exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

swan.html

swan.html
Posted Aug 17, 1999

swan.html

tags | tool, firewall
systems | unix
SHA-256 | 45b3cc5408b7f88217bdc02a14757858e44a69861b2eda01cb27c0c9f30009f4

swan.html

Change Mirror Download
<html>
<head>
<title>Swan: Securing the Internet against Wiretapping</title>
</head>
<body>

<center>
<h1>
Swan: Securing the Internet against Wiretapping
</h1>

</center>

<p>

My project for 1996
was to <b>secure 5% of the Internet traffic against passive wiretapping</b>.
(It didn't happen in 1996, so I'm still working on it in 1997.)
If we get 5% this year, we can
secure 20% next year, against both active and passive attacks; and
80% the following year. Soon the whole Internet will be private and secure.
It's called S/WAN or S/Wan or Swan for Secure Wide Area Network;
<a href="http://www.rsa.com/rsa/SWAN/">RSA</a> came up with the term.
Want to help?
<p>

The idea is to deploy PC-based boxes
that will sit between your local area network and
the Internet (near your firewall or router) which opportunistically
encrypt your Internet packets. Whenever you talk to a
machine (like a Web site)
that doesn't support encryption, your traffic goes out "in the
clear" as usual. Whenever you connect to a machine that does support this
kind of encryption, this box automatically encrypts all your packets,
and decrypts the ones that come in. In effect, each packet gets put into
an "envelope" on one side of the net, and removed from the envelope when
it reaches its destination. This works for all kinds of Internet
traffic, including Web access, Telnet, FTP, email, IRC, Usenet, etc. The
encryption boxes will be standard PC's that use
freely available software that you can download over the Internet.
<p>

This wasn't just my idea; lots of people have been working on it for years.
The encryption protocols for these boxes are called
<a href="http://www.cs.arizona.edu/xkernel/www/ipsec/ipsec.html">IPSEC
(IP Security)</a>.
They have been developed by the
<a href="http://www.ietf.cnri.reston.va.us/html.charters/ipsec-charter.html">IP
Security Working Group</a> of the
<a href="http://www.ietf.org/">Internet Engineering Task Force</a>,
and will
be a standard part of the next major version of the Internet protocols
(<a href="http://playground.sun.com/pub/ipng/html/ipng-main.html">IPv6</a>).
For today's (IP version 4) Internet, they are an option. The
<a href="http://www.iab.org/iab">Internet Architecture Board</a> and
<a href="http://www.ietf.org">Internet Engineering Steering Group</a>
have taken a
<a href="iab-iesg.stmt">strong stand</a> that the Internet should use
powerful encryption to provide security and privacy. I think these protocols
are the best chance to do that, because they can be deployed very easily,
without changing your hardware or software or retraining your users.
They offer the best security we know how to build, using the Triple-DES,
RSA, and Diffie-Hellman algorithms.
<p>

This "opportunistic encryption box" offers the "fax effect". As each
person installs one for their own use, it becomes more valuable for their
neighbors to install one too, because there's one more person to use
it with. The software automatically notices each newly installed box,
and doesn't require a network administrator to reconfigure it. Instead of
"virtual private networks" we have a "REAL private network"; we add
privacy to the real network instead of layering a manually-maintained
virtual network on top of an insecure Internet.
<p>

<h2> Deployment </h2>

The US government would like to control the deployment of IP Security with
its
<a href="ftp://ftp.cygnus.com/pub/export/export.html">crypto export laws</a>.
This isn't a problem for my effort, because
the cryptographic work is happening outside the United States. A foreign
philanthropist has donated the resources required to add these protocols
to the Linux operating system.
<a href="http://www.linux.org">Linux</a>
is a complete, freely available
operating system for IBM PC's and several kinds of workstation, which
is compatible with Unix. It was written by Linus Torvalds, and is still
maintained by a talented team of expert programmers working
all over the world and coordinating over the Internet. Linux is distributed
under the
<a href="ftp://prep.ai.mit.edu/pub/gnu/COPYING">GNU Public License</a>,
which gives everyone the right to copy it,
improve it, give it to their friends, sell it commercially, or do just
about anything else with it, without paying anyone for the privilege.
<p>

Organizations that want to secure their
network will be able to put two Ethernet cards into an IBM PC, install
Linux on it from a $30 CDROM or by downloading it over the net, and
plug it in between their Ethernet and their Internet link or firewall.
That's all they'll have to do to encrypt their Internet traffic everywhere
outside their own local area network.
<p>

