April 1993 - cypherpunks-legacy

Re: DC Cypherpunks
by Bob Stratton 21 Apr '93

21 Apr '93

> Subject: DC Cypherpunks > From: fergp(a)sytex.com (Paul Ferguson) > Date: Wed, 21 Apr 93 12:16:22 EDT > > -----BEGIN PGP SIGNED MESSAGE----- > > On Wed, 21 Apr 93 09:15:25 EST, > Pat Farrell <uunet!cs.gmu.edu!pfarrell> writes - > > PF> Craig, there is no problem having a meeting, you just have to have > PF> more sense than the kids who think Pentagon City Mall is public > PF> space. A small meeting can be in my house, or at Maggie's bar over > PF> beer and pizza. > > You've got my vote for beer and pizza. ;-) > > Pat, let's plan accordingly. I'd like to be there for the first > meeting, so I'll give you a call and we can discuss this at length. In > the meantime, I'm keeping a list and building a kering of > interested parties. Hear, hear. I think I can also swing permission to have it at my office in Herndon, if having a T1 to the Net is at all helpful. I'll ask, if anyone's interested. --Strat, whose company actually took a position on the Clipper chip! (It's the right one, BTW) Help stop the wiretap chip! (a.k.a "Clipper") RIPEM and PGP keys available on request.

1 0

DC Cypherpunks
by fergp＠sytex.com 21 Apr '93

21 Apr '93

On Wed, 21 Apr 93 2:07:49 EDT, Craig Nottingham <uunet!cosmos.gmu.edu!cnotting> wrote - CN> There is plenty of DC area support fr such a group. The only CN> problem that presents it self is where to hold a meeting where CN> here will be no hassles. I'm putting together of interested parties who would like to get together for physical meetings on a "psuedo-random" basis. As Pat mentioned earlier, my free time is non-existant at least until mid-May (getting re-married May 1), but I'm eager to meet, unite and build a DC chapter. Solidarity and determination, my brothers and sisters! Also, send your pubkey. Little things mean alot. Paul Ferguson | Uncle Sam wants to read Network Integration Consultant | your e-mail... Centreville, Virginia USA | Just say "NO" to the Clipper fergp(a)sytex.com | Chip...

1 0

DC Cypherpunks
by fergp＠sytex.com 21 Apr '93

21 Apr '93

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 21 Apr 93 09:15:25 EST, Pat Farrell <uunet!cs.gmu.edu!pfarrell> writes - PF> Craig, there is no problem having a meeting, you just have to have PF> more sense than the kids who think Pentagon City Mall is public PF> space. A small meeting can be in my house, or at Maggie's bar over PF> beer and pizza. You've got my vote for beer and pizza. ;-) Pat, let's plan accordingly. I'd like to be there for the first meeting, so I'll give you a call and we can discuss this at length. In the meantime, I'm keeping a list and building a kering of interested parties. Cheers. -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK9VurZRLcZSdHMBNAQG6GQP/aWlhwgaBwLU2QFUsjdoauIuPYrVRiu5f 87z4s8YhRj/dNX/alIO6LTGIT0Q4V5UW7w9gu2EChok618KJly3zgqg1slDBhg0x F6ZIJjbdiPmkeNGjlswfm/x/yGF2NWLu+F2YsMfbXEjnmdOaZaooiOQFA1tiMN2x AysEJYTBnJs= =q/Pf -----END PGP SIGNATURE----- Paul Ferguson | Uncle Sam wants to read Network Integration Consultant | your e-mail... Centreville, Virginia USA | Just say "NO" to the Clipper fergp(a)sytex.com | Chip...

1 0

Making Clippers More Secure
by Communism is like MS-DOS: It doesn't work, and you wouldn't want to use it even if it did. 21-Apr-1993 1120 21 Apr '93

