April 1993 - cypherpunks-legacy

Re: WIRETAP: Non-technical statement
by szabo＠techbook.com 20 Apr '93

20 Apr '93

> [proposed press statement] > .... > This has come to be known as the > Wiretap chip since it allows any Law Enforcement agency to automatically > decrypt any conversations made with it with a search warrant. > ... I understand there are some situations where law enforcement agencies can gain access to keys _without_ a search warrant, and furthermore access to the keys allows wiretapping of conversations that go well beyond the scope of the search warrant. This might be better phrased "with, or in many cases even without, a search warrant". Does anybody know of specific examples of wiretapping without a search warrant, or beyond the scope of the search warrant that we can cite? Especially famous ones (didn't Nixon wiretap somebody?) Question: does there need to be a warrant to search *both* parties in a conversation, or just one? What if one of the parties is a foreign citizen calling from their homeland? What about conference calls? In addition to lawyer-client and doctor-patient conversations, ubiquity of the wiretap chip allows the U.S. government exclusive access to recording the following calls under the rubric of a "secure" system: * husband-wife * psychologist-client * priest-confessor * foreign tourists, businessmen, and diplomats * international phone calls * phone calls outside the U.S. involving Clipper phones (last I heard AT&T was planning to export the wiretap chip phone, can that be verified?) * etc. We might design a special press release to be sent to the *international* press and foreign companies. We might especially target electronics giants like Matsushita, Phillips, Siemens, Fujitsu, NEC, etc. that can make alternative chips if they feel there is market demand for privacy from U.S. spooks who speak of using the wiretap chip to "enhance U.S. economic competitiveness". This might be a joint venture with U.S. companies like Security Technologies Inc. that AT&T and the U.S. government have screwed with their collusion. The vast majority of consumer-product chips are manufactured outside the U.S. It is doubtful that VLSI can compete, much less corner the market if international concern is raised over the potential U.S. wiretapping monopoly. However, we do need to do this in such a way that we do not encourage foreign government escrow-key schemes. Let's use the term "wiretap chip" for the entire class of escrow-key hardware schemes. I think we have a shot at giving the entire class of Denning-style schemes a bad reputation in the international community. One desirable foreign government action would be to ban the import of phone equipment containing escrow-key chips from the U.S.; a very undesirable outcome is for foreign governments to set up their own escrow-key systems. Primarily, we want to give wiretap chips a bad reputation in the market. We also need to dig up information on the phone call archives being kept by the NSA and other agencies. How extensive are they? Is there any guarantee phone calls will be deleted after some period, or are phone calls once tapped stored forever on some CD-ROM? Can foreign companies operating in the U.S. have any confidence that the U.S. government is not wiretapping their phones, gleaning trade secrets and distributing them to favored U.S. megacorps like AT&T? If we don't have answers to these questions we need to ask them, in public and often. Nick Szabo szabo(a)techbook.com

