Slashdot Mirror
China Frustrated In Encryption Talks
mikesd81 writes "According to an AP article, the Chinese are pushing for the encryption standard called WAPI. It's not going so well, as the majority of countries are taking the IEEE standard 802.11i. From the article: 'An international dispute over a wireless computing standard took a bitter turn this past week with the Chinese delegation walking out of a global meeting to discuss the technology. The delegation's walkout from Wednesday's opening of a two-day meeting in the Czech Republic escalated an already rancorous struggle by China to gain international acceptance for its homegrown encryption technology known as WAPI. It follows Chinese accusations that a U.S.-based standards body used underhanded tactics to prevent global approval of WAPI.'"
Isn't it possible the Chinese could be pushing an encryption standard because they know a flaw in it they can exploit?
If we can put a man on the moon, why can't we shoot people for Apollo-related non-sequiturs?
The Chinese want their encryption to be the standard so that they can use their backdoor.
The US wants its encryption to be the standard so they can use their backdoor.
So the Chinese are pushing for a standard that no one can currently verify as being secure and then they get angry?
Kindness is the language which the deaf can hear and the blind can see. - Mark Twain
There are already at least two wireless encryption formats I can think of. I don't see why adding a third is a problem. As China's economy is very much export-driven I can see how they'd be frustrated if the US attempted to thwart them getting their standard adopted as an international one.
Video Game cheats, hints a
I'm not trying to be negative, especially towards China... However, I would never accept a security concept from any government that filters and censors their country's internet. Seems like an oxymoron to me.
The best way to predict the future is to invent it. -Alan Kay
. . . then China does not have to accept the standard for its domestic routers, right? What's the big deal?
Part of the hardcore faithful who believed in Apple long before it was cool again to do so
I trust neither China nor the US to provide me with an encryption standard that protects my privacy. Neither government is known for their fondness of people's privacy.
If anything, a free and most of all open standard could win my heart. But as long as governments are involved, who have an inherent interest in snooping, I will not rely on their security only and use encryption that is under MY (or at least that of about a billion flaw-seekers worldwide) control.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I'm not any sort of expert, but I believe that OpenSSL is an implementation of an existing standard, whereas the things up for debate here are the next-generation standards to use. Furthermore, these standards are for wireless connections, which isn't something that OpenSSL has anything to do with.
So basically, it's not relevant, I'm afraid.
Since when is the USA a "Christian" country? Have Falwell and his Taliban finally taken over your government completely? Sorry to hear that; it seemed like a reasonably nice place while it lasted.
most of these 'standards' come with a lot of strings attached: implementation of certain pieces of technology, support infrastructure, etc. are patented. patents rule this world. wapi must be well-protected by chinese corporations, while its alternative is probably surrounded by a patent mind field that belongs to u.s. companies. it is all about money, as usual.
China throws a hissy fit because it's standards not used? How is this new? It's standard practice to storm out if something you don't like happens. It disrupts the meeting and makes you get your way much easier. Every 4 year old kid can tell you this..
I don't trust China and I don't trust America, but last time I checked "offical" ment jackshit in the tech world. People will use what they deem is best and anything official will either be picked by geeks and become standard or it'll be dead within a few years and replaced by another standard untill geekdom kicks in.
I like muppets.
i11.208, the white and user-friendly encryption that is so hip only the coolest will use it (or be able to afford it)..
I jest! I jest! *ducks*
So code your own. WEP, WAP WIP WOP WUP fuckee doo, really.
:D
This IS Slashdot, isn't it? Why is this news?
There are no "backdoors" in standards, only in implementations.
Oh, I can't help quoting you because everything that you said rings true
Any crypto standard with a name like that gets my vote.
Everybody wants to use /their/ secret, of course. If it can't have code that all parties can audit.... ? I mean for real. OpenWhatever then, or is it just play-encryption.
We're all upset that the Chinese want to introduce their closed-door proprietary standard...
...] are all essentially closed door standards. Even if you're in the SIG you're only one of many. And the many are usually NOT cryptographers so they'll basically vote for whatever turns into the least amount of VB.NET code for their Windows only drivers.
