- cypherpunks-legacy - lists.cpunks.org

CLIP: Sample/Draft letter to the editor
by zane＠genesis.mcs.com 18 Apr '93

18 Apr '93

I wrote up a letter to the editor on the issue, which I will send to the local newspapers and the major newspapers. I'd like comments, and criticisms so that I may make the letter more effective. I also plan on writing an article in my newsletter _The Free Journal_ on this big brother plan. (I plan on including excerpts from _From Crossbows to Cryptography_ in this "Crypto" issue as well.) Editor: The Clinton administration on Friday unveiled their plan for establishing a standard data encryption system for voice communications. This plan is abhorrent and reeks of Big Brother. President Clinton says that he wants to bring the United States into the twenty-first century. This proposal is bringing us to 1984. First I will mention technical reasons why the system is inadequate. The encryption algorithim is classified. Only a select group of people will be allowed to examine the algorithim for flaws. The members of the cryptographic community emphasize that the only way to make sure that a cryptographic system is secure is to have as many people as possible analyze and try to break it for as long as possible. A system which has been examined by a small segment of the population will not be trusted to be secure. The key used in this algorithim is very small-- it is easily attacked by brute-force. The encryption key is only eighty bits long. Such a small key lends itself to easy decryption by an unauthorized party. It would lend a false sense of security to laypersons in the field who do not realize that a key of such simplicity could be cracked easily by any talented criminal. Apart from the technical flaws in the system, there are many political problems with the recent big brother proposal. First, there is the assumption that the government has a right to spy on its own citizens. The proposal for this wiretap chip includes the registration of keys with two escrow agencies. This is purported to allow law enforcement to keep track of "terrorists" and "drug-dealers." The first flaw in this key-escrow system is that no self-respecting criminal will use a cryptography system which can be easily tapped by law enforcement officials-- they will use strong cryptography. Thus the only people who may end up using the wiretap encryption system will be law-abiding laypeople who don't fully understand cryptography. (Law-abiding citizens who do understand cryptography will use strong cryptography to preserve their privacy from a talented criminal.) The proposal says that in order to obtain the key of a wiretap chip user a law enforcement agency must first establish that they have a valid interest in the key. Translated out of legalese, that means that all a government agency will have to do to get access to all of the private communications between, for example, a lawyer and her client will be to fill out the necessary forms. Registering cryptographic keys with the government is similar to giving the IRS the keys to your house and filing cabinet. The chip is being manufactured exclusively by one company. The release stated that the Attorney shall request (i.e. coerce) telecommunication product manufacturers to use this product. This aspect of the system is a government-mandated monopoly. Such monopolies result in high prices and the elimination of market forces which drive the improvement of technology. (One needs only look at the state of the Soviet Union to see how the lack of market forces affects consumer technology.) What is feared the most from the proposal is that if the wiretap chip becomes the standard, strong cryptography will be declared illegal. If such is the case, then only criminals will have access to strong cryptography. As I have stated above-- the wiretap chip will not be used by criminals because of the obvious flaws in the crypto-system-- criminals will use strong crypto, while law-abiding citizens will have to use a system which can be easily defeated by any criminal. Strong cryptography already exists for data communications, for -free-. Strong cryptography for voice communications for -free- is only a few months away for people who own a personal computer. There is no way that making strong cryptography illegal will stop it-- it will only turn otherwise law-abiding citizens into criminals. Sincerely, Sameer Parekh -- | Sameer Parekh-zane(a)genesis.MCS.COM-PFA related mail to pfa(a)genesis.MCS.COM | | Apprentice Philosopher, Writer, Physicist, Healer, Programmer, Lover, more | | "Be God" - Me __ "Specialization is for Insects" - Robert A. Heinlein ____/ \_____________/ \____________________________________________________/

1 0

FAQ's
by uni＠acs.bu.edu 18 Apr '93

18 Apr '93

Perhaps someone should cook up a frequently asked questions sheet with regard to our position on the Wiretap chip proposal? Something bent a little more in the direction of consequences and not promises? Q: What will the Clipper Chip really mean for Privacy? A: The Clipper chip bills itself as the answer to a nations right for privacy, when indeed it is less secure than many of the algorithms in circulation today. Buying a Clipper Chip device is the same as handing the government your login password and accepting the promise, "We'll only use it with proper authorization..." Admittedly my example is less than eloquent, perhaps someone can come up with better? Given this format, and if the questions and answers are kept in layman's terms, it could reasonably be distrubuted to some of the less technical news groups and things like comp.mac.comm and such.... uni (Dark)