1 0

Re: Another Clipper weakness
by Hal 20 Apr '93

20 Apr '93

-----BEGIN PGP SIGNED MESSAGE----- From: "Perry E. Metzger" <pmetzger(a)lehman.com> > I've just looked over the proposal again, and I've seen no mention of > random inputs -- only that the 30 bit key would get a "fixed 34 bit > padding" added to it. Here is what Denning's writeup says: At the beginning of a session, a trusted agent from each of the two key escrow agencies enters the vault. Agent 1 enters an 80-bit value S1 into the laptop and agent 2 enters an 80-bit value S2. These values serve as seeds to generate keys for a sequence of serial numbers. To generate the unit key for a serial number N, the 30-bit value N is first padded with a fixed 34-bit block to produce a 64-bit block N1. S1 and S2 are then used as keys to triple-encrypt N1, producing a 64-bit block R1: R1 = E[D[E[N1; S1]; S2]; S1] . Similarly, N is padded with two other 34-bit blocks to produce N2 and N3, and two additional 64-bit blocks R2 and R3 are computed: R2 = E[D[E[N2; S1]; S2]; S1] R3 = E[D[E[N3; S1]; S2]; S1] . R1, R2, and R3 are then concatenated together, giving 192 bits. The first 80 bits are assigned to U1 and the second 80 bits to U2. The rest are discarded. The unit key U is the XOR of U1 and U2. U1 and U2 are the key parts that are separately escrowed with the two escrow agencies. Here, the notiation E[X; Y] means to encrypt 64-bit number X using 80-bit key Y with the Skipjack algorithm. U1 and U2 come from concatenating R1, R2, and R3. Each of R1, R2, and R3 is a function not only of N, the serial number, along with the 3 fixed 34-bit blocks, but also S1 and S2, the two random numbers entered by agents from the escrow organizations. > > The one problem is that S1 and S2 are not changed for each chip, but are > > rather kept the same in programming a batch of about 300 chips. Then > > they are supposed to be destroyed. > > This was not clearly implied, either. Furthermore, no clear reason has > been stated why all this complexity is needed and U1 and U2 can't just > be randomly generated. All Clipper Chips are programmed inside a SCIF (secure computer information facility), which is essentially a vault. The SCIF contains a laptop computer and equipment to program the chips. About 300 chips are programmed during a single session. The SCIF is located at Mikotronx. I agree that the process seems complex. Why should the keys U1 and U2 be correlated with the serial number in this way? Here is one thought: The most straightforward approach would be to get two random seeds, S1 and S2, and use them to run a PRNG that produces U1 and U2, the two key-halves, and N, the serial number. But the problem with this is that you are depending on the security of your PRNG to ensure that there is no correlation between N and U1/U2. Ordinary PRNG's might allow some correlation to exist. This would be weak because then just knowing the N of your chip might allow a good organization like NSA to crunch out U1 and U2 without going through the escrow agencies, by exploiting weaknesses in the PRNG. Instead, they go through a roundabout process which appears to show that the relationship between N and U1/U2 is as strong as the Skipjack algorithm itself, in fact when run in a triple-encryption mode. If NSA had a way, given N, to produce U1/U2, then it would appear that they must be able to break Skipjack, in which case they wouldn't need U1/U2. So this key generation process can be argued not to introduce any new vulnerability in the system. Hal -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK9QrV6gTA69YIUw3AQGGrAP/Rmx0H603b1EdBIsiGuc637wptW133IFU /irxw+aCPrL3yOzuBTQbUW+LeMIwpC+Y8DARkAohxnIjhuu/aQXVnIvJPPiUSPr0 fz2PLxhA5tgjVAH0e5xvl9K+CgWnRXazd9Tp+Zbi/xAiWz0PI6kff4QtNG13p1xw /V0dGDb4tec= =XgfH -----END PGP SIGNATURE-----

2 1

cypherpunks vs. cryptoprivacy
by TO1SITTLER＠APSICC.APS.EDU 20 Apr '93

20 Apr '93

I agree with those who think that "CypherPunks" is a bad name for the list. It brings up negative associations in the minds of outsiders, who are, after all, the people who we want to influence against the Big Brother wiretap chip. Kragen

1 0

Waco, crypto, and unbreakable links
by grady＠netcom.com 20 Apr '93

20 Apr '93

We can only speculate that the loss of life might have been much fewer if the Branch Davidian cult had a copy of PGP as well as a 2m packet radio. They could have maintained private links with journalists who could have given us their side of the story, which now, tragically will never be told.

2 1

Re: Wiretapping chip: vid clips & sound bites
by wcs＠anchor.ho.att.com 20 Apr '93

20 Apr '93

I strongly agree with Ray Cromwell's suggestions that we consistently refer to "the wiretap chip", and avoid "drug dealer" examples. One that might be closer to home when you need an example is "Suppose the IRS thinks you may have cheated on your income tax and decides they want to wiretap your phone ..." It's within the range of things people imagine could happen to them, and it makes the point that it's *their* phone that's being trapped, not some public enemy bogeyman. Making it personal is important... Bill # Bill Stewart wcs(a)anchor.ho.att.com +1-908-949-0705 Fax-4876 # AT&T Bell Labs, Room 4M-312, Crawfords Corner Rd, Holmdel, NJ 07733-3030

