and their degree of security readily available.
With many communications taking place over long distance and mediated by technology, and increasing awareness of the importance of interception issues, technology and its compromise are at the heart of this debate. For this reason, this article focusses on communications mediated or intercepted by technology.
Also see "
Trusted Computing", an approach under present development that achieves security in general at the potential cost of compelling obligatory trust in corporate and governmental bodies.
Users and needs
Many forms of everyday communication are "reasonably" secure, thus, we do not assume telephone calls are intercepted when we use them. However in some areas such as online intellectual property rights, legal, criminal, political and commercial communications, this assumption is inadequate.
Nikola Teslademonstrated a radio controlledboat in Madison Square Gardenthat allowed secure communication between transmitter and receiver. [The schematics are illustrated in US patent|613809 and describes "rotating coherers".]
One of the most famous forms of secure communication was the Green Hornet. During WWII, Winston Churchill had to make vital calls to the President of the United States, Franklin D. Roosevelt. These calls talked about such things as shipping and troop movements. At first, the calls were made using a radio phone as this was thought to be secure. Unfortunately, due to the Nazis having a listening station in Holland they were able to hear every last word. As soon as it was realised they stopped using the radio phone and started work on a whole new system, the Green Hornet. It worked by playing a copy of white noise over the conversation and then an identical copy was subtracted on the other end of the line. This meant that anyone listening in would just hear white noise but as the only two identical copies were held with the Prime Minister and the President the conversation was clear to them. As secrecy was paramount, the location of the Green Hornet was only known by the people who built it and Winston Churchill, and if anyone did see him entering the room it was kept in, all they would see was the Prime Minister entering a closet labeled 'Broom Cupboard.' It is the said that because of the way the Green Hornet works it is not able to be beaten, even today.
Nature and limitations of secure communication
Types of security
Security can be broadly categorised under the following headings, with examples:
* Hiding the content or nature of a communication
** Identity Based
* Hiding the parties to a communication (prevention of identification, or
Crowds" and similar anonymous group structures. i.e. it is difficult to identify who said what when it comes from a "crowd".
** Anonymous communication devices (unregistered
cellphones, Internet cafes)
** Hard to trace
routingmethods (through unauthorised 3rd party systems, or relays)
* Hiding the fact that a communication takes place
** "Security by obscurity" (similar to
needle in a haystack)
** Random traffic (creating random data flow in order that the presence of genuine communication is harder to detect and
traffic analysisless reliable)
Each of the three is important, and depending on the circumstances any of these may be critical. For example, if a communication is not readily identifiable, then it is unlikely to attract attention for identification of parties, and the mere fact a communication has taken place (regardless of content) is often enough by itself to establish an evidential link in legal prosecutions. It is also important with computers, to be sure where the security is applied, and what is covered.
A further category, which touches upon secure communication, is software intended to take advantage of security openings at the end-points. This software category includes
trojan horses, keyloggers and other spyware.
These types of activity are usually addressed with everyday mainstream security methods, such as
antivirussoftware, firewalls, programs that identify or neutralize adwareand spyware, as well as web filtering programs such as proxomitronand privoxywhich check all web pages being read and identify and remove common nuisances contained. As a rule they fall under computer securityrather than secure communications.
Tools used to obtain security
Encryptionis where data is rendered hard to read by an unauthorised party. Since encryption can be made extremely hard to break, many communication methods either use deliberately weaker encryption than possible, or have backdoors inserted to permit rapid decryption. In some cases government authorities have required backdoors be installed in secret. Many methods of encryption are also subject to "man in the middle" attack whereby a third party who can 'see' the establishment of the secure communication is made privy to the encryption method, this would apply for example to interception of computer use at an ISP. Provided it is correctly programmed, sufficiently powerful, and the keys not intercepted, encryption would usually be considered secure. The article on key sizeexamines the key requirements for certain degrees of encryption security.
The encryption can be implemented in way to require the use of encryption, i.e. if encrypted communication is impossible then no traffic is sent, or opportunisticly.
Opportunistic encryptionis a lower security method to generally increase the percentage of generic traffic which is encrypted. This is analogous to beginning every conversation with "Do you speak Navajo?" If the response is affirmative, then the conversation proceedes in Navajo, otherwise it uses the common language of the two speakers. This method does not generally provide authenticationor anonymitybut it does protect the content of the conversation from eavesdropping.
Steganography("hidden writing") is the means by which data can be hidden within other more innocuous data. Thus a watermark proving ownership embedded in the data of a picture, in such a way it is hard to find or remove unless you know how to find it. or, for communication, the hiding of important data (such as a telephone number) in apparently innocuous data (an MP3 music file). An advantage of steganography is plausible deniability, that is, unless one can prove the data is there (which is usually not easy), it is deniable that the file contains any. "(Main article: Steganography)"
Identity based networks
Unwanted or malicious behavior is possible on the web since it is inherently anonymous. True identity based networks replace the ability to remain anonymous and are inherently more trustworthy since the identity of the sender and recipient are known. (The telephone system is an example of an identity based network.)
