- cypherpunks-legacy - lists.cpunks.org

Tough Choices: PGP vs. RSA Data Security
by Eric Hughes 30 Apr '93

30 Apr '93

I have a few more words on this topic at this juncture. Tim was calling for an examination of the issue; he was not, to my reading, recommending one course of action or another. Possibly Tim's pancritically rationalist sensibilities have offended some. To them I say "Cypherpunk is not a religion." If you cannot question your own beliefs, you are acting in a predominantly ideological mode. We need no zealots here. Please, everyone, have a bit of calm purpose and broad-mindedness. Reference is not advocacy. One of the great and lasting advantages of language over the visual is the ability to say "no," "might," "ought," "can," "may": the plethora of negations and conditions. This mailing list is not a TV channel; do not treat it as one. I specifically request those of you who engaged the keyboard without understanding this basic point please to reread Tim's article and to alter and/or to retract you hasty words as appropriate. I leave this entirely as an exercise to the reader. Eric

1 0

RE: Tough Choices: PGP vs. RSA Data Security
by wcs＠anchor.ho.att.com 30 Apr '93

30 Apr '93

Pat Farrell writes: > I'm writing a Windows-based POP client designed for folks that can't spell SLIP. > It should have strong encryption invisibly and automatically. > It won't until there is a legal encryption engine with at least the key > management of PGP. (I'm replying to cypherpunks, since other people may run into similar problems, and there *are* good ways to solve them.) Let's assume for the moment that you don't care about being exportable, so "legal" only means "Ok with RSA". RSAREF is ok with RSA for non-commercial, non-exportable use, and if you want to use it commercially they'll give you a price. It's got most of the subroutines you need, and if some non-Yankee writes a version with a compatible interface (to avoid copyright problems; patents aren't an issue outside the US) they can probably use the non-RSA parts of your code. I'm not sure exactly which routines in RSAREF the license lets us use, (so I've written to RSA to ask them), but the ones that ARE clearly usable let you do Sign/Verify on a block, and DES-with-random-session-key-and- signature-with-RSA-session-key-encoding (aka R_SealPEMBlock/R_OpenPEMBlock.) This gives you all you need to build standalone systems (compatibility is another story), though sometimes it's a big and clunky approach when a simple RSAEncrypt/Decrypt would have done. For example, your POP client needs to solve three main problems 1) Login authentication 2) Message encryption during transmission 3) preventing bogus deletes or other problems if your session gets hijacked. 3) probably isn't possible without changing the protocols or running over an encrypted telnet-equivalent session, but that's not RSA's problem. The POP3 RFC1225 explicitly recommends against including extra data in the DELE messages, though I suppose you could use an RSAREF signature as extra baggage anyway, including some kind of timestamp or counter to prevent replay. 1) The current POP protocols have the user send a USER message, to which the system either sends a rejection or a positive +OK response with arbitrary text to follow, and the user sends a PASS message, with password in clear-text, which is not real swift. This obviously needs to be replaced with some sort of challenge- response method to prevent eavesdropping and replay. A simple method using the block stuff is for the system's +OK response to the user to contain a challenge-string, and the user's PASS variable to be the challenge-string (or that+1) with an RSA signature from R_SignPEMBlock(). If Diffie-Hellman were included with RSAREF, the response could include a DH half-key. Alternatively, the PASS variable could be an encrypted R_SealPEMBlock() message containing the challenge and a session key, encrypted using the server's public key and signed by the client. 2) can either be accomplished by encrypting each message as with a new session key and RSA to encrypt the session key (a bit slow, but each message is now self-contained, which has some degree of elegance) or else by negotiating a session key at the beginning (as discussed in the above) and using it for each message. The latter approach is obviously faster. The main feature from PGP that this doesn't provide is authentication of public keys, but that's not really a problem in a POP environment - you have to deal with the administrator to set up your mailbox, so you can exchange keys at that time. If you wanted to build a mechanism like PGP's web of trust for keys, it's not too hard, though the obvious approaches will probably have the painful slowness of PGP2.0 instead of the blazing speed of PGP2.2 :-) You've got a block signature routine, so you use messages saying "Keysig User KeyLen Key SignerUser SignerKeysig [SignerKey?]" with appropriate amounts of ASCII armoring and delimiters, and sign them. This would be a very practical addition to RIPEM, if anybody's in the mood; RIPEM's key server isn't integral to the package. Bill Stewart wcs(a)anchor.att.com

