December 2003 - cypherpunks-legacy

Re: HACK - U HAVE NO PRIVACY
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Please tell me you posted this as a joke and didn't even contemplate it for a microsecond! Haven't you ever heard of Craig Shergold? Say, you're not the same lefty who's listed in the alt.syntax.tactical FAQ are you? G

1 0

Re: no subject (file transmission)
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

See Tim May's "blacknet" spoof from last year. Anonymous mail pools have been the subject of long discussions. We were talking about it just last week actually - I pointed out that with suitable newsclip software you didn't even need a designated pool group. G PS I got thrown off the machine I was using to run the newsclip stuff on, so no more experiments with that for a long time...

1 0

The Delhi Detweiler
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

gtoal(a)an-teallach.com (Graham Toal): > PPS While in paranoid mode, I thought I'd mention that I've noticed > some of Detweiler's mannerisms emanating from email in New Delhi of > all places. Weird. I think I must be cracking up. I've been worried myself, BBSes here have had a number of posts against those who oppose our Government's recent moves to be nasty to BBSes. The style of these posts is very Detweiler; maybe you can now get a degree in Detweilerese? Or did you mean me ;-) -------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Fairness to Game Animals Association says: Support your right to arm bears! --------------------------------------------------------------------------

1 0

IMP (was Re: ecash-info (
by Duncan Frissell 17 Dec '03

17 Dec '03

H > 2.) It seems to me that that e-cash, contrary to the status quo's H >thinking, H > is *critical* to internet commerce. H > H >No, it's not critical. Some form of transaction mechanism is H >critical. Privacy is not critical to the bulk of the economy, H >though. Face up to it. If it were, it would be so obvious that we H >wouldn't be discussing it on a mailing list. In fact, _we_ wouldn't be H >discussing it, but rather a whole bunch of bank vice presidents. The nicest thing about electronic money is not that anonymous digital cash is possible. but that the money is electronic. This means cheap transaction costs. This means that even if "banks" deploy ID-based rather than anonymous transaction systems, civilians can quickly step in and offer to broker anonymous transactions for those who prefer their privacy. Just as you can cash checks for other people today, you will be able to carry out transactions for others on the nets. Since it is much easier to operate these kinds of services in an electronic payment system with automation and on-line verification, suppliers should appear if the demand warrants. Since people will be in different physical locations and legal jurisdictions proof of wrong doing will be hard to come by. DCF "It is perfectly possible to overthrow the old order without picking up a gun or violating any (significant) law. If the conditions of human life change as radically and rapidly as they seem destined to, the (always bizarre) notion that groups of small oligarchies are competent to run the lives of everyone on earth will be swept aside almost accidentally as people move into their new lives." -- DCF --- WinQwk 2.0b#1165

1 0

more info from talk at MIT yesterday.
by sommerfeld＠localhost.medford.ma.us 17 Dec '03

17 Dec '03

The folks from the NSA said the following about key generation: - each escrow agency provides a "seed key", seed1 and seed2 - the box which programs the chip generates two random keys, random1 and random2 - for each chip programmed during that batch (which is "12 to 14 hours of production"), the box computes a classified deterministic function (U1, U2) = F(serial, random1, random2, seed1, seed2) to generate the unit keys They did *not* explicitly say that the random seeds were destroyed at the end of the production run. Also, someone asked "How do we know that the unit key isn't a hash function of the chip serial number?" The answer was: "You don't". They also confirmed Tom Knight's suspicions about what they're going to do when someone reverse engineers the chip and publishes the Skipjack algorithm & the family key: they've got a patent application filed, under a secrecy order; if the algorithm is published, they'll lift the secrecy order and have the patent issued, and use that to go after anyone making a compatible version. They also had a comment that they considered Blaze's findings to be mostly irrelevant, as the only people who would use it would be persons who *didn't* trust the escrow system, but *did* trust the algorithm... - Bill

6 7

Re: Faster way to deescrow Clipper
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > ...not be able to decrypt the communications, but they still get your ID. > >"your ID"? You mean your phone's ID. Goodness gracious, if you were > >a criminal, you wouldn't go out and steal someone else's Clipper > >phone, would you? Let's not get too high tech here, just because we > >have the ability. > > Or you could just steal someone else's LEAF, by keeping a copy of it, and use > that for spoofing. Then you could have a valid IV too... The IV is session-dependent, and both ends generate it. We don't know where in the LEAF the chipid is, but if they use a fixed format and don't do a key-dependent permutation of the LEAF bits, it shouldn't be hard to figure out (unless the checksum comes first and they use a block-chaining encryption, in which case you know you lose.) That would let you create rogue LEAFs with known users' chipids, which would be interesting - does anyone want to make 65536 calls to clipperphone(a)whitehouse.gov :-) ? (Yeah, it's not quite that simple.) (If you do need a lot of data, cellphones are a good source, since the cellphone operators' chipids are likely to be wellknown, though rapidly tapped.) Paranoid-speculation-mode: Of course, if you can forge LEAFs with their chipid, they can forge LEAFs with yours, which could be used to manufacture interesting evidence.... Bill

