- cypherpunks-legacy - lists.cpunks.org

Archives, FAQ, and Why Things are the Way they Are
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

(This message has two parts. First, a discussion of archives, the FAQ, etc. Second, why encryption and remailers have been such successes and why things like digicash and other more exotic protocols have not.) I received half a dozen requests for ftp posting of articles, for archive sites, etc. This was in response to my comment about "golden oldies." We are in a tower of Babel these days. Dozens of computer platforms, from mainframes to workstations to Macs to Windows to Amigas. Dozens of mail programs (hence the fragmented support for something so basic as PGP), dozens of newsreaders, dozens of etc. The point: There is no easy solution to the problem of how newcomers can come up to speed on this list. Some miscellaneous points: * Yes, a FAQ would help. I am working on one. A long one, as is my wont. I hope to have a version out soon for comments and further submissions. I expect to either put it up for ftp at my site, or at the soda/csuu(?) site, or to just mail it to folks who request to be early commenters (I don't want the early versions ricocheting through cyberspace). * However, many people are demonstrably unwilling or unable to read the sci.crypt FAQ (else why some of the questions we get?) or to acquire Schneier. ("What's Schneier?" is one of the FUQs--Frequently Unanswered Questions.) * My best articles (in my opinion) and the best articles of others are scattered in 200 folders/directories, arranged thematically. I use Eudora's sorting capabilities to sort the mail into topics I think are related (such as Crypto/Technical/One Time Pads). Then I index the articles with "On Location," which allows me to pull up each article that has key words, such as "uranium" anywhere in the message. My own personal research tool. I mention this because I have no plans to collect these articles (either mine or those of others) and put them up for ftp access. Just too much work for too little gain. * Newcomers should be patient. Read the list for a while. I notice that one newcomer has announced that he is leaving the list after 3 days (!!) because his question on analog encryption went unanswered. Oh well. * The "Cypherpunks Archives" comes up from time to time. While we all have our own personal archives (I have 40 MB of Eudora files devoted more or less to Cypherpunks), many believe a browsable archive of _all_ posts would be nice. - this has some downsides: inspection by prosecutors and the like for seditious, infringement-inducing posts, etc. (Yes, they could subscribe and see much the same things, but making a browsable site accessible to one and all seems risky, given the political climate.) Also, the 50 or 100 MB (rough estimate) of Cypherpunk mail would be unreadable except in dribbles and dabs. (The Bible is only 10 MB!) - and recall that Cypherpunks has no budget, no organized structure, and no means of accomplishing such goals as making archives available except insofar as the volunteer efforts of folks like Hugh Daniel and Eric Hughes go. And the toad.com machine is John Gilmore's personal machine, for which we should be thankful we have any access to at all. - a real archive, maintained by real people, would require time commitments and budgetary commitments I don't see materializing anytime soon. * Meanwhile, we face the "tower of Babel." Only text messages, like this one, cut across all systems, all mailers, all readers, and can be encrypted (into _other_ text blocks, which is why some interoperability exists at all). Many things that are "possible" in the malleable and Protean world of computers simply never gets done. For while many things are "possible," time and energy limits mean these things don't get done. To the Unix jocks who send me their idea of helpful messages, suggesting that I use MIME-compliant agents and HTML URLs for the FAQ (or somesuch...), or that a few pages of perl would fix these problems....thanks, but no thanks! (I get a fair number of messages suggesting that my complaints about foo would vanish if I gave up the Macintosh and adopted the One True Way, be it BSD, or XWindow, or perl, or whatever.) (I do have access to "lynx," a stunning character-based form of Mosaic, and I've been cruising around webspace with this. But I intend to distribute the FAQ as a simple text doc, not as a WWW/Mosaic/HTML/URL/lynx thingamajig. I know this will be disappointing to some fraction of you, but we can't all be pioneers with arrows in our backs. I actually have some expectation that WWW and Mosaic are the Next Big Thing, and that groups like our list will eventually migrate to webspace, with Cypherpunks being a virtual meeting place in webspace. But not in the next year or two.) AND NOW FOR SOMETHING COMPLETELY DIFFERENT,... One final word: My point about only the text block being the lingua franca of e-mail and the Internet (with a few images and sound files gaining strength) is an important clue to what works and what doesn't work in the world of crypto: * simple encryption works because everybody conceptually understands the concept of the encrypted message, which remains a text block. * remailers have worked for the same reason: everybody understands the idea of readdressing a letter, and the underlying data structure for the system remains a text block. * other protocols, like digicash, reputation servers, anonymous markets, and so on, have languished because of the tower of Babel effect--too many layers of protocol communication, negotiation, and cross-platform incompatibilities. And the "semantics" of these protocols are far from clear. (Try playing the roles of Banker, Customer, and Shop in a 3-entity digital cash protocol, with messages, signatures, blinded signatures, and "money objects" flowing back and forth. It gets confusing, even to those who've pored over the Chaum papers. Now try to _automate_ the protocol to run with little human intervention on a mix of platforms, e-mail systems, etc. This is the "protocol problem" that I happen to think needs a _lot_ more work. A big C or perl problem will not necessarily be the solution.) So, our early successes (use of encryption and remailers) is not too surprising, and that's why these successes came early on. What's next is a much harder problem. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

