December 2003 - cypherpunks-legacy

No Subject
by cowen＠glia.biostr.washington.edu 17 Dec '03

17 Dec '03

hello folks i have been trying to ge the non-net folk to fight against clipper and all other such methods of the gov't to surpress the freedom to talk to anyone at anytime without other listening in on things so my finacee wi going ot give a short series of speachs to her speech class. anyone can do this, talk out loud to the public tell your non net friends, tell everyone. also ..... help anyone who has a list of article or topics that can be looked up in serial lititure to use for this purpose, please e.mail me the info or post it so others can gain the infomation to use to fight those who would take our rights from us. charles the monster maker

1 0

Re: Ames/clipper compromised?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> sommerfeld(a)orchard.medford.ma.us (Bill Sommerfeld) : > > >BTW, my guess at the most likely back door is that the unit keys will > >be generated as a cryptographic function of the serial number and a > >*small* random number generated for each chip and unknown to the > >agency. They would have to search a mere 2**16..2**32 keys once they > >get the serial number out of the LEEF. The existance of such a > >backdoor would be difficult to prove, since there would be no visible > >evidence for it in the individual chips. It is also difficult to > >disprove such a theory because the clipper key generation algorithms > >are classified. Key generation is one of the obvious backdoors; the wrinkle of making the random number space from the keymasters small enough to search is interesting, especially because they only need one key per batch to validate whether they've got the right guess. My original reaction to the version described by Dorothy Denning was that it wouldn't be very hard to *steal* the key-generating keys the keymasters bring to the key-generation charade in the vault, either physically or by leaking them out in generated keys or something. Now that they've announced they're changing the script for the charade, who knows how easy it will be? They've certainly announced no plans for validation of the key-generation software design or implementation. Matt Thomlinson writes: > I just read a paper that might apply to this type of backdoor; it was by > someone at RSA, with the title "..RSA's trapdoor can be broken". I'll No, that's a different argument; it's (name forgotten) vs Kaliski, where the proposed method turns out to take as much work as factoring and therefore doesn't rate as a backdoor. Bill Stewart

1 0

Re: Ames/clipper compromised?
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

1 0

Very funny, Polyanna :-( [namespace pollution]
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Grrr. I use a mailer here (that I'm developing) that automatically encrypts outgoing mail for user X if "<X>" can be found in my pgp keyring. Unfortunately some comedian has published the key below... Type bits/keyID Date User ID pub 384/99CBA7 1992/11/15 Polyanna, c/o <cypherpunks(a)toad.com> 1 key(s) examined. so if I use this mailer when posting to cypherpunks, it gets encrypted for this idiot. I guess this is something we mailer writers will just have to allow for. Looks like I'm about to add a stop-list... (removing it from the keyring won't be good enough, because next feature planned for my mailer is to look up the fingerable key-server if it isn't found locally...) G

3 2

Re: Ames/clipper compromised?
by Peter Wayner 17 Dec '03

17 Dec '03

I spoke with D. Denning last week and she told me that she was not going to CFP because they had a Clipper Review Panel meeting. She said she wanted to get a chance to go out to Mykotronix and check out the vault. -Peter Wayner

1 0

Ames/clipper compromised?
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I remember awhile back someone posted some clipper documents that were released under FOIA as I recall. The thing that struck me was that the NSA was refering internally to clipper as "The Trapdoor chip." Why refer to it as such if there is no back door? If anyone has the documents I'm refering to handy, please repost, (or I'll have to dig them out!) Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced comunication is indistinguishable from noise." --Steve Witham "Have you ever had your phones tapped by the government? YOU WILL and the company that'll bring it to you.... AT&T"--James Speth -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLZdBc9CcBnAsu2t1AQHJZwP/f49BBtg/Gts4C4X0MdhzJ0UUUoSVDY4B wO0Ib44dTx/i00M3P/v1Q1xTcfyEXIRQaJmvp7xXPmjHAd6GPZaeW0Ag8hmvDAel DMmVLAAnaGP7Jmj2gSE7N2do/p80aY6IMzBwD3rI4glbns2kq0/kLjrLosXLK/c4 S3zjwR2wYVA= =mfh0 -----END PGP SIGNATURE-----

2 1

Bruce Sterling's Speech
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

I greatly enjoyed Bruce Sterling's speec/rant/assessment of the entire CFP conference on Saturday afternoon. Does anybody know if he will be posting the text of that speech on-line (as he has of other presentations he has made) or if somebody w/ access to one of the tapes of the speech will post a transcription? If someone can get me a bootleg, I would be willing to do the typing. -john. -------------------------------------------------------------------------- John Blair: <jdblair(a)nextsrv.cas.muohio.edu> voice: (513) 529-4877 PGP public key available upon request. KILL YOUR Privacy in the information age is a right, not a privilage. TELEVISION Information = Power = Control. Fight the centralization of information.

