- cypherpunks-legacy - lists.cpunks.org

TEMPEST and other "neat stuff"
by fergp＠sytex.com 20 May '93

20 May '93

This is an interesting extract that I came across this morning. I thought that I'd post a portion of it (the entire paper is almost 900 lines) to the group since the topic of TEMPEST had surfaced - 8<------ Snip, Snip ------[ edited ]------ (c) 1990 Christopher J. Seline cjs(a)cwru.cwru.edu cjs(a)cwru.bitnet Eavesdropping On the Electromagnetic Emanations of Digital Equipment: The Laws of Canada, England and the United States This document is a rough draft. The Legal Sections are overviews. T h e y w i l l b e significantly expanded in the next version. We in this country, in this generation, are -- by destiny rather than choice -- the watchmen on the walls of world freedom.[1] -President John F. Kennedy _____________________ 1. Undelivered speech of President John F. Kennedy, Dallas Citizens Council (Nov. 22, 1963) 35-36. In the novel 1984, George Orwell foretold a future where individuals had no expectation of privacy because the state monopolized the technology of spying. The government watched the actions of its subjects from birth to death. No one could protect himself because surveillance and counter- surveillance technology was controlled by the government. This note explores the legal status of a surveillance technology ruefully known as TEMPEST[2]. Using TEMPEST technology the information in any digital device may be intercepted and reconstructed into useful intelligence without the operative ever having to come near his target. The technology is especially useful in the interception of information stored in digital computers or displayed on computer terminals. The use of TEMPEST is not illegal under the laws of the United States[3], or England. Canada has specific laws criminalizing TEMPEST eavesdropping but the laws do more to hinder surveillance countermeasures than to prevent TEMPEST surveillance. In the United States it is illegal for an individual to take effective counter-measures against TEMPEST surveillance. This leads to the conundrum that it is legal for individuals and the government to invade the privacy of others but illegal for individuals to take steps to protect their privacy. The author would like to suggest that the solution to this conundrum is straightforward. Information on _____________________ 2. TEMPEST is an acronym for Transient Electromagnetic Pulse Emanation Standard. This standard sets forth the official views of the United States on the amount of electromagnetic radiation that a device may emit without compromising the information it is processing. TEMPEST is a defensive standard; a device which conforms to this standard is referred to as TEMPEST Certified. The United States government has refused to declassify the acronym for devices used to intercept the electromagnetic information of non-TEMPEST Certified devices. For this note, these devices and the technology behind them will also be referred to as TEMPEST; in which case, TEMPEST stands for Transient Electromagnetic Pulse Surveillance Technology. The United States government refuses to release details regarding TEMPEST and continues an organized effort to censor the dissemination of information about it. For example the NSA succeeded in shutting down a Wang Laboratories presentation on TEMPEST Certified equipment by classifying the contents of the speech and threatening to prosecute the speaker with revealing classified information. [cite coming]. 3. This Note will not discuses how TEMPEST relates to the Warrant Requirement under the United States Constitution. Nor will it discuss the Constitutional exclusion of foreign nationals from the Warrant Requirement. <New page> protecting privacy under TEMPEST should be made freely available; TEMPEST Certified equipment should be legally available; and organizations possessing private information should be required by law to protect that information through good computer security practices and the use of TEMPEST Certified equipment. Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0

Hargis T-raid
by Kent Hastings 20 May '93

20 May '93

Hargis T-raid#000# The offices of Anthony L. Hargis were visited 5-18-93 by Treasury agents. Since 1976, Hargis operated a "bank that isn't a bank," using a Massachusetts Business Trust structure. The theory of operation was that a Trust recording gold Deposits and Transfer Orders was legally different than a Bank with Accounts and Checks. This bluff worked well for 15 years. Anthony's recent involvement with the State Citizens (a new tax protestor approach) may have triggered the raid. Or perhaps ALH was allowed to exist all these years to suck in more IRS victims. Account holders can assume the worst. Customers were not allowed in the door, and the computer records were not encrypted, despite my, and others, frequent suggestions. "Citizens don't need encryption" was the response in a nutshell. Citizens Do. Now, secure physical data links (perhaps using spread-spectrum modulation of radio and microwave) appear necessary for financial privacy. All the nice little tricks with mail drops and trusts may work in the short term, but only strong encryption and signal hiding will insure long term survival. Kent - kent_hastings(a)qmail2.aero.org. and

