August 1993 - cypherpunks-legacy

Re: Clipper trapdoor?
by smb＠research.att.com 12 Aug '93

12 Aug '93

Consider the following hypothetical: Iraqi agents smuggle Clipper phones out of the U.S. Saddam Hussein uses them to communicate with his military commander in Basra. NSA intercepts the communications. Question: How does NSA decrypt the messages? You raise a valid point. I think there are several possible answers. First, of course, since the key escrow mechanism has not yet been established, an exception could be written into the procedures. (And whether they would be established by law or executive order remains to be seen.) There might be some clause saying, ``NSA may have access to escrowed keys, provided that they certify that the targets of their surveillance are foreign powers, as defined in the FISA. If, upon decryption, it is determined that a U.S. citizen's conversations have been intercepted, the procedures of the FISA for such eventualities will apply.'' Yes, they could abuse such a clause -- but by that logic, they could be listening in to cleartext domestic phone calls today. (And of course, there have been such abuses.) A second possible answer is for export phones to come from a separate production run, using a different family key. These would be export-only, and you'd never get a license to export a ``secure'' model. For U.S. residents to make an encrypted phone call to such a site, either they, too, would need such a phone, or they need some way to interoperate with a phone with a different family key. The obstacle there is the verification procedures such phones have, to guard against bogus narc headers being inserted. I'm not certain whether or not such a solution can be found. --Steve Bellovin

1 0

final post
by Kragen Sittler 11 Aug '93

11 Aug '93

Looks like the sands of time are running out on my account. If there is someone here who can inform me of a service provider for internet access in Albuquerque, NM, tell me about it. It's been nice being here and listening to the discussion, even contributing occasionally. Hopefully I wasn't too shy or too mouthy. See y'all in my next account. Kragen Xentrac finger me for other contact points.

1 0

cypher punks (fwd)
by Warren Keith Russell 11 Aug '93

11 Aug '93

---------- Forwarded message ---------- Date: Tue, 10 Aug 1993 17:16:21 -0700 From: Kevin Kelly <kk(a)well.sf.ca.us> To: keru(a)cpu.us.dynix.com Subject: cypher punks I heard you were asking about online versions of Levy's WIRED article. I'm the editor of WIRED. It's available in an e-text version in the WIRED folder on American Online, but not elsewhere at the moment. In a few months WIREDs' gopher site will be up. My own article in WER is not yet ready for ftp world. I'm finishing a book of which that is one chapter, and I need to focus on that before geting stuff up on the net. -- Kevin Kelly kk(a)well.sf.ca.us

1 0

voluntary compliance
by fnerd＠smds.com 11 Aug '93

11 Aug '93

An interesting statement from the Skipjack proponents is that its use will be voluntary, and there's nothing that the citizen using it will be required to divulge (he doesn't even know the key and they do), and therefore no one's rights are being violated. Assume for the moment that that will remain true. They just want to encourage voluntary compliance. This is an interesting point. How much encouragement counts as coercion? Is it okay if they tax a dollar from a million people and offer the million to you for your information? Is it okay if they make it illegal to sell non-compromised phones (i.e., you don't have to use Skipjack, you can go unencrypted or roll your own)? These people are purposely, avowedly, trying to "encourage" us to do something they have no legal right to require. Why is that okay? Other than asking us as "good citizens" to do something, how is slanting the incentives okay? Do we have the right not to be nudged? -fnerd quote me

2 1

Clipper trapdoor?
by David Sobel 11 Aug '93

11 Aug '93

Clipper trapdoor? Peter Wayner <pcw(a)access.digex.net> writes: >My general impression is that the system is secure. Many people >have played paranoid and expressed concerns that the classified >algorithm might be hiding a trapdoor. It became clear to me that >these concerns were really silly. There is a built-in trapdoor >to be used by the government when it is "legal authorized" to >intercept messages. The NSA has rarely had trouble in the past >exercising either its explicitly granted legal authority or >its implied authority. The phrase "national security" is a >powerful pass phrase around Washington and there is no reason >for me to believe that the NSA wouldn't get all of the access >to the escrow database that it needs to do its job. Building in >a backdoor would only leave a weakness for an opponent to exploit >and that is something that is almost as sacrilidgeous at the NSA >as just putting the classified secrets in a Fed Ex package to >Saddam Hussein. This raises an interesting question and I draw a totally different conclusion. If, as we have been told, the only way for an agency to obtain the escrow keys is to present a court order, than NSA needs to obtain such an order to decrypt *any* communication it intercepts. I don't really understand what Peter means when he says that "NSA has rarely had trouble in the past exercising either its explicitly granted legal authority or its implied authority. The phrase 'national security' is a powerful pass phrase around Washington and there is no reason for me to believe that the NSA wouldn't get all of the access to the escrow database that it needs to do its job." Does this mean NSA would, in fact, obtain a warrant in order to "get all of the access to the escrow database that it needs to do its job"? If so, this would represent an unprecedented change in the way NSA does "its job." NSA has no domestic law enforcement authority, so it would obviously never be in a position to obtain a law enforcement wiretap warrant under Title III. The only possible way for NSA to obtain a warrant would be under the Foreign Intelligence Surveillance Act (FISA). But the Foreign Intelligence Surveillance Court, which issues warrants under FISA, has ruled that FISA's provisions limit the authority to conduct electronic surveillances to the U.S. in a geographic sense as defined in sec. 101(i). The drafters left to another day the matter of "broadening this legislation to apply overseas ... because the problems and circumstances of overseas surveillance demand separate treatment." In the Matter of the Application of the United States for an Order Authorizing the Physical Search of Nonresidential Premises and Personal Property (1981), footnote 1 (citations omitted). Consider the following hypothetical: Iraqi agents smuggle Clipper phones out of the U.S. Saddam Hussein uses them to communicate with his military commander in Basra. NSA intercepts the communications. Question: How does NSA decrypt the messages? Note that neither Title III (law enforcement) nor FISA (U.S.-based) apply to this situation, so we have to assume that NSA will not have a court order to obtain the escrow keys. I have to conclude that NSA would not be putting this technology out into the world *unless* it did, in fact, have some way to decrypt messages *without* access to the escrow keys. Am I missing something? David Sobel CPSR Legal Counsel

