December 2003 - cypherpunks-legacy

Re: NYT on NTT/RSA Chips
by jim bell 17 Dec '03

17 Dec '03

At 10:54 AM 6/4/96 GMT, John Young wrote: >Connecting Declan's three dots [...]: > The New York Times, June 4, 1996, pp. D1, D4. > Japanese Chips May Scramble U.S. Export Ban > By John Markoff > Washington, June 3 -- The Nippon Telegraph and Telephone > Corporation has quietly begun selling a powerful data- > scrambling chip set that is likely to undermine the Clinton > Administration's efforts to restrict the export of the > fundamental technology for protecting secrets and commerce > in the information age. > An executive at NTT America said that although there were > no restrictions on the export of cryptographic hardware or > software from Japan, his company was still anxious to > obtain software from RSA Data to use in its chips. That > software is still controlled by United States export law, > he said. Maybe it's just me, but the solution to NTT's problem is obvious. Even assuming that the export of this software would be against the law, why doesn't somebody simply violate that law? RSA would publish that software, possibly encrypted with NTT's public key, on a public system protected against direct export. "Somebody" would download it, write it to a floppy (taking care not to leave any fingerprints, and wetting both the stamp and the envelope with tap water, rather than licking them) and mail that floppy off to NTT in Japan. (Naturally, you don't put a return address on that envelope. The truly paranoid would first take that floppy to some store's PC section, and cross-load the data onto a floppy written by some other floppy drive.) NTT finds that envelope in their mail, opens it, reads the floppy, decrypts the data, and say, "Wow! It's the data we wanted to get!" It verifies that the data is valid by emailing a copy back to RSA in America, who say, "Amazing! Somebody has illegally exported our software!" As far as I know, there is nothing wrong with NTT using this software even if it is assumed to have been exported illegally. Obviously, NTT won't _ask_ for somebody to do this, because then the government will claim it was all a conspiracy, but that doesn't prevent NTT from being the beneficiary of somebody else's activities. Jim Bell jimbell(a)pacifier.com

2 1

Export what's imported
by jim bell 17 Dec '03

17 Dec '03

Recently, Senator Burns introduced that bill, S.1726, "ProCode." Part of it had to do with changes in the export laws to allow export of things that are currently not allowed. It occurs to me that this bill should be amended to say, explicitly, that any object or software which has ever been imported into the US can be legally exported. (Including multiple copies of software.) It is particularly important that we do this now that the NTT encryption chip set has been announced. Why? Well, first, we CAN easily justify this. The claim for export controls is that they restrict the access of encryption to various of the horsemen, out there. But by definition anything which has ever been imported is already available outside the US, so it'll look rather silly if they try to control somebody from export that came from out of the country. What are the benefits? Maybe it'll destroy the entire crypto-export-regulation system. Domestic software companies can simply set up a practice of buying all their crypto expertise from overseas. If this happened over the long term this would be bad, but it won't because within a couple of years good crypto will be exported by American manufacturers based on foreign designs. Pretty soon the export bans will become meaningless (even more so than they are today) and the pressure to remove the last restrictions will be enormous. Jim Bell jimbell(a)pacifier.com

1 0

Re: (VTW) BillWatch #48
by jim bell 17 Dec '03

17 Dec '03

At 10:17 AM 6/4/96 -0400, Carl Ellison wrote: >I was at the EPIC conference yesterday (6/3) -- where Whit Diffie, BTW, presented the same argument Steven Cherry gave in this BillWatch -- but at the end of the EPIC conference we had Scott Charney of DoJ on a panel about what the OECD is doing (pushing Clipper internationally) and we kept going round with him on the administration's pushing of Clipper (N). [One attendee described this as "forum shopping" -- looking for a friendly place to push Clipper.] > >There were people battling him over his alleged representation of the USA at the OECD -- claiming he was misrepresenting the country by pushing Clipper. His response was that the Executive is empowered to do all international meetings/negotiations/.... > >After the meeting ended it hit me what the problem is and I mentioned it to PRZ. We're complaining that the Executive has gone rogue -- is disobeying the will of the people. PRZ likened it to Nixon's war in Cambodia. I have a solution to that problem. Jim Bell jimbell(a)pacifier.com