NSA Chief Counsel in Wired, to appear on AOL
by Richard Johnson 17 Dec '03

17 Dec '03

The guy in charge of marginalizing crypto users and privacy seekers for the NSA, Stuart Baker, tries his hand at logical arguments with a minimum of name-calling. Do his arguments stand up? Not really. Note how he avoids the issue of how easy it's getting for authorities to do 'drift-net' fishing - trotting out the tired old 'no new capabilities' line. He also seems to believe that requiring court authorization for wiretaps provides good protection against their abuse (NSA has its own pet court). ------- Forwarded Message Copyright and distribution policy attached to the end of document. FYI. X-within-URL: http://www.wired.com/Etext/2.06/Features/nsa.clipper.html NSA'S CHIEF COUNSEL TO APPEAR ONLINE Stewart A. Baker, Chief Counsel for the National Security Agency and featured writer in WIRED 2.06 will host a Q&A session on the Clipper Chip. He will appear on America Online in Center Stage (from AOL type keyword: "center stage") on Thursday May 26, 1994, from 7-9 p.m. EST. Baker is the NSA's top lawyer and supports the Clipper Initiative. He worked briefly as Deputy General Counsel of the Education Department under President Jimmy Carter. His article "Don't Worry Be Happy" refutes seven myths of key escrow encryption and is a WIRED Exclusive. _________________________________________________________________ DON'T WORRY BE HAPPY Why Clipper Is Good For You By Stewart A. Baker, Chief Counsel for the NSA _________________________________________________________________ With all the enthusiasm of Baptist ministers turning their Sunday pulpits over to the Devil, the editors of WIRED have offered me the opportunity to respond to some of the urban folklore that has grown up around key escrow encryption -- also known as the Clipper Chip. Recently the Clinton administration has announced that federal agencies will be able to buy a new kind of encryption hardware that is sixteen million times stronger than the existing federal standard known as DES. But this new potency comes with a caveat. If one of these new encryption devices is used, for example, to encode a phone conversation that is subject to a lawful government wiretap, the government can get access to that device's encryption keys. Separate parts of each key are held by two independent "escrow agents," who will release keys only to authorized agencies under safeguards approved by the attorney general. Private use of the new encryption hardware is welcome but not required. That's a pretty modest proposal. Its critics, though, have generated at least seven myths about key escrow encryption that deserve answers. MYTH NUMBER ONE: Key escrow encryption will create a brave new world of government intrusion into the privacy of Americans. Opponents of key escrow encryption usually begin by talking about government invading the privacy of American citizens. None of us likes the idea of the government intruding willy-nilly on communications that are meant to be private. But the key escrow proposal is not about increasing government's authority to invade the privacy of its citizens. All that key escrow does is preserve the government's current ability to conduct wiretaps under existing authorities. Even if key escrow were the only form of encryption available, the world would look only a little different from the one we live in now. In fact, it's the proponents of widespread unbreakable encryption who want to create a brave new world, one in which all of us -- crooks included -- have a guarantee that the government can't tap our phones. Yet these proponents have done nothing to show us that the new world they seek will really be a better one. In fact, even a civil libertarian might prefer a world where wiretaps are possible. If we want to catch and convict the leaders of criminal organizations, there are usually only two good ways to do it. We can "turn" a gang member -- get him to testify against his leaders. Or we can wiretap the leaders as they plan the crime. I once did a human rights report on the criminal justice system in El Salvador. I didn't expect the Salvadorans to teach me much about human rights. But I learned that, unlike the US, El Salvador greatly restricts the testimony of "turned" co-conspirators. Why? Because the co-conspirator is usually "turned" either by a threat of mistreatment or by an offer to reduce his punishment. Either way, the process raises moral questions -- and creates an incentive for false accusations. Wiretaps have no such potential for coercive use. The defendant is convicted or freed on the basis of his own, unarguable words. In addition, the world will be a safer place if criminals cannot take advantage of a ubiquitous, standardized encryption infrastructure that is immune from any conceivable law enforcement wiretap. Even if you're worried about illegal government taps, key escrow reinforces the existing requirement that every wiretap and every decryption must be lawfully authorized. The key escrow system means that proof of authority to tap must be certified and audited, so that illegal wiretapping by a rogue prosecutor or police officer is, as a practical matter, impossible. MYTH NUMBER TWO: Unreadable encryption is the key to our future liberty. Of course there are people who aren't prepared to trust the escrow agents, or the courts that issue warrants, or the officials who oversee the system, or anybody else for that matter. Rather than rely on laws to protect us, they say, let's make wiretapping impossible; then we'll be safe no matter who gets elected. This sort of reasoning is the long-delayed revenge of people who couldn't go to Woodstock because they had too much trig homework. It reflects a wide -- and kind of endearing -- streak of romantic high-tech anarchism that crops up throughout the computer world. The problem with all this romanticism is that its most likely beneficiaries are predators. Take for example the campaign to distribute PGP ("Pretty Good Privacy") encryption on the Internet. Some argue that widespread availability of this encryption will help Latvian freedom fighters today and American freedom fighters tomorrow. Well, not quite. Rather, one of the earliest users of PGP was a high-tech pedophile in Santa Clara, California. He used PGP to encrypt files that, police suspect, include a diary of his contacts with susceptible young boys using computer bulletin boards all over the country. "What really bothers me," says Detective Brian Kennedy of the Sacramento, California, Sheriff's Department, "is that there could be kids out there who need help badly, but thanks to this encryption, we'll never reach them." If unescrowed encryption becomes ubiquitous, there will be many more stories like this. We can't afford as a society to protect pedophiles and criminals today just to keep alive the far-fetched notion that some future tyrant will be brought down by guerrillas wearing bandoleers and pocket protectors