But please, tell me, how many cryptographers were consulted BEFORE the design of WEP? I know of a few who worked on the implementation AFTER the design [e.g. when they couldn't change things]. WEP and WAP [and WiMAX and
Like it's so fucking hard to get a shared-secret lossy communication medium secured... AES + CCM + proper rekeying == router that doesn't cost 69.95$ at Fry's but does == a wifi device you can trust.
Tom
Someday, I'll have a real sig.
You have to partner with a bloody Chinese company to build equipment based on it.
That's fucking ridiculous.
The standard is unpublished, and will not be published. It checks in security keys with a centralized Chinese government server.
I cannot imagine a world that would permit this to become an international standard, and if China insists on all equipment manufactured within its borders to have this technology it'll just push electronics manufacturing out of China.
For a long time, people have predicted that the heavy hand of the Chinese government will one day disrupt the economic boom happening there. I hope to god not; an unstable, economically volatile China sounds like a nightmare to me.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
I think China and North Korea use the same publicist.
an ill wind that blows no good
If China wants to be heard in the international community, then they should participate in other global standards, or should have opened up the design and devlopment process of WAPI to either participation or scrutiny. They developed the standard knowing that their was an international effort (NOT American) to come up with the next generation of WLAN encryption, so I have no sympathy for the wasted effort at this stage. If China wants to effectively participate in the global standards game, they should, for instance, start a Common Criteria scheme and become a signatory country. It seems to this casual observer that China often likes to go it alone wrt standards, and when they suddenly start blustering about this international community not subscribing to their arbitrary standard is ridiculous. Why should the IEEE's efforts be thrown out? They lost the vote. They can complain about the vote being rigged or unfair, but a voting system is the closest approximation to a fair way of determining next-gen standards. I hear voting isn't so popular over in China though.
(%i1) factor(777353);
(%o1) 777353
And since they own all our manufacturing capacity, there would be little we could do about it. It would take years to tool up enough manufacturing to replace everything we depend on them to produce.
I guess being dependent on foreign oil wasn't good enough. We had to match that folly by sending our component manufacturing overseas as well.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
when Mandarin or Cantonese is equally or more effective :)
It's actually very simple. Here's what they need to do in two simple steps:
1. They should tell all manufacturers of WLAN equipment that are based in China (90% or so of all wlan manufacturers) to implement WAPI (remember, they are in China so they have to do what their government asks them to or they will be down. Oh wait, it's not very much different in USA anyway.).
2. They should tell all manufacturers of WLAN equipment that are based in China to drop support for 802.11i, or whatever else shouldn't be there.
Now, after about a year or so they will have a de facto wireless encryption standard named WAPI. Like it or not, that's the most efficient way to do this.
It seems you have no idea what makes a good encryption standard today.
The only way to be sure that an encryption schema is good is to publish it so that thousands of scientists can look at it and search for problems. Better try to include the community into the developement process.
Your "security by obscurity" idea almost never worked...
I suspect lots of companies and people would have liked to stick it to the IEEE and Linksys, and if the Chinese had prepared their position well, negotiated carefully, and put in a good proposal for an open, patent-unencumbered, well-tested, and clean encryption standard, they could have won this debate.
I don't know what exactly they actually did, but from the strongly negative reactions, I'm concluding that they must have failed on not just one, but several of these points.
The point of wireless encryption isn't to prevent anyone from sniffing the data. As soon as the data leaves the AP, it reverts to whatever form of traffic it was - POP, HTTP, HTTPS, FTP, whatever. The Chinese have more than enough access to intercept any network traffic in China in a centralized location; they don't have to sit outside your home sniffing wireless traffic.
I've always thought that WEP and it's like are overrated. If you want something to be secure, you need end-to-end encryption. You shouldn't be sending confidential data over _any_ part of the network, wireless or not, without a secure protocol like SSH or HTTPS. If you have end-to-end encryption, WEP becomes much less important.
Extra crackability may not be bad, from the Chinese point of view; control freaks try to get as much power as they can, and I can see some bureaucrat pushing for this just because. Just like in the US, where we have officials who say they absolutely need some new privacy-intrusive measure even though existing measures already cover everything they could legitimately want (like warrantless wiretapping - or CALEA).
Where's the part about figuring out why they rest of the world doesn't beat a path to their door to buy these?