1 0

Magic Money simplification
by Hal 17 Dec '03

17 Dec '03

In my posting about remailer abuse, I mentioned a point in passing re Magic Money that perhaps deserves a more explicit mention. Presently, Magic Money has each user create a special public key just for use by that program. When MM sends a message to the bank, it includes a copy of the user's public key. Then, when the bank sends the return message, it encrypts it with that key. (Messages to the bank are also encrypted with the bank's public key.) Last night it occured to me that this encryption may not be necessary. Messages to the bank are of the form f(x)*r^e, where f is a one-way function, x is the coin's serial number, r is a random blinding factor, and e is the bank's public exponent for this denomination. The bank signs this by taking it to the d power, were d is the RSA-inverse of e, and sends back f(x)^d * r. It looks to me like these two messages are secure even without being encrypted with the user's or bank's public key. r, and r^e, both act as one-time-pads, blinding the underlying f(x) or f(x)^d value perfectly. This blinding, of course, is what prevents the bank from linking up withdrawn cash from spent cash. But it should serve just as well to prevent an eavesdropper from stealing the cash. If someone manages to get f(x)^d * r, this is of no value to them if they don't know r. Since only the original sender knows r, this message can be sent in the clear. Similar logic applies to the message from the user to the bank. If this argument holds up, the usage of Magic Money can be simplified considerably. The user should no longer have to create a special public key. Nor should he need to know the bank's public key. All he needs to get started is the email address of the bank, to which he can send the standard initialization query message which causes the bank to send back information about the exponents and denominations used, as well as the name of the money. Of course, when users send actual un-blinded coins amongst themselves as payment, those transmissions need to be encrypted or done via some secure channel. But MM never concerned itself with those. It was only involved with messages to and from the bank, and for these it seems to me that encryption is not necessary. Hal

1 0

INTERNET CONNECTIONS IN JAPAN
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, A quick question to help an international friend: Does anyone on the list know anything about getting a (cheap, if possible) Interenet connection in Japan? Please let me know by private e-mail if you have any information. Thanks, S a n d y

1 0

Re: Very funny, Polyanna :-( [namespace pollution]
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

:Isn't this really just a special case of the more general problem of :deciding which keys on a public key ring you're willing to trust? :Perhaps your mailer script should automatically encrypt only when a :keyid is found with a signature trail that you trust. No, that's a totally separate problem. What I'm worried about is some comedian publishing a public key for addresses like "alt.security.pgp(a)cs.utexas.edu" or any of the common mailing gateways, and suddenly people using auto-encrypting mail programs find that no-one can read their posts. It kind of throws a spanner in the works for completely transparent pgp shells. :I do see a signature for that key from Miron Cuperman. Perhaps :you'd want to modify your trust parameters for him... That's not the point; someday soon people will be using mailers that auto-pgp without them even realising it. I don't want to have to hassle those people with interactive questions about whether they trust someone, or force them to maintain personal lists of bad addresses. Whatever solution we can find will have to involve active support from the keyservers I suspect. thoth@netcom - I hope you're listening to this! There's a definite problem of a denial-of-service attack here that the current scheme makes hard to avoid. Hence why I called it 'namespace pollution' in the subject line. G

2 1

URGENT: NII Summit announcement - don't miss out!
by Stanton McCandlish 17 Dec '03

17 Dec '03

Tomorrow, March 29, the NII Summit begins in DC. This is an announcement that should be of relevance to anyone interested but unable to attend, as you can still participate "virtually". Get your word in NOW. EFF will probably be providing links to the Summit gopher and web server via gopher.eff.org 1/Alerts, and via http://www.eff.org/ Forwarded message:

1 0

Chaumian digicash papers
by Sameer 17 Dec '03

17 Dec '03

Pardon the faq, but where can I find by ftp Chaum's papers/articles/etc on digicash? Pointers to wother works on the subject would be appreciated as well. Thanks.

