December 2003 - cypherpunks-legacy

technical information on Clipper
by smb＠research.att.com 17 Dec '03

17 Dec '03

------- Forwarded Message Return-Path: ISL.Stanford.EDU!hellman Received: by research.att.com; Sun Apr 18 02:06 EDT 1993 Received: by inet.att.com; Sun Apr 18 02:06 EDT 1993 Received: by ISL.Stanford.EDU (4.1/25-eef) id AA22827; Sat, 17 Apr 93 23:05:23 PDT Date: Sat, 17 Apr 93 23:05:23 PDT From: "Martin Hellman" <hellman(a)isl.stanford.edu> Message-Id: <9304180605.AA22827(a)ISL.Stanford.EDU> To: DAVIDNEWMANPC(a)mcimail.com, NORMILE.J(a)applelink.apple.com, adw(a)research.att.com, amo(a)research.att.com, bach(a)cs.wisc.edu, berson(a)sri.com, biham(a)cs.technion.ac.il, branstad(a)st1.ncsl.nist.gov, brassard(a)iro.umontreal.ca, burt(a)rsa.com, carl(a)joe.math.uga.edu, caronni(a)nessie.cs.id.ethz.ch, clipper(a)csrc.ncsl.nist.gov, denning(a)cs.cosc.georgetown.edu, diffie(a)eng.sun.com, eor(a)ISL.Stanford.EDU, erdmann@leland, fahn@cs, gfung%ccm.UManitoba.CA(a)cornellc.cit.cornell.edu, gill(a)ISL.Stanford.EDU, gormish(a)ISL.Stanford.EDU, infort%czheth5a.BITNET(a)forsythe.stanford.edu, jeffr(a)sco.com, jhwang(a)ISL.Stanford.EDU, jim(a)rsa.com, jwarren(a)well.sf.ca.us, jwolf(a)ucsd.edu, kurlberg@leland, langford(a)ISL.Stanford.EDU, lenstra(a)flash.bellcore.com, markoff(a)nyt.com, matt(a)rsa.com, merkle(a)xerox.com, minnieho(a)ISL.Stanford.EDU, mitran(a)asic.sc.ti.com, ovseev(a)ippi.msk.su, rivest(a)theory.lcs.mit.edu, roche(a)ISL.Stanford.EDU, rotenberg(a)washofc.cpsr.org, scholtz(a)jimmie.usc.edu, shamir%wisdom.bitnet@forsythe, smb(a)research.att.com, taher(a)rsa.com, voois(a)ISL.Stanford.EDU, welch(a)irving.usc.edu, wesel(a)ISL.Stanford.EDU Subject: Clipper Chip Most of you have seen the announcement in Friday's NY Times, etc. about NIST (National Institute of Standards & Technology) announcing the "Clipper Chip" crypto device. Several messges on the net have asked for more technical details, and some have been laboring under understandable misunderstandings given the lack of details in the news articles. So here to help out is your friendly NSA link: me. I was somewhat surprised Friday to get a call from the Agency which supplied many of the missing details. I was told the info was public, so here it is (the cc of this to Dennis Branstad at NIST is mostly as a double check on my facts since I assume he is aware of all this; please let me know if I have anything wrong): The Clipper Chip will have a secret crypto algorithm embedded in Silicon. Each chip will have two secret, 80-bit keys. One will be the same for all chips (ie a system-wide key) and the other will be unit specific. I don't know what NIST and NSA will call them, but I will call them the system key SK and unit key UK in this message. The IC will be designed to be extremely difficult to reverse so that the system key can be kept secret. (Aside: It is clear that they also want to keep the algorithm secret and, in my opinion, it may be as much for that as this stated purpose.) The unit key will be generated as the XOR of two 80-bit random numbers K1 and K2 (UK=K1+K2) which will be kept by the two escrow authorities. Who these escrow authorities will be is still to be decided by the Attorney General, but it was stressed to me that they will NOT be NSA or law enforcement agencies, that they must be parties acceptable to the users of the system as unbiased. When a law enforcement agency gets a court order, they will present it to these two escrow authorities and receive K1 and K2, thereby allowing access to the unit key UK. In addition to the system key, each user will get to choose his or her own key and change it as often as desired. Call this key plain old K. When a message is to be sent it will first be encrypted under K, then K will be encrypted under the unit key UK, and the serial number of the unit added to produce a three part message which will then be encrypted under the system key SK producing E{ E[M; K], E[K; UK], serial number; SK} When a court order obtains K1 and K2, and thence K, the law enforcement agency will use SK to decrypt all information flowing on the suspected link [Aside: It is my guess that they may do this constantly on all links, with or without a court order, since it is almost impossible to tell which links over which a message will flow.] This gives the agency access to E[M; K], E[K; UK], serial number in the above message. They then check the serial number of the unit and see if it is on the "watch list" for which they have a court order. If so, they will decrypt E[K; UK] to obtain K, and then decrypt E[M; K] to obtain M. I am still in the process of assessing this scheme, so please do not take the above as any kind of endorsement of the proposed scheme. All I am trying to do is help all of us assess the scheme more knowledgably. But I will say that the need for just one court order worries me. I would feel more comfortable (though not necessarily comfortable!) if two separate court orders were needed, one per escrow authority. While no explanation is needed, the following story adds some color: In researching some ideas that Silvio Micali and I have been kicking around, I spoke with Gerald Gunther, the constitutional law expert here at Stanford and he related the following story: When Edward Levi became Pres. Ford's attorney general (right after Watergate), he was visited by an FBI agent asking for "the wiretap authorizations." When Levy asked for the details so he could review the cases as required by law, the agent told him that his predecessors just turned over 40-50 blank, signed forms every time. Levi did not comply and changed the system, but the lesson is clear: No single person or authority should have the power to authorize wiretaps (or worse yet, divulging of personal keys). Sometimes he or she will be an Edward Levi and sometimes a John Mitchell. Martin Hellman ------- End of Forwarded Message

