Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've been watching more and more people jump on the idea of Telex as a way to prevent internet censorship (e.g. http://www.technologyreview.com/communications/38207/ -- not my comments at the bottom of the article).

Halderman says the design is such that it doesn't matter if the location of ISPs employing Telex stations are known to the censors. "The key thing is that we want to put the stations at enough points in the Internet so that blocking all the routes that go through those would be tantamount to making the Internet unavailable," he says.

I've gone over the basic design and it's a pretty neat idea, I'll admit. But I'm a little confused...

What happens if an ISP that already has Telex keys (for instance if a government takes control of the ISP) goes rogue? It seems that they haven't solved for determining who a trusted ISP would be?

share|improve this question
add comment

2 Answers

up vote 6 down vote accepted

The Telex scheme seems impractical. It seems to be designed for a scenario like this:

There is an area AreaA with a represive governing authority. In AreaA a individuals ability to speak, write, travel, and meet or associate are restricted. AreaA has internet access but the access is monitored and controled by the governing authority.

There is an area AreaB with general liberal democratic freedoms: freedom of speech, publication, travel, and association. AreaB has internet access and the access is not (or very loosly) monitored and controlled by a governing authority.

The governing authority in AreaA allows limited access from AreaA to AreaB, and from AreaB to AreaA. They monitor communications in both directions.

The governing authority in AreaB allows unrestricted or lightly restricted acess from AreaA to AreaB, and from AreaB to AreaA. They rarely monitor communications in either direction.

The scheme depends on creating significant number of Telex stations. The Telex stations must be in AreaB and allowed by the governing authority of AreaA. The governing authority of AreaA must not be able to identify identity the Telex stations or they will remove access to those stations. However, the Telex stations must be able to handle a moderate amount of traffic, and most be powerful enough to handle the cryptographic and processing requirements without a detectable difference in traffic patterns. If the governing authority of AreaA blocks access to enough Telex stations the availability of the system degrades and traffic flow decreases.

Providing clandestine information channels is a difficult problem. See Embedding Covert Channels into TCP/IP.

The distribution problem:

The software needed to create Telex messages must be distributed to users in AreaA. Given that the governing authority (GA) of AreaA is monitoring and potentially blocking messages from AreaB to AreaA. It is difficult to get software to the AreaA users. I think it is a logical addendium that the GA of AreaA is additionally monitoring and blocking postal mail and package delivery. Likewise, we can assume that GA of AreaA is monitoring and blocking PSTN as well as GSM/CDMA. The effectiveness of each channel will determine how to distribute the software.

Key distribution can be combined with the software distribution problem. The Telex messaging software can be distributed with a Telex station public key. The software could generate a public-private key pair for each user and send the user's public key to the Telex station in a covert message.

The bandwidth problem:

The larger the bandwidth the system provides, the easier it is for the governing authority in AreaA to detect Telex stations. The smaller the bandwidth the system provides, the less useful the system is to people in AreaA.

The innovation problem:

The Telex messaging relies on standard protocols to covertly deliver messages from AreaA to AreaB. If non-standard protocols were used then detection would be easy. What happens when the protocols change or improve? Will Telex messaging be forward compatible, backwards compatible? Will the carrier protocol need to change? The Telex messaging software will need to be revised and updated. Every update or revision puts the users in AreaA at risk of discovery when the attempt to acquire a new revision or update. However, failure to modify the software for too long a period will also put the users in AreaA at risk of detection as the GA in AreaA refines their detection methods.

The station identity problem:

If the Telex stations remain static, then after some period of time the governing authority (GA) of AreaA will be able to detect the stations. If the Telex stations change then the system needs to inform the users in AreaA of the change. Even if the users in AreaA don't know the real station identities, they will need to know approved sites in AreaB that will allows their messages to be routed through the Telex station. The more frequently the stations chanage the fewer users in AreaA will know the identity of the Telex stations at any given time. There is also the problem of the number of AreaA users. The more people know the Telex station identities, the more likly GA of AreaA will discover the indetities.

If hierarchical scheme is used to distribute the station identities (most users know one station id, some know two or three, and a few know eight or more), then GA for AreaA will attempt to find the users in AreaA who know the most stations. It may take longer to find users who know many stations but discovery will severly impact the system by cutting off many stations at the same time. If a flat scheme is used (stations identities are distributed uniformly) then stations will be discovered and blocked at a more steady rate.

share|improve this answer
1  
Wow. Nice answer. :) –  Steve Aug 4 '11 at 0:51
add comment

When it popped up on Schneier's blog, there was an immediate back-and-forth in the comments about that question. In essence: Yes, if a censor can get their station on the list of Telex nodes, that censor can intercept and decrypt traffic that goes to it. This would involve either subverting or replacing the telex client that gets distributed to the censored populace.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.