3 2

re: Secure voice software issues
by thug＠phantom.com 11 Aug '93

11 Aug '93

Paul, I noticed you mentioned that you will be using key rings in your cryptophones, so here's an idea I think would be great for cryptophones. This is a simple solution to the key-exchange problem. Cryptophone users would not need to exchange keys beforehand nor need to store other people's public keys on their cryptophone. - Every cryptophone user has a public and private key pair (like in RSA or PGP) - When a person calls another person, the phones automatically exchange their public keys before the voice conversation begins. Obviously the private keys are never transmitted. With this method, all one needs to initiate a secure telephone conversation is the phone number of whoever you're calling, just like using a regular telephone. I am assuming this is how Clipper/Skipjack phones would do this. I hope your cryptophone software does this as well, since I don't want to or need to keep keyrings full of public keys of everyone I might ever have to call. Thug

5 7

Re: Clipper trapdoor?
by peb＠PROCASE.COM 11 Aug '93

11 Aug '93

>Note that neither Title III (law enforcement) nor FISA (U.S.-based) apply >to this situation, [...] >I have to conclude that NSA would not be putting >this technology out into the world *unless* it did, in fact, have some way >to decrypt messages *without* access to the escrow keys. Which is why they probably already have a draft for a bill to get escrowed keys without a warrant for national security reasons. They would want the whole escrow process set up before they announce this, of course. If they can't get this kind of bill passed, then they probably will not approve the technology for export. Alternatively, the escrow process may be written with specific wording that it applies only to US citizens leaving a convenient escrow process trap-door. This makes the Privacy Clipper difficult to sell overseas, but specially made chips for export might be compromised anyway with weak random seeds. Paul E. Baclace peb(a)procase.com

1 0

Re: Software Patent Institute
by norm＠netcom.com 11 Aug '93

11 Aug '93

I am interested in the issue of patenting ideas that have already been put into practice or that would be obvious to any of many practitioners. I have a patent and my patent attorney included in the ideas that were not new. We were not motivated to spend the time and money to revise the patent to avoid this. The patent examiner had little experience in programming and missed the old ideas. I would be curious to know what software patents exist and the outcome of any court fights to overturn patents on ideas that were indeed not new. I am not good a keeping track of publications where I have learned of ideas but I often do know people who were using various ideas going back to 1955 when I began programming professionally. I do not know very much about patent law but I understand that IBM, for instance, regularly publishes "Technical Disclosures" which is mostly comprised of the work products of IBM patent attorneys when they have decided that it is not worth the expense of patenting some particular idea. It would be good to have a public repository of programming ideas that are good but not worth patenting. Let me know how I can help.

1 0

Re: How long would it take?
by smb＠research.att.com 11 Aug '93

11 Aug '93

Its generally unwise to make the assumption that the only possible attack on your conventional scheme is a brute force attack. Certainly the attacks used on many previous generations of cryptosystems were never brute force -- and certainly every generation of naive cryptographer has said "well, using brute force it would take N years to break my cypher". A simple vingenere cypher with a 12 letter key would seem to be very strong indeed (stronger than DES), and yet we know you can break one in a few moments because there are better attacks than brute force. We have suprisingly little in the way of general theory on what would or would not make a conventional cryptosystem strong. Certainly differential cryptanalysis will not be the last thing people come up with. Until we know everything the NSA knows, I will be hesitant to say "unless something better comes up" and more comfortable saying "until something better comes up." Indeed. The key length is a worst-case analysis for the cryptanalyst; they can do no worse than that. We can be confident that NSA has cracked DES because an exhaustive search engine is within their means, but we don't know how much better they can do. A while back, Shamir gave a talk on differential cryptanalysis here at Murray Hill. He mentioned Coppersmith's letter, which said that IBM knew about differential cryptanalysis back when they built DES, and they designed it to resist the attack. That's obviously the case -- so Shamir said that he asked Coppersmith to state that in the intervening 18 years, IBM had not come up with a stronger attack on DES. Coppersmith was silent, from which you can draw any conclusions you wish.

1 0

Re: Secure voice software issues
by hfinney＠shell.portal.com 11 Aug '93

11 Aug '93

A couple of comments on the cryptophone idea. First, there has seemed to be general agreement in our earlier discussions of this concept that the hard part is compressing the voice to the point where it can go over commonly-available modems. The government-standard CELP algorithm is too slow for general-purpose home computers. You need an algorithm that can operate in real time and compress intelligibly down to about 13K bits per second. It has to be either able to compress and decompress simultaneously or else you need some switching logic to decide which person is talking and which is listening at each moment, with both sides reversing roles in synchrony. Second, Diffie-Hellman key exchange will probably take about as long as an RSA decryption with similar modulus sizes. So speed would not seem to be a reason to choose DH over RSA for key exchange. If PGP is slow on your machine, DH will be, too. Hal Finney hfinney(a)shell.portal.com

1 0