April 1993 - cypherpunks-legacy@lists.ogf.org

Forwarded article.
by whitaker＠eternity.demon.co.uk 27 Apr '93

27 Apr '93

This article was forwarded to you by whitaker(a)eternity.demon.co.uk (Russell Earl Whitaker): --------------------------------- cut here ----------------------------- Newsgroups: demon.security From: nikki(a)trmphrst.demon.co.uk (Nikki Locke) Path: eternity.demon.co.uk!demon!trmphrst.demon.co.uk!nikki Subject: Cppnews now has PGP support Reply-To: cppnews(a)trmphrst.demon.co.uk Distribution: world X-Mailer: cppnews $Revision: 1.35 $ Organization: Trumphurst Ltd. Lines: 13 Date: Sun, 25 Apr 1993 17:23:45 +0000 Message-ID: <735786863snx(a)trmphrst.demon.co.uk> Sender: usenet(a)demon.co.uk CPPNEWS $Revision: 1.35 $ Demon.security members may like to know that cppnews now has the ability to add user defined external commands to the Article menu. This latter enables automatic uudecoding, pgp decrypting etc. to be integrated with cppnews. The latest version of cppnews should be available for public ftp from ftp.demon.co.uk [158.152.1.65]:in directory /pub/trumphurst/cppnews. -- Nikki Locke,Trumphurst Ltd.(PC and Unix consultancy) nikki(a)trmphrst.demon.co.uk trmphrst.demon.co.uk is NOT affiliated with ANY other sites at demon.co.uk. --------------------------------- cut here -----------------------------

1 0

Clipper key negotiation...
by L. Detweiler 27 Apr '93

27 Apr '93

is nonexistent. That is, as I understand it, the algorithm for creating/exchanging the session key that is negotiated at the beginning of each call is *not* built into the chip or the standard. Am I correct? Mrs. Denning has conspicuously evaded this issue only by saying that the keys can be exchanged via Diffie-Hellman or RSA. The point is, the phone hardware designer/integrator must use an additional circuit. Isn't this a serious potential defect of the chip? Isn't it amazing that the design neglects the issue completely? Wouldn't the ideal (or even `usable'?) chip have this built in? If RSA refused to grant support to people using the algorithm for this purpose, it could have tremendous effect in helping vanquish it... What will be their commitment in this area? Is Mr. Bidzos annoyed about the Clipper chip as a veiled revocation of American rights or as a lucrative opportunity, denied at first, but not later, to get a tasty piece of the wiretapping pie? It seems to me that Mr. Bidzos has a critically pivotal decision to make, and to make clear. Or has it been made already, by someone else? If somebody comes out with a neat chip that interfaces to the Clipper *really soon* that has been *totally approved* by RSA for clipper key negotiation, I'd be a bit suspicious.... Can anybody clear this up? Exactly what parts of session key exchange/ negotiation/ generation are handled by the chip, and which aren't? There is not even specific information in Denning's statements about when all this (including the All-American Privacy-Protecting Law Enforcement Block, ug!) is transmitted (at the beginning of the call, presumably). Why hasn't there been more inquiry into this? Is the key fed to the chip by other circuitry? That would seem to be the case. The chip appears to be just a low level encryption device, not something high-level that worries about key manipulation and trading. Hence, there may be widely varying approaches to implementing key exchange. Not much of a `standard' that leaves unspecified something so basic. Notice however that the wiretapper does not care, because this is not involved in the decryption; the crucial data for them is that the serial number and family codes be correct for the chip. So, these aspects are hardwired.

1 0

Interesting quotation from Denning's book on cryptography
by Mike Godwin 27 Apr '93

27 Apr '93

>From Dorothy Denning, CRYPTOGRAPHY AND DATA SECURITY, Addison-Wesley 1982,1983, page 8: "Cryptosystems must satisfy three general requirements: "1. The enciphering and deciphering transformations must be efficient for all keys. "2. The system must be easy to use. "3. The security of the system should depend only on the secrecy of the keys and not on the secrecy of algorithms E [enciphering] or D [deciphering]." --Mike