I'm sure the rest of the aisian pacific rim manufacturers will be laughing all the way to the bank.
..Chi-Fi
EETimes did a fact-rich article in March. The first paragraph of the second page is most illuminating. It seems the "startup" that owns the secret encryption mechanism lacks any visible means of support, and it is a "spinoff" of a government body.
IMHO there is far too much polite gentility and benefit of the doubt shown in the media, and ISO, and WTO and even /. to the thugs who run China. There's no moral or technical equivalency involved here. The Chinese government presented WAPI late accompanied by protectionist threats and has been whining disingenuously about the world mistreating it in the process ever since. WAPI has received over 2 years of special treatment because the rest of the world relies on Chinese de facto slave labor to build its electronic goods. If the ISO process was being run honestly with a legitimate goal of defining a trustworthy secure standard that can be widely implemented in interoperable and competitive ways, WAPI would have been dismissed when first proposed.
Walking out on negotiations might work when you're holding the nukes or the Tibet being discussed at a diplomatic meeting. But walking out on engineering standards meetings for consumer electronics seems more like giving up. Maybe when you're a mafia government that rules by decree with an iron fist, you can't tell the difference.
--
make install -not war
chinese encryption algorithm??? are you serious?? does anyone else here think its a bad idea to use an security algorithm from a group of people who have yet to invent/discover the fork??? and.. i ask that with great respect to those who actually TRIED to use chopsticks.. on second thought.... shit, throw a fortune cookie at it and see if the algorithm falls apart.. your fortune: "confusion says 'you key is bad.. you no enta hear..'"
WAPI Uses a cenralized authentification host, known to both the computer and router. Geee, I wonder why China likes this architecture. Guess who would have easy access to all the keys.
Of course, this also makes it a easy target for hackers. WAPI systems in general would prove juciy targets, either for DOS, or hacking.
AES is secure, there is no NSA backdoor. Of course the NSA may have a way to brute force it, we've all heard rumors of it. But they have to bruteforce each key of each router they want to listen in on.
The Chinese govt just has to walk up to the telecom owning the local auth host and say "Give us the keys" or "Let us listen in", and it's arbitrarily simple.
No one is going to use encryption from a communist country, end of story. They can try using a homegrown solution there but as the world ties closer together over time, they'll have to adopt more open standards or face the prospects of being incompatable.
Did you know that you can be apathetic to apathy? Not that I give a shit...
Goddamnit! Lets not let the chinese have any say in any encrypting of anything! Only us here in the good old US of A have the competence to make such systems!
The fact aside that AES was developed by non-US researchers, is open to the world, and has been extensively examined by the best cryptographers in the world it wouldn't make sense. The NSA's job is protecting US interests. Those interests include classified government data and US financial data, both of which AES is approved for. So for the NSA to know about a flaw but keep it secret would mean:
1) That the NSA was able to discover a flaw in AES before it was approved, even though no one else has ever come close in all the time it's been out.
2) They believe they are they are the only ones smart enough to ever find the flaw, and thus it's safe to allow out in the wild.
I just can't see that. While it's possible the SVR isn't as good as the NSA, fair bet they are pretty good and I can't see the NSA wanting to chance something like that. To make that kind of arrogant assumption would be pretty colossally stupid.
It's a pretty safe bet that AES is indeed secure. It has been extensively checked by all sorts of crypto heavy hitters, including the NSA, and they all have weighed in as saying it's secure. It's kinda like the open source idea. Sure you can't say for SURE there's no bugs, but if the code is open, and it's been reviewed for years (without changes) by the best of the best, you are as close to sure as you can get.
Are the chinese so naive to think they are on a level field with the rest of the world. Do they really think that throwing tantrums will help them. The world, quite understandably, cringes everytime a deal with china has to be made. We all want to reap the rewards of a market that size but we are also loathe to keep making the same rationalizations over and over so we can sleep at night with the image of that student going under that tank.
As others noted, it's an open standard. Good encryption isn't developed behind closed doors, it is something that you have to have people beat on for years before you are convinced it's worthwhile. Well AES has been a standard as AES for 5 years, and the process for it to become the standard was another 5 years. In those 10 years it's been heavily examined, it's probably the most examined algorithm other than the orignal DES. Because of it's approval by the US government, and it's use in SSH/SSL it's of interest to a whole lot of people that it's secure. Thus far, it is.
