THE FIRST PRIVATE LINE E-ZINE! by Tom Farley (privateline@delphi.com) (916) 777-4420 Voice & FAX P.O. Box 1059 Isleton, CA 95641-1059 USA Thanks to Rich Adams, Dayglo and Vamprella I. Editorial Page II. Updates and Corrections A. An apology to _Cellular Networking Perspectives_ B. A.E.'s most excellent demarcation points C. A new telephone related hardcopy zine from Canada D. The 1996 International Directory of Telephone Museums E. Download this! -- Nortel's "Telephony 101" pdf file III. Letters IV. Encryption Basics by Rich Adams A. Introduction B. The Julius Caesar Cipher -- substitution algorithms C. World War II -- cryptography becomes science D. The downside -- problems with shared keys E. A New Dawn: public key cryptography today F. Concepts -- understanding basic public key ideas 1. Editor's note on keys G. Stepping through encryption -- the process H. Pause for discussion I. Stepping through encryption continues J. Conclusion V. Reprint from _private line No. 1-- The GTE RTSS phone VI. Adventures in Semi-rural telephony -- Isleton telephone service by Tom Farley A. Introduction B. Isleton looses long distance and 911 for a day C. Life under GTD5 (Revised) D. Free payphone calling in the 916 E. Fun with AT&T VII. History: Fire! - The Bell System's worst single service disaster VIII. _private line_ general information IX. The last word: Vamprella's Hacker Manifesto I. Editorial Page Welcome to the first _private line_ e-zine. Comments, corrections and contributions are always welcome. Feel free to distribute freely but respect the copyright of any particular author. I suggest you put the e-text of all _private line_ back issues and the contents of this e-mail version into one giant text file. Then use your word processor's "Find" utility to look up what interests you. Got some funny looking line breaks? Reduce the font size a point or two and that should clear things up. I am humbled by the response readers and subscribers of _private line_ are giving me to the the demise of the hardcopy magazine. I've received dozens of nice notes and letters of support. Thank you all. Many people want nothing, some want back issues. Not a single request for a refund has come in. Much as I appreciate this, I must state once again that I will honor any refund request. Just drop me a note and I'll take care of you. Rich Adam wrote this issues' lead article; a well done encryption introduction for _private line_. As with all things cryptographical, it's necessary to go over it slowly. Print it out. Draw some diagrams or flow charts. Read a basic encyclopedia article on encryption later to see if they phrase things in a way you might understand better. Web site development over at privateline.com will start as soon as I complete mailing this. The next issue of the e-zine will contain some original writing by myself on prison phone technology. Let me know now if you have experience with this subject so I can incorporate your comments. On a personal note, I have recently fallen in love with a woman named Nancy. She's everything I've ever wanted and I am quite overwhelmed. This 38 year old bachelor thought he'd never find the right person, however, I know now life is indeed endless with possibilities and hope. Gone, forgotten or abandoned feelings are all coming back. This is a happy time for me and I hope it is a happy time for you as well. Best wishes, Tom Farley -- privateline@delphi.com ------------------------------------------------------------- II Updates and Corrections A. An apology to _Cellular Networking Perspectives_ The January/February _private line_ (No.10) featured a _Cellular Networking Perspectives_ article by David Crowe that I copied without permission. I used his article to fill space at the last minute. Another writer's promised article never came in. At the last minute I dropped in David Crowe's article, hoping that the positive publicity might be enough to compensate _Cellular Networking Perspectives_. That was wrong, of course, and I apologize. I should have picked up the phone and asked. Deadline is a terrible thing and I worried that David wouldn't give permission. David was nice enough not to send the Mounties out and to keep me on his mailing list. You need this newsletter if you make your living with cellular. Check out the following for more information: http:www.cnp-wireless.com/cnp-wireless B. A new telephone related hardcopy zine from Canada _Voice On The Wire_ (the operator/telephone culture digest), is a simple, engaging, personal zine by Judith Beeman about telephone operator issues. This eight page photocopied zine from British Columbia is definitely worth two American dollar bills. What's the theme? This is how Judith, an operator with BC Tel explains it: "What's not to love about being an opr?! The hours are great (I am not a morning person); I talk/assist/people people without face to face contact (not that I am antisocial...); the chairs are comfy and our work positions modern; I dress casual; get to speak with those charming male operators in the U.K. once in a while and -- now this is crucial -- the work leaves me plenty of time for other hobbies and interests. Being an operator is quirky and definitely a dying breed . . . I truly enjoy my work and hope it'll last for many more years." The debut issue features cartoons, commentary and real life stories about being an operator. There's even a reprinted book review from _private line_.The well done lead article features Rick Wehmhoefer's story -- the Bell System's first male operator. _Voice on The Wire_ shows promise and I look forward to future issues. By the way, articles, clippings, cartoons and clip art about operators are solicited. Send one dollar if you live in Canada and two dollars if you live in the United States to: Voice on The Wire #4636 MPO Vancouver British Columbia V6B 4AI Or contact VOTW at beeman@mindlink.bc.ca C. GTE's most excellent demarcation points I wrote a little about the demarcation point in _private line_ No. 7, in the article on outside plant. A photograph and an illustration pictured WECO (Western Electric Company) units. Here in Isleton we have Automatic Electric units. They are much neater in appearance and best of all they include a normal phone jack in each one. No more messing around with alligator clips to test the line. Beige boxing, I mean, service and repair, is much easier. Got a problem with your phones? Repair will often ask you to call out from the service terminal before sending a lineman. In my case, heavy, intermittent static is plaguing my phones. When tested at the demark point, however, no static is present at any time. I have some investigating, therefore, to do of my inside wiring. D. The 1996 International Directory of Telephone Museums The Telephone Historical Centre of Edmonton, Alberta has once again published their invaluable directory. Issue No. 9 is 23 pages long with 180 listings. Edited by Nellie Anquist, Isabel Peters and Susan Anderson, with direction by the Centre's Executive Director, Bert Yeudall, this directory continues to be the only semi- comprehensive source to telephone museums. I say semi- comprehensive because many entries list a museum but there is no current information to go with it. That's a shame. More people ought to buy the directory, visit a museum with little information, then send current info to Edmonton. Although this may be the last directory to be published for several years due to budget restraints, the Centre will continue to "act as a focal point for collectors and telephone museums world-wide." Purchase the directory for $6.00 plus $2.00 postage and handling. North American orders can pay with money order or check. Other orders are asked to pay with an international money order. Here's the mailing address: Telephone Historical Centre P.O. Box 4459 Edmonton, Alberta T6E 4T5 Canada Or pick one up at the Centre when visiting their museum: 10437 83 AVE Edmonton, Alberta Canada Their phone number is (403) 441-2077. FAX is (403) 433-4068 E. 