October 1992 - cypherpunks-legacy

One-time pads and DC Nets
by nobody＠soda.berkeley.edu 27 Oct '92

27 Oct '92

Regarding the previous discussion about one-time pads, there is another use for disks full of random numbers. They can be used to implement Chaum's DC-nets. For the degenerate case of just two people communicating, the DC-net is similar to using a one-time pad. However, what you are hiding is not _what_ you are sending, but _who_ is sending it. DC-nets ("DC" stands for "Dining Cryptographers", the example Chaum used to introduce the idea) are designed to hide message sources among some group of people. The people have to be fairly well connected, with near-real-time communications capability. It won't really work for people exchanging email. For the simple two-person case, suppose as in the case of the one-time pad that each person has an identical CD-ROM filled with random bits. What they do is, at some predetermined rate, each person just transmits the bits off his pad. Both people are sending the same bits. When one wants to send a message, he starts toggling certain of his bits. To send a "1" he sends the opposite of the next bit from the one-time pad; to send a zero he sends the correct version of the next bit from the one-time pad. Assuming they don't start transmitting at the same time, what an outside observer will see is that, where before they were both producing exactly the same bits, now they are producing a certain number of opposite bits. Interpreting each opposite bit as a 1, and each case of same bits as a 0, produces a recognizable message. But, the outside observer can't tell which person is sending that message. All he sees is two totally random streams of bits, which disagree at certain spots. Without access to the one-time pads, there is no way for him to tell who is sending. (Of course, the two people involved know who is sending, since one of them is and one of them isn't.) Generalizing to larger numbers of people, you need to have a separate one-time pad shared with each other person in the group. In other words, for a group of N people there has to be a total of N(N-1)/2 one-time pads; each person has N-1 of them. That is, for each pair of people in the group, there is a unique and secret one-time pad which they share. (This is for maximal security - you can get by with fewer pads if you trust each other some.) Now, they all send all the time. What they send is the "XOR" of the next bits of all their N-1 one-time pads. It turns out that if you then "XOR" everybody's output bits, you'll get nothing but zeros as a result. When someone wants to send, he sends the opposite of what he normally would for a "1", and he sends just what he normally would for a "0". Collisions can be handled like ethernet - back off and retransmit. (Chaum had another way involving reserving future blocks of transmit time.) With N people sharing N-1 one-time pads per person, nobody can tell who is transmitting. All anyone knows is whether he himself is transmitting or not; all an outside observer knows is that someone in the group is transmitting. DC-Nets eat up one-time pads even worse than using them for message secrecy does. But, with CD's, you can put a lot of data on a pad. And the system is fairly robust against pads being stolen. If one person's one-time pads are all secretly copied by a spy, then he can tell if that person is sending. But he learns absolutely nothing about which other people are sending. I wonder if it would be possible to experiment with a DC-Net system in the Internet environment. I recently acquired an account on a system with Internet connectivity (I know because I can telnet and ftp from it). I've done considerable programming with Unix socket communication in systems connected by ethernet, and I think the Internet provides a very similar programming interface. It shouldn't be that hard to create a very simple "chat" program in which message sources are strictly anonymous (assuming the existance of the required one-time pad random-number files - for testing, they could be created by random number generators at each end, started with identical seeds). I'll try some experiments along these lines over the next few days. Hal 74076.1041(a)compuserve.com

