December 2003 - cypherpunks-legacy

Denning article - sites for retrieval
by L. Detweiler 17 Dec '03

17 Dec '03

The article has been placed in Privacy Forum archives: ===cut=here=== Date: Fri, 24 Sep 1993 16:49:45 -0400 (EDT) From: denning(a)cs.georgetown.edu (Dorothy Denning) Subject: Wiretap Article The following article on wiretap laws and procedures was written in response to the many questions and misunderstandings that have arisen about wiretaps in the context of escrowed encryption as well as Digital Telephony. This article may be distributed. Dorothy Denning denning(a)cs.georgetown.edu [ I have included the introductory portion of the paper below. The entire text (~33K bytes) has been placed into the PRIVACY Forum archives. To access: Via Anon FTP: From site "ftp.vortex.com": /privacy/wiretap.laws.Z or: /privacy/wiretap.laws Via e-mail: Send mail to "listserv(a)vortex.com" with the line: get privacy wiretap.laws as the first text in the BODY of your message. Via gopher: From the gopher server on site "gopher.vortex.com" in the "*** PRIVACY Forum ***" area under "wiretap.laws". -- MODERATOR ]

1 0

idiotic government regulations: DO SOMETHING!
by L. Detweiler 17 Dec '03

17 Dec '03

Here's everyone's chance to do something *constructive* about idiotic government regulations. Imagine this -- an email address to report them! ------- Forwarded Message Date: Sun, 26 Sep 93 23:14:39 EDT From: "Paul Jones" <pjones(a)sunsite.unc.edu> Subject: REGO needs your suggestions - soon The following announcement comes from the Office of the National Performance Review- they are looking for anecdotes regarding useless government regulations, and reccomendations for eliminating needless bureaucracy. This is the Net's chance to have a say in fixing what's wrong with the US government. - ------ Vice President Gore's task force on reinventing government (REGO) called for many changes in the federal government. Now that the report has been issued, we have shifted to implementation of those recommendations. Successful implementation of those changes will require the collective efforts of many people across government. To provide support and to help implement the recommendations, a "network of networks" is being established. The network, dubbed "NetResults" will link together government workers at the federal, state, and local levels, and will provide ways for people in the private and non-profit sectors to participate as well. This message is an initial effort by NetResults to get information and support for these recommendations. On September 11, 1993, President Clinton signed an executive order calling for the elimination of one-half of executive branch internal regulations within three years. We'd like your assistance in helping us find the best examples of obsolete, redundant, or dysfunctional federal regulations. This is your opportunity to let senior federal policy managers know about federal regulations or internal administration policies and procedures that prevent effective service to the taxpayer. We plan to forward this information to the Federal Quality Institute for its use in helping agencies eliminate or reduce regulations. Any replies should give a brief description of the regulation or internal administrative procedures and a specific citation where this regulation is found. Please send us this information either through electronic mail to: sillyreg(a)sunsite.unc.edu or fax it to REGO at: (202) 632-0390. For immediate impact, send your responses by electronic mail before September 28, 1993. If you are interested in more information on "NetResults", please send an electronic mail message to Steve Butterfield at steveb(a)sunsite.unc.edu, Dennis Egan at dennise(a)tmn.com, or Andy Campbell at andy(a)tmn.com. We appreciate your interest and will look forward to your replies. ------- End of Forwarded Message

2 1

Re: saturation tactics?
by George A. Gleason 17 Dec '03

17 Dec '03

yeah, here's a cheaper version. Write to the arms excport license people and pester them with questions: I'm a BBS operator, what should I do?; I'm a businessperson travelling overseas and need my crypto to comm with the home office what should I do?; all this kind of thing. Swamp them with letters. Every person and every circumstance which even remotely fits. An alternative version which would require more guts and perhaps a serious conscientious decision about whether it's worth making this an act of civil disobedience, is to write to them and say, "I'm a BBS operator, not an arms merchant, and on the strength of my 1st-A rights I'm not going to censor my board or get a license..." or "I'm a businessperson who travels & takes my cryupto out of the country on my laptop to comm with the home office; I'm not an arms dealer either and I don't intend to get a license..." And again, there is strength in numbers here. And of course, a good steganographic program or two would be a very nice development indeed, Just In Case. -gg