'Telephony 101' by Nortel -- an excellent, informative file Been to Nortel's site yet? (http://www.nortel.com) If you're able, download and printout the Adobe Acrobat file 'Telephony101.' It's a well done, modern introduction to the telephone system. It doesn't have much on the local loop, so it's a little deceptively titled, but I really enjoyed it. It helps put current technology magazines like _Computer Telephony_ in better focus by explaining terms you've seen but perhaps haven't looked up. Here's one example involving SCAI (Switch-to-Computer-Applications Interface): Switch-to-Computer-Applications Interface (SCAI) enables a central office to communicate information in its data banks with incoming and outgoing telephone calls. SCAI services include: Coordinated Voice and Data -- provides an agent a screen of information about a caller concurrently with receipt of an incoming call Third-Party Call Control -- permits a customer's computer to interact with Coordinated Voice and Data to place outgoing calls and provide telephony control from a call center computer Voice-Processing Integration -- allows a host application, i nterworking with an Interactive Voice Response (IVR) system or Voice Response Unit (VRU) to obtain additional information about callers and direct them to the appropriate agent Third-Party Agent Control -- enables an external host computer to log-in and log-out ACD agents through SCAI signaling 'Telephony 101' contains many clear diagrams. This file is 100 pages when printed out so get ready to download a *big* file. The Acrobat reader program is downloadable from their site for free, so you can view and print this document. It's worth the effort if you have a fast modem. I suppose you could call 1-800-NORTHERN to weasel a hardcopy of the document but don't say I sent you. ------------------------------------------------------------- III Letters (Editor's note: these are just two of many nice letters I am getting. In the future, feel free to write in on anything the magazine is covering or should cover.) Mr. Tom Farley, publisher, _private line_ magazine I have received a satisfactory value from your magazine. No refund is necessary. Best wishes, hope to see you on the Web. James R. Niederlehner M.D. Dear Tom: I just received your letter last week explaining your position on why you were discontinuing your magazine. I must say that I'm sorry that your magazine will no longer be published, I thoroughly enjoyed all of your articles. I first heard of _private line's_ demise in the latest issue of _Blacklisted!411_ magazine. I don't know what would become of my subscription , so I'm glad that you had written to me. Again, I enjoyed your magazine and I don't want my subscription fee refunded to me, but I would appreciate it if you could send me issues #3-7. I already have issues #8-10. To complete my _private line_ collection I have enclosed $10.00 for issues #1&2. Thanks for keeping me informed of your situation. I hope things go well for you in the future and I wish you well. Sincerely, Mark Curran, Santa Rosa ------------------------------------------------------------- Encryption Basics by Rich Adams-Copyright 1996 by Rich Adams A. Introduction B. The Julius Caesar Cipher -- substitution algorithms C. World War II -- cryptography becomes science D. The downside -- problems with shared keys E. A New Dawn: public key cryptography today F. Concepts -- understanding basic public key ideas 1. Editor's note on keys G. Stepping through encryption -- the process H. Pause for discussion I. Stepping through encryption continues J. Conclusion (Rich Adams is a Communications Analyst and Network Operations Manager for Chevron Information Technology Company, a Division of Chevron U.S.A., Inc.) First the disclaimer: this article is not meant to be a highly technical dissertation on encryption. When you are finished, you will not be able to rush out and design encryption algorithms to rival DES or IDEA. If you do, it's because you would have been able to do so before reading this. This is merely a primer to allow one to understand how encryption, public keys, and digital signature works, not the "why" down at the nuts and bolts level. If you wish more detail than this article provides, I would recommend Bruce Schneier's most excellent book, _Applied Cryptography_ (ISBN 0-471-12845-7 (second ed.), which explains the mathematics behind the algorithms along with the source code of some of the algorithms, completely researched with cross references to over 900 other sources. Cryptography is a complicated subject, but the underlying principles are actually quite simple--almost deceptively so. Quite often the use of analogy is employed to illustrate the principles. For example, many of us might take the need for encryption as a given, yet others may not quite see the purpose. One of the most popular analogies is to use the postal service. If you had a message you wanted to send to someone else, and didn't want to hand deliver it, you could do one of several things. You could write it on a postcard and mail it, you could put it in an envelope and mail it, or you could slip it into a strong box, lock it, and mail it. If you did the last, you would then be faced with the problem of getting the other party a duplicate of the box's key, but we'll get into that later. If we send something electronically, we are faced with pretty much the same choices. We can send it as we have been doing so far. That is analogous to sending it on a postcard. Whatever nodes or wires it crosses, it will be in plaintext, and easily intercepted and readable. Encrypting it is analogous to putting it in something. Using weak cryptography is like putting it in an envelope which could be steamed open. Using strong cryptography is like putting it in the strong box. The first recorded use of cryptography was in Ancient Sparta. The Spartans used what was called the "Scytale," a long and narrow strip of parchment that was wound around a staff. The message was written down the length of the staff, then unwound and sent to the receiver. The message could be read only if wrapped about a staff of the same thickness. Any other diameter would result in a jumble of letters. II THE JULIUS CAESAR CIPHER -- Substitution algorithms The most common reference to encryption in ancient times, however, was with Julius Caesar, who shifted the alphabet by three, so that A became D, B became E, and so on. This type of alphabet shifting or substitution is common today in the "cryptograms" and "cryptopuzzles" found in the daily paper. It can be broken by elementary school children. Methods for encryption became more and more complicated as time passed. Algorithms and keys were developed and became so complicated that they had to