1 0

Threat to our privacy
by pmetzger＠shearson.com 27 Oct '92

27 Oct '92

For Cypherpunks: A copy of mail I just sent to... libernet(a)dartmouth.edu, extropians(a)gnu.ai.mit.edu, prz(a)sage.cgd.ucar.edu, mike(a)eff.org, mkapor(a)eff.org [This is being sent out to a wide audiance. If you receive this, its because My friends, its rare of me to try to encourage panic. Occassionally, however, by panicing early we can avert a disaster later on. Risks, an internet mailing list, reported about a week ago on a proposal by Dr. Dorothy Denning, one of the most prominent people in the field of cryptography, that copies of all private encryption keys associated with public key cryptographic systems be held, effectively by the government, to permit them to read people's encrypted messages to each other. Naturally, such invasions of privacy will only be permitted "when a warrant is produced". It has been suggested that this idea might be taken up by several government agencies for "review". Many have noted that the dawning of cheap and effective cryptographic systems could spell the end of the ability of governments to invade people's privacy. Unfortunately, it appears that the government and its cronies have also realized this, and intend to take preemptive action. Our notion of civil rights has decayed so far that it is now considered a citizen's duty to not merely be quiet while he is enslaved but to actively cooperate with his own enslavement. Not merely must we put up with the indignity of the government being granted the right to read our papers and communications to each other, not merely has the FBI attempted to get legislation passed to make phone companies give them easier access to tap phone lines under color of "maintaining the current capability in the presense of new technology", but now it is suggested that we ordinary citizens must personally cooperate to make it easier for them to read our communications. We will be branded criminals if we fail to cooperate, presuming that ideas like this are enacted. It is crucial that the fiends proposing this be convinced that resistance will be too high to implement their plan. It is crucial that before they can even propose legislation that the threat here be brought to the attention of the news media. If the currently proposed FBI legislation were passed, a dictatorial government would have all the tools it would need to tap all the phones in the country -- the only thing restraining that behavior would be a system of warrants that could disappear with a mere change in attitude. If Denning's more serious and sinister idea were proposed for future enactment as legislation (this has not yet been proposed), it would become impossible for individuals to take any action to protect their own communications privacy from a dictatorial regime, even ignoring the question of abuses that could occur right now. I'm convinced that the only thing that prevented the FBI bill from passing this year was the fact that media attention was brought to bear. Its important that this new proposal be exposed to similar sunshine. Far be it for me to suggest restraint of free speech, but I would like to see people think of making such suggestions as having the social acceptability of calling a black person "nigger". Here, for reference, is a copy of an article Dr. Denning just posted to sci.crypt on usenet. I encourage people, rather than discussing this matter on libernet or extropians, to discuss this on sci.crypt where the topic is just breaking. Perry Metzger ---------------------------------------------------------------------- Article 6275 of sci.crypt: Path: shearson.com!uunet!uunet!think.com!sdd.hp.com!zaphod.mps.ohio-state.edu!darwin.sura.net!guvax.acc.georgetown.edu!denning From: denning(a)guvax.acc.georgetown.edu Newsgroups: sci.crypt Subject: Re: A Trial Balloon on Registered Keys Message-ID: <1992Oct27.143737.1574(a)guvax.acc.georgetown.edu> Date: 27 Oct 92 14:37:37 -0500 Distribution: world Organization: Georgetown University Lines: 94 The posting about the proposal I made at the NCSC for key registration is essentially correct. Let me add to it the following: 1. The government is not taking any action to curb crypto and is unlikely to take any such action in the near future. No proposal has been made and no government agency that I am aware of has plans to make such a proposal. The closest we've had to a proposal was a "Sense of Congress" resolution in Senate Bill 266 over a year ago. This would not have mandated anything, but said it was the sense of Congress that service providers should provide accesss to the plaintext of encrypted communications under a court order. It got a lot of opposition and was withdrawn. Thus, don't panic folks -- this was just me making a suggestion. I didn't realize I had that much clout to cause such a stir and call to arms! I expect that the next step will be government sponsored discussions about crypto policy, probably sponsored by NIST, at the recommendation of the Computer System Security Advisory Board headed by Willis Ware. That will provide a forum to work through these issues. 