December 2003 - cypherpunks-legacy

Answers to Summit questions
by jkreznar＠ininx.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > -- Questions for Discussion Groups -- > 1. What is important to your group? Truth and honesty. > 3. What does your group want not to happen with the NII? For it to de facto preempt honest alternatives. I'm afraid that the NII will be funded in part by taxation. An honest person cannot in good conscience willfully accept services funded by taxation when he has a reasonable alternative. The NII threatens the viability of honest alternatives. The reason is that even an honest person will find it hard to justify paying more for access to a user-funded network when a cheaper alternative such as NII is available because it is sustained by expropriating the fruit of the toil of unconsenting others. Some of us would prefer that relations among people be by mutual consent or not at all. Government programs, by contrast, imply imposition by the politically victorious upon all others. > 5. What would you be able to do with the NII, that you would not > otherwise, if you did not have to worry about the cost of access? One can _not_ of course not worry about the cost. The people who install and maintain the system have to eat, too. The pertinent question is whether that money is given freely in exchange for service rendered, or is expropriated from another without his consent through taxation. An honest user of the system suffers ongoing distress to know that he benefits only because of another's oppression. The NII should not come to be. The ``N'' in NII stands for ``National''. Nations are abominations, functioning as they do to supplant personal choice with collective dictate. John E. Kreznar | Relations among people to be by jkreznar(a)ininx.com | mutual consent, or not at all. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLZZwxcDhz44ugybJAQEbTwQAgCHVdhmdC3zyQWRKOhNLTFzM8AFH29re jOdOmnIKkGiJWzjPGLb/x4cagv+tS56OgfpSMmBet9xsm9f7Yf3gGpGgPVgiYr2n pseH5x7ON0a6u0YVYZX8SIPyOjUUEiDBwhAfOOALJ2fWWMI0hYhREiAQuNS1Ag8T /oYQtUFf274= =QDwY -----END PGP SIGNATURE-----

1 0

personal manifesto (comments appreciated)
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The following is my manifesto of net.beliefs. I recognize their lack of precision, their foundation in principles of faith, and their lack of a clear vehicle for realization. I do not profess them to be a statement of cypherpunk beliefs. I do submit them for discussion, criticism, suggestion, rant, or flame. If you disagree this is your chance to educate a misguided individual with hopelessly antiquated beliefs. If you agree, this is your chance to point out badly constructed arguments, awkward sentences, repetition, and poor word choice. I cannot work for something unless I know what it is IUm working for. 1) My vision of the Net is utopian, or I would not spell it as I do, with a capitol N. While the most likely possibility is that the Net will simply mirror current society, a Net of this structure would fail to realize its potential as an agent of social change. 2) The Net has the potential to become the greatest de-centralizing force in the history of humanity. The potential ability of the individual to cheaply reach, and organize, vast numbers of like-minded individuals is unprecedented. 3) Current arguments for regulation of cryptography by government agencies depend on the argument they are maintaining their current abilities in the brave new world of cyberspace. I argue that even if this were the case, we have a responsibility to do more than simply maintain the status quo. This argument can be mapped to possible future objections by authorities. 4) It is the responsibility of the information haves to spread their knowledge to the information have-nots. A Net which allows the economic exploitation of information have-nots by those with the information is, while perhaps profitable, immoral. Information wants to be free. Knowledge which is not of a personal nature should be freely accessible. 5) Along with these positive potentials, it is possible for the Net to be constructed in such a way as to allow the formation of the most powerful authoritarian societies the world has ever seen. The potential for the death of the Individual, just as for the empowerment of the Individual, is very real. We must work to prevent totalitarianism. 6) The Net is no better than its users. Current crises of economic inequality, of homelessness and hunger, will not be affected by the Net unless we work to change them in pre-Net society. People cannot participate in a democratic society if they are not educated to a minimal level required for functioning in that society. This is the crux of our societal problems, as well as the crux of possible problems with the Net. 7) It is better to help oneUs fellow human than to hurt. It is better to give than to receive. Equally, one human has an enormous capacity to injure and exploit another human. We must decide which ability we wish to empower, and judge which we actually do. 8) There are fundamental problems with the structure of society. Realizing the democratic vision of the Net is a way to re-structure society. My hope is that this restructuring will create a better society than the one I know. I recognize it can be worse-- much worse. With vigilance, it will not be. 9) My beliefs are hopelessly utopian. I have faith in democratic principles to shape society into a more just social hierarchy. This faith must not be confused with certainty. It is impossible to predict the shape of the society which will be created. A few risks are of the tyranny of the majority, and the willful formation of totalitarian dictatorships (hyperlink Weimar Germany). The will of the people is impossible to define, much less judge, gauge, measure or regulate. We must be satisfied with approximations. 10) All actions have moral implications. Ignoring these implications is irresponsible and, yes... immoral. - -john. - -------------------------------------------------------------------------- John Blair: <jdblair(a)nextsrv.cas.muohio.edu> voice: (513) 529-4877 PGP public key available upon request. KILL YOUR Privacy in the information age is a right, not a privilage. TELEVISION Information = Power = Control. Fight the centralization of information. -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLZZOOBD3efpluabZAQH/swH9FmFB45S9jcMs2oqMn12wTEfqcbGFDdSN LAc5NEt1us7aipazZIouu+abSsPRlqq2lhIxOzJ65KGlYNdWjJ0tPw== =NiD7 -----END PGP SIGNATURE-----