1 0

Re: Tough Choices: PGP vs. RSA Data Security
by jsday＠THUNDER.LakeheadU.CA 30 Apr '93

30 Apr '93

> All he has to do is let us pay a licence fee for pgp. > What's the advantage to him in asking for a different piece of code that > uses RSAREF and DES instead of Phil's code and IDEA? I can't see it, > except that using DES blows away the security of the program... > > No, I think this suggestion should be put down now, or we'll splinter > and give them exactly the divide-and-conquer opening they're looking for. Agreed. PGP is too much of a good thing for me to withraw my support for it without a much more compelling reason than this. As Tim May stated, we should be careful to see who there real enemies are here. PGP is certainly not one of them. I certainly do not want to be RSA Data's "enemy", but from the indications on here that they are actively working against PGP, and are not likely to support any similar, freely-distributable product (and that would require a substantial length of time to develop!) PGP is currently the best, and only, possibility. Now, if there were some program without the legal problems that PGP has which was at least very affordable and could reasonably be expected to gather the same widespread use that PGP already has, ideally through complete compatibility with PGP keys, I think we would all agree on using it. Tim May: > If RSA fails to take actions against sites and users, it weakens > their legal position with respect to their patents. The government > does not need licenses in any case, but users of Clipperphones *do* ... Indeed. It would be nice if PGP were universally supported, and legal. That, as far as I can see, is its only problem. I do not see how we are going to come up with a solution to that problem without sacrificing much of PGP's availability and utility. If not PGP, then what? Until there is a concrete and acceptable alternative to work towards, which seems unlikely if RSA will not support it, we must work with what we have. ---

