April 1993 - cypherpunks-legacy

FAQ: Overview of crypto
by szabo＠techbook.com 21 Apr '93

21 Apr '93

The wiretap chip has generated quite a bit of new interest in learning how to protect our electronic privacy. We need to bring folks up to speed quickly on practical use of crypto, so I'm going to write up some mini-FAQs. Experts, please send me succinct descriptions of PGP, anonymous remailers, the Clipper wiretap chip, GMS, or anything else you feel is an important basic. Alternatively, write up and post your own FAQ, and we'll sort it out later. Here is an overview of computer-based crypto that Bill Stewart posted a few weeks ago. Nick Szabo szabo(a)echbook.com ----------------------------------------------------------------- You can get a proper faq by ftp from rsa.com, in the directory pub/faq. Cryptography = writing stuff only authorized people can read. Real crypto depends on algorithms that are secure as long as the Bad Guys don't know the keys, even if they know everything else. Most of the interesting stuff depends on mathematical processes that take exponential amounts of time, so a 56-bit key would take 2**56 attempts to guess - you can't guess it a bit at a time in 56 steps. Factoring large numbers is believed to take roughly expontential time. M = plaintext message Cyphertext C = E(k, M), E = encryption function, k = key. Plaintext M = D(k, C) ITAR - International Traffic In Armaments Regulations - the US has a bunch of laws about exporting munitions, and crypto hardware and software count as munitions - algorithms are OK, but our Benevolent Govt KNOWS that foreigners aren't bright enough to turn algorithms into code. Lots of flamewars discuss exactly the boundaries, and the laws are contradictory about which bureaucrats are really in control, but nobody's wanted to get thrown in jail for arms dealing badly enough to force a court case .... Appears to apply to importing crypto also, though that hasn't been something anybody's made a big deal about. Other countries besides the US may have major restrictions as well. Alice and Bob - the people sending messages to each other. Eve may be eavesdropping, and Charlie may be around also, Secret-Key Cryptosystem, also called Symmetric-key or private-key - the same key k is used for E and D, or at least a closely related key that's easy to derive if you know the other one. DES = Data Encryption Standard = IBM/NSA-designed secret-key system, very widely used, keys 56 bits long which may be a bit short, some people worry there may be an trapdoor put there by NSA, but if I told you I'd have to kill you :-) Banks use it, for instance. IDEA - a Swiss-written secret-key system, maybe more secure than DES, newer anyway. Patented in Switz but not US, easy licensing. Public-Key CryptoSystem - Encryption key ke and Decryption key kd are related, but in a way that you can't determine kd knowing only ke. ke is called the public key and kd the private key - you can publish ke where everyone can see it and encrypt stuff to mail to you, you can decrypt with private key kd. (If you want to reply, you've got to get their public key.) Public-key algorithms are pretty slow, so generally people use create a random secret key, encrypt their message with a secret-key algorithm like DES, and encrypt the secret key with the recipient's public key; recipient decrypts the secret key with his private key, then uses it to decrypt the message. Digital Signatures - if you can do public-key crypto, then you can do the reverse as well to sign a message - you *decrypt* the message with your private key, and the recipient encrypts it with your public key - if it restores the original message, she knows it's good and knows that *you* sent it, because only you have your private key. For speed, you normally make a "hash" checksum of the message, and sign the hash instead of the whole thing. Some public-key algorithms can only be used for encryption, some only for signatures, some for both but you need different keys. MD-4 and MD-5 - Message Digest hashing algorithms from (?) Rivest, which are thought to be unforgeable, unlike the CRC checksums used by many programs which are easily forged. RSA - A public-key algorithm developed by Rivest, Shamir, and Adelman. It's the only well-known public-key algorithm that does everything everybody wants, including signatures and public-key, that's secure enough that you can't crack it as long as you use reasonably long keys. Unfortunately, it's patented in the US, by Public Key Partners, a company R, S, A, and friends started that owns most of the interesting patents related to public-key. On the other hand, to avoid having the NSA classify their patent right when they applied (the NSA can do that), they published the algorithm before applying, which means that it's public-knowledge in most of the world