Recently, anonymous networking has been used to secure communications. In principle, a large number of users running the same system, can have communications routed between them in such a way that it is very hard to detect what any complete message is, which user sent it, and where it is ultimately going from or to. Examples are
Crowds, Tor, I2P, Mixminion, various anonymous P2Pnetworks, and others.
Anonymous communication devices
In theory, an unknown device would not be noticed, since so many other devices are in use. This is not altogether the case in reality, due to the presence of systems such as Carnivore and Echelon which can monitor communications over entire networks, and the fact that the far end may be monitored as before. Examples include
payphones, Internet cafe, etc.
Methods used to "break" security
The placing covertly of monitoring and/or transmission devices either within the communication device, or in the premises concerned.
Any security obtained from a computer is limited by the many ways it can be compromised - by hacking,
keystroke logging, backdoors, or even in extreme cases by monitoring the tiny electrical signals given off by keyboard or monitors to reconstruct what is typed or seen ( TEMPEST, which is quite complex).
Laser reading of windows
In certain cases individuals have had private spoken communications intercepted by means of laser. This usually involves a sensitive laser directed at a window, capable of picking up the tiny glass movements caused by sounds, and conversion back to speech.
ystems offering a degree of secure communication
Cellphones can easily be obtained, but are also easily traced and "tapped". There is no (or only limited) encryption, the phones are traceable - often even when switched off - since the phone and SIM card broadcast their International Mobile Subscriber Identity (
IMSI). It is possible for a cellphone company to turn on some cellphones when the user is unaware and use the microphone to listen in on you, and according to James Atkinson, a counter-surveillancespecialist cited in the same source, "Security-conscious corporate executives routinely remove the batteries from their cell phones" since many phones' software can be used "as-is", or modified, to enable transmission without user awareness [http://news.com.com/FBI+taps+cell+phone+mic+as+eavesdropping+tool/2100-1029_3-6140191.html] and the user can be located within a small distance using signal triangulationand now using built in GPS features for newer models. Pablo Escobarwas assassinated after he was located by using his cellphone signal.Fact|date=September 2007
Analogue landlines are not encrypted and are trivially tapped. Such tapping requires physical access to the line which is easily obtained from a number of places, e.g. distribution points, cabinets and the exchange itself. Tapping a landline in this way would also enable the attacker to make calls which appear to originate from the tapped line.
Using a third party system of any kind (payphone, Internet cafe) is often quite secure, however if that system is used to access known locations (a known email account or 3rd party) then it may be tapped at the far end, or noted, and this will remove any security benefit obtained. Some countries also impose mandatory registration of Internet cafe users.
Anomymous proxies are another common type of protection, which allow one to access the net via a third party (often in a different country) and make tracing difficult. Note that there is seldom any guarantee that the
plaintextis not tappable, nor that the proxy does not keep its own records of users or entire dialogs. As a result anonymous proxies are a generally useful tool but may not be as secure as other systems whose security can be better assured. Their most common use is to prevent a record of the originating IP, or address, being left on the target site's own records. Typical anonymous proxies are found at both regular websites such as Anonymizer.com and spynot.com, as well as on proxy sites which maintain up to date lists of large numbers of temporary proxies in operation.
A recent development on this theme arises when wireless Internet connections ("
Wi-fi") are left in their unsecured state. The effect of this is that any person in range of the base unit can piggyback the connection - that is, use it without the owner being aware. Since many connections are left open in this manner anyway, situations where piggybacking might arise (wilful or unaware) have successfully led to a defense in some cases, since it makes it difficult to prove the owner of the connection was the downloader, or had knowledge of the use to which unknown others might be putting their connection. An example of this was the Tammie Marson case, where neighbours and anyone else might have been the culprit in the sharing of copyright files. [ [http://www.theregister.co.uk/2007/04/25/open_wi-fi_child_porn_case/ Open Wi-Fi proves no defence in child porn case | The Register ] ] Conversely, in other cases, people deliberately seek out businesses and households with unsecured connections, for illicit and anonymous Internet usage, or simply to obtain free bandwidth. [ [http://www.theregister.co.uk/2007/12/11/piggybacking_arrest_made/ 'Extortionist' turns Wi-Fi thief to cover tracks | The Register ] ]
Programs offering more secure communications
Skype- secure voice over Internet, secure chat. Uses 128-bit AES (256-bit is the standard) and 1024-bit assymmetrical protocols to exchange initial keys (which is considered relatively weak by NIST[ NISTrecommmendations from 2005 state that 1024-bit asymmetric ciphers are the lowest standard it considers when evaluating ciphers, and that this is expected to be categorized as technically weak or breakable from around 2006-2010. [http://www.keylength.com/index.php] (click on NIST and scroll to the last table, or see article: Key size).] ). Proprietary. No information on backdoors. An article in 2004 suggested that Skype has relatively weak encryption, but more recent analyses, one by invitation and one by reverse engineeringpresented at DEF CON2005, both conclude that Skype uses encryption effectively. Criticism focuses upon its proprietary "black box" design, its relatively short (1536 bit) keys, excessive bandwidth use of user supernodes, and excessive trust of other computers able to "speak Skype". "(See Skype#Security)"
Zfoneis an open sourcesecure voice over Internet program, by Phil Zimmermann, the creator of PGP. As of April 2006it is being beta tested prior to release.
