April 1993 - cypherpunks-legacy

FAQ's
by uni＠acs.bu.edu 18 Apr '93

18 Apr '93

Perhaps someone should cook up a frequently asked questions sheet with regard to our position on the Wiretap chip proposal? Something bent a little more in the direction of consequences and not promises? Q: What will the Clipper Chip really mean for Privacy? A: The Clipper chip bills itself as the answer to a nations right for privacy, when indeed it is less secure than many of the algorithms in circulation today. Buying a Clipper Chip device is the same as handing the government your login password and accepting the promise, "We'll only use it with proper authorization..." Admittedly my example is less than eloquent, perhaps someone can come up with better? Given this format, and if the questions and answers are kept in layman's terms, it could reasonably be distrubuted to some of the less technical news groups and things like comp.mac.comm and such.... uni (Dark)

1 0

voice privacy for the masses
by Phil Karn 18 Apr '93

18 Apr '93

I think Hal Finney's analysis is not far from the mark. Saner elements in the government probably do realize the utter impossibility of a complete ban on uncrackable crypto given the existence of talented, knowledgeable and highly motivated (especially now!) "cypherpunks". But the government has also found that with very little effort, they can still have an enormous practical effect on the non-cypherpunk masses. Heck, look at what the NSA did to the digital cellular standards by standing in the shadows and quietly threatening to withhold export approval to phones with meaningful technology. The NSA barely had to whisper its objections, because the industry simply doesn't care very much about customer privacy. Certainly not enough to risk not only their non-US markets, but also the ability to have phones manufactured overseas for the US market. And then NSA rubs salt in the wound by brazenly claiming that they're only concerned about encryption getting into the hands of unfriendly foreign governments. As far as they're concerned, they say with a perfectly straight face, Americans are free to use any encryption scheme they want. I wonder how people like that can sleep at night. Well, the implications are obvious. If the public is ever to benefit on a large scale from strong encryption technology, it cannot depend on a normal market to sell it to them in turnkey packages. As soon as you go into business overtly selling such packages, the government pressure will begin. They will make sure that you do not become too successful, either by banning exports or by flooding the market with inferior technology that they can break (like Clipper). So we need to create a rather nonconventional "market". More specifically, we need to find a way to bring the efforts of the cypherpunks to the public with minimal cost and in a way that the government cannot control. By far the best way to do this is to write and distribute free crypto software that requires only readily available general purpose hardware to run. As we know, duplicating and distributing software is so trivial that controlling it is virtually impossible. And while it's theoretically somewhat easier for the government to ban or regulate, say, modems faster than 2400 bps or CPUs faster than 10 MHz 286s, general purpose computer hardware like this has so many other "legitimate" uses that in practice a ban would again be impossible. I've contributed a little to this effort myself with my public domain DES code, but it's the PGP effort that has really made this a reality. PGP is now unstoppable, and it's well on the way toward providing large scale privacy for email and other textual information. But voice is still a problem. What we really need now is "PGVP" ("Pretty Good Voice Privacy"), i.e., a package of public domain software that, when again combined with readily available general purpose computer hardware, produces a highly secure telephone. We already have two of the three hardware components of a digital secure telephone well in hand: CPUs capable of encrypting digital voice in real time, and reasonably fast telephone modems. The one remaining piece to the puzzle is the vocoder, as conventional waveform sampling of speech produces a data rate too high for telephone modems. (Faster modems might alleviate the need for a low bit rate vocoder, but current generation modems are already running very close to theoretical limits, and there won't be too many more improvements.) Ready-made vocoders are available. In fact, my company (Qualcomm) just announced one (the Q4400) as a spinoff of our CDMA digital cellular system. It's a mask-programmed AT&T DSP-16A DSP chip. Unfortunately, like many leading-edge products, it's not cheap: $69/ea in quantity 1000, and reportedly nearly $200 in small quantities. A second alternative is to run your own vocoder software. But vocoders are notoriously compute-intensive, and they're traditionally run on DSPs. And DSPs do not yet qualify as "widely available general purpose computer hardware". That leaves a third possibility: tuning vocoder software to run in real time on a fast general purpose processor like a 486. John Gilmore has already obtained and distributed public domain code that implements the Federal standard CELP vocoder algorithm (used in government secure telephones, a nice twist) but my understanding is that it's too slow to run in real time on popular computers. Van Jacobson at LBL has reportedly tuned it to run in better than real time on a Sparc 1+, but he hasn't released it yet and he's a notoriously hard guy to get ahold of. So the request of the day is this: who's willing to take that CELP code, bum enough instructions out of it so it will run in real time on a 486, and place his or her work back out into the public domain? Phil