1 0

Re: personal manifesto (comments appreciated)
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

John Blair says he welcomes comments and criticism, so here goes: > 1) My vision of the Net is utopian, or I would not spell it as I do, > with a capitol N. While the most likely possibility is that the Net > will simply mirror current society, a Net of this structure would fail > to realize its potential as an agent of social change. I often use the term "the Net" as well, but perhaps this usage is skewing our thinking in the very direction we mostly despise: the creation of a monolithic entity, as epitomized in "the" National Information Infrastructure. Perhaps we should be thinking in terms of "many nets," "many communcations channels." Come to think of it, "cyberspace," though sometimes hackneyed (hackerneyed?), captures it best, at least for me. > 3) Current arguments for regulation of cryptography by government > agencies depend on the argument they are maintaining their current > abilities in the brave new world of cyberspace. I argue that even if > this were the case, we have a responsibility to do more than simply > maintain the status quo. This argument can be mapped to possible future > objections by authorities. Not the best one-paragraph argument for crypto I've ever seen. But I don't disagree. > 4) It is the responsibility of the information haves to spread their > knowledge to the information have-nots. A Net which allows the economic > exploitation of information have-nots by those with the information is, > while perhaps profitable, immoral. Information wants to be free. > Knowledge which is not of a personal nature should be freely accessible. I disagree with nearly everything here! If I know how to design circuits, and some "have-not" does not, what is wrong with that? Is knowledge to be made illegal? Are consultants, writers, designers, etc. to be told they cannot use "the Net"? Arghh! Words fail me. Perhaps our ideologies are just too far apart. > 5) Along with these positive potentials, it is possible for the Net > to be constructed in such a way as to allow the formation of the most > powerful authoritarian societies the world has ever seen. The potential > for the death of the Individual, just as for the empowerment of the > Individual, is very real. We must work to prevent totalitarianism. And part of preventing totalitarianism means not interfering with economic transactions made by folks. See how this applies to your point above. > 6) The Net is no better than its users. Current crises of economic > inequality, of homelessness and hunger, will not be affected by the Net > unless we work to change them in pre-Net society. People cannot > participate in a democratic society if they are not educated to a minimal > level required for functioning in that society. This is the crux of our > societal problems, as well as the crux of possible problems with the Net. A platitude. Ditto for "End Hunger Now" and "Save the Dolphins." > 7) It is better to help oneUs fellow human than to hurt. It is > better to give than to receive. Equally, one human has an enormous > capacity to injure and exploit another human. We must decide which > ability we wish to empower, and judge which we actually do. It's OK that you believe this, of course, but I fail to see any real links with what it is we're doing, what crypto and digital privacy is all about, etc. My fear is that these nice thoughts will be used by others, especially politicians, to their own ends. > 8) There are fundamental problems with the structure of society. > Realizing the democratic vision of the Net is a way to re-structure > society. My hope is that this restructuring will create a better > society than the one I know. I recognize it can be worse-- much worse. > With vigilance, it will not be. Be sure you read up on the problems with "democracies." (For the most part, I'm opposed to democracies. Too many issues to go into right now, but I can if there's interest.) > 9) My beliefs are hopelessly utopian. I have faith in democratic > principles to shape society into a more just social hierarchy. This Instead of so much talk of democracy, think of _free choice_. Is "deomcratic input" needed in determining what books get published, what magazines are created and sold, what CDs get produced? No, the "market" decides. Not perfectly, not to everyone's liking, and "injustices" do occur. But far better that the success of a book or a CD depend on customer willingness to buy than that some committee or democratic vote has decreed that 2 Live Crew is not needed. The extension of this notion to cyberspace is both obvious and natural. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Re: Digital Cash
by John.Schofield＠f903.n102.z1.fidonet.org 17 Dec '03