be run by machines, like the Enigma machine in World War II Germany. The algorithms, that is, the mechanics of how the encryption was done, were always kept secret, and were always the targets for interested third parties. When the British captured one of the Enigma machines, they were able to read everything the Germans encrypted and sent. To give an idea of how all this works so far, we'll encrypt the phrase "NEITHER A BORROWER NOR A LENDER BE" from Hamlet. If we were to use a simple substitution algorithm like the Caesar Cipher, our algorithm would look like this: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z D E F G H I J K L M N O P Q R S T U V W X Y Z A B C and the phrase would then read: QHLWKHU D ERUURZHU QRU D OHQGHU EH Our phrase is not in what we might consider a standard written English and would therefore be harder to break than a common sentence, but even so, there are two characteristics about it that a cryptanalyst could and would exploit. One is obvious, the single letter standing by itself. Only two letters do that, the A and the I. The other is the double letter in the third word. If the interested third party knew that our algorithm was a simple alphabet shift, they would only need to try twice, shifting the alphabet three times one way (as we did) so that D becomes A, or shifting it five times the other way so that D becomes I. Had our algorithm been a true substitution cipher, our cryptanalyst would then have begun working on the double letter, because only some of the letters can be doubled in English. Eventually, after some tedious work, the message would be broken. The longer the message, the more clues are available, and the easier it is to break. However, suppose we used a more complicated algorithm, one we called "multiple alphabet shift." Our algorithm might look like this: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z P Q R S T U V W X Y Z A B C D E F G H I J K L M N O R S T U V W X Y Z A B C D E F G H I J K L M N O P Q I J K L M N O P Q R S T U V W X Y Z A B C D F F G H V W X Y Z A B C D E F G H I J K L M N O P O R S T U A B C D E F G H I J K L M N O P Q R S T U V W X Y Z T U V W X Y Z A B C D E F G H I J K L M N O P Q R S E F G H I J K L M N O P Q R S T U V W X Y Z A B C D L M N O P Q R S T U V W X Y Z A B C D E F G H I J K I J K L M N O P O R S T U V W X Y Z A B C D E F G H N O P O R S T U V W X Y Z A B C D E F G H I J K L M E F G H I J K L M N O P O R S T U V W X Y Z A B C D We work our algorithm by finding the first letter we want to encrypt, the N, and dropping to the first shifted alphabet to get C, the second letter, E, drops to the second shifted alphabet, and we get a V. The third letter goes to the third alphabet, and so one until we reach the bottom, then we start over. Our phase now becomes: CVOOHXV L JBVGFEZR GSC I YICUMM BX That is the message we will be sending. The party with which we are communicating will have to know two things, the algorithm, "multiple alphabet shift," and the key. In this case we have a key length of eleven, and you've probably already noticed by reading down the left side of the algorithm that our key is "private line." We could have made it even more difficult by making our key something like "private line + 5" or "private line - 2" and buried the key somewhere in the middle. Although the message now seems as unreadable as the first time, our cryptanalyst friend has lost a number of their clues. For example, the single letter words are saying nothing. Our double letters are buried and false doubles have been introduced. The cryptanalyst will now have to somehow get a hold of the key, or try a brute force attack and try every possible key. III WORLD WAR TWO -- Cryptography becomes science By the time the world was slugging it out in the 1940s, Cryptography had reached the level of a science. By then, there were elaborate electromechanical means to do encryption even more complicated than what has been described above. Consider for a moment Germany's "enigma" machine which the Allies were able to break only because they had a captured Enigma machine of their own, which Churchill called his "ultra secret." By then, what is considered the only unbreakable algorithm (even by today's standards) had been developed. It was called the "one time pad." Each character in a one time pad is randomly generated--tens of thousands of characters spanning hundreds of pages. Only two copies of the pad are made. These copies are shared between the two communicating parties. One will encrypt the message using the first page of the pad and the receiver will decrypt it using the same page. Then both parties tear the page off and destroy it. It's a great scheme, but the logistical nightmare behind it is obvious. It's difficult to generate random numbers, especially in the quantities needed. Then there is the problem of trusted couriers securely getting the pad to the other party--handcuffed attache cases, locked safes, trusted guards--real cloak and dagger stuff. Affordable only by governments who feel they need to do that kind of spook stuff. Even as late as the 1970s, military comm centers had the punch card version of one time pads to synch up the communications equipment. Every morning at "oh six hundred zulu" the comm center operators would destroy the previous day's card and tear a new one from the pad. (Editor's note: Dayglo points out that many countries still use a one time pad scheme to pass embassy, military or intelligence traffic over shortwave to field operatives around the world. Information on "numbers stations" occurs occasionally in both _Monitoring Times_ and _Popular Communications_.) IV. THE DOWNSIDE -- Problems with shared keys Let's return now to our strongbox analogy. What has been described so far is what's known as Shared Key Cryptography. Even the algorithm based on DES, the Data Encryption Standard, requires the sharing of keys. By analogy, if you have something you want to send in a strongbox, you have to share the key with the other party. You either send the key with the strongbox (not a good idea--if someone intercepts the box they also get the key), send the key separate from the strongbox (again, not good-- if they can intercept the strongbox they can intercept the key), or you can meet the other party before hand and give them a duplicate of the key, which is precisely how it's done, both with real strongboxes and in Shared Key Cryptography. The box (algorithm) remains the same, and whatever one person locks, the other can unlock. There are, of course, problems. What if the parties cannot meet ahead of time? What if they have never met and have no way of knowing if the person they are now giving the key to is the real person with whom they will later be communicating? What if you need to communicate the same message with more than one person? Do you all share duplicate keys? That's bad security-- it doesn't allow communication that cannot be read by other key holders. But then, if you have a different key for every two people, the number of keys begins to grow exponentially. You only need one key for two people, but ten people would need 45 keys. Add an eleventh person and you suddenly need 10 more keys. When it comes to cryptology, it seems that people don't make truly random keys. If a key becomes compromised, then the "Time Machine Effect" becomes active: not only are present communications