July 1993 - cypherpunks-legacy

MEET: Boston Area meeting
by Derek Atkins 21 Jul '93

21 Jul '93

I would like to hold a meeting on the second saturday in August, the 8th, to corespond with the California meeting. I can get a room at MIT unless someone else has a better place. Also, can people give me topics for the agenda? I'm sure people have things they want to talk about. Send agenda items to me, directly. Send problems/questions/place suggestions to the list. -derek

1 0

Encrypted data across international lines
by gdale＠apple.com 21 Jul '93

21 Jul '93

Does anybody have pointers to the actual statutes prohibiting transmitting encrypted data across international boundries. I had an argument with somebody who didn't think this was illegal. I'm pretty sure you need special permits (export licenses??) for this. _________________________________________________________________________ Geoff Dale -- insert standard disclaimers here -- gdale(a)apple.com -- How am I posting? -- To comment on this Apple Employee's posting etiquette call 1-800-373-9821

2 1

subliminal messages
by Karl Barrus 21 Jul '93

21 Jul '93

-----BEGIN PGP SIGNED MESSAGE----- Eric Hughes just told me some extremely interesting information concerning subliminal channels and the DSS. Apparently, the DSS is very hospitable towards subliminal channels. (I won't summarize further since Eric may have posted to the list). Again: a subliminal channel is a channel in which an external observer is unaware of communication. For example, two prisoners want to communicate. The warden agrees if the messages are plaintext. The prisoners agree if they can authenticate (digitally sign) the messages - - after all, the warden may try to spoof them. The warden agrees to this arrangement (for instance, after reading up on digital signatures in Denning's book, which doesn't cover subliminal channels!), allowing the prisoners to embed their true communication in the digital signature of their plaintext messages. Before showing an example El Gamal subliminal channel, I'll briefly describe El Gamal's authentication scheme (since most people are familiar with or have heard of the RSA method only). In El Gamal's scheme (from Seberry and Pieprzyk's "Cryptography: an Introduction to Computer Security"): 1) Alice chooses p a prime, g a primitive element of GF(p), r a random integer. Loosely, g (being primitive) can be used to generate the rest of the field GF(p) by exponentiation. 2) Alice calculates K = g^r mod p Alice publishes (K,g,p) as the public key 3) a message M is authenticated by first choosing a second random integer r' such that r' and p-1 are relatively prime Alice computes X = g^r' mod p Alice solves M = rX + r'Y mod p-1 for Y Alice sends (M,X,Y) to B and keeps (r,r') secret 4) Bob can verify the message M by calculating A = K^X X^Y mod p and only accepts the message as authentic if and only if A = g^M mod p The example in the book is (I'm not sitting at a NeXT at the moment, the only place it's convenient for me to use Mathematica, or I'd use some larger numbers): Alice chooses p = 11, g = 2, r = 8 Alice computes K = g^r mod p = 2^8 mod 11 = 3 Thus (K,g,p) = (3,2,11) Say the message is M = 5 Alice chooses r' = 9. GCD(r',p-1) = 1, so they are relatively prime Alice computes X = g^r' mod p = 2^9 mod 11 = 6 Alice solves M = rX + r'Y mod p-1 for Y 5 = 8*6 + 9*Y mod 10; yeilding Y = 3 Alice sends out the triple (M,X,Y) = (5,6,3) to Bob. Note: M can be read. Bob now has (M,X,Y) = (5,6,3) and the public key (K,g,p) = (3,2,11) Bob calculates A = K^X X^Y mod p = 3^6 6^3 mod 11 = 10 Bob calculates g^M mod p = 2^5 mod 11 = 10 So, since A = 10 and g^M mod p = 10, the message is valid. Again, when I have a chance I'll plug in much larger numbers so you don't think it all works out by coincidence. In the El Gamal subliminal channel, somehow the random integer r is known by both parties. So Alice and Bob agree on a random r before they ever find themselves in the position of using a subliminal channel. 1) Alice chooses p, g as before. She chooses the r that she and Bob share. She calculates K as before. 2) Alice calculates the subliminal message m, using a plaintext message M, by calculating X = g^m and solving the following equation for Y: M = rX + mY mod (p-1) 3) Alice send (M,X,Y) to Bob. 4) Bob receives (M,X,Y) and knows (p,g) which are public and the secret r he shares with Alice. 5) Bob calculates A = (g^r)^X X^Y mod p and accepts the message M as authentic if A = g^M mod p (as before in El Gamal authentication). 6) Now Bob extracts the subliminal message by computing m = Y^-1 (M - rX) mod (p-1) As before, (K,g,p) = (3,2,11) is public. r = 8 is the shared secret. Alice wants to send m = 9, using the plaintext message M = 5 Alice computes X = g^m mod p = 2^9 mod 11 = 6 Alice solves 5 = 8*6 9Y mod 10 for Y; Y = 3 Alice sends (M,X,Y) = (5,6,3) to Bob. Bob computes A = (2^8)^6 6^3 mod 11 = 10 Bob computes g^M mod p = 2^5 mod 11 = 10 These are equal, so Bob accepts the message. Now, he extracts the subliminal message: m = Y^-1 (M - rX) mod (p-1) = 3^-1 (5 - 8*6) mod 10 = 9. So, it is possible to communicate information with subliminal channels. A real life example where this could occur is with ham radio operators. Encrypted messages are illegal, but checksum message can be transmitted, so the checksum can be modified to include a subliminal message. I'm just pointing this out for theoretical interest - I know it's illegal! Now, back to subliminal messages and the DSS. Suppose the government decides to authenticate the information on your driver's license with DSS. All sorts of information can be included subliminally, such as an arrest record, number of speeding tickets, if the person in question is suspicious, etc... -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLEyIroOA7OpLWtYzAQE95gQAmrCoIB0lWTbBUOcayev0HvKUoAyz2dT4 FSbqi65oytE+EA2RhY9BHOFeRuA8yF97Dm+tTunOUYlA3CTlGRvmfxdA98TuGD7X otmr0qVPJlAFsW7xqm8sJq09mozM+NMONwQJTOObaEr9UzPsgGeyGs4RVz3h29Qp nvxCopYQy6A= =4kzu -----END PGP SIGNATURE-----