1 0

Rave on...
by crunch＠netcom.com 27 Apr '93

27 Apr '93

At the last Mt View Cypherpunks meeting, it was discussed about ways in which we can get the word out to as many people as possible. I have an idea on yet another way on how this can be done. Would like to get input and feedback on this from the rest of the group. One such place where lots of people meet are RAVES. My proposal is to set up a room with a bunch of donated PC's Macs or whatever, and have a booth set up where people can purchase PGP diskettes for slightly above cost of the diskettes. People attending raves can purchase their PGP diskettes and on the spot, generate their keys. They can sign each other's keys there, and handout literature can be made available for anyone attending that describes the "Clipper" proposals, and suggestions on what people can do to resist further government control over private cryptography. Already, at most raves, there are demonstrations set up for things like the new "body synth", VR demos, and other things, so this should fit right in. I'm in contact with a number of RAVE organizors, and plan on contacting them. If enough people from Cypherpunks are interested in bringing their portables or small PC's, Macs or whatever to raves, this might be a very good way of reaching the younger people who might not otherwize be plugged into the mainstream media like TV, or newspapers, or whatever. For those interested in donating a Sat evening, and wanting to have a little fun, by bringing their computers to future raves, please send me your Email address, and specifics on any equipment you might want to bring, I can put you in touch with the appropriate organizers. Anyway, I'm open for input on this, and how we can get the word out. At the Cypherpunks dinner, I mentioned to John Gilmore and others about the possibility of doing short video "skits" and "infomercials" on some hypothetical scenerios of a "Faschiist government" that outlaws encryption. We can make it fun and entertaining, and I don't think I would have a problem proposing it to those people capable of producing this video. We will need actors, and some people to write up the "skit". I don't think we would have any problem convincing KQED, or any other TV station to air it. It would reach a lot of people, and is a good instrument in getting the word out. I talked to Wes Thomas about this, and we can set up an ad hoc get together in Berkeley and perhaps Eric Hughes and John Gilmore can attend and we can "ad lib" for practice a few hypothetical skits and vide tape it some evening. I think it would be fun, and even John Gilmore might enjoy participating in this fun activity. Rave on - D00ds!! JD

1 0

Re: Markey hearings on Thursday will be on the Internet MBone
by karn＠qualcomm.com 27 Apr '93

27 Apr '93

Does anybody know if the hearings will be carried on CSPAN? Phil

1 0

Clipper: International implications
by Tom Keenan 27 Apr '93

27 Apr '93

It will be fascinating to see how non-US governments react to Clipper. Anybody have any info on this? I will contact the office of the Canadian minister responsible for Communictions (Hon. Perrin Beatty) and see if there has been a statement or reaction. Canada might prosper as a "phone haven" much as some Caribbean countries are "data havens." Somewhat related item in April 19/93 Communictions Week International (page 4) reports (in part): "Europe's mobile telephone industry is developing less-secure GSM digital cellular equipment to mollify government law-enforcement agencies and adjust to restrictions on high technology exports. New base station software and modified handset chips would make it easier for GSM calls to be tapped, a requirement of some governments, but would likely cost millions of dollars to install in existing networks and terminals." The export status of Clipper technology will also be an interesting thing to sort out. White House Statement just says "case by case." Dr. Tom Keenan, I.S.P. Associate Dean, R&D, U of Calgary & Technology Correspondent, CBC Television "Midday"

2 1

How to protect your electronic privacy -- consumer pamphlet
by szabo＠techbook.com 27 Apr '93