17 Dec '03

--==<Quoting Uucp to John Schofield about "Re: Digital Cash">==-- Uu> I have always been skeptical of this observer-chip approach, because Uu> it wasn't clear that it was feasible to make a tamper-resistant chip Uu> economically, and because the specialized hardware that would be Uu> required would prevent the system from being used on widely-available Uu> PCs. However, now we see that our military rulers apparently trust Uu> tamper-resistant technology well enough to put it into thousands of Uu> public hands, without fear that even one chip will be opened and read. Uu> Breaking an observer only lets you double-spend the coins it holds, Uu> while breaking Clipper allows you to permanently defeat the escrow Uu> provisions of the whole system. So this suggests that the technology Uu> is adequate for observers. I once asked my grandfather if he was sure he could take apart the tractor he was working on. His response? "A man put it together." Anything one man can do, another can undo--the only variable is the degree of effort required. I'm sure we can make a tamper-resistant chip, but can we make a tamper-proof one? No. Considering the determination and intelligence of some of the people involved, I'm sure that a tamper-resistant chip would be compromised pretty quickly. --John Schofield ... I tried an internal modem, but it hurt when I walked. --- Blue Wave/RA v2.12 -- : John Schofield - via mcws.fidonet.org - Public Access (213)256-8371 : ARPA/INTERNET: John.Schofield(a)f903.n102.z1.fidonet.org : UUCP: ...!cheshire!mcws!903!John.Schofield : Compu$erve: >internet:John.Schofield@f903.n102.z1.fidonet.org

