December 2003 - cypherpunks-legacy

Steve Jackson opposes Clipper FIPS
by L. Detweiler 17 Dec '03

17 Dec '03

===cut=here=== Date: Sun, 26 Sep 93 21:15:13 GMT From: sj(a)indial1.io.com (Steve Jackson) Subject: Comments on Clipper/Skipjack proposal Steve Jackson, President Sept. 26, 1993 Steve Jackson Games / Illuminati Online PO Box 18957, Austin, TX 78760 512-447-7866 sj(a)io.com National Institute for Standards and Technology (NIST) ATTN: Proposed FIPS for Escrowed Encryption Standard Technology Building, Room B-154 National Institute of Standards and Technology Gaithersburg, MD 20899 Sirs: I am writing in opposition to the Proposed Federal Information Processing Standard (FIPS) for an Escrowed Encryption Standard, docket # 930659-3159. As a publisher of both printed and online materials, I am deeply concerned by the potential effect of the proposed standard, which appears to me to have been produced in haste and to be lacking many significant elements required for informed citizen comment. I am in strong agreement with the points raised by the EFF and CPSR in their comments opposing the proposed standard. Private access to strong encryption is simply vital to protect the privacy of individuals in today's online environment. Legitimate business requirements for confidentiality also mandate free access to good encryption technology. The manner in which this proposal has been put forward is improper and incomplete. An algorithm intended for private and commercial purposes should not be classified as a "national security matter." And it is wholly improper to ask for meaningful "citizen input" while the algo- rithm itself is secret, the identities of the escrow agents are not firmly established, complete operating procedures are not available, and no legal recourse is yet proposed for the improper release of keys. In particular, the proposal fails to define what "legal authorization," other than a court order, might be available to compel the escrow agents to release a key. This omission is unacceptable. If keys are to be released to any authority except a United States court, the details must be made public immediately. Finally, a strong guarantee is needed that the Clipper/Skipjack system will never become mandatory, and that other forms of encryption will remain freely and legally available to all Americans. The proposal should be withdrawn until all these issues can be addressed. Only then can a legitimate period of citizen comment begin. Respectfully submitted - Steve Jackson ------- End of Forwarded Message

1 0

Re: PGP Business Week article
by George A. Gleason 17 Dec '03

17 Dec '03

Re. Representative Sam Gejdenson (pronounced as if spelled "gaydenson", accent on first syllable): I went to one of his campaign appearances when he first ran for office (this was Middletown Connecticut, 1980), and was very much impressed by his positions on various issues, and in particular, his background knowledge in a number of areas including engineering and policy areas related to the environment.... he is definitely someone who has a good ability to digest and utilise technical information in detail, and I'd say he could be a very very key person on our side of these issues. He definitely deserves 100% support and all the solid detailed information we can provide. -gg

1 0

Re: Verilog encryption broken
by George A. Gleason 17 Dec '03

17 Dec '03

Re Mark's question about the ethics of revealing that a proprietary system is crackable: I believe there is every right and duty to make the vulnerability publicly known. However, this can be done without disclosing enough of the content of the badly-protected information as to come in for heat. For example, one might post little snippets of a source code file which by themselves aren't usable but which the original owners will instangly recognise. This would be akin to the "fair use" of quotations from literature and poetry in critical reviews. And I also believe it would stand up in court, because the material which was revealed in the quotations could not be used in and of itself to devalue the content of the original complete work. -gg

