- cypherpunks-legacy - lists.cpunks.org

Clipper Key generation
by L. Detweiler 04 Aug '93

04 Aug '93

The Clipper key generation is almost too bizarre to contemplate. In the recent Denning article we still have the fantastically implausible (or at least unimaginable) indication that it is all done on a `laptop computer'. She left out the indication that it is destroyed. Only one implausibility at a time. Anyway, there are various aspects that don't entirely make sense, or seem to indicate some kind of ulterior design constraints. I would like to hear speculation on what the design constraints were. In particular, they could just let the key generator site create random keys. But then there would be accusations that they are encoding secret information or something, and the appearance is too much like `we will know all the keys' irrespective of key escrow agencies. So we have this picture of the two escrow agencies entering in information into the initial system that determines the final unit key, two 80 bit values. This means the escrow agencies could theoretically combine keys and reproduce the entire process to recompute the unit key and prove that the key generation as described is actually taking place. It also makes it look like the key originates completely from outside sources. But wait! The generation site (read: NSA in capital letters) supplies the `starting serial number'. That is, it is completely at the discretion of the NSA to determine the serial number. Now, given that this should be random and contain no extra information, wouldn't we all feel a bit more comfortable if the key escrow agencies also supplied it, or that it was based on their input? What could be put in the serial number that is useful? There are 64 bits to play with here and the two keys are 160. Denning says that it is `padded' -- almost a Freudian slip. The key generation process is rather interesting. It clearly is not `cryptographically secure' in the sense that it relies on the security of an algorithm for protection against abuse. This makes me think of the following problem, which I wonder how has been explored in the literature: consider it the Clean Key Generation problem. How can a chip be programmed such that no one ever has the complete key all at once? I would like to see the chip go through two stages: in the first stage the first agency plugs in their half of the secret key, in the second stage the second key agency does so, and the ability for either to read the other is impossible. This would guarantee there is no illicit archival. In fact, the centralized key generation in the scheme seems so absolutely preposterous, because it is not `cryptographically secure', it is only `NSA-assured-secure' (hey, a new category of communications security!) What is the assurance that the facility is `safe'? Alternatively, it would be very useful to devise some cryptographic or technological scheme whereby a chip could be programmed at a centralized location based on the input from multiple escrow agencies, but the complete key is never available to the programmers. Seems like a real catch-22, but then again so is public key cryptography (need to ruminate on this one some more). of course, these are all just theoretical ramblings and not to be taken in any way of endorsement of key escrow...

1 0

comments on Denning's American Scientist article on Clipper
by L. Detweiler 04 Aug '93