2. The reason I made the proposal is because I am concerned that we may be facing a major crisis in law enforcement. I expect many of you will say "that's wonderful" but I don't see it that way. Electronic surveillance has been an essential tool in preventing serious crimes such as terrorist attacks and destabilizing organized crime. The economic benefits alone are estimated to be in the billions. This issue is not about snooping on innocent citizens but about doing what we can do prevent major crimes that could seriously disrupt other liberties. The problem is likely to get even worse if criminals know they use the telecommunications systems without any chance of getting caught. 3. My proposal was to register your private key with a trustee, different from the government. The key would be encrypted under some other public key so the trustee couldn't decrypt it. I have suggested it be the key of the DOJ, but it could be another independent trustee. I believe this would provide acceptably good protection since someone would need to get a court order and then the cooperation of 3 agencies to get at your communications: the telecommunications provider (to get the bit stream), the first trustee (to get the encrypted key), and the second to decrypt it. Experience with the telecom providers has been that they are very fussy about court orders -- you have to get the semicolons right! You can get even more security by using Silvio Micali's "fair public-key cryptosystem" approach. Called "fair" because it is designed to strike a balance between the needs of the Government and those of the citizens. With his approach, you would break your key up into 5 parts and give it to different trustees. All 5 parts are needed to reassemble it, but it is possible to veryify the parts individually and as a whole without putting them together -- ingenious! He presented this at CRYPTO '92. 4. Someone suggested that law enforcement routinely taps without court order. This is an ungrounded claim for which I have never seen any evidence. Regardless, their ability to do this is disappearing with the new digital based technologies. They need the help of the service providers, who in turn ask for court orders. Court orders are not all that easy to get as law enforcers have to document why other approaches have failed etc. 5. Many people have noted that you could not enforce key registration. They may be right, but I am not throwing in the towel yet. Let's take phones, which is what law enforcers are most interested in. Products are emerging that you can attach to your phone and that will do DES encryption. Criminals and everyone else are most likely to use commercial products -- easiest to get and cheapest. The products could be designed so key registration would essentially be part of the sales process. There can be social benefit to government regulation even when regulation is not 100% successful. None of our laws prevent the acts they outlaw. But this does not mean we should get rid of all laws. 6. Some people have said we should not give up our privacy to the government. But the constitution does not give us absolute privacy. We are protected from unreasonable searches and seizures, but not reasonable ones in response to "probable cause" of crime. In all areas of our lives, the government can invade our privacy if they have good reason to believe we are engaged in major criminal activity. They can break into our homes, our safes, and so on. Do we really want a society where electronic communications cannot ever be broken when there is good reason to believe some major threat against society is being planned? Thank you for your comments and for encouraging those on the other news groups to move over to sci.crypt. I'll try to keep up with this newsgroup and respond to other comments if appropriate, but I honestly can't track them all. Dorothy Denning denning(a)cs.georgetown.edu (posting from guvax) ----------------------------------------------------------------------