1 0

Communications Law 302
by nobody＠soda.berkeley.edu 17 Dec '03

17 Dec '03

Does anyone know what happened to the banks lovely sytem a while back when New York account holders found out that withdrawls were made twice on their accounts? What happened, did someone actually get creditted with the corresponding debits, or was this another case of an operator putting up a tape twice? -- As an aside, I remember an old wire from some years ago when $58Million was held up by the US with co-operation of European authorities. In case anyone is interested the following was the reult of the legal wranglin'. and is dated 11/93. Forget Clipper, and check out how else they're stickin it to ya. In short they 'seized' data packets, at an intermediary remailer. They have made information seizable **EGADS** -- AN PTS2096146 HL U.S. WINS MAJOR VICTORY ON WIRE SEIZURES DL ESTIMATED INFORMATION UNITS: 4.7 WORDS: 569 DD 11/01/93 SO * Money Laundering Alert (MLAL) Alert International, Inc Vol. 5, No. 2 LP When operatives of the Santacruz-Londono Cali drug cartel were arrested in June 1990 in Luxembourg, a flurry of wire transfers flew from hundreds of cartel bank accounts in Europe. Anticipating the transfers, Luxembourg authorities asked other countries to freeze the money linked to those accounts TX Of the $58 million seized worldwide, $12 million was frozen in New York City banks which had served as "intermediary banks" in the wire transfers. The role of those banks was to credit the accounts of certain correspondent Colombian banks who would then notify the beneficiaries that the funds were available. The banks were instructed by DEA agents to attach all funds on deposit in the names of Cali cartel associates, including "all related entities and individuals," and to say which transfers were destined for beneficiaries in Colombia. Two groups of Colombian clothing exporters filed claims to about $6.5 million of the seized funds saying the money was legitimately earned. They also sued the New York banks for loss of use of their funds and for violation of the Right to Financial Privacy Act and the Electronic Communications Privacy Act (ECPA). Their suits against the banks were dismissed. After a two-month trial last year, the jury found that 18 of the 22 accounts seized were forfeitable. Now, in a case of great importance to the emerging wire transfer battles between the government and the movers of dirty money, the key federal appellate court which rules on issues arising from the New York financial center has given a resounding victory to the government. The Second Circuit Court of Appeals ruled that wire transfers that pass through intermediary banks can be seized even without "alleging facts sufficient to show that specific property is tainted." All the government must show are "facts sufficient to support a reasonable belief that (it) can demonstrate probable cause for finding the property tainted," the court said. By naming the intermediary banks and the beneficiaries, the U.S. described the property with "reasonable particularity." Moreover, the U.S. did not need a warrant for the seizures because the law permits the Justice Department to seize property when it has "probable cause to believe" it is subject to civil forfeiture, said the court. "Because the (transfers were) fungible and capable of rapid motion due to modern technology,...exigent circumstances were present here," said the court, dismissing the claimants' assertions that their constitutional rights had been violated. Likewise, there was no violation of the Right to Financial Privacy Act, said the court, because the claimants did not maintain "accounts" at the banks. The ECPA also provided no relief to the claimants because that law deals with the use of "devices" to "intercept" communications. Here, no devices were used and there was no interception, said the court. The court also ruled than an EFT at an intermediary bank is "clearly a seizable res (thing) under the forfeiture statutes" and that only a "nexus" and not a "substantial connection" between seized property and illegal drug activity must be shown by the government to show probable cause. The case has far-reaching implications since a majority of international wire transfers pass through intermediary banks, many of them in New York. (U.S. vs. Daccarett, Docket Nos. 92-6229 and 6259, 2nd Cir. Ct of App., September 10, 1993). ---Richard M. Lucas, CPA, is a consultant for the Philip Manuel Resource Group and a former IRS Special Agent. COPYRIGHT 1993 by Alert International, Inc. I0607 * END OF DOCUMENT.

