FYI the following is scanned, not stirred (or forwarded) from "The Computer
Applications Journal", July 1994, issue #48 (a 'zine with a refreshingly
technical mix of software, hardware info for board-level integration with
current popular operating systems e.g. DOS etc.)
By John Iovine
Cryptology is a science of enciphering and deciphering messages
and information. The word conjures up images of espionage, spies,
hostile government action, and top secret information. We don't
usually associate this word with privacy--your privacy--but it
is this facet of cryptology that is being argued today in our
courts and among government agencies.
ENCRYPTED PRIVACY?
The arena where electronic bits of information are transmitted
through data conduits is loosely termed "cyberspace." Currently, in
cyberspace there's no guarantee of privacy. Transmitted messages
may be intercepted and read indiscriminately. This possible invasion of
privacy is not just limited to Email on your local BBS or on
Internet. Our national telephone network, which handles voice and
fax as well as computer telecommunication, is vulnerable.
Additional data conduits like cable television systems and satellite
feeds are becoming more commonplace all across the country. These
newer networks are vulnerable to interception as well.
To better grasp the threat, imagine a company that
routinely transmits bids or promotional information to
field agents through one of these networks. The company can be put
at a severe disadvantage if a competitor gains access to
this information.
The dark side of our information age is that technically skilled
crooks--sometimes romantically referred to as phreakers and crackers
can create havoc in your life.
For a while, crackers were making national news by breaking into
secured government databases.
Intercepting various unprotected data communications makes most
people easy targets for others to gain access to confidential
material.
Anyone who has been electronically mugged has very little
sympathy for these criminals. By stealing credit card numbers,
they are capable of making purchases, charging telephone calls to
your phone number, reading your Email, and listening to cellular
phone conversations.
The problem is growing. Our national data network increases in size
and complexity daily. It is changing and defining the methods by
which people communicate, information is transferred, and business is
conducted.
It is therefore becoming increasingly important to secure the
privacy of the networks and reduce their vulnerability to
interception. Business has been less than responsive to this threat.
For instance, credit card companies justify their exorbitant +19%
interest rates because they are needed to compensate for the
tremendous amount of credit card (read "electronic") fraud and
thievery. These companies should be doing
much more to prevent electronic fraud instead of just passing the
cost on to honest consumers in the way of high interest rates.
Rep. Edward J. Markey (D-Mass), the chairman of the House Telecom-
munication and Finance Subcommittee, had this to say about privacy:
"Whether it's a cellular phone conversation, computer data, a fax
transmission, a satellite feed, cable programming, or other
electronic
services, encryption is the key to protecting privacy and security."
He stated further that "developing a national policy
for encryption and its uses is therefore a process of fundamental
importance for the future of our national networks and our
competitive position internationally."
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
--------- ENTER THE CYPHERPUNKS
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
That's cypher, not cyber. Let's not confuse these similar sounding
monikers. The cypherpunks want to see widespread public use
of cryptotechnology. They see the individual's privacy protected
through cryptography. However, they face powerful governmental and
political obstacles.
The end of the cold war hasn't eliminated the need for cryptography
and secret codes used by our government. But it should
have alleviated some of the regulations concerning private use of
cryptotechnology. The government still classifies cryptotechnology
with hard military weapons such as tanks. The U.S. government agency
in charge of cryptotechnology is the National Security Agency (NSA).
The cypherpunks see the NSA as trying to keep its monopoly on
cryptotechnology intact.
One of the most outspoken and visible members of the cypherpunks is
Iohn Gillmore. Mr. Gillmore has this to say on the subject:
Government investment leads to government control.
Government control is detrimental to the development of the media.
Government seized the control of radio and television in their
infancy. Since then the media has never had full first amendment
rights or protection.
Encryption technology is the key for people and companies to maintain
their privacy over the networks. The government should cease its
involvement .
John has fought legal battles with the NSA on a few fronts. So
far he has been victorious.
BATTLE LINES
The lines are drawn. On one side you have the cypherpunks who feel
that good public cryptographic technology safeguards our privacy. The
NSA feels this is compromising our national security.
The government has threatened private cryptographers with jail. John
Gillmore was threatened by the NSA stating that he was on the
verge of violating the Espionage Act. A conviction would have sent
him to jail for 10 years.
How can the government threaten private citizens7 Easily: as stated
previously, the government classifies cryptographic tools with
military tanks and bomber planes.
THE WASHINGTON CONNECTION
The Administration wants America to encrypt its information to
protect it from unauthorized access. The encryption scheme, con-
tained in the government-sponsored Clipper chip, includes voice as
well as data information sent over communication lines. A major
catch in this plan is that only the government-approved encryption is
allowed in any device used by the government or in government
projects.
Other encryption methods continue to be legal for domestic use, but
only in nongovernment applications.
The second catch is the potential for a trap door in the
encryption chip's program that would allow law enforcement agencies
to decipher any encrypted data. Therefol-e, this method of encryption
doesn't alleviate concerns that the government could abuse its ability
to tap into the privacy of the citizenship.
Of course, organized crime would use its own crytotechnology, anyway.
So a trap door would only be effective for spying on
small incidental crooks and private citizens.
The encryption algorithm touted by the Administration is
contained in an integrated circuit. This chip, designed by Mykotronx
in Torrance, Calif. and manufactured by VLSI in San Jose, Calif., is
nicknamed "Clipper." It is a 12-Mbps encryption coprocessor. The OEM
cost of the chip is $26 when purchased in large quantities, which
trickles down to an increase of $100 in the street price of any
electronic equipment (computer, phone, fax that contains the chip.
SOFTWARE VS. HARDWARE
There are less expensive encryption chips on the market than the
Clipper.