1 0

My comments to NIST
by Phil Karn 17 Dec '03

17 Dec '03

7431 Teasdale Avenue San Diego, CA 92122 karn(a)unix.ka9q.ampr.org September 27, 1993 Director, Computer Systems Laboratory ATTN: Proposed FIPS for Escrowed Encryption Standard Technology Building, Room B-154 National Institute of Standards and Technology Gaithersburg, MD 20899 Re: A Proposed Federal Information Processing Standard for an Escrowed Encryption Standard (EES) Docket No 930659-3159 RIN 0693-AB19 Comments of Philip R. Karn, Jr Sirs: I am writing in response to your call for comments on the aforementioned matter that appeared in the Federal Register on July 30, 1993. I am writing as a concerned individual with BS and MS degrees in electrical and computer engineering and 15 years of professional experience in communications, computer networking and security at leading edge R&D organizations. I currently work in the digital cellular telephone industry, a ripe application for robust encryption if there ever was one. I feel that my experience in this field qualifies me to comment on the practicality of the proposed standard. First of all, I am totally opposed to the entire concept of key escrow. It is a dangerous, un-American and fatally flawed idea that should never have been proposed. In my opinion, everyone has the Constitutional right to use the encryption scheme of their choice, whether or not the government can break it. The impact of strong encryption on the enforcement of legitimate laws is and will remain minimal. Even unbreakable encryption is incapable of thwarting standard investigational techniques such as informants, testimony compelled through grants of immunity, "end point" surveillance (e.g., hidden microphones), the gathering of physical evidence of crimes and so forth. Strong un-escrowed encryption will, on the other hand, finally put an end to illegal, often politically motivated interceptions of private electronic communications without having to rely on anyone's goodwill, such as the still-unnamed "key escrow agencies". Precisely because eavesdropping has been so easy to do and so hard to detect, the government has repeatedly proven itself untrustworthy in this regard, as documented in great detail by the Watergate investigations and the Church Committee hearings of the 1970s. Why should we trust it now? Although the government currently claims that the EES will be a "voluntary" standard, many of its features make no sense whatsoever in this context. For example, why must the Skipjack algorithm be kept secret if individuals remain free to use other algorithms such as triple-key DES or IDEA that are quite probably even stronger? The government's claim is completely transparent, as one simply cannot escape the conclusion that the EES is a prelude to a ban on all other encryption schemes, or at least a ban on those the government can't crack. And this presents a profoundly disturbing threat to some very important Constitutional principles. Countless others have argued forcefully against the proposal on these and other grounds. For example, see the points made by the Computing Professionals for Social Responsibility (CPSR) in the attached Appendix. I fully agree with CPSR and feel that they alone should have been enough to stop the proposal long ago. However, the fact that the Escrowed Encryption Standard has advanced so quickly despite these serious problems reveals the totally one-sided nature of the decision process. Far from being an independent and impartial agency, NIST has proven itself to be merely a pawn for the National Security Agency, the Federal Bureau of Investigation and other powerful intelligence and law enforcement agencies. Despite (or perhaps because of) encryption's enormous potential to put real "teeth" into the Constitutional principles of privacy and freedom of speech and association, these agencies are notably unsympathetic to tFrom owner-cypherpunks Tue Sep 28 05:51:28 1993 Received: by toad.com id AA02707; Tue, 28 Sep 93 05:46:19 PDT Received: by toad.com id AA02651; Tue, 28 Sep 93 05:41:49 PDT Return-Path: <nowhere(a)bsu-cs.bsu.edu> Received: from bsu-cs.bsu.edu ([147.226.112.101]) by toad.com id AA02647; Tue, 28 Sep 93 05:41:46 PDT Received: by bsu-cs.bsu.edu (5.57/Ultrix3.0-C) id AA08271; Tue, 28 Sep 93 07:43:59 -0500 Date: Tue, 28 Sep 93 07:43:59 -0500 Message-Id: <9309281243.AA08271(a)bsu-cs.bsu.edu> From: Anonymous <nowhere(a)bsu-cs.bsu.edu> To: cypherpunks(a)toad.com X-Remailed-By: Anonymous <nowhere(a)bsu-cs.bsu.edu> X-Ttl: 0 X-Notice: This message was forwarded by a software- automated anonymous remailing service. Subject: Disturbing statistics on wiretaps Organization: Coalition for Cryptographic Freedom In the paper written by Delaney, Denning and Kaye (Wiretap Laws and Procedures -- What Happens when the U.S. Government Taps a Line, September 23, 1993), a few numbers were presented from a 1992 report which reflect the wiretaps put into place during that year. Without further details concerning the specifics surrounding some of these numbers, it should certainly raise eyebrows on a couple of points: - All 919 "interceptions" were authorized. The numbers presented in this report indicate that none were denied. - Out of this number, 303 were in single family homes, 135 were in apartments and 289 were categorized as placed in "other" locations. - Out of 919, 634 were placed into service for interception of information involving narcotics. The closest contender in this area involved racketeering, in which 90 was the magic number. - The number of persons arrested was 2,685. Of that number, only 607 were convicted. These statistics alone should concern YOU.

