December 2003 - cypherpunks-legacy

Re: cfp '94 transcript
by werner＠mc.ab.com 17 Dec '03

17 Dec '03

>Date: Tue, 29 Mar 1994 05:52:22 -0800 >From: Jack King <gjk(a)well.sf.ca.us> > >In Texas, Louisiana and Mississippi, it is now a federal crime to state >orally or in writing to any federal administrative or law enforcement >officer, during the course of an official investigation that you don't know >what they are talking about if in fact you do. How can something be a federal crime in only 3 states?

3 2

Re: federal crime
by moormajb＠vuse.vanderbilt.edu 17 Dec '03

17 Dec '03

>>Date: Tue, 29 Mar 1994 05:52:22 -0800 >>From: Jack King <gjk(a)well.sf.ca.us> >> >>In Texas, Louisiana and Mississippi, it is now a federal crime to state >>orally or in writing to any federal administrative or law enforcement >>officer, during the course of an official investigation that you don't know >>what they are talking about if in fact you do. >How can something be a federal crime in only 3 states? I think he probably meant "felony" not "federal crime."

2 1

questions for review committee.
by sommerfeld＠orchard.medford.ma.us 17 Dec '03

17 Dec '03

Question: How many bits of true "hardware randomness" go into the generation of each set of unit keys? Question: Exactly how are these random numbers generated? Which entity or entities provide the hardware and/or software to generate them? Are they generated inside the "vault" at the time of programming or "off-line"? Question: Are any of the random inputs to the key generation algorithm held constant during the generation of a "batch" of chips? If so, what is the justification for this practice? Question: What is the current batch size? What will the batch size be if production reaches ~1 million units per year, or ~4000 per work day? Question: What assurances are there that the key generation algorithm documented and examined by the review committee is the one actually used in production? Question: What assurances are there that the encryption algorithm studied by the review committee is the same as the one implemented by the chip? More specifically, have several members of the review committee each coded their own SKIPJACK implementations, including the escrow protocols, "from scratch" on computer systems not owned or provided by the U.S. government, and compared their outputs to that of the chips under study? If this is not feasible, please explain why. Question: What assurances are there that the actual physical chip(s) implementing the EES implements exactly and only the skipjack algorithm, the documented escrow procedures, and other publicly documented features? Are there any VLSI experts on the review committee? If so, what chips have they designed, and what chips have they "reverse engineered"? ---- By "assurances" I mean that there is an active process in place for validating compliance to a particular requirement such that no single *organization*, or single model of hardware can "fail" in a way such that violation of the requirement goes undetected. I consider the set of current and former employees of the Executive Branch of the U.S. Government to be a single organization for purposes of assurance. Addendum to all of these: If this information is classified, please justify this classification etc., etc., Steve, I hope you don't consider any of these "have you stopped beating your spouse".. - Bill

1 0

Very funny, Polyanna :-( [namespace pollution]
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Grrr. I use a mailer here (that I'm developing) that automatically encrypts outgoing mail for user X if "<X>" can be found in my pgp keyring. Unfortunately some comedian has published the key below... Type bits/keyID Date User ID pub 384/99CBA7 1992/11/15 Polyanna, c/o <cypherpunks(a)toad.com> 1 key(s) examined. so if I use this mailer when posting to cypherpunks, it gets encrypted for this idiot. I guess this is something we mailer writers will just have to allow for. Looks like I'm about to add a stop-list... (removing it from the keyring won't be good enough, because next feature planned for my mailer is to look up the fingerable key-server if it isn't found locally...) G

3 2

Crypto and new computing strategies
by Jim choate 17 Dec '03

17 Dec '03

In the latest issue of Scientific American there is an article on quantum computing and how the first working machine is to be built in the immediate future. This raises dark portents in my mind when one considers the rate and the size constraints on such devices. We may be looking at a technology birth which will allow brute force computation of RSA style algorithms and their cracking. As an aside in a Physics mailing list I subscribe to Rajashi Roy from Georgian Tech supposedly has managed to synchronize two chaotic lasers which would provide a basis for a optical one-time pad system.