1 0

voice privacy for the masses
by Phil Karn 18 Apr '93

18 Apr '93

I think Hal Finney's analysis is not far from the mark. Saner elements in the government probably do realize the utter impossibility of a complete ban on uncrackable crypto given the existence of talented, knowledgeable and highly motivated (especially now!) "cypherpunks". But the government has also found that with very little effort, they can still have an enormous practical effect on the non-cypherpunk masses. Heck, look at what the NSA did to the digital cellular standards by standing in the shadows and quietly threatening to withhold export approval to phones with meaningful technology. The NSA barely had to whisper its objections, because the industry simply doesn't care very much about customer privacy. Certainly not enough to risk not only their non-US markets, but also the ability to have phones manufactured overseas for the US market. And then NSA rubs salt in the wound by brazenly claiming that they're only concerned about encryption getting into the hands of unfriendly foreign governments. As far as they're concerned, they say with a perfectly straight face, Americans are free to use any encryption scheme they want. I wonder how people like that can sleep at night. Well, the implications are obvious. If the public is ever to benefit on a large scale from strong encryption technology, it cannot depend on a normal market to sell it to them in turnkey packages. As soon as you go into business overtly selling such packages, the government pressure will begin. They will make sure that you do not become too successful, either by banning exports or by flooding the market with inferior technology that they can break (like Clipper). So we need to create a rather nonconventional "market". More specifically, we need to find a way to bring the efforts of the cypherpunks to the public with minimal cost and in a way that the government cannot control. By far the best way to do this is to write and distribute free crypto software that requires only readily available general purpose hardware to run. As we know, duplicating and distributing software is so trivial that controlling it is virtually impossible. And while it's theoretically somewhat easier for the government to ban or regulate, say, modems faster than 2400 bps or CPUs faster than 10 MHz 286s, general purpose computer hardware like this has so many other "legitimate" uses that in practice a ban would again be impossible. I've contributed a little to this effort myself with my public domain DES code, but it's the PGP effort that has really made this a reality. PGP is now unstoppable, and it's well on the way toward providing large scale privacy for email and other textual information. But voice is still a problem. What we really need now is "PGVP" ("Pretty Good Voice Privacy"), i.e., a package of public domain software that, when again combined with readily available general purpose computer hardware, produces a highly secure telephone. We already have two of the three hardware components of a digital secure telephone well in hand: CPUs capable of encrypting digital voice in real time, and reasonably fast telephone modems. The one remaining piece to the puzzle is the vocoder, as conventional waveform sampling of speech produces a data rate too high for telephone modems. (Faster modems might alleviate the need for a low bit rate vocoder, but current generation modems are already running very close to theoretical limits, and there won't be too many more improvements.) Ready-made vocoders are available. In fact, my company (Qualcomm) just announced one (the Q4400) as a spinoff of our CDMA digital cellular system. It's a mask-programmed AT&T DSP-16A DSP chip. Unfortunately, like many leading-edge products, it's not cheap: $69/ea in quantity 1000, and reportedly nearly $200 in small quantities. A second alternative is to run your own vocoder software. But vocoders are notoriously compute-intensive, and they're traditionally run on DSPs. And DSPs do not yet qualify as "widely available general purpose computer hardware". That leaves a third possibility: tuning vocoder software to run in real time on a fast general purpose processor like a 486. John Gilmore has already obtained and distributed public domain code that implements the Federal standard CELP vocoder algorithm (used in government secure telephones, a nice twist) but my understanding is that it's too slow to run in real time on popular computers. Van Jacobson at LBL has reportedly tuned it to run in better than real time on a Sparc 1+, but he hasn't released it yet and he's a notoriously hard guy to get ahold of. So the request of the day is this: who's willing to take that CELP code, bum enough instructions out of it so it will run in real time on a 486, and place his or her work back out into the public domain? Phil

1 0

Address of major telecom decision makers (AT&T, etc.)
by zane＠genesis.mcs.com 18 Apr '93