1 0

Re: Sound bite time
by peb＠PROCASE.COM 20 Apr '93

20 Apr '93

I like the newer sound bites. ``Having to deposit copies of all your private letters with the authorities, "in case" they need to later read them...'' and ``Giving the government keys to your encrypted messages is like giving them keys to the front door of your house.'' seem best. Phil, About the right to bear arms and crypto-privacy...you are right--it is not a good sound bite for J. Q. Public, but could be a good angle for *understanding* (uhg, I hate this sound bite stuff.) Paul E. Baclace peb(a)procase.com

1 0

WIRETAP: Non-technical statement
by dstalder＠gmuvax2.gmu.edu 20 Apr '93

20 Apr '93

I've had some people ask me about a non-technical synopsis of the Wiretap Chip proposal. What follows is it. Can you please look over it for errors? I am still very much the amateur when it comes to cryptography. The WIRE-TAP Proposal: Problems with it. The White House sent out a press release on Friday 16 April about a voice encryption chip called the Clipper chip. This has come to be known as the Wiretap chip since it allows any Law Enforcement agency to automatically decrypt any conversations made with it with a search warrant. The LE presents said search warrant to two different escrow agencies to obtain the keys (80 bits long) that automatically decrypts your conversation. The Electronic Freedom Foundation (EFF) and the Computer Professionals for Social Responsibility (CPSR) have both criticized the proposal. There was even a negative article already in Network World (19 Apr 93). The paragraphs that follow are facts and problems I have collected by listening to other discuss the Wiretap chip. Say you wanted to encrypt your talk with someone over a phone. Well, since you and the person you want to talk to both have the Wiretap (Clipper) chip in your phones, you can automatically encrypt your conversation. All fine and good encryption for the consumer. Now, what if you come under investigation by the local constabulary? The get a court order and ask the escrow agencies (non-law enforcement types) for your key. They already have the family key since that is the same in each chip. They now have your specific key. With these two keys, they can decrypt all conversations that you have. This includes conversations that are not legal to wiretap such as attorney-client, doctor-patient and so on. They also have that key for any all future sessions that you use that phone for. Start to see the problem? This part is all legal... Search warrants are even exceedingly easy to get at times. There have been reports of the FBI get groups of 50 signed and blank search warrants from the DoJ. Now, there are other problems. Would you give the IRS keys to your house and filing cabinet as long as they promised that they would only use it under proper authorization? The key length of 80 bits is still considered cryptographically weak. It would take determined effort by an agency with a supercomputer but your key could be broken. The cryptographic algorithm is also being kept classified. This is not the usual practice. In the cryptographic community, algorithms are public. This way people can be assured there aren't any back doors and that the algorithm can stand on its own strengths, not that of secrecy. It has also been hinted at by NIST (the agency behind the technical implementation of the chip.) that the chip could be compromised if the algorithm was made public. It is not that difficult to reverse engineer a chip these days. Finally, some of the implications behind this announcements are dire. The Wiretap chip could become the market or legislative standard. This could mean that other implementations of cryptographic voice transactions would be very difficult to obtain or would be illegal to obtain. Why would a criminal use the Wiretap chip when they knew it wouldn't encrypt their conversations against the LE agencies? They wouldn't, they would use other encryption technologies. Would this mean that using something other than the Wiretap chip is probable cause and puts you under suspicion? One last fishy thing is that AT&T has already (on the same day) announced phones with this chip. This implies (means?) that AT&T has known about this chip for a while. They seem to be more concerned about getting a jump on the competition than producing a product that will actually give their users real security. 'Course, there is the question of collusion between the governement and industry. Only two companies will be allowed to manufacture the chip, VLSI and Mykotronix. Jeff Hendy, director of new product marketing for VLSI, says his company expects to make $50 million of the chip in the next 3 years. (This from the San Jose Mercury News.) Hopefully, I haven't left stuff out. I am going to forward this to cypherpunks for the experts there to check it out. Think free, -- Defeat the Torin/Darren Stalder/Wolf __ Wiretap Chip Internet: dstalder(a)gmuvax2.gmu.edu \/ PGP2.x key available. Proposal! Bitnet: dstalder@gmuvax Finger me. Write me for Sprintnet: 1-703-845-1000 details. Snail: 10310 Main St., Suite 110/Fairfax, VA/22030/USA DISCLAIMER: A society where such disclaimers are needed is saddening.