2 1

Re: more info from talk at MIT yesterday.
by werner＠mc.ab.com 17 Dec '03

17 Dec '03

>Date: Fri, 03 Jun 1994 10:36:37 -0400 >From: "Perry E. Metzger" <perry(a)imsi.com> > >Since when can the government patent its work? I thought that works >produced by government agencies could not be copyrighted or patented. I'm not sure of the details, but I know the law in this area was changed during the Reagan administration to unfetter U.S. companies who had done research that was partially govt. funded. Under the old rules, foreign companies could take advantage of work that could not be patented or otherwise protected by trade secret. Thus, technologies that were developed through govt.-funded work were acquired for free and used against the U.S. in global economic competition. Not sure about work that is completely government-produced, but what did the government ever come up with all on its own, anyway? I do know that my company is currently engaged in several joint projects with the government as a result of the new regulations, and part of the deal is that we retain the rights to the inventions. tw

1 0

Re: more info from talk at MIT yesterday.
by smb＠research.att.com 17 Dec '03

17 Dec '03

Bill Sommerfeld says: > They also confirmed Tom Knight's suspicions about what they're going > to do when someone reverse engineers the chip and publishes the > Skipjack algorithm & the family key: they've got a patent applicatio n > filed, under a secrecy order; if the algorithm is published, they'll > lift the secrecy order and have the patent issued, and use that to g o > after anyone making a compatible version. Since when can the government patent its work? I thought that works produced by government agencies could not be copyrighted or patented. The government can patent things, but not copyright them. In any case, they cannot refuse to license a patent, so this isn't real protection anyway. (The hope behind people patenting things they may release in the future is to make it commercially less attractive, not to utterly prevent use.) Why can't they refuse to license a patent?

1 0

Re: more info from talk at MIT yesterday.
by Perry E. Metzger 17 Dec '03

17 Dec '03

smb(a)research.att.com says: > Why can't they refuse to license a patent? I was under the impression that the law obligated you to license patents -- albeit not necessarily at an attractive price. I am quite likely to be mistaken on this -- my memory on the topic is very sketchy, as demonstrated by the fact that I didn't realize the government can patent things (although I was right on copyrights.) Perry

1 0

Re: no subject (file transmission)
by f_griffith＠ccsvax.sfasu.edu 17 Dec '03

17 Dec '03

Date: Thu, 2 Jun 1994 17:58:38 -0700 > From: nobody(a)shell.portal.com > > Attn Pr0duct Cypher > -----BEGIN PGP MESSAGE----- > -----END PGP MESSAGE----- > >Now that's an interesting idea for contacting people anonymously. However, it would have been kinder to the rest of the list members to put Attn Pr0duct Cypher in the subject.

1 0

Re: more info from talk at MIT yesterday.
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Bill Sommerfeld says: > > They also had a comment that they considered Blaze's findings to be > > mostly irrelevant, as the only people who would use it would be > > persons who *didn't* trust the escrow system, but *did* trust the > > algorithm... Defense Messaging System is supposedly going to use Skipjack, so I assume it's reasonably secure - and if there *are* NSA-only backdoors in the algorithm, at least they won't be admitting it to your neighbor hood cops and FBI wiretappers, so you'd have to be an *interesting* suspect to get cracked. Bill

2 1

Re: Black Eye for NSA, NIST, and Denning
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Perry writes: > > However, it can be done in advance, and you can conceivably reuse > > forged LEAFs. > > I will point out something that I didn't quite understand myself but > have since discussed with Matt Blaze in some detail -- LEAF checksums > are tied to session keys. You CAN do this in advance but only if your > key exchange will permit you to generate your session keys in advance, too > Obviously, reusing forged LEAFs requires reusing session keys. More precisely, as Steve's summary pointed out, it's tied to the IV, which is tied to the session key. (It makes sense - assuming the descriptions of the LEAF contents are true, the only session key component in the LEAF itself is encrypted with the chip-unique backdoor key, and tying it to the IV accomplishes key-dependence, though they could also use the session key externally from the LEAF.) Unfortunately, most Clipperphones will probably use Diffie-Hellman key exchange, since it reduces or eliminates the need for prearranged public-key management (depending on whether they're using radio or a medium that can be actively wiretapped), so precomputation will generally not be usable. I suppose some crude Diffie-Hellman implementations might always use the same half-key for every conversation, rather than generating a random one each time, and you could precompute session keys for talking to them. For email applications, however, most standards will probably use sender-generated session keys, so it would be simple enough to make secure Tessera mailers if you don't worry about subliminal channels in the hash. Bill