2 1

Ames/clipper compromised?
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Okay here's the scoop on the Ames/clipper bit, from the guy who wrote it. Permission to distribute is granted as long as it is reproduced in it's entirety. Termcomp.zip, the electronic version of TERMINAL COMPROMISE is available for ftp at ftp.netsys.com under /pub/novel for those who asked. - From p00506(a)psilink.com Fri Mar 25 08:04:37 1994 Date: Fri, 25 Mar 94 11:01:56 -0500 To: talon57(a)well.sf.ca.us From: "Winn Schwartau" <p00506(a)psilink.com> Organization: Inter.Pact Subject: Ames/Clipper Connection More About Clipper and Ames by Winn Schwartau March 25, 1994. The Ames/Clipper item I wrote in the Feb. 1994 issue of Security Insider Report has apparently caused quite a hub-bub. The Senate Foreign Relations Committee is looking for more, the general media has picked it up, and the net is buzzing. As a result, I have been asked to put a few words out regarding this story. First of all, it is a story, one that was told to me by a person whom I know well, respect, and was at the actual meeting where the subject of Ames/Clipper was discussed. In RISKS 15.67, Dorothy Denning said that she didn't think that the Clipper Ames story/rumor made sense. While I am sure that the people to whom she spoke told her what she wrote, I was given the story by my source who WAS AT THE MEETING. Does that make it all true? No, it doesn't. And the item in Security Insider Report contained strong caveats at both the beginning and the end of the article. It was NOT printed as 100% accurate: it was printed as I was told it, and it was read and approved prior to publication by the source. I, too, have sought for confirmation, and been unable to find it. So, when Dorothy said she couldn't, that's no surprise. I have enclosed the piece that originally appeared in SIR. I fail to understand Dorothy's inability to accept possibilities and capabilities. That's one of the basic tenets of intelligence and a strong defensive posture. I find it very easy to accept that the intelligence community is considering everything that Ames might have spilled, including Clipper. What is so strange about that? That's their job! In the same issue of SIR, I examined how the FBI used technology to monitor Ames'computer. In the next issue of SIR, I will be looking at Ames' hacking abilities and skills which possibly lend credence to the possi bility that Clipper was compromised. The tale is still unfold ing. "Ames and the Clipper Connection" (From The February, 1994 Issue of Security Insider Report) Let me preface this item with a caveat. I received a call from a very well placed and highly reliable person in Washington who passed on the information. I asked if there was any way I could confirm what he told me, and I was told no. It's too sensitive. Nonetheless, it is so intriguing that SIR readers expect and would want to know what people are thinking about, even if it turns out not to be true. We in our industry deal with possibil ities and capabilities and since this discussion did take place, I'm passing it on as it happened. If this item has any shred of truth to it, well . . . decide for yourself. My contact, we'll call him something original, like 'Joe', was asked to attend a meeting where representatives from the FBI (he wasn't clear if it was the Counter Intelligence 3 [CI-3 from Half Street who keep track of Soviets and Russians] or from FBI HQ), the CIA and the National Security Agency. All told more than a dozen and less than twenty people assembled in an off-site "neutral" location to figure out what to do. It seems, according to a number of people at this meeting, that alleged CIA traitor Aldrich Ames, had access to the Clipper keys. Whoah! I nearly fell off my keyboard when I heard that. "You mean he knew the crypto-secrets behind the whole thing?" I asked. "Why would a Humint [Human Intelligence] guy know the secrets of Clipper?" "He had access to them; it would have been a normal part of his job to be in that loop." So what this group of initialed reps are allegedly attempting to do is: 1. Determine how much access Ames had to Clipper. 2. Determine if he did have access, did he in fact take advantage of it. 3. If he did get some Clipper secrets, is there a record of that access? 4. Then, what did he do with them? The fear, understandably, is that Ames might have compromised the entire Clipper/Capstone/Tessera program. The words I also heard were, "If there's only even a 1% chance that Clipper has been compromised, the whole thing's over. We have to start from scratch." So, according to my sources, the spooks-that-be are looking for a fast alternative to Clipper and Skipjack, under the theory that Ames may have blown the whole wad. Civil libertarians might shout with glee if this turns out to be true, but I think it's a hell of way to win a ball game. Bitter sweet irony. Sure, I'm not in favor it, and I am indeed nervous about 'the other shoe' but this is not the way I wanted Clipper to go away. I repeat: as of today, this is only a story, there is no confir mation. If SIR readers have anything to add, please let us know in any way you can. (C) 1994, Winn Schwartau and Inter.Pact NOTE: As of March 24, 1994, my sources reconfirmed that the story as I told it is 100% accurate. (Security Insider Report is published monthly by Inter.Pact Press, 11511 Pine St., Seminole, FL 34642. Voice: 813-393-6600, Fax 813-393-6361, email wschwartau(a)delphi.com. Hardcopy sub scriptions are $99/Yr. and electronic site licenses are available for selected organizations.) Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced comunication is indistinguishable from noise." --Steve Witham -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLZNPndCcBnAsu2t1AQEsJwQAhLOSV4jLiGgTGNELeZipoXqNTMjUROfo /iCGCKzJJEhk3d25/9jyZsqj7Y0O83j1+oGdqvGB/HyUeHAh/jzNSWwOFaYhBpqJ kWIIjt9YNSRBc+e7ua1bKOD6ZajYw1aOyot8yCjwO0GSZwXdWQHWgd2TkTFobHvH 8CN9hjQ84gs= =x6t+ -----END PGP SIGNATURE-----