1 0

Another Clipper weakness
by Hal 20 Apr '93

20 Apr '93

Perry asks about the 30-bit serial number. Actually, it appears that the unit key UK is a function of the serial number plus the two 80-bit random numbers input by the escrow agents when the chips are programmed. This would prevent an easy guessing attack as long as these random numbers S1 and S2 are unknown. The one problem is that S1 and S2 are not changed for each chip, but are rather kept the same in programming a batch of about 300 chips. Then they are supposed to be destroyed. The potential weakness is that if someone managed to keep a copy of the S1 and S2 values which were used to program all clipper chips (only about 3000 such values for a million chips), then Perry's suggested attack could work. This would be few enough bits that the unit key could be guessed. Those who are asked to judge the safety of the system will presumably pay careful attention to the measures used to insure that S1 and S2 are not saved. I don't know how they'll check for NSA micro-cameras in the vault ceiling, though... Hal

1 0

(fwd) THE CLIPPER CHIP: A TECHNICAL SUMMARY
by tcmay＠netcom.com 20 Apr '93

20 Apr '93

Cypherpunks, Here's the most complete and readable summary of the Wiretap Chip I've seen. Ironically, it comes from none other than Dorothy, the Wicked Witch of the East, who claims she knew nothing of it until Thursday night, just before the announcement. Curiouser and curiouser. -Tim May From: denning(a)guvax.acc.georgetown.edu Newsgroups: sci.crypt Subject: THE CLIPPER CHIP: A TECHNICAL SUMMARY Date: 19 Apr 93 18:23:27 -0400 Distribution: world Organization: Georgetown University The following document summarizes the Clipper Chip, how it is used, how programming of the chip is coupled to key generation and the escrow process, and how law enforcement decrypts communications. Since there has been some speculation on this news group about my own involvement in this project, I'd like to add that I was not in any way involved. I found out about it when the FBI briefed me on Thursday evening, April 15. Since then I have spent considerable time talking with the NSA and FBI to learn more about this, and I attended the NIST briefing at the Department of Commerce on April 16. The document below is the result of that effort. Dorothy Denning --------------- THE CLIPPER CHIP: A TECHNICAL SUMMARY Dorothy Denning April 19, 1993 INTRODUCTION On April 16, the President announced a new initiative that will bring together the Federal Government and industry in a voluntary program to provide secure communications while meeting the legitimate needs of law enforcement. At the heart of the plan is a new tamper-proof encryption chip called the "Clipper Chip" together with a split-key approach to escrowing keys. Two escrow agencies are used, and the key parts from both are needed to reconstruct a key. CHIP STRUCTURE The Clipper Chip contains a classified 64-bit block encryption algorithm called "Skipjack." The algorithm uses 80 bit keys (compared with 56 for the DES) and has 32 rounds of scrambling (compared with 16 for the DES). It supports all 4 DES modes of operation. Throughput is 16 Mbits a second. Each chip includes the following components: the Skipjack encryption algorithm F, an 80-bit family key that is common to all chips N, a 30-bit serial number U, an 80-bit secret key that unlocks all messages encrypted with the chip ENCRYPTING WITH THE CHIP To see how the chip is used, imagine that it is embedded in the AT&T telephone security device (as it will be). Suppose I call someone and we both have such a device. After pushing a button to start a secure conversation, my security device will negotiate a session key K with the device at the other end (in general, any method of key exchange can be used). The key K and message stream M (i.e., digitized voice) are then fed into the Clipper Chip to produce two values: E[M; K], the encrypted message stream, and E[E[K; U] + N; F], a law enforcement block. The law enforcement block thus contains the session key K encrypted under the unit key U concatenated with the serial number N, all encrypted under the family key F. CHIP PROGRAMMING AND ESCROW All Clipper Chips are programmed inside a