2 1

Ringing Dingaling Rebuttal
by L. Detweiler 17 Dec '03

17 Dec '03

Here's a cypherpunkesque rebuttal of the recent article. ===cut=here=== Date: Mon, 27 Sep 93 08:39:11 -0400 From: shap(a)viper.cis.upenn.edu (Jonathan Shapiro) To: denning(a)cs.cosc.georgetown.edu Subject: Re: Wiretap Article Dorothy: Recently you sent out a piece of mail providing information on wiretap laws in connection with the Clipper chip. I wish to draw to your attention that the laws concerning wiretapping are largely irrelevant to the issue at hand, and why. Let us assume that the wiretap laws as they stand are sound (I do not believe this, but it doesn't matter). Let us ignore the fact that the new Attorney General was recently asked to sign a large pile of blank warrants in the interests of "National Security," and rightly went through the roof. Let us further imagine that the system is Good, and that the likes likes of McCarthy, J. Edgar Hoover, Richard M. Nixon, G. Gordon Liddy, and Ollie North are gone forever. In fact, let's go so far as to ignore that as the Federal Government grows and grows it is a _necessary_ consequence that we will encounter more such people. Let us ignore the abridgements of the First Amendment rights of encryption technologists during the '60s and '70s by the NSA, and discount their bleatings as the reactions of alarmists. Finally, let us imagine that the timing of the munitions investigation into Pretty Good Privacy is entirely accidental, and that this does not amount to an attempt to make the only viable alternative encryption technology illegal de facto. As a personal matter, I'm inclined to grant this point because the agencies involved are too disorganized to have successfully coordinated. Government is _not_ intrinsically evil. It _is_ intrinsically amoral. The propriety of a government is only as sound as its weakest member in a position of relevant power. We can sometimes catch the offenders and subject them to due process, but doing so does not compensate their victims for their abuses. To be sure, this term's politicos are swearing themselves stupid promising that other encryption technologies will not be outlawed. By them. Of course, the policies change from term to term, and the guarantees of this group of people are therefore irrelevant to the long term. The question, you see, is not _whether_ the Clipper technology will be abused, but _how_soon_. The lessons of history, Ms. Denning, are best not forgotten. Jonathan S. Shapiro Synergistic Computing Associates

1 0

minor humor: telco's vs cable companies
by Brian D Williams 17 Dec '03

17 Dec '03

We at TPC like to put it to people quite simply, " Do you want your cable service to be like your phone service, or do you want your phone service to be like your cable service?" Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced communication is indistinguishable from noise." --Steve Witham "Have you ever had your phones tapped by the government? YOU WILL and the company that'll bring it to you.... AT&T" --James Speth

1 0

Steve Jackson opposes Clipper FIPS
by L. Detweiler 17 Dec '03

17 Dec '03

===cut=here=== Date: Sun, 26 Sep 93 21:15:13 GMT From: sj(a)indial1.io.com (Steve Jackson) Subject: Comments on Clipper/Skipjack proposal Steve Jackson, President Sept. 26, 1993 Steve Jackson Games / Illuminati Online PO Box 18957, Austin, TX 78760 512-447-7866 sj(a)io.com National Institute for Standards and Technology (NIST) ATTN: Proposed FIPS for Escrowed Encryption Standard Technology Building, Room B-154 National Institute of Standards and Technology Gaithersburg, MD 20899 Sirs: I am writing in opposition to the Proposed Federal Information Processing Standard (FIPS) for an Escrowed Encryption Standard, docket # 930659-3159. As a publisher of both printed and online materials, I am deeply concerned by the potential effect of the proposed standard, which appears to me to have been produced in haste and to be lacking many significant elements required for informed citizen comment. I am in strong agreement with the points raised by the EFF and CPSR in their comments opposing the proposed standard. Private access to strong encryption is simply vital to protect the privacy of individuals in today's online environment. Legitimate business requirements for confidentiality also mandate free access to good encryption technology. The manner in which this proposal has been put forward is improper and incomplete. An algorithm intended for private and commercial purposes should not be classified as a "national security matter." And it is wholly improper to ask for meaningful "citizen input" while the algo- rithm itself is secret, the identities of the escrow agents are not firmly established, complete operating procedures are not available, and no legal recourse is yet proposed for the improper release of keys. In particular, the proposal fails to define what "legal authorization," other than a court order, might be available to compel the escrow agents to release a key. This omission is unacceptable. If keys are to be released to any authority except a United States court, the details must be made public immediately. Finally, a strong guarantee is needed that the Clipper/Skipjack system will never become mandatory, and that other forms of encryption will remain freely and legally available to all Americans. The proposal should be withdrawn until all these issues can be addressed. Only then can a legitimate period of citizen comment begin. Respectfully submitted - Steve Jackson ------- End of Forwarded Message

1 0

Re: PGP Business Week article
by George A. Gleason 17 Dec '03

17 Dec '03

Re. Representative Sam Gejdenson (pronounced as if spelled "gaydenson", accent on first syllable): I went to one of his campaign appearances when he first ran for office (this was Middletown Connecticut, 1980), and was very much impressed by his positions on various issues, and in particular, his background knowledge in a number of areas including engineering and policy areas related to the environment.... he is definitely someone who has a good ability to digest and utilise technical information in detail, and I'd say he could be a very very key person on our side of these issues. He definitely deserves 100% support and all the solid detailed information we can provide. -gg

