December 2003 - cypherpunks-legacy

No Subject
by Martin Hellman 17 Dec '03

17 Dec '03

Subject: Clipper Chip Most of you have seen the announcement in Friday's NY Times, etc. about NIST (National Institute of Standards & Technology) announcing the "Clipper Chip" crypto device. Several messges on the net have asked for more technical details, and some have been laboring under understandable misunderstandings given the lack of details in the news articles. So here to help out is your friendly NSA link: me. I was somewhat surprised Friday to get a call from the Agency which supplied many of the missing details. I was told the info was public, so here it is (the cc of this to Dennis Branstad at NIST is mostly as a double check on my facts since I assume he is aware of all this; please let me know if I have anything wrong): The Clipper Chip will have a secret crypto algorithm embedded in Silicon. Each chip will have two secret, 80-bit keys. One will be the same for all chips (ie a system-wide key) and the other will be unit specific. I don't know what NIST and NSA will call them, but I will call them the system key SK and unit key UK in this message. The IC will be designed to be extremely difficult to reverse so that the system key can be kept secret. (Aside: It is clear that they also want to keep the algorithm secret and, in my opinion, it may be as much for that as this stated purpose.) The unit key will be generated as the XOR of two 80-bit random numbers K1 and K2 (UK=K1+K2) which will be kept by the two escrow authorities. Who these escrow authorities will be is still to be decided by the Attorney General, but it was stressed to me that they will NOT be NSA or law enforcement agencies, that they must be parties acceptable to the users of the system as unbiased. When a law enforcement agency gets a court order, they will present it to these two escrow authorities and receive K1 and K2, thereby allowing access to the unit key UK. In addition to the system key, each user will get to choose his or her own key and change it as often as desired. Call this key plain old K. When a message is to be sent it will first be encrypted under K, then K will be encrypted under the unit key UK, and the serial number of the unit added to produce a three part message which will then be encrypted under the system key SK producing E{ E[M; K], E[K; UK], serial number; SK} When a court order obtains K1 and K2, and thence K, the law enforcement agency will use SK to decrypt all information flowing on the suspected link [Aside: It is my guess that they may do this constantly on all links, with or without a court order, since it is almost impossible to tell which links over which a message will flow.] This gives the agency access to E[M; K], E[K; UK], serial number in the above message. They then check the serial number of the unit and see if it is on the "watch list" for which they have a court order. If so, they will decrypt E[K; UK] to obtain K, and then decrypt E[M; K] to obtain M. I am still in the process of assessing this scheme, so please do not take the above as any kind of endorsement of the proposed scheme. All I am trying to do is help all of us assess the scheme more knowledgably. But I will say that the need for just one court order worries me. I would feel more comfortable (though not necessarily comfortable!) if two separate court orders were needed, one per escrow authority. While no explanation is needed, the following story adds some color: In researching some ideas that Silvio Micali and I have been kicking around, I spoke with Gerald Gunther, the constitutional law expert here at Stanford and he related the following story: When Edward Levi became Pres. Ford's attorney general (right after Watergate), he was visited by an FBI agent asking for "the wiretap authorizations." When Levy asked for the details so he could review the cases as required by law, the agent told him that his predecessors just turned over 40-50 blank, signed forms every time. Levi did not comply and changed the system, but the lesson is clear: No single person or authority should have the power to authorize wiretaps (or worse yet, divulging of personal keys). Sometimes he or she will be an Edward Levi and sometimes a John Mitchell. Martin Hellman ======== And, his permission to repost. PLEASE NOTE HIS "RESTRICTION." --jim =======

1 0

Re: Marty's 4/17 Clipper Chip post-to-many ...
by Martin Hellman 17 Dec '03

17 Dec '03

Jim, It is fine to post my previous message to cypherpunks if you also post this message with it in which: I ask recipients to be very sparse in their requesting further info from me or asking for comments on specific questions. By this posting I apologize for any messages I am unable to respond to. (I already spend too much time answering too much e-mail and am particularly overloaded this week with other responsibilities.) martin ========= Finally, there has been a significant reponse to this by a cryptoid well-known to all of us. Am seeking permission to repost it, also. --jim Incidentally, Marty sez he had no forewarning that Clipper was about to sail. The NY Times article blind-sided him about 11:30 Thursday night. Sounds like the government is really doing an outstanding job of careful, collaborative policy-making. [Danger! Novice gunslinger is shooting from the hip!] --jim

