- cypherpunks-legacy - lists.cpunks.org

IMPORTANT--WE WON
by Sandy 17 Apr '93

17 Apr '93

_________________________________________________________________ FROM THE VIRTUAL DESK OF SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FIRST, THE BAD NEWS--The government wants to control encryption. Though they are playing coy about it, it's clear that eventually they will try to ban "the good stuff." It's clear Zimmermann, and others, have gotten their attention. NOW, THE GOOD NEWS--I t d o e s n o t m a t t e r. The game is over. We won. The government may engage in holding actions, but it still doesn't matter. What we have here, is the State's pitiful attempt to make the best of a bad situation. This amazing "policy" announcement is a tacit admission of defeat. HOW CAN I BE SO SURE?--The cat is out of the bag. Free, mil spec data encryption is readily available to all. Within a year, equivalent voice encryption freeware will join it. There is no way the government can stuff the encryption cat back in the bag. They can pass their laws. We will do as we please--and they will help us. THEY WILL *HELP* US?--The Administration's plan will have one, unintended, result. It will give legitimacy to privacy through encryption. Legitimacy will beget usage. And usage will mean TRAFFIC. Our securely encrypted messages will be hidden in plain sight. Whispers in a wind tunnel. One digitally encrypted phone call sound just like another--no matter what algorithm is used. A PLOY FOR THE PARANOID--Still think the Secret Service is going to get you? No problem. Just *PRE-encrypt* your phone or data communications with your home-made encryption unit, before you re-encrypt it using the government approved model. ("Hey, I don't know why you couldn't use your back door key to eavesdrop on my secure phone. Sounds like a personal problem to me.") THE ELECTRONIC FRONTIER FOUNDATION IS RIGHT, TOO--Yes, we can rejoice because we won. But it is still important to continue the fight against the State's last gasps. Even when the government is in random-walk mode, it's still possible to get stepped on. They have lost, but they can still do us plenty of damage. We should continue to press them on all fronts to secure our victory. But never doubt it, W E H A V E W O N. S a n d y _________________________________________________________________ PLEASE RESPOND TO: ssandfort(a)attmail.com (except from CompuServe) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

No Subject
by nobody＠pmantis.berkeley.edu 17 Apr '93

17 Apr '93

With regard to the White House's attempt to force the "Clipper" on you: I guess the time has come for the Cypherpunks to break their 'political teeth'. This issue is squarely on point with the purpose of the cpunks and needs to be addressed. The best thinkers on these topics are on this list (as are many libertarian thinkers). The Cypherpunks have gotten a fair amount of media play as of late and I think those interested in privacy and security are frothing at the mouth. I know in general cpunks dont believe in the necessity for leaders, but leader'ship' is a different matter. I believe that there are people here with the knowledge to fight against this proposal. So, Cypherpunks, step to the political plate. > In the past, it has >been possible to preserve a government capability to conduct >electronic surveillance in furtherance of legitimate law >enforcement and national security interests, while at the same time >protecting the privacy and civil liberties of all citizens. Just some levity to start off with :-) >The Attorney General of the United States, or her representative, >shall request manufacturers ... I read this differently than does Tim. "shall" coupled with "request" actually equals ambiguity and seems not to compel anyone. Im sure that the language was meant to confuse though. >In making this decision, I do >not intend to prevent the private sector from developing, or the >government from approving, other microcircuits or algorithms that >are equally effective in assuring both privacy and a secure key- >escrow system. Well, the door does still appear to be open for private circuit development and a better escrow system (better?). This does lend credence to the opinion that this may just be a very forceful suggestion and not an order per se. >The Attorney General shall make all arrangements with appropriate >entities to hold the keys for the key-escrow microcircuits >installed in communications equipment. Gotta agree with Tim that this appears to be an incredibly obvious backdoor to all telecommunications equipment. This should be made clear in any public statements about this document. > The Attorney >General shall review for legal sufficiency the procedures by which >an agency establishes its authority to acquire the content of such >communications. OK. This might be the key to the downfall of this proposal. The Govt appears to be showing its weak hand here. They have either not thouroughly addressed the legal concerns or they are standing on shaky legal ground. I believe there could be a number of problems (legally speaking) with the proposal. Seperation of Powers, Commerce concerns, penumbra Right to Privacy, etc just to name a few. Well, I guess Im off to the library to research another interesting, yet inapplicable directly to my legal studies, topic. (As if I dont spend enough time in the library) I guess if she's gonna review the legal sufficiency there should be no problem with me 'parallel processing' that same information. > Further, the Attorney General >shall utilize funds from the Department of Justice Asset Forfeiture >Super Surplus Fund to effect this purchase. Surplus...what happened to the defecit? :^) In general I believe that this event calls for a public expression of intellectual disagreement. An assertion of the power of the ideas expressed on this list will put the Cypherpunks in the discourse of public policy. Obviously, it should be well thought out and expressed in the most positive way. Calm, cool, calculated response will gain the cpunks respect, a knee jerk, emotional response will only get our ideas ignored. If politics doesn't work there also appears to be an economic out. Creating REAL encryptive circuits whose keys are not held by the government but rather by the owner. Private enterprise and a result to our concerns for liberty appear amenable. So any hardware cypherpunk hacks, get out your tools. Finally, a simple analogy. The current state of the law does not require me to register the key to my home with a government agency so that they can gain access to my home in a more efficient way if they feel the need. I keep the key and the control (until they break down my door). In that case, the value is placed on my freedom, not the efficiency with which the police could access my private communications. There are reasons that search warrents were 'initially' difficult to acquire and reasons why it should be difficult to access my home (i.e. they must break down my door.) Those reasons dealt with the severity of encroachment upon my privacy and rights thereto. In fact, that is the reason given for the remaining formalistic requirements of the necessity of prior judicial consent for warrents. No, the judge does not ponder long and hard about whether to give the warrent. Rather, the purpose is to give the officers pause. The ritual is designed to make the parties involved at least ponder the severity of their actions. This proposal would only make invasions of our privacy easier to achieve and eliminate obstacles in the way of officers, giving them even less time to ponder the severity of their encroachment. //////////////////////////////////////////////////////////////////////////////// VOLTAIRE Studying the law, Finding the flaws, Creating a light, Out of the night! //////////////////////////////////////////////////////////////////////////////// Tim- Aren't we closer than 10 mins. to midnight???????

