- cypherpunks-legacy - lists.cpunks.org

Government fear of strong crypto [was Re: Digital Cash$$$$
by Pat Farrell 25 Jun '93

25 Jun '93

Jim McCoy <mccoy(a)ccwf.cc.utexas.edu> writes: > IMHO, the real >reason governments are opposed to strong cryptography is that in an >information society it effectively places the population outside the >control of the government, the central government becomes superfluous. I'm not going to disagree that long term, the net makes governments obsolete, but I think that far fewer folks in the US government have _any_ understanding of the issues arround strong crypto. I spent yesterday at the "Computer Security Institute" conference in Washington (it is a commercial educational conference on computer security). Lots of government employees were there learning about security, products, etc. Most of the products were virus scanners, sigh. The "government" as a whole is not against crypto. The NSA is _very strongly_ against it. There are 60,000 or more bureaucrats in NSA that would be effectively put out of work by widespread strong crypto. All the $17 Billion that they use on signal intercepts would go to competing approachs (satelite recon, spys in the field, etc.) that are controlled by other agencies. Why? because signal intellegence is so easy now that it is extremely cheap and cost effective. Widespread strong crypto will not make evesdropping impossible, but it will make it _very_ expensive in time and money, and thus make it much less attractive. Rather than simply ranting about the evils of bureaucrats, think for a second about their motivation. There is no profit metric for bureaucrats to rely upon - they have to do their job as well as expected for the least amount of money. If they fail to deliver, they lose their jobs. (yes, they can be fired or reassigned to siberia...) So they spend all their life making sure that they do a "good enuff" job and follow all the approved actions. Having Signal intercepts work cheaply and well makes it easy to keep their jobs. I believe that the FBI and other more public agencies are simply shills for NSA. The many posting about real wiretap usage and costs simply can't support taking all the heat last year of Digital Telophony and this year over Clipper, esp. when they admit that smart crooks wouldn't bother to use Clipper. BTW, I talked to Dorothy Denning at the conference. She says that it is now called the "Key escrow chip" because of Intergraph's trademark on Clipper. I'll post more on my conversations with DE Denning later. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

3 3

Re: Karn's note...
by peb＠PROCASE.COM 24 Jun '93

24 Jun '93

>sounds like Bob Smith on line 42 This is speaker recognition, not voice recognition. It turns out that the problem is solved in a very different way for each; voice recognition, in order to be speaker independent, must throw out the information that makes it possible to do speaker recognition (and vice versa: the latter does not need some of the information that the former needs). This is used in "roving wiretaps" that apparently are used infrequently as they scan whole exchanges or number sets (e.g., all payphones in some city). The idea is to capture phone calls from the suspects that are savvy enough to know that they are being tapped. At least one Mob boss was caught this way (in Los Angeles, I think, about 4-5 years ago). Paul E. Baclace peb(a)procase.com

1 0

Re: Karn's note...
by Kelly Goen 24 Jun '93

24 Jun '93

From toad.com!cypherpunks-request Thu Jun 24 15:34:07 1993 Return-Path: <karn(a)qualcomm.com> Date: Thu, 24 Jun 93 15:32:54 -0700 From: karn(a)qualcomm.com (Phil Karn) Message-Id: <9306242232.AA08245@servo> To: cypherpunks(a)toad.com, pcw(a)access.digex.net Subject: Re: Karn's note... I tend to doubt that the spooks have voice recognition technology in regular widespread use, at least not the kind of ultra sophisticated stuff that AI types seem to dream about. It's possible that they use ln. Much Deleted... \ Hi Phil... All the reports I have seen on the widespread phone tapping and voice recognition by the NSA allegedly was in reference to Operation HARVEST According to private estimates immense intel value results even if the recog phase gets 15-20% accuracy on most? speakers... for phrases such as Spook, espionage,drugs etc... Most of the references I saw to HARVEST were published by the Bill of Rights foundation in various of their books and phamplets and reports from the Church Subcommittee hearings on intelligence activities during the earlier abuses of COINTELPRO, with a few references in "The Puzzle Palace" by Cliff Bamford. I also saw some refeneces about 5 years ago in comp.dcom.telecom... as to these kind of operations. Do they really do it??? hmm dont know but I am not taking any chances!! :) Phil

1 0

Re: Karn's note...
by Peter Wayner 24 Jun '93

24 Jun '93

I believe the novel implied that the magic box didn't do voice recognition in the sense of identifying the words being spoken. It just said, "Hey, that sounds like Bob Smith on line 42." The point was that these guys were jumping around from phone to phone. But, I agree with you that traffic analysis should be much easier now with all of the ID tags. I think the Clancy box would be too much overkill because people really don't use that many telephones during the day. Especially now that they call carry pocket cellular phones. -Peter

