Posts by efestnetz 8 publicly visible posts • joined 5 Jun 2015
our equivalent of cesg just announced that the bundestag pc network must be scrapped due to cyber attack.
the bilderbergs certainly have the power to cut down the size of the cyber war domain by stopping the use of the c language, the most important enabler of cyber war.
maybe they can pay for a the train ticket for niklaus wirth from zurich. he could tell them how to umdo the damage their bell labs buddies effected.
so we finally have the memory safe systems programming languages. the cyber crime/war domain can now be shrunken to reasonable size again.
after decades of malpractice with the bug-enabler C, we return to the sanity of strongly typed languages. thanks to niklaus wirth and other allaman engineers.
lets hope we can turn the it ship around before people start to use paper files again.
Also, it could be mandated that in the course of one year 1% of all messages/sessions are decrypted and inspected for being double-crypted. If they found something double-crypted, you would be fined with some inconvenience like monetary loss or loss of internet connection. The inspection could be done by a separate entity from the judicial system instead of an intelligence service.
That is much better than the status quo, where they apparently go for ALL KEY MATERIAL THEY CAN GET. Innocent or not. One single drive-by event might be sufficient.
If you encrypt your symmetric message/HTTPS session key with your local TLA's Public Key (TLAPK) and broadcast that, it should be somewhat secure.
Of course the government/militia must protect the TLAPRIVKEY corresponding to the TLAPK like their eyeballs. If they can assure that, the scheme is technologically very robust.
I just sent an Email to Bruce Schneier on this issue and I guess it makes sense to add it to this discussion:
Hello Bruce,
I see you recently take part in the crypto and cyber war discussion.
I think it is important to look at history: Military Intelligence/General Staffs have been covertly reading letters probably since letters were sent by courier. Something like 1550 A.D. or probably earlier. The U.S. general staff were reading telegrams since the 1920s. The Austrian Empire had a "black chamber" for covertly opening and re-sealing letters 200 years ago. So did the British and the Russians. Maria Stuart was sentenced to death on the basis of an opened letter sent to an agent provocateur. The U.S. gained a superior negotiating position by reading ciphered japanese telegrams in the 1920s in the fleet size limitation talks.
Now, I am quite positive we COULD design+build un-hackable operating systems, CPUs, USB-like interfaces, ethernet interfaces, RAMs and so on. See the L4 operating system, which attempts to prove correct the entire operating system kernel. INRIA has attempted to mathematically prove correct a C compiler.
Also, we need to get rid of using the C language ASAP. In practical use it is a hellhole of insecurity. Both Apple and Mozilla are doing excellent work with the Swift and Rust languages. These languages are "memory safe", which eliminates about 50% of exploits in the CVE database.
BUT - if there were a truely secure computer/OS/compiler on the free market, this would enable everybody to build encrypted communications endpoints aka. "cipher machines". The U.S. general staff would be mightily offended by millions of arabs having a "strong" cipher machine in their homes. So they currently facilitate the subversion of the Windows, Linux, OSX, iOS, Solaris kernels by covert means (double-paid software engineers in these projects).
We all know this is a dangerous thing and the "cyber war domain" is essentially un-controllable.
Still, we need to address the "strong cipher machine" issue, or they (governments/general staffs) will continue to subvert commercial IT systems.
So maybe "key escrow" would not be a too bad thing after all. Because that would enable the respective(!) national intelligence/police agencies to look into communications without having to resort to making operating systems and hardware insecure.
For example, if you make an HTTPS connection from America to Egypt, both NSA and Egypt intelligence would get a copy of your HTTPS session key. It would be encrypted once with the public key of NSA and once with the public key of egypt's intelligence service. Both key-cryptograms would be sent along with the HTTPS session.
If you sent a message inside Germany, only the BND or BKA (something like the FBI) would receive your HTTPS session key.
As long as the IT thinkers are dogmatic about this issue, the government will simply run over our interests.
Kind regards
XXXXXXXXXXXX
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