compromised, but everything that is sent in the future will be compromised, and everything that has been sent in the past becomes compromised. V. A NEW DAWN: Public Key Cryptography Luckily, everything mentioned until now is "stone age." Modern cryptography began in 1976 when Whitfield Diffie and Martin Hellman first described Public Key Cryptography. Since then, there has been an explosion in cryptography, especially aided by the continuing speed and development of the computer. Since then, randomization of keys became feasible, digital signature became possible, and perhaps most importantly, encryption was no longer the exclusive domain of the National Security Agency. Since then, acronyms and jargon like DES, IDEA, PGP, RSA, Blowfish, Public Key, Private Key, Key Escrow, and the like have been in the media. The concept of public key cryptography is deceptively simple. The first time you hear it, you understand it; then five minutes later you've lost it. The standard explanations like "with public key cryptography, two keys are generated, a public key and a private key; the private key the individual keeps to himself, and the public key is shared with everyone" doesn't really convey the power behind this technology. What we are going to do is a step by step walk through the encryption and decryption process and conceptually examine what happens at each step. VI CONCEPTS -- Understanding basic public key ideas Before we begin the process, we are going to have to lay some ground work. The first thing to realize is that a modern encryption package will "do it all." The user has to do nothing much more than hit the "encrypt and send" button, and the receiver has to do not much more than hit the "decrypt and verify" button. So as you read, please don't get bogged down with the feeling that encryption is only for mathematicians and spooks. Anyone can do it. Modern encryption packages, in addition to a friendly user interface, contain four major parts or functional components. One is an encryption engine (DES, IDEA, Triple-DES, Blowfish, RC4, etc.). One is a public key generator (RSA, ElGamal, Diffie Hellman, etc.). One is a digital signature algorithm (RSA, DSA, etc.) And one is a one-way hash function (MD5, SHA, Luby Rackoff, etc.). The first thing we'll begin with is an understanding of public keys. Think back again to our strongbox analogy. Shared public key cryptography could be compared to making duplicate keys and sharing them with others. With public key cryptography, two keys are generated. One key is for locking and one is for unlocking. That is perhaps the most important concept in public key cryptography, so I'm going to repeat it. You have two keys, both different, say a red one and a blue one, and one strongbox. If you lock the strongbox with the red one, ONLY the blue one can unlock it. The red one cannot unlock what it has just locked. If you lock it with the blue one, only the red one can unlock it; the blue one cannot. Neither can the green one or the yellow one or the purple one. You keep a copy of your red key safe and hidden, and place your blue one out where anybody can get it and make duplicates. If they want to send you something, they take the strongbox and a copy of your blue key, lock it, and send it to you. Only the red key can unlock it, and you have the only copy. When you want to send something secured to someone else, you get a copy of their "blue key" and lock the box with it. You will not be able to unlock it with the blue key, and neither will anyone else who has a copy of that blue key. Only that other person's "red key" will be able to unlock it. That's what happens electronically with encryption keys. The two keys that are generated are unique. You keep the private one, your "red key," safe and secure, and put your other one out on a public key server. It's published, much the same as a phone number. If anyone wants to call you on the phone, they look your number up in the phone book. If anyone wants to send you something encrypted, they look your public key up in a key server. A. (Editor's note: Is your brain shutting down yet? It's difficult to grasp this key concept since it fights against our experience of what a key does. An ordinary key locks and unlocks something: a car door, a gym locker or a finely made gun case. Strongbox keys, though, are specially made, in that they may lock but not unlock. Two keys, therefore, are needed to operate them. Let's imagine a stagecoach rolling along to pickup a payroll. The strongbox lid rattles slightly since it isn't locked yet. The guard picks up the money, throws it into the box and locks it up with his key. This key will not open the box any longer, only a different key will back at the bank. In a similar vein, you can leave your public encryption key out for all to use, much as a bank could leave dozens of locking strongbox keys around. Anyone may use your key to lock up a message but only you, back at Hacker's Bank, can unlock the goods with your unlocking key. In a similar vein, an e-mail message or other box becomes a lockable device. The process of creating and sending an encrypted document, in effect, builds a strong box made of data. It can be more secure than any box made of steel or oak. And once someone locks in a message only you can open that door. But let's get back to Rich's article.) STEPPING THROUGH ENCRYPTION -- The process Now let's begin the process. We are going to look at one of the most complicated scenarios--digitally signing and encrypting a message, then decrypting and verifying the signature at the far end. Even though complicated, it's still quite understandable, and any other scenarios will be a piece of cake. We have a Sender, let's say a young man who's in love, and we have a Receiver, a young lady who is the object of his affections and is halfway around the world on the Internet, with lots of interesting places in between where a message could be compromised. We'll assume for the moment that neither have the spiffy interface and have to do everything manually so we can see what happens at each step. Step 1. The Sender has a message that he wants to send confidentially to Receiver. Step 2. The Sender generates a one-way hash of the message. This "hash" is really a type of digital fingerprint that is unique to that message. Change a comma to a period, and the fingerprint would be different. It can be compared to the pseudoscience of numerology, where you take the person's name, King Lear, say, and boil it down to a single number, nine perhaps, and then try to figure out the person's future. Change the name to King Leer, and you end up with a different number. And it's one-way, which means you can't take the number nine and from it extrapolate "King Lear" any more than you can extrapolate a data packet from its CRC. Step 3. The Sender "signs" the fingerprint by using a digital signature algorithm and his private key. Step 4. The Sender concatenates the "signature" to the plaintext message. PAUSE FOR DISCUSSION At this point, many people stop and send their message. Why? Because the contents are not sensitive and may be read by anyone, the critical portion being that the reader may want to verify who it came from. Remember, what one key locks, only its pair can unlock. So if something is encrypted with a private key, only the corresponding public key can unlock it, and everybody