and sending PGP-encrypted messages to each other across cyberspace. MYTH NUMBER THREE: Encryption is the key to preserving privacy in a digital world. Even people who don't believe that they are likely to be part of future resistance movements have nonetheless been persuaded that encryption is the key to preserving privacy in a networked, wireless world, and that we need strong encryption for this reason. This isn't completely wrong, but it is not an argument against Clipper. If you want to keep your neighbors from listening in on your cordless phone, if you want to keep unscrupulous competitors from stealing your secrets, even if you want to keep foreign governments from knowing your business plans, key escrow encryption will provide all the security you need, and more. But I can't help pointing out that encryption has been vastly oversold as a privacy protector. The biggest threats to our privacy in a digital world come not from what we keep secret but from what we reveal willingly. We lose privacy in a digital world because it becomes cheap and easy to collate and transmit data, so that information you willingly gave a bank to get a mortgage suddenly ends up in the hands of a business rival or your ex-spouse's lawyer. Restricting these invasions of privacy is a challenge, but it isn't a job for encryption. Encryption can't protect you from the misuse of data you surrendered willingly. What about the rise of networks? Surely encryption can help prevent password attacks like the recent Internet virus, or the interception of credit card numbers as they're sent from one digital assistant to another? Well, maybe. In fact, encryption is, at best, a small part of network security. The real key to network security is making sure that only the right people get access to particular data. That's why a digital signature is so much more important to future network security than encryption. If everyone on a net has a unique identifier that others cannot forge, there's no need to send credit card numbers -- and so nothing to intercept. And if everyone has a digital signature, stealing passwords off the Net is pointless. That's why the Clinton administration is determined to put digital signature technology in the public domain. It's part of a strategy to improve the security of the information infrastructure in ways that don't endanger government's ability to enforce the law. MYTH NUMBER FOUR: Key escrow will never work. Crooks won't use it if it's voluntary. There must be a secret plan to make key escrow encryption mandatory. This is probably the most common and frustrating of all the myths that abound about key escrow. The administration has said time and again that it will not force key escrow on manufacturers and companies in the private sector. In a Catch-22 response, critics then insist that if key escrow isn't mandated it won't work. That misunderstands the nature of the problem we are trying to solve. Encryption is available today. But it isn't easy for criminals to use; especially in telecommunications. Why? Because as long as encryption is not standardized and ubiquitous, using encryption means buying and distributing expensive gear to all the key members of the conspiracy. Up to now only a few criminals have had the resources, sophistication, and discipline to use specialized encryption systems. What worries law enforcement agencies --what should worry them -- is a world where encryption is standardized and ubiquitous: a world where anyone who buys an US$80 phone gets an "encrypt" button that interoperates with everyone else's; a world where every fax machine and every modem automatically encodes its transmissions without asking whether that is necessary. In such a world, every criminal will gain a guaranteed refuge from the police without lifting a finger. The purpose of the key escrow initiative is to provide an alternative form of encryption that can meet legitimate security concerns without building a web of standardized encryption that shuts law enforcement agencies out. If banks and corporations and government agencies buy key escrow encryption, criminals won't get a free ride. They'll have to build their own systems -- as they do now. And their devices won't interact with the devices that much of the rest of society uses. As one of my friends in the FBI puts it, "Nobody will build secure phones just to sell to the Gambino family." In short, as long as legitimate businesses use key escrow, we can stave off a future in which acts of terror and organized crime are planned with impunity on the public telecommunications system. Of course, whenever we say that, the critics of key escrow trot out their fifth myth: MYTH NUMBER FIVE: The government is interfering with the free market by forcing key escrow on the private sector. Industry should be left alone to develop and sell whatever form of encryption succeeds in the market. In fact, opponents of key escrow fear that businesses may actually prefer key escrow encryption. Why? Because the brave new world that unreadable encryption buffs want to create isn't just a world with communications immunity for crooks. It's a world of uncharted liability. What if a company supplies unreadable encryption to all its employees, and a couple of them use it to steal from customers or to encrypt customer data and hold it hostage? As a lawyer, I can say it's almost certain that the customers will sue the company that supplied the encryption to its employees. And that company in turn will sue the software and hardware firms that built a "security" system without safeguards against such an obvious abuse. The only encryption system that doesn't conjure up images of a lawyers' feeding frenzy is key escrow. But there's a second and even more compelling reason why the key escrow initiative can't fairly be characterized as interfering with private enterprise: The encryption market has been more or less created and sustained by government. Much of the market for encryption devices is in the public sector, and much of the encryption technology now in widespread use in the private sector was funded, perfected, or endorsed by the federal government. And not by accident, either. Good encryption is expensive. It isn't just a matter of coming up with a strong algorithm, although testing the strength of an algorithm can be enormously time-consuming. The entire system must be checked for bugs and weaknesses, a laborious and unglamorous process. Generally, only the federal government has been willing to pay what it costs to develop secure communications gear. That's because we can't afford to have our adversaries reading our military and diplomatic communications. That's led to a common pattern. First, the government develops, tests, or perfects encryption systems for itself. Then the private sector drafts along behind the government, adopting government standards on the assumption that if it's good enough for the government's information, it's good enough to protect