1 0

Re: Karn's note...
by karn＠qualcomm.com 24 Jun '93

24 Jun '93

I tend to doubt that the spooks have voice recognition technology in regular widespread use, at least not the kind of ultra sophisticated stuff that AI types seem to dream about. It's possible that they use less sophisticated stuff as a "pre filter" (compress out silence, perhaps distinguish male from female voices, etc), but I'm sure that the bulk of the work is still very labor intensive. Tens of thousands of clerks, intercept operators and natural language translators have long been employed by the NSA and there don't seem to be mass layoffs of these sorts of people around Fort Meade. And sophisticated voice recognition really isn't necessary when you consider all of the information that cell phones and base stations emit that is almost trivially processed automatically by an intercept device: electronic serial numbers, Mobile Identification Numbers (telephone numbers), handoff messages, channel assignment messages, etc. It's no big deal at all to build boxes that automatically intercept all calls made to or from a specific phone, assuming you have an RF path to the target (e.g., from a car tailing a suspect). As a manufacturer of cellular telephones, we have such a box (commercially made by IFR) in our lab. We use it to test our phones in their FM/analog mode. The spooks (NSA and otherwise) simply cannot be uninterested in boxes like these -- and in preserving their capabilities. One point I keep making about Clipper: it makes this sort of automated identity tracking as easy on regular telephone lines as it already is on cellular, because the chip serial number in the Law Enforcement Block can be decrypted with just the (common) Family Key - you don't need the escrowed keys. And sometimes simple traffic analysis can be almost as deadly as getting the actual contents of a conversation. Phil

1 0

Karn's note...
by Peter Wayner 24 Jun '93

24 Jun '93

On Over-the-air encryption... If anyone wants to read Tom Clancy's latest book, _Clear and Present Danger_ about a set of covert operations against drug kingpins in South America, they will note that he mentions a magic box that will scan the airwaves for voices on the cellular channels. This allows the protagonists to follow the conversations of the kingpins as they hop from limo to limo using a different phone with each conversation. Does TriggerFish do this? My theory is that the 260-bit repeated XOR code was proffered because it wouldn't interfere with algorithms that were doing simultaneous voice recoginition. It is, after all, just the equivalence of doing a discrete convolution across the signal. I believe that this should be easy to handle with a few clever signal processing algorithms designed for noise reduction. I don't know this with any stretch of confidence so I would like to be disabused of this idea if it's harder than all of that. --Peter

1 0

Triggerfish
by Phil Karn 24 Jun '93

24 Jun '93

I just posted this to the CU (Computer Underground) digest in response to a most interesting series of items about the newsletter Full Disclosure's public mention of a Harris Corporation device marketed to law enforcement agencies for intercepting cellular telephone conversations named "Triggerfish". Harris responded with an amazing threat to sue the newsletter for a variety of offenses, including trademark infringement (for merely mentioning the product in a brief "new products" editorial). The CU digest can be read on the usenet newsgroup comp.society.cu-digest; the issue in question is Volume 5, Issue 46. Phil To: tk0jut2(a)mvs.cso.niu.edu Reply-To: karn(a)servo.qualcomm.com Subject: Re: Cu Digest, #5.46 In CU Digest 5.46: |> Harris Law Enforcement Products |> |> TRIGGERFISH has a number of cellular phone based applications: |> determining a suspects phone number, dialed number recorder, and |> wiretapping. According to Harris, ``for the first time, law |> enforcement is not at a disadvantage in tracking the high-tech |> criminal.'' Additionally, the unit ``collects and integrates all |> relevant data, including voice, directly from the ether.'' |> Reprinted from Full Disclosure, Box 903, Libertyville, Illinois 60048 I find the phrase "directly from the ether" *most* illuminating given a rather heated exchange I had with Mr. Jim Kallstrom of the FBI at the recent CPSR Cryptography Conference in Washington DC earlier this month. Kallstrom is the FBI's chief public advocate for their "Digital Telephony Initiative". Among other things, they want the ability to intercept suspects' cellular telephone calls at the MTSO (switch). Only with a valid warrant, naturally. At the meeting, I made the following comments. I had seen the standards-setting process for the new digital cellular telephone systems from the inside as they related to security and privacy. And I was wondering why the government (specifically NSA, through its export control reviews) was so strongly opposed to meaningful air link encryption, even if the encryption were to stop at the switch as it would have to in order to be compatible with existing telephones on the land side of a cellular call. Such encryption would secure the air link, the most easily intercepted portion of a cellular telephone call, while leaving the conversation in the clear at the MTSO where it could be tapped, if necessary. In a private conversation, one of the senior members of the committee who didn't want his name mentioned told me why. "It's very simple", he said. "Anybody can intercept the radio link. It's easy. But tapping a call at the switch requires the cooperation of the telephone company, and they generally require warrants. And law enforcement says that sometimes, warrants are, well, just too damn inconvenient." This really set Kallstrom off. He shouted me down, attacking my unwillingness to name my source. I challenged him, unsuccessfully, to back up *his* shrill claims for the absolute necessity of Digital Telephony with anything more than handwaving. After tempers cooled a bit, in a one-on-one conversation during a break, he insisted to me that the FBI was never interested in intercepting the air link portion of cellular calls - "too difficult, too labor-intensive", he said. He agreed that he'd like to see cellular air links encrypted. They only wanted the capability to tap in at the switch, and he couldn't care less if the air link were securely encrypted (though he still wanted the keys to be escrowed for some reason...hmmm...) Perhaps it was a desperate attempt to maintain this "we're not interested in the air link" fiction that triggered Harris's silly overreaction to the public mention of TRIGGERFISH. Phil