21 Apr '93

Agreeing with all the previous problems and issues put forth; key-escrow, secret algorithms that can't be formally tested, etc... So, let's *assume* that the US Gummint makes all other encryption illegal, except those that use this chip, and they intend to check all messages that look encrypted to verify that they have the correct system key: Well, we can use more than one chip, or use it in ways that were "unanticipated". F'rinstance: Use PGP (or SROT, or some other p.d. crypto package) to encrypt once, and then use a Clipper to put a legal-looking wrapper on the message. The problem with this is that *if* there is a law making all other cryptosystems illegal, then you still do time. Then the gummint says "You can use chips, but ONLY chips. No other encryptation.". Well, how 'bout this: Use three chips. The first two are BOTH fed the message, and the resulting bitstreams are XORed together and then fed to the third chip (to provide a legal-looking "wrapper") The XORing should obscure the serial numbers of the first two chips, meaning that the NSA can not go to a key-escrow authority with a blanket court order and obtain the keys. Rather, assuming the "secret algorithm" is good, the worst-case scenario is either a full search of the keyspace (if the secret algorithm forms a mathematical "group", or an exhaustive search of [issued-keyspace]^2. Yes, the above does not address the issue of decoding (as stated above, you can't recover the plaintext.) But that's soluble, by inserting a known (but secret) string into the start of the bitstream for both the encoding and decoding second chips; the result is that by the time the second decoding chip needs to start knowing what was XORed into the incoming stream, the first decoding chip has already decoded that part of the message, which can be re-encoded using the first encoding chip's keys to provide the continuing bitstream needed for the XOR. Now, the BIG issue is this: is it possible to obtain the serial numbers of a pair of Clipper chips from the XOR of two output streams? How about three? How about N, where N is large? Without knowing the algorithm, this will be difficult to answer... -Bill % ====== Internet headers and postmarks (see DECWRL::GATEWAY.DOC) ====== % Received: by enet-gw.pa.dec.com; id AA02474; Wed, 21 Apr 93 05:13:14 -0700 % Received: from mc by mc.lcs.mit.edu id ak02907; 20 Apr 93 11:15 EDT % Received: from enet-gw.pa.dec.com by mc.lcs.mit.edu id aa02377; 20 Apr 93 10:20 ED % Received: by enet-gw.pa.dec.com; id AA27388; Tue, 20 Apr 93 07:19:42 -0700 % Message-Id: <9304201419.AA27388(a)enet-gw.pa.dec.com> % Received: from aidev.enet; by decwrl.enet; Tue, 20 Apr 93 07:19:43 PDT % Date: Tue, 20 Apr 93 07:19:43 PDT % From: "Dulce et decorum est pro patria mori. 20-Apr-1993 0950" <aidev::yerazunis> % To: elbows(a)mc.lcs.mit.edu % Cc: aidev::yerazunis % Apparently-To: elbows(a)mc.lcs.mit.edu % Subject: Clipper Chip

1 0

alt.encrypted
by grady＠netcom.com 21 Apr '93

21 Apr '93

I guess the cryptowranglers read this group too. But of course I knew that because it is so easy to do. There is not a single doubt in my mind that every byte that passes every significant gateway or 'bone is captured for the colligation of data about __________? (Maybe your name is here). Maybe we should start a newsgroup for the distribution of encrypted posts intended of members of affinity groups with a shared private key. For example at the coming up Cypherpunks meeting, a private key corresponding to that particular meeting could be passed out by a moderator. Minutes, followup comments to other participants, and so on could be posted to the alt.encrypted group for the use of the people who attended. Communiques intended by the group for non-attendees could of course just be signed using the private key but otherwises not encrypted. Starting a alt.encrypted newsgroup rather than just maintaining mailing lists is better for several reasons. First, it would be easier to archive for people who might join a group "late" and who might like to easily read earlier posts; second, traffic analysis to know exactly to whom an affinity message is directed would be foiled; three, a newsgroup is much more public and would serve to publicize available privacy measures on the internet. And it would be fun to accumulate a secret keyring full of such keys -- it beats giving out t-shirts as a door prize. We could send a copy of alt.encrypted directly to Judge William Sessions or Admiral Studeman to save them the time of having it collected for them. -- grady(a)netcom.com 2EF221 / 15 E2 AD D3 D1 C6 F3 FC 58 AC F7 3D 4F 01 1E 2F

1 0

RE: Webs of Trust vs Trees of Trust
by Pat Farrell 21 Apr '93

21 Apr '93

In norm(a)netcom.com (Norman Hardy) writes: >This is much ingrained in all of the legally mandated security >systems that I am aware of. It assumes, at first glance, that there >is a root, an inner sanctum, which is totally trusted by all. > >It is a pervasive mind-set in military security. While I can't claim to understand the military mind set, I can believe that it is pervasive. It is also at best simplistic. Under the "new world order" we must forge aliances according the the needs of the situation, so that the trusted aliance's members vary over time. Economic aliances have similar dynamics, with trust and allegiance changing. The government's view seems to be that trust is transitive. I believe that it can't be, because the world is not a simplistic heirarchy that starts with Billery and flows down. The tree of trust also ignores international exchanges, as Billery's signature means far less to an European than to a US citizen. There was a recent article about a ring of college students in Texas selling forged driver's licenses. They used Montana and Idaho as samples, with the expectation that a bouncer in a Texas bar wouldn't know a real Idaho license if he saw one. Seems like the value of a US-based signature would be lowered in Sydney or Delhi in a similar manner. More importantly, I expect that digital signatures will be used for commercial transactions accross the net. This means that there is money involved, and with a tree of trust, the higher level trees are _worth_ bribing, forging, and perhaps killing for. Once a high level node is compromised, all lower nodes are worthless. This is why we need a serious education effort for the "decision makers" in the government. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