1 0

Forwarded messages from RISKS
by fergp＠sytex.com 20 May '93

20 May '93

These messages were extracted from RISKS Digest (14.64) - 8<------- Snip, Snip ------------- Date: Wed, 19 May 1993 16:32:46 -0400 (EDT) From: esr(a)snark.thyrsus.com (Eric S. Raymond) Subject: Re: Clipper (Denning, RISKS-14.60; Rotenberg, RISKS-14.62) In <CMM.0.90.1.737688970.risks(a)chiron.csl.sri.com> Marc Rotenberg wrote: > Denning has to be kidding. The comments on the proposed DSS were > uniformly critical. Both Marty Hellman and Ron Rivest questioned > the desirability of the proposed standard. Mr. Rotenberg, as a public figure operating in the political arena, has to exercise a certain diplomatic restraint in responding to Ms. Denning's claims. I am, thankfully, under no such requirement. As a long-time RISKS reader and contributor, I observe that that this is not the first time that Ms. Denning has apparently operated as a mouthpiece for the NSA's anti-privacy party line on DES and related issues. I believe Ms. Denning's remarks must be understood as part of a continuing propaganda campaign to marginalize and demonize advocates of electronic privacy rights. Other facets of this campaign have attempted to link privacy advocates to terrorists and drug dealers by suggesting that only criminals need fear wiretapping. These are serious charges. I make them because, in the wake of the Clipper proposal, I do not believe civil libertarians can afford any longer to assume that their opponents are persons of good will with whom they can simply debate minor differences of institutional means in a collegial way. It's time for someone to say, in public and on this list, what I know many of us have been thinking. The future is *now*. Electronic privacy issues are no longer a parlor game for futurologists; they are the focus of a critical political struggle, *and the opponents of privacy are fighting their war with all the tools of force, deception, and propaganda they can command*. The histories of the DES, the FBI wiretap proposal, and now the Clipper proposal must be considered against a wider background of abuses including the Steve Jackson case, "Operation Longarm", and the routine tapping of U.S. domestic telecommunications by NSA interception stations located outside the geographic borders of the United States. These form a continuing pattern of attempts by agencies of the U.S. government to pre-empt efforts to extend First and Fourth Amendment privacy protections to the new electronic media. In each case, the attempt was made to present civil libertarians with a fait accompli, invoking "national security" (or the nastiness of "kiddie porn") to justify legislative, judicial and practical precedents prejudicial against electronic privacy rights. While I would not go so far as to claim that these efforts are masterminded by a unitary conspiracy, I believe that the interlocking groups of spies, bureaucrats and lawmen who have originated them recognize each other as cooperating fellow-travelers in much the same way as opposing groups like the EFF, CPSR and the Cypherpunks do. Their implicit agenda is to make the new electronic communications media transparent to government surveillance and (eventually) pliant to government control. One of the traits of this culture of control is the belief that manipulative lying and dissemblage can be justified for a `higher good'. I believe that Ms. Denning's disingenuous claim that the DSS "is now considered to be just as strong as RSA" is no mere technical misapprehension. I believe it is propaganda aimed at making objectors non-persons in the debate. I cannot know whether Ms. Denning actually believes this claim, but it reminds me all too strongly of the classic "Big Lie" technique. It is important for us to recognize that the propaganda lie is not an aberration, but a routine tool of the authoritarian mindset. And the authoritarian mindset is, ultimately, what we are confronting here --- the mindset that regards the fighting of elastically-defined `crime' as more important than privacy, that presumes guilt until innocence is proven, that demands for government a license to override any individual's natural rights at political whim. We cannot trust representatives of an institutional culture that was *constructed* to deal in information control, lies, secrecy, paranoia