27 Apr '93

Here is a handout I've written for our next Portland-area libertarian meeting. Comments welcome. Feel free to distribute freely (you can edit out Portland-specific stuff) with attributions. ---------------------------------------------------------------- How to Protect Your Electronic Privacy Nick Szabo, April 30 1993 Distribute Freely We conduct more and more of our legal, political, and private business over the wires. Every decade, the number of phone calls that the government can record for later playback increases by a factor of ten. Commercial organizations gather and sell our transactions; marketers and governments cross-reference them, forming our vast electronic reputation. The number of e-mail messages doubles every year, and many political organizations are coming to rely on networks like Internet and LiberNet. Most e-mail users are unaware that it is the most public medium ever invented, and use it to write love letters, letters to their lawyer, discussion of illegal activities, etc. Vast volumes of e-mail can be stored on small magnetic tapes and searched in bulk for keywords, eg "mari[jh]uana". The good news is, the computer brings an even greater weapon to fight these threats to our privacy and political freedoms: widely available, automatic cryptography. Instead of developing phones allowing truly private conversations, which are now feasible, AT&T recently put a phone on the market that contains the NSA-designed "Clipper" wiretap chip. All users' encryption keys are registered with the U.S. government, giving it exclusive access to wiretapping this system's phones. The use of an unpublished algorithm and other features also make the system insecure. "Clipper" would also make traffic analysis (finding out who is calling whom, when, etc.) much easier. The goal of this government/Ma Bell collusion is to subsidize the creation of a standard that forces truly private phone systems off the market. By purposefully allowing a government backdoor in its "secure" phones, AT&T has demonstrated its contempt for its customers' privacy. Here are some other long-distance providers that may have more respect. All U.S. line providers are required to surrender to telephone taps under government "authorization", but some require more "authorization" than others, or otherwise make a greater fuss about it. Local wiretaps are beyond the control of long-distance companies, but long-distance eavesdropping is much more difficult if the company uses fiber optic instead of microwave links. Ask company representatives for details. Allnet Long Distance Services 1-800-783-2020 MCI, commercial 1-800-888-0800 MCI, residential 1-800-950-5555 Metromedia Communications Corp. 1-800-275-2273 One-2-One Communications 1-800-293-4121 Sprint, residential 1-800-877-7746 Sprint, business 1-800-733-5566 Real phone privacy can be obtained with a veil of encryption, by using pairs of phones containing privacy chips, which scramble the signals *and* keep the keys private. Contact your local business telephone dealers for privacy phones from Ericson, Cylink and other companies. Keep your eye out for portable-computer-based software with voice input that can be used to encrypt voice mail and send it over the networks like e-mail; these may be appearing on the market or as freeware within six months. Data privacy can be obtained with public-key encryption features which have been added to some of the newer e-mail packages from Microsoft, Apple, Novell, etc. Beware: most software encryption has been restricted by the U.S. government to very weak algorithms. "Cypherpunks" enjoy writing programs to crack the weakened file encryption in Word Perfect, Lotus, etc. Be sure the software contains the new "RSA" public-key algorithm, which probably cannot be cracked by anybody, even the NSA with their buildings full of supercomputers. A strong freeware RSA package is also available called Pretty Good Privacy (PGP); this is the international standard on the Internet. PGP can also be used for protecting the files on your PC. On an Internet machine type "archie pgp" to find out where PGP is available for download. Several BBS systems also have PGP available. In public key encryption, there are two keys, one used to lock (really scramble) the data, the other to unlock (unscramble) the data. To join the fun, publish or send your freinds your public key, and they can then send you messages only you can unlock with your private key. You collect other's public keys and do the same. PGP key distribution is based on an informal, voluntary web of trust instead of the government's rigid heirarchy which is vulnerable to failure at the top. Just as today's businessmen trade business cards, tommorrow's businessmen will trade public keys -- if the government doesn't ban them first. For more detailed information on electronic privacy, see: * Your local phone dealer. If he does not know about privacy issues and phone privacy products, ask him to find out! * The May/June issue of "Wired" magazine featuring "crypto-rebels" on the cover. A history computer cryptography and the "cypherpunk" movement, whose goal is to break the government monopoly on cryptography and to restore our right to privacy in the electronic age. * "Mondo 2000" #9 (most recent) features two good articles on PGP, and a third article on protecting our financial privacy from governments. * The Winter/Spring issue of "Extropy" features and article on digital cash. Unlike current electronic funds transfer, digital cash increases financial privacy. * On the Internet, the cypherpunks mailing list (cypherpunks-request(a)toad.com) and the newsgroups sci.crypt. In the Portland area two Internet providers are agora (293-1772 data) and techbook (220-0636 data). * Organizations helping lobby for electronic privacy: Electronic Frontier Foundation (eff.org) Computer Professionals for Social Responsibility (cpsr.org) Privacy International. These are not entirely libertarian (eg EFF tends to support Gore's socialist "Data Highway".) * James Bamford, _The Puzzle Palace_, 1983: A classic expose of the National Security Agency. Nick Szabo szabo(a)techbook.com

1 0

COMP.RISKS is where the action seems to be
by tcmay＠netcom.com 27 Apr '93

27 Apr '93

Comp.risks is carrying extensive coverage of the Clipper Chip issue, including Dorothy Denning attempting to defend the Clipper. Sci.crypt and alt.security.clipper still have more messages, but comp.risks seems to be the place I check first. Being a digest, though, a new one only appears a few times a week. -Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available.