1 0

Re: more info from talk at MIT yesterday.
by smb＠research.att.com 17 Dec '03

17 Dec '03

> Bill Sommerfeld says: > > They also had a comment that they considered Blaze's findings to b e > > mostly irrelevant, as the only people who would use it would be > > persons who *didn't* trust the escrow system, but *did* trust the > > algorithm... Defense Messaging System is supposedly going to use Skipjack, so I assume it's reasonably secure - and if there *are* NSA-only backdoors in the algorithm, at least they won't be admitting it to your neighbor hood cops and FBI wiretappers, so you'd have to be an *interesting* suspect to get cracked. Not only that, there have been too many spies found in the various intelligence agencies for them to risk such a thing.

1 0

Re: Faster way to deescrow Clipper won't work
by sidney＠taurus.apple.com 17 Dec '03

17 Dec '03

Perry answered most of my questions with the new information that the checksum is a function of the IV and session key. That still leaves one big one unanswered: Doesn't the Clipper chip at the other end of the message have to compute and send a LEAF too? Otherwise there would be no way for the wiretappers to identify it. And that LEAF will contain the proper session key unless both ends are using the same hack. Also, what does Clipperphone have that the Tessera board doesn't which keeps this hack from working? Is enough known about the workings of the two so that someone could build a computer-based telephone using Tessera that would be compatible with Clipperphone yet use this hack? -- sidney <sidney(a)taurus.apple.com>

1 0

Re: Faster way to deescrow Clipper
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Sidney Markowitz writes: > If that's the case, then 1) How does the second chip find out what the > session key is? That's a separate protocol issue; Clipper doesn't do any key exchange itself, though Capstone does. Unless manufacturers are bullied/bribed into using a standard implementation, everyone will probably roll their own. > 2) Doesn't the second chip also have to generate and send a > LEAF, if for no other reason than to identify itself to the wiretappers, > and if so won't that give away the session key if that chip's device is not > also hacked? If you use the same session key for both directions of the conversation, which most Clipperphones probably will, then yes, it's true. That means you can only have private conversations with other people who also care about privacy, which is somewhat appropriate. On the other hand, a big use of Clipper is traffic analysis, and Matt's method *will* prevent them from getting your Clipper serial number from your conversations, though they'll get the number for the other end if they're not also hacking LEAFs. That can be a big win, especially if the other end is a well-known person, like your local cellphone provider or president(a)whitehouse.gov. However, one danger of doing this for cellphone calls is that they might notice that calls from your cellphone keep having different LEAFs, and suspect that you're a Potential Troublemaker. 3) If all that is needed for this hack is a LEAF with a proper > checksum, why go through the brute force method of generating random LEAFs? > Why not just buy (or steal or whatever) another Clippered device that you > never use for real communication so the wiretappers have no record of who > has that serial number, and get LEAFs from it? For that matter, why can't > you obtain one LEAF from listening to anybody's Clippered transmission and > use it over and over again? The LEAF depends on the IV for the session, which depends on the session key. Therefore, it's probably different for each call; otherwise you *could* just reuse someone else's LEAF. (This should be obvious, but I wasn't thinking about it when I first read Matt's paper, though the "but the IV will be wrong so that won't work" had been a sufficient distraction for many of us when CLipper first came out.) Remember that they don't record Clipper chip keys when you buy your Clipperphone - otherwise stealing one would be effective. They record the chip-unique backdoor keys when they make the chip, so they can tap *any* conversation they hear without needing to keep track of who owns what phone. On the other hand, for cellphones, it's *real* easy to find out who uses a given chip, since the phone call setup protocols tell them what phone it's coming from, and they _can_ look that up with the phone company, so they can easily do that correlation. (If the Clipper chips are socketed, you could always swap them for occasional more-paranoid-but-still-tappable calls, but that would probably just annoy them.) Bill

1 0

Re: News Flash: Clipper Bug?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > [ discussion of chip operations ] > > Where did you get the information about the internals? > I've seen no references at all. Back when Clipper was first announced, you could call up Mykotronx and ask them for data sheets on the chip. Don't know if they're still giving them out or not.