Usually anyone interested in encryption takes a software
approach. It may be a little slower than hardware, but the
recurring cost is much less. Speed only becomes a critical
consideration when it's necessary to secure fast communication
such as video or voice communication.
RECENT EVENTS
On February 4, 1994, the U.S. Government officially endorsed the
Clipper chip and directed the Commerce Department's National
Institute of Standards and Technology (NIST) and the Treasury
Department to hold in escrow the keys used to unlock the Clipper
codes. It also establishes new procedures for exporting products
using Clipper to most countries.
The government has formed an interagency group whose job it is to
develop encryption technologies that could serve as alternatives to
Clipper.
The Clipper endorsement contains three flaws according to a
policy paper released in January 1994 by the Institute of Electrical
and Electronic Engineers: a classified algorithm, the key-escrow
system, and an encryption standard developed for public use without
public scrutiny.
The Clipper chip has developed many industrial and congressional
opponents. So far, Novell, AT&T, Citicorp, Computer Associates,
Hughes Aircraft, Motorola, and other major corporations openly
oppose the Clipper encryption standard. The failure of recent
administrations lies in
the fact that they did not seek greater industry participation
before proposing the Clipper chip. Further, they ignored protests
from industry and Congress.
THE BIG BROTHER ISSUE
The Clipper chip can provide government agencies with
unprecedented wiretapping ability.
Ideally, the Clipper chip encrypts (scrambles) communication to
everyone except the intended recipient. The key code to unscramble
communication is held by two separate government agencies. The
government has the option of using a joining key code to unscramble
communications with court-approved legal authorization.
However, there is a strong possibility that a trap door exists in the
Clipper chip that would allow agencies unauthorized tapping. The
government wouldn't allow the algorithm used in the Clipper, called
"SkipJack," to be studied publicly, so no one knows for sure.
When the Administration endorsed the Clipper as a Federal Data
Processing Standard on February 4, it was backed up with an immediate
order for 50,000 Clipper chips. Meanwhile, a forced export
embargo keeps all other encryption schemes expensive. U.S.manu-
facturers must "dumb down" their data encryption programs by
keeping the key lengths to 40 bits or fewer for legal export. The
Clipper uses an 80-bit code.
ENCRYPTION BASICS
The following is a list of some of the basic terms that are used in
encryption. Plaintext is the original unaltered message or file.
Ciphertext is the encrypted message or file. An encryption
algorithm is the function that maps plaintext into ciphertext.
Keys are used to determine mapping. Keyspace describes the size
of the key; it determines
the number of all possible keys. For instance, an 8-bit key has a
keyspace of 256 (256 possible values), where a 16-bit key has a
keyspace of 65,536. Keys are usually alphanumeric.
There are three main types of ciphers: substitution, transposition,
and product. Substitution ciphers substitute each character in the
plaintext with another, determined by the key. Transposition ciphers
rearrange the characters in plaintext, again, determined by the key.
Product ciphers combine the substitution and transposition
algorithms.
A substitution cipher simply substitutes each plaintext character
with another character determined by the key. For instance, we could
easily displace the alphabet by one character to generate a simple
substitution. For example, ABC...XYZ could become BCD...YZA, and the
phrase "HELLO WORLD" would become "IFMMP XPSME."
Substitution ciphers are also called Caesar ciphers, because Julius
Caesar used this simple method of encoding messages.
The transposition cipher system rearranges the characters in
plaintext. A simple system rearranges every two characters, so "ab"
becomes "ba." With this kind of cipher, "HELLO WORLD" becomes
"EHLLW ORODL."
GENERATING MORE COMPLEX CIPHER SYSTEMS
Blaise de Vigenere, a French cryptographer in the sixteenth century,
complicated the simple Caesar code. He proposed that the key be
used to change the plaintext in a periodic manner. When a message is
encoded by this method, you change a plaintext letter for each
successive letter in the key, always running through the same
sequence of key letters. A simple example should clear any confusion.
Suppose the name "John" was selected for the key code. This corre-
sponds to the number sequence 9, 14, 7, 13. To encode a message
using this key sequence, divide the letters of the plaintext message
into groups of four. This corresponds to the four letters used in the
key.
To each letter group, add 9 to the number value of the
first letter of each group, 14 to the second letter, 7 to the third
letter, and 13 to the fourth letter. The example below illustrates
the Vigenere code:
Key Code: JohnJohnJohnJohn
Plaintext message: helloworld
Ciphertext message: qssy xlvf m
As you can see, the coding algorithms are becoming more
complex. Even this code pales to the more sophisticated programs
available.
THE DEBATE CONTINUES
I've only scratched the surface in the great encryption debate.
There are a number of on-line newsletters carried on the Circuit
Cellar BBS that follow the issue closely Computer Underground Digest
[CuD] and Electronic Frontier Foundation [EFF]. If you are
interested in following along, check them out.
So what do you think? Write and let me nkwo (pun intended)
John Iovine is a free-lance writer living in Staten Island, N.Y.
He has published numerous books on electronics and science-related
topics. He may be reached at 75425.673(a)compuserve.com.
For those who wish to pursue data encryption, Images Company
offers an encryption program titled Cipher 1.0 for $9.95. Images
Company, P.O. Box 140742, Staten Island, NY 10314, l 718 698-8305.
New York residents must add the appropriate sales tax. Add $5.00
postage and handling to all orders.
-NetSurfer
#include standard.disclaimer
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
== = = |James D. Wilson |V.PGP 2.4: 512/E12FCD 1994/03/17 >
" " " |P. O. Box 15432 | finger for full PGP key >
" " /\ " |Honolulu, HI 96830 |====================================>
\" "/ \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com >
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