2 1

Re: cfp '94 transcript
by ag588＠cleveland.Freenet.Edu 17 Dec '03

17 Dec '03

> > > >On Tue, 29 Mar 1994, Jack King wrote: > >> Mike Godwin stated that the FBI agent said something like " >> "we can lie to you, but you can't lie to us." That has always been true >> under 18 U.S.C. 1001. But now you can't even answer one of their questions >> with a "no" if the truthful answer would be "yes." You should read up on >> this, it's scarier than Clipper and the digital telephony proposal combined. > >Of course you can still refuse to say anything which is what you should >have always done in any case. > >I wonder that if you tell the agents that you reserve the right to lie -- >in other words disclaim an oath. Swear to lie. If you can beat such a rap. > >DCF > > > > Don't try to be clever when you're talking with the Feds. Your best bet is simply to demand a lawyer and then shut up. -- ------------------------------------------------------------------------- I am an attorney, seeking a position in the area of Computer Law. If you know of such a position available, or of someone who may know of such a position, please send e-mail! Thanks.

1 0

Re: federal crime
by f_griffith＠ccsvax.sfasu.edu 17 Dec '03

17 Dec '03

>> >> >How can something be a federal crime in only 3 states? >> >> > By interpretation of the circuit court of appeals (federal) for that area.

1 0

No Subject
by Whitney, Mara 17 Dec '03

17 Dec '03

Hi. Netta suggested I write you about joining your list, or at least that's what I think she said. We were at CFP '94 and a lot was goining on simultaneously. My name is Mara Whitney and you can reach me at maraw@fs- gate.uchicago.edu. Thanks, Mara

1 0

Re: cfp '94 transcript
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> I have a question concerning the algorithm that is used in the > Clipper Chip, Skipjack..[]..There is a certain amount of conjecture > that in fact the algorithm contains a deliberately encoded weakness > that will allow the NSA, without access to the escrow keys, to be > able to intercept communication in their mission to monitor on- > shore and off-shore communications..[].. > > BAKER I'll answer it yes or no if you'll > tell me exactly the question. > > UNKNOWN Does it or does it not contain a > weakness that allows you to intercept the communications without > access to the escrow keys. > > BAKER No. The response is incorrect; I'll leave moral judgements about whether the constitutes deliberate lying or mere confusion to others :-) Specifically, the Clipper Chip does *not* use the escrow keys - it uses its device unique key, which can be derived from them. It *could* have been designed to use the escrow keys to do the device-unique-key generation internally, or even to do *two* separate encryption rounds in LEAF creation so there isn't just one key, but nooo. Decryption of LEAF also does not use the escrow keys, it uses the device unique key as well. The Black Box For Cops may very well use the escrow keys to derive the device unique key, but anybody who has access to the Skipjack and LEAF algorithms and Family Key and the device unique key can do the decryption, and you can probably feed the Black Box For Cops the device-unique key and 000000..00 instead of the escrowed key-parts. (They'd have to do some *really* special checking otherwise.) So how do you get the device unique key without using the escrow keys? - Maybe you can FOIA it - Maybe the Key Generation Bureau can steal it during manufacturing - Maybe the Key Generation Bureau can just *take* it during manufacturing, since the Attorney General's rules don't say not to. - Maybe the Key Generation Bureau can steal the two half-keys before (or after) giving them to the so-called "escrow" agents, which means they're not really the escrow keys. - Maybe the Key Generation Bureau can re-generate the keys, either by stealing the input batch parameters from the escrow agents or by brute-force searching the range of inputs they might have provided or something similar. - Maybe the Black Box For Cops lets you extract the data from it, either directly or by handing it carefully-designed input - Maybe authorized government employees can obtain the keys for chips for internal use, and then distribute those chips to victims\\\\\\\suckers\\\\\\customers outside government. - Maybe the rules for access to government-used Clipper-chip keys are or will be different than for keys used by the public. After all, their responsibilities for protecting internal information are different than their ability to wiretap people. So maybe they just "misread" a serial number and get the chip keys from the wiretapping-each-other list instead of the escrow agencies by "mistake - those keys aren't "escrowed", since the escrow agents don't have them they're just "retained for internal use". "Wiretap the usual suspects!" Bill Stewart # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Web of Trust?
by Hal 17 Dec '03