has access to the public key, so everyone can verify that only one person locked it. END PAUSE Step 5. The Sender generates a one-time random key. This is sort of an electronic equivalent of a one-time pad. It's also called a session key, and this is the key that all the hullabaloo is about with the US export hassles. Step 6. The Sender uses this one-time key to encrypt the "signed message" from Step 4. This key is NOT part of a public key private key pair; it both encrypts and decrypts (locks and unlocks) the message. Note that this one-time key is still in the clear at this point. Step 7. The Sender gets the Receiver's public key from a key server, or perhaps in this case, from the Receiver herself. Step 8. The Sender then encrypts the session key using the Receiver's public key and the public key algorithm. Yes, it is feasible to bypass the session key generation and encrypt the entire signed message using a public key algorithm--but it's not normally done. RSA, for example, is slow, around 6000 times slower than the other encryption engines. So the public key algorithms are normally used for encrypting the keys only, leaving the bulk of the message to be encrypted by the faster engines. Step 9. The Sender concatenates (joins -- puts together) the encrypted key to the encrypted message. Step 10. The Sender then uses e-mail to send the encrypted message to the Receiver. PAUSE FOR DISCUSSION At this point the message is out where anybody can get to it. The addressees and routing information is in the clear for anyone to read. And they can separate the session key from the encrypted message, but what good would it do? The message has been encrypted by the session key and can only be decrypted by it. The session key has been encrypted by the a public key and only its corresponding private key can decrypt it. It is against the encrypted session keys that all the attacks are directed, which is why the key length is so critical. The only feasible way of breaking them is through brute force-- trying every possible combination until the right one is found. With a short key length, considering the computing power we have today, brute force is a snap. Any key length of 40-bits or less is okay for export according to the US government. Any why not? They can break it in .2 seconds (assuming $1,000,000 in hardware). You can export up to 64-bits IF it's to an overseas division of the same company and IF you give the government a copy of the key. PGP, by comparison, uses the 128-bit IDEA algorithm. Ah, but there's a paradigm that computing power doubles per price every 18 months. At that rate, a 64-bit key, which takes 38 days to break today, will only take an hour to break by the year 2010. PGP, using today's computers, will take 1018 years. By 2010, 1015 years, and by the year 2030, will still take 10 years. These figures are all taken from Schneier's book. Whether the US government's export rules make sense or not shouldn't really be a part of this discussion, but I can't help myself. Everyone, from anarchists to corporate types disagree with the government. The government, on the other hand, wants to be able to read anything encrypted that leaves the country so they can spot illegal activities. I can't imagine a drug cartel, for example, using only government approved software. It's legal to use encryption of any strength within the US (and Canada). It's legal to buy and use encryption of any strength that was developed somewhere else in the world (IDEA was developed in Switzerland). It's legal to use that software to communicate with someone in another country who also bought it legally outside the US. But it's not legal to take or send it out once you get it in the US, and it's not legal to develop something here and take it out. At that point it's classified as a munition and falls under the same category as a weapon. Does that make sense? You decide. Anyway, to get back on the subject, the encrypted message is out for anybody to examine, but the only thing that they could tell is that the Sender sent an encrypted message to the Receiver, and if they used PGP, they won't be reading it until about the year 2080. END PAUSE Step 11. The Receiver receives the message, trashes the header and trailer information, then separates the encrypted session key from the encrypted message. Step 12. Using the same public key algorithm and using her own private key, the Receiver decrypts the session key. Remember, the public key locked it, only the private key can unlock it. Step 13. Using the same encryption engine as the Sender and the now decrypted session key, the Receiver decrypts the signed message. The session key is discarded, never to be used again. The message can now be read. Step 14. To verify the authenticity of the Sender, the following substeps will be taken: Step A. The Receiver separates the message from the "signature." Step B. The Receiver generates her own one-way hash of the message. Step C. Using the Sender's public key which she was able to get either off a server or directly, the Receiver decrypts the encrypted hash she received. Step D. The Receiver compares the two hashes. If they are the same, the message is authentic. If not, she knows someone else is trying to spoof her, and throws the message away. CONCLUSION Remember, all those steps are transparent to the user. All those little discrete steps are done behind the scenes and require little more than button pushing. A short note takes less than a second to encrypt and send, and less than a second to decrypt. A large file might take several seconds to several minutes . Despite the thousands of years that encryption has been around, it's really still in its infancy. There are two main issues we'll be facing in the future as far as encryption is concern. The first is the aforementioned government restrictions. Hopefully, when some common sense gets into the bureaucracy, that will become a non- issue. The second will take time. Think about telephones for a moment. You can pick up the phone and call anyone in the world. It doesn't matter what make or manufacturer made the two phones, you will be able to speak to each other. You can even understand each other if one of you happens to know the other's language. It seems silly to think that if one person owns a Western Electric phone they would not be able to talk to someone who owned a phone purchase at the AT&T phone store. That's how it is with encryption, however. There are no standards. Someone using PGP cannot communicate with someone using, say, Motorola's Signet or Nortel's Entrust, but only other PGP users. Perhaps in the future, we'll be buying one encryption product over another because we like the key management better, or the GUI better, or the price better, but the different products can still work together. ------------------------------------------------------------- THE GTE RTSS PHONE (From _private line_ No. 1) I'm reprinting this old article to show how much crypto phones interest me and my readers. In that article I reproduced an ad for a General Telephone and Electronics Red Telephone Switching System phone. I asked for help in identifying some of the strange acronyms and abbreviations. STU, for example, stands for Secured Telephone Unit (thanks, Dayglo). I ask for comments and help on the rest from any reader . . . "The ad is a photograph of the phone with text