Well my friend, that's as good as it gets in the crypto world. You can't prove (in the for-sure mathematical sense) that a crypto algorithm is secure. You can only test it extensively. That's been does with AES, and not just by the NSA.
I suppose there is an miniscule change that the NSA can crack AES when nobody else can, but in that case you are fucked anyway since that's what (new) SSL and SSH use anyhow.
3 months ago, the Chinese president had to come to here and meet with Gates/Balmer and the CEO of Boeing, followed by W. Now, the feds have decided that it is okay to allow all sorts of dual use IP to go to china. It is certain that all this info and goods will make it into other companies.
I prefer the "u" in honour as it seems to be missing these days.
1)the chinese are smart
2)the americans are not(except for the germans and chinese they imported)
3)The above mentioned protocols have been exploited in the past
4)the current american politics does raise suspision on everything made in america
5)the refusal to have some of the dns servers controlled outside the USA just prooves this.
6)the only people that have a problem with chinese technology is the USA
7)most europians would i bet be OK with using chinese technology since in a lot of cases it's light years ahead of the USA technology.
8)I SEE NO FREAKING PROBLEM IN USING DIFFERENT STANDARDS FROM DIFFERENT COUNTRIES.IN FACT this is a plus.It's like opensource...everyone contributes something and there 4 it's gonna be harder for someone to create and exploit it.
As another comment mentioned, it was IBM who first invented DC. And DES is vulnerable to linear cryptanalysis, indicating that maybe that's something that got invented in the open community first.
I don't believe that they are way ahead of us these days. They invented SHA-1 - now we've broken it. Skipjack's margin of safety has been whittled down to nothing with Biham's "impossible differentials". Their proposal "double counter mode" was broken within 24 hours. I think the widespread idea that they are still decades ahead of us is pure myth.
Xenu loves you!
...it's one step of a POWER PLAY.
China wants to be even more of a commercial power than ever, using a dual communist-ideology/capitalist-practice strategy against the West to help the latter collapse upon itself.
There's no ideological closed-source vs. open-source face-off here; the Communists want to be in a position to control YOU and how you communicate. You all bitch about the NSA's telephone call pattern analysis - well, here's a REAL attempt to get the means to listen in on what you talk about, and to shut you up if what you say is "inconvenient" and "unfortunate."
Get this straight: the so-called People's Republic of China is an oligarchy whose stated ideology is diametrically opposed to how YOU (and I'm talking to you Slashdotters) behave. Unless and until another Tianamen uprising occurs - and succeeds - the communists remain our foes. Cordial ones, to be sure, but foes nonetheless.
To the expat above who whined about his/her material getting ripped off: Welcome to the joys of dealing with a 3rd world government, baby. You have no chance in hell of renumeration. Get used to it.
There's no room to hide a secret "back door" in AES. Every step of its design is clear and well justified. There are no special hidden tables to sneak a back door into. And the guys who invented it were Belgian.
The NSA gave their blessing to all five final candidates. It's wildly implausble that they can break them all.
Xenu loves you!
Maybe you should look at a more reputable resource as the original poster provided. Amnesty International reports the death toll under saddam as just over 17,000. I think you will find that is LESS than those slaughtered by "friendly" forces during the illegal invasion of Iraq...
It takes nerve to use reputable and Amnesty International in the same thought. The left will do anything to sabotage the great work of Iraqi Freedom, including fabricate statistics. Well, you are only off by a factor of 20. As for legality, I find the operation more palatable from a legal standpoint than the graft and corruption of the Oil for Food crimes that preceeded it.
an ill wind that blows no good
The VERIFIED number of disappearances according to amnesty is 17,000, but may be much higher.
The VERIFIED number of civilians killed during the iraq war and subsequent occupation is 38355, but may be much higher.
According to various sources the mass graves do not contain the vastly inflated figure as mentioned in your previous quotes.
Additionally, many of the mass graves have been verified to stem from the previous war. Where they contain the bodies of those victims of the previous conflict.
Now, cant you both agree to disagree and shut the hell up! This sounds nothing like a WAPI discussion!!
MOD PARENT DOWN (and the other idiot/troll)