- cypherpunks-legacy - lists.cpunks.org

No Subject
by Anonymous 17 Dec '03

17 Dec '03

xxxx is exactly right on this. Several years ago I posted to sci.crypt my "novel" idea for packing bits into the essentially inaudible "least significant bits" (LSBs) of digital recordings, such as DATs and CDs. Ditto for the LSBs in an 8-bit image or 24-bit color image. I've since seen this idea reinvented _several_ times on sci.crypt and elsewhere...and I'm willing to bet I wasn't the first, either (so I don't claim any credit). A 2-hour DAT contains about 10 Gbits (2 hours x 3600 sec/hr x 2 channels x 16 bits/sample x 44K samples/sec), or about 1.2 Gbytes. A CD contains about half this, i.e., about 700 Mbytes. The LSB of a DAT is 1/16th of the 1.2 Gbytes, or 80 Mbytes. This is a _lot_ of storage! A home-recorded DAT--and I use a Sony D-3 DAT Walkman to make tapes--has so much noise down at the LSB level--noise from the A/D and D/A converters, noise from the microphones (if any), etc.--that the bits are essentially random at this level. (This is a subtle, but important, point: a factory recorded DAT or CD will have predetermined bits at all levels, i.e., the authorities could in principle spot any modifications. But home-recorded, or dubbed, DATs will of course not be subject to this kind of analysis.) Some care might be taken to ensure that the statistical properties of the signal bits resemble what would be expected with "noise" bits, but this will be a minor hurdle. Adobe Photoshop can be used to easily place message bits in the "noise" that dominates things down at the LSB level. The resulting GIF can then be posted to UseNet or e-mailed. Ditto for sound samples, using the ideas I just described (but typically requiring sound sampling boards, etc.). I've done some experiments along these lines. This doesn't mean our problems are solved, of course. Exchanging tapes is cumbersome and vulnerable to stings. But it does help to point out the utter futility of trying to stop the flow of bits. --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP 2.0 and MailSafe keys by arrangement.

