Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

dot.gov.in

Post reply on HN
Print view View original

31–40 of 70 posts

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#31

Post by dchest »

tuxcanfly wrote: post #26
dchest wrote: post #18

This document is from 2001. http://toroid.org/ams/etc/dot-india-crypto-nonsense

The linked post doesn't provide any source. According to the internet archive, it's from 2006 http://wayback.archive.org/web/*/http://www.dot.gov.in/isp/g...

Here's an article from 1999 http://www.rediff.com/computer/1999/jul/26gatewa.htm

Last week it announced the 'Guidelines and general information for setting up of international gateways for Internet'.

Another quote:

There is a view in the industry that 40-bit key length is too weak for most commercial applications and can be easily broken.

Surprisingly, Singhal [secretary, Internet Service Providers' Association of India] is not very worked up over this. He clarifies that it is just an initial step. "It is not a hard and fast rule that higher bit encryption is not allowed. If encryption over 40 bits is used then the key will have to be given to the government. The DoT seems to have taken the worldwide standard. As and when they receive complaints that it can be easily broken, they will consider going for stronger encryption.

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#32

Post by shabda »

dchest wrote: post #31
tuxcanfly wrote: post #26

Earlier quoted context omitted.

The linked post doesn't provide any source. According to the internet archive, it's from 2006 http://wayback.archive.org/web/*/http://www.dot.gov.in/isp/g...

Here's an article from 1999 http://www.rediff.com/computer/1999/jul/26gatewa.htm Last week it announced the 'Guidelines and general information for setting up of international gateways for Internet'. Another quote: There is a view in the industry that 40-bit key length is too weak for most commercial applications and can be easily broken. Surprisingly, Singhal [secretary, Internet Service Providers' Association of In…

It is from 2001, It can be verified by using google search with a date range.

https://www.google.com/search?hl=en&q=%22Individuals/Gro...

My apologies for jumping the gun. Its easy to get confused as there was no date on that page.

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#33

Post by neil_s »

I'm not that surprised by this. More developed countries use their scientific prowess to build massive organisations like the NSA to decrypt and monitor communications in the name of national security, the Indian government tries to legislate it instead. This is what they insisted on doing with RIM's encrypted Blackberry services as well. Technology's progressing too fast for the government research agencies to keep up with and eavesdrop on.

(ref: http://news.ycombinator.com/item?id=4018084)

I'm not too concerned because of the standard 'I've got nothing to hide' line, but there's always the chance of corrupt officials and poor data security in their wiretapping centers. Anyways, it doesn't seem like this rule is enforced since the document has been there for a while and SSH traffic works just fine.

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#34

Post by chris_wot »

chris_wot wrote: post #28
chris_wot wrote: post #12

I love the broken images at the bottom of the page. This proposal is just one way of destroying their call centres and any Internet based transaction system they may want to develop with the outside world. You might also want to note the following: 14. The ISP should block Internet sites and individual subscribers, as identified by Telecom Authority. 15. The Government(Licensor) reserves the right to make changes in…

Actually... is this current policy? I just checked the wayback machine, and this has been there since at least 2006. See http://web.archive.org/web/20060222081026/http://www.dot.gov... Is this really still in effect?

OK, this is getting weird. Check out the front page:

http://www.dot.gov.in/

This is their "Department of Telecommunication"! But the site could have been slapped together by a 12 year old. It looks like an abandoned server - full of flashing "New!" images...

And down the bottom it says:

  This site can be best viewed at 800x600 resolution in IE 4.0/ Netscape 3.1 or above
  Copyright � 2002, Department of Telecommunications, India
Google has also blocked their custom search... looks like they are using Google without paying them so Google have cut off their access!

However, while this looks to be abandoned, the front page says that the last time it was updated was on 22nd May, 2012. Something seems very wrong with the Indian Government's IT department!