industry's. As encryption technology gets cheaper and more common, though, we face the real prospect that the federal government's own research, its own standards, its own purchases will help create the future I described earlier -- one in which criminals use ubiquitous encryption to hide their activities. How can anyone expect the standard-setting arms of government to use their power to destroy the capabilities of law enforcement -- especially at a time when the threat of crime and terror seems to be rising dramatically? By adopting key escrow encryption instead, the federal government has simply made the reasonable judgment that its own purchases will reflect all of society's values, not just the single-minded pursuit of total privacy. So where does this leave industry, especially those companies that don't like either the 1970s-vintage DES or key escrow? It leaves them where they ought to be -- standing on their own two feet. Companies that want to develop and sell new forms of unescrowed encryption won't be able to sell products that bear the federal seal of approval. They won't be able to ride piggyback on federal research efforts. And they won't be able to sell a single unreadable encryption product to both private and government customers. Well, so what? If companies want to develop and sell competing, unescrowed systems to other Americans, if they insist on hastening a brave new world of criminal immunity, they can still do so -- as long as they're willing to use their own money. That's what the free market is all about. Of course, a free market in the US doesn't mean freedom to export encryption that may damage US national security. As our experience in World War II shows, encryption is the kind of technology that wins and loses wars. With that in mind, we must be careful about exports of encryption. This isn't the place for a detailed discussion of controls, but one thing should be clear: They don't limit the encryption that Americans can buy or use. The government allows Americans to take even the most sophisticated encryption abroad for their own protection. Nor do controls require that software or hardware companies "dumb down" their US products. Software firms have complained that it's inconvenient to develop a second encryption scheme for export, but they already have to make changes from one country to the next -- in language, alphabet, date systems, and handwriting recognition, to take just a few examples. And they'd still have to develop multiple encryption programs even if the US abolished export controls, because a wide variety of national restrictions on encryption are already in place in countries from Europe to Asia. MYTH NUMBER SIX: The National Security Agency is a spy agency; it has no business worrying about domestic encryption policy. Since the National Security Agency has an intelligence mission, its role in helping to develop key escrow encryption is usually treated as evidence that key escrow must be bad security. In reality, though, NSA has two missions. It does indeed gather intelligence, in part by breaking codes. But it has a second, and oddly complementary, mission. It develops the best possible encryption for the US government's classified information. With code breakers and code makers all in the same agency, NSA has more expertise in cryptography than any other entity in the country, public or private. It should come as no surprise, therefore, that NSA had the know- how to develop an encryption technique that provides users great security without compromising law enforcement access. To say that NSA shouldn't be involved in this issue is to say the government should try to solve this difficult technical and social problem with both hands tied behind its back. MYTH NUMBER SEVEN: This entire initiative was studied in secret and implemented without any opportunity for industry or the public to be heard. This is an old objection, and one that had some force in April of 1993, when the introduction of a new AT&T telephone encryption device required that the government move more quickly than it otherwise would have. Key escrow was a new idea at that time, and it was reasonable for the public to want more details and a chance to be heard before policies were set in concrete. But since April 1993, the public and industry have had many opportunities to express their views. The government's computer security and privacy advisory board held several days of public hearings. The National Security Council met repeatedly with industry groups. The Justice Department held briefings for congressional staff on its plans for escrow procedures well in advance of its final decision. And the Commerce Department took public comment on the proposed key escrow standard for 60 days. After all this consultation, the government went forward with key escrow, not because the key escrow proposal received a universally warm reception, but because none of the proposal's critics was able to suggest a better way to accommodate society's interests in both privacy and law enforcement. Unless somebody comes up with one, key escrow is likely to be around for quite a while. That's because the only alternative being proposed today is for the government to design or endorse encryption systems that will cripple law enforcement when the technology migrates -- as it surely will -- to the private sector. And that alternative is simply irresponsible. For more information on the Clipper standard you can access WIRED's Clipper archive via the following WIRED Online services. * WIRED Infodroid e-mail server: Send e-mail to infodroid(a)wired.com containing the words "send clipper/index" on a single line inside the message body. * WIRED Gopher: Gopher to gopher.wired.com and select "Clipper Archive." * WIRED on World Wide Web: http://www.wired.com select "Clipper Archive." * WIRED on America Online: The keyword is WIRED. * WIRED on the Well: Type "go wired" from any "OK" prompt. _________________________________________________________________ Stewart A. Baker is the National Security Agency's top lawyer. He worked briefly as Deputy General Counsel of the Education Department under President Jimmy Carter, and he practiced international law at Steptoe & Johnson, in Washington, DC. He has been at the NSA since 1992. _________________________________________________________________ WIRED Online Copyright Notice Copyright 1993,4 Ventures USA Ltd. All rights reserved. This article may be redistributed provided that the article and this notice remain intact. This article may not under any circumstances be resold or redistributed for compensation of any kind without prior written permission from Wired Ventures, Ltd. If you have any questions about these terms, or would like information about licensing materials from WIRED Online, please contact us via telephone (+1 (415) 904 0660) or email (info(a)wired.com) WIRED and WIRED Online are trademarks of Wired Ventures, Ltd. ------- End of Forwarded Message

