December 2003 - cypherpunks-legacy

"Drift net fishing," GAK, FBI, and NSA
by Timothy C. May 17 Dec '03

17 Dec '03

A couple of posters have talked about "drift net fishing" of communications, where random stuff is sampled and intelligence items gleaned. (I think it was Ernest Hua who cited the example in a Tom Clancy book/movie.) Perhaps, but let's go back to the discussions at the EPIC "SAFE" conference in Palo Alto several months ago. Some convincing evidence was presented that the moving force behind GAK is *not* the NSA, but is rather the *FBI*. Specifically, even 40-bit keys are probably too long for massive "drift net fishing," in that the cost per break is probably still too high. The cost for a "focussed attack" (I can't think of a fishing parallel...maybe "spear fishing"?) is of course low. The speaker at SAFE pointed out that the FBI is pushing for the 40-bit keys (and now is accepting the 56-bit keys?) because for focussed attacks, e.g., on the communications of a person under observation, they can call on other agencies to break the ciphers for them (even if they don't yet have their own such machines). In a nutshell, almost any level of encryption above, say, 30something bits, is too much when millions of messages per day are to be "drift-netted" is too much. (The exact number that is "too much" depends on a lot of factors, including the cost of the cipher-breaking machines, the number of messages to be read per day, etc. This number will change with time.) The FBI's interest may be changing, too. Their lead role in the TWA 800 investigation may have them sorely wanting "drift net" capabilities, as all other leads are exhausted. If we see more of these sorts of terrorist (maybe) incidents, it may be that more "drift net" capabilities are sought. A note on _contact analysis_. One thing the FBI probably wants badly are databases of who has travelled where, and when, for correlation analysis. Note that the crackdown on "valid IDs" for travel, for airlines, helps in this regard. I would not be surprised to learn that the airline databases are routinely fed to the Feds, so to speak. (Possibly via the FAA, acting as a kind of cutout.) Were I the head of the FBI, this is what I would want. The next step will be collecting hotel reservation databases. (Unlike the case with the FAA and the airlines, I don't know what kind of authority would grant them access to private hotel databases, but I expect they are working to find such authority somewhere. Maybe the infinitely malleable "regulation of commerce" clause, even if hotel stays are canonically _not_ interstate trade!) (They already got access to the credit card databases, decades ago, of course.) --Tim May "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Voice Stress Analysis of Debates?
by jim bell 17 Dec '03

17 Dec '03

At 09:23 AM 10/6/96 -0700, Dale Thorn wrote: >jim bell wrote: >> This reminds me... Years ago, somebody developed a technique called >> "Voice Stress Analysis," which was supposed to detect small variations >> in a person's voice in response to stress. Not exactly a lie-detector, >> but it was supposed to do nearly the same thing. Does anybody plan >> to analyze the debates for stress? Is there software to do this? >> (Tried to do a web-search; didn't see anything.) > >Pardon me for butting in. Some remailer says I post too much, and I >should cut out some. They didn't say which posts I should cut out, tho'. Cryptography is, basically, the area of hidden meanings. In a sense, a voice-stress analyzer is intended to seek out hidden meanings in a person's statements. So I'd say it's as on-topic as most of the stuff 'round here. >Anyway, as I understand it, the current technology in voice/stress >analysis goes way beyond the polygraph at its best (current) level of >technology. There was at least one agency that did voice analysis >during the Simpson debacle, and the results were (as I recall) very >promising. Apparently, a person who can beat a polygraph cannot beat a >voice/stress analysis. One thing I wonder is this: Can the stress indications be removed from a voice-containing signal by some sophisticated DSP processing? Just look for whatever effect that indicates stress, add it in equal and negative amounts to eliminate the apparent stress, etc. It might not make sense for anything less "critical" than debates, but if the control of the debates is as monopolized as we think it is, it is reasonable to think that debate participants would insist on a certain level of control over the audio signal. >BTW, the rule for these debates (as all presidential discourse) is: >"He's lying." >"How can you tell?" >"His lips are moving." Well, I sorta assumed this. But I would still be interested to get some kind of quantitative feedback on the debates. If anything, the ABSENSE of the news media's attempting to use voice-stress analysis is telling. Jim Bell jimbell(a)pacifier.com