all around it. Yes, the phone is a nice red color. My magazine is, unfortunately, in black and white. Still, you may find the ad in _Air Force_ magazine and some other mainstream publications. It looks similar to a generic ISDN phone but with the Autovon keys and with some sort of LCD display. The display looks to be about 2" by 4". Here's the text: Look where you can go with One GTE RTSS phone ANDVT AUTOVON CLASS A DIALLINE DEFENSE SWITCHED NETWORK JCSCAN KG-81/94, TRUNKS & MULTIPLE REMOTE SUBSCRIBER UNIT KY-3 AUTOSEVOCOM LAND MOBILE RADIO LONG-HAUL HOTLINES ON-BASE HOTLINES RED SWITCH NETWORK SATCOM RADIO STU-II KY-71/ PARKHILL KY-65/75 STU III TACTICAL GATEWAY DSVT KY-68 TACTICAL SWITCH DROP UHF RADIO VHF RADIO With GTE's Red Telephone Switching System (RTSS), a single phone gives you total Red/Black voice communications access to all these places . . . with unequalled security. It also provides robust connectivity and interoperability with other existing and future secure voice systems - - tactical, strategic, and commercial. A 20- year life-cycle support program is backed by a proven GTE worldwide field support and logistics system. You, too, can order RTSS under Contract No. F34608-88-D0007 from the DoD through HQ EID, Tinker AFB, Oklahoma. If you use more than one phone for secure/non-secure communications, you haven't been authorized RTSS. GTE Government Systems" Further comments: This ad details an exciting looking phone. I know nothing about it. Let me know if you can help by filling in the details. I'll get the guessing game going. Much has been written about Autovon. It utilizes the four right hand buttons: flash overide, flash, intercept and priority. These correspond to the four extra tones that are built into most DTMF IC's. These silver box tones are not often used by most telcos but they are used by Autovon to prioritize phone calls when they are first placed. Anyway, the Red Switch Network would have to piggyback onto Autovon if it is being included in this phone. Wouldn't it? And what are Red/Black voice communications? One color probably stands for secure voice communications. And I mean secure. It's likely that an imbedded chip in the phone does the NSA certified encryption. So, you have a secure line immediately with no need to interface with anything else. As such, it is probably classified as a "controlled cryptographic item." It may allow only one person to speak at a time when it's in the secure mode. KY-3 AUTOSEVOCOM should stand for automatically secure voice communications. Comsec stands for the obvious: secure communication. There are, apparently, many forms of Comsec. Some of them are KY-57, ANDVT, and KG-84. The field radio receiving this traffic is called, I think, a processor. Motorola makes a unit called the Sunburst II processor. VI. Adventures in Semi-rural telephony -- Isleton telephone service by Tom Farley A. Introduction B. Isleton looses long distance for a day C. Life under GTD5 (Revised) D. Free payphone calling in the 916 E. Fun with AT&T Isleton phone service is frustrating, sometimes fun and always expensive, since everything out of here is a toll call. Get out a California map to follow along. General Telephone, which later became GTE, provided phone service to Isleton as well as southwestern Sacramento county for decades. They sold this territory to Citizen's Telecom two years ago. You have therefore, an infrastructure built by one large, impersonal, out of state firm, maintained by a smaller, impersonal, out of state firm. Only four thousand people live year round in the Delta, consequently, our local phone book's white pages take up just 38 pages and the yellow pages take less than a hundred. That's in a 5 inch by 7 inch phone book, by the way, something that looks like a small pamphlet. People here exchange the last four digits of their telephone numbers. You know an outsider or newcomer if they give you their complete number. Let's look at the whole area before we look at Isleton. Here are the cities served along with their prefixes in the 916 area code: Elk Grove 682-687 Freeport 665 Clarksburg 744 Hood 775 Courtland 775 Locke 776 Walnut Grove 776 Ryde 776 Isleton 777 I won't discuss Elk Grove much since it falls outside of the Delta. I will say, though, that their phone book still contains an interesting, if grim, two page evacuation plan for the now defunct Rancho Seco Nuclear Power Plant. Moving into the Delta, Freeport, Clarksburg, Hood and Courtland long distance traffic seems bundled together and sent to Citizen's toll center in Elk Grove, probably by microwave link from the Courtland switching office. Isleton, Ryde, Walnut Grove and Locke traffic, on the other hand, are sent by fiber optic cable to Elk Grove by way of Walnut Grove. Much of that cable crosses or lies underneath the Sacramento River. These towns are connected in series to the cable with no backup or alternative cable routing in case of emergency. This poor arrangement shut down Isleton toll traffic on March 14, 1996 when the fiber optic cable failed. B. Isleton looses long distance for a day I woke up that Thursday to find the power out. No big deal, since Isleton seems like a low priority to Pacific Gas and Electric. Most residents keep candles, flashlights and extra ice to cope with these outages. You light a candle, throw anything that can spoil into the freezer section and wait. The big problem was my inability to call PG&E to report the outage. Dialing their 800 number only resulted in a fast busy signal (reorder) or a message saying that all circuits were busy. This changed later to a recording stating that technical problems were preventing the call from being completed. 'O' was dead. '411' and '611' (Repair) and '911' were dead. All 800 and 900 and 700 numbers were dead. All long distance was gone. Everything out of Isleton's 777 prefix was dead. Isleton's exchange serves this 850 person town, the surrounding farm country and a dozen marinas within an eight mile circle. We were all cut off, with a few dozen cellular circuits to handle outbound traffic. Not many people have cellular, though, and it wasn't surprising once I managed to call in PG&E had no reports from the public about the power outage. And while the power came back on after two hours, it wasn't until 17 hours later that we got long distance service back up. Citizen's Telecom told me later that a fiber optic cable on the bottom of the river failed internally. The core broke down simultaneously along multiple points, although their exact locations weren't known. The telco didn't know what caused the breaks, although a ship anchor dragging the cable then releasing it may have damaged it this fashion. In any case, Citizens had no way to connect the Isleton exchange with the outside world since there was no emergency routing. Working on more improvisation than planning, Citizens got some circuits going by midnight by patching into the old copper cable still lying next to the fiber optic one. GTE had disconnected the cable years ago but hadn't removed it. Since light waves don't travel very well over copper, Citizen's labored throughout the day to attach the necessary opto-electronics on either side of the suspected break to convert the light waves to electrical signals the copper could pass. They have since replaced the affected cable. C. Life Under GTD-5 (Revised) Citizens later maintained that '911' (emergency) calls were routed to the Isleton police department, however, I know I called '911' at 4:30 p.m. and my call was not completed. Interestingly, calls that shouldn't rely on distant network resources, like ringback, the ANAC number and the Proctor Test Set number were cutoff as well. I thought those numbers would be based at the local switch, an aging GTD-5, more formally called a GTD-5 EAX. (General Telephone and Dynamics-Electric Automatic Exchange?) The leading article on the GTD-5, at least in the underground press, is an article by Zaphraud in the Summer, 1994 _2600_. The writer contends that the GTD-5 exists as software only, working under an existing switch like a DMS-100. Not so. The GTD-5 is a real switch, an early digital one, with its own software. I understand there is also a military version of the software and that the first GTD-5 was cut over in Banning, twenty miles west of Palm Springs on June 26, 1982. I don't have many problems with the beast, although the ringing generator sounds in the background on most calls. Repair says little can be done about that. Until three weeks ago there used to be a suite of services nestled in the 11X dialing area. Dialing 114 got the Automatic Number Announcement Circuit, 117 got the payphone proctor test set and 119 got the phone to ring after you went back on hook. Among other things. The switch's software was upgraded around the first of August and these services have moved. I pay on a per-call basis here so I won't be doing much scanning to find them. The telco appears to be installing some new hardware and software to enable caller I.D. delivery, something that is months away for this area. This may be a logical time for them to do other upgrades. The most devastating result of these changes, though, is a shutting down, for the most part, of free payphone calling in the 916. D. Free payphone calling in the 916 I noticed several years ago, when visiting Isleton, that calls would connect anywhere in the 916 if you dialed them in a certain way. For example, 1-916-444-5555 would connect but dialing 916- 444-5555 or 4444-5555 would call up the Automated Coin Toll Service. When GTE held the territory you got only ten seconds of talk time until you were cut off. Pretty cool but somewhat worthless except for short messages. Two years ago, when Citizens took over, I felt sure the game was over. They would have reviewed operations and shut down my little bit of fun. Much to my amazement, though, the ten second restriction was lifted and unlimited calls were allowed! I made many free calls to family and friends in Sacramento over the last year from a Citizens payphone tied to the Isleton exchange. The resort phones were always the most fun. There were often portable chairs next to them. You could sit down, watch the scene and talk. And talk. And talk. I think my record was a forty-five minute conversation at the B&W Marina. This was a lifesaver with calls so outrageously expensive. As of early August, though, things have changed. I remember the horror of hearing a message left one night by a Citizens' employee, informing me of "upgrades to our switch" and to "call if you have any problems." Yeah, right. My friend Vamprella and I rushed to the nearest payphone to see if the free phone still worked. She called her voice mail in Sacramento and got connected. But the DTMF keypad was disabled so she needed a tone dialer to retrieve her messages. My favorite numbers in Davis and Sacramento, by comparison, no longer work and now call up the ACTS. Hmm. So certain prefixes still connect a call and others don't. I have a lot of experimenting to do in Isleton and I'll let you know what happens. E. Fun with AT&T My phone number was hacked big time on March 26, 1996. Starting at about 4:00 p.m. and continuing until 7:00 p.m., someone successfully charged 55 one minute calls to my number, using the old third party billing routine. Only three calls were blocked. The oldest scam in the book, third party billing is, apparently, as easy as calling the the operator and asking them to bill your call to someone else's phone number. I wasn't too upset by the hack since I would never pay for the calls, however, I was suprised by the events and explanations that followed. The first surprise was not being able to get ahold of AT&T security at night. They left a message on my answering machine, saying that someone was billing to my number exessively and that they had put a 90 day block on my number to prevent any more third party billing. Okay. They said to call if I had any questions. AT&T doesn't seem to answer their phones at midnight, though, which is when I got home, got the messages and made my call. I made at least three calls, waiting for ten minutes or so at a time, only to have my call unanwered. Not even an answering machine. No one picked up the phone, and here we are talking about the world's largest telecommunication company. This might be a good test for all you business owners out there -- try calling up your long distance carrier's security at midnight -- see if anyone answers. No problem with checking, is there?. What was more surprising, however, was the story I got from security when I called the next morning. AT&T says that even to this day, most third party billing calls will be connected, unless there is a third party block in place already. No one will call verify, they'll just place it through, as "a convenience to our customers". So, considering how easy this is to do, I have some advice. If you don't need third party billing, then make sure there is a block on it from your LD company and your local telco. Call both and insist on it. You won't have to deal with the nonsense I detail now. The next stop was to deal with billing. They seemed confused. Turns out that Citizens' Telecom doesn't share (or isn't able to) real time billing information with AT&T. That means that AT&T can't pop up my record on their screens. They know I'm an AT&T customer but that's about it. They told me the calls would be taken off and to call them later when I actually got my bill. That bill still had the calls, of course, so I called AT&T again. They told me to make copies of the bill and send them in! Amazing. So I mailed off copies to someplace in Georgia and didn't hear from them again for weeks. I called again and they confessed they couldn't find my copies but would I be so kind as to fax another copy? No 800 fax number to do that and no way for me to be credited for making the call. Ridiculous. I faxed them over and they said they'd adjust things. Let me wrap this up without getting more negative. Bottom line is that AT&T did credit me for the $129 worth of calls. I switched to MCI because of this problem. MCI as well as others bills separately for long distance. They can call my account up in real time and discuss any problems with my billing. MCI also included a personal 800 number free of charge when I signed up. Kind of nice. Enjoyable as that was, I am back with AT&T. Two months after this incident they mistakenly deducted the $129 again, so I was money ahead. Then came a $70 check to get me to sign back up. I will go back to MCI as soon as there is another problem but I simply couldn't refuse $200. Got an interesting story? Send it in and I'll publish it here. I'm especially interested in independent telephone stories and information from