3 2

From Todays' RISKS column
by dat＠ebt.com 17 Dec '03

17 Dec '03

I'm sending this because of the first item, but thought the rest were relevant also, although I would assume that most c'p'ers would read comp.risks anyway... If you haven't seen it, be sure to check out the piece by EFFector Online 07.08 and Digital Media, "Ever Feel Like You're Being Watched? You Will..." -- see below for details... ... from: RISKS-LIST: RISKS-FORUM Digest Tuesday 10 May 1994 Volume 16 : Issue 04 ---------------------------------------------------------------------- Date: 06 May 94 00:06:10 -0500 From: Dave.Leibold(a)f730.n250.z1.fidonet.org (Dave Leibold) Subject: Secret elevator codes baffle Metro Toronto government An article in _The_Toronto_Star_ on 5 May 1994 described secret codes which are necessary to maintain elevators at Metro Hall, the building which houses Metro Toronto municipal council and services. The elevators, made and maintained by Schindler Elevator Corp., require secret password codes in order to maintain them. This means that only Schindler staff can maintain the Metro Hall lifts, and as such forced Metro Council to award a 10 year contract of $3.5 million to Schindler. Meanwhile, Metro is also suing the building's developer, Marathon Realty, to try to get the codes. Without the passwords, elevator maintenance contracts cannot be given to a competing firm. Metro Councillor Howard Moscoe wanted the Council to issue a $10 000 reward to the first person to successfully crack Schindler's Code. This motion probably didn't get approval. David Leibold Fidonet 1:250/730 dave.leibold(a)f730.n250.z1.fidonet.org ------------------------------ Date: 09 May 94 06:31:56 EDT From: "Mich Kabay [NCSA]" <75300.3232(a)CompuServe.COM> Subject: Dartmouth prof spoofed Here is some old news that was new to me: According to the _Dartmouth Life_ newsletter (Feb 1994--I'm just clearing up my in basket today), an article appeared in _The New York Times_ on 94.01.05 entitled "Confronting changing ethics of the computer age." The unsigned article begins, "Hanover, N.H. -- Somebody in Prof. David Becker's course on Latin American politics did not want to take the midterm exam, so he or she used Dartmouth's innovative electronic mail network to impersonate a department secretary and cancel the test. "At 11 o'clock on the night before the test in the Government 49 class, a message flashed on students' computer screens. Because of a family emergency, the message said, Professor Becker would be unable to administer the midterm." The article explains that half the class understandably failed to show up for the test. No one has been identified yet as the culprit. The rest of the article talks about the extensive electronic mail system on campus. One of the key concerns of the unregulated network is the rapid spread of rumours: "Late in August computer flashed an account of a woman being raped while jogging near campus. The message was intended as a warning, but there had been no rape." The Hanover police department were swamped with calls. The Chief of Police now has his own electronic mail account to try to squelch rumours. M. E. Kabay, Ph.D. (Dartmouth '76) / Dir Educn / Natl Computer Security Assn. ------------------------------ Date: Mon, 9 May 1994 18:04:54 +0100 From: pcl(a)foo.oucs.ox.ac.uk (Paul C Leyland) Subject: Re: Bellcore cracks 129-digit RSA encryption code (RISKS-16.03) > predicted would take "40 quadrillion years" to break. ... > This mathematically arduous task was accomplished in eight months by > 600 volunteers in 24 countries who used their organizations' spare > computing capacity. ... There are two risks, one amusing. Ron Rivest now regrets ever making that 40 quadrillion years estimate. It was silly when he made it; his papers in the scientific literature from that era give estimates which are within an order of magnitude of how much computation we actually used. From those estimates, and the observation that way back then it wasn't feasible to hook together hundreds of computers, we can deduce that a late 70's supercomputer using the best algorithms available then would have taken a few decades, maybe a century. Certainly much less than the 40 quadrillion years. The risk is: making predictions about the runtime of computer programs can sometimes make you look silly 8-) The other risk is more serious. RSA is widely used to protect commercially significant information. 512-bit keys are widely used for this. Most, if not all, smart-card implementations are restricted to 512-bit keys. RSA-129 has 425 bits. I estimate (taking a risk 8-) that 512-bit keys are only about 20 times harder to break than 425-bit keys. Readers are left to draw their own conclusions. However, it is not by chance that I have a 1024-bit PGP key. Oh yes, as Arjen Lenstra had pointed out: if you had used RSA-129 as the modulus in a digital signature for a 15-year mortgage, you would have been cutting it pretty fine. It is the use of RSA for long-lived signatures which needs to be examined with a very critical eye. Paul Leyland (one of four RSA-129 project coordinators) ------------------------------ Date: Fri, 6 May 1994 02:45:26 +0200 From: Dik.Winter(a)cwi.nl Subject: Re: Bellcore cracks 129-digit RSA encryption code Perhaps because there is no risk beyond the known ones? Bob Silverman of MITRE (well known in number factoring circles) has publicly predicted already some time ago that it would require about 5000 MIPS years to factor the number. Reasonably close to the actual figure. That the team was led by Bell Communications Research is untrue. It is a team led by four people from Bellcore (Arjen Lenstra), MIT (Derek Atkins), Iowa State University (Michael Graff) and Oxford University (Paul Leyland). dik t. winter, cwi, kruislaan 413, 1098 sj amsterdam, nederland, +31205924098 home: bovenover 215, 1025 jn amsterdam, nederland; e-mail: dik(a)cwi.nl ------------------------------ Date: Thu, 5 May 94 20:02 PDT From: paulb(a)teleport.com (Paul Buder) Subject: Re: Bellcore cracks 129-digit RSA encryption code (RISKS-16.03) I've heard this 40 quadrillion years figure a couple of times now and I find it odd. Is that what the Scientific American said? I have the original document from MIT's Laboratory for Computer Science. It's titled "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems" by Ronald Rivest, Adi Shamir, and Len Adleman, April 1977. I can't do superscripting with vi so 10 10th means 10 to the 10th power. It has the following table in it: Digits Number of Operations Time =================================================== 50 1.4 X 10 10th 3.9 hours 75 9.0 X 10 12th 104 days 100 2.3 X 10 15th 73 years 200 1.2 X 10 23rd 3.8 X 10 9th years 300 1.5 X 10 29th 4.8 X 10 15th years 500 1.3 X 10 39th 4.2 X 10 25th years 200 digits was supposed to take 3.8 trillion years and 100 a mere 73. So where does the 40 quadrillion figure come from? paulb(a)teleport.COM Not affiliated with teleport. ------------------------------ Date: 9 May 1994 15:26:52 GMT From: daugher(a)cs.tamu.edu(Walter C. Daugherity) Subject: White House May Issue National ID Cards >From Prodigy 5/9/94: White House May Issue National ID Cards The Clinton administration is working on a national ID card that every American would need in order to interact with any federal agency, reports Digital Media: A Seybold Report, a computer industry newsletter based in Media, Pa. The so-called U.S. Card would be issued to citizens by the Postal Service. It would be issued as a "smart card," with its own internal CPU, or as a plug-in "PCMCIA" card with megabytes of built-in memory. Administration approval of the plan "could come at any time," states the newsletter. Walter C. Daugherity daugher(a)cs.tamu.edu uunet!cs.tamu.edu!daugher Texas A & M University, College Station, TX 77843-3112 DAUGHER@TAMVENUS [Several folks sent me Mitch's piece from EFFector Online 07.08, and Digital Media, "Ever Feel Like You're Being Watched? You Will..." However, I cannot run it in RISKS because of its copyright notice. Contact Mitch Ratcliffe <godsdog(a)netcom.com> (NOT RISKS) if you want a copy of the whole article. PGN] ------------------------------ -- dat(a)ebt.com (David Taffs)

