December 2003 - cypherpunks-legacy

IMP (was Re: ecash-info (
by Duncan Frissell 17 Dec '03

17 Dec '03

H > 2.) It seems to me that that e-cash, contrary to the status quo's H >thinking, H > is *critical* to internet commerce. H > H >No, it's not critical. Some form of transaction mechanism is H >critical. Privacy is not critical to the bulk of the economy, H >though. Face up to it. If it were, it would be so obvious that we H >wouldn't be discussing it on a mailing list. In fact, _we_ wouldn't be H >discussing it, but rather a whole bunch of bank vice presidents. The nicest thing about electronic money is not that anonymous digital cash is possible. but that the money is electronic. This means cheap transaction costs. This means that even if "banks" deploy ID-based rather than anonymous transaction systems, civilians can quickly step in and offer to broker anonymous transactions for those who prefer their privacy. Just as you can cash checks for other people today, you will be able to carry out transactions for others on the nets. Since it is much easier to operate these kinds of services in an electronic payment system with automation and on-line verification, suppliers should appear if the demand warrants. Since people will be in different physical locations and legal jurisdictions proof of wrong doing will be hard to come by. DCF "It is perfectly possible to overthrow the old order without picking up a gun or violating any (significant) law. If the conditions of human life change as radically and rapidly as they seem destined to, the (always bizarre) notion that groups of small oligarchies are competent to run the lives of everyone on earth will be swept aside almost accidentally as people move into their new lives." -- DCF --- WinQwk 2.0b#1165

1 0

more info from talk at MIT yesterday.
by sommerfeld＠localhost.medford.ma.us 17 Dec '03

17 Dec '03

The folks from the NSA said the following about key generation: - each escrow agency provides a "seed key", seed1 and seed2 - the box which programs the chip generates two random keys, random1 and random2 - for each chip programmed during that batch (which is "12 to 14 hours of production"), the box computes a classified deterministic function (U1, U2) = F(serial, random1, random2, seed1, seed2) to generate the unit keys They did *not* explicitly say that the random seeds were destroyed at the end of the production run. Also, someone asked "How do we know that the unit key isn't a hash function of the chip serial number?" The answer was: "You don't". They also confirmed Tom Knight's suspicions about what they're going to do when someone reverse engineers the chip and publishes the Skipjack algorithm & the family key: they've got a patent application filed, under a secrecy order; if the algorithm is published, they'll lift the secrecy order and have the patent issued, and use that to go after anyone making a compatible version. They also had a comment that they considered Blaze's findings to be mostly irrelevant, as the only people who would use it would be persons who *didn't* trust the escrow system, but *did* trust the algorithm... - Bill

6 7

Re: Faster way to deescrow Clipper
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > ...not be able to decrypt the communications, but they still get your ID. > >"your ID"? You mean your phone's ID. Goodness gracious, if you were > >a criminal, you wouldn't go out and steal someone else's Clipper > >phone, would you? Let's not get too high tech here, just because we > >have the ability. > > Or you could just steal someone else's LEAF, by keeping a copy of it, and use > that for spoofing. Then you could have a valid IV too... The IV is session-dependent, and both ends generate it. We don't know where in the LEAF the chipid is, but if they use a fixed format and don't do a key-dependent permutation of the LEAF bits, it shouldn't be hard to figure out (unless the checksum comes first and they use a block-chaining encryption, in which case you know you lose.) That would let you create rogue LEAFs with known users' chipids, which would be interesting - does anyone want to make 65536 calls to clipperphone(a)whitehouse.gov :-) ? (Yeah, it's not quite that simple.) (If you do need a lot of data, cellphones are a good source, since the cellphone operators' chipids are likely to be wellknown, though rapidly tapped.) Paranoid-speculation-mode: Of course, if you can forge LEAFs with their chipid, they can forge LEAFs with yours, which could be used to manufacture interesting evidence.... Bill

2 1

Re: more info from talk at MIT yesterday.
by werner＠mc.ab.com 17 Dec '03

17 Dec '03

>Date: Fri, 03 Jun 1994 10:36:37 -0400 >From: "Perry E. Metzger" <perry(a)imsi.com> > >Since when can the government patent its work? I thought that works >produced by government agencies could not be copyrighted or patented. I'm not sure of the details, but I know the law in this area was changed during the Reagan administration to unfetter U.S. companies who had done research that was partially govt. funded. Under the old rules, foreign companies could take advantage of work that could not be patented or otherwise protected by trade secret. Thus, technologies that were developed through govt.-funded work were acquired for free and used against the U.S. in global economic competition. Not sure about work that is completely government-produced, but what did the government ever come up with all on its own, anyway? I do know that my company is currently engaged in several joint projects with the government as a result of the new regulations, and part of the deal is that we retain the rights to the inventions. tw

