April 1993