1 0

Re: FOR WHOM THE BELL TOLLS
by jim bell 17 Dec '03

17 Dec '03

At 12:30 PM 6/4/96 -0700, Sandy Sandfort wrote: > Carl Ellison wrote: >>After the meeting ended it hit me what the problem is and I >>mentioned it to PRZ. We're complaining that the Executive >>has gone rogue -- is disobeying the will of the people. >>PRZ likened it to Nixon's war in Cambodia. > > Jim Bell replied: > >>I have a solution to that problem. > >My question for member of this list is: When Bell finally >goes too far and they arrest or shoot him, how can we best >capitalize on his martyrdom? Or in a more negative light, >what damage control will we need to do in that case? >Now I know that barking dogs rarely bite, but Jim may just >fool us and find his cajones. In any event, the sort of >yapping he is doing could itself be considered a crime that >could attract the sort of negative attention he apparently >craves. If there is any doubt that we _need_ a system to rid us of these sleazy politicians: I just saw tonight's PBS McNeil news hour, and they had two politicians on, one of which was promoting a re-emergence of the "Star Wars" missile defense system, which even under optimistic scenarios would cost hundreds of billions of dollars. My solution is simpler and far less expensive: Target any political or military person at any level who is directly or indirectly in control of any offensive missile system (nuclear or otherwise), killing off as many as it takes until they cry "uncle" and destroy all of that hardware. Probable cost of this persuasian? A few hundred million dollars, at most. Who is committing the crime, here? Maybe, someday, you'll start really LISTENING to what I have to say. ObCrypto? Your motivations are quite opaque. Maybe we can turn them into a cryptosystem? Jim Bell jimbell(a)pacifier.com

1 0

Info on DES crypto program
by vinnie moscaritolo 17 Dec '03

17 Dec '03

Hey all; Does anyone have experience or comments about a product called Code Cryptor from New Mexico Software. I belive it is yet another DES based product. tey have a web page at: http://www.swcp.com/cryptor/ "Rah's Samoan Attorney" Vinnie Moscaritolo ------------------ "friends come and friends go..but enemies accumulate." http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

2 1

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

1 0

FOR WHOM THE BELL TOLLS
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, In a recent exchange, Carl Ellison wrote: >After the meeting ended it hit me what the problem is and I >mentioned it to PRZ. We're complaining that the Executive >has gone rogue -- is disobeying the will of the people. >PRZ likened it to Nixon's war in Cambodia. To which Jim Bell replied: >I have a solution to that problem. My question for member of this list is: When Bell finally goes too far and they arrest or shoot him, how can we best capitalize on his martyrdom? Or in a more negative light, what damage control will we need to do in that case? Now I know that barking dogs rarely bite, but Jim may just fool us and find his cajones. In any event, the sort of yapping he is doing could itself be considered a crime that could attract the sort of negative attention he apparently craves. Any suggestions? S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4 3

MELP: 2400 baud speech coding
by John Gilmore 17 Dec '03

17 Dec '03

Mixed-Excitation Linear Predictive encoding gives better speech quality than CELP at half the data rate. Encoding and decoding together burn up more than 100% of a TMS320C3x digital signal processor at 33MHz -- 64% to encode and 53% to decode. I don't know how it does on a Pentium or an Alpha. If you have the MIPS at both ends, this enables very robust encrypted speech across modem links to the Internet. John Walker's free SpeakFreely software (http://www.fourmilab.ch/speakfree/windows/speak_freely.html; or follow the link from there to the Unix version) is already doing packet replication for high reliability, using the earlier LPC-10 algorithm. (It doesn't implement MELP, though those on fast CPUs could add it.) I noticed an ad in EE Times that said, "MELP: The new Federal Standard for 2400 bps Speech Coding", so I did a web search for it. It reportedly comes from Georgia Tech research. Atlanta Signal Processors has the exclusive license. See http://www.ti.com/sc/docs/dsps/softcoop/voc-13-1.htm. John Gilmore