1 0

Re: Weak steganography
by nobody＠rosebud.ee.uh.edu 24 Jun '93

24 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- Several people have suggested that PGP or some similar public-key program could be used to exchange encrypted email, then a "fake" one-time pad file could be created to transform the PGP file into a safe plaintext. If your files were seized and the keys demanded, you could supply the fake OTP file as the key which would "decrypt" the PGP file to the safe text. Unfortunately, this doesn't presently work with PGP. PGP puts a header at the front of encrypted file which identifies it as a PGP file. This includes information about whether the file is RSA or IDEA encrypted, and if it is RSA encrypted it includes information about which key(s) it is encrypted with. If files are saved like this, there will be no question that they are actually PGP files, and not the output of a one-time pad. Any attempt to produce a OTP key file which leads to a safe plaintext will be a transparent fabrication. And, of course, PGP's ASCII encoding, which would usually be used for email, boldly displays the "-----BEGIN PGP MESSAGE-----" at the top. If the files were saved in this format it would be a further giveaway. People have called for PGP to have a "stealth" mode in which it would save files without these headers. This would require the user to know which files were truly PGP encrypted, what the encryption algorithm was, and of course the key. If this were implemented it would make PGP files much less recognizable and the "fake OTP key" approach would be workable. Another approach for now would be to super-encrypt the PGP file with some other system. A simple XOR with a repeated random bit pattern (produced by hashing a user pass phrase) which is longer than the PGP header would be adequate, since the non-header portion of a PGP file should be random. Or you could use one of the widely-available DES encryption utilities, since these don't produce any headers, as far as I know. But this would complicate the process of decrypting the file. PGP's IDEA-encrypted files, which you create with the "-c" switch to PGP, put only a five-byte header on: a type byte, and a four-byte file length. This information is redundant and it should be very easy for PGP to recon- struct it if it were removed. RSA encryption headers will be harder to remove, particularly because of the lack of a key ID to tell which secret key to decrypt with. We would just try the default key, I guess. But this would require a more extensive set of changes to PGP. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- iQCVAgUBLCmngKgTA69YIUw3AQGDWgP/U/HwP5gwPXn3GZgH3SH3zjnrKd8dHPqn y2OVF7xqiaVPuV5VF/UBGzFcPgfb/DuamIEr/aQmAMX2BlVktQ/fGaluZ8wvIbs/ QlQcsp+BH9AAb0BcojQ6rmwtf8A5c/3VkuGUSvyRGEX1PecdwoW8Eh/FEIfeU/WE njvIwmn92aY= -----END PGP SIGNATURE-----

2 1

Re: Government fear of strong crypto
by Peter Wayner 24 Jun '93

24 Jun '93

I seem to remember that Pres. Reagan authorized the NSA to help domestic law enforcement officials when "lives were at stake." But I don't have a citation. -Peter Wayner

1 0

Re: Government fear of strong crypto
by Doug Porter 24 Jun '93

24 Jun '93

Jim McCoy says: > The NSA is not chartered for domestic surveillance work. This statement keeps showing up. If there is any support for it I'd like to hear it. We know it was not true as far back as twenty years ago, from July 1, 1969 to October 1973. For details on the MINARET Charter see page 150 of "The National Security Agency and Fourth Amendment Rights", and pages 323 and 324 of "The Puzzle Palace". NSA has a long history of ignoring whether they are chartered for an activity, of course. Doug

1 0