1 0

NPR Clipper Report Transcript
by Duncan Frissell 29 Apr '93

29 Apr '93

Here is the NPR report on Clipper broadcast on the Tuesday following Der Tag. It was heroically transcribed by my wife Lois and myself. There are no errors (except for name spellings we had to guess at) so we won't apologize for them. Duncan Frissell National Public Radio Morning Edition -- Tuesday 20 April 1993 -- C+4 (Clipper + 4) Approx 6:50 am EDT repeated 8:50 am EDT (a few words missing from the front end) ...telephone communications from illegal eavesdropping. But the new system is the focus of controversy because the federal government has built in a way for law enforcement agencies to listen to private conversations. NPR's Dan Charles reports: You don't usually go to the White House to learn about computer technology. But last Friday, officials there unveiled a new silicon chip. The Clipper Chip, as it's called, is programmed to turn electronic transmissions like telephone conversations into gibberish that no one unauthorized listening in can understand. And it turns that gibberish back into normal speech or data at the other end. Whitfield Diffey, a senior engineer at Sun Microsystems in Silicon Valley, says this Clipper Chip is an example of the technology of secret codes or cryptography. "This is in some sense a relatively ordinary cryptographic chip, of which there lots." Banks, companies, and government officials can use these chips to make sure no one eavesdrops on financial transfers or confidential discussions. And the government says this new chip will offer more powerful protection than anything people could buy up to now. But there's another reason why the government wants people to use the Clipper Chip, and it's why a lot of people are up in arms about it. Every one of these chips will have in its circuitry a unique key --- a very long number --- that only the government knows. And if an agency of the government, like the FBI, wants to listen in, that number will be like a master key that allows them to decode the conversation. "The mechanism is very much like what the real estate agents do with houses. Right, they take you to show you a house and they don't have a key to that house in their pockets. But they get to the house, and there's a lock box hanging on the front door. And they have a master key in their pockets, and they open the lock box, and take out the key to the door, and open the front door, and go in and show you the house." The special key that the government holds is like the key to the lock box. Even though someone using the Clipper Chip can choose their own key to keep other people from listening in, the chip is programmed to always keep that changing key inside the lock box, where the government can get at it. The reason for that lock box is that the government occasionally likes to listen in to the phone calls of suspected criminals at home and hostile governments abroad. For the last two years, law enforcement officials have been worrying publicly that the Mafia or terrorists will start buying powerful scrambler phones to keep the FBI from understanding their conversations. The government doesn't want to ban this technology because, increasingly, legitimate businesses depend on it. So the government developed its own version --- the Clipper Chip. Raymond Kammer, Acting Director of the National Institute of Standards and Technology, says it's a good compromise. "On the one hand you've got a need for personal privacy. And I think most of us intuitively understand that and desire it. I know I do. And on the other hand, you've got the right of society to try and assure itself that it's safe from crime. But computer scientist Whitfield Diffey, who's one of the pioneers of modern cryptography, thinks the lock box is a terrible idea. He says that trying to deny even criminals the right to a private conversation is dangerous. It is something absolutely essential to the functioning of society. "We are taking a long step towards saying, 'No, you can never be sure that you're going to have a private conversation on the phone.' And therefore, a real right of privacy only belongs to people rich enough to travel and meet face to face." Government officials say they have policies in place to prevent abuse. Law enforcement agencies will have to request the key for any lock box from two separate independent agencies, each of which will have only a piece of the key. This should also make it harder for anyone to steal the keys. Diffey says the Clipper Chip will encourage more government eavesdropping, simply because it's there. "Technology makes policy," he says, "if the government invests hundreds of millions of dollars creating a computer chip designed for wire taps, it will try to take advantage of that investment whenever possible by carrying out more of them. The success of the government strategy will depend on people buying the chip. AT&T will soon be selling a small flat box, half a foot long and about four inches wide, with the Clipper Chip at its heart. It costs just over $1000, plugs right into the cord that connects the telephone handset to the phone itself. People who have it can talk to each other in complete privacy --- unless the government wants to listen in. This is Dan Charles in Washington.

1 0

No Compromise in Defense of Our Privacy Rights. PGP FIRST!
by Matthew J Miszewski 29 Apr '93

29 Apr '93

To all, Tim's statements bother me a great deal. Granted I have not been around as long as some (in this particular environment), but long enough to gain respect for certain net personalities. I wish to hold on to that respect... Ive heard a lot of people talk a lot of sh** about the privacy issues concerning us requiring private acts of heroism. Is that what is involved with giving up on an ideal that has helped define the term cypherpunk. Not long ago Tim (and others) posted a rabid defense to the changing of the name of the list. Were those merely words? I have never questioned the dedication of freedom lovers like Tim before this series of postings. Something has clearly taken place. I hope we find out what. My problems with Tim's suggestions: 1. While those of us lucky enough (or skilled enough) to be independently wealthy may think that the price of RSA software is nominal considering what is at risk (I personally agree), do we forget about those that *need* this data security and cannot pay for it? (All of these people of course would use PGP as an academic resource in order to make its distribution OK). 2. From a legal point of view, what RSA is probably doing is asserting its *presumed* patent rights. Left unchallenged they will remain presumed. So, to those whom have repeatedly sounded the call for "individual acts of heroism", is now the time to run and hide? The *ultimate* question of the legitimacy of algorithmic patents funded with public money *will* default if left unchallenged. So I challenge, with all of my honest respect, those with the means to take up the gauntlet thrown down by RSA. 3. There are more ways than one to legitimize strong crypto and allow RSA to gain its almighty buck. Suggestions have already been made. Allow the rights to the RSA patents to be purchased. RSA does have a choice between that and no money at all. 4. What about those that went before. Is the heroism of Phil Zimmerman to go for nought? The chances that several people, including Tim, have taken deserve compensation NOT compromise. RSA wants us to fold now. Why is a respected leader of the community asking a compromise of the Cypherpunk Manifesto? 5. Finally, there have been other ways suggested to deal with the problems. A USA-Legal PGP is one. I know that many of the philosophers, code writers, hackers, thinkers, etc. among us can overcome this too. Why give up when it appears to be the night before the big game? I am merely a law student with a deep interest in liberty and privacy. I *am* willing to offer my time to the preparation of any eventual *challenge* of the RSA patents. NONE of the above post was meant as a personal afront to anyone, but rather a critical look at Tims suggestions (Mainly because I would not have expected it from *Tim*). If there are extenuating circumstances involved, let us know. I have been reading posts from Tim since the days of p/hun and before. I in NO WAY question Tims committment, but rather the motivation for the out of character post. Any individual heroes left? Matt mjmiski(a)macc.wisc.edu