04 Aug '93

Some notes on the D. Denning article on Clipper in Sigma Xi American Scientist, July-August, vol 81 p. 319-323. Essentially almost nothing new for people who have tracked the debate on the Internet. Some tiny scraps at the end. This is a sort of `Scientific American' article on the Clipper chip. Apparently it was written before the switch to the Skipjack moniker, although under the photo caption of the chip it states `The name `Clipper Chip' should not be confused with Integraph Corperation's microprocessor.' The article begins by noting that cryptography is as ancient as Julius Caesar and the Gallic Wars. Clinton's Clipper and Capstone as a `new government standard for encryption.' Short blurb on public key cryptosystems a la Diffie & Hellman and RSA in mid 1970s, `a turning point in the development of modern cryptosystem.' (Madam, it is a revolution.) DES in 1977 by IBM `with advice from the National Security Agency.' Mentions PEM as example of `growing interest in strong cryptosystems that protect unclassified, private-sector telecommunications and computer data.' Next, the AT&T Model 3600 Telephone Security Device, which used the DES chip that `illustrates the basic issues--some technical and some societal--involved in securing voice communcations.' Denning says the key exchange algorithm in the phone is `proprietary' but gives the Diffie Hellman math as example. Then we hear of Omnibus Crime Control and Safe Streets Act of 1968 that limits electronic surveillance, including wiretapping, to be `conducted lawfully only by law-enforcement agencies that are authorized with a court warrant, and then only for serious criminal activities in which other means of gathering evidence have failed, are likely to fail or are too dangerous.' `This act prohibits surveillance in other cases such as political discourse. The law provides a practical basis for safeguarding privacy rights while allowing legitimate criminal investigations. In applies only to federal investigations; two-thirds of the states have their own laws that govern local surveillance activities.' `Officials in the Dept. of Justice have become concerned that the increasing use of digital encoding and the success of public cryptography may make it impossible to intercept or understand criminal communications. The AT&T telephone device added urgency to that concern.' Hm, even the Clipper announcement didn't note any `concern'... Then, Clipper was `proposed' by Clinton administration to (1) secure telephone conversations, (2) preserve law-enforcement capability to `legally intercept the telephone conversations of suspected criminals' (wow, finally a word like `suspected' or `reputed' or `alleged' in conjunction with Clipper, a real milestone), and (3) split key escrow system that `balances' privacy. `The president declared that it is essential to establish these principles now, while the `national information infrastructure' is still young, so that privacy and effective law enforcement can guaranteed for everyone in years ahead.' I don't recall that proclamation. What were his exact words again? Next, description of Clipper and Capstone and the first user-friendly diagrams suitable for public consumption showing the key generation, communication session, and interception. Fairly detailed esp. with the key generation. Does not indicate at all how the key escrow agencies are assured that the chip IDs presented to them are actually of the people named in a warrant. `The details of the law-enforcement field are classified so that no one will be able to construct compatible chips that bypass this feature. Consequently, the structure of the law enforcement decoder is classified.' Then, Capstone as Clipper successor `will be relased this summer' with all the same elements plus DSA, key negotiation, exponentiation, and random number generator. `If the Capstone Chip become available on workstations and personal computers, it could also be used for Privacy Enhanced Mail.' (Boy, clearly someone at NSA is really concerned about this PEM thing.) Yeeks, here's the news: `The Clinton administration intends to [promote Clipper and] by developing and promulgating a standard for all sensitive, unclassified federal communications by the end of 1993.'' The ominous statement is that this seems to suggest something more than Clipper. `The Clinton administration believes that industry will follow the government's lead as it did in the 1970s with the DES system.' (we'll see.) `The administration does not propose to enforce the use of the Clipper Chip because it believes the technology will become widespread without coercion'. This is the tantalizingly familar NSAspeak into which people can read whatever they want, the same sounds-OK-except-to-here and what-are-they-really-saying sentence structure that permeated the Clipper announcment. Taken in the first half, it seems to be the most bold and unequivocal indication so far in the popular press that Clipper nor any other system will be `enforced'. On the other hand, it also has the ulterior suggestion that if the technology does *not* become widespread without coercion, some other attack will be formulated, and the `administration' cannot be considered liable for any seeming promises for unrestriction. Now, for the kicker: the National Security Council will finish their `comprehensive policy review' hinted in the Clipper announcement on `privacy, secure business communications, ... electronic surveillance, ... manufacture and export of advanced [cryptographic] products, use of advanced [cryptographic] technologies in digital networks and telecommunications, ... expected to be completed in September'. Can't wait for that one. `issues such as software encryption and private-sector standards are likely to be raised by industry during the process'. Don't you love that ubiquitous evasive passive voice? As the Clipper announcement stated `public debate is expected to intensify'...yelled at and echoing off the brick wall of the castle, soon to disgorge the concealed schemers with their Royal Proclamation for the Citizenry... At the end: `Note: the author obtained some of the information in this article during private briefings with the National Security Agency and the Federal Bureau of Investigation.' No kidding.