1 0

Re: Verilog encryption broken
by George A. Gleason 17 Dec '03

17 Dec '03

Re Mark's question about the ethics of revealing that a proprietary system is crackable: I believe there is every right and duty to make the vulnerability publicly known. However, this can be done without disclosing enough of the content of the badly-protected information as to come in for heat. For example, one might post little snippets of a source code file which by themselves aren't usable but which the original owners will instangly recognise. This would be akin to the "fair use" of quotations from literature and poetry in critical reviews. And I also believe it would stand up in court, because the material which was revealed in the quotations could not be used in and of itself to devalue the content of the original complete work. -gg

1 0

My comments to NIST
by Phil Karn 17 Dec '03

17 Dec '03

7431 Teasdale Avenue San Diego, CA 92122 karn(a)unix.ka9q.ampr.org September 27, 1993 Director, Computer Systems Laboratory ATTN: Proposed FIPS for Escrowed Encryption Standard Technology Building, Room B-154 National Institute of Standards and Technology Gaithersburg, MD 20899 Re: A Proposed Federal Information Processing Standard for an Escrowed Encryption Standard (EES) Docket No 930659-3159 RIN 0693-AB19 Comments of Philip R. Karn, Jr Sirs: I am writing in response to your call for comments on the aforementioned matter that appeared in the Federal Register on July 30, 1993. I am writing as a concerned individual with BS and MS degrees in electrical and computer engineering and 15 years of professional experience in communications, computer networking and security at leading edge R&D organizations. I currently work in the digital cellular telephone industry, a ripe application for robust encryption if there ever was one. I feel that my experience in this field qualifies me to comment on the practicality of the proposed standard. First of all, I am totally opposed to the entire concept of key escrow. It is a dangerous, un-American and fatally flawed idea that should never have been proposed. In my opinion, everyone has the Constitutional right to use the encryption scheme of their choice, whether or not the government can break it. The impact of strong encryption on the enforcement of legitimate laws is and will remain minimal. Even unbreakable encryption is incapable of thwarting standard investigational techniques such as informants, testimony compelled through grants of immunity, "end point" surveillance (e.g., hidden microphones), the gathering of physical evidence of crimes and so forth. Strong un-escrowed encryption will, on the other hand, finally put an end to illegal, often politically motivated interceptions of private electronic communications without having to rely on anyone's goodwill, such as the still-unnamed "key escrow agencies". Precisely because eavesdropping has been so easy to do and so hard to detect, the government has repeatedly proven itself untrustworthy in this regard, as documented in great detail by the Watergate investigations and the Church Committee hearings of the 1970s. Why should we trust it now? Although the government currently claims that the EES will be a "voluntary" standard, many of its features make no sense whatsoever in this context. For example, why must the Skipjack algorithm be kept secret if individuals remain free to use other algorithms such as triple-key DES or IDEA that are quite probably even stronger? The government's claim is completely transparent, as one simply cannot escape the conclusion that the EES is a prelude to a ban on all other encryption schemes, or at least a ban on those the government can't crack. And this presents a profoundly disturbing threat to some very important Constitutional principles. Countless others have argued forcefully against the proposal on these and other grounds. For example, see the points made by the Computing Professionals for Social Responsibility (CPSR) in the attached Appendix. I fully agree with CPSR and feel that they alone should have been enough to stop the proposal long ago. However, the fact that the Escrowed Encryption Standard has advanced so quickly despite these serious problems reveals the totally one-sided nature of the decision process. Far from being an independent and impartial agency, NIST has proven itself to be merely a pawn for the National Security Agency, the Federal Bureau of Investigation and other powerful intelligence and law enforcement agencies. Despite (or perhaps because of) encryption's enormous potential to put real "teeth" into the Constitutional principles of privacy and freedom of speech and association, these agencies are notably unsympathetic to tFrom owner-cypherpunks Tue Sep 28 05:51:28 1993 Received: by toad.com id AA02707; Tue, 28 Sep 93 05:46:19 PDT Received: by toad.com id AA02651; Tue, 28 Sep 93 05:41:49 PDT Return-Path: <nowhere(a)bsu-cs.bsu.edu> Received: from bsu-cs.bsu.edu ([147.226.112.101]) by toad.com id AA02647; Tue, 28 Sep 93 05:41:46 PDT Received: by bsu-cs.bsu.edu (5.57/Ultrix3.0-C) id AA08271; Tue, 28 Sep 93 07:43:59 -0500 Date: Tue, 28 Sep 93 07:43:59 -0500 Message-Id: <9309281243.AA08271(a)bsu-cs.bsu.edu> From: Anonymous <nowhere(a)bsu-cs.bsu.edu> To: cypherpunks(a)toad.com X-Remailed-By: Anonymous <nowhere(a)bsu-cs.bsu.edu> X-Ttl: 0 X-Notice: This message was forwarded by a software- automated anonymous remailing service. Subject: Disturbing statistics on wiretaps Organization: Coalition for Cryptographic Freedom In the paper written by Delaney, Denning and Kaye (Wiretap Laws and Procedures -- What Happens when the U.S. Government Taps a Line, September 23, 1993), a few numbers were presented from a 1992 report which reflect the wiretaps put into place during that year. Without further details concerning the specifics surrounding some of these numbers, it should certainly raise eyebrows on a couple of points: - All 919 "interceptions" were authorized. The numbers presented in this report indicate that none were denied. - Out of this number, 303 were in single family homes, 135 were in apartments and 289 were categorized as placed in "other" locations. - Out of 919, 634 were placed into service for interception of information involving narcotics. The closest contender in this area involved racketeering, in which 90 was the magic number. - The number of persons arrested was 2,685. Of that number, only 607 were convicted. These statistics alone should concern YOU.