1 0

Re: cfp '94 transcript
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

----------- [...] (Unknown) My name is Barbolin (?) from GRC (?). I have a question concerning the algorithm that is used in the Clipper Chip, Skipjack..[]..There is a certain amount of conjecture that in fact the algorithm contains a deliberately encoded weakness that will allow the NSA, without access to the escrow keys, to be able to intercept communication in their mission to monitor on- shore and off-shore communications..[].. BAKER I'll answer it yes or no if you'll tell me exactly the question. UNKNOWN Does it or does it not contain a weakness that allows you to intercept the communications without access to the escrow keys. BAKER No. ----------- ObNit: As has been said before by others, there's more to Clipper/EES than just the Skipjack algorithm. I think simply asking if "the [Skipjack] algorithm contains a deliberately encoded weakness" leaves too much room for a "truthful" No answer. People have posted descriptions of mechanisms that could be used to leak key information which do not rely on a deliberately weakened encryption algorithm. (depends on how broadly you define "algorithm"). A better question to ask would be... Are there any software or hardware mechanisms, or combinations of software and hardware mechanisms, present in the Clipper/EES system that supports or enables decryption of intercepted Clipper/EES communications without access to escrowed unit keys? Does that cover it well enough? Jim_Miller(a)suite.com

4 3

Shirt project
by Eric Johnson 17 Dec '03

17 Dec '03

Crypto Political Action Sportware... Is anyone interested in a T-shirt with the swoosh Big Brother Inside front, and maybe a !Key Escrow (RSA button style; red circle and slash over the words Key Escrow)? Would be a real conversation piece with non-crypto friends, I would think. I recently heard another great idea for a shirt: 1 9 8 4 "We're behind schedule." National Security Agency I think I'll do at least a few for myself and friends, if no one else is interested. Also, reply directly to me (and *please* don't cc: the list), so I can get an idea of how many to order, if I do this. If it's already been done, I would like to know about that also. "Shirt orders" sent to the list will be ignored... --Eric --- Eric Johnson ejohnson(a)names.maricopa.edu Maricopa Community Colleges, Tempe AZ 602-731-8919

3 2

Re: cfp '94 transcript
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

SINCLAIR DOUGLAS writes: > I'm not sure what the NSA policy is on this. However, at > that same conference Jim Settle from the FBI told us > plainly that he is allowed to lie, and that the courts have > confirmed this right. I doubt Baker would have confessed > to a back door even if one existed and the question was > complete. > Ah, of course. What was I thinking? After all, this is a national security issue we're dealing with. I guess my idealism is showing again. Jim_Miller(a)suite.com

1 0

Re: Ames/clipper compromised?
by smb＠research.att.com 17 Dec '03

17 Dec '03

If the algorithm becomes known at this stage in the game, they can probably "easily" generate a modified SKIPJACK algorithm (changing the S-boxes or equivalent), a new family key, and a subtle variation on key generation. They might not even need to re-spin the chip design if, as they claimed, the critical parts of the algorithm are programmed into the chip after fabrication. Of course, we now know that changing the DES S-boxes isn't necessarily easy. Without knowing the details of Skipjack, we can't even start to evaluate it. BTW, my guess at the most likely back door is that the unit keys will be generated as a cryptographic function of the serial number and a *small* random number generated for each chip and unknown to the agency. They would have to search a mere 2**16..2**32 keys once they get the serial number out of the LEEF. The existance of such a backdoor would be difficult to prove, since there would be no visible evidence for it in the individual chips. It is also difficult to disprove such a theory because the clipper key generation algorithms are classified. The review committee will be looking at the key generation mechanism, according to Steve Kent. Not as good as publishing it, of course, and -- if they're honest -- there would seem to be a lot less reason to keep it secret than there is for Skipjack. (I don't like Skipjack being secret, but at least the ostensible reason is quite sensible, given their motivations.) A useful exercise for this group might be to compile a list of questions that they *should* answer if they're playing it straight. These could be forwarded to the review committee, too. If we come up with a good list, I'm willing to submit it to them. For that matter, I'll submit it to one of the gentleman from NSA who gave the Clipper presentation at Bell Labs. (But I won't bother sending in ``when did you stop beating your spousal equivalent unit'' questions; there's no point to doing that in this venue.) Question 1: What is the unit key generation algorithm? If it is classified, justify the decision with reasoning at least as persuasive as the reason Skipjack is classified. Question 2: Ditto for the device serial number. Any more?