1 0

Re: Sterilized Medflies of Crypto
by greg＠ideath.goldenbear.com 04 Aug '93

04 Aug '93

uunet!PROCASE.COM!peb (Paul Baclace) writes: > The CIA has been accused of stealing a company's source code and > reselling said software modified with a trojan horse to specific targets > outside the U.S. I don't remember the name of the company, but read about > the lawsuit pending against the government. Anyone have more details? > This is nice evidence for people who think the spooks are fully accountable. This sounds like the Inslaw thing - a company called Inslaw sold some software for case management and person-tracking (intended for use by prosecuting attorneys for maintaining dossiers, etc.) to the Justice department. Then (the story goes) the Justice department deliberately failed to make agreed-upon payments and screwed around with Inslaw's cash flow to the point that they were forced into choosing between bankruptcy and selling out to another software company owned by cronies of Ed Meese. They chose bankruptcy and subsequently sued the Justice Department. The first judge who heard the case ruled in Inslaw's favor was not reappointed to his seat. I'm unable to remember the specifics of the following events - and the above summary probably leaves out important stuff. I've got a few text files on this - if folks are interested I can upload them to the soda archives. This is also related to the "suicide" of writer Danny Casolaro about 2 years ago in Washington, D.C. - he was working on a book on this mess, supposedly discovered something pretty important, then allegedly killed himself. Conspiracy stuff abounds with this. Supposedly the PROMIS software has also been given to Canadian intelligence/police forces, as well as the Israelis. It's a pretty sordid story and frankly I dunno how much of it to believe. I don't know if this is exactly relevant to Cypherpunk stuff (and it's long) so I'm not posting it to the list, but I can mail or ftp the stuff to interested folks. -- Greg Broiles greg(a)goldenbear.com Golden Bear Computer Consulting +1 503 465 0325 Box 12005 Eugene OR 97440 BBS: +1 503 687 7764

1 0

Re: Sterilized Medflies of Crypto
by peb＠PROCASE.COM 04 Aug '93

04 Aug '93

>hardware backdoor The NSA does mask inspection for it's own purposes. They require source code for products they buy under certain conditions too. The CIA has been accused of stealing a company's source code and reselling said software modified with a trojan horse to specific targets outside the U.S. I don't remember the name of the company, but read about the lawsuit pending against the government. Anyone have more details? This is nice evidence for people who think the spooks are fully accountable. Paul E. Baclace peb(a)procase.com

2 1

crypto in HK
by Brad Huntting 04 Aug '93

04 Aug '93

Greetings from Hong Kong. I've spent the last couple weeks helping setup Hong Kong SuperNet, the first dialup Internet provider in China. Sudenly last week, it dawned on me! I'm not in Kansas anymore! I dont have to worry about ludicrous RSA patents, or antiquated export laws! In fact there's not much respect for any intelectual property laws here, but that's another matter.... So, I have two question's: First, where (outside of the US) can I ftp (or mirror) the latest version of PGP? Second, does anyone know where I can find the RSA extensions for ISODE (often called the osisec package). There's an ftp site in the UK, but the files are all des'ed, and the person with the key is ignoring my e-mail messages. brad

3 2

ADMIN: misconfigured host north.net has been removed from the list
by Eric Hughes 04 Aug '93

04 Aug '93

The host north.net is misconfigured to send mail to itself forever, that is, until it bounces. I've removed it from the list, so any further problems with this host may be ignored. Eric

1 0

Cypherpunk Mailing List
by Jon_Axelrad＠third.wsgr.com 03 Aug '93

03 Aug '93

I've read about the cypherpunks and your mailing list in recent issues of _Wired_ and the _Whole Earth Review_. I support your goals and would appreciate being added to the mailing list. While I probably couldn't contribute to discussions from a technical standpoint, I am a lawyer and may have an occasional useful comment on policy/legal matters.

1 0

mail failed, returning to sender (fwd)
by bart＠netcom.com 03 Aug '93

03 Aug '93

Forwarded message:

1 0

PKZIP Encryption is worthless
by nobody＠pmantis.berkeley.edu 03 Aug '93

03 Aug '93

To the best of my knowledge, PKZip uses a simple Vigenere algorithm for its encryption. There is a program called "zipcrack", widely available on BBSes, that does cryptanalysis of encrypted PKZip files. The rumor is that the "zipcrack" program originated in Russia, but really, cryptanalysis of the stuff that PK is using is relatively trivial. There are many good implementations of DES, including Symantec's in the Norton Utilities. You could also use PGP. But don't rely on PKZip to protect your privacy. That's not what it's designed for. Note the reply-to address above if you wish to reply.