2 1

GIF experts
by ssteele＠eff.org 17 Dec '03

17 Dec '03

Hi everyone. I know this is not the focus of the cypherpunks, but I was hoping one of you folks out there might be able to point me in the direction of a technoid who could testify about how easy it is to manipulate GIF images. Please respond by private message (ssteele(a)eff.org) so I don't cause any more noise on the list. Thanks. Shari

1 0

my clipper letter
by Matt Blaze 17 Dec '03

17 Dec '03

Matthew Blaze 55 River Drive South Jersey City, NJ 07310 September 25, 1993 National Institute for Standards and Technology (NIST) ATTN: Proposed FIPS for Escrowed Encryption Standard Technology Building, Room B-154 National Institute of Standards and Technology Gaithersburg, MD 20899 Dear Director: I am writing to express my opposition to the Proposed Federal Information Processing Standard (FIPS) for an Escrowed Encryption Standard, docket #930659-3159. First, let me state my qualifications in this area. I hold a Ph.D. in computer science in the area of large-scale systems from Princeton University. I am presently employed as a Principal Investigator / Member of Technical Staff in the Computing Systems Research Laboratory of AT&T Bell Laboratories. My research focuses on the design of cryptographically secure networked computing and communications systems and I have published several research papers in this field. I must emphasize, however, that I am making these comments as a private citizen; nothing in this letter should be construed as representing the opinion or position of my employer or any other organization. I state my affiliation only for the purpose of identification. I believe that adoption of the proposed Escrowed Encryption Standard would be harmful to the national interest in at least two ways. First, it will harm us economically, putting our computing and communications technology at a significant disadvantage against foreign competition. Second, it will hinder, rather than promote, the increasingly vital efforts to improve the security of our information infrastructure. Several aspects of the proposed standard render the system inadequate for our competitive and information security needs. First, because the proposed system relies on the use of a special, tamper-resistant computer chip, it is impossible to manufacture equipment or design systems that have their cryptographic security functions based entirely in software. The implementation of cryptographic systems in software has only recently been made feasible by advances in computer speed and has significant advantages over hardware (chip)-based encryption. Software encryption can be included in digital voice and computer communications equipment, such as cellular telephones, at virtually no increase in marginal cost. Hardware-based encryption (based on technologies such as the proposed standard), on the other hand, can add over a hundred dollars to the end price of each unit. This could represent an increase of several times the original price for typical low-end consumer communications products. Clearly, devices that include the proposed standard will be at a significant disadvantage compared with equivalent products (possibly from foreign competitors) that employ software-based encrypFrom owner-cypherpunks Tue Sep 28 06:46:18 1993 Received: by toad.com id AA03637; Tue, 28 Sep 93 06:41:30 PDT Received: by toad.com id AA03607; Tue, 28 Sep 93 06:38:21 PDT Return-Path: <cme(a)ellisun.sw.stratus.com> Received: from transfer.stratus.com ([134.111.1.10]) by toad.com id AA03603; Tue, 28 Sep 93 06:38:18 PDT Received: from lectroid.sw.stratus.com by transfer.stratus.com (4.1/3.14-jjm) id AA14444; Tue, 28 Sep 93 09:38:16 EDT Received: from ellisun.sw.stratus.com by lectroid.sw.stratus.com (4.1/3.10-jjm) id AA29408; Tue, 28 Sep 93 09:38:15 EDT Received: by ellisun.sw.stratus.com (4.1/SMI-4.1) id AA25476; Tue, 28 Sep 93 09:38:15 EDT Date: Tue, 28 Sep 93 09:38:15 EDT From: cme(a)ellisun.sw.stratus.com (Carl Ellison) Message-Id: <9309281338.AA25476(a)ellisun.sw.stratus.com> To: cypherpunks(a)toad.com Subject: Re: saturation tactics? >From: "George A. Gleason" <gg(a)well.sf.ca.us> >Subject: saturation tactics? >Message-Id: <93Sep26.015035pdt.14005-3(a)well.sf.ca.us> >Date: Sun, 26 Sep 1993 01:50:31 -0700 >lots and lots of people & companies applying for those arms export licenses, >"saturation," which involves lots and lots of people scrupulously obeying an >unfair or controversial law to the point where it starts to swamp the >system. I'd much rather not do it. There won't be enough people out there to really swamp the system. Meanwhile, it lends credence to the stupid notion that S/W crypto is arms. I much prefer the statements in the READMEs at soda.berkeley.edu .... The official Stratus line on this issue, BTW, is that we don't want to deal in munitions. We have no intention of selling arms to anyone. We sell much of our product overseas and we sell only freely available crypto -- the stuff which is so widely documented and available that no terrorist or unfriendly government could possible not already have it. In particular, we sell software DES and a few simpler systems for our customers to use as they will. Of course, ye olde US Gov't still forces not to export this except to financial institutions (which is a reasonable fraction of our business) but there are other customers pissed at us because we obey the stupid US export laws. Needless to say, Stratus as a company wants to see the export laws changed. - Carl Disclaimer: I don't speak for Stratus. For the official company policy, see the company's letter to NIST re: Skipjack. [I certainly hope these will be available to the public.]