and you can't patent it there, even in places that do allow algorithm patents. Their claims about what techniques their patents cover are *very* broad; if you want to do anything public-key related in the US, you've got to deal with them or carry a BIG lawyer, and so far everybody's chosen to deal with them rather than risk a long expensive difficult court case, or else chosen to ignore or infringe their patent but not sell their products for cash, and hoped to get away with it. RSAREF - an RSA implementation from PKP, which you may use free for personal non-commercial use as long as you agree to follow a set of rules that are much less restrictive than they used to be; you can't export it outside the US and Canada, and can't change the interface without their permission, and a few other terms. Better implementations of RSA's algorithms have been done, but you can use this one free, with their permission. Or you can pay them money and get support for incorporating their techniques into your products. Key certification - Public Keys are usually long - RSA keys are often 1024 bytes. Public keys crypto is only secure if you can be SURE you have the public key for the person you're trying to send a message to, like Bob, and that Eve hasn't handed you HER public key instead - she could be intercepting all your mail to Bob, decrypting it, and re-encrypting with Bob's key. So you need to find a secure way to transmit public keys, where "secure" means it can't be forged without you knowing about it (though anybody can read them.) Publishing in the New York Times classified ads is one approach, as is any other broadcast method you can be SURE everyone gets correctly. Another method is to use digital signatures - somebody you trust, whose public key you can be sure you know accurately, gets Bob's public key from Bob, and signs it with their public-key. Since not everybody knows somebody who knows Bob, the problem can be handled by a chain or hierarchy of key certifications - Charlie signs Bob's, Dave signs Charlie's ... and You know Xerxes yourself. Or George Bush signs all the general's keys, the generals all sign the keys for the colonels under them, the colonels sign for the majors under them, .... and you can check some sergeant's key because it's got a certificate from his lieutenant on up to Bush, and Bush's key is in the Phone Book. PGP - Phil's Pretty Good Privacy program - a nice packaging of this technology that can be used easily to prepare secure email. The original version used RSA and a choice of DES or a home-brew secret-crypto system; the current version uses RSA and IDEA. For certification, the method is non-hierarchical - you have a "keyring" containing public keys you know, maybe with certificates, and you can sign the ones *you* trust and give your signed keyring to your friends. Hierarchies imply the potential for control; this is cooperative anarchy, and there's no chain of people you HAVE to obey to exchange keys. When PGP version 1 first came out, RSA yelled at Phil Zimmerman, the author, and told him he was risking patent infringement lawsuits and such if he didn't cease and desist, so he's no longer distributing it. But some of those SNEAKY FOREIGNERS *somehow* got a copy, and so ongoing development of PGP is taking place outside the US, unhindered by patent problems. Version 2.1 is out, 2.2 real soon. Parts of PGP are probably not covered by PKP's patents, and parts are clearly not covered by ITAR, but some parts are a problem. RIPEM - Mark Riordan's public-key email system, which uses RSAREF to do RSA, so it's legally kosher but not exportable, and is related to the internet Privacy Enhanced Mail stuff that was being developed for a while. Still real new, but probably Pretty Good also; I seem to remember its key certification was more hierarchical. ---- More PGP info - PGP was originally written for a DOS environment (there are problems trusting any system you don't totally control, and it's tough to say you totally control a multi-user system), but it's been ported to lots of things by now, including UNIX and some early Mac ports (work is in progress to make the Mac port feel like Mac-stuff rather than Unix-stuff.) You can get the source, compile it, play with it, and do anything you want that doesn't infringe PKP's patent, so remember not to use it to exchange keys with anyone or send them mail unless you've got a licensing agreement..... Once it's compiled, type pgp -h to get help, and/or read the documentation. Where to get things: The fun place to shop is nic.funet.fi, by anonymous ftp, but if you telnet to an archie server like archie.rutgers.edu (login as archie) you can ask it wher to find anything. Using a US site would be potentially better legally, and also cuts down on the bandwidth used between here and Finland.... Bill Stewart