1 0

Revealing identities
by Anonymous 17 Dec '03

17 Dec '03

Johan, I haven't been paying close attention to the latest on the anonymity debate, so please tell me if the following has been raised before. In your message <9302260807.aa01498(a)penet.penet.FI> of Fri, 26 Feb 93 08:50:19 +0200 on the subject "Moral dilemma." to the cypherpunks list, you mentioned that >One rule is >that I *never* reveal the true identity of an anon user, While I believe that you should be able to use any policy you want for this sort of thing, I do not believe that both your server and this policy can survive together. Because you/the-server cannot censor the content of anonymous postings/mail (you lack the time, and knowledge of what is legal in every corner of the world), you can only withdraw someone's anonymous posting permission in response to complaints to something that they have already posted. I believe that eventually, someone will post something so damaging/incensing that sufficient pressure will be applied that either: the service cannot continue (e.g. disconnected from the network), or you will be forced to reveal or destroy the mappings between alias(es) and user(s). For example, on the cypherpunks list, the question of what would happen if someone claiming responsibility for the New York bombing posted through the anonymous server. Bodies in the US (from people providing parts of the Internet service through to political and criminal bodies such as the FBI/CIA/NSA) could easily apply very strong pressure. Unfortunately, I feel that this pressure will come sooner rather than later because there is nothing preventing people opposed to the anonymous service from making these postings merely to discredit your service. I think that there *MAY* be a way around this. I assume the reasons behind your non-disclosure policy are: i. You cannot decide which identities should be revealed. ii. Revealing an identity removes their anonymity from all of their previous postings, some of which may have had reason to be anonymous. For example, I think it "unjust" to reveal what someone wrote to alt.sex.abuse because they violated copyright or whatever in some other group. The second of these reasons could be avoided by permitting anonymous users to have a different alias for each posting that they make. This would increase the loading on the alias space and records of alias<->ID mappings. I can see no reason why you would need to reveal all of the aliases of one real identity. The decision of when an identity should be revealed could be left to a jury: If you receive a reasonable complaint about a posting (not just a flame, but something more significant such as copyright violation, libel, etc) then you would post this complaint to a group of anonymous jurors who decide on what action should be taken. The plaintiff and defendant could even argue their positions to the jury, and might advertise on a newsgroup asking for assistance from relevant groups (e.g. pro/anti-anonymity groups). The problem now is how to select the jury. Some factors are: i. The number of jurors influences the probability that the decision can be swayed because of the random composition of the jury. So one juror would be too few, 12 as used in orthodox courts might be reasonable, etc. ii. Jurors would not want to spend too much time on the case, so there should be an upper limit on the number of bytes transmitted by defendant and plaintiff, and the time span of the case. iii. The degree of "consensus" required for a decision. Perhaps 2/3 majority is OK, perhaps 75%. The larger the majority required, the less likely that the case will be swayed by the composition of the jury, but also the longer it would take to reach the decision. iv. The jury can't be composed just of users of the anonymous service because of their bias. Perhaps jurors could be selected at random from the names of people who have posted to the news in the past? v. Jurors would have to accept their position -- there's no use in having a juror who doesn't read the information passed to him/her. I feel that the problem of selecting a jury would be easier to solve than that of defending the anonymous service against the uproar that may result from some postings. With this judicial process, anonymous users would also be accountable for what they post. Some other issues would be i. What happens if the jury can't decide? ii. What sort of "punishment" is possible? Warning the person? Barring the person from anonymous posting? Revealing their identity to the necessary body? etc The idea is *VERY* rough at the moment, but perhaps it has some merit? As I see it, the good part for the anonymous service provider is that they do not have to participate in the process (apart from filtering trivial flaming cases from the judicial system), which will avoid claims of bias and lessens your already considerable load. Comments? Tim ---- 8< Cut Here 8< ---- Tim Moors __________________________________________________________ Australian Telecommunications Research Institute .-_!\ GPO Box U 1987 Email: tim(a)atri.curtin.edu.au / \ Perth, WA 6001 Phone: +61 9 351 3243 \_.-._/ Australia Fax: +61 9 351 3244 o "beLIEve" -- U2 Zoo TV Tour

1 0

No Subject
by Martin Hellman 17 Dec '03

17 Dec '03

Subject: Clipper Chip Most of you have seen the announcement in Friday's NY Times, etc. about NIST (National Institute of Standards & Technology) announcing the "Clipper Chip" crypto device. Several messges on the net have asked for more technical details, and some have been laboring under understandable misunderstandings given the lack of details in the news articles. So here to help out is your friendly NSA link: me. I was somewhat surprised Friday to get a call from the Agency which supplied many of the missing details. I was told the info was public, so here it is (the cc of this to Dennis Branstad at NIST is mostly as a double check on my facts since I assume he is aware of all this; please let me know if I have anything wrong): The Clipper Chip will have a secret crypto algorithm embedded in Silicon. Each chip will have two secret, 80-bit keys. One will be the same for all chips (ie a system-wide key) and the other will be unit specific. I don't know what NIST and NSA will call them, but I will call them the system key SK and unit key UK in this message. The IC will be designed to be extremely difficult to reverse so that the system key can be kept secret. (Aside: It is clear that they also want to keep the algorithm secret and, in my opinion, it may be as much for that as this stated purpose.) The unit key will be generated as the XOR of two 80-bit random numbers K1 and K2 (UK=K1+K2) which will be kept by the two escrow authorities. Who these escrow authorities will be is still to be decided by the Attorney General, but it was stressed to me that they will NOT be NSA or law enforcement agencies, that they must be parties acceptable to the users of the system as unbiased. When a law enforcement agency gets a court order, they will present it to these two escrow authorities and receive K1 and K2, thereby allowing access to the unit key UK. In addition to the system key, each user will get to choose his or her own key and change it as often as desired. Call this key plain old K. When a message is to be sent it will first be encrypted under K, then K will be encrypted under the unit key UK, and the serial number of the unit added to produce a three part message which will then be encrypted under the system key SK producing E{ E[M; K], E[K; UK], serial number; SK} When a court order obtains K1 and K2, and thence K, the law enforcement agency will use SK to decrypt all information flowing on the suspected link [Aside: It is my guess that they may do this constantly on all links, with or without a court order, since it is almost impossible to tell which links over which a message will flow.] This gives the agency access to E[M; K], E[K; UK], serial number in the above message. They then check the serial number of the unit and see if it is on the "watch list" for which they have a court order. If so, they will decrypt E[K; UK] to obtain K, and then decrypt E[M; K] to obtain M. I am still in the process of assessing this scheme, so please do not take the above as any kind of endorsement of the proposed scheme. All I am trying to do is help all of us assess the scheme more knowledgably. But I will say that the need for just one court order worries me. I would feel more comfortable (though not necessarily comfortable!) if two separate court orders were needed, one per escrow authority. While no explanation is needed, the following story adds some color: In researching some ideas that Silvio Micali and I have been kicking around, I spoke with Gerald Gunther, the constitutional law expert here at Stanford and he related the following story: When Edward Levi became Pres. Ford's attorney general (right after Watergate), he was visited by an FBI agent asking for "the wiretap authorizations." When Levy asked for the details so he could review the cases as required by law, the agent told him that his predecessors just turned over 40-50 blank, signed forms every time. Levi did not comply and changed the system, but the lesson is clear: No single person or authority should have the power to authorize wiretaps (or worse yet, divulging of personal keys). Sometimes he or she will be an Edward Levi and sometimes a John Mitchell. Martin Hellman ======== And, his permission to repost. PLEASE NOTE HIS "RESTRICTION." --jim =======