1 0

Re: Ames/clipper compromised?
by smb＠research.att.com 17 Dec '03

17 Dec '03

Thanks much for posting. I have a lot of trouble with much of the article, though, on purely technical grounds. Consider the following passage: The words I also heard were, "If there's only even a 1% chance that Clipper has been compromised, the whole thing's over. We have to start from scratch." What does it mean to ``compromise'' Clipper? The algorithm is known? No big deal, in my opinion -- Skipjack was almost certainly designed to be strong even if the algorithm was known. (As I've said before, I tend to believe NSA on that point. I suspect they're telling us the truth about Clipper -- just not the whole truth -- and what they've said is damning enough even if 100% accurate.) It's also quite unlikely that Ames would ever have seen the algorithm; it's just not something he'd have any reason to know. Might he have stolen the family key? More plausible, though again it's not something that would be left lying around, as opposed to being embedded in equipment. Could he have turned over a magic decoder box, which would have to know that key? Not at all unreasonable -- and the decoder boxes are at a sufficiently early stage of design that they may not yet be armored against tampering. But from everything that's been published, very few Clipper chips have been deployed so far. It would not be a major project to recall and rekey the devices. Copies of the key escrow databases? Same argument applies -- though if that's what was stolen, we have to ask how he had access to ``both'' of them. I don't believe there have ever been any categorical statements about how FISA access to Clipper conversations would be obtained. See above under ``whole truth''... It may be, of course, that the episode has made the powers that be wonder about the wisdom of keeping any such keys around. There's been a very strong trend in recent years to avoid *any* sort of cryptography where session keys live anywhere but inside sealed boxes, precisely to avoid key theft. (See Diffie's retrospective on public key technology for more detailed discussion and some examples.) And it's also why the government doesn't want to use Clipper -- as opposed to Skipjack -- for classified information. So -- if the story is true, just what did Ames steal that would require them to ``start over from scratch''? Is there another back door? That's the only thing I can think of that would require such an action -- which means that if they do hold off, there's a new topic to explore via FOIA requests and the like. --Steve Bellovin

2 1

NSA in the WSJ
by Duncan Frissell 17 Dec '03

17 Dec '03

From: The Wall Street Journal, Tuesday March 22, 1994, p. B1 TECHNOLOGY Clipper Chip Is Your Fried, NSA Contends NSA Seeks to Dispel Misgivings of Public About Clipper Chip By Bob Davis Staff Reporter of The Wall Street Journal. FORT MEADE, Md. --- The National Security Agency wants everyone to know that its new computer-security system will protect individual privacy. But as the spy agency knows, hardly anyone believes that. Critics fear the government will use the NSA technology, designed in secret, to spy on Americans. The project "is a focal point for the distrust of government," acknowledges Clinton Brooks, the NSA scientist who led the so-called Clipper Chip project, in the agency's first interview on the subject. The Clinton administration last month adopted the NSA plan for a series of computer chips that would protect telephones and computers. Use of the technology would be voluntary. Federal agencies would adopt it first, and public use is expected to spread gradually. Under the plan, cryptographic "keys" that could unscramble the communications would be split in two and held separately at the Treasury Department and the National Institute of Standards and Technology. That way, law-enforcement agents could tap the communications by getting court authorization to obtain the two halves. The idea is to boost security but to keep the technology out of the hands of criminals and spies. The NSA is the world's biggest eaves-dropper. Equipped with the latest in super-computers and satellite receivers, it targets communications by foreign governments. The agency shuns publicity but agreed to the interview to explain its role in the Clipper controversy and try to dispel fears. Mr. Brooks, a 26-year veteran of the NSA, says the project began in 1989 and cost more than $2.5 million. He says the NSA is consumed with what it calls the "equities problem" --- how to balance privacy rights against the needs of law enforcement, national security and private industry. In 1989, he and Raymond Kammer, deputy director of NIST, began discussions about how to improve computer security without making it impenetrable to police. NIST is a Commerce Department agency with formal responsibility for unclassified computer security. Before the interview, Mr. Brooks takes a look around a small cryptographic museum just outside the NSA's gates. He stands before an exhibit of Enigma machines, used by the Germans during World War II to encrypt messages --- and later broken by Allied intelligence. Enigma started as a commercial product; recognizing its military value, the Nazis pulled it off the market. "That was the concern we're wrestling with today," Mr. Brooks says --- commercial encryption technology becoming so good that U.S. spy agencies can't crack it. In 1989, NIST and the NSA put together an eight-person team, split evenly between the agencies, to quietly work out security concepts. The team decided against using a weak encryption code --- "Roman Numeral One is that it had to be good security," says Mr. Brooks. And it also rejected a so-called trapdoor approach, in which the computer code would be designed so it would have a weak spot --- a trapdoor --- that federal agencies could enter via computer to tap the communications. Someone else could discover the trapdoor, they decided. The team settled on a system with a powerful encryption formula, called an algorithm, and encryption keys that would be held by outsiders. Law- enforcement agencies could get copes of the keys when they needed to bug the conversations. The toughest decision, both Mr. Brooks and Mr. Kammer say, was to keep the algorithm, dubbed the Skipjack, secret. That meant the public wouldn't know for sure whether the NSA had inserted a trapdoor or some other eavesdropping device. "It would defeat the purpose [of the project] if we gave the knowledge of how the algorithm worked" to the public, says the 56-year-old Mr. Brooks. "It was going to have to be kept classified." Otherwise, he explains, engineers could use the algorithm to design computer-security systems that the government's encryption keys couldn't unlock. By 1990, he says, as many as 30 NSA "cryptomathematicians" and other employees were working to perfect the algorithm and other features. A year later, the NSA launched what it called the Capstone Project to build the algorithm into a computer chip. The NSA contracted with Mykotronx Inc., a small company in Torrance, Calif., to do much of the development. By September 1992, the NSA was confident the system would work. None too early for the NSA. Earlier that year, Mr. Brooks says, American Telephone & Telegraph Co. informed the NSA that it wanted to sell a phone using a popular encryption technology to scramble conversations. The NSA balked. "We said it probably wouldn't get an export license from this country," Mr. Brooks says. Instead, AT&T was told of the Capstone work and agreed to use the technology if it became a federal standard and was exportable, he says. The NSA then took some of the functions of the Capstone chip and tailored it to phone equipment, calling the resulting product the Clipper Chip. For computers, Capstone was encased on a computer card that became known as Tessera. The the Bush administration, enmeshed in a re-election bid, never pushed Capstone. So shortly after the election, National-security heavyweights importuned the Clinton transition team to move quickly on Capstone. Just weeks after the inauguration, the new administration's national-security team was debating the NSA proposal and in April announced to the public that it would adopt the scheme. Last month, the administration gave the final go-ahead --- despite withering criticism from industry. Vice President Gore called encryption a "law and order issue." NIST's Mr. Kammer says the new administration was also trying to line up backing among national-security officials to liberalize export controls on computer equipment and other high-tech gear. The high-tech industry was stunned at the decision. David Peyton, vice president of the Information Technology Association of America, a trade group of computer companies, says the scheme will dangerously centralize power in the federal government and will limit exports. James Bidzos, president of a computer-security firm, RSA Data Security Inc., goes further. He posted a letter on the Internet computer network arguing that Clipper may be the "visible portion of a large-scale covert operation on U.S. soil by NSA." Nonsense, responds Mr. Brooks, who says he is distressed by the "emotionalism" of the arguments. "The only reason we're involved is that we have the best cryptomathematicians in the country." --- WinQwk 2.0b#1165