18 Apr '93

If someone has the addresses of these people it would be a very good idea to post these addresses (addresses of the NIST, Denning, etc. folk would be good as well.. I don't know those but those are probably more well-known than head-AT&T folk) here so that we can inundate them with mail and use these addresses in the full-page ads we buy in the newspapers. -- | Sameer Parekh-zane(a)genesis.MCS.COM-PFA related mail to pfa(a)genesis.MCS.COM | | Apprentice Philosopher, Writer, Physicist, Healer, Programmer, Lover, more | | "Be God" - Me __ "Specialization is for Insects" - Robert A. Heinlein ____/ \_____________/ \____________________________________________________/

1 0

Cypherpunks--Mission Statement Needed
by Clark Reynard 18 Apr '93

18 Apr '93

CP is for Crypto Privacy, because we feel that privacy and cryptography are now more inextricably linked than ever. We shall likely have to use crypto to hide our crypto. CP is for Changing Policy, both CP policy and existing government policy. CP is for Conscious Paranoia. We know and understand the issues involved, both the political and the scientific. We _are_ paranoid, but we know _why_ we're paranoid, and justify it as a _rational_ response. [The use of 'paranoia' is loose, of course, since the strict meaning and popular meaning differ widely.] CP is for Cypher Punks. Cypher because not only do we use cyphers, but in a certain sense we _are_ cyphers. Punks? A contemptuous term created by those contemptuous of those who fail to pay allegiance to the Almighty Government. Should it be a badge of pride, or a shameful term used for a shameful purpose? I believe that if we are to be effective, we ought to decide on a number of tenets which just aren't in the FAQ now. Tim May's .signature seems as good a place to start as any. Methods of implentation, boat-rocking and some form of plan will likely be necessary. Send mail to me or to the list, preferably to my mail address at nyx.cs.du.edu; and I will summarize and post, stripping headers if requested and eliminating redundant entries. The FAQ needs to be revised, I believe, to reflect the current crisis, and I am more than willing to help re-write it if anyone finds it agreeable. Thank you. [Aside: I appear to be getting two copies of many letters-- if anyone makes a snide comment about multiple postings of articles, I'll, I'll, I'll, uh, grin and look sheepish-- and I wonder if others have this problem; it's not a double sub, per se, as some letters _aren't_ doubled. Ah, well, it's probably nothing, just the side effects of the surveillance software.] ---- Robert W. Clark rclark(a)nyx.cs.du.edu PGP signature available by mail or finger

1 0

Putting out a paper-magazine
by zane＠genesis.mcs.com 18 Apr '93

18 Apr '93

I HIGHLY suggest that publishing-inclined cypherpunks start publishing cypherpunk-oriented PAPER newsletters to: A) Get out the word about how Clipper sucks B) Educate people about strong crypto, in layman's terms (tough one) C) Raise public support for strong crypto. There are probably other reasons why we want to do this as well. (When the discussion here was about technical details, I was greatly interested, but I had nothing to say-- now that the time has come for activism.. I feel that I can help..) The idea for full-page ads is nice. I'd advertise for raising funds for such a venture in my libertarian-leaning newsletter. -- | Sameer Parekh-zane(a)genesis.MCS.COM-PFA related mail to pfa(a)genesis.MCS.COM | | Apprentice Philosopher, Writer, Physicist, Healer, Programmer, Lover, more | | "Be God" - Me __ "Specialization is for Insects" - Robert A. Heinlein ____/ \_____________/ \____________________________________________________/

1 0

Media Sugestions, History of Clipper and Conspiracy theories
by Dave Banisar 18 Apr '93

18 Apr '93

RE: Press Blitz I have found from experience, with some success, that the best way to handle press if you to contact local press and present yourself as a local expert on the subject. This gives them a local connection for their stories. You should have apack ready to send them, including copies of the White House documents, and a 1 page fact sheet of your own pointing out the problems with the proposal. Present yourself as a local computer scientist who sees the deeper issues behind this proposal and wants to air them. The major national newspapers are already covering this but its the smaller local papers that most people read. Only a few million people total read the NY Times, Washinging Post etc. Thinks of the millions that read their local papers and get to them. If they respond, this will be killed. History of Clipper: As I mentioned before, Iwas at the NIST press Conference on Fri. They responded to a question by saying that they had been working on this for 4 years and had been implimenting it for 14 months. Suggestion for campaign name: Clip the Clipper! Mailing List: No CPSR, etc. were not involved as a cabal supporting this dingbat proposal. If you beliueve that then go back to reading your endless JFK/CIA/Mafia/aliens conspiracy theory books and let the rest of us go on living in the real world. They have put together a very slick electronic media blitz here, sending the proposal to every applicable newsgroup etc. Dave Banisar CPSR Washington Office