1 0

Re: Marty's 4/17 Clipper Chip post-to-many ...
by Martin Hellman 17 Dec '03

17 Dec '03

Jim, It is fine to post my previous message to cypherpunks if you also post this message with it in which: I ask recipients to be very sparse in their requesting further info from me or asking for comments on specific questions. By this posting I apologize for any messages I am unable to respond to. (I already spend too much time answering too much e-mail and am particularly overloaded this week with other responsibilities.) martin ========= Finally, there has been a significant reponse to this by a cryptoid well-known to all of us. Am seeking permission to repost it, also. --jim Incidentally, Marty sez he had no forewarning that Clipper was about to sail. The NY Times article blind-sided him about 11:30 Thursday night. Sounds like the government is really doing an outstanding job of careful, collaborative policy-making. [Danger! Novice gunslinger is shooting from the hip!] --jim

1 0

Re: Clipper Chip
by denning＠cs.cosc.georgetown.edu 17 Dec '03

17 Dec '03

I just had another conversation with NSA to clarify some of the features of Clipper. Please feel free to distribute this and my other messages on Clipper. The name of the encryption algorithm is "Skipjack." Martin Hellman had written and the serial number of the unit added to produce a three part message which will then be encrypted under the system key SK producing E{ E[M; K], E[K; UK], serial number; SK} To which I responded: My understanding is that E[M; K] is not encrypted under SK (called the "family key") and that the decrypt key corresponding to SK is held by law enforcement. Does anyone have first hand knowledge on this? I was correct in that E[M; K] is not encrypted under SK. However, Skipjack being a single-key system, there is, of course, not a separate decrypt key for the family key SK. The unit key, also called the "chip key," is generated from the serial number N as follows. Let N1, N2, and N3 be 64 bit blocks derived from N, and let S1 and S2 be two 80-bit seeds used as keys. Compute the 64-bit block R1 = E[D[E[N1; S1]; S2]; S1] (Note that this is like using the DES in triple encryption mode with two keys.) Similarly compute blocks R2 and R3 starting with N2 and N3. (I'm unlear about whether the keys S1 and S2 change. The fact that they're called seeds suggests they might.) Then R1, R2, and R3 are concatenated together giving 192 bits. The first 80 bits form K1 and the next 80 bits form K2. The remaining bits are discarded. The seeds S1 and S2 do not change. The whole process is performed on a laptop computer, and S1 and S2 are supplied by two independent people so that no one person knows both. The same S1 and S2 are used during an entire "programming session" to generate keys for a stream of serial numbers. Everything is discarded at the end (the computer could be thrown out if desired). The serial number is 30 bits and the values N1, N2, and N3 are formed by padding the serial number with fixed 34-bit blocks (separate padding for each value). The resulting keys K1 and K2 are output onto separate floppy disks, paired up with their serial number. Each pair is stored in a separate file. The floppy disks are taken away by two separate people on behalf of the two escrow agencies. Dorothy Denning denning(a)cs.georgetown.edu ====== >From eff.org!interesting-people-request(a)netcomsv.netcom.com Mon Apr 19 20:07:50 1993 Posted-Date: Mon, 19 Apr 1993 21:17:27 -0500 From: David Farber <farber(a)central.cis.upenn.edu> X-Sender: farber(a)linc.cis.upenn.edu Subject: More technical details -- Chipper To: interesting-people(a)eff.org (interesting-people mailing list) Personal note. Denning suggests such firms as " SRI, Rand, Mitre, the national labs (Sandia, LANL, Los Alamos), Treasury, GAO" as possible escrow organizations. I personally believe that firms which get their funding from the government are just too susceptible to pressure which we have seen historically. It would be best to use organizations that have a more arms length relationship with the government so everyone believes the escrows task is being performed properly. Dave From: smb(a)research.att.com (Steven Bellovin) Subject: More technical details Date: 19 Apr 93 13:43:46 GMT Here are some corrections and additions to Hellman's note, courtesy of Dorothy Denning. Again, this is reposted with permission. Two requests -- first, note the roles of S1 and S2. It appears to me and others that anyone who knows those values can construct the unit key. And the nature of the generation process for K1 and K2 is such that neither can be produced alone. Thus, the scheme cannot be implemented such that one repository generates