2 1

GIF experts
by ssteele＠eff.org 17 Dec '03

17 Dec '03

Hi everyone. I know this is not the focus of the cypherpunks, but I was hoping one of you folks out there might be able to point me in the direction of a technoid who could testify about how easy it is to manipulate GIF images. Please respond by private message (ssteele(a)eff.org) so I don't cause any more noise on the list. Thanks. Shari

1 0

my clipper letter
by Matt Blaze 17 Dec '03

17 Dec '03

Matthew Blaze 55 River Drive South Jersey City, NJ 07310 September 25, 1993 National Institute for Standards and Technology (NIST) ATTN: Proposed FIPS for Escrowed Encryption Standard Technology Building, Room B-154 National Institute of Standards and Technology Gaithersburg, MD 20899 Dear Director: I am writing to express my opposition to the Proposed Federal Information Processing Standard (FIPS) for an Escrowed Encryption Standard, docket #930659-3159. First, let me state my qualifications in this area. I hold a Ph.D. in computer science in the area of large-scale systems from Princeton University. I am presently employed as a Principal Investigator / Member of Technical Staff in the Computing Systems Research Laboratory of AT&T Bell Laboratories. My research focuses on the design of cryptographically secure networked computing and communications systems and I have published several research papers in this field. I must emphasize, however, that I am making these comments as a private citizen; nothing in this letter should be construed as representing the opinion or position of my employer or any other organization. I state my affiliation only for the purpose of identification. I believe that adoption of the proposed Escrowed Encryption Standard would be harmful to the national interest in at least two ways. First, it will harm us economically, putting our computing and communications technology at a significant disadvantage against foreign competition. Second, it will hinder, rather than promote, the increasingly vital efforts to improve the security of our information infrastructure. Several aspects of the proposed standard render the system inadequate for our competitive and information security needs. First, because the proposed system relies on the use of a special, tamper-resistant computer chip, it is impossible to manufacture equipment or design systems that have their cryptographic security functions based entirely in software. The implementation of cryptographic systems in software has only recently been made feasible by advances in computer speed and has significant advantages over hardware (chip)-based encryption. Software encryption can be included in digital voice and computer communications equipment, such as cellular telephones, at virtually no increase in marginal cost. Hardware-based encryption (based on technologies such as the proposed standard), on the other hand, can add over a hundred dollars to the end price of each unit. This could represent an increase of several times the original price for typical low-end consumer communications products. Clearly, devices that include the proposed standard will be at a significant disadvantage compared with equivalent products (possibly from foreign competitors) that employ software-based encrypFrom owner-cypherpunks Tue Sep 28 06:46:18 1993 Received: by toad.com id AA03637; Tue, 28 Sep 93 06:41:30 PDT Received: by toad.com id AA03607; Tue, 28 Sep 93 06:38:21 PDT Return-Path: <cme(a)ellisun.sw.stratus.com> Received: from transfer.stratus.com ([134.111.1.10]) by toad.com id AA03603; Tue, 28 Sep 93 06:38:18 PDT Received: from lectroid.sw.stratus.com by transfer.stratus.com (4.1/3.14-jjm) id AA14444; Tue, 28 Sep 93 09:38:16 EDT Received: from ellisun.sw.stratus.com by lectroid.sw.stratus.com (4.1/3.10-jjm) id AA29408; Tue, 28 Sep 93 09:38:15 EDT Received: by ellisun.sw.stratus.com (4.1/SMI-4.1) id AA25476; Tue, 28 Sep 93 09:38:15 EDT Date: Tue, 28 Sep 93 09:38:15 EDT From: cme(a)ellisun.sw.stratus.com (Carl Ellison) Message-Id: <9309281338.AA25476(a)ellisun.sw.stratus.com> To: cypherpunks(a)toad.com Subject: Re: saturation tactics? >From: "George A. Gleason" <gg(a)well.sf.ca.us> >Subject: saturation tactics? >Message-Id: <93Sep26.015035pdt.14005-3(a)well.sf.ca.us> >Date: Sun, 26 Sep 1993 01:50:31 -0700 >lots and lots of people & companies applying for those arms export licenses, >"saturation," which involves lots and lots of people scrupulously obeying an >unfair or controversial law to the point where it starts to swamp the >system. I'd much rather not do it. There won't be enough people out there to really swamp the system. Meanwhile, it lends credence to the stupid notion that S/W crypto is arms. I much prefer the statements in the READMEs at soda.berkeley.edu .... The official Stratus line on this issue, BTW, is that we don't want to deal in munitions. We have no intention of selling arms to anyone. We sell much of our product overseas and we sell only freely available crypto -- the stuff which is so widely documented and available that no terrorist or unfriendly government could possible not already have it. In particular, we sell software DES and a few simpler systems for our customers to use as they will. Of course, ye olde US Gov't still forces not to export this except to financial institutions (which is a reasonable fraction of our business) but there are other customers pissed at us because we obey the stupid US export laws. Needless to say, Stratus as a company wants to see the export laws changed. - Carl Disclaimer: I don't speak for Stratus. For the official company policy, see the company's letter to NIST re: Skipjack. [I certainly hope these will be available to the public.]