1 0

Ultra and Coventy
by smb＠research.att.com 17 Dec '03

17 Dec '03

Perry wrote that the British let Coventry be destroyed lest Ultra be revealed. Kahn doesn't believe that. From ``Kahn on Codes'', p. 110: Nor, to debunk another story, did Churchill let Coventry be destroyed because he believed that defensive measures would risk the secret of ULTRA. Critical analyses of documents show that this is pure myth. The footnote cites F.H. Hinsley with E.E. Thomas, C.F.G Ransom, and R.C. Knight, ``British Intelligence in the Second World War: Its Influence on Strategy and Operations'' (London, 1979- ), I:528-48; N.E. Evans, ``Air Intelligence and the Coventry Raid'', Royal United Services Institution Journal (September 1976), 66-73. I don't have access to either of those publications, so I can't assess that further.

3 3

Re: Faster way to deescrow Clipper
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> The defect in this notion that the LEAF is encrypted with the family > key, which is not public knowledge. The mode that this encryption is > performed in is not public knowledge, either. Yeah, that was brain damage on my part. My basic idea was that it is possible, for some chaining methods, to find out where in the LEAF the chipid is by watching what changes when you vary the keys and the chipids used, even if you *don't* have the Family Key or know the encryption mode, but the set of modes and component orders for which that works is more limited than I first thought. There are still some that work, though. Bill

1 0

Re: Faster way to deescrow Clipper
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>From: sidney(a)taurus.apple.com (Sidney Markowitz) > >Could someone please enlighten me on this: It seems from the descriptions >of the hack to fake a LEAF that 1) When two Clipper chips are going to >communicate, one of them generates the session key and sends a LEAF to the >other chip, 2) The second chip recognizes the LEAF as being valid based on >the validity of the checksum, but does not determine the session key from >the LEAF. The session key encoded with the unit key in the Law Enforcement Access Field is not recoverable. The unit key is only contained within the orignating clipper chip, and within the two escrowed key portions. >If that's the case, then 1) How does the second chip find out what the >session key is? An external key exchange in performed. In the case of AT&T TSD 3600s the key is negotiated between them blindly. > 2) Doesn't the second chip also have to generate and send a >LEAF, if for no other reason than to identify itself to the wiretappers, >and if so won't that give away the session key if that chip's device is not >also hacked? FIPS Pub 185 requires that clipper phones adhere to a protocol not contained within the FIPS, and requires transmission of the LEAF. > 3) If all that is needed for this hack is a LEAF with a proper >checksum, why go through the brute force method of generating random LEAFs? >Why not just buy (or steal or whatever) another Clippered device that you >never use for real communication so the wiretappers have no record of who >has that serial number, and get LEAFs from it? For that matter, why can't >you obtain one LEAF from listening to anybody's Clippered transmission and >use it over and over again? Using a constant unit ID even if the session key is not recoverable, still leaves you open to traffic flow analysis. Using a LEAF from another clipper chip still identifies you (or serves to flag interest). It would be a wise to assume that the adversary routinely decodes all LEAFs crossing their purview, recovering unit IDs. (Which would at least flag a lot of counterfeited LEAFS, were ID ranges or (as in IP) prefixes used.)

1 0

Anonymous Remailers
by ghio＠cmu.edu 17 Dec '03

17 Dec '03

Usura(a)vox.hacktic.nl wrote: >>> Has anyone had any experience chaining from a Cypherpunk-style >>> remailer to anon.penet.fi? Can a "::" separator be used >>> successfully, or which format will work? >> >>I think it can be done... > >I know it can be done... Well, some of the remailers will only send to naxxx(a)anon.penet.fi I think remailer(a)chaos.bsu.edu requires this. Jeff Davis <eagle(a)deeptht.armory.com> wrote: > Today I used the catalyst(a)netcom.com remailer to send an anonymous > contribution to a list. They're raising hell about anonymity in their > list, but that's beside the point. The message also showed up on a > seperate beta test list. I assume this was done manually by > <mcstout(a)netcom.com> bouncing the message to the other list, since he > is the sigular person on the planet subscribed to both lists. mcstout > has been a quite vocal detractor of my catalyst contributions to the > other list. I thus strongly suspect manual sabotage. There was no > flaw in the Request-Remailing-To: adress. > > Could someone please confirm that this was not a quirck of the remailer? Try checking the headers to see what site it came from.