1 0

Re: GIF experts
by Romana Machado 17 Dec '03

17 Dec '03

Hi Shari, I am not quite an expert on GIFs, but I know a thing or two about manipulating digital images to hide information - steganography, and I am writing a shareware tool for the MAC that can embed data undetectably within GIF images. The first release date is scheduled for October 15. I am also working on providing an IBM version of this about one month later. If this interests you, let me know. Cheers, Romana romana(a)apple.com

1 0

FAX # for Clipper Comments
by Matt Blaze 17 Dec '03

17 Dec '03

I just checked with NIST; they are accepting FAX comments on the Escrowed Encryption Standard until close-of-business today. The number is 301-948-1784 -matt

1 0

Re: Disturbing statistics on wiretaps
by stig＠netcom.com 17 Dec '03

17 Dec '03

It should be noted that although it is illegal for the cops/feds/spooks to tap phone lines without a warrant, only illegally-obtained voice communications are inadmissible in court. This means that fax and modem communications can be illegally intercepted and STILL used in court against you. Stig ;; __________________________________________________________________________ ;; Stig(a)netcom.com netcom.com:/pub/stig/00-PGP-KEY ;; It's hard to be cutting-edge at your own pace... 32 DF B9 19 AE 28 D1 7A ;; Bullet-proof code cannot stand up to teflon bugs. A3 9D 0B 1A 33 13 4D 7F

3 3

Re: Orange book, the NSA, and the NCSC
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Dan Odom clarifies some information about NSA, NCSC, Orange Book series, etc.: > > I'm willing to accept that the Orange book doesn't specifically address > > cryptography, and I appreciate the clarifications on something that is > > one of the deepest, complex, and most obscure military handbooks, which > > Uh, any American citizen is entitled to one (1) free copy of the > Orange Book (and every other book in the Rainbow series); all you have > to do is ask. The address on the inside of my copy says: > > NCSC > 9800 Savage Road > Fort George G. Meade, MD 29755-6000 I got on this list of automatic books several years ago and now have about a dozen or more different publications, in different colors, from blue to green to the famous orange. All from the National Computer Security Center. Nothing juicy, and not much fun (for me) to read. Unix gurus trying to get better security classifications for their machines and systems have to read this stuff, though. > Since every NSA address I've ever seen is 9800 Savage Road, I assume > that it's some sort of secretarial thing. But if you ask them for a > copy of the Rainbow Series, they'll send it to you and also put you on > the list to receive updates. It is _not_ deep, complex, or obscure; Savage Road is the actual address of the Agency; Fort Meade per se is huge. NCSC as created in 1984 as part of NSDD-145 (National Security Decision Directive-145, a very important one). Prior to that date it had been called the DoD Computer Security Center, located smack dab in the center of SIGINT City. (I visited in May of 1991, strictly to satisfy my own curiousity. The closest I got was the front gate, with the newly installed "National Security Agency" signs. Signs said "Das Photographen ist Strictly Verboten," but I took a bunch anyway out my car window.) > And before anybody starts forming consipiracy theories, I am not > related to Lieutenant General William Odom; we just share a name :-). I'd long been meaning to ask Dan about this. General Odom once was introduced at a speech he was giving to Jim Bamford. Odom recoiled and said "Sir, I consider you to be an unindicted felon." -Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