1 0

words, words, words: debate at Stanford on March 30
by Marianne.Mueller＠Eng.Sun.COM 17 Dec '03

17 Dec '03

I guess Oxford style debates are all the rage. with apologies if this already showed up on the list, mrm ----- Begin Included Message ----- From: ceh(a)leland.Stanford.EDU (Carey Heckman) Newsgroups: su.school.gsb.events Subject: Encryption, Digital Communications Debate, 3/30 5:30 pm Date: 23 Mar 1994 11:20:05 GMT Organization: Stanford University, CA 94305, USA Sender: ceh(a)leland.stanford.edu NNTP-Posting-Host: cardinal.stanford.edu ENCRYPTION AND DIGITAL COMMUNICATIONS: LAW ENFORCEMENT OR PRIVACY? An Oxford-Style Debate J. Kent Walker, Jr. (Stanford Law '87) Assistant U.S. Attorney and Coordinator, High-Tech Task Force Marc Rotenberg (Stanford Law '87) Washington Director, Computer Professionals for Social Responsibility Wednesday, March 30, 1994, 5:30 PM Stanford Law School, Room 290 Light Refreshments Served This debate brings together two nationally prominent experts in this area. You won't want to miss the verbal fireworks and the opportunity to learn more about this important question. Background ========== The Clinton Administration is promoting use of the Clipper Chip technology that provides encryption, but in a form that law enforcement can unscramble. It also backs legislation requiring design of digital communications networks so ongoing surveillance will be feasible. Law enforcement officials argue that these proposals are necessary to protect society from criminals and preserve important investigative tools. Privacy advocates contend that these proposals grant broad new powers to law enforcement agencies and diminish protection for future users of the National Information Infrastructure. Sponsored by the Stanford Law and Technology Policy Center and the Stanford Law and Technology Association. Additional Information ====================== Contact the Stanford Law and Technology Policy Center by email (Law.Tech.Policy@forsythe) or telephone (5-7788).

1 0

Crypto and new computing strategies
by Jim choate 17 Dec '03

17 Dec '03

In the latest issue of Scientific American there is an article on quantum computing and how the first working machine is to be built in the immediate future. This raises dark portents in my mind when one considers the rate and the size constraints on such devices. We may be looking at a technology birth which will allow brute force computation of RSA style algorithms and their cracking. As an aside in a Physics mailing list I subscribe to Rajashi Roy from Georgian Tech supposedly has managed to synchronize two chaotic lasers which would provide a basis for a optical one-time pad system.

2 1

please ignore this test message
by Sam Walters 17 Dec '03

17 Dec '03

this is a test message. asdf;ljkasdfkl;asdfj asjdkl;flasdl;jkasdl; as;dlfsa;lasdfl; --

