Is Fax Dead Yet?

IIRC I did use the included rand function in the old Turbo Pascal. The function was convenient. To make it more advanced I suppose an electronic 'noise' peripheral could create a source of random numbers based on some naturally occurring noise from say a zener or a noisy transistor.

D from BC British Columbia Canada

end."

Neato... I never knew the name of that crypto method.

D from BC British Columbia Canada

Unfortunately, it was probably not random. Most of these software- based "random number generators" are pseudo-random... if you know their internal state (e.g. the "seed" value from which they are starting) they are actually 100% predictable.

To make matters worse, some of these generators lack the ability to accept a seed value (e.g. a truly random value, or at least a hash of the date and time) as input. These generators will produce the *same* series of pseudo-random numbers each time the program is run. Net security - zero if your opponent knows what generator you are using, and close to zero if your opponent manages to intercept any two encrypted messages.

Even those generators which accept a seed value, often accept only a relatively small seed (16, 24, or 32 bits). This means that the encryption scheme is distinctly vulnerable to brute-force decryption attempts, since only (e.g.) 2^32 different keystreams will exist.

To make matters even more complicated, some "pseudo-random" generators use techniques (e.g. a simple linear-feedback shift register) which create regularities in the keystream, no matter what seed value you start with. An opponent may be able to break such an encryption scheme even without knowing the seed.

There have been some commercial encryption products which boasted an "unbreakable one-time pad" approach, but which actually generated the "pad" independently at each end based on a fairly small key/seed value. This is *not* a true one-time pad, and claiming that it has OTP-level security is little short of fraudulent.

That is a *much* better approach.

Another approach is to use a pseudo-random generator with a large amount of internal state, which has very little regularity or predicability in its output, and which is "seeded" by a reasonable amount of truly random (or at least unpredictable) input data. The Linux kernel comes with a random-number generator (/dev/random and /dev/urandom) which uses SHA-1 hashing to generate unpredictable numbers, and is fed with randomness ("entropy") based on unpredictable values such as the exact number of nanoseconds required for the system's disk drive to execute read and write commands.

=A0 =A0...Jim Thompson

That can be done via email.

Email and the modern scanner has made the FAX a dinosaur.

Of course it "can be done", but are you willing to risk losing an order by forcing the CUSTOMER to do something they would prefer not to? I'd rather let some more "progressive" company fight those battles where my valuable customers are concerned. Best regards, Spehro Pefhany

Nope. I'll probably keep that extra line until I'm dead ;-)

...Jim Thompson

On Sun, 20 Apr 2008 10:33:03 -0700, D from BC wrote: ...

Not here. In fact, I just finished a project for a client who doesn't even have email yet, so we just faxed stuff back and forth. And, of course, talked on the landline.

Cheers! Rich

You must not spend much time in the business world. I recently had to manage a major project for a world wide banking conglomerate that everyone knows by name, and everything "important" was done using FAX. Absolutely nothing sensitive could be transmitted via email, encrypted or otherwise.

I also recently went through a credit card dispute after being swindled on a Christmas present purchase (bastards!). Every scrap of paper and every statement I made had to be faxed. They wouldn't even give me an email address, or even surf to the web site I built that had everything nicely organized, documented, and explained in detail. A web site hosted tight in my own living room no less.

I also do quite a bit of work for a largish law firm dealing primarily with international property and copyright law. They've gone largely paperless internally, but I'd estimate over 90% of their external (non-hardcopy) correspondence is still FAX. They actually decrypt archived documents before transmission and use a networked Xerox "all in one" to FAX documents when it would actually be *easier* to email them if their clients would only put in place a free server and exchange keys properly. The whole thing could be done transparently, and documents would be delivered directly to the "addressee" rather than routed through whoever happens to "check the FAX machine" that hour. ;-)

FAX dead? Not from where I sit it isn't. I can only guess at why it's so, but if I had to my best would be that crypto is a "black box" and FAX feels more "natural". FAX is (allegedly) a direct transmission too, while everyone seems to have at least some small, if sometimes alarmist, grasp of how "evil" email can be because it's routed through every Tom, Dick, and Jane server on the planet. FAX transmissions are simply trusted more than email and crypto, and oddly enough, for some valid reasons.