4 3

Re: WINDOWS NT ????
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sun, 6 Oct 1996 01:28:16 -0500 (CDT), snow wrote: >> An NT machine running off the shelf protocols and services is certainly mor= >> e secure than your average linux install. Of course clueless administrators= >> for either (any) platform can leave the door wide open easily enough.=20 > How about an "average" NT install versus a "average" linux install? Or, better yet, the typical "rent-a-loser" admin install. You know, the one who installs everything in the root directory? (I've seen this happen; don't laugh) > Neither of my machines are all that secure, but they don't have to >be right now. Neither has more than 5 users, all of whom I either trust >personally, or don't know enough to do anything. On the other hand, I >would be willing to bet that Mr. Metzger, or adamsc (sorry, I forgot your >full name) could lock a linux box down as tight as a networked NT machine. With enough time and net access, just about anyone could - if they thought it was important. Unfortunately, many people just don't realize how open their system is... > Hell, I'd bet 20 bucks I could. The machine wouldn't DO a whole lot, >but it would be tough to break into. (basically, don't run telnetd, ftpd, >sendmail, run sshd for incoming/outgoing connections, use a secure httpd >IF NECESSARY, NO NFS, shadow passwords etc.) ++agree. >> But what do you mean by secure? > Safe from undesired intrusion. Now, the much harder one is: safe from undesired usage by authorized users. As in that guy from the Dept of Health who was handing out the AIDS info... # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

You can be forced to turn over your encryption keys?
by Geoffrey C. Grabow 17 Dec '03

17 Dec '03

I thought we had a 5th amendment. Isn't turning over your key that may (or may not) expose encriminating evidence an extension of self-encrimination? Haven't there been dozens of famous witnesses (Patty Hurst, Oliver North, etc) that "take the 5th" dozens of times on the stand. Why couldn't I "take the 5th" when asked for my encryption keys? When asked for your key, can't you say: "I'm sorry your honor, but I respectfully refuse to answer that question on the grounds that it may incriminate me.". Any legal-eagles out there? G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | Great people talk about ideas. | | Oyster Bay, New York | Average people talk about things. | | gcg(a)pb.net | Small people talk about people. | |----------------------------------------------------------------------| | PGP 2.6.2 public key available at http://www.pb.net/~wizard | | and on a plethora of key servers around the world. | | Key ID = 0E818EC1 | | Fingerprint = A6 7B 67 D7 E9 96 37 7D E7 16 BD 5E F4 5A B2 E4 | |----------------------------------------------------------------------| | That which does not kill us, makes us stranger. - Trevor Goodchild | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

David Sternlight knows 1000 times more about cryptograpjy than Timmy May
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Cryptanalysis by David Sternlight: >From: David Sternlight <david(a)sternlight.com> >Newsgroups: phl.food,alt.food.wine,ne.food,rec.food.drink.coffee,rec.arts.fine,rec.food.cooking,austin.food,triangle.dining,la.eats,soc.culture.jewish,chi.eats,memphis.dining,nyc.food >Subject: Re: 2nd Avenue Kosher Deli is on the Web, and they do mail order! Go to http://www.quicklink.com/~nycdeli/ >Message-ID: <32574E6F.64F1(a)sternlight.com> >Date: Sat, 05 Oct 1996 23:15:11 -0700 >References: <01bbb2c8$efc52a60$29a5c0d0@dell-xps-p200s> <5366ac$qtj(a)news1.panix.com> <slrn55dmhj.4r.jamie(a)apm5-190.realtime.net> >Reply-To: david(a)sternlight.com >Organization: DSI/USCRPAC >Lines: 14 >NNTP-Posting-Host: sternlight.com >Mime-Version: 1.0 >Content-Type: text/plain; charset=us-ascii >Content-Transfer-Encoding: 7bit > >jamie wrote: >> >> On Sat, 05 Oct 1996 19:46:07 GMT, Andrew Mathis <fresh(a)panix.com> wrote: >> >Two observations >> >1) From the most Orthodox standpoint, 2nd Ave. Deli is not Kosher >> >because they are open on Shabbat. Many frum Jews I know refuse to eat >> >there >> >> Ah....kosher style, then? > >Congregant: "What does "kosher style" mean? >Rabbi: "Tref". > >David