Travelers will be able to run Linux on their
laptops, to secure their connection back to their home network (and to
everywhere else that they connect to, such as customer sites).
Anyone who runs Linux on a standalone PC will also be able to secure their
network connections, without changing their application software or
how they operate their computer from day to day.
<p>

There will also be numerous commercially available firewalls that use
this technology.
<a href="http://www.rsa.com">RSA Data Security</a>
is coordinating the
<a href="http://www.rsa.com/rsa/SWAN">S/Wan (Secure Wide Area Network)</a>
project among more than a dozen vendors who use these protocols. There's a
<a href="http://www.rsa.com/rsa/SWAN/swan_test.htm">compatability chart</a>
that shows which vendors have tested their boxes
against which other vendors to guarantee interoperatility.
<p>

Eventually it will also move into the operating systems
and networking protocol stacks of major vendors. This will probably take
longer, because those vendors will have to figure out what they want to do
about the export controls. I've had discussions with several other
operating system and protocol stack vendors, but none is ready to announce
their product or direction yet.
<p>

<h2>
Current status
</h2>

My initial goal of securing 5% of the net by Christmas '96 was not met.
It was an ambitious goal, and inspired me and others to work hard, but was
ultimately too ambitious. The current goal is to get a complete system
released for alpha-testing in Summer 1997. In March 1997 as I write this,
we have various pieces of the system working, but not all of them.

<dl>
<dt>Protocols
</dt><dd>
The low-level encrypted packet formats are defined. The system for
publishing keys and providing secure domain name service is defined.
The IP Security working group has settled on an NSA-sponsored protocol
for key agreement (called ISAKMP/Oakley), but it is still being worked
on, as the protocol and its documentation is too complex and incomplete.
There are prototype implementations of ISAKMP. The protocol
is not yet defined to enable opportunistic encryption or the use of
DNSSEC keys.
<p>
</dd><dt>Linux Implementation
</dt><dd>
The Linux implementation of the low-level packets
is in its fourth alpha test release, and is reliably
exchanging encrypted packets with itself.
See below for how to obtain it.
<p>
</dd><dt>Domain Name System Security
</dt><dd>
The first prototype implementation of Domain Name System Security was
funded by
<a href="http://www.ito.darpa.mil">DARPA</a>
as part of their
<a href="http://www.ito.darpa.mil/ResearchAreas/Information_Survivability.html"
>Information Survivability program</a>.
<a href="http://www.tis.com">Trusted Information Systems</a>
wrote a modified version of
<a href="http://www.vix.com/isc/bind.html">BIND</a>,
the widely-used Berkeley implementation of the Domain Name System,
and it is now available for
<a href="ftp://ftp.tis.com/pub/DNSSEC/README">worldwide FTP</a>.
(The State and Commerce departments have OK'd its export -- it only does
authentication, not information-hiding.)
<p>
I am merging the prototype into the standard version of BIND.
The first
production version that supports KEY and SIG records is <b>bind-4.9.5</b>.
This
or any later version of BIND will do for publishing keys. It is available
from the
<a href="ftp://ftp.vix.com/pub/bind/release/">Internet Software Consortium
FTP site</a>. This version of BIND is not export-controlled since it does
not contain any cryptography. Future releases with more
and more DNS Security features, eventually including
cryptographic validation, will also appear there; all versions will be
exportable.
</dd>
</dl>
<p>

<h2> Why? </h2>
Because I can. I have made enough money from several
successful startup companies, that for a while
I don't have to work to support myself.
I spend my energies and money creating the kind of world
that I'd like to live in and that I'd like my (future) kids to live in.
Keeping and improving on the civil rights
we have in the United States, as we move more of our lives into
cyberspace, is a particular goal of mine.