No Subject
by ah＠uknet.ac.uk 21 Apr '93

21 Apr '93

To: cypherpunks(a)toad.com Subject: Re: The Family Key Newsgroups: ml.cypherpunks In-Reply-To: <199304211229.AA28337(a)sun.Panix.Com> Organization: Dunathad Cc: In article <199304211229Y.AA28337(a)sun.Panix.Com> wrote: >I think the largest weakness in the whole Clipper scheme, and >I am not sure If I am right about this is,.... >... >Thus, the NSA will be able to maintain an active traffic pattern >analysis of ALL communications sent via the Clipper chiped devices. > >I think in many ways that traffic watching can and does often reveal >more information about someone than at time listening in to what >is actually being said. > I can't help feeling that they'll be looking for a little more, an edge; not enough that their promises to the executive are broken, but enough to get an edge if they need to decrypt without the key. No offense against the NSA of course, but that's how I'd expect the British to work "in the National Interest". Rgds Alan --- Alan Hunter Johnson Hunter Ltd Isle of Islay, Scotland A.Hunter(a)dunaad.co.uk fax: +44-496-2336 voice: +44-496-2286

1 0

The Family Key
by Harry Shapiro 21 Apr '93

21 Apr '93

I think the largest weakness in the whole Clipper scheme, and I am not sure If I am right about this is,.... The NSA knows the family key (the key that is built into each chip; or perhaps large meta batch of chips). The family key encrypts the Law Enforcement Block [LEB] of the message, which contains the serial number for the chip in the device being used to communicate. This key is known to NSA. Thus, the NSA will be able to maintain an active traffic pattern analysis of ALL communications sent via the Clipper chiped devices. I think in many ways that traffic watching can and does often reveal more information about someone than at time listening in to what is actually being said. The big point here is the the press release claims that the Clipper chip doesn't provide anything more than what Law Enforcement already has. That is not true. What they get is a complete serialized, accurate method of traffic analysis. Note: Denning claims that a proper order to wire tap an encrypted communication will be "gotten" prior to decoding the LEB. Then a second batch of paper work will be processed once the serial number is revealed to get the encrypted/escrowed keys. -- Harry Shapiro habs(a)panix.com List Administrator of the Extropy Institute Mailing List Private Communication for the Extropian Community since 1991

1 0

Lets connect the meetings together
by crunch＠netcom.com 21 Apr '93

21 Apr '93

I propose that the E. Coaster Cypherpunks connect via computer to the one on the West Coast on the 24th. Perhaps on a private IRC channel, but doing it via encryption would be the best.

1 0

Meets 'n Greets
by fergp＠sytex.com 21 Apr '93

21 Apr '93

On Tue, 20 Apr 93 10:54:00 -0700, Eric Hughes <uunet!soda.berkeley.edu!hughes> wrote - EH> ANNOUNCEMENT EH> ============ EH> Ad Hoc Cypherpunks Meeting on the recent Wiretap Chip proposal. EH> Where: Cygnus Support, Mt. View (directions follow) EH> When: 12:00 noon sharp - 6:00 p.m. EH> I'm mad as hell. I know that a lot of other folks are too. You're right, Eric -- we are mad as hell, too. But I'm not about to jump on a flight to the west coast to simply share strategies. The fact that I would even consider it negates the functions which we are working towards, no? I propose that us east coasters organize and meet as well. Pat and I are DC bourne, for those interested, I'd like to propose a DC local meeting. Suggestions? Keep in mind that I'm in NYC during the week, so my only available meeting times aare on the weekends. (By the way, lets get our shit together DC'ers. We need technologists, not lacidaisical idealisms.) Your DC based Cypherpunk group is hereby established. BTW, if anyone noticed, the EFF is drawing some serious fire by the public press. "Sold out to commercialism", one headline reads. Cheers. Paul Ferguson | Uncle Sam wants to read Network Integration Consultant | your e-mail... Alexandria, Virginia USA | Just say "NO" to the Clipper fergp(a)sytex.com | Chip...

4 3