1 0

biometric id
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

info on a biometric id utilizing crypto techniques. ------- Forwarded Message Date: Fri, 31 May 1996 16:34:40 -0700 (PDT) From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: biometric encryption [A Canadian company called Mytec is marketing a biometric encryption system that, as far as anybody can tell, is an important step forward for privacy protection. It is based on fingerprint recognition, but it does not produce a representation of the fingerprint or recover the identity of the fingerprint's owner. Instead, it uses an optically transformed version of the fingerprint to decrypt a text string that could be, for example, the private key for a public-key cryptographic system such as RSA. Provided that one trusts the Mytec box, this would be a way to overcome many of the pragmatic hassles that would otherwise accompany the privacy-enhancing technologies that David Chaum and others have described. For example, they have built their device into a computer mouse, so that the computer will only generate your digital signature, or permit your mail to be read, if you are holding the mouse (or, I suppose, if you have been holding it very recently). In this message, the president of Mytec responds to some common concerns about his company's technology that arose in response to a query that I sent to the Computer Privacy Digest. He provides the company's web URL for those who wish to know more.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Fri, 31 May 96 11:06:44 EST From: Computer Privacy Digest Moderator <comp-privacy(a)uwm.edu> To: Comp-privacy(a)uwm.edu Subject: Computer Privacy Digest V8#044 Computer Privacy Digest Fri, 31 May 96 Volume 8 : Issue: 044 - - ---------------------------------------------------------------------- Date: 29 May 1996 09:42:54 -0400 (EDT) From: gtomko(a)noc.tor.hookup.net (George Tomko) Subject: Re: Biometric Encryption Dear Mr. Levine: Subject: Biometric Encryption I have noticed a number of communications in your news group regarding Biometric Encryption, especially some concerns about its use. As one of the developers of this technology, I would appreciate if the attached response could be posted in the news group to provide people with some answers and also to obtain feedback and discussion. Kind regards. George J. Tomko, Ph.D. Several people commented on four concerns in using a finger pattern for biometric encryption, namely: 1. It's easy to get someone's fingerprints since they are left on a vast number of everyday objects, such as drink cans and door handles; 2. Muggers would start cutting off people's fingers when stealing their cards; 3. The crooks would forcibly hold down an individual's finger against the biometric encryption authentication device to extract the string coded by the individual's Bioscrypt; and 4. If the finger used to code the Bioscrypt is damaged or destroyed, then an individual will not have access to the files associated with the Bioscrypt. I will try to answer these concerns in order. But, first, let me define a Bioscrypt. A Bioscrypt is a two-dimensional image of a string or set of characters which can represent a PIN, encryption key or pointer and which has been coded (encrypted) by the two-dimensional information in a fingerprint pattern. It has the following properties: - - - it has no resemblance to the original fingerprint. - - - it cannot be reconverted to the original fingerprint. - - - if an optical image of the correct live fingerprint is transmitted through the Bioscrypt, then the output light beam uniquely represents the coded number. By successfully decoding their Bioscrypt, the person also confirms who they claim to be. For purposes of the discussion below, it is important to note that the optical authentication device is a coherent system and uses the phase information in a finger pattern (complex domain) as a discriminating parameter. 1. "Picking up latent prints from door handles, etc." To perpetrate a masquerade using a latent fingerprint of a legitimate user is very difficult for the following reasons: * The system requires a three-dimensional reconstruction of the legitimate user's fingerprint because the height of the various fingerprint ridges can modify the two-dimensional complex optical image which is the input to the authentication device. There is little information in a two-dimensional latent print about the depth and the height of grooves and ridges of the actual fingerprint. * The three-dimensional reconstruction of the legitimate user's fingerprint from a latent print would also need to duplicate the approximate oil and moisture content of the skin, since this is one of the factors which affects (modulates) the two-dimensional image read by the system. Quantifying this information from a latent print is very difficult. Even if it were, the three-dimensional reconstruction would have to be made from a synthetic material which had the same oil and moisture properties as the legitimate user's skin. To use an oil/water based solution to place on the input scanning window would be useless since this would frustrate all of the light bouncing off the window and would convey little or no useful information to the optical system. * The reconstructed fingerprint would also need to be made from a material with approximately the same elastic properties as the legitimate user's finger skin. During enrollment, and subsequently on authentication attempts, the user slides a finger over the input scanning window. This action warps the skin and the corresponding fingerprint pattern based on the elastic properties of the skin. Within the population, warping can vary significantly based on age, dryness of skin, etc. and is thus another unique aspect of the individual's finger pattern. 2. "Severing the finger to obtain access." As already mentioned in some of the previous communications in this newsgroup, measuring the temperature, humidity, pulse rate and even heart rate to verify a live finger can be accomplished. One of the key factors, though, is after the finger is severed the elastic properties of the skin change rapidly and thereby would not warp in the same manner as a live finger pattern. This would make a cadaverous finger useless after a period of time. (Can't find subjects to do a double blind study though). 3. "Crooks would forcibly hold down the finger." By forcibly sliding an individual's finger against the biometric encryption authentication device (reading device), the string coded by the Bioscrypt can be extracted. The string coded by the individual's finger pattern Bioscrypt could then be used for a one-time access for whatever purposes the string was intended. However, assuming that the individual is freed, he can then use his finger pattern to code a completely different string to prevent repetitive access. The system is robust in that it is very easy to change PINs, encryption keys or computer pointers. It was suggested in some of the messages that a pass phrase be used in conjunction but, again, if an individual is holding your finger down forcibly, to extend that to pointing a gun to your head to divulge the pass phrase is not an extreme assumption. There is no perfect security system out there and I doubt one will ever be designed since it has to work with real human beings. I suggest that the goal is to provide privacy-enhancing technology that handles the majority of the infringement cases and that, for exceptional circumstances where extreme privacy and security must be guaranteed, we combine the biometrics (something you are) with the pass phrase (something you know) and a token (something you have). If the combination of those three doesn't do it, then at this stage of technological evolution, nothing will cut it. 4. "Losing or damaging a finger with the result of not being able to access the Bioscrypt and related files." One of the properties of optical processing is that composite patterns can be made and thereby used to make the Bioscrypt. Accordingly, more than one finger could be used or a finger and a proprietary pattern (which one keeps hidden away somewhere). Of course, there is a penalty. The more patterns one uses, the smaller the signal to noise ratio of the system. The system is currently designed to give signal to noise ratios in the order of 10 to 12 dB and thereby significant degradation can still occur which would allow comfortably two to three patterns to be superimposed in the same Bioscrypt. If you are interested, more information can be gained by accessing Mytec's web page at http://www.mytec.com. - - -- George J Tomko Mytec Technologies Inc. Toronto, Ontario - - ------------------------------ End of Computer Privacy Digest V8 #044 ****************************** - ------- End of Forwarded Message ------- End of Forwarded Message