2 2

No Subject
by ssimpson＠eff.org 17 Dec '03

17 Dec '03

I'm happy to say that there were 225 letters offering comments on the proposed key escrow system sent to the cryptnow(a)eff.org address. They were printed out and delivered today. Many thanks to all who responded to the call for action. I've gotten really positive responses to the post and our electronic mail mechanism. If you think that this sort of notice helped you to be informed and participate in policy, please drop me a note at ssimpson(a)eff.org. Let me know if you think that this is an important service that EFF can provide for the online community. Below is the text of the comments that EFF filed with NIST today. ================================ September 27, 1993 National Institute for Standards and Technology ATTN: Proposed FIPS for Escrowed Encryption Standard Technology Building, Room B-154 Gaithersburg, MD 20899 To The Director: The Electronic Frontier Foundation (EFF) writes in strong opposition to the Proposed Federal Information Processing Standard (FIPS) for an Escrowed Encryption Standard, docket # 930659-3159. We believe that NIST's guidance in setting technical standards for security and privacy protection is a critical part of the growth of the National Information Infrastructure, but any action on the proposed escrow technical standards must await the resolution of several fundamental policy issues. Thus, at this time, we oppose the proposed FIPS in all of its parts. Well over 200 EFF members are also critical of the Proposed FIPS. We believe this demonstrates the depth of public concern about the implementation of key escrow systems. EFF is a nonprofit, public interest organization whose public policy mission is to ensure that the new electronic highways emerging from the convergence of telephone, cable, broadcast, and other communications technologies enhance free speech and privacy rights and are open and accessible to all segments of society. Introduction Widespread, affordable cryptography is vital for the protection of individual privacy in the Information Age. As more and more personal information flows around electronic networks, we all need strong encryption to safeguard information from unwanted intrusion. Personal information, such as health care records, private communications among friends and families, and personal financial transactions, will also travel over this information infrastructure. The business community can only make full use of the infrastructure if it is assured that the data it transmits is secure from unauthorized interception. In short, if communications in the new infrastructure are vulnerable, all of our lives and businesses would be subject to both damaging and costly privacy and security losses. Resolve Policy Issues and Objectives Before Promulgating Technical Standards EFF has been in ongoing dialogue with NIST, the White House, and Congress regarding the very complex public policy choices raised by cryptography policy. We are hopeful that this dialogue will result in a positive, comprehensive set of cryptography and privacy policies. But until these issues are resolved, we believe any approval of technical standards is premature. Among the public policy issues to be resolved are the following: 1. Guaranteed Continued Legal Use of All Forms of Encryption When the Clinton Administration announced the Clipper Chip, it assured the public that this would be a purely voluntary system. We must have legal guarantees that Clipper is not the first step toward prohibition against un-escrowed encryption. Yet the Administration has not offered any such guarantees, either in the form of proposed legislation or even agency rules. 2. Identity of Escrow Agents When Clipper was first proposed, some in the Administration suggested that one of the two escrow agents would be a government agency and the other a private, non-governmental organization. Now it appears that plans for a private escrow agent have been dropped in favor of NIST and the Department of Treasury, though there is still no final designation of agents. We are unable to comment on the security or reliability of escrow procedures proposed here when we do not know who will be administering the escrow databases. We also note that there is active consideration of having more than two escrow agents. This option should be explored from a policy perspective before a technical standard is adopted. 3. Legal Rights of Escrow Users If individuals do choose to deposit their keys with the government, or any other escrow agent, they must have some legal recourse in the event that those keys are improperly released. However, the most recent draft of escrow procedures specifically states: "These procedures do not create, and are not intended to create, any substantive rights for individuals intercepted through electronic surveillance, and noncompliance with these procedures shall not provide the basis for any motion to suppress or other objection to the introduction of electronic surveillance evidence lawfully acquired." Leaving users with no recourse will discourage use of the system and provides little disincentive against unscrupulous government behavior. In the Proposed FIPS, NIST also suggests an unusual and, we believe, incorrect notion of what an escrow agent is. The Proposed FIPS adopts the incomplete definition of an escrow system found in Webster's Dictionary. The Proposed FIPS states: To escrow something (e.g., a document, an encryption key) means that it is "delivered to a third person to be given to the grantee only upon the fulfillment of a condition." (Webster's Seventh New Collegiate Dictionary). This definition omits the very basic notion that an escrow agent has responsibilities to those who deposit things of value in the escrow account. Black's Law Dictionary, which we believe may be a more appropriate source of information about escrow relationships, states that an escrow contract is an: Agreement between buyer, seller, and escrow holder setting forth rights and responsibilities of each. It is the general legal rule that one who deposits value with an escrow agent is entitled to recover damages from the escrow agent in the event of a breach of the agent's duty of care: Depositor is entitled to recover damages sustained because of escrow agent's unwarranted act, and where grantee participates in wrongful delivery he also may be liable, but recovery is limited to damages actually attributable to wrongful delivery. Collier v Smith (Mo App) 308 SW2d 779. (See ANNOTATION: Who must bear loss resulting from defaults or peculations of escrow holder. 15 A.L.R.2d 870.) The notion of an escrow agent who is insulated from all liability to the depositor is wholly alien to American law and custom. The government may, of course, seek to establish escrow agents free of legal liability, but this is fundamentally a policy choice, not a matter of technical standards. Until there is some agreement on the real responsibilities of the escrow agents, NIST is not in a position to set technical and operating standards. 4. Open, Trusted Standards: A key goal of the Clipper Proposal is to promote widespread encryption in the marketplace. Yet people will not use encryption unless they trust it. Secret standards such as Clipper cannot be evaluated by independent experts and do not deserve the public trust. Other parties, including Whitfield Diffie of Sun Microsystems, have commented extensively on this issue. EFF fully subscribes to those remarks. Insufficient Technical and Operating Information Available for Comments Even aside from the major policy issues left unanswered, the Proposed FIPS itself lacks the detail necessary to allow full public comment. First, the full operating procedures for the escrow agents has yet to be issued. Public comment must be sought on the complete procedures, not just the outline presented in the draft FIPS. Even the government-selected algorithm review group has declared that it needs more information on the escrow process. Second, asking for comments on an algorithm that is classified makes a mockery of citizen participation in government decision-making. Action on the Proposed FIPS Must Be Delayed to Allow Completion of Public-Private Consultation Mandated by Presidential Decision Directive President Clinton's announcement of the Clipper initiative made very clear that there should be "early and frequent consultations with affected industries, the Congress and groups that advocate the privacy rights of individuals as policy options are developed" (April 16, 1993 Press Statement). EFF and other organizations have invested significant effort in dialogue and policy review with the Administration. We have made some progress, but many issues remain unresolved. EFF believes that for NIST to rush forward with a FIPS in advance of resolving the fundamental policy issues cited above would prematurely curtail the dialogue that the President ordered. Finally, NIST will be involved in making many critical decisions regarding the National Information Infrastructure. The next time NIST solicits public comments, it should be ready to accept reply by electronic mail in addition to paper-based media. Over 200 of EFF's members e-mailed comments to our offices, which we then printed and hand-delivered to NIST. We hope that in the near future, NIST and other federal agencies will be prepared to accept comments directly via the Internet. Respectfully Submitted, Jerry J. Berman Daniel J. Weitzner Executive Director Senior Staff Counsel ****************************** Sarah L. Simpson Membership Coordinator Electronic Frontier Foundation 1001 G Street, NW Suite 950 East Washington, DC 20001 202/347-5400 tel 202/393-5509 fax