3 2

Markey hearings on Thursday will be on the Internet MBone
by gnu 27 Apr '93

27 Apr '93

John Gage tells me that audio from the Congressional hearings on telephone privacy and Clipper will be multicast on the Internet `MBone' (multicast backbone). We don't yet know the multicast address. If someone who knows about the mbone could hook in and record a copy of the hearings (as an online sound file, or on tape), that would be great. I'll be at a conference on Thursday. John

2 1

Re: a quick non-technical writeup on the Clipper chip -- corrections
by composer＠Beyond.Dreams.ORG 27 Apr '93

27 Apr '93

Here are some minor corrections to the the non-technical writeup I posted earlier this evening. Note, that I also already corrected the typo regarding how the keys were constructed. Ignore the line numbers.. they'll be incorrect, as this is part of a larger article. FYI... -jeff Jeff Kellem Internet: composer(a)Beyond.Dreams.ORG ===CUT HERE=== *** /tmp/RCSA002047 Tue Apr 27 01:29:46 1993 --- whats-out-there-1.03.text Tue Apr 27 01:29:08 1993 *************** *** 188,203 **** important to the privacy of that same public. o it would seem that the Government might be granting a monopoly to ! Mykotronx, Inc. and VLSI Technology. It's unclear whether each ! company makes the entire chip or just parts thereof. o the key, which allows the information encrypted with this chip to be decrypted, is embedded in the chip [ This means that once the key is known, the chip needs to be ! replaced to maintain private communications. In other words, a new ! encryption device, if the key is ever divulged, which could just ! mean a wire-tap. ] o the 80-bit key is made from the xor of two (2) 80-bit keys, which are kept in databases at two different escrow agencies --- 188,206 ---- important to the privacy of that same public. o it would seem that the Government might be granting a monopoly to ! Mykotronx, Inc. and VLSI Technology. As far as I know, VLSI ! fabricates the chip and Mykotronx programs the keys into it. o the key, which allows the information encrypted with this chip to be decrypted, is embedded in the chip [ This means that once the key is known, the chip needs to be ! replaced to maintain private communications. This would usually ! mean replacing the entire device (e.g. telephone), anytime that ! the key was divulged, whether legally or not. The key is also ! transmitted along with your encrypted data, so that law enforcement ! can obtain it, which would allow them to decrypt your data without ! your knowledge. ] o the 80-bit key is made from the xor of two (2) 80-bit keys, which are kept in databases at two different escrow agencies *************** *** 223,235 **** for international distribution. On the other hand, there are too many things about the announcement which ! are bothersome and need to be discussed publicly. Some of these items ! have been mentioned above. I recommend talking with your local ! congressman, writing letters, and discussing this with friends. Both the Electronic Frontier Foundation (EFF) and the Computer Professionals for Social Responsibility (CPSR) have made public statements ! against the announcement. The CPSR has filed Freedom of Information Act (FOIA) requests regarding the plan. Online discussions of the announcement have been occurring all over the --- 226,243 ---- for international distribution. On the other hand, there are too many things about the announcement which ! are bothersome and need to be discussed publicly. Some of these items have ! been mentioned above. The Clipper Chip basically seems like it might ! provide privacy from some people, but not from the government. I recommend ! talking with your local congressman, writing letters, and discussing this ! with friends. Both the Electronic Frontier Foundation (EFF) and the Computer Professionals for Social Responsibility (CPSR) have made public statements ! against the announcement. The EFF supports the idea of reviewing ! cryptographic and privacy policies, but believes that the Clipper Chip ! announcement was premature and should be delayed until after the overall ! review and discussion. The CPSR has filed Freedom of Information Act (FOIA) requests regarding the plan. Online discussions of the announcement have been occurring all over the

1 0