and deception to tell us the truth. We cannot accept the authoritarians' unverified assurances that the sealed interior of the Clipper chip contains no `trapdoor' enabling the NSA to eavesdrop at will. We cannot trust the authoritarians' assertions that they have no intention of outlawing cryptographic technologies potentially more secure than the Clipper chip. We cannot believe the authoritarians' claims that `independent' key registries will prevent abuse of decryption keys by government and/or corrupt individuals. We cannot --- we *must not* --- cede control of encryption technology to the authoritarians. To do so would betray our children and their descendants, who will work and *live* in cyberspace to an extent we can barely imagine. We cannot any longer afford the luxury of treating the authoritarians as honest dealers with whom compromise is morally advisable, or even possible. Whatever their own valuation of themselves, the thinly-veiled power grab represented by the Clipper proposal reveals a desire to institutionalize means which a free society, wishing to remain free, *cannot tolerate*. Big Brother must be stopped *here*. *Now.* While it is still possible. Eric S. Raymond <esr(a)snark.thyrsus.com> - -- Date: Wed, 19 May 93 18:37:24 EDT From: denning(a)cs.cosc.georgetown.edu (Dorothy Denning) Subject: Re: Clipper (Raymond, RISKS-14.64) Eric Raymond has accused me of being part of a propaganda campaign and a "Big Lie." Among his wild speculations, he wrote: I believe that Ms. Denning's disingenuous claim that the DSS "is now considered to be just as strong as RSA" is no mere technical misapprehension. I believe it is propaganda aimed at making objectors non-persons in the debate. I cannot know whether Ms. Denning actually believes this claim, but it reminds me all too strongly of the classic "Big Lie" technique. Frankly, I don't know how to respond his allegations other than by saying that I am not and have never been on the payroll of NIST, NSA, or the FBI and that every word I have published has been completely on my own initiative. While I frequently speak with people in these agencies (mainly to ask them questions so that I can be informed) and have considerable respect for them, I am operating on my own initiative and making my own independent evaluations based on all the evidence I can find. I try to avoid pure speculation as much as possible. My objective in responding to Sobel in the first place was to point out that, in my best judgement, the DSS as revised is as secure as RSA. I did that so that readers would not be led to believe the contrary. Let me elaborate more. The security of the DSS is based on the difficulty of computing the discret log. (The Diffie-Hellman key exchange, invented in 1976, is likewise so based.) The security of the RSA is based on factoring. My understanding is that the computational difficulty of these two problems is about the same for comparable key lengths, and indeed, the fastest solutions with both come using the same basic technique, namely the number field sieve. If I'm wrong here, I am happy to be corrected by someone who knows more than I do about this. There are other factors, of course, that must be taken into account. With both schemes, you have to make sure you get good primes. In the case of the DSS, you want really random ones so that you don't get ones with "trapdoors." This is readily done and the chances of getting a trapdoor one are minuscule. For a reference, see Daniel Gordon's paper from Crypto '92. I still remember the day when George Davida called me up to say that he had cracked RSA. It turned out that he had found a way of exploiting the digital signatures to get access to plaintext (but not keys). I generalized his mathematics and published a paper in CACM (April 84). The solution is to hash messages before they are signed, which has other advantages anyway. I also remember various articles by people pointing other potential vulnerabilities with RSA if the primes weren't picked right. There are potential weaknesses in all of these public-key methods, but they can be resolved. As near as I can tell, NIST has resolved the potential problems with the DSS, and I am confident that if new ones are found, they will resolve them too. Dorothy Denning Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0