1 0

Address of major telecom decision makers (AT&T, etc.)
by zane＠genesis.mcs.com 18 Apr '93

18 Apr '93

If someone has the addresses of these people it would be a very good idea to post these addresses (addresses of the NIST, Denning, etc. folk would be good as well.. I don't know those but those are probably more well-known than head-AT&T folk) here so that we can inundate them with mail and use these addresses in the full-page ads we buy in the newspapers. -- | Sameer Parekh-zane(a)genesis.MCS.COM-PFA related mail to pfa(a)genesis.MCS.COM | | Apprentice Philosopher, Writer, Physicist, Healer, Programmer, Lover, more | | "Be God" - Me __ "Specialization is for Insects" - Robert A. Heinlein ____/ \_____________/ \____________________________________________________/

1 0

Cypherpunks--Mission Statement Needed
by Clark Reynard 18 Apr '93

18 Apr '93

CP is for Crypto Privacy, because we feel that privacy and cryptography are now more inextricably linked than ever. We shall likely have to use crypto to hide our crypto. CP is for Changing Policy, both CP policy and existing government policy. CP is for Conscious Paranoia. We know and understand the issues involved, both the political and the scientific. We _are_ paranoid, but we know _why_ we're paranoid, and justify it as a _rational_ response. [The use of 'paranoia' is loose, of course, since the strict meaning and popular meaning differ widely.] CP is for Cypher Punks. Cypher because not only do we use cyphers, but in a certain sense we _are_ cyphers. Punks? A contemptuous term created by those contemptuous of those who fail to pay allegiance to the Almighty Government. Should it be a badge of pride, or a shameful term used for a shameful purpose? I believe that if we are to be effective, we ought to decide on a number of tenets which just aren't in the FAQ now. Tim May's .signature seems as good a place to start as any. Methods of implentation, boat-rocking and some form of plan will likely be necessary. Send mail to me or to the list, preferably to my mail address at nyx.cs.du.edu; and I will summarize and post, stripping headers if requested and eliminating redundant entries. The FAQ needs to be revised, I believe, to reflect the current crisis, and I am more than willing to help re-write it if anyone finds it agreeable. Thank you. [Aside: I appear to be getting two copies of many letters-- if anyone makes a snide comment about multiple postings of articles, I'll, I'll, I'll, uh, grin and look sheepish-- and I wonder if others have this problem; it's not a double sub, per se, as some letters _aren't_ doubled. Ah, well, it's probably nothing, just the side effects of the surveillance software.] ---- Robert W. Clark rclark(a)nyx.cs.du.edu PGP signature available by mail or finger

1 0

Putting out a paper-magazine
by zane＠genesis.mcs.com 18 Apr '93

18 Apr '93

I HIGHLY suggest that publishing-inclined cypherpunks start publishing cypherpunk-oriented PAPER newsletters to: A) Get out the word about how Clipper sucks B) Educate people about strong crypto, in layman's terms (tough one) C) Raise public support for strong crypto. There are probably other reasons why we want to do this as well. (When the discussion here was about technical details, I was greatly interested, but I had nothing to say-- now that the time has come for activism.. I feel that I can help..) The idea for full-page ads is nice. I'd advertise for raising funds for such a venture in my libertarian-leaning newsletter. -- | Sameer Parekh-zane(a)genesis.MCS.COM-PFA related mail to pfa(a)genesis.MCS.COM | | Apprentice Philosopher, Writer, Physicist, Healer, Programmer, Lover, more | | "Be God" - Me __ "Specialization is for Insects" - Robert A. Heinlein ____/ \_____________/ \____________________________________________________/

1 0

Media Sugestions, History of Clipper and Conspiracy theories
by Dave Banisar 18 Apr '93

18 Apr '93

RE: Press Blitz I have found from experience, with some success, that the best way to handle press if you to contact local press and present yourself as a local expert on the subject. This gives them a local connection for their stories. You should have apack ready to send them, including copies of the White House documents, and a 1 page fact sheet of your own pointing out the problems with the proposal. Present yourself as a local computer scientist who sees the deeper issues behind this proposal and wants to air them. The major national newspapers are already covering this but its the smaller local papers that most people read. Only a few million people total read the NY Times, Washinging Post etc. Thinks of the millions that read their local papers and get to them. If they respond, this will be killed. History of Clipper: As I mentioned before, Iwas at the NIST press Conference on Fri. They responded to a question by saying that they had been working on this for 4 years and had been implimenting it for 14 months. Suggestion for campaign name: Clip the Clipper! Mailing List: No CPSR, etc. were not involved as a cabal supporting this dingbat proposal. If you beliueve that then go back to reading your endless JFK/CIA/Mafia/aliens conspiracy theory books and let the rest of us go on living in the real world. They have put together a very slick electronic media blitz here, sending the proposal to every applicable newsgroup etc. Dave Banisar CPSR Washington Office