1 0

correction from Hellman
by smb＠research.att.com 17 Dec '03

17 Dec '03

Here's a follow-up note from Hellman, in response to a question I sent (and also in response to my request to post his original note to netnews). ------- Forwarded Message Date: Sun, 18 Apr 93 11:41:42 PDT From: "Martin Hellman" <hellman(a)isl.stanford.edu> To: smb(a)research.att.com Subject: Re: Clipper Chip It is fine to post my previous message to sci.crypt if you also post this message with it in which: 1. I ask recipients to be sparse in their requesting further info from me or asking for comments on specific questions. By this posting I apologize for any messages I am unable to respond to. (I already spend too much time answering too much e-mail and am particularly overloaded this week with other responsibilities.) 2. I note a probably correction sent to me by Dorothy Denning. She met with the person from NSA that I talked with by phone, so her understanding is likely to better than mine on this point: Where I said the transmitted info is E{ E[M; K], E[K; UK], serial number; SK} she says the message is not double encrypted. The system key (or family key as she was told it is called) only encrypts the serial number or the serial number and the encrypted unit key. This is not a major difference, but I thought it should be mentioned and thank her for bringing it to my attention. It makes more sense since it cuts down on encryption computation overhead. ------- End of Forwarded Message

1 0

PGP shells ...
by Jim choate 17 Dec '03

17 Dec '03

Hi all, On the issue of shells for PGP, has anyone released a REXX based shell? I have REXX working on my Dos, Linux, and Amiga boxes and the cross-compatibility would be very nifty... Any info on existing REXX shells or front-ends would be appreciated.

1 0

New Cypher ListServ (part 2) **REVISED** (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: "David Downey" <digital_matrix(a)hotmail.com> > Subject: New Cypher ListServ (part 2) **REVISED** > Date: Sun, 20 Jul 1997 06:16:19 PDT > The Cryptography-Politics-PGP-L ListServ is in operation.(We just > finished up with the majordomo scripts and the like). Here is what you > need to do to join. BTW, this list is a digested list. Please do not > freak if things do not go right straight from the get go. I hope to have > this as painless as possible, yet we all know that Murphy wrote Murphy's > Law just for this instance. Please bear with me. Once again, ANY > suggestions, short of flames, will be listened to 100%! > Now for the nitty gritty. Is this a new CDR node or is this a new indipendant mailing list? ____________________________________________________________________ | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Problems with anonymous escrow 2
by Hal 17 Dec '03

17 Dec '03

Besides the question of trustworthiness, another problem I see with anonymous escrow agents applies more generally to any form of anonymous business. Anonymity makes sense to me for the individual. Each person manages his own affairs and he can keep secret or reveal what he wants. But at the business level it is going to be much harder to keep the same level of secrecy. It is hard for me to see how a business larger than two or three people can really expect to operate with the kind of anonymity we are talking about here. These escrow agents will need significant assets to be useful, and probably staffs of at least dozens or hundreds of actuaries and other professionals who will judge the safety and appropriateness of the various deals the agency is offered. How can you expect to keep the location and true identities of the business principals secret? It is said that no more than three people can keep a secret; can we really expect a staff of hundreds not to reveal that they actually work for the mysterious XYZ escrow agency, accessible only through Blacknet? Even with the Mafia, everyone knows who works there (judging from the newspapers). Can we really expect more secrecy for these anonymous businesses? I think that it is really impossible for a business of any significant size to be anonymous in the same way that an individual can. The idea of an escrow agency that retains its anonymity seems impractical to me. Hal