2 1

Ames/clipper compromised?
by Matt Thomlinson 17 Dec '03

17 Dec '03

sommerfeld(a)orchard.medford.ma.us (Bill Sommerfeld) : >BTW, my guess at the most likely back door is that the unit keys will >be generated as a cryptographic function of the serial number and a >*small* random number generated for each chip and unknown to the >agency. They would have to search a mere 2**16..2**32 keys once they >get the serial number out of the LEEF. The existance of such a >backdoor would be difficult to prove, since there would be no visible >evidence for it in the individual chips. It is also difficult to >disprove such a theory because the clipper key generation algorithms >are classified. I just read a paper that might apply to this type of backdoor; it was by someone at RSA, with the title "..RSA's trapdoor can be broken". I'll look the article up when I get home. Basically, it argued that the smaller keyspace generation approach used above would be detectable. I think it might be generally applicable. I'll look it up again. mt Matt Thomlinson Say no to the Wiretap Chip! University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 548-9804 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

1 0

No Subject
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Does anyone know of a utility to crack Lotus 123 files? Someone's lost their password. I believe 123's encryption is very primitive... Ideally the utility should be ftp-able. Thanks ------------------------------------------------------------------------------- Rishab Aiyer Ghosh "What is civilisation rishab(a)doe.ernet.in, rishab(a)dxm.ernet.in but a ribonucleic Voicemail +91 11 3760335; Vox/Fax/Data 6853410 hangover?" H-34C Saket New Delhi 110017 INDIA -------------------------------------------------------------------------------

1 0