1 0

Tough Choices: PGP vs. RSA Data Security
by tcmay＠netcom.com 29 Apr '93

29 Apr '93

Cypherpatriots, This is a tough posting to write. I may even be called a quisling, or even a sternlight! This may be the most important posting I make during this current Clipper-Big Brother Chip controversy. I suggest that we as a community seriously reconsider our basic support for PGP. Not because of any flaws in the program, but because of issues related to Clipper and the potential limits on crypto. Continuing use of PGP causes several problems: 1. If RSA fails to take actions against sites and users, it weakens their legal position with respect to their patents. The government does not need licenses in any case, but users of Clipperphones *do* (not the final end-users, but the suppliers of Clipperphones to non-government customers). (A case can be made that repudiation of the patents might be a good thing. I know I have argued this at times. It's hard to know.) 2. The "guerrilla crypto" aspect of the PGP community (and our group) is charming, but may be counterproductive. If we are viewed as outlaws, the target even of RSA, then we have almost no influence, save for underground subversion. (To put this another way, if we are seen as RSA Data's enemy, we lose a potential ally. I am suggesting that a coming war between strong crypto on one side and government snooping on the other will force all participants to choose up sides.) 3. Supporting a legal version of strong crypto, which RSA Data-approved programs are and PGP is *not*, is a much more solid foundation from which to fight possible restrictions on strong crypto. 4. Our time could better be spent by solidifying existing RSA programs, including RIPEM, RSAREF-derived programs, MailSafe, and so forth. This is the approach several major companies have taken (Apple, Lotus, Sun, etc.). I've urged Jim Bidzos to work toward some compromise with the PGP community (and I think everyone recognizes the positive aspects of this growing community). This might include creating translation programs so MailSafe or RIPEM can read PGP files, a reworking of PGP to conform to licensing requirements, etc. I'm hoping that Phil Zimmermann can see what the real battle is. The PGP community is not likely to win their battle in court, and the effect of such a court battle will be divisive and ultimately may help the government in its plans. Phil Z. is most unlikely to ever see any real revenues from PGP. I think the benefits of a strong, legal, supported crypto product are greater than the dubious benefits of having a "free" piece of software. At any reasonable hourly wage, the cost of MailSafe ($125, last time I checked) is dwarfed by the amount of time crypto activists like ourselves spend debating it, downloading it, awaiting patched versions, etc. (All is not rosy on the RSA Data side, either. RSA Data chose to concentrate on getting RSA built in to e-mail products from the major companies and chose not to devote much effort to PGP-like personal encryption products (such as MailSafe, which runs on DOS and UNIX only and which hasn't changed much since 1988). Support for RSA Data should mean more support for these kinds of products. We could essentially ask RSA for a commitment in this area.) I'm arguing that we should look carefully and see what the real issues are, who the real enemy is, and then make plans accordingly. Awaiting your feedback, -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, smashing of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available. Waco Massacre + Big Brother Wiretap Chip = A Nazi Regime