1 0

Anderson's RSA Trapdoor Can Be Broken
by Matt Thomlinson 17 Dec '03

17 Dec '03

The name of the article I cited earlier is in the subject line. Written by Burton S. Kaliski Jr, of RSA Labs, on **March 19, 1994**. An abstract: ------------- A recent letter by Ross Anderson proposes a ``trapdoor'' in the RSA public-key cryptosystem whereby ahardware device generates RSA primes p and p' in such a way that the hardware manufacturer can easily factor the RSA modulus n = pp'. Factoring the modulus hopefully remains difficult for all other parties. The proposed trapdoor is based on a secret value A known only to the manufacturer. For 256-bit RSA primes, the secret value A is 200 bits long. The device generates primes p of the form p = rA + q = r(q,A)A + q. (1) where q is at most about 100 bits long, and is 56 bits long and a function of A and q. To factor the RSA modulus n = pp', the manufacturer reduces the modulus modulo A to recover the product qq', following the relationship n = pp' = rr'A^2 + (rq' + r'q)A + qq'. (2) The 200-bit product qq' is easily factored and the manufacturer recovers the primes p and p' accordingly. While the trapdoor is indeed practical, it can be broken: Factoring such ``trapped'' moduli is easy. [...goes into easy-to-tex, hard-to-ascii derivation...] ...Such inequalities are called ``simultaneous Diophantine approximations,'' ... [and these will be solvable for these parameter lengths when (number of keys) >= 13] [...] One way to overcome this attack is to assign a different secret value to each device [...] The user does not need 14 moduli to find A, however. Two prime factors p and p' suffice, since the fraction r'/r is such a good approximation to the fraction p'/p that it is guaranteed to be a convergent in the continued fraction expansion of p'/p. The user can therefore detect a trapdoor even if the device generates each modulus with a different secret value. The manufacturer's only recourse, at least as far as the proposed trapdoor is concerned, is for the device to generate each modulus with a different secret value and to keep the prime factors secret. In such a sitiation, the manufacturer may as well preload the device with the primes and escrow copies--a practical ``trapdoor'' to which all cryptosystems, not just RSA, are vulnerable. burt(a)rsa.com -------------------------- check out rsa.com for the real copy: I left out about 3 equations relating to the diophantine approximations, but the text is pretty much copied in its entirety. Matt Thomlinson Say no to the Wiretap Chip! University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 548-9804 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

1 0

Re: cfp '94 transcript
by Jack King 17 Dec '03

17 Dec '03

Also note that the Fifth Circuit recently discarded the "exculpatory no" defense to Sec. 1001. See _United States v. Rodriguez-Rios_, No. 92- 8257 (5th Cir. 2/11/94) (Smith, J.). Reported at 54 CrimLRptr 1528. Now, in the Fifth Circuit, you can't even say "No, I never did/say/thought that" without committing a crime!

2 1

Citizen-Unit May fulfils Duty
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

> Personally, I expect personal crypto dongles and/or similar gadgets to > be self-contained, in a wearable form. Maybe pendants, maybe rings > (real decoder rings!), maybe wristwatches. Communication will be by > inductive coupling or similarly robust links. (Inductive, > noncontacting transfer would allow implantation of the unit. IR > transfer through the skin is also possible.) We grant Citizen-Unit May Approved Thought Pattern credits for suggesting new ideas for our Unit Identifying Project. We note with some sadness that he was unable to carry his Approved Thoughts to their completion, whereby the Citizen-Identifying Trade Units broadcast all trade transactions of their attached Citizen-Unit to all Clipper-Units in the vicinity, for the benefit of surveillance and efficiency of society. --Approver-Unit Rishab Aiyer Ghosh -------------------------------------------------------------------------------- Rishab Aiyer Ghosh "What is civilisation rishab(a)doe.ernet.in, rishab(a)dxm.ernet.in but a ribonucleic Voicemail +91 11 3760335; Vox/Fax/Data 6853410 hangover?" H-34C Saket New Delhi 110017 INDIA --------------------------------------------------------------------------------

1 0

Re: Shirt project
by Jim Gillogly 17 Dec '03

17 Dec '03

> jdblair(a)nextsrv.cas.muohio.EDU writes: > > 1 9 8 4 > > > > "We're behind schedule." > > National Security Agency > > were interested in the design. I thought that on the back I might make a > list of government policies which are eroding civil rights. Sounds a bit busy -- what about the WiReD Clipper logo: the fist clutching the airwaves? I assume they'd give permission if asked nicely... Jim Gillogly Highday, 7 Astron S.R. 1994, 01:43

2 1

Re: personal manifesto (comments appreciated)
by W. Kinney 17 Dec '03

17 Dec '03

T.C. May writes: >And part of preventing totalitarianism means not interfering with >economic transactions made by folks. Say, Public Key Partners, for instance? ;-) -- Will

1 0

Shirt project
by hughes＠ah.com 17 Dec '03

17 Dec '03

>The "1984" T-shirt was suggested by one of the NSA reps at the CFP >conference. The fellow involved was indeed from the the NSA, but he was by no means representing it. I understand from him that he did a bit of bureaucratic hacking just to attend. He also kindly offered to post from dockmaster that he had seen me and some other tentacles in the same place and at the same time at a privacy conference, but alas, there were no tentacles to be found. Eric

1 0