1 0

Re: Clipper Chip
by denning＠cs.cosc.georgetown.edu 17 Dec '03

17 Dec '03

I just had another conversation with NSA to clarify some of the features of Clipper. Please feel free to distribute this and my other messages on Clipper. The name of the encryption algorithm is "Skipjack." Martin Hellman had written and the serial number of the unit added to produce a three part message which will then be encrypted under the system key SK producing E{ E[M; K], E[K; UK], serial number; SK} To which I responded: My understanding is that E[M; K] is not encrypted under SK (called the "family key") and that the decrypt key corresponding to SK is held by law enforcement. Does anyone have first hand knowledge on this? I was correct in that E[M; K] is not encrypted under SK. However, Skipjack being a single-key system, there is, of course, not a separate decrypt key for the family key SK. The unit key, also called the "chip key," is generated from the serial number N as follows. Let N1, N2, and N3 be 64 bit blocks derived from N, and let S1 and S2 be two 80-bit seeds used as keys. Compute the 64-bit block R1 = E[D[E[N1; S1]; S2]; S1] (Note that this is like using the DES in triple encryption mode with two keys.) Similarly compute blocks R2 and R3 starting with N2 and N3. (I'm unlear about whether the keys S1 and S2 change. The fact that they're called seeds suggests they might.) Then R1, R2, and R3 are concatenated together giving 192 bits. The first 80 bits form K1 and the next 80 bits form K2. The remaining bits are discarded. The seeds S1 and S2 do not change. The whole process is performed on a laptop computer, and S1 and S2 are supplied by two independent people so that no one person knows both. The same S1 and S2 are used during an entire "programming session" to generate keys for a stream of serial numbers. Everything is discarded at the end (the computer could be thrown out if desired). The serial number is 30 bits and the values N1, N2, and N3 are formed by padding the serial number with fixed 34-bit blocks (separate padding for each value). The resulting keys K1 and K2 are output onto separate floppy disks, paired up with their serial number. Each pair is stored in a separate file. The floppy disks are taken away by two separate people on behalf of the two escrow agencies. Dorothy Denning denning(a)cs.georgetown.edu ====== >From eff.org!interesting-people-request(a)netcomsv.netcom.com Mon Apr 19 20:07:50 1993 Posted-Date: Mon, 19 Apr 1993 21:17:27 -0500 From: David Farber <farber(a)central.cis.upenn.edu> X-Sender: farber(a)linc.cis.upenn.edu Subject: More technical details -- Chipper To: interesting-people(a)eff.org (interesting-people mailing list) Personal note. Denning suggests such firms as " SRI, Rand, Mitre, the national labs (Sandia, LANL, Los Alamos), Treasury, GAO" as possible escrow organizations. I personally believe that firms which get their funding from the government are just too susceptible to pressure which we have seen historically. It would be best to use organizations that have a more arms length relationship with the government so everyone believes the escrows task is being performed properly. Dave From: smb(a)research.att.com (Steven Bellovin) Subject: More technical details Date: 19 Apr 93 13:43:46 GMT Here are some corrections and additions to Hellman's note, courtesy of Dorothy Denning. Again, this is reposted with permission. Two requests -- first, note the roles of S1 and S2. It appears to me and others that anyone who knows those values can construct the unit key. And the nature of the generation process for K1 and K2 is such that neither can be produced alone. Thus, the scheme cannot be implemented such that one repository generates the first half-key, and another generates the second. *That* is ominous. Second -- these postings are not revealed scripture, nor are they carefully-crafted spook postings. Don't attempt to draw out hidden meanings (as opposed to, say, the official announcements of Clipper). Leave Denning out of this; given Hellman's record of opposition to DES, which goes back before some folks on this newsgroup knew how to read, I don't think you can impugn his integrity. Oh yeah -- the folks who invented