Attn: real cryptographers - how safe would you be?

Hi,

This is a serious question involving a real life scenario, and I'm hoping
some of you real cryptographers can provide some insights.

Imagine you lived in Zimbabwe or some other terrible place. Assume you want
to provide the outside world with information about what's going on in your
country, but you know that the regime in power has obtained some software to
monitor outgoing email and, possibly, browser transactions involing filling
in forms.

Your health and life and that of your family and friends is at stake.

Here are some questions you might ask yourself. What answers would you
give?

- Does anyone (e.g. the CIA, NSA, Chinese) have the ability to crack well
known encryption such as RC4, AES 128, AES 256?
- Is a brute force attack nowadays viable on any 128 or 256 key?
- If "yes" to either of these questions, would any of these organizations
provide the Zimbabwe regime with the technology? (A political, question, I
know - feel free to treat as rhetorical.)
- Would the fact that the regime has seen an encrypted email from you simply
mean that they arrest you and perform some "rubber hose cryptography"? In
which case, encryption is of no help and is probably a really bad idea.
- You know you can visit any number of websites that have HTTPS (SSL)
connections, would you assume that an AES 256 connection (using FireFox, for
example) would be pretty much unbreakable and not worth monitoring (given
there are hundreds of thousands per day)? Therefore, such a website which
allowed you to send a message via your browser would be reasonably safe
(assuming you can trust the website owner).
- If you couldn't use any of the above methods, what would you do to safely
get information out? Would you setup a one-time pad procedure on paper or,
maybe, fax with an outside party? I guess this depends on how much
information you need to send and whether you could disguish the transmission
in an innocuous method.
- What about sending CDs or floppies that have a hidden volume feature such
as TrueCrypt's? Plausible deniability may be the safest means.

regards,
RR



.