With a FAX transmission you get a receipt with a CSID that "proves" it was actually sent and received by the correct recipient.

And it's still faster to get some things across with a fax than by any other remote method. Most substantial businesses will have a fax and a photocopier for some time to come.

Best regards, Spehro Pefhany

You're confusing public key asymmetrical encryption and private key symmetrical encryption. 128bits is plenty for private key encryption. 1024 is the minimum for public key. The two are used for entirely different purposes.

Absolute nonsense.

Somewhat true (only true for brute =-force attacks on some encryption algorithms), but you have to compare apples with apples. You haven't.

s/most/all/

Computers are by design, deterministic.

There are even fewer full-length such generators.

Not short at all.

The problem is proving even the randomness of noise. It's easy to have correlations to non-random events creep into "random" noise sources.

Even these sources of "randomness" are very hard to prove, in a cryptographic sense. Asynchronous oscillators have the same issues (they like to lock to each other).

made the FAX

I'm not saying it's completely dead, YET.

But it will be, once people realise it's not any more secure than email. Also, it's super easy and free to make your own PDF files now.

I've had to use a FAX maybe once in 3 years or so.

But this is all coming from someone who still watches tapes on a VCR, and still buys used tapes.

But the industry has apparently stopped making new VCR tapes, so it's only a matter of time.

I'm sure there are still people who have 8-track tapes too....

end."

Communicating the pad? Glue under postage stamp, don a dark trenchcoat, hat, dark sunglasses, brisk walk to mailbox, look over shoulder, look over shoulder some more, drop the letter in, push Smith&Wesson back into holster, saunter down the road and whistle a tune. At least that's how it was done in the old movies.

One of the advantages of FAX is that the courts have sorted out what's good enough.

Have they done that with email and/or signed/encrypted PDFs?

No email! :O It's kinda goofy not to have email. Then again, it's probably that same goofyness that made them hire an electronics designer. :)

Let me guess the project... Solar powered gopher zapper for farms?? :)

D from BC British Columbia Canada

Years ago I did make pseudo random number generator circuits using CMOS registers and gates. I'm guessing the algorithm was probably not too differant than what was used by rand function in the old Turbo Pascal language. Yup, if one knows the seed and scheme, then it's predictable. It's a mechanism like a pile of gears and not true chaos.

I'd like to think a bunch of electrons swarming around like bees or electrons bashing into things is better chaos for rnd generation for crypto..

D from BC British Columbia Canada

has made the FAX

I'm saying it's not even feeling aged yet. First hand experience tells me it's here to stay for any foreseeable future. Some of hte reasons may be more valid than others, but the reasons are what they are. :)

You're wrong about the security. On a level playing field FAX is somewhat more secure than email because a FAX isn't sent through a mutable chain of hops in clear text form, where any casual observer can sniff and fondle it. Telephone calls do route through switches, but they far harder to compromise than data routers or mail servers.

As I said you must not spend a lot of time out in the business world. I FAX quite a bit actually. Several times a week at least.=20

VHS and 8-track aren't valid analogies. For one they're mostly luxury items and a luxury industry. For another, there's a issue of fidelity that simply does not exist within the realm of FAX versus scanned/mail.

Apparently, no---I understand there is a brisk business making encrypted faxes for the US military. Apparently every tank has one; orders have to be given in writing, signed by the commander and faxed back.

That's a good point, even though CSID is about as easy to spoof as a From: header. ;)

Agreed. Although I'm not so sure about the "speed" issue given the fact that throughput is drastically faster for email, and you could if you wanted trivially configure things so a hard copy is produced as the email is received. IOW, email can be used as a super-fast FAX and still benefit from strong encryption with a centralized key escrow.