3 2

Simmons Subliminal channels and more...
by Peter Wayner 21 Jul '93

21 Jul '93

I too received a copy of Gus Simmons paper in the mail and I called him on the phone to discuss it with him. He sent me a copy of his latest version of the paper. The significance of the paper is that it is possible to use the DSS algorithm to send messages disguised as signatures. The specs for the DSS used by NIST required that it could not be used to hold secrets. This would make it more exportable and this was one of the reasons why RSA was not chosen as the DSS. On a more philosophical level, it shows that the DSS and the El Gamal system really aren't signature systems. They convey extra information. That means that they really aren't that different from RSA on a functional level. The easiest way to understand how the message passing system works is notice that the DSS uses a random number to compute the signature. If we could somehow recover this number, then we could have the information. What's the simplest hidden way to send a message? Let's say that you want to send a bit. Just keep rerunning the algorithm with different random numbers until the right parity appears. The real approach is more sophisticated than this. My personal feeling is that this shows how utterly impossible it is to keep secret bits from hiding in the noise of the world. If the NSA can't do it, then there is a good chance that no one can. -Peter

1 0

Simmons...
by Peter Wayner 21 Jul '93

21 Jul '93

I have no idea about the reason behind his departure from Sandia, but I did note with curiosity that Sandia refuses to forward mail to him. This may be Standard Operating Procedure at secure sites, but the Journal of Cryptology reported this in its latest issue. He is still an editor. -Peter

1 0

Re: Remailers/PayPhones and Today's NYT
by smb＠research.att.com 21 Jul '93

21 Jul '93

I thought it was interesting that the danger of untraceable drug dealers popped into the reporters mind when they were researching the article. After all, they don't tend to mention illegal problems when they speak about used car dealers or other services. Well, the article said that some of the phone store operators raised the issue, often defensively. Even if the reporter didn't know about the issue beforehand, they sure knew after that. Also note that part of the market for such stores is that NY Telephone has cut off some payphone service in certain areas, thereby sensitizing the reporter to such questions.

1 0

chicago area cypherpunks
by Brian D Williams 21 Jul '93

21 Jul '93

Samuel Pigg posts: >Is there a Chicago area cypherpunks group/meeting time/place? >(or have I just not been paying attention..?) There is no current group/meeting that I know of, but we could start one ( don't let the well.sf.ca.us fool you, I work in Downtown Chicago) any other Chicago area cypherpunks? Brian Williams

1 0

Subliminal Channels in the Digital Signature Algorithm (DSA)
by tcmay＠netcom.com 21 Jul '93