Clipper aren't stupid. If you think something doesn't make sense, it's almost certainly because you don't understand their goals. --Steve Bellovin ----- Date: Sun, 18 Apr 93 07:56:39 EDT From: denning(a)cs.georgetown.edu (Dorothy Denning) Subject: Re: Clipper Chip To: (a long list of folks) I was also briefed by the NSA and FBI, so let me add a few comments to Marty's message: The Clipper Chip will have a secret crypto algorithm embedded in The algorithm operates on 64-bit blocks (like DES) and the chip supports all 4 DES modes of operation. The algorithm uses 32 rounds of scrambling compared with 16 in DES. In addition to the system key, each user will get to choose his or her own key and change it as often as desired. Call this key plain old K. When a message is to be sent it will first be K is the session key shared by the sender and receiver. Any method (e.g., public key) can be used to establish the session key. In the AT&T telephone security devices, which will have the new chip, the key is negotiated using a public-key protocol. encrypted under K, then K will be encrypted under the unit key UK, and the serial number of the unit added to produce a three part message which will then be encrypted under the system key SK producing E{ E[M; K], E[K; UK], serial number; SK} My understanding is that E[M; K] is not encrypted under SK (called the "family key") and that the decrypt key corresponding to SK is held by law enforcement. Does anyone have first hand knowledge on this? I will also check it out, but this is 7am Sunday so I did not want to wait. The unit key will be generated as the XOR of two 80-bit random numbers K1 and K2 (UK=K1+K2) which will be kept by the two escrow The unit key, also called the "chip key," is generated from the serial number N as follows. Let N1, N2, and N3 be 64 bit blocks derived from N, and let S1 and S2 be two 80-bit seeds used as keys. Compute the 64-bit block R1 = E[D[E[N1; S1]; S2]; S1] (Note that this is like using the DES in triple encryption mode with two keys.) Similarly compute blocks R2 and R3 starting with N2 and N3. (I'm unlear about whether the keys S1 and S2 change. The fact that they're called seeds suggests they might.) Then R1, R2, and R3 are concatenated together giving 192 bits. The first 80 bits form K1 and the next 80 bits form K2. The remaining bits are discarded. authorities. Who these escrow authorities will be is still to be decided by the Attorney General, but it was stressed to me that they will NOT be NSA or law enforcement agencies, that they must be parties acceptable to the users of the system as unbiased. Marty is right on this and the FBI has asked me for suggestions. Please pass them to me along with your reasons. In addition to Marty's criteria, I would add that the agencies must have an established record of being able to safeguard highly sensitive information. Some suggestions I've received so far include SRI, Rand, Mitre, the national labs (Sandia, LANL, Los Alamos), Treasury, GAO. When a court order obtains K1 and K2, and thence K, the law enforcement agency will use SK to decrypt all information flowing on the suspected link [Aside: It is my guess that they may do this constantly on all links, with or without a court order, since it is almost impossible to tell which links over which a message will flow.] My understanding is that there will be only one decode box and that it will be operated by the FBI. The service provider will isolate the communications stream and pass it to the FBI where it will pass through the decode box, which will have been keyed with K. for "the wiretap authorizations." When Levy asked for the details so he could review the cases as required by law, the agent told him that his predecessors just turned over 40-50 blank, signed forms every time. Levi did not comply and changed the system, but the lesson is clear: No single person or authority should have the power to authorize wiretaps No single person does, at least for FBI taps. After completing a mound of paperwork, an agent must get the approval of several people on a chain that includes FBI legal counsel before the request is even taken to the Attorney General for final approval. Dorothy Denning