<h2> What You Can Do </h2>

<dl>
<dt>Install the latest BIND at your site.</dt>
<dd>
You won't be able to publish any keys for your domain, until you
have upgraded your copy of BIND. The thing you really need from
it is the new version of <i>named</i>, the Name Daemon, which knows
about the new KEY and SIG record types. So, download it from the
<a href="ftp://ftp.vix.com/pub/bind/release/">Internet Software Consortium
</a>
and install it on your name server
machine (or get your system administrator, or Internet Service Provider,
to install it). Both your primary DNS site and all of your secondary
DNS sites will need the new release before you will be able to publish
your keys. You can tell which sites this is by running the Unix
command "dig MYDOMAIN ns" and seeing which sites are mentioned in your
NS (name server) records.
</dd><p>
<dt>Set up a Linux system and run a 2.x kernel on it</dt>
<dd>
Get a machine running Linux (say the 4.1 release from
<a href="http://www.redhat.com">Red Hat</a>).
Give the machine two Ethernet cards.
</dd><p>
<dt>Install and test the kernel changes manually</dt>
<dd>
If you're an experienced sysadmin or Linux hacker, install these
changes. You can test them in your local environment by manually
configuring an encrypted tunnel with another test site. This set of
changes does NOT provide automated "opportunistic" operation; it must
be manually configured for each site you wish to encrypt with.
This is an alpha-test release to shake out some of the early bugs and to start
getting the Linux and IPSEC communities familiar with the code.
<pre>
Date: Wed, 29 Jan 1997 09:29:36 +0200
From: John Ioannidis <ji@hol.gr>

A few days ago I released version 0.4 of my Linux IPSEC code. It can be found
in ftp://ftp.funet.fi/pub/unix/security/net/ip/.

New in this release is support for all the currently defined transforms; of
particular interest should be AH-HMAC-SHA1 and ESP-3DES-MD5.

Release 0.4 is by no means perfect; it still has to undergo a lot of work
before it can be something a nonexpert user can just install and have work
right out of the box. For that, I need your help. If you find bugs, please
report them; if you can provide a fix, so much the better. The documentation
file that comes with the release lists a whole bunch of areas that need work.
If you can work on any of these, please tell me so.

Please note that in some countries such as the USA, it is unlawful for
a citizen of that country to provide technical assistance "with the
intent to aid a foreign person in the development or manufacture outside
the United States" of "Encryption Items". Also, in countries such as
France, it is unlawful to even use cryptography without notifying the
authorities. Naturally, I don't expect help from people in the USA or
France, but there must be *some* people in the rest of the world who
can offer some!

/ji
</pre>
</dd><p>
<dt>Get on the linux-ipsec mailing list</dt>
<dd>
The discussion forum for people working on the project, and testing
the code and documentation, is: linux-ipsec@clinet.fi.
To join this mailing list, send email to
<a href="mailto:linux-ipsec-REQUEST@clinet.fi">linux-ipsec-REQUEST@clinet.fi</a>
containing a line of text that says "subscribe linux-ipsec".
(You can later get off the mailing list the same way -- just
send "unsubscribe linux-ipsec").
</dd><p>
<dt>Check back at this web page every once in a while</dt>
<dd>
I update this page periodically, and there may be new information
in it that you haven't seen. My intent is to send email to the mailing
list when I update the page in any significant way, so subscribing
to the list is an alternative.
</dd>
</dl>

Would you like to help? I can use people who
are willing to write documentation, install early releases for testing,
write cryptographic code outside the United States, sell pre-packaged
software or systems including this technology, and teach classes
for network administrators who want to install this technology.
To offer to help, send me email at gnu@toad.com. Tell me what country
you live in and what your citizenship is (it matters due to the
export control laws; personally I don't care). Include a copy of your
resume and the URL of your home page. Describe what you'd like to do
for the project, and what you're uniquely qualified for. Mention what
other volunteer projects you've been involved in (and how they worked out).
Helping out will require that you be able to commit to doing particular things,
meet your commitments, and be responsive by email. Volunteer projects
just don't work without those things.
<p>

<h4> Related projects </h4>
<dl>
<dt>IPSEC for NetBSD</dt>
<dd>
This prototype implementation of the IP Security protocols is for another
free operating system.
<a href="ftp://ftp.funet.fi/pub/unix/security/net/ip/BSDipsec.tar.gz">Download
BSDipsec.tar.gz</a>.
</dd>
<dt>IPSEC for <a href="http://www.openbsd.org">OpenBSD</a></dt>
<dd>
This prototype implementation of the IP Security protocols is for yet another
free operating system. It is directly integrated into the OS release, since
the OS is maintained in Canada, which has freedom of speech in software.
</dd>
</dl>

<h4> Misc notes </h4>
I've also collected a small bit of information about
<a href="netcrypt.html">network encryption history and patents</a>.

<hr>
<i>gnu@toad.com</i>, <i>gnu@eff.org</i>,
<a href="http://www.cygnus.com/~gnu/"><i>my home page</i></a><br>
An equal opportunistic encryptor.
Last updated
Thu Mar 20 19:45:24 PST 1997
</body>
</html>
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close