the first half-key, and another generates the second. *That* is ominous. Second -- these postings are not revealed scripture, nor are they carefully-crafted spook postings. Don't attempt to draw out hidden meanings (as opposed to, say, the official announcements of Clipper). Leave Denning out of this; given Hellman's record of opposition to DES, which goes back before some folks on this newsgroup knew how to read, I don't think you can impugn his integrity. Oh yeah -- the folks who invented Clipper aren't stupid. If you think something doesn't make sense, it's almost certainly because you don't understand their goals. --Steve Bellovin ----- Date: Sun, 18 Apr 93 07:56:39 EDT From: denning(a)cs.georgetown.edu (Dorothy Denning) Subject: Re: Clipper Chip To: (a long list of folks) I was also briefed by the NSA and FBI, so let me add a few comments to Marty's message: The Clipper Chip will have a secret crypto algorithm embedded in The algorithm operates on 64-bit blocks (like DES) and the chip supports all 4 DES modes of operation. The algorithm uses 32 rounds of scrambling compared with 16 in DES. In addition to the system key, each user will get to choose his or her own key and change it as often as desired. Call this key plain old K. When a message is to be sent it will first be K is the session key shared by the sender and receiver. Any method (e.g., public key) can be used to establish the session key. In the AT&T telephone security devices, which will have the new chip, the key is negotiated using a public-key protocol. encrypted under K, then K will be encrypted under the unit key UK, and the serial number of the unit added to produce a three part message which will then be encrypted under the system key SK producing E{ E[M; K], E[K; UK], serial number; SK} My understanding is that E[M; K] is not encrypted under SK (called the "family key") and that the decrypt key corresponding to SK is held by law enforcement. Does anyone have first hand knowledge on this? I will also check it out, but this is 7am Sunday so I did not want to wait. The unit key will be generated as the XOR of two 80-bit random numbers K1 and K2 (UK=K1+K2) which will be kept by the two escrow The unit key, also called the "chip key," is generated from the serial number N as follows. Let N1, N2, and N3 be 64 bit blocks derived from N, and let S1 and S2 be two 80-bit seeds used as keys. Compute the 64-bit block R1 = E[D[E[N1; S1]; S2]; S1] (Note that this is like using the DES in triple encryption mode with two keys.) Similarly compute blocks R2 and R3 starting with N2 and N3. (I'm unlear about whether the keys S1 and S2 change. The fact that they're called seeds suggests they might.) Then R1, R2, and R3 are concatenated together giving 192 bits. The first 80 bits form K1 and the next 80 bits form K2. The remaining bits are discarded. authorities. Who these escrow authorities will be is still to be decided by the Attorney General, but it was stressed to me that they will NOT be NSA or law enforcement agencies, that they must be parties acceptable to the users of the system as unbiased. Marty is right on this and the FBI has asked me for suggestions. Please pass them to me along with your reasons. In addition to Marty's criteria, I would add that the agencies must have an established record of being able to safeguard highly sensitive information. Some suggestions I've received so far include SRI, Rand, Mitre, the national labs (Sandia, LANL, Los Alamos), Treasury, GAO. When a court order obtains K1 and K2, and thence K, the law enforcement agency will use SK to decrypt all information flowing on the suspected link [Aside: It is my guess that they may do this constantly on all links, with or without a court order, since it is almost impossible to tell which links over which a message will flow.] My understanding is that there will be only one decode box and that it will be operated by the FBI. The service provider will isolate the communications stream and pass it to the FBI where it will pass through the decode box, which will have been keyed with K. for "the wiretap authorizations." When Levy asked for the details so he could review the cases as required by law, the agent told him that his predecessors just turned over 40-50 blank, signed forms every time. Levi did not comply and changed the system, but the lesson is clear: No single person or authority should have the power to authorize wiretaps No single person does, at least for FBI taps. After completing a mound of paperwork, an agent must get the approval of several people on a chain that includes FBI legal counsel before the request is even taken to the Attorney General for final approval. Dorothy Denning