2 1

MPJ Encryption Algorithm comments
by Michael Johnson 17 Dec '03

17 Dec '03

Due to an unfortunate circumstance beyond my control, all of my mail from this group for the last 30 hours got forwarded to /dev/null. If anyone had comments on the MPJ Encryption algorithm, please send them to me again at mpj(a)csn.org or mpjohnso(a)nyx.cs.du.edu. Mike

1 0

Re: Phil Zimmerman on 'The Death of DES'
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

Single DES is weak, for a known plaintext attack. I think we knew that. We didn't know how weak. We can extrapolate to an NSA machine with 1 second scan of all keys, perhaps. So -- 1. use triple DES 2. before using DES, XOR with a stream from a decent PRNG (destroying the known plaintext) 3. in between DES operations, mix bytes up as with tran (posted on sci.crypt occasionally, avbl from me by mail or on ripem.msu.edu) -- spreading bytes out within a huge block, further hiding any known text - Carl

4 3

Re: Challenge: break the MPJ Encryption Algorithm
by Michael Johnson 17 Dec '03

17 Dec '03

On Tue, 28 Sep 1993, Carl Ellison wrote: > Is each of your 160 permutation arrays a self-inverse or do you generate > different arrays for encryption and decryption? No, they are not self inverses. The inverses are computed from the forward arrays to decrypt in electronic codebook mode. Note that in some chaining modes, the reverse mode isn't even needed, and the arrays could literally be filled with random numbers. Mike Johnson Long live the U. S. Constitution!

1 0

Rep. Gejdenson's NET address
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

>Still the NSA can't stave off the inevitable for long. Gejdenson hopes to >produce legislation by early next year to revamp government policy on high >tech exports. Rep. Gejdensons NET address is: bozrah(a)hr.house.gov for those of you who care to write him. This is a receive address only, he can't as of yet respond. Scott G. Morham ! The First, Vaccinia(a)uncvx1.oit.unc.edu ! Second ! and Third ! Levels of ! Information Storage and Retrieval ! DNA, ! Biological Neural Nets, ! Cyberspace

1 0

No Subject
by VACSC0D4＠VAX.CSUN.EDU 17 Dec '03

17 Dec '03

A little over a month ago, I called Mykotronx and asked for information about the Clipper chip. Their response was vague: we're working on some ap notes, but they're not ready yet. I called back today. The person who answered the phone put me on hold for a minute, then came back and told me she had spoken to the VP of engineering and that the ap notes would be ready in four weeks. It looks like Clipper has really been put into high gear. When they are ready, I'll try to get them and post the interesting stuff here. -- MikeIngle(a)delphi.com (using my student account; don't reply here - reply to Delphi)