2 1

Hellman cogitates on the Clipper Chip
by jwarren＠autodesk.com 18 Apr '93

18 Apr '93

Received this on Saturday and got Marty's permission to repost it to 'punks. --jim ======

1 0

CLIP: Chip -- Modification?
by Doctor Zaphod 18 Apr '93

18 Apr '93

I havn't waded thru the entire stream of CypherPunks mail yet... but I thought I'd make a suggestion. If the clipper chip DOES in fact become widespread, in telephones, modems, whatever.. why don't we make an alternative chip [say.. based off the IDEA cypher and PGP keys] that uses the same pinouts as the Clipper chip. We, on the list, have been waiting for devices with the capability for encryption.. and it sounds as if ATT will be making it easier for us! Of course there might be some legal conflict with modifiying the devices.. and I think that's where our battle begins. --------------------------------------------------------------------- | DrZaphod | Stop, or I'll Encrypt! | | [AC/DC] / [DnA][HP] | Xcitement is Technology and Creativity | | [drzaphod(a)ncselxsi.uucp] | [Mind Police Censored] | --------------------------------------------------------------------- DrZaphod [AC/DC] / [DnA][HP] [drzaphod(a)ncselxsi.uucp] Technicolorized

1 0

IMPORTANT!
by hal＠alumni.cco.caltech.edu 18 Apr '93

18 Apr '93

Based on some of the suggestions I've seen here and on the net, I am inclined more to believe that there is no threat to make non Clipper cryptography illegal. The plan instead is to make it a de facto standard for all encrypted voice communications. You will notice in the AT&T press release posted here that AT&T is offering to release its technical information in order to allow this standardization to proceed. (As the release said, you need more than just a common encryption standard, you also need standardization on the voice encoding.) AT&T is obviously in bed with the government on this, and it doesn't really matter at this point why. It's a big company and the government can do a lot for it. AT&T is apparently determined to take whatever steps are necessary for this standardization to come about. As far as non-clipper encryption, I imagine the government will initially exert as much influence as it can to prevent any competing standard from getting a toehold. They have apparently waited until the chips were ready to deliver in quantity. AT&T is promising to release clipper phones later this year. It's doubtful that anyone else could even come up with a standard that soon, let alone get it into hardware (or firmware). If the standard does become established, it could be tough to defeat it. How easy is it going to be to sell a phone which is incompatible with everybody else's for secure communication? You'd have to buy one for everybody in your company or group who wanted to communicate. Then if they wanted to make a secure call to someone outside (say, a supplier or distributor) they wouldn't be able to do it. It would be a similar problem to the video phones. Why buy one when almost no one else has one and so you can hardly ever use it? Who will buy a Beta VCR today? An RCA non-laser video disk? Non-clipper encrypted phones may experience similar lack of success. I think this is their main strategy. If it doesn't work, they have a fallback before they would have to forbid encryption in the way we have feared. That is to forbid the sale of commercial devices with non-clipper encryption. You don't stop private individuals from making their own devices, you just make it illegal to sell them. There is precedent for this, I think, in the scanner business. You can't sell scanners capable of eavesdropping on cellular calls. But nothing stops you from building your own if you are an electronics whiz. (I am not expert on the legalities of scanner law. Someone please correct me if I am wrong here.) Notice that in their document they said that U.S. citizens do not have the right to unlimited-strength commercial encryption. I didn't pay much attention to the word "commercial" before, but now I think it is important. This would imply that their next step would be to ban only commercial implementations of cryptography. This way they can counter our civil-liberties arguments by saying that nothing stops anyone from encrypting his messages if he really wants to; he's doing it in the privacy of his own home, after all. But when he gets out in the commercial arena the government has many precedents for limiting what is bought and sold, the scanner laws being just one of many. I'm not sure how ominous such a world would be - clipper chips dominating the (small) encrypted phone market, no commercial competition, and only a few hobbyists with PC's and modems able to set up clumsy untappable conversations via modem-to-modem links. I might be able to talk to Tim May securely, but not to Mom and Dad. In a way, I can still have privacy, if I really want it. But it won't be available to most people. I wouldn't be surprised if something similar to this vision were the goal of those behind the clipper. Hal

1 0

clipper
by Timothy Newsham 18 Apr '93

18 Apr '93

smb(a)att.com has created a newsgroup for clipper conversation. alt.privacy.clipper I believe. I think it would be best (in keeping traffic here down and in getting everybody interested in clipper together) if everyone uses that newsgroup for clipper topics if possible.

1 0