Re: Encripted huffman-like compression
by Peter Wayner 20 May '93

20 May '93

I wrote something on this in Cryptologia several years back. I believe it is the April Issue of 1988. It describes how to scramble the tree of the Huffman compression to achieve more cryptographically useful compression. Why is this necessary? Because people often assume that compression removes many of the redundancies of the language. Well, it only does this in a theoretical sense. The patterns are still there. If the Huffman encoding maps "T" to "01", "H" to "1001" and "E" to "11", then the pattern "01100111" is going to be very common in English text, but "10010111" is going to much less common. -Peter Wayner

1 0

Encripted huffman-like compression
by stig＠netcom.com 20 May '93

20 May '93

At the first bay c-punks meeting I attended, someone mentioned a variation on huffman encoding that used your key to initialize the compression tables. (This was a while ago, so I probably garbled that description...) Anyway, could the person who mentioned this scheme please mail or post a pointer to code or references? Thanks, Stig

1 0

Constitution...
by J. Michael Diehl 20 May '93

20 May '93

< We hold these truths to be self-evident, that all Communications <should be designed equally and, that they are endowed by their <creators with certain unalienable technical aspects, that among these, <are Privacy, Communications Liberalism, and the pursuit of Cryptographic Please define "Communications Liberalism." Otherwise, this is a nice document. <Freedom. That, to secure these rights to publicly available crypto, <the Government which was once instituted among Men, and derived their <just powers from the consent of the governed, that, whenever any Form +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | | But, I was mistaken. |available| | +-----------------------------+---------+ | mdiehl(a)triton.unm.edu | "I'm just looking for the opportunity | | mike.diehl(a)fido.org | to be Politically Incorrect! <Me> | | (505) 299-2282 | | +-----------------------+---------------------------------------+

1 0

No Subject
by Anonymous 20 May '93

20 May '93

Personally, I think that this is required reading. Practically, I'd like to think that most of you folks will comment and edit this document to the point where each and every one of us will be proud to sign our _names_ to it. Please forgive me for adapting a consecrated public document for this venue, however I feel that this is the best adaptive vehicle for this statement. #include_statement THE DECLARATION OF INDEPENDENCE FROM GOVERNMENTALLY IMPOSED CRYPTOGRAPHY Proposed to Cypherpunks-at-large, May 20, 1993 When, in the Course of human events, it becomes necessary for one people to disregard and challenge the communicative and neo-political bands which have connected them with their Government, and to assume among the powers of the earth, the separate and equal station to which the Laws of Nature and of Nature's God entitle them, a decent respect to the opinions of mankind requires that they should declare the causes which impel them to the opposition. We hold these truths to be self-evident, that all Communications should be designed equally and, that they are endowed by their creators with certain unalienable technical aspects, that among these, are Privacy, Communications Liberalism, and the pursuit of Cryptographic Freedom. That, to secure these rights to publicly available crypto, the Government which was once instituted among Men, and derived their just powers from the consent of the governed, that, whenever any Form of Government once became destructive of these ends, it was once the Right of the People to alter or to abolish it, and to institute new Government, laying its foundation on such principles, and organizing its powers in such form, as to them shall seem most likely to effect their Communications Safety and Happiness. Prudence, indeed, will dictate that Governments long established, should not be changed for light and transient causes; and, accordingly, all experience hath shown, that mankind is more disposed to suffer, while evils are sufferable, than to right themselves by abolishing the forms to which they are accustomed. But, when a long train of abuses and usurpations, pursuing invariably the same Object, evidences a design to reduce them under absolute Despotism, it is their right, it is their duty, to throw off such Government abuses and to provide new Guards for their future communications security.--- Such has been the patient sufferance of these Cryptographic soldiers; and such is now the necessity which constrains them to attempt to alter their former Systems of Government. The history of the present President of The United States of America is a brief history of repeated injuries and usurpations, all having in direct object the establishment of an absolute Tyranny and imposition over individual rights to communicative privacy. To prove this, let Facts be submitted to a candid world. He has implemented a policy which may possibly usurp the citizens privacy in electronic communications, which at least, will indeed submit private communications to unjust scrutiny under his agencies surveillance. He has attempted to impose these standards without academic or public scrutiny. We have not been wanting in attentions to our cryptographic practices; this is true. It does not, however, indicate that we are guilty of crimes of any sort. We have alerted our governmental representatives, from time to time, of attempts made by their legislature to extend an unwarrantable jurisdiction over us. We have reminded them of the circumstances of our professional and private idealisms. We have appealed to their native justice and magnanimity, and we have conjured them by the ties of our common kindred to disavow these usurpations, which would inevitably interrupt our connections and correspondence. They too have been deaf to the voice of justice and of consanguinity. We must, therefore, acquiesce in the necessity, which denounces our united objection, and hold them, as we hold the rest of mankind, Enemies in War, in Peace Friends. We, therefore, the Representatives of the Cryptographic partners resident in the computing networks and establishments, in General Consensus, Assembled, appealing to the legislative bodies of the United States of America for the rectitude of our intentions, do, in the Names, and by Authority of the good People of the Networks, solemnly publish and declare, That the computer community is, and of Right ought to be, Free and Independent of governmentally imposed cryptographic restrictions; that they are Absolved from all Allegiance to the proposals implemented by the National Security Agency, The National Institute of Standards and Technology and the Clipper purveyors by-and-large, and that all political connection between them and the United States of America, and ought to be, totally dissolved: and that, as Free and Independent communicators, they have absolute rights to private electronic communications without Governmentally imposed sanctions which may unethically submit their communications to Governmental scrutiny. And, for the support of this Declaration, with a firm reliance on the protection of divine Providence, we mutually pledge to each other our sacred Honor. Quis Custodiet Ipsos Custodes?