1 0

Re: "Drift net fishing," GAK, FBI, and NSA
by jim bell 17 Dec '03

17 Dec '03

At 10:07 AM 10/6/96 -0800, Timothy C. May wrote: >Some convincing evidence was presented >that the moving force behind GAK is *not* the NSA, but is rather the *FBI*. >Specifically, even 40-bit keys are probably too long for massive "drift net >fishing," in that the cost per break is probably still too high. The cost >for a "focussed attack" (I can't think of a fishing parallel...maybe "spear >fishing"?) How about "DuPont-lure fishing"? is of course low. The speaker at SAFE pointed out that the FBI >is pushing for the 40-bit keys (and now is accepting the 56-bit keys?) >because for focussed attacks, e.g., on the communications of a person under >observation, they can call on other agencies to break the ciphers for them >(even if they don't yet have their own such machines). > >In a nutshell, almost any level of encryption above, say, 30something bits, >is too much when millions of messages per day are to be "drift-netted" is >too much. (The exact number that is "too much" depends on a lot of factors, >including the cost of the cipher-breaking machines, the number of messages >to be read per day, etc. This number will change with time.) You should also factor in the government's ability to store what they can't immediately decrypt, which drastically changes the playing field with regard to encryption. It was at least five years ago when I first read about a system to record data on so-called "digital paper," which was actually a plastic with a photo-writable layer similar to write-once CD's. It could be formed in any configuration, but perhaps one of the more intriguing (due to the large writable area) is on large reels similar to 1/2" magtape. As I recall, they claimed that such a reel could hold 1 terabyte of data. Sure, such a capacity is small compared with the total Internet traffic, but I assume that most traffic could be excluded from recording if its source was known, etc. They'd exclude anything from "probably-okay" web pages, they'd trim space-hogging graphics, etc. "Just the facts, ma'am." Call the whole thing "retroactive-selective-drift-net-fishing," if you will. Once this data is stored away the government would determine (perhaps years after the fact?) which data they want to decrypt, possibly based on crimes committed long after the data was recorded. This information might reveal contacts, etc. Obviously they have no prayer of doing real-time analysis. Even so, it makes it far more practical to do the equivalent of drift-net fishing if they can exclude 99.9999%+ of the traffic from their decryption attempts. 56-bit encryption doesn't look so ominous to them in this case. Jim Bell jimbell(a)pacifier.com

2 1

Re: Voice Stress Analysis of Debates?
by azur＠netcom.com 17 Dec '03

17 Dec '03

> Jim Bell <jimbell(a)pacifier.com> wrote: >One thing I wonder is this: Can the stress indications be removed from a >voice-containing signal by some sophisticated DSP processing? Just look for >whatever effect that indicates stress, add it in equal and negative amounts >to eliminate the apparent stress, etc. It might not make sense for >anything less "critical" than debates, but if the control of the debates is >as monopolized as we think it is, it is reasonable to think that debate >participants would insist on a certain level of control over the audio signal. > > [snip] >But I would still be interested to get some >kind of quantitative feedback on the debates. If anything, the ABSENSE of >the news media's attempting to use voice-stress analysis is telling. > BTW, did anyone notice that some of the evening news anchors are imaged via a camera/DSP to render as more youthful (e.g., removing facial wrinkles)? PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Voice: 1-702-655-2877 Sacred Cow Meat Co. | Fax: 1-702-658-2673 7075 W. Gowan Road, #2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

1 0

Re: "Drift net fishing," GAK, FBI, and NSA
by azur＠netcom.com 17 Dec '03

17 Dec '03

>A note on _contact analysis_. One thing the FBI probably wants badly are >databases of who has travelled where, and when, for correlation analysis. >Note that the crackdown on "valid IDs" for travel, for airlines, helps in >this regard. I would not be surprised to learn that the airline databases >are routinely fed to the Feds, so to speak. (Possibly via the FAA, acting >as a kind of cutout.) Were I the head of the FBI, this is what I would >want. The airlines don't yet carefully check IDs (no SSN or DL # retained). They merely check that the name on your ID matches the reservation. > >The next step will be collecting hotel reservation databases. (Unlike the >case with the FAA and the airlines, I don't know what kind of authority >would grant them access to private hotel databases, but I expect they are >working to find such authority somewhere. Maybe the infinitely malleable >"regulation of commerce" clause, even if hotel stays are canonically _not_ >interstate trade!) > >(They already got access to the credit card databases, decades ago, of course.) > Are SSN and other ID required when opening a 'pre-paid' credit card account? That is, the ones for persons with poor credit who are required to maintain a balance sufficient to pay off the charges? Perhaps we could put our heads together and determine a way to become franchised by MC/VISA and offer 'affinity' type accounts with no address requirements (all statments are sent via remailer/nym email). -- Steve

10 13

Re: FUCK!!!!!!;-)
by Will Rodger 17 Dec '03

17 Dec '03

At 08:23 AM 10/6/96 -0700, Declan McCullagh wrote: >Will is hardly a "media monopoly" representive, or someone who spits out >"ADS as news." > >If his longtime reading of the cypherpunks mailing list wasn't a good >enough clue, you may remember that Will broke the Clipper III story >earlier this year. > >And yes, I am a card-carrying member of the media -- and a fan of Will's >writing. > >-Declan > >HotWired >Washington, DC > Thanks, Declan. You've helped restore my faith in fellow journalists. I'm touched. Cheers. Will