17 Dec '03

One of the key concepts widely used to describe PGP is the "web of trust". This brings to mind a network of connections between people who know and communicate with each other. Two people who want to communicate can do so securely if there is a path of connections in the form of signed keys that joins them. But this is not quite right. The fundamental fact about PGP key signatures, which is often misunderstood, is this: You can only communicate securely with someone whose key is signed by a person you know, either personally or by reputation. In other words, if I want to communicate with joe(a)abc.com, I can only do so if one of the signators of his key is a person I know. If not, I have no way of judging the validity of his key. This belies simple interpretations of the "web of trust". I may have signed A's key, A has signed B's, B has signed C's, C has signed D's, and D has signed Joe's, but this is of no value unless I know D. Only then can I trust Joe's key. This means that, in the "web" picture, I can only communicate securely with people who are at most two hops away in the web of connections. I can communicate with the people I know, and I can communicate with the people they know, and that is it. This is unfortunate, because the simple web model ties into some famous research which suggests that any two people chosen at random are only about half a dozen steps apart in the web of who-knows-whom connections. (This result is where the title of the movie "Six Degrees of Separation" comes from.) If you had a system which actually supported communications via such a web model, it actually would have hope of letting two people communicate who did not have a very long chain between them. But PGP, with a maximum chain length of two, will not allow this. What would have to be added in order to allow a true web of trust model to be used in a program like PGP? Basically what is needed is some way to judge the trustworthyness of signatures by people you don't know. This would most plausibly be provided by the people who had signed their keys. For example, if there were another type of key signature which did not only vouch for the person's identity, but also for his trustworthyness and care in signing keys, then a chain of such signatures could serve as the basis for a true web of trust. Obviously such signatures could not be given out nearly as easily as the kind we have now, where a glance at some stranger's drivers' licence is often all we get, but they could be given to close friends and those we know and trust. More elaborate systems might include numerical ratings of trustworthiness which would help to estimate the strength of any given path. The main point is that some information of this kind would be needed in order to allow communication with people distant in the web of connections. Without this, I think we will continue to have problems with PGP being unable to validate keys of people we want to communicate with. People will collect huge laundry lists of signatures in the hopes that whoever wants to commu- nicate with them will know one of those people. Centralized key validators will appear (as in the case of the SLED service being started now, which will sign a key based on a signed check with your name on it). The result may be a choice between using an unsigned key or using one signed by some faceless bureaucracy, which is no better than the original PEM conception. (People may be confused by this essay because they thought PGP worked this way already. PGP does have a follow-the-web model, but that is only for following signatures. In the example above, where I wanted to talk to Joe and there was a chain to him through A, B, C, and D, we have to first sup- pose that I know and trust all of A, B, C, and D. Given that, what PGP can do is to determine whether I have valid keys for all of those people. It will notice that A has signed B's key, so it is valid. I know B and told PGP he was trustworthy, and he signed C's key, so therefore that one is valid. Sim- ilarly, I know C and I know D so PGP can follow the chain through them. Fin- ally we come to Joe, whom I don't know, but because I know D and PGP followed the web to determine that D's key is valid, PGP can determine that Joe's key is valid. But again, that was only because I knew D and everyone else in the chain. The bottom line is still that I can only communicate with people who know someone I know.) Hal

1 0