1 0

Re: Faster way to deescrow Clipper
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>From: "Perry E. Metzger" <perry(a)imsi.com> > >Mike Ingle says: > >An interesting idea. > >> The LEAF would look good unless you tried to decrypt the >> session key. The wrong-IV problem would remain. The NSA should have >> designed the Clipper so that, if the IV was wrong, the chips would not >> accept the LEAF. > >That can't be done, I'm afraid. Its way to difficult to distinguish a >bad IV from line noise nuking the first block of your CBC >conversation. I used to work on NSA cryptographic equipment. One of characteristic of a system designed to use crypto is the ability to detect crypto sync. If you have access to the control program (which you would if faking LEAFS), you would tend to throw out the first block. The difficulty is that the DE (distant end) ain't necessarily smart enough to do so (assuming it has not been modified), and is more than likely looking for a passed data value (typically a sync symbol) to determine the state of crypto synchronization. Were the system consuming data from the enciphered link properly prepped, it is possible that it would ignore garbage (Assuming the damaged decrypted first block did not contain the sync), while awaiting a synchronization indicator. Most duplex crypto systems use some variant of End Around Prep (EAP), where the receive data path is used to determine whether crypto synch is acheived by looking for a constant mark or space, or idle character. When the receiver does not provide the proper value the transmit side is knocked down, the DE receive notices and restarts its transmit. A data value is passed through the loop to tell the system to go to operate mode. Such functions are generally predicated on having crypto - and the data system for which it provides a link, separate. The point being that a communications system that you can't modify both ends of may not be able to accept a garbled first block. Not to mention that OFB is probably a lot more prevalent for voice applications.

2 1

Re: LEAF forgery
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I wrote about a possible trapdoor in Skipjack to which Perry replied: >Your belief is without evidence. It is a supposition. I'd say the NSA >has a lot to lose by putting holes in Skipjack. How true, yet the NSA also had a lot to lose by putting out a flawed backdoor in Skipjack which essentially negates much of this features (LEAF) value. They did so none the less. In addition, I remember the comments of Stuart Baker; the audacity was typical of an organization which would put in just such a hole and smugly disbelieve that anyone would find out. In addition, it is possible that the agency is not alarmed about their LEAF problems because they don't need to use it. Of course, even if the whole algorithm was compromised I don't think they would show alarm outwardly. The possibilty is still there. Since one does not know the Skipjack design, a belief that it does not contain a trapdoor is without evidence and also a supposition. My contention is that the NSA is cocky enough to disregard the consequences of putting holes in Skipjack. >None the less, I wouldn't use Skipjack, because I don't trust things I >don't know the design of. Me neither, and randomly generating new LEAF fields would not give me comfort as to the security of my transmissions. Which is the main point here in my mind. Scott G. Morham !The First, VACCINIA(a)uncvx1.oit.unc.edu! Second PGP Public Keys by Request ! and Third Levels ! of Information Storage and Retrieval !DNA, ! Biological Neural Nets, ! Cyberspace -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLe92xz2paOMjHHAhAQHaUwP/T+Di/N7ej8pfW7jKJJHmV8CTfJaYkYgt ejB2M+QTs23i+6AdT6yiSfs+cGXz19F/eHiNtvemJyYujnyXP8EjxeqkhCIjtu+/ ZkF9dBWSC6V1Xj7MycPZbG8lgv7EY57nnVDU7smv42xbRx9Co9qYF9zRdhe0WRZc Hdzm4YP+8Bw= =T1Tz -----END PGP SIGNATURE-----

2 1

IVs and synchronization
by perry＠imsi.com 17 Dec '03

17 Dec '03

Just in case it confuses people, when you are doing Matt's general attack that interoperably works with non-rogue systems, you find via exhaustive search a LEAF that corresponds to your selected Session Key/IV pair. IV synchronization problems only show up if you are using the less general "feed the LEAF back to the same processor" trick. Perry

1 0

PGP 2.6 hoax by Sternlight
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Vincent.Cate(a)FURMINT.NECTAR.CS.CMU.EDU: > The pgp26-RSAREF_3.0_beta.tar.gz file is not real. From some other > post, it seems this came from the site in Italy that I mentioned awhile > back. They have removed the file from there. It is a lot of bytes > for a joke. It should probably be removed from soda too. > ... > [Sternlight ASCII art] I was surprised to see that this file was owned by "strnlght" on the Italian site. Anyway, the file has been removed from the Italian site, and its replacement, pgp26.zip, is real. (I haven't checked the sig, but the contents seem ok, at least ;-) -------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Fairness to Game Animals Association says: Support your right to arm bears! --------------------------------------------------------------------------

1 0

Re: more info from talk at MIT yesterday.
by Mark Voorhees 17 Dec '03

17 Dec '03

>Since when can the government patent its work? I thought that works >produced by government agencies could not be copyrighted or patented. No. The patent on the digital signature algorithm, the basis of the new digital signature standard, for example, is held by NIST.

1 0