1 0

Re: more info from talk at MIT yesterday.
by smb＠research.att.com 17 Dec '03

17 Dec '03

Bill Sommerfeld says: > They also confirmed Tom Knight's suspicions about what they're going > to do when someone reverse engineers the chip and publishes the > Skipjack algorithm & the family key: they've got a patent applicatio n > filed, under a secrecy order; if the algorithm is published, they'll > lift the secrecy order and have the patent issued, and use that to g o > after anyone making a compatible version. Since when can the government patent its work? I thought that works produced by government agencies could not be copyrighted or patented. The government can patent things, but not copyright them. In any case, they cannot refuse to license a patent, so this isn't real protection anyway. (The hope behind people patenting things they may release in the future is to make it commercially less attractive, not to utterly prevent use.) Why can't they refuse to license a patent?

1 0

Re: more info from talk at MIT yesterday.
by Perry E. Metzger 17 Dec '03

17 Dec '03

smb(a)research.att.com says: > Why can't they refuse to license a patent? I was under the impression that the law obligated you to license patents -- albeit not necessarily at an attractive price. I am quite likely to be mistaken on this -- my memory on the topic is very sketchy, as demonstrated by the fact that I didn't realize the government can patent things (although I was right on copyrights.) Perry

1 0

Re: no subject (file transmission)
by f_griffith＠ccsvax.sfasu.edu 17 Dec '03

17 Dec '03

Date: Thu, 2 Jun 1994 17:58:38 -0700 > From: nobody(a)shell.portal.com > > Attn Pr0duct Cypher > -----BEGIN PGP MESSAGE----- > -----END PGP MESSAGE----- > >Now that's an interesting idea for contacting people anonymously. However, it would have been kinder to the rest of the list members to put Attn Pr0duct Cypher in the subject.

1 0

Re: more info from talk at MIT yesterday.
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Bill Sommerfeld says: > > They also had a comment that they considered Blaze's findings to be > > mostly irrelevant, as the only people who would use it would be > > persons who *didn't* trust the escrow system, but *did* trust the > > algorithm... Defense Messaging System is supposedly going to use Skipjack, so I assume it's reasonably secure - and if there *are* NSA-only backdoors in the algorithm, at least they won't be admitting it to your neighbor hood cops and FBI wiretappers, so you'd have to be an *interesting* suspect to get cracked. Bill

2 1

Re: Black Eye for NSA, NIST, and Denning
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Perry writes: > > However, it can be done in advance, and you can conceivably reuse > > forged LEAFs. > > I will point out something that I didn't quite understand myself but > have since discussed with Matt Blaze in some detail -- LEAF checksums > are tied to session keys. You CAN do this in advance but only if your > key exchange will permit you to generate your session keys in advance, too > Obviously, reusing forged LEAFs requires reusing session keys. More precisely, as Steve's summary pointed out, it's tied to the IV, which is tied to the session key. (It makes sense - assuming the descriptions of the LEAF contents are true, the only session key component in the LEAF itself is encrypted with the chip-unique backdoor key, and tying it to the IV accomplishes key-dependence, though they could also use the session key externally from the LEAF.) Unfortunately, most Clipperphones will probably use Diffie-Hellman key exchange, since it reduces or eliminates the need for prearranged public-key management (depending on whether they're using radio or a medium that can be actively wiretapped), so precomputation will generally not be usable. I suppose some crude Diffie-Hellman implementations might always use the same half-key for every conversation, rather than generating a random one each time, and you could precompute session keys for talking to them. For email applications, however, most standards will probably use sender-generated session keys, so it would be simple enough to make secure Tessera mailers if you don't worry about subliminal channels in the hash. Bill

1 0

Re: more info from talk at MIT yesterday.
by smb＠research.att.com 17 Dec '03

17 Dec '03

> Bill Sommerfeld says: > > They also had a comment that they considered Blaze's findings to b e > > mostly irrelevant, as the only people who would use it would be > > persons who *didn't* trust the escrow system, but *did* trust the > > algorithm... Defense Messaging System is supposedly going to use Skipjack, so I assume it's reasonably secure - and if there *are* NSA-only backdoors in the algorithm, at least they won't be admitting it to your neighbor hood cops and FBI wiretappers, so you'd have to be an *interesting* suspect to get cracked. Not only that, there have been too many spies found in the various intelligence agencies for them to risk such a thing.

1 0