1 0

Gelernter's piece
by Carl Ellison 17 Dec '03

17 Dec '03

I wish I could stop each person advocating Clipper and get them to explain how this will give access to criminals' conversations before they Even DERD backed way down from there on Science Friday last week -- saying that Clipper *wasn't* for giving access to criminal conversations -- just for making sure that the gov't standard didn't shoot the gov't in the foot. Given that more reasonable stance, the next step is to eradicate from the record (before the jury sees it) any mention of criminal behavior or wiretaps of criminals as a justification for Clipper. >From that point, I think we could have a reasonable debate.

1 0

A CC of my letter to Gelernter@cs.yale.edu
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

I caught your piece on the Op-Ed page. Of course I agree with you about the fact that there is a need for wiretaps. But I think that there are serious problems with the Clipper chip. It is very expensive compared to software only solutions and it is also very, very brittle. First the cost: * Every extra chip adds to cost, battery usage and pocket bulge. This is a heavy price to pay for something that could be done in software. Many of the next generation digital phones, for instance, use a DSP. There are more than enough spare cycles available to do encryption. * The high cost is effectively a tax on privacy for the average person. It is easy to imagine clipper chips adding $100 to the cost of an already digital phone, fax machine or computer. The poor are just as much targets as the rich. In fact, they are often easier targets because no one wants to bother chasing down a fake credit card transaction or bank account withdrawl if it only amounts to $75. If a chip was necessary, then it would be a different story. Software could help all of America, not just the rich. Now the Fragility: * The first generation of Capstone chips is already obsolete. They're worthless. All of the money that went into fabbing and producing them is gone. Why? Because the NSA discovered a weakness in the Secure Hash ALgorithm. They've fixed it now, but all the old chips are worthless. * Imagine that problems arise well after the chip is standardized. What will millions of Americans do? All of the digital phones, fax machines and modem cards will need to be replaced. * Now imagine that a pair of turncoats sell out America and put both halves of the key escrow on the black market. If we're lucky enough to discover this leak, it could easily take 6 months to a year to replace our now worthless phone system. * Software, on the other hand, is very easy to change. In many cases, the anti-virus programs travel faster than the viruses. These are the main reasons why I think that the Clipper is a boondoggle. Software based solutions would solve all of these problems _except_ the government's desire for a firm grip on the world and technology. -Peter Wayner

3 3

(fwd) MIT Announces availability of PGP 2.5
by ecarp＠netcom.com 17 Dec '03

17 Dec '03

Xref: netcom.com sci.crypt:25468 alt.security.pgp:12712 Path: netcom.com!netcomsv!decwrl!lambda.msfc.nasa.gov!newsxfer.itd.umich.edu!gatech!udel!MathWorks.Com!news.kei.com!bloom-beacon.mit.edu!senator-bedfellow.mit.edu!zurich.ai.mit.edu!bal From: bal(a)zurich.ai.mit.edu (Brian A. LaMacchia) Newsgroups: sci.crypt,alt.security.pgp Subject: MIT Announces availability of PGP 2.5 Date: 9 May 94 14:04:14 Organization: M.I.T. Artificial Intelligence Lab. Lines: 66 Message-ID: <BAL.94May9140414(a)freeside.ai.mit.edu> NNTP-Posting-Host: freeside.ai.mit.edu MIT has announced availability of PGP 2.5 (beta). Here's a copy of the announcement I received: --bal Date: Mon, 9 May 94 09:32:39 -0400 From: Jeffrey I. Schiller <jis(a)mit.edu> Subject: MIT Announces PGP 2.5 Beta Test Release of PGP version 2.5 May 9, 1994 The Massachusetts Institute of Technology announces the distribution of PGP version 2.5, incorporating the RSAREF 2.0 cryptographic toolkit under license from RSA Data Security, Inc., dated March 16, 1994. In accordance with the terms and limitations of the RSAREF 2.0 license of March 16, 1994, this version of PGP may be used for non-commercial purposes only. PGP 2.5 strictly conforms to the conditions of the RSAREF 2.0 license of March 16, 1994. As permitted under its RSAREF license, MIT's distribution of PGP 2.5 includes an accompanying distribution of the March 16, 1994 release of RSAREF 2.0. Users of PGP 2.5 are directed to consult the RSAREF 2.0 license included with the distribution to understand their obligations under that license. This distribution of PGP 2.5, available in source code form, is available only to users within the United States of America. Use of PGP 2.5 (and the included RSAREF 2.0) may be subject to export control. Questions concerning possible export restrictions on PGP 2.5 (and RSAREF 2.0) should be directed to the U.S. State Department's Office of Defense Trade Controls. Users in the United States of America can obtain information via FTP from net-dist.mit.edu in the directory /pub/PGP. *** Beta Release Note -- May 7, 1994 *** Today's release of PGP 2.5 is a beta test release, designed to permit users to familiarize themselves with the program and to give us feedback before we make the final release. This version of PGP2.5 has been tested on the following platforms: MSDOS, Sun381i, Solaris 2.X, Ultrix 4.X, Linux, RS6000, HP/UX Over the next few days, we will be testing PGP2.5 on a variety of other systems and collecting bug reports from this release. Please send bug reports to pgp-bugs(a)mit.edu. If you obtain a copy of this beta release code, please keep checking http://web.mit.edu for the announcement of the final release, so that you can update your copy of PGP2.5. We expect the final release to occur within a week. *** To Get PGP2.5: The directory where PGP2.5 is located is hidden. To get it you need to telnet to "net-dist.mit.edu" and login as getpgp. You will be asked to confirm that you will abide by the terms and conditions of the 3/16/94 RSAREF 2.0 license. The license is in the file "license.txt" in /pub/PGP on net-dist.mit.edu. -- Ed Carp, N7EKG/VE3 ecarp(a)netcom.com 519/824-3307 Finger ecarp(a)netcom.com for PGP 2.3a public key an88744(a)anon.penet.fi If you want magic, let go of your armor. Magic is so much stronger than steel! -- Richard Bach, "The Bridge Across Forever"