1 0

Re: ?-line cash
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> In-Reply-To: "Rick H. Wesson"'s message of Sat, 27 Aug 1994 19:04:21 -0700 <199408280204.TAA23729(a)ar.com> > > The last on-line cash system I tried to work up didn't > have a drop of anonymity to it, and I don't know how to blind the > bank to the transactions but keep the thing reliable and secure... > > Please look at Magic Money, which is an existing coded prototype which > uses blind signatures to represent digital banknotes. The canonical place to look for discussion of blinding is Chaum's article in CACM from maybe October 1985? Should be referenced in Schneier's bibliography. It's probably also available on chaum's web server (something-or-other.digicash.nl). Schneier also discusses the technology somewhat.

1 0

Using remailers, chained remailers?
by Gary Jeffers 17 Dec '03

17 Dec '03

Hello Cypherpunks, Could anyone give me a concise post on how to use remailers & chained remailers? Or an ftp site where I can download the info.? Thank You, Gary Jeffers

1 0

CDR Traffic & IRC
by Jim Choate 17 Dec '03

17 Dec '03

Hi, I have obtained a Sparc ELC (4/25) w/ 24M of RAM and 200M of disk space under Solaris 1.1.2 (SunOS 4.1.4). I will be installing the gcc suite from the O'Reilly "Programming with GNU software" since this is a supported OS. I intend to set it up as a small public access irc server. I was wondering if anyone had suggestions on such hardware and what to use. The crypto relevance is that I was thinking of having a #cdr channel which would receive traffic from the regular mailing list. In other words when a user joins #cdr they could use the normal irc functions but a bot would be receiving the mailing list traffic as it arrives and sending it out. I am not proposing to send the #cdr traffic to the mailing list. It would be one way only. Though a bot function to forward mail on a per request basis might be implimented if some suitable abuse avoidance mechanism could be worked out. Any other crypto relevant suggestions on this topic welcome. ____________________________________________________________________ | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Announcing Bellcore's Trusted Software Integrity (Betsi) System
by rubin＠faline.bellcore.com 17 Dec '03

17 Dec '03

> Am I totally off base in thinking that distributing the fingerprint in > the same way as the public key is close to totally pointless? Well, in many cases, people will be checking the key in several different places for extra assurance that it is correct. Including the fingerprint just saves them a calculation. I suppose you have a point that the fingerprints could all match, and be unrelated to the key being posted, but then I'd only be cheating myself.

1 0

Re: Bad govt represents bad people?
by sw＠tiac.net 17 Dec '03

17 Dec '03

>sw(a)tiac.net (Steve Witham) writes > >> Saying that a bad government is just representing bad people gives it more >> credit than is due. John Kreznar responds- >You leave me wondering what you mean by ``bad people''. As someone near >here (Eric?) is fond of reiterating, never attribute to malice that >which can adequately be explained by ignorance or stupidity. Bad >people? Well, maybe, but it's mostly ignorant-bad, not malicious-bad. Yah. I just meant "bad" to stand for something we were discussing: people who want to benefit from your being taxed, or restrict your freedoms gratuitously. >Majority or not, the constituents strongly influence the bureaucrats. Right, the problem is more than just people in government. I was just contradicting the idea that (as Tim May says) people get the government they deserve. Certainly not all people, maybe not most "deserve" this deal. > A >good recent example familiar to readers of this list is the EFF with its >shrill and incessant campaign Yeah, I said that cleverness, etc. helped to influence but left out persistence, volume, high profile. But not representativeness. > to all of us to pressure politicians to do >this or that. Thanks to the EFF's efforts, proponents of government >surveillance can now claim the cooperation of a leading representative >of data communications users. Yup. Whoops. There's a footnote in one of Bruno Bettleheim's books-- he says professional organizations resemble the guards recruited from among the prisoners in concentration camps. They both start out wanting to defend their fellows from the tyrants, but through compromise they end up being the ones who deliver the tyranny. >> It's the structure of government that needs changing. > >The social cancer would need to be cured. It's hard to believe that >what would result would embed anything like ``government''. You're right, the problem is bigger than government. Also, I was using "government" in the sense of "whatever way protection services are arranged for" rather than "government as we know it". (But I've blabbed enough about that usage.) --Steve - - - - - - - - - - It is said a Shao Lin priest can walk through walls. Looked for, he cannot be seen. Listened for, he cannot be heard. Touched, he cannot be felt.

2 1