1 0

Re: Marty's 4/17 Clipper Chip post-to-many & Dorothy's 4/8 response
by denning＠cs.georgetown.edu 17 Dec '03

17 Dec '03

Fine with me. Post anywhere. Dorothy =====

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Based on previous experience, a couple more will appear overnight. Hal Finney hfinney(a)shell.portal.com

1 0

on line books (not just in risk mgmt)
by Tapen Sinha 17 Dec '03

17 Dec '03

If you are looking for information on new books, how to buy them (on line!) and review of these books, there is a neat way to do it on internet: telnet books.com if the above does not work on your machine, try telnet 192.148.240.9 It will ask you a bunch of questions (like your name and address) and then you can look at info on books by author, subject... You can look at reviews of those books too. You can order books by email even (have your credit card handy)! It can be quite useful. A word of caution: there are some unhappy users out there who claim that they got billed for books they did not order. tapen_sinha(a)macmail.bond.edu.au

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Yes, I remember that now. My interpretation, though, was that with the bank's help you could tell when a coin had been re-used. This could impair the anonymity of the cash. Generally in the analysis of these proto- cols one wants anonymity even if the bank and the other participants collude. That is the whole point of cryptographic (non-transferable) cash, after all; otherwise the bank could just use the "Poor Man's Cash" idea which Tim May suggested here last year and just issue cash in the form of magic numbers with no blinding or digital sigs. Hal

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

I read this paper some time ago. Couldn't the cash still be detected as having belonged to the original owner even after you have transferred it? If so, then the other requirement is that you must transfer it anonymously, otherwise they can still get back to you. An example would be if you are doing something which the government doesn't like, such as shipping tracts advocating egalitarianism to a country with explicitly racist policies. The government might be able to put pressure on some members of the organization and use this (in effect) "marked money" to find the others. If you pass the money on to someone else, but they know it came from you, and then the government comes to them, determines that this is "dirty money" (which was given to the threatening egalitarians) they can say "who did you get this from" and your jig is up. Hal

1 0

No Subject
by mkj＠world.std.com 17 Dec '03

17 Dec '03

Has anyone here seen the so-called Lehman Panel report? It is available by ftp from ftp.uspto.gov, in the directory /pub/nii-ip. It is offered there in several formats. The deadline for comments is September 7th. (Sorry about the short notice, but I've only just recently discovered the report myself.) The Lehman Panel is more officially known as the "Working Group on Intellectual Property Rights", a subcommittee of President Clinton's "Information Infrastructure Task Force". The Lehman Panel report makes a number of recommendations concerning changes to current intellectual property law, in light of challenges presented by the National Information Infrastructure (NII) project. This appears to me to be quite an important report, which could play a major role in shaping vital aspects of our near-future society. I find the whole approach taken by the panel disturbing, though perhaps not surprising. Very briefly, my general concerns are these: There appears to be a natural tension between current intellectual property law and the widespread deployment of computer networking. (John Barlow has put it more simply: "Copyright is dead".) The Lehman panel's report, rather than trying to accomodate and adapt to the inevitable effects of the NII, instead recommends tightening up existing laws, and expanding their scope, in an attempt to preserve the status quo and protect established interests. It seems to me that this approach would dramatically undercut the potential of the NII, making many of its most natural uses and benefits illegal. Worse, I believe this approach would create a body of law which will make speed limits look well-respected by comparison, and any attempt to enforce these laws is likely to be destructive and unpleasant for all of us. There are numerous other, more specific things in this report which make me unhappy, too -- such as the presumption that the NII should be little more than a new marketplace for old businesses; the creation of gratuitous new rights for major record labels which would hurt artists, and would enable the record companies to control the digital audio server industry; and most frightening of all, the shameless suggestion that the public schools should be used to pound these new rules into the heads of children as early as Kindergarten. I've obviously considered firing off a letter of comment myself, but after I calmed down I realized how little impact that would be likely to have. So I decided the most constructive thing I could do would be to post this "alert" here, in the hope that someone with better qualifications and resources than myself might pick up the ball. Thanks for your attention. --- mkj

1 0

Re: Why Doesn't Wired.....
by jimp＠wired.com 17 Dec '03

17 Dec '03

In article <v4cAlOwscUg6077yn(a)io.org>, werewolf(a)io.org (Mark Terka) wrote: > .....if it is sooooooo hooked in the online culture have a PGP public key > that 'net users could use to send in their credit card numbers for > subscriptions? Here it is. We're just implementing it. Send us a message (send to talk2subs(a)wired.com) -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7 mQCOAy8EM1EAAAEEANqhOZTAwWI/99ZZ7t77VHH02n+xM4CQEk2DJe2zZhpjKP8v EHndzBPr3dIsHOZUJABi7ztk5NiQhNVR5EBE7Tqz/7HhGFUE2ErVjAS3OQckcmvW BrCgNXfe0G4tlX1paXFGHsoVT3UgE2IKjttwmZA1WtOH1lbgLCGi/5f257vHAA9A AbQnV2lyZWQgQ2lyY3VsYXRpb24gPHRhbGsyc3Vic0B3aXJlZC5jb20+ =xdqc -----END PGP PUBLIC KEY BLOCK----- -- Jim Petersen Argue for your limitations.... jimp(a)wired.com And they are yours.

1 0