* pbxnsip is a SIP-based PBX that uses TLS and SRTP for encrypting the voice traffic. In contrast to other proprietary protocols, the protocol is open so that devices from independent vendors can be used. The encryption includes the relay of
Instant Messagingand Presenceinformation as well as the management interface.
* Secure IRC and web chat - Some IRC clients and systems use security such as SSL. This is not standardised. Likewise some web chat clients such as Yahoo Messenger use secure communications on their web based program. Again the security of these is unverified, and it is likely the communication is not secured other than to and from the client.
* Trillian - offers secure IM facility, however appears to have weaknesses in key exchange which would enable a "man in the middle" attack with ease. Proprietary, no information on backdoors.
Off-the-Record Messagingis a plugin which adds end-to-end encryption and authentication as well as Perfect forward secrecyto instant messaging. It is not a separate protocol but runs under most every IM protocol.
WASTE- open source secure IM, high strength "end to end" encryption, within an anonymised network.
* Secure email - some email networks such as "
hushmail", are designed to provide encrypted and/or anonymous communication. They authenticate and encrypt on the users own computer, to prevent transmission of plain text, and mask the sender and recipient. Mixminionprovides a higher level of anonymity by using a network of anonymizing intermediaries, (similar to how Tor and crowdswork above).
CryptoHeaven- secure email, secure instant messaging, secure file storage and sharing. Provides end-to-end encryption with AES standard. Publicly available client source codein Java language.
oftware selections and comparisons
Comparison of VoIP software
Comparison of instant messaging clients
Hepting vs. AT&T(a 2006 lawsuit in which the Electronic Frontier Foundationalleges AT&Tallowed the NSAto tap the entirety of its clients' Internet and Voice over IPcommunications)
NSA warrantless surveillance controversy
* [http://ise.gmu.edu/~xwangc/Publications/CCS05-VoIPTracking.pdf * X. Y. Wang, S. Chen and S. Jajodia “Tracking Anonymous Peer-to-Peer VoIP Calls on the Internet”. In Proceedings of the 12th ACM Conference on Computer Communications Security (CCS 2005), November 2005.]
Wikimedia Foundation. 2010.
Look at other dictionaries:
Secure Communication based on Quantum Cryptography — (SECOQC) is a project that aims to develop quantum cryptography (see there for further details). The European Union decided in 2004 to invest 11 million EUR in the project as a way of circumventing espionage attempts by ECHELON. Christian Monyk,… … Wikipedia
Secure voice — (alternatively secure speech or ciphony) is a term in cryptography for the encryption of voice communication over a range of communication types such as radio, telephone or IP. Contents 1 History 2 Analog Secure Voice technologies 3 Di … Wikipedia
Secure messaging — is a server based approach to protect sensitive data when sent beyond the corporate borders and provides compliance with industry regulations such as HIPAA, GLBA and SOX. Advantages over classical secure e Mail are that confidential and… … Wikipedia
Secure Messaging — (englisch für „Sicheres Mailen“) bezeichnet ein serverbasiertes sicheres E Mail System. E Mails sind dabei bei der Übermittlung vor Einsichtnahme Dritter geschützt, Vertraulichkeit ist gewährleistet. Secure Messages haben eine hohe… … Deutsch Wikipedia
Secure multi-party computation — (also known as secure computation or multi party computation (MPC)) is a sub field of cryptography. The goal of methods for secure multi party computation is to enable parties to jointly compute a function over their inputs, while at the same… … Wikipedia
Secure messaging — (englisch für „Sicheres Mailen“) bezeichnet ein serverbasiertes sicheres E Mail System. E Mails sind dabei bei der Übermittlung vor Einsichtnahme Dritter geschützt, Vertraulichkeit ist gewährleistet. Secure Messages haben eine hohe… … Deutsch Wikipedia
Secure telephone — A secure telephone is a telephone that provides voice security in the form of end to end encryption for the telephone call, and in some cases also the mutual authentication of the call parties, protecting them against a man in the middle attack.… … Wikipedia
Secure Shell — Fonction Session à distance sécurisée Sigle SSH Port 22 RFC … Wikipédia en Français
Secure shell — Pile de protocoles 7 • Application 6 • Présentation 5 • Session 4 • Transport … Wikipédia en Français
Secure multicast — IP Multicast is a communication method where a single data packet can be transmitted from a sender and replicated to a set of receivers. The replication techniques are somewhat dependent upon the media used to transmit the data. Transmission of … Wikipedia