1 0

1024 limit...
by perry＠bacon.imsi.com 17 Dec '03

17 Dec '03

Hmmm... This was from the newfor24.doc file -- NOT the newfor25.doc file! -- included in the pgp25 distribution. >- Number of bits allowed when generating keys limited to 1024, in line > with the limits in RSAREF and BSAFE. It used to be higher, but > folks, if you think you need a key larger than that, do some research > into the complexity of factoring. I'm sure patches to fix this bit of fascism will show up soon. Perry

2 1

Real DigiCash !
by geoffw＠nexsys.net 17 Dec '03

17 Dec '03

MONDEX SPECIFICATIONS FOR ELECTRONIC CASH PAYMENT RELEASED Nationl Westminster Bank today (26th April) announced that it is rele asing the first of its product development specifications for Mondex, the electronic cash payment service which it will launch in the UK n ext year in a joint venture with Midland Bank and BT. These specifications will enable manufacturers to begin the developme nt of Mondex-compatible products such as point-of-sale terminal equip ment for retailers and bank cash machines as well as opening up compe tition for the production of other Mondex devices such as the Mondex electronic wallet and the Mondex personal balance reader. The specifi cations take account of existing ISO standards for Integrated Circuit (IC) cards and other emerging IC card standards. Tim Jones, Chief Executive of Mondex, said: "Production of Mondex dev ices was neccessarily limited to a number of specialist suppliers to provide the basis of next year's large scale launch in Swindon. Howev er, Mondex has been designed as a global product and we are now in a position to provide interested manufacturers around the world with th e specifications they need to begin development of their own new prod ucts or to adapt their existing ranges to be Mondex compatible. "Mondex offers manufacturers an exciting opportunity to develop and m arket new product ranges that add value to the simple Mondex proposit ion -- the storage and transfer of electronic cash" he added. Devices for the Mondex launch in the UK are being developed by: * AT&T Global Information Solutions (formerly known as NCR) -- cash m achines * BT -- residential telephones and payphones * Dai Nippon Printing Co. Ltd. / SPOM Japan Co. Ltd. -- cards * De La Rue Fortronic -- retailer terminals * Hitachi Ltd. -- integrated circuits * Oki Electric Industry Company Ltd. -- electronic wallets * Panasonic (Matsushita Electric/Matsushita Battery) -- electronic wa llets and personal balance readers * Texas Instruments Ltd. -- personal balance readers. NOTES FOR EDITORS 1. Mondex is an open, unaccounted electronic purse initiative which h as been developed by National Westminster Bank. Mondex is being launc hed in the UK by a joint venture of NatWest and Midland working with BT. 2. The first specifications available are: * IFD-Purse Application Interface Specification. (IFD stands for Inte rface Device.) This core product development specification defines th e commands to which a card will respond and refers to the relevant in ternational standards covering general communications to an from smar t cards. * Introduction to Mondex Purse Operation. This is a companion documen t to the above specification. It provides an overview of the Mondex c ard and its interface with a Mondex device. * The Mondex Brand Manual. This document defines the permissible impl ementations of the Mondex brand. 3. Other specifications will cover the communications between two int erface devices, the user-interface standards designed to ensure user- friendly product design and the card specification. 4. Manufacturers interested in Mondex specifications should contact t he Mondex Information Centre, National Westminister Bank plc, 1st Flo or Podium, Drapers Gardens, 12 Throgmorton Avenue, London EC2N 2DL (f ax 071 920 1562). Further enquiries to David Morton, PR Department, NatWest Bank, UK Br anch Business, 41 Lothbury, London EC2P 2BP (tel 071 726 1782, fax 07 1 726 1530).