21 Jul '93

The recent discussion of possible subliminal channels (which some call covert channels) in the DSA reminds me of a preprint of a paper I received several months back with a rather mysterious note attached to it. There was no return address on the envelope. Apparently a number of Cypherpunks and folks active in the sci.crypt community also received it, as it came up on sci.crypt and we talked about it at a physical Cypherpunks meeting. The note read: "This needs to be made very public. Simmons resigned from Sandia over writing it." Some caveats: * this allegation that Gus Simmons left Sandia was denied by several folks on sci.crypt who actually _know_ Simmons. I don't know him, so I haven't checked directly. * some say this paper is hardly earth-shaking, though the possibility of subliminal channels should be taken seriously, especially in light of the cross-licensing of DSA/DSS with Public Key Partners (RSA Data, etc.). * I don't even know where this paper is being published--the preprint gave no clues. The timing of my getting it, several months back, suggests this year's Crypto Conference. The advance program ought to have it (I can't find my copy). I've OCRed the first page or so, including the Abstract. Too many OCR errors and too many equations with Greek symbols for me to scan-in the entire 20-page paper. The implications for Clipper, Capstone, Skipjack, etc. I'll leave for now. Here it is: The Subliminal Channels in the U.S. Digital Signature Algorithm (DSA) Gustavus J. Simmons Sandia Park. NM 87047. USA Abstract Since the DSA is derivative from El Gamal's digital signature scheme--which Simmons showed in 1985 permitted a subliminal channel--it should come as no surprise that the DSA also permits a similar channel. The subliminal channel in the El Gamal scheme, however, had several shortcomings. In order for the subliminal receiver to be able to recover the subliminal message, it was necessary for him to know the transmitter's secret key. This meant that the subliminal receiver had the capability to utter undetectable forgeries of the transmitter's signature. Also, only a subset of the desired message set could be communicated subliminally (phi (p-l) messages instead of p-1) and some of those that could be transmitted were computationally infeasible for the subliminal receiver to recover. The subliminal channels in the DSA avoid all of these difficulties! In fairness, it should be mentioned that not all are avoided at the same time. The channel in the DSA analogous to the one Simmons demonstrated in the El Gamal scheme can communicate messages conveying the full log-base-2 |X| bits, where X is the set of session keys; all of which are easily recovered by the subliminal receiver. However, this broadband channel still requires the subliminal receiver to know the transmitter's secret key. There are two other narrowband (<< 1og-base-2 |X|) subliminal channels in the DSA that do not give the subliminal receiver any better chance of forging the transmitter's signature than an outsider has. The price one pays for this integrity for the transmitter's signature is a reduced bandwidth for the subliminal channel and a difficult but feasible (dependent on the bandwidth actually used) amount of computation needed to use the channel. Two quite different such channels have been devised: one places the computational load almost entirely on the transmitter, the other almost entirely on the subliminal receiver. Since the total computation is essentially the same in either case, the choice of a particular channel would be based on which end is best equipped to do the necessary computation. To make clear what a remarkable coincidence it is that the apparently inherent shortcomings of subliminal channels using the El Gamal scheme can all be overcome in the DSA, we will analyze each of the channels implemented in both schemes. The inescapable conclusion, though, is that the DSA provides-the most hospitable setting for subliminal communications discovered to date. Introduction In 1983 Simmons introduced the notion of a subliminal channel existing in an encrypted communication channel by pointing out that if for each plaintext there existed two or more corresponding cipher texts, the identity of the cipher used to communicate a plaintext could convey information additional to that revealed by the decryptlon of the cipher [5]. In particular, in a public-key based authentication scheme in which the decryption key must be public information in order for public receivers to be able to decrypt cipher texts and verify the authenticity of the encrypted plaintext, this raised the possibility of there also being subliminal receivers who could recover information hidden from the public receivers: hence the name of a subliminal channel. Clearly subliminal channel receivers must have private information not known to public receivers--and as we will see, the nature of this private information provides a natural classification for subliminal channels. (rest of paper not OCRed...too many errors (blurred fonts), too many equations)

1 0

Re: Congressional contacts list
by mbl＠mail.msen.com 21 Jul '93

21 Jul '93

Just thought I ought to let you know... Carl Pursell (R-MI) is gone. I know because I worked on his opponent's campaign. You might want to advise the source of the list about that. (There are most likely more, but I don't know about them personally.) -- Matthew B. Landry | mbl(a)mail.msen.com President of Project SAVE | (313)971-5469 (H/W) My opinions are my most prized posession. I don't share them.

1 0

Re: Thoughts on remailers
by peter honeyman 21 Jul '93

21 Jul '93

pay phones and postal mail are also "perfect for those who would harrass and abuse others." peter

2 1