Edit: it's getting worse. Check out the contacts list:

http://www.dot.gov.in/rti/teldir.htm

They have government officials using hotmail acounts! But this isn't that old - they have Gmail accounts for officials. If that's not bad enough, the Legal Advisor for the Deputy Director General is using a Yahoo account and the actual Deputy Director General is doing the same!!!

Something is very, very wrong with the Indian Government's IT security.

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#35

Post by sa1 »

shabda wrote: post #32
dchest wrote: post #31

Earlier quoted context omitted.

Here's an article from 1999 http://www.rediff.com/computer/1999/jul/26gatewa.htm Last week it announced the 'Guidelines and general information for setting up of international gateways for Internet'. Another quote: There is a view in the industry that 40-bit key length is too weak for most commercial applications and can be easily broken. Surprisingly, Singhal [secretary, Internet Service Providers' Association of In…

It is from 2001, It can be verified by using google search with a date range. https://www.google.com/search?hl=en&q=%22Individuals/Gro... My apologies for jumping the gun. Its easy to get confused as there was no date on that page.

Is the policy still applicable if it doesn't seem to be updated?

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#37

Post by Symmetry »

You're all thinking about this as if it were a law the First World, where this would be enforced impartially. Its just a revenue generation method for whatever bureaucracy gets to pretend to enforce it, aka another excuse to demand bribes. Same principle as countries with official tax rates over 100%.

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#38

Post by tuxcanfly »

shabda wrote: post #32
dchest wrote: post #31

Earlier quoted context omitted.

Here's an article from 1999 http://www.rediff.com/computer/1999/jul/26gatewa.htm Last week it announced the 'Guidelines and general information for setting up of international gateways for Internet'. Another quote: There is a view in the industry that 40-bit key length is too weak for most commercial applications and can be easily broken. Surprisingly, Singhal [secretary, Internet Service Providers' Association of In…

It is from 2001, It can be verified by using google search with a date range. https://www.google.com/search?hl=en&q=%22Individuals/Gro... My apologies for jumping the gun. Its easy to get confused as there was no date on that page.

I think google doesn't have info about page dates prior to 2001. I think the actual date must be 1999 as linked by the parent post.

http://www.google.co.in/search?q=www.google.com&hl=en&#3...

PS: I'm the one who should apologize.

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#39

Post by gautamc »

sgt wrote: post #20

Surprisingly many of the indian IT workers (outsourced) I am in touch with support the increasing limitations of freedom in India. I am not sure why, maybe they are just brainwashed or simply not used to having as many rights as people in the western world are accustomed to. In any case, terrorism is a real threat in India and I suspect they are all a bit touchy.

I am from India and I am pretty concerned about terrorism, but I am assuming that the people/businesses who will end up following such rules would most probably be the people who aren't planning any thing nefarious.

Meanwhile, the real bad guys are going to find a way around it - and will the govt of India pay me damages if my private key ended up on piratebay because someone stole it from their servers? Nope, don't think so.

Most Indian's have been brainwashed into accepting flaws/weaknesses in (big)governance, kind of like - "its a feature, not a bug"

Re: Govt of India proposes to ban SSH (Or wants you to use 40 bit keys)

#40

Post by boundlessdreamz »

tuxcanfly wrote: post #38
shabda wrote: post #32

Earlier quoted context omitted.

It is from 2001, It can be verified by using google search with a date range. https://www.google.com/search?hl=en&q=%22Individuals/Gro... My apologies for jumping the gun. Its easy to get confused as there was no date on that page.

I think google doesn't have info about page dates prior to 2001. I think the actual date must be 1999 as linked by the parent post. http://www.google.co.in/search?q=www.google.com&hl=en&#3... PS: I'm the one who should apologize.

Yeah. Here is the archive history for linked guidelines in the rediff article - http://wayback.archive.org/web/20060815000000*/http://www.do... Dates back to 2000 at least. So must be from 1999
Post reply on HN