1 0

Re: GIF experts
by Romana Machado 17 Dec '03

17 Dec '03

Hi Shari, I am not quite an expert on GIFs, but I know a thing or two about manipulating digital images to hide information - steganography, and I am writing a shareware tool for the MAC that can embed data undetectably within GIF images. The first release date is scheduled for October 15. I am also working on providing an IBM version of this about one month later. If this interests you, let me know. Cheers, Romana romana(a)apple.com

1 0

FAX # for Clipper Comments
by Matt Blaze 17 Dec '03

17 Dec '03

I just checked with NIST; they are accepting FAX comments on the Escrowed Encryption Standard until close-of-business today. The number is 301-948-1784 -matt

1 0

Re: Disturbing statistics on wiretaps
by stig＠netcom.com 17 Dec '03

17 Dec '03

It should be noted that although it is illegal for the cops/feds/spooks to tap phone lines without a warrant, only illegally-obtained voice communications are inadmissible in court. This means that fax and modem communications can be illegally intercepted and STILL used in court against you. Stig ;; __________________________________________________________________________ ;; Stig(a)netcom.com netcom.com:/pub/stig/00-PGP-KEY ;; It's hard to be cutting-edge at your own pace... 32 DF B9 19 AE 28 D1 7A ;; Bullet-proof code cannot stand up to teflon bugs. A3 9D 0B 1A 33 13 4D 7F

3 3

Re: Orange book, the NSA, and the NCSC
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Dan Odom clarifies some information about NSA, NCSC, Orange Book series, etc.: > > I'm willing to accept that the Orange book doesn't specifically address > > cryptography, and I appreciate the clarifications on something that is > > one of the deepest, complex, and most obscure military handbooks, which > > Uh, any American citizen is entitled to one (1) free copy of the > Orange Book (and every other book in the Rainbow series); all you have > to do is ask. The address on the inside of my copy says: > > NCSC > 9800 Savage Road > Fort George G. Meade, MD 29755-6000 I got on this list of automatic books several years ago and now have about a dozen or more different publications, in different colors, from blue to green to the famous orange. All from the National Computer Security Center. Nothing juicy, and not much fun (for me) to read. Unix gurus trying to get better security classifications for their machines and systems have to read this stuff, though. > Since every NSA address I've ever seen is 9800 Savage Road, I assume > that it's some sort of secretarial thing. But if you ask them for a > copy of the Rainbow Series, they'll send it to you and also put you on > the list to receive updates. It is _not_ deep, complex, or obscure; Savage Road is the actual address of the Agency; Fort Meade per se is huge. NCSC as created in 1984 as part of NSDD-145 (National Security Decision Directive-145, a very important one). Prior to that date it had been called the DoD Computer Security Center, located smack dab in the center of SIGINT City. (I visited in May of 1991, strictly to satisfy my own curiousity. The closest I got was the front gate, with the newly installed "National Security Agency" signs. Signs said "Das Photographen ist Strictly Verboten," but I took a bunch anyway out my car window.) > And before anybody starts forming consipiracy theories, I am not > related to Lieutenant General William Odom; we just share a name :-). I'd long been meaning to ask Dan about this. General Odom once was introduced at a speech he was giving to Jim Bamford. Odom recoiled and said "Sir, I consider you to be an unindicted felon." -Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

2 2