2 1

Hellman cogitates on the Clipper Chip
by jwarren＠autodesk.com 18 Apr '93

18 Apr '93

Received this on Saturday and got Marty's permission to repost it to 'punks. --jim ======

1 0

CLIP: Chip -- Modification?
by Doctor Zaphod 18 Apr '93

18 Apr '93

I havn't waded thru the entire stream of CypherPunks mail yet... but I thought I'd make a suggestion. If the clipper chip DOES in fact become widespread, in telephones, modems, whatever.. why don't we make an alternative chip [say.. based off the IDEA cypher and PGP keys] that uses the same pinouts as the Clipper chip. We, on the list, have been waiting for devices with the capability for encryption.. and it sounds as if ATT will be making it easier for us! Of course there might be some legal conflict with modifiying the devices.. and I think that's where our battle begins. --------------------------------------------------------------------- | DrZaphod | Stop, or I'll Encrypt! | | [AC/DC] / [DnA][HP] | Xcitement is Technology and Creativity | | [drzaphod(a)ncselxsi.uucp] | [Mind Police Censored] | --------------------------------------------------------------------- DrZaphod [AC/DC] / [DnA][HP] [drzaphod(a)ncselxsi.uucp] Technicolorized

1 0

IMPORTANT!
by hal＠alumni.cco.caltech.edu 18 Apr '93

18 Apr '93

Based on some of the suggestions I've seen here and on the net, I am inclined more to believe that there is no threat to make non Clipper cryptography illegal. The plan instead is to make it a de facto standard for all encrypted voice communications. You will notice in the AT&T press release posted here that AT&T is offering to release its technical information in order to allow this standardization to proceed. (As the release said, you need more than just a common encryption standard, you also need standardization on the voice encoding.) AT&T is obviously in bed with the government on this, and it doesn't really matter at this point why. It's a big company and the government can do a lot for it. AT&T is apparently determined to take whatever steps are necessary for this standardization to come about. As far as non-clipper encryption, I imagine the government will initially exert as much influence as it can to prevent any competing standard from getting a toehold. They have apparently waited until the chips were ready to deliver in quantity. AT&T is promising to release clipper phones later this year. It's doubtful that anyone else could even come up with a standard that soon, let alone get it into hardware (or firmware). If the standard does become established, it could be tough to defeat it. How easy is it going to be to sell a phone which is incompatible with everybody else's for secure communication? You'd have to buy one for everybody in your company or group who wanted to communicate. Then if they wanted to make a secure call to someone outside (say, a supplier or distributor) they wouldn't be able to do it. It would be a similar problem to the video phones. Why buy one when almost no one else has one and so you can hardly ever use it? Who will buy a Beta VCR today? An RCA non-laser video disk? Non-clipper encrypted phones may experience similar lack of success. I think this is their main strategy. If it doesn't work, they have a fallback before they would have to forbid encryption in the way we have feared. That is to forbid the sale of commercial devices with non-clipper encryption. You don't stop private individuals from making their own devices, you just make it illegal to sell them. There is precedent for this, I think, in the scanner business. You can't sell scanners capable of eavesdropping on cellular calls. But nothing stops you from building your own if you are an electronics whiz. (I am not expert on the legalities of scanner law. Someone please correct me if I am wrong here.) Notice that in their document they said that U.S. citizens do not have the right to unlimited-strength commercial encryption. I didn't pay much attention to the word "commercial" before, but now I think it is important. This would imply that their next step would be to ban only commercial implementations of cryptography. This way they can counter our civil-liberties arguments by saying that nothing stops anyone from encrypting his messages if he really wants to; he's doing it in the privacy of his own home, after all. But when he gets out in the commercial arena the government has many precedents for limiting what is bought and sold, the scanner laws being just one of many. I'm not sure how ominous such a world would be - clipper chips dominating the (small) encrypted phone market, no commercial competition, and only a few hobbyists with PC's and modems able to set up clumsy untappable conversations via modem-to-modem links. I might be able to talk to Tim May securely, but not to Mom and Dad. In a way, I can still have privacy, if I really want it. But it won't be available to most people. I wouldn't be surprised if something similar to this vision were the goal of those behind the clipper. Hal

1 0