5 4

RE: HELP! Some nut is threatening to sue!
by tcmay＠netcom.com 29 Apr '93

29 Apr '93

Dr. Zaphod writes, commenting on Jim Bidzos' e-mail to Stanton M., > For a guy who claims to want to help us Cypherpunks in the way of >personal encryption, scare tactics seem a little out of place. I'm sure >we'd all like to use legal encryption methods [maybe]... but we ARE >Cypherpunks.. giving us the responsibility to use what's best and defend our >rights for privacy. Using a package that hasn't been updated in 5 years >[MailSafe], we have diminished to politically correct yippies. I;m not sure >quite what to do.. but I saw Jim Bidzos on a magazine once.. and he looks >like a fed. >By playing the game we are becoming part of it. TTFN. * The scare tactics may have been somewhat too harsh, or at least phrased in typical "cease and desist" lawyer terms, but Stanton _did_ post his announcement very prominently and widely in sci.crypt, where everyone could see it. RSADSI was pretty much forced to react, lest they later find their patents/copyrights/whatever ruled invalid by their failure to protect them. Most PGP sites are less well-advertised :-}. * I agree that PGP has a feature set (especially its distributed trust model) that is more interesting than the creaky old MailSafe program. There may be several solutions brewing here, as several postings in this thread have noted. * As George Gleason has also noted, dividing our community may play into the government's hands. (Some may think I'm trying to fragment the PGP community with these comments. Not at all. PGP has done a valuable service in educating hackers, users, etc., and in energizing the community. But keeping crypto "underground," as by nature PGP must be, is not what we want, is it?) * I once thought RSA Data Security Inc. was NSA-controlled. This was in 1988 or so, when I tried to buy a crypto package from them and got the run-around ("Don't call us, we'll call you."). It seemed natural, to me at that time, that the Agency would control such a crucial technology. This opinion didn't last too long, as I got more familiar with the crypto community. Now I'm convinced otherwise, and that Clipper/Capstone is in fact the government's way of gaining control of a technology they failed to classify and control the first time around. (To be sure, the export controls and other legal restrictions are a way the Agency and others control the spread of strong crypto, but so far there has been no basic challenge to the "right to encrypt." Many of us see Clipper as a probable move in this direction. Time will tell.) After meeting many of the principals, including some early investors (like Alan Alcorn, of Atari fame, at the Hackers Conference), I came to a different conclusion: RSA Data Security was just concentrating on the "big deals" which are only now coming to fruition--the zillion-copy deals with large companies like Apple, Microsoft, Lotus, etc.. This market is vastly larger than the PGP community, which may be as "small" as several thousand copies (does anybody have any better guesses?). And it turns out anyone _can_ buy a personal encryption package from RSADSI...it's called MailSafe. In 1991, I stopped off at the offices of RSA in Redwood City, while on my way to Lake Tahoe to the Hackers Conference, to pick up my copy of MailSafe and ran into Jim Bidzos. We talked about PGP (1.0 in those days) and about the upcoming Hackers Conference. Jim made an interesting offer: Anyone at the Hackers Conference could buy MailSafe for $50, just by saying they were there. This fee barely covered the manufacturing/packaging costs, as I'm sure you all know. So far as I know, a handful of people followed up. (And I agree there's a perceived problem that no one, especially in our community, uses it. That's why I have both a MailSafe and a PGP key...I figure I'm pretty safe against any legal charges, as I can always wave my MailSafe license in the air!) Several other conversations have convinced me that Bidzos is not a Fed. Also, his company has sponsored two excellent (and *free*, by the way!) conferences on crypto, featuring speakers from outside his company (such as Mark Riordan of RIPEM fame) and talks highly critical of the "Digital Signature Standard" (DSS), which the real Feds were pushing as a weak alternative to RSA digital signatures. (By the way, DSS is part of the new Capstone system, unsurprisingly.) * I'm not a lawyer (which is why I'll cc Mike Godwin and Lee Tien on this response), but my understanding is that the RSA patents cannot just be licensed on a "per person" basis...that's just not the way patents work. That is, we can't just pay RSA a quite reasonable $50 apiece for a perpetual license to the patents and be done with it. Instead, each product that uses the patents must be separately licensed, as per patent laws. (This doesn't mean the fee is anywhere _near_ the $125 for MailSafe, the $50 fee I suggested here, etc. I suspect the deals with Apple, Lotus, etc., resulted in _much_ lower fees, perhaps just a couple of bucks per user. Just a guess.) * A "personal encryption" product, for users who don't use commercial e-mail products such as Lotus Notes (which contains RSA), is sorely needed. The PGP distributed trust model and other features, combined with a fully legal "crypto core," could be a real success. (Personally, I'd like to see a commercial version of "Eudora," the Macintosh off-line mail reader I now use, with easier (push-button, automatic) support for PGP, RIPEM, etc.). * The upcoming battle for strong crypto is as important a battle for civil liberties as our generation will ever face, in my opinion. The precendents set in the next several years will shape this country (and other countries, by extension) for many years to come. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, smashing of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available. Waco Massacre + Big Brother Wiretap Chip = A Nazi Regime