1 0

Re: legality of wiretapping: a "key" distinction
by Greg Broiles 17 Dec '03

17 Dec '03

At 06:10 PM 10/5/96 -0800, Jim Bell wrote: >At 02:14 PM 10/5/96 -0700, Greg Broiles wrote: >>At 04:42 PM 10/4/96 -0800, jim bell wrote: >>>I think it's really very simple. Wiretaps in the US were illegal until >>>1968. >> >>Then please explain what the Supreme Court was doing some 40 years prior to >>1968, in _Olmstead v. US_ 277 U.S. 438 (1928), where the product of a >>wiretap was held to be admissible because without a physical trespass there >>was no Fourth amendment violation. (This is no longer good law.) > >Then you ignored the rest of my commentary. While wiretaps were narrowly >held "constitutional" in about 1932, as I vaguely recall, that doesn't mean >that they were LEGAL: On numerous occasions subsequent to 1932, Congress >rejected laws which would have legalized the use of wiretaps. They were not >provided for under law. Obviously, you could take the position that >Congress could have approved of them at any time, as they did in 1968, but >apparently it took such approval to _legalize_ them. Congress doesn't need to explicitly approve the use of new investigatory tools or techniques. Do you think that cops needed special legislation before they could use cars, or telephones, or helicopters, or cameras, or fancier guns, or ..? Also, Congress is not the only legislature to think about - the individual states can (and have) developed their own statutes relating to wiretaps, law enforcement use of wiretaps, and so forth. (See, e.g. Cal. Penal Code s. 630 et seq, Oregon Revised Stats. s. 165.540 et seq) Also, Congress' intent when it passed Title III in 1968 was not to "legalize" wiretapping but to standardize it. I quote from Pub.L. 90-351 (1968): "On the basis of its own investigations and of published studies, the Congress makes the following findings: (a) Wire communications are normally conducted through the use of facilities which form part of an interstate network. The same facilities are used for interstate and intrastate communications. There has been extensive wiretapping carried on without legal sanctions, and without the consent of any of the parties to the conversation . . . The contents of these communications and evidence derived therefrom are being used by public and private parties as evidence in court . . . (b) In order to protect effectively the privacy of wire and oral communications, to protect the integrity of court and administrative proceedings, and to prevent the obstruction of interstate commerce, it is necessary for Congress to define on a uniform basis the circumstances and conditions under which the interception of wire and oral communications may be authorized . . ." It took me less than ten minutes to find that. You could have taken that ten minutes instead. It's abundantly clear that you don't give a shit about the accuracy of what you write. If you're making things up or speculating, you could at least say something like "I think Congress was probably acting to legalize previously illegal wiretaps in 1968", so that it's clear that you're writing on the basis of speculation, not research. It'd also be nice if you'd add some sort of indication that you're posting about your own secret version of the law instead of the one that's used in courtrooms, but I'm going to go ahead and assume that the former is what you mean in the future. >You're ENTIRELY misunderstanding (or misrepresenting) what I'm saying! I'm >well aware that the SC disagrees, but that is simply because they are >entirely wrong in this matter. Why should this surprise you? Given the >rash of 5-4 decisions in the last few years, there can be no illusion that >they always come to the right decision. I don't claim that they agree with >me, quite the opposite. But if anything, their error justifies removing >them by whatever level of force turns out to be necessary. As a matter of Constitutional interpretation, the Supreme Court cannot be "wrong". You and I can disagree with them, but their interpretation is the magic one that trumps ours in court. If we're going to try to organize our lives around a body of writings (e.g., laws) it's not useful for everyone to make up their own meanings for the laws because if we're all following different laws, that's more or less the same as having no law at all. Somebody's interpretation has to be the "right" one; and the United States is organized and has evolved such that the Supreme Court's is the right one. I think it's reasonable for you to say that you don't want to play that game, but I don't see why you need to pretend that your failure to play the game has anything to do with law or legal reasoning. If what you want is anarchy (and as I understand things, you're arguing that people should live by their own interpretation of what's right and wrong, and should kill people who disagree with them, which seems like a fair although unnecessarily dismal view of anarchy), there's no point in arguing about the Constitution. >> Here's a tip: if you think of a >>way to interpret the Constitution that would make law enforcement not >>merely less efficient but effectively impossible, your interpretation will >>not be adopted, > >Your statement is inadvertently illuminating. Legal decisions are not >supposed to be made by people who have a stake in the outcome. Here, you >are acknowledging that there is no way to expect the current legal system >will come to any kind of objective decision concerning