1 0

mail failed, returning to sender
by MAILER-DAEMON＠uunorth.north.net 03 Aug '93

03 Aug '93

|------------------------- Failed addresses follow: ---------------------| accesspt.north.net!brettm ... loop detection: maximum hop count exceeded |------------------------- Message text follows: ------------------------| Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNUVi-0001dLC; Tue, 3 Aug 93 18:07 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNUTS-0001b8C; Tue, 3 Aug 93 18:04 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNURC-0001dKC; Tue, 3 Aug 93 18:02 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNUOM-0001b8C; Tue, 3 Aug 93 17:59 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNULt-0001c8C; Tue, 3 Aug 93 17:57 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNUJT-0001c8C; Tue, 3 Aug 93 17:54 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNUH5-0001c7C; Tue, 3 Aug 93 17:52 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNUEY-0001c7C; Tue, 3 Aug 93 17:49 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNUBz-0001b8C; Tue, 3 Aug 93 17:46 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNU9a-0001b8C; Tue, 3 Aug 93 17:44 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNU79-0001c7C; Tue, 3 Aug 93 17:41 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNTpc-0001c7C; Tue, 3 Aug 93 17:23 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNTnB-0001c8C; Tue, 3 Aug 93 17:21 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNTka-0001c8C; Tue, 3 Aug 93 17:18 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNTiB-0001c8C; Tue, 3 Aug 93 17:15 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNTfX-0001c8C; Tue, 3 Aug 93 17:13 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNTcu-0001c8C; Tue, 3 Aug 93 17:10 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNTaB-0001c7C; Tue, 3 Aug 93 17:07 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNTXp-0001c7C; Tue, 3 Aug 93 17:05 EDT Received: from uunorth.uucp by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNTVY-0001c8C; Tue, 3 Aug 93 17:02 EDT Received: from netcom.com by uunorth.north.net with uucp (Smail3.1.28.1) id m0oNJFk-0001eWC; Tue, 3 Aug 93 06:05 EDT Received: from toad.com by relay2.UU.NET with SMTP (5.61/UUNET-internet-primary) id AA26190; Tue, 3 Aug 93 06:06:28 -0400 Received: by toad.com id AA20888; Tue, 3 Aug 93 02:57:42 PDT Received: by toad.com id AA20824; Tue, 3 Aug 93 02:55:25 PDT Return-Path: <bart(a)netcom.com> Received: from netcom5.netcom.com ([192.100.81.113]) by toad.com id AA20820; Tue, 3 Aug 93 02:55:23 PDT Received: by netcom5.netcom.com (5.65/SMI-4.1/Netcom) id AA27451; Tue, 3 Aug 93 02:56:11 -0700 From: bart(a)netcom.com (Harry Bartholomew) Message-Id: <9308030956.AA27451(a)netcom5.netcom.com> Subject: Other shoe drop confirmation To: cypherpunks(a)toad.com Date: Tue, 3 Aug 93 2:56:10 PDT X-Mailer: ELM [version 2.3 PL11] Well, somebody else heard the story as I did. Bart >From netcom.com!csus.edu!decwrl!decwrl!spool.mu.edu!agate!library.ucla.edu!ddsw1!uunet!news.claremont.edu!ucivax!ucla-cs!gast Tue Aug 3 02:52:20 1993 Newsgroups: alt.privacy.clipper Path: netcom.com!csus.edu!decwrl!decwrl!spool.mu.edu!agate!library.ucla.edu!ddsw1!uunet!news.claremont.edu!ucivax!ucla-cs!gast From: gast(a)cs.ucla.edu Subject: FBI wants to ban Crypto Message-ID: <1993Aug3.012316.9036(a)cs.ucla.edu> Originator: gast(a)oahu.cs.ucla.edu Sender: usenet(a)cs.ucla.edu (Mr Usenet) Nntp-Posting-Host: oahu.cs.ucla.edu Reply-To: gast(a)CS.UCLA.EDU (David Gast) Organization: UCLA Computer Science Department Distribution: alt Date: Tue, 3 Aug 93 01:23:16 GMT Lines: 10 I just heard a little of the report on NPR on Saturday, but it seems that the FBI went public last week at a security conference with its desires to ban cryptography, at least crypto that it cannot break. The FBI said that in four different wiretap cases, it got encrypted messages instead of talk. I know that the FBI has previously announced similar plans including at CFP-2, but this seems to be a new salvo. David --

1 0