1 0

No Subject
by nobody＠soda.berkeley.edu 20 May '93

20 May '93

TEMPEST Information (Might be a bit old) ---------------------------------------- HETRA Computers Inc. George Brazel 45472 Holiday Dr. #1 Sterling, VA 22170 Vox: (703) 709-0800 Fax: (703)709-8181 [God I love this list] =8^(

1 0

TEMPEST
by wcs＠anchor.ho.att.com 20 May '93

20 May '93

> Where can I find more info about tempest? Is it a roomwide thing, is it > implemented in the cables and housings, or what? I understand that the > purpose of Tempest is to prevent people from spying on you via electronic > emissions detection. Is this just a glorified Faraday cage? Both techniques are used. You can either buy TEMPEST-designed equipment, which is designed for low emissions, separation of signals between classified and unclassified components, shielded cables, etc., or you can build a shielded box or room and use special filtered power supplies, fiber optics, etc. The exact standards are classified, but they're a lot stricter than FCC Class A or B. The shielded-room vendors out there also sell to the electromagnetic-compatibility- testing market, who want to have nice quiet rooms to measure emissions from their equipment in. Last time I saw one of these rooms built, about 5 years ago, typical construction used plywood sheets with thick sheet metal on each side, fancy connectors between plywoods, copper-wool crammed in any cracks, and special waveguide meshes for air vents and fiber-optic communication cables, and gives about 100-120 dB shielding for frequencies up to about 1-10GHz. Twenty years ago, typical construction used copper screening and was good to ~60dB. About 3-4 years ago, the typical cost for a TEMPEST PC was ~$4000 more than the non-TEMPEST equivalent, and the equipment was maybe 1 year behind the commercial models due to integration and testing time. TEMPEST mini-computers, if they were small enough, generally took the approach of putting the standard versions of the machine in a box built like the TEMPEST rooms; TEMPEST PCs had a somewhat more integrated design, though they were starting to use commercial motherboards. Bill Stewart

1 0

Re: MCI, Sprint or bust ...
by jordan＠imsi.com 20 May '93

20 May '93

>>> what makes more sense is to buy some at&t shares ... Looks like someone did that. AT&T is up about $8 in the past four days, up another 4.8% today ... /jordan

1 0