Canada and overseas . . . ------------------------------------------------------------ VII. History -- - The Bell System's worst single service disaster This excerpt is from John Brooks _Telephone_, long out of print and now out of copyright. It details how in 1975 a 4,000 man Bell System task force restored service to 170,000 phones knocked out by fire at the 13th Ave. and Second Street switching office in New York City. . . "The most local and transient, but not the least dramatic, of these was a fire of unknown origin that swept through a switching center at Second Avenue and Thirteenth Street in lower Manhattan on February 27, 1975, causing the worst single service disaster ever suffered by any single Bell operating company. Starting around midnight in the cable vault under the eleven-story building's basement, the fire spread rapidly upward. Alert work by New York City firemen confined it to the lower floors and saved the building itself from destruction, but dense smoke from burning cable insulation suffused the unburdened parts of the building and virtually all the equipment in it was put out of service. By afternoon, when the fire was finally declared under control -- with no loss of life to either firemen or telephone people-- twelve Manhattan telephone exchanges, embracing three hundred city blocks and 104,00 subscriber lines serving 170,000 telephones, were out of service, and among the institutions bereft of working telephones were six hospitals and medical centers, eleven firehouses, three post offices, one police precinct, nine public schools, and three higher education institutions, including New York University. Before fireman had given telephone repairmen the O.K. to enter the building, the Bell System had begun one of the typical crisis mobilizations of which it is justly proud -- indeed, the largest such mobilization ever. New York Telephone, AT&T Long Lines, Western Electric, and Bell Labs contingents converged on the area, and a crisis headquarters -- inevitably called a war room -- was established in a rented storefront on Fourteenth Street, under the immediate direction of Lee Oberst, New York City area vice- president of New York Telephone. (Oberst, the type-cast hero for such and operation, was a South Bronx-born man of 54 who had started his Bell System career in 1946 as a twenty-eight dollar a week switchman.) Within twenty-four hours, emergency telephone service had been restored to the medical, police and fire facilities affected, and in hardly more time the task force assessing damage and beginning to restore service had reached its peak strength of four thousand, working around the the clock in twelve hour shifts of two thousand each. Western Electric officials were ordered to commandeer or quickly manufacture huge quantities or replacement equipment; shipments by air began the day after the fire, and eventually the amount of equipment shipped in amounted to three thousand tons. The work to be done in the damaged building varied all the way from installing new ESS equipment and writing computer programs for it to cleaning smoke-damaged relays with toothbrushes and Q- tips. A couple of happy circumstances speeded the work along. One of these was the fact that the the third floor of the burned building happened to be standing vacant at the time, thus providing space for the rapid installation of an entirely new main frame for handling trunk calls, which was shipped by cargo jet on February 28 from Western Electric's Hawthorne works. Another was the convenient availability for emergency use of excess switching capacity, from the ESS installations at Seventh Avenue and Eighteenth Street and at New York Telephone headquarters at Sixth and Forty-second. Such capacity could temporarily accommodate 28,000 of the 104,000 served lines. "The miracle on Fourteenth Street," Oberst kept calling it -- a bit melodramatically, and it appeared for a time, overoptimistically. On March 11, New York Telephone announced plans to restore service to all ordinary telephone subscribers on March 16. As that date approached, it developed that water used in the fire-fighting operation had damaged many of the cables entering the building and that the miracle would be postponed. Except for a few stray problem lines, service was restored just before midnight on March 21 -- twenty two days after the disaster, instead of the year or more that would have been required under normal conditions. The restoration was ceremoniously marked by a call from William Ellinghaus, New York Telephone's president, to Mayor Beame of New York at the mayoral residence, Gracie Mansion. The cost of the job, still not precisely calculated six months later, had been about ninety million dollars, of which almost all was covered by insurance, so the disaster cost no increase in rates to subscribers or lost profits to stockholders. It remains a fair question whether New York Telephone had been prudent, in the most telephone-dependent area in the country, to house twelve exchanges and five toll switching machines in a single building. (2) (2) _New York Times_, February 28, March 13, March 24, March 30, 1975; AT&T Share Owners Newsletter, First Quarter 1975. ----------------------------------------------------------- VIII. _private line_ General information _private line_ in hardcopy was a "journal of inquiry into the telephone system." It presented an alternative, non-corporate point of view which focused on explaining technology to beginners. The magazine was consecutively paged, indexed and illustrated. Back issues are five dollars apiece. Issues 5 through 10 are in plentiful supply, issues 1-4 will not be in stock until the first week or so of September. The best way to get an idea what the magazine was about is to check out the e-text version of the back issues. Web, gopher or FTP over to: etext.archive.umich.edu /pub/Zines/PrivateLine Another useful URL is: gopher://gopher.etext.org:70/11/Zines/PrivateLine Checks or money orders for back issues to: private line P.O. Box 1059 Isleton, CA 95641-1059 USA Questions? (916) 777-4420 Voice & FAX M-T-Th-F 9:00 a.m to noon Tom Farley (privateline@delphi.com) ------------------------------------------------------------- IX. The last word: Vamprella's Hacker Manifesto Do you remember the America of Mom and Apple Pie? Do you remember the America that lead the world in Technology? Do you remember when you were proud to be an American? That America is still alive, alive in the heart of hackers. Hackers do not desire money. Hackers desire testing their intelligence and the intelligence of others. Criminals pose as hackers since the true hacker is NOT a criminal. Curiosity and knowledge are the hacker's motivation. We create products to make our lives easier. We create computer software to make our jobs simpler. We create security to make America safer. Hackers do not destroy, hackers create. Has the person sitting next to you "hacked" or improved a part of your life? Do you know a person that has above-average intelligence? These people make things better for others. These people are hackers. Have you ever thought of ideas to improve the system at home, at work, for yourself, or for others? Then you, my friend, are a hacker. Be proud to be an American, be proud to be a hacker. -vamprella- princess@midtown.net Check out her web site. Look up Vamprella with your search engine.