Conference 7.286::fddi

    I have been trying to find any products from any vendors who provide
    encryption over FDDI for over a year now and had no success. 
    
    Debbie
    

    I don't know if it will help your customer to realize some inherent
    security features of fiber optic communications. Especially if he is
    using the Full duplex point to point FDDI for MDF, crypto on the fddi 
    will buy him almost nothing. The fiber doesn't radiate, and is very
    very difficult to tap.
    

    re: .-1
    
   > The fiber doesn't radiate, and is very very difficult to tap.
    
    Actually, it's not that hard to tap (just make a tight bend in it), but
    it is hard to tap without being detected.
    

    This "hard to tap" stuff is fine for marketing, but don't say that to
    the technical customers.  If you tap a line, and leave it tapped forever,
    the user will surely not notice that it has been tapped.  The moment of
    tapping it is easily mistaken for a glitch caused by a power outage or
    something.  I would not say "easy to notice tapping" unless the network
    management interface has a specific indication "...line1.hasBeenTapped" or
    equivalent.  Surely we do not offer that level of intrusion protection.

FDDI is neither hard to tap, nor hard to tap without detection.  Taps that
pick off a small fraction of the power are off-the-shelf items and are included
with FDDI LAN analyzers.

The "fiber is secure because you can't tap it" statement is BULLSHIT.

However... it IS true that fiber has security advantages if your worry is
about radiated signals picked up at some distance from the cable (e.g., your
opponent can get to the other side of the wall, but can't touch the cable 
itself).  There you have a benefit because fiber doesn't radiate while some
kinds of copper cable, UTP in particular, do.  So if you're into TEMPEST
considerations, fiber is interesting.  If you're worried about tapping by
people who have actual physical access to the cable, fiber is no better (nor
worse) than copper.

	paul

    re: .4 & .5
    
    By "detection," I was referring to the ability to measure the drop in
    power at the receiver due to some of the light being tapped off
    midstream. 
    
    I wasn't trying to imply that an SNMP trap existed to detect this power
    drop, or that "commercial-grade" FDDI equipment had this type of
    detection capability built into it.

Is the insertion loss of a -10dB tap high enough to be observable with 
commercial grade power meters?  How does it compare with variations that
occur due to connector insert/remove cycles, cables being shoved around,
etc.?  I wonder...

	paul

    Hand-held power meters typically offer 0.1 dB resolution....

	I think the answer would have to be the same as for Ethernet, if
	you want encryption, the end-points have to do it (encrypt/decrypt).

	If this is via software or hardware, it doesn't matter.  Once the
	data gets beyond the cabinet of the machine (via copper, fiber,
	whatever), it is tappable.  it must be encrypted before it gets
	outside the computer cabinet...

					My $.02
						Megan

Yes, the answer is the same in all cases, but no, the answer is not necessarily
that the endpoints must do it.  It depends on what technology you have
available to you, and what threats you're worried about.

If you're worried about wiretap by insiders, protect the data before it leaves
the box.

If you're worried about wiretap by outsiders, protect the data before it leaves
the building.

If you're worried about traffic analysis, use link level encryption (i.e.,
at the physical layer).  If not, you can do it at a higher layer (datalink,
application, whatever).

If you can't get crypto hardware, you'll have to make do with crypto software.
That's easy at the application layer, harder (though still possible) lower down.

If you want to export it, any kind of crypto is a problem.  But if your customer
is in another country, they can get their own crypto from any number of places,
including Moscow... (!)

	paul