SCIF (secure computer information facility), which is essentially a vault. The SCIF contains a laptop computer and equipment to program the chips. About 300 chips are programmed during a single session. The SCIF is located at Mikotronx. At the beginning of a session, a trusted agent from each of the two key escrow agencies enters the vault. Agent 1 enters an 80-bit value S1 into the laptop and agent 2 enters an 80-bit value S2. These values serve as seeds to generate keys for a sequence of serial numbers. To generate the unit key for a serial number N, the 30-bit value N is first padded with a fixed 34-bit block to produce a 64-bit block N1. S1 and S2 are then used as keys to triple-encrypt N1, producing a 64-bit block R1: R1 = E[D[E[N1; S1]; S2]; S1] . Similarly, N is padded with two other 34-bit blocks to produce N2 and N3, and two additional 64-bit blocks R2 and R3 are computed: R2 = E[D[E[N2; S1]; S2]; S1] R3 = E[D[E[N3; S1]; S2]; S1] . R1, R2, and R3 are then concatenated together, giving 192 bits. The first 80 bits are assigned to U1 and the second 80 bits to U2. The rest are discarded. The unit key U is the XOR of U1 and U2. U1 and U2 are the key parts that are separately escrowed with the two escrow agencies. As a sequence of values for U1, U2, and U are generated, they are written onto three separate floppy disks. The first disk contains a file for each serial number that contains the corresponding key part U1. The second disk is similar but contains the U2 values. The third disk contains the unit keys U. Agent 1 takes the first disk and agent 2 takes the second disk. The third disk is used to program the chips. After the chips are programmed, all information is discarded from the vault and the agents leave. The laptop may be destroyed for additional assurance that no information is left behind. The protocol may be changed slightly so that four people are in the room instead of two. The first two would provide the seeds S1 and S2, and the second two (the escrow agents) would take the disks back to the escrow agencies. The escrow agencies have as yet to be determined, but they will not be the NSA, CIA, FBI, or any other law enforcement agency. One or both may be independent from the government. LAW ENFORCEMENT USE When law enforcement has been authorized to tap an encrypted line, they will first take the warrant to the service provider in order to get access to the communications line. Let us assume that the tap is in place and that they have determined that the line is encrypted with Clipper. They will first decrypt the law enforcement block with the family key F. This gives them E[K; U] + N. They will then take a warrant identifying the chip serial number N to each of the key escrow agents and get back U1 and U2. U1 and U2 are XORed together to produce the unit key U, and E[K; U] is decrypted to get the session key K. Finally the message stream is decrypted. All this will be accomplished through a special black box decoder operated by the FBI. ACKNOWLEDGMENT AND DISTRIBUTION NOTICE. All information is based on information provided by NSA, NIST, and the FBI. Permission to distribute this document is granted. --

3 2

Waco, crypto, and unbreakable links
by pat＠tstc.edu 20 Apr '93

20 Apr '93

> We can only speculate that the loss of life > might have been much fewer if the Branch Davidian > cult had a copy of PGP as well as a 2m packet > radio. > > They could have maintained private links with journalists > who could have given us their side of the story, which > now, tragically will never be told. I thought about this yesterday at lunch, at about the time the fire started in the Davidian compound. Only as it applies to the overthrow of a government or such. Agree on the initial frequency and time, then send the next frequency and time encoded in the message text to avoid jamming. "A rebellion is not a few men huddled around a candle talking in whispers. But a large, well funded, organization with an intricate communications network." - Unknown -- Pat Hykkonen, N5NPL Texas State Technical College at Waco {pat,postmaster}(a)tstc.edu Instructional Network Services PGP Key available by finger. 3801 Campus Dr. Waco, Tx 76705 V:(817) 867-4830 F:(817) 799-2843

1 0