1 0

Re: Marty's 4/17 Clipper Chip post-to-many & Dorothy's 4/8 response
by denning＠cs.georgetown.edu 17 Dec '03

17 Dec '03

Fine with me. Post anywhere. Dorothy =====

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Based on previous experience, a couple more will appear overnight. Hal Finney hfinney(a)shell.portal.com

1 0

on line books (not just in risk mgmt)
by Tapen Sinha 17 Dec '03

17 Dec '03

If you are looking for information on new books, how to buy them (on line!) and review of these books, there is a neat way to do it on internet: telnet books.com if the above does not work on your machine, try telnet 192.148.240.9 It will ask you a bunch of questions (like your name and address) and then you can look at info on books by author, subject... You can look at reviews of those books too. You can order books by email even (have your credit card handy)! It can be quite useful. A word of caution: there are some unhappy users out there who claim that they got billed for books they did not order. tapen_sinha(a)macmail.bond.edu.au

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Yes, I remember that now. My interpretation, though, was that with the bank's help you could tell when a coin had been re-used. This could impair the anonymity of the cash. Generally in the analysis of these proto- cols one wants anonymity even if the bank and the other participants collude. That is the whole point of cryptographic (non-transferable) cash, after all; otherwise the bank could just use the "Poor Man's Cash" idea which Tim May suggested here last year and just issue cash in the form of magic numbers with no blinding or digital sigs. Hal

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

I read this paper some time ago. Couldn't the cash still be detected as having belonged to the original owner even after you have transferred it? If so, then the other requirement is that you must transfer it anonymously, otherwise they can still get back to you. An example would be if you are doing something which the government doesn't like, such as shipping tracts advocating egalitarianism to a country with explicitly racist policies. The government might be able to put pressure on some members of the organization and use this (in effect) "marked money" to find the others. If you pass the money on to someone else, but they know it came from you, and then the government comes to them, determines that this is "dirty money" (which was given to the threatening egalitarians) they can say "who did you get this from" and your jig is up. Hal

1 0