1 0

a cypherpunk's clipper reaction
by Eric Hughes 17 Apr '93

17 Apr '93

Fellows: I will, in the coming weeks have much more to say on the matter of this Clipper chip proposal. For now, however, I have only one thing to say. No compromises. Eric

1 0

white house blunder
by Timothy Newsham 17 Apr '93

17 Apr '93

Even though the white house proposal may seem bad it could be used to your advantage in some ways: swap keys with someone else... if serial number isnt sent in transmission this takes gives a big headache when they try to decrypt your stream. use another encryption before sending to clipper chip... this way everything looks normal, and if they are playing according to the rules (cross fingers) they dont know anything is fishy until they try to get a warrant and decrypt. First keys wont match. When they do find the correct key they'll decrypt and get a file encrypted in another system. This might be great for averting suspicion of using another crypto- system. Everyone will be using clipper, and your message will look like its from the clipper chip. It wont look like an RSA file or DES'ed voice or whatever. The chip gives you a opaque (hopefully) envelope to put things into.

1 0

White House Encryption idea
by treason＠gnu.ai.mit.edu 17 Apr '93

17 Apr '93

Well, this all sounds fine and dandy, but... 1) They are not passing out the algorithym, and I dont trust ANYONE to tell me its secure. I am not a cryptographer, so it wouldn't help any if they gave the code to me, but it just being out there for public perusal helps me to think it IS secure. I trust no payola. 2) It is very possible that the 'criminal' effort may be able to modify these devices so that there is no possiblility for the agencies to decrypt their trasmissions (If it IS truly secure with no backdoors or decyphering possibilities) in which case, it can only harm the law abiding. 3) It allows the government the ability to determine WHAT encryption method industry uses, and they should be able to have a choice. Those who understand this very misleading comment will understand, those who do not, will prolly never be able to. 4) No explanation of what the 'key' contents are composed of (numbers, letters, alphanum, characters, some odd cyphercode???) is even implied. 5) No explanation of how the key is propegated or if it will even be needed for the remote site is mentioned. How are the remote sites going to decypher your cyphersounds(text)? There was no mention of further releases in information...is this all we get? treason@gnu

2 1

Re: Key Registration and Big Brother--Time to Fight!
by George A. Gleason 17 Apr '93

17 Apr '93

Instead of a conference call in clear voice, how about doing it online from the various meetings, and encrypted? What would it take to set up a broadcast encryption system that will work in chat mode...? A conference call in clear voice is almost certain to be monitored, and I would bet that it would yield a whole lot more high-grade intelligence than we would usually expect: first of all, voices of all participants (for later use in voiceprint recognition surveillance), second, all the background discussions, and third, a lot of the kind of deliberation and working-through-things that ordinarily gets filtered out by the process of posting things to this list. Yes, they can theoretically send visitors to our meetings. But realistically this is more labor intensive and potentially risky than recording a conference call which has all the meetings on line. Let's not go leaving any huge holes, please...! -gg