2 1

cypherpunks vs. cryptoprivacy
by ggoebel＠sun1.ruf.uni-freiburg.de 21 Apr '93

21 Apr '93

All, Kragen writes: } I agree with those who think that "CypherPunks" is a bad name for the list. } It brings up negative associations in the minds of outsiders, who are, after } all, the people who we want to influence against the Big Brother wiretap chip Is anyone against changing the name from cypherpunks to cryptoprivacy? Seems to be the general consensus... that cryptoprivacy would be more PC. Unoriginal Thought: couldn't the list/group name be changed to "CP"? o For outsiders, and formally, it could stand for CryptoPrivacy o To insiders... it could still stand for CypherPunks o CP is the opposite of PC (I like that). back to lurking, Garrett -- C. Garrett Goebel <ggoebel(a)sun1.ruf.uni-freiburg.de>

1 0

GSM vs. wiretapping: Australia
by jhart＠agora.rain.com 21 Apr '93

21 Apr '93

Forwarded from comp.org.eff.talk In article <1993Apr12.081136.1(a)cc.curtin.edu.au>, zrepachol(a)cc.curtin.edu.au (Paul Repacholi) writes: > In article <1993Apr11.175007.10136(a)news.acns.nwu.edu>, jlacour(a)merle.acns.nwu.edu (John LaCour) writes: > Have not seen a proposal like the FBI one yet, doesn't mean it isn't out there > though. One thing that has happened is the delaying of the new GSM digital > mobile phones. It seems that ASIO and friends have been told by GCHQ about > the dificulty of breaking MD5. Info is still a bit thin. You could try posting > to aus.comms. > Please note, I have added aus.comms and aus.politics to this one. I enquired of Austel ( the Australian telecoms regulatory body), and the Federal Atourny Generals Office today. The Telecom GSM trail marketing that started in Brisbane in March has been canceled. GSM will *NOT* be legal in Australia till the use of MD% encryption is changed, or the system is altered to allow monitoring of calls. This is a requirement of the 'Telecomunications Interception Act'( AG perth.) There are also prohibitions on using codes and cyphers in the 'Crimes Act' various state police acts and criminal codes ( thought these would not affect Telecomms, as that is federal jusistiction. I will try to find the acts, and quote the relevent sections on this. There has also been posts on 'pen-recorders' I notice. The .au situation on this is that a commisioned officer of the federal police can give the telco a written notice requiring the supplying of cal info for the date range in the notice. I saw this some monthes ago, and had the impression that this included info *PRIOR* to the notice, info Telecom claims not to have if mear chattels inquire! Strange, wonder where it matterializes from. Note the absence of words like 'warrant', 'judge', 'court' or other such! I think there is a requirement for the commisioner of the FP to include in his anual report to parlament the number of notices issued. All this has been in place in one form or another for decades. I first saw this sort of stuff when I worked in the post office ( ob history: the post offie used to run the phon system in australia years ago ) As I worked both as a night shift telephonist and in the office itself, I had to sign a stack of secrecy stuff, and a copy of the 'Posts and Telegraphs Act' was standard issue. This had a prohibition on "unlawfull codes, cyphers and secret writings" The Comercial Telex Code was the *ONE* allowed code. Any other code used in a telegram *HAD* to be stated on the logment form. Don't know what happened after that. Small country town, never saw one. Only the banks used codes. This would have been Dec '67 or '68 I think. Will try to fill in the gaps, and post a full account later. Note that I will be probably away next week, ( school hols ) so it may be a while. I will also try to get some extra info on use etc. ~Paul

1 0

PGP help?
by Robert Luscombe 21 Apr '93

21 Apr '93

I am in search of any MSDos (or Windows, but not preferred) offline mail readers, text editors, etc. that work well with PGP-- anything to help me use PGP for everyday email. I use a dial-up internet connection, so i have no choice but to use the remote system's PINE mail reader... if anyone knows of anything that will let me compose and encrypt email locally and format the messages into a .QWK packet for upload, that would be IDEAL, but anything else could still help. (BTW-- i have already posted on alt.security.pgp and nothing ever came of it. So it goes.) --Robert Luscombe Internet: ral(a)telerama.pgh.pa.us Voice:412/488-0941 robert(a)well.sf.ca.us (Finger for PGP Pub Key)

