From: gnu
Date: Tue, 27 Oct 92 01:31:25 PPE
To: pmetzger@shearson.com
Subject: Re: D-H telnet protocol  *  Cheap secure phones
In-Reply-To: <9210221929.AA16268@newsu.shearson.com>
Message-ID: <9210270831.AA29372@toad.com>
MIME-Version: 1.0
Content-Type: text/plain


> >					(It doesn't protect against
> >active re-routing of the call, e.g. by substituting another machine
> >for the BBS, but we could work on that as Phase II.)
> I would suggest that it be done during phase one. Spoofing attacks are
> very important things to guard against, ...

Fine, Perry.  You do it.  I want to get some "easy" protection out
there now.  Easy often turns out to be six months of work all by itself.

> suggest that the protocol be designed so that it does not reveal the
> entities forming the link to outsiders (unless one end should
> intentionally advertise who it is...

This is the intent.  The D-H protocol will not reveal any identifying
information, and the rest of what is transacted will be protected under
the secret key produced by the D-H protocol.

> I am very interested in seeing such a protocol standardized because I
> have another use for it -- secure telephones. Given modern DSPs to do
> and cheap V.32bis modems, excellent secure voice communications are
> feasable.

There's a "CELP" standard for voice encoding which you can get from
the Feds.  They used it as an upgrade in STU-III secure phones.  It's
Federal Standard 1016.  It encodes voice at 4800 bits per second with
better quality than any known algorithm under 16,000 bits per second
(so says the paper on it).  If you give it 16 kbits/sec, it is "toll
quality".

You can get a free copy of the standard, a "technical information
bulletin 92-1" entitled "Details to Assist in Implementation of Fed
Standard 1016 CELP", and four floppies full of C and Fortran software
that implements it, plus test cases, by requesting it from:

	Office of the Manager
	National Communications System
	Attn: NT
	701 S. Court House Road
	Arlington, VA  22204
	+1 703 692 2124

Note that this C and Fortran code doesn't run in realtime on workstations;
it requires a DSP.  But as the "Implementation Details" paper says:

	"A high-quality, low power, small-sized voice processor can be
	constructed for under $200 parts cost in small quantities by
	adding to one of these [TMS320C31, DSP56001] DSP chips: ROM,
	16k words of SRAM, and a Texas Instruments TLC32044 A/D and
	D/A with filters chip."