1 0

Hackers Conference--Crypto Session
by tcmay＠netcom.com 27 Oct '92

27 Oct '92

Glenn Tenney, chairman of the Hackers Conference, has asked me to help put together the crypto session at the Conference next week (6-8 November, Lake Tahoe). I of course agreed....our correspondence is attached below. Sorry if I left off your name in my comments to Glenn ...it seems sometimes that nearly everyone I know has some interest in crypology, privacy, cyberspace, AND is going to Hackers! For those not going to Hackers this year, I'd still like your inputs, and I'll write up some kind of update after it's over, so you'll get some feedback on your ideas. This growing interest in cryptology and the protection of privacy--fanned by the availability of PGP 2.0, the books and articles on hackers and crackdowns by the Feds, the activities of the EFF and CPSR, and by our very own "Cypherpunks" crypto group--should make for an extremely interesting time at Hackers this year. Just about every year at Hackers there's a de facto theme. One year it was hypertext (and Xanadu got started when John Walker of Autodesk met Ted Nelson, Mark Miller, Roger Gregory, and others at Hackers in 1987), another year it was multimedia. Last year it was effectively the EFF, and so on. My hunch is that this year the de facto theme _could_ turn out to be crypto tools and digital protection of privacy. In addition to our session, there will be discussions of wireless communication, the work of the EFF, and a Sunday discussion of these critical issues. These will all fit nicely with our own session. Our session is in "prime time," mid-Saturday afternoon, tentatively (you all know how schedules change!), and is one of the "no competitors" tracks, so attendance should be very high. Accordingly, some premium should be placed on organization, to maximize the information flow. Too many people for the "circle discussion" that worked so well at last year's nanotechnology session (run by Ted Kaehler), so we need to figure out a good format. So give me your inputs! (Also, I think we should get togther informally Friday to bounce ideas around, the better to make the session on Saturday richer and more exciting. I'll let you know in the next several days what we decide, and where we'll meet.) * What topics need to be discussed the most? * What format? Panel discussion? A series of mini-lectures on the various topics? Free-for-all discussion? (Remember that we'll probably be in a big room, with perhaps as many as 100-150 attendees.) * Some ideas for topics (which I'll add to as people make suggestions): - A very brief review of modern cryptology (very brief because we need to move on quickly to the juicy stuff), including snapshot summaries of encryption, RSA (but no number theory!), anonymous mail, digital cash, etc. (Too many crypto panels spend the entire time bringing people up to speed on what prime numbers are, on how one-time pads are used, and so on. I favor giving people a good glimpse of the "exciting" stuff--anonymous mail, digital pseudonyms, information markets, dining cryptographers protocols, etc.--and then letting them go back and fill in the background. Give 'em a glimpse of the Promised Land.) - The uses of digital remailers to protect privacy, and progress on building them (a brief summary) - Possible summary of the "Crypto Anarchy Game" we've been experimenting with here in our Cypherpunks group (Note: we could describe it briefly and then invite folks to play it later that evening, perhaps around midnight) - PGP 2.0...what it is, how to get it, and how to use it - Proposed legislation for trapdoors in telephone equipment, and the possibility that crypto keys may be placed under strict controls (a la my recent post on Dorothy Denning's latest trial balloon) - What we can do about these trends, what we as hackers can do to protect our privacy. Things like: deploying encrypted e-mail as quickly as possible, using digital pseuodonyms, deploying "mixes," arguing for basic constitutional protections, etc. Ideally, people will get so worked up and excited that the rest of the Conference will be buzzing about these issues! Here's Glenn's message to me and my acceptance: > > Considering your keen interest in cryptography, I was > > wondering if you could have your arm twisted to help > > pull together the crypto session for the conference? > > > > It should be fairly easy... Let's see, Eric Hughes will > > be there, as will a couple of guys from BellCore (Sternetta > > and ... ??? ). > > > > If so, plesae let me know and I'll pass on some more names. > > > > Thanks much. > > Glenn Tenney > > Of course I'll help. Anything needed, including what you suggest. > > I'm in regular contact with Eric Hughes, John Gilmore, Fen LaBalme, > Hugh Daniel, Keith Henson, and others. I also know Stu Haber, from > Bellcore...if he could speak briefly about digital timestamping of > documents (and Internet mail applicaitions) that would be timely. > > So I'll so whatever I can. > > BTW, I'll forward my latest posting from sci.crypt about proposals to > require all crypto keys to be registered with the government! That, > alone, is worth of a "hacker politics" discussion at Hackers. > > --Tim (408-688-5409) .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP 2.0 and MailSafe keys by arrangement.

1 0

list status
by Eric Hughes 27 Oct '92

27 Oct '92

As of today, the list stands at 121 members, at least one of which is a mail gateway. Breakdown of the list by top-level domain: U.S. domains: 42 com 42 edu 1 gov 1 mil 10 org 6 us All other domains: 1 at 3 au 1 ca 1 de 2 il 1 nl 2 no 1 nz 1 pt 1 se 4 uk 1 za Eric

2 1

Please remove me from the mailing list / thanks
by clarka＠netcom.com 27 Oct '92

27 Oct '92

clarka(a)netcom.com Andrew Clark My ignorance is my own fault. "We have virtual reality today: George Bush lives in it." | Bad cop! "Macs are to computing what television is to journalism." | No donut! Secondary account at aclark(a)UCSD.EDU -- prefer mail at netcom site.

1 0

Re: Registering Keys with Big Brother
by hkhenson＠cup.portal.com 27 Oct '92

27 Oct '92

Eric mentioned that this topic sounds like a recipe for selective enforcement. If all traffic were captured for possible subsequent analysis, they could get you for a noise burst on a communication line. Couldn't decrypt that even with your key. Keith

1 0

Re: Registering Keys with Big Brother
by hkhenson＠cup.portal.com 27 Oct '92

27 Oct '92

One consequence of this proposal would be the capturing of *all* email traffic for (possible) subsequent decryption under a court order. After all, how could you complain? They couldn't read your messages of the last ten years unless they happened to get a court order. Knowing how easy it is to get a pliant judge to issue an order, this would be really chilling. Keith Henson (on the other hand, the media makers would love it.)