3 2

Factoring with a quantum computer (Citation)
by jamesd＠netcom.com 17 Dec '03

17 Dec '03

First: Don't panic. So far no usable quantum computer has been built. It will be a long time before one is. Secondly a quantum computer capable of factoring 1024 bit keys will require polynomially high precision in its extremely tiny components, whereas a classical computer will only require order one precision, regardless of the number of bits. This may well not be feasible until we are close to achieving nanotechnology. (That is polynomially high precision, which achievable. Non polynomially high component precision is of course impossible for problems large enough to be interesting) Secondly: Yes, quantum computers will indeed be able to solve in polynomial time many problems that require non polynomial time for classical computers. In plain English that means that they can solve problem classes that ordinary computers cannot solve. Factoring is one of those problems. This result was established by E. Bernstein and U. Vazirani, and has recently been published as: Quantum Complexity Theory, Proc. 25th ACM Symp. on Theory of Computation, pp. 11--20 (1993). Barak Pearlmutter summarizes the current status as follows: The class of things a quantum computer can compute in polynomial time is called QRP. The class of things a regular randomized computer can compute in polynomial time is called RP. It is not known whether RP>P. But, under the usual assumptions, we know RP < QRP <= P^#P. It is not known whether QRP < NP. Factoring has not been shown to be in RP, nor has it been shown to be NP-complete. (If factoring were shown to be NP-complete, then we would have NP=coNP, a big deal, and also NP <= QRP, an immense deal assuming that accuracy problems don't make them impossible to build.) So it might be that NP <= QRP. Also plausible is RP < QRP < NP. In any case, the public key cryptosystems we thought were secure (RSA, discrete logs) has now had their viability brought into serious question. Even if QRP<NP (which it might not be) it might be the case that any public key cryptosystem can be broken in QRP, since no public key cryptosystem has been exhibited for which the inverse problem is NP-complete. (Some have been related to NP-complete problems, but with the reductino in the wrong direction, which proved fatal.) I will shortly give a hand waving explanation of why it is so, why a quantum computer is potentially capable of solving problems that a classical computer cannot solve within the lifetime of the universe. I am not able to cite Shor's result, showing that factoring is among the problems that a quantum computer can solve efficiently, because he is not yet published. I am attempting to reconstruct his results from information that people have given me about them, but so far I am making fairly heavy weather of it. He is applying the remarkable result of Bernstein and Vazirani to a particular interesting case. So if you want to go an prove that his method cannot possibly work, simply go and prove that the methods of Bernstein and Vazirani, cannot possibly work. The quantum magic part is in Bernstein and Vazirani's work, not Shor's work. (I can assure that they will work.) Some of you folk may remember the great flame war on this topic on the Extropians mailing list. I mentioned this result, without giving source or authority (it had not been published to my knowledge at that time), and Price flamed me vigorously, calling me an idiot, an ignoramus, a crackpot, and a fool, and so forth, and offered to bet 5000 British pounds, then about US$7500, on the matter. $7500 bet! I of course cheerfully accepted. Alas I wanted the judging to be done by somebody who had published on quantum computing in a refereed journal, (like Bernstein) and I wanted that person to hold the pot. Michael reluctantly agreed to having the bet judged by a qualified person but he wanted the pot held by a bunch of people who are involved in a business concerning which I have very grave and serious suspicions. I attempted my various means of persuasion to get him to put up the pot. Alas, Michael was not willing to let the pot for the bet go outside the control of him or these dubious people. Eventually I resorted to a vigorous attempt to shame him into putting up the money. My unkind comments concerning Michael and his pals eventually resulted in me being expelled from the Extropians list, for flaming Michael and defaming the Exi board. But since Bernstein and Vazirani are now published, and no further suckers seem willing to come forward and bet, I am now going to give an vague hand waving explanation of their results. A quantum event has many outcomes, all of them happening at once. Consider a quantum computer with 1024 bits of memory. (128 bytes, not 128 megabytes) A classical computer can only be in one state at a time. A quantum computer can be, and usually will be, 2^1024 states simultaneously. That is 10^306 states, or about 1 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 states simultaneously. Obviously a quantum computer can explore state space a lot more efficiently than a classical computer can. In fact a classical computer simply cannot explore a space that big, even if the computer were to fill then entire universe. This however is not much use, because the probability of observing it in the correct state is equally low. The clever trick of Bernstein Vazirani is to arrange for constructive interference between correct answers and destructive interference between incorrect answers. This requires the quantum computer to retain quantum coherence. It is evident that most of the people blowing off and saying "Quantum computers are bullshit" do not understand quantum coherence etc. (At least Michael Price had some faint grasp of quantum mechanics.) Thus a quantum computer has vast potential for problems that involve the combinatorial explosion. Unfortunately, because the transformation is unitary, a quantum computer cannot efficiently report back the one correct result that it has discovered to the any one particular reality Although getting the information out of a quantum computer is inherently inefficient, it is not always nonpolynomially inefficient. My judgment, for what it is worth, is that (for the vast majority of problems that are not NP complete, but are NP and are actually interesting, because they have an answer that is true rather than an answer that is marginally better than other answers) it will be reasonably easy to find ways of persuading a quantum computer to disgorge the necessary information that are only polynomially inefficient. These methods will be extremely general, rather than domain specific, and algorithms will improve in the direction of generality. A quantum computer will always operate very rapidly, for any algorithm that one would wish to program on a quantum computer. For many algorithms, the probability of it emitting the right answer is rather low. If the probability is non polynomially low, then the algorithm is of course useless. A number of algorithms have now been shown, including factoring, where the probability is only polynomially low, which is of course enormously better than non polynomially low. The precision of the components of the quantum computer must be proportional to the time taken by one shot of the algorithm, since in order to get the information out of the computer with a reasonably high probability, we require the class of true answers to interfere constructively, while the vastly larger class of incorrect answers interferes destructively. If the computer sits there for too long, random thermal noise will destroy coherence, and all the answers will interfere randomly, so the probability of getting the right answer out (observing the computer in the desired state) will be non polynomially low. Similarly, if the quantum computer takes too many steps, imperfections in its components will destroy quantum coherence. When the coherence is lost, a quantum computer is equivalent to a non deterministic computer. When it retains quantum coherence, it can surpass a non deterministic computer by an exponentially large factor. --------------------------------------------------------------------- We have the right to defend ourselves and our | property, because of the kind of animals that we | James A. Donald are. True law derives from this right, not from | the arbitrary power of the omnipotent state. | jamesd(a)netcom.com

1 0

Where is PGP2.5?
by geoffw＠nexsys.net 17 Dec '03

17 Dec '03

It seems like the directory at MIT is write locked. Anybody have the key?

1 0