1 0

FAQ: where to get PGP
by szabo＠techbook.com 21 Apr '93

21 Apr '93

Here is a list of PGP sites generated by "archie". I have checked sony.com which has PGP 2.2 but have not checked the other sites. If you know any of these sites to be down, out of date, etc. please let me know and I'll update the list. Also let me know of sites archie did not catch. Strong crypto is available worldwide, but the Clinton Adminstration has threatened to ban it in the U.S. In the age of digitial telecom and fascist governments, strong crypto is your only guarantee of electronic privacy. Get it, learn it, and use it while it's still legal! Nick Szabo szabo(a)techbook.com ----------------------------------------------- /usr2/users/szabo> archie pgp Host sony.com Location: /pub DIRECTORY drwxr-xr-x 512 Apr 9 20:26 pgp Host quepasa.cs.tu-berlin.de Location: /pub/os/386BSD/386bsd-0.1/unofficial/doc/software FILE -rw-rw-r-- 12121 Feb 2 00:01 pgp Host reseq.regent.e-technik.tu-muenchen.de Location: /informatik.public/comp/usenet/alt.sources DIRECTORY drwxrwxr-x 512 Dec 9 01:24 pgp Host ftp.uni-kl.de Location: /pub1/unix/security DIRECTORY drwxrwxr-x 512 Feb 24 19:24 pgp Host cwdynm.echem.cwru.edu Location: /scriptures/ALL.plain FILE -r--r--r-- 167535 Sep 11 1991 pgp Host goya.dit.upm.es Location: /tmp DIRECTORY drwxr-xr-x 512 Aug 22 1992 pgp Host walton.maths.tcd.ie Location: /src/misc/pgp-2.0/src FILE -rwxr-xr-x 316640 Oct 18 00:00 pgp Host ftp.uu.net Location: /pub/security DIRECTORY drwxrwxr-x 512 Mar 9 15:13 pgp Host isy.liu.se Location: /pub/misc DIRECTORY drwxr-xr-x 512 Mar 11 23:54 pgp Host ftp.luth.se Location: /pub/infosystems DIRECTORY drwxr-xr-x 512 Jan 27 12:59 pgp Host unix.hensa.ac.uk Location: /pub/uunet/pub/security DIRECTORY drwxr-xr-x 512 Mar 19 07:35 pgp

1 0

A few notes on the WIRED article (kudos)
by fergp＠sytex.com 21 Apr '93

21 Apr '93

I hope this goes over well. I found this article to be just what we need --- publicity. The kind that opens eyes. Tim, Eric and John -- I sat to thee, "How come this only happens in California?" ;-) - Snip, Snip ----- 8< ------ From the "For What It's Worth Department"... A totally biased review of Steven Levey's "Crypto Rebels" article in WIRED, Volume 1, Issue 2, May/June 1993 I was a bit interested when a fellow cypherpunk mentioned that there was a "decent" write-up in WIRED on the cypherpunk issues. Somehow, I envisioned some sidebar mention. In these interesting times, any mention of our efforts on the computer privacy frontier gets A-1 attention in my book. However, I was startled (and pleasantly surprised) when I took a jaunt down to my local magazine-ary on Broadway and found that my internaut campadres were on the cover, no less. Golly gee, imagine that. The cover itself conjures images of computer cultist symbolism. Tim May, Eric Hughes and John Gilmore strike an interesting pose wearing plain white, plastic carnival masks. The American flag held in their hands is even more striking considering the topic at hand. (What the hell does the Russian inscription mean?) I remember reading the post announcement in the cypherpunks mail area about that meeting in Mountain View. (If I had known that you western cypherpunks would get all the press attention, I would've hopped a red-eye and met you guys at Cygnus.) It's ironic that this topic built steam and attention _before_ the "Clipper Chip" fiasco and still provides the computer community with viable (perhaps not altogether proper) alternatives. I knew it would. Ha. Steven Levey has long since established himself as a solid, factual and sometimes thought-provoking writer. His book "Hackers" is considered by many professionals in the field to be the authoritative work on the progression of computer hackers. Levey earns himself one more brownie badge by bringing attention to the cypherpunk dilemma. The article is thought provoking (read: it is not designed for disinterested parties), accurate and for the most part, right on the mark. Key statements are sprinkled on the page margins, including "In the Cypherpunk mind, cryptography is too important to leave to government or even well-meaning companies. To insure that the tools of privacy are available to all, individual acts of heroism are required." That piece alone is enough to invoke thoughts of ... A key profile is included about John Gilmore and his headaches with the NSA, the Cypherpunk subscription mail group and several other side-bar notes that lend some valuable credibility to the otherwise incredulous auspices of the cypherpunk image. Not only is this article well written, as far as information blurbs go, this is good stuff, even for us neanderthals on the east coast. In a broader aspect, WIRED is a magazine that deserves your attention. Pick up this rag and give it the once-over. Somehow, I classify this 'zine as a combination of INFO World, The New Yorker and Mondo 2000. Isn't that a draw? Humor and seriousness implied... Paul Ferguson, Editor, Legal Net News - Snip, Snip --- 8< ----- I loved the feel of the magazine, too. All recycled. Ain't that great? Cheers. Paul Ferguson | Uncle Sam wants to read Network Integration Consultant | your e-mail... Alexandria, Virginia USA | Just say "NO" to the Clipper fergp(a)sytex.com | Chip...