1 0

Re: Disturbing statistics on wiretaps
by smb＠research.att.com 17 Dec '03

17 Dec '03

The same is true of e-mail over the Internet--there is no statutory exclusionary rule that would prvent its admissibility in court. It is at least theoretically possible, however, to exclude illegally seized communications of these sorts using a "pure 4th Amendment" (nonstatutory) exclusionary rule. Don't hold your breath, though. Do you really think that? One could argue, fairly strongly, that the rules set forth in the ECPA have created an expectation of privacy, and that a violation of that expectation would be exactly the violation of the 4th Amendment that the Supreme Court addressed in the 1967 decision that led to the original wiretap provisions in the Omnibus Crime Control and Safe Streets Act.

1 0

Re: the public key minefield
by baumbach＠atmel.com 17 Dec '03

17 Dec '03

> The question is phrased improperly. Apart from the fact that the > concept (though not the reality) of anti-gravity is prior art, they > didn't patent the concept of public-key cryptography. Rather, they > patented a class of devices fitting a certain description, with one > public key cryptosystem as an example and as a separate set of claims. > To use your analogy, I could patent anti-gravity achieved by interposing > a screen of some substance opaque to gravity, and patent Cavorite as > an instance of that class. If you had another use for Cavorite, you'd > be home free. Or if you found a way to neutralize gravity by beaming > anti-gravitons downward, you'd probably be clear, too. But if you > found another substance besides Cavorite that was opaque to gravity -- > yes, that would be covered by my patent. (Fortunately, H.G. Wells didn't > patent his literary device. But I can't think of another science > fiction author who used that technique....) > > It's certainly possible that all possible cryptosystems that achieve the > same effect would be covered by their description. That, of course, is > the mark of a good patent attorney's work -- that he or she managed to > fashion so broad a claim. But maybe you can find a better way to do what > you really want to do, which is trade keys and authenticate messages. I think you have convinced me. I don't want to be convinced, so maybe I will try again later, when I have learned more about it. ;-) This means to me, that you cannot patent a broad claim, until you have a narrow specific example of it. Anti-gravity had prior art, public key systems did not. If without inventing a public key system, someone had described the concept in general terms, then prior art would exist for this as well. The person who invented the wheel (or sled?) might have been able to have claims broad enough to cover hovercrafts. > And if you do -- well, then, the patent system has succeeded in its goals, > in that the monopoly assigned to someone else has stimulated you to find > another way to do things, and thus furthered the useful arts and sciences. At what expense? Will our government win some battles, it might otherwise lose to the cypherpunks? Would legal access to pgp, now, be a deciding factor to maintaining legal access to non-clipper encryption later? Peter Baumbach baumbach(a)atmel.com

1 0

Re: the public key minefield (fwd)
by Svetlana Borisova 17 Dec '03

17 Dec '03

svet wrote:

1 0

Re: Clinton UN Speech / Msg to Prez/VP
by plaz＠netcom.com 17 Dec '03

17 Dec '03

Perry Metzger states (perhaps incorrectly): >Mike Ingle says: >> In his UN speech this morning, Clinton talked about cracking down on nuke >> and missile proliferation, and he also mentioned eliminating cold-war-era >> restrictions which are harming American business. Let's put together a >> message to president(a)whitehouse.gov and vice-president(a)whitehouse.gov >> (since Gore is the info-highway guru) stating our position. > >Messages sent to president(a)whitehouse.gov are weighed, not read. I >suspect this will have about as much effect on the president as a note >written in a bottle and tossed into the ocean. > >However, on that basis, its perfectly harmless for you to send a >letter saying anything whatsoever other than a threat on the >president's life, so if you and others would like to spend time >writing such a thing, you can feel free. Just remember that there is >no cypherpunks organization, so you can't claim to represent us. Depends how you define harmless. If I recall the original e-mail release correctly, they do archive all messages. No assurances are made that these messages will not be used against you (ie- might end up in some file on you; I doubt that it would be used in court). To reenforce Perry's point: Any threats against the Prez or his clan WILL get forwarded to the secret service, so DON'T pull that one. Death threats are useless (and most likely counter-productive) tactics anyway. But writing letters to that address are probably at least as effective as writing to him via US Snail. Keep the message focused on one idea (remember it will probably be tabulated as for or against an issue) and make sure that the message gets across clearly. Who knows, if a enough messages get through on a subject, Bill or Al might get a one line statement in one of there meetings saying that the online community is "up in arms" about skipjack or the pgp subpoenas. _______________________________________________________________________ Geoff Dale -- insert standard disclaimers here -- plaz(a)netcom.com "Communists! Those bug-brained motherfuckers are even worse than the schmucks who think they run things here." - Norman Spinrad, from his novel "Little Heroes"

1 0