these matters, >precisely because they would reject any decision which was seen as >"mak[ing] >law enforcement effectively impossible." This sounds like a classic >conflict-of-interest, huh? It's not quite the same as receiving a bribe, >or falsely convicting an ex-wife's lover of murder, or some sort of purely >personal issue. Nevertheless, it is a conflict of interest. It's not inadvertent - I meant what I said. The Constitution is a document for organizing a government. If you're going to interpret it into such a pretzel-like format that it no longer describes a functional government, it's much more sensible to just say "I don't want to have a government". If you do want to have a government, interpretations which prevent it aren't useful. Your hypothetical "conflict of interest" problem seems beside the point; I don't see how the "can government ever be legitimate?" or "can the government exist?" or "can the government act to enforce the laws?" sort of questions which would create a conflict would ever really be up for debate. There's simply no meaningful argument that the Constitution was intended to do anything but create a government; and it envisions that the executive branch will enforce laws that the legislature chooses to enact. Again, there are certainly other ways to organize human behavior and human societies. But they don't need to have anything to do with the Constitution. In particular, I don't see any reason to try to make anarchy and the Constitution compatible in some perverted logical universe. >And BTW, you vastly overstated your case by suggesting that the rejection of >wiretaps would "make law enforcement...effectively impossible." Before >telephones, there were no wiretaps, right?!? (I won't claim "justice was >done," then, but they would have claimed it was...) And even today, >probably 99%+ of cases decided by courts within the US do not contain any >wiretap evidence at all (I invite you to correct me if I'm wrong, here!) so >I suggest that it is obvious that even the complete rejection of wiretaps >wouldn't "make law enforcement...effectively impossible." (how could it?) Sorry. I skipped a step. I see no meaningful distinction between wiretaps and other searches & seizures. The rule you want to apply to wiretaps should, if it's a good rule, be applied to all searches & seizures. There's nothing special about phone calls. If we're going to give people notice & an opportunity to be heard before even preliminary steps are taken in a criminal proceeding, very few prosecutions will get off the ground. (We can either leave people free pending decisions about searches & arrests, in which case they've got reason & an opportunity to make themselves scarce or destroy evidence; or we can lock them up and seize their houses while arguing about search/arrest warrants, which is also a problem because most of the evidence about guilt or innocence isn't available yet .. so you're holding people & property with very little evidence of wrongdoing. And that's not constitutional or good.) Also, the premises of your argument were known at the time the Fourth Amendment was written & adopted. I think that if the writers & adopters had meant for there to be a pre-search hearing for the target of the search, they'd have said so. You and Detweiler seem to be missing the distinction between what's constitutional and what's useful or possible. I believe that wiretaps are constitutional (assuming the cops jump through all the right hoops). I believe that laws which force me to use wiretappable phones in my home or business are unconstitutional. If many people use unwiretappable phones then wiretaps will become obsolete. But they will still be constitutional in their obsolescence. These two approaches "wiretaps are not allowed" and "wiretaps are allowed but citizens are able to make them ineffective" do reach a similar result (very few or no wiretaps) but the approach used to reach the result is meaningfully different. In particular, the second approach doesn't require a reorganization of search & seizure law. Such a reorganization is unlikely to occur. >>and therefore is not useful. > >No, actually it's potentially quite useful! It's just highly embarrassing >for anyone who has a strong psychological stake in working entirely within >the American legal system. Your arguments are only "highly embarrassing" to someone who identifies with the legal system only in that they have enough buzzwords and are internally consistent (even if based upon fantasy) enough that people with no meaningful contact with the legal system might mistake you for someone familiar with it. >>It might or might not be >>theoretically elegant or logically attractive, it will not be adopted. So >>stop thinking about it. > >Ultimately, I don't think there's even a choice in the matter: The current >system WILL be dropped, possibly directly onto the heads of the people who >currently populate it! Are you going to be part of the solution, or part >of the problem? Depends on your perspective. As this is really no longer even tangentially related to technology or privacy, I won't post further about it (absent a renewed connection to technology or privacy, which I don't anticipate). Jim, you and anyone else who wants it are welcome to the "last word". Please don't interpret my failure to respond as agreement or endorsement of anything beyond an attempt to get the list back closer to being on-topic. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

2 1