1 0

Re: (fwd) White House Public Encryption Management Fact Sheet
by peb＠PROCASE.COM 17 Apr '93

17 Apr '93

>From: Peter Wayner <pcw(a)access.digex.com> >2) The system is vulnerable to simple phone swapping attacks Yes, that's when the it becomes necessary to register your phone and phone license with the government every year. Remember, "using a telephone is a privilage, not a right!" 8^) Nice way to charge license fees too! >From: gnu(a)toad.com (John Gilmore) >Subject: EFF crypto statement and press release > Does disclosure of keys to a third party waive an individual's Fifth Amendment > rights in subsequent criminal inquiries? This is a very important question and it gets to the heart of the matter. Paul E. Baclace peb(a)procase.com

1 0

The New Mykotronix phones...
by Peter Wayner 17 Apr '93

17 Apr '93

Okay, let's suppose that the NSA/NIST/Mykotronix Registered Key system becomes standard and I'm able to buy such a system from my local radio shack. Every phone comes with a built in chip and the government has the key to every phone call. I go and buy a phone and dutifully register the key. What's to prevent me from swapping phones with a friend or buying a used phone at a garage sale? Whooa. The secret registered keys just became unsynchronized. When the government comes to listen in, they only receive gobbledly-gook because the secret key registered under my name isn't the right one. That leads me to conjecture that: 1) The system isn't that secure. There are just two master keys that work for all the phones in the country. The part about registering your keys is just bogus. or 2) The system is vulnerable to simple phone swapping attacks like this. Criminals will quickly figure this out and go to town. In either case, I think we need to look at this a bit deeper. -Peter Wayner

3 2

Re: (fwd) White House Public Encryption Management Fact Sheet
by George A. Gleason 17 Apr '93

17 Apr '93

Re Big Brother proposal. The "asset forfeiture" mention isn't quite so ominous as suggested: what it seems to say is that the Atty General will procure (i.e. buy) encryption devices for use by law enforcement in their own secure communications (i.e. police radio and computer links), and "the funding to effect this purchase" will come from the "superfund" of money derived from existing asset forfeitures. In other words, smoke a joint, lose your house, and Uncle Sam sells the house to get money to buy more crypto gear for cops. I don't see an implication that crypto gear makers will be facing forfeiture for failing to comply with the "request" to incorporate key escrow. It appears that this is directed at first to establish the use of key escrow in government-related communications: "federal communications systems that process sensitive but unclassified information." So for instance, Ollie North's memos would be recoverable, and so on. But the real risk is that it will spread out to encompass any facility receiving government funding or contracts, i.e. the universities; and from there, widen so as to restrict other types of crypto from being used at those sites. So far it doesn't seem to restrict crypto on private microcomputers, though a widely accepted standard could eventually be written into law. The proposal specifically says it will allow other manufacturers to develop other approaches to key escrow systems. I think what the long-term plan might be, is to win acceptance for the idea of key escrow, and then require it. This isn't exactly a backdoor into your hardware; what it would allow would be for instance NSA to get your key and then read your communications as they occur. So your local hardware isn't storing anything in a different way or being remotely accessed or triggered, but your key is available elsewhere, at some approved facility. Now I'm guessing here, but what I think the way the crypto part of this has to work, is with a "device-specific" key and a "session"-type of key; where the first is what is escrowed, and the second is user-variable. Both are required to decrypt messages, and recovery of the second key would be relatively straightforward. Now you buy a modem or whatever, and it has a crypto chip in it, with a device-specific key that is registered along with the serial number of the device. So your purchase record has that serial number on it, and that's used to track the device key, which of course has been escrowed by the manufacturer before shipping the modem out. This would suggest that device keys would be relatively hard to crack, and therefore that some improvement in privacy would be possible by simply swapping the key chip in the device; and this would be easy enough with a black market in key escrow chips. In the mean time, from our end of it, someone oughta start working on steganography FAST. Spread spectrum designs are feasible. Slow is okay; the goal being to do anything that will render key escrow obsolete by making it impossible to tell when ciphertext (or for that matter any kind of data) is being sent. -gg

1 0

ietf-telnet-encryption.01.txt
by rclark＠nyx.cs.du.edu 17 Apr '93

17 Apr '93

Does anyone know why this Internet draft was deleted? I've sent a quick message to Internet-drafts(a)nri.reston.va.us to determine the reason. Will report. It sounds a little suspicious to me, though. Snag those copies of PGP while you can. Expect trouble in coming months. ---- Robert W. Clark rclark(a)nyx.cs.du.edu PGP signature available by mail or finger

2 1