1 0

Just a thought...
by mark＠coombs.anu.edu.au 21 Apr '93

21 Apr '93

Whilst being heavily opposed to the chip although less affected by it since I dont reside on US soil, one useful purpose of it would to exploit the functions of it to send your pre-encrypted data through it and have it come out the other end in the same form, thus using it's protocols of retransmission and error correction. Using the encryption part of it isnt worth considering due to the real lack of data integrity if (as?) the TLA's have backdoors. Basically mooch it's good points and ignore the bad points as your data wont be channeled to the phone in cleartext anyway. (This isnt an advocacy of the damn thing, just a note that it has SOME functionality for those that wont use the encryption functions). Mark mark(a)coombs.anu.edu.au

1 0

Radical politics
by tcorcora＠sunlab.cit.cornell.edu 21 Apr '93

21 Apr '93

Sheesh, it's enough to make one turn into a radical libertarian/anarchist (if one wasn't already...). I firmly suggest that we all call ou [ unauthorized communication, re: Sec 12-2, .2-12.6; channel closed under Anti-Terrorist-Communications Act on 00:30 21 MAR 93. Authorization 4ff0 -NIST]

1 0

Objections...
by Peter Wayner 21 Apr '93

21 Apr '93

I think one very serious objection to the SkipJack system is that the secrecy prevents us from coming up with Software implementations of the system. Naturally, they don't want that to happen because people start finding easy ways to screw up the encrypted block of key information needed by the government. But regardless of that, software implementations of DES have been extremely useful for everyone. There is probably 10 times as much encryption done using software DES than hardware. Maybe 1000 times as much. The fact is that software protection is much easier for the public to use. They don't need to buy an extra chip for their computer. They just run some software. It's cheaper. More populist. I think this is the most practical and non-inflamatory argument for public access to the algorithm. -Peter Wayner

2 1

European front: wiretapping vs. GSM
by szabo＠techbook.com 21 Apr '93

21 Apr '93

Forwarded from comp.dcom.telecom: Subject: Re: Truly Amazing, Truly Amazing ... Feds Reply-To: Michael_Lyman(a)sat.mot.com Message-ID: <telecom13.254.17(a)eecs.nwu.edu> Organization: Motorola Inc. - Satellite Communications Sender: Telecom(a)eecs.nwu.edu In article 1(a)eecs.nwu.edu, naddy(a)mips.ruessel.sub.org (Christian Weisgerber) writes: > I wonder, is the signal only digitally encoded or digitally encoded > and *additionally* encrypted? Yes on both counts. On the air interface between the base station ( BSS ) and mobile station ( MS ) the signals are digitally encoded. Traffic channel rate is 13 Kb/s. In addition to this, ciphering is done to protect the signalling channel such that user data privacy is provided then, encryption is provided for all voice traffic. As an aside, the GSM system also assigns "alias" subscriber numbers which are changed automatically with ( usually ) every call -- the subscribers real phone number is never ( well, almost never ) used over the air. > I'm getting a little paranoid over this, but in Germany when you buy > an approved wireless phone you are told that it is impossible to > listen in to it. Bullsh*t. In fact it's only impossible to listen in > with another (unmodified) wireless phone -- just get a scanner and > you're in. For GSM, the level of privacy for both signalling and voice is considerable. Just to give you an idea, encryption keys change for each call made by the subscriber and the encryption algorithms use the changing physical properties of the radio channel. As a matter of fact, GSM is SO secure that several European governments including Britain are insisting that the scrambling algorithm ( called A5 in GSM ) be modified to allow at least government operatives ( read "undercover eavesdroppers" ) to listen in on suspected criminal activities. Agencies such as GCHQ, the British government's listening post near Cheltenham and the FBI in America are concerned that the A5 scrambling algorithm provided with the GSM Mobile Stations is equivalent to many military systems and in fact when exported may be adapted for military applications. Vendors of GSM equipment are starting to run into export problems due to the nature of the encryption / ciphering. Although there are some industrious "scanners" out there, I dare say that listening in on a GSM conversation will be a bit of a job. Michael Lyman Motorola - Iridium Phoenix, Arizona

1 0