1 0

Re: CWD: "Jacking in from the "One that Got Away" Port (fwd)
by Carl Ellison 17 Dec '03

17 Dec '03

>(By Brock Meeks / brock(a)well.com / Archived at http://www.cyberwerks.com/) > > > CyberWire Dispatch // Copyright (c) 1996 // > > Jacking in from the "One that Got Away" Port: > > Washington, DC -- President Clinton call your spooks, get FBI Director > Louis Freeh on the phone. Tell them to order in pizza. Bill, it's > going to be a long night. All your plans to hold the U.S. crypto > market hostage have just been fucked... and you didn't even get kissed. > > A virtual tactical nuke was hurled into the arcane subculture of > encryption technology Monday when RSA President Jim Bizdos revealed > that his company's Japanese subsidiary had developed a monster chipset > capable of scrambling voice and data real time with a so-called "key > length" of up to 1024 bits. Brock, you have probably heard by now -- this is wrong. The chip set was developed by a subsidiary of NTT called NEL. That's much worse, of course, than if it had been an RSA subsidiary. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)cybercash.com http://www.clark.net/pub/cme | |CyberCash, Inc. http://www.cybercash.com/ | |207 Grindall Street PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 | |Baltimore MD 21230-4103 T:(410) 727-4288 F:(410)727-4293 | +--------------------------------------------------------------------------+

1 0