1 0

re: Re: Registering Keys with Big Brother
by Tom.Jennings＠f111.n125.z1.FIDONET.ORG 27 Oct '92

27 Oct '92

U> From: efrem(a)spitha.informix.com (Efrem Lipkin) U> It seems that registration would defeat the advantage U> of a public key system, but it would not prevent private U> encrypted messages from being hidden from casual traffic U> analysis or even notice by public key wrapping. (Hi Efrem!) Yes but. The ole "chilling effect". Everyone talks about ENCRYPTION and SECURITY, what I want is PRIVACY. You can have privacy today, but if you have to sneak around, if privacy is not the background assumption, it gravely limits your ability to live and act freely. Yes, you will always be able to find co-conspirators, but it would be a weak version of the world in which we could presume privacy to begin with. --- ReadMail * Origin: World Power Systems / FidoNews / San Francisco CA (1:125/111) -- Tom Jennings - via FidoNet node 1:125/555 UUCP: ...!uunet!hoptoad!kumr!fidogate!111!Tom.Jennings INTERNET: Tom.Jennings(a)f111.n125.z1.FIDONET.ORG

1 0

re: Registering Keys...
by Tom.Jennings＠f111.n125.z1.FIDONET.ORG 27 Oct '92

27 Oct '92

U> From: 74076.1041(a)CompuServe.COM (Hal) U> This proposal to register keys was also mentioned in the U> July, 1992 Communications of the ACM, in an article by Ron U> Rivest, one of the creators of the RSA algorithm. He was U> solution based on 'escrowed secret keys' might be U> workable, wherein each user is legally required to depost U> his or her secret key with a trusted third party, such as U> the user's bank. Actually this sounds signifigantly different from what Denning is allegedly proposing. This method is analogous to the way FFL (Federal Firearm License) holders record transactions of gun sales (I have an FFL). FFL holders are required to record, in detail, each transaction based upon gun serial number/description, and to/from addresses (buy/sell). The FFL holder maintains the records; the feds dont' get a copy. If a gun is used in a crime, the feds go to the manufacturer, and follow the audit trail of FFL records to follow that guns travels. This is *completely* different than a centralized gun database, where a hypothetical they can compile cross indices based upon oh say name or address or whatever. The third party escrow method puts the same sort of restraint upon searches. I'm not saying I particulary like the method, it's just that it's qualitatively different. The BATF cannot rummage through the audit trail of FFL records, they can only follow the forward/backward pointers per gun. Rivest seems to imply there could be many, independent key-escrow locations. A hypothetical we could form our own key escrow, and while we'd be subject to whatever the hypothetical they would require for access, we could probably do things ilke inform members of all key accesses/inquiries, etc. In short, it bothers me a lot less than Dennings. --- ReadMail * Origin: World Power Systems / FidoNews / San Francisco CA (1:125/111) -- Tom Jennings - via FidoNet node 1:125/555 UUCP: ...!uunet!hoptoad!kumr!fidogate!111!Tom.Jennings INTERNET: Tom.Jennings(a)f111.n125.z1.FIDONET.ORG

1 0

Re: Alpha Particles and One Time Pads
by George A. Gleason 27 Oct '92

27 Oct '92

Re Pete's proposal for an on-net random source which could be accessible to users who would then use a psuedo-random process to select which bits to use in compiling cypher keys: What you'll get will be superencipherment, which is no more secure than the links in the chain. The random stream would be non-secure; and so we're left with the security of the psuedo-random selection process. To analogise somewhat, white noise put through a filter has the characteristics of the filter. Try it with FM static and a graphic equaliser. Now to play devil's advocate here, I wonder if a less-than-perfect physical random source would be acceptable, since the potential domain of decryptions would be large enough that unicity in cryptanalysis would in practice be unattainable. What do you think...?

1 0