1 0

Re: Tough Choices: PGP vs. RSA Data Security
by karn＠qualcomm.com 29 Apr '93

29 Apr '93

I think the ball's already in Bidzos's court. Consider the following Bidzos quote a few days ago on the "billcryp" list: You have it correct, but let me expand a bit. It would be a bad business decision for us to try to keep *anyone* out of the market with patents because we disagree with their approach. Remember, personal choice crypto isn't outlawed yet. Now the context of this quote was whether RSA could use its patents to try to squash the more objectionable aspects of Clipper (particularly key registration), but his wording is (perhaps unintentionally) much more revealing. It implies to me that licensing PGP would be in RSADSI's best business interests. And so it would, if not for the personal animosity between Bidzos and Zimmerman. I sent a note to Bidzos asking him this exact question, but I have not yet received a reply. I am yet another person who would be glad to pay RSADSI a reasonable fee to use RSA in the form of PGP. Cost is really not the main issue here; PGP is the product I want to use, plain and simple. Nothing else matches its features, especially the "web of trust" model for certificates and the widespread availability of source code for inspection. Mailsafe isn't even in the running. I use PGP only occasionally, in a personal and educational mode. I would very much like to be able to recommend it to my company for business use, but I can't do that under the present circumstances. And that's too bad. Phil

1 0

Re: Tough Choices: PGP vs. RSA Data Security
by Bob Stratton 29 Apr '93

29 Apr '93

> From: markh(a)wimsey.bc.ca (Mark C. Henderson) > Date: Thu, 29 Apr 1993 11:11:20 PDT > Subject: Re: Tough Choices: PGP vs. RSA Data Security > > > 6. RIPEM currently has no way to handle certificates or sign other > people's public keys. This is, of course, serious. The Macintosh RIPEM client does/will have certificate creation functionality RSN. In fact, RSA's even running a low-security persona certification authority that interoperates with them, as we speak. --Strat

1 0

Raving on..
by crunch＠netcom.com 29 Apr '93

29 Apr '93

>> Who wants to collaborativly work on an information packet containing >> a collection of the previous reports on the wiretap chip, such as >> the initial white house statement, CPSR's and EFF's responses, >> list of questions that were hashed at the last Cypherpunks meeting, >> etc, etc. >I already have such an archive (missing the cypherpunk questions [I had >a mail blowout, and that was one of the casualties, along with a couple >other saved items, mostly criticisms of the the privacy clipper.]) >Lemme know if you need it. I have it in .ZIP format, so you'll need >some way to deal with that. Great!! What we need is for someone who can read ZIP files and get it into hard copy for reproduction to be handed out at raves. Who wants to take on this responsibility? Geoff, now that one of my mailing lists has just dissolved (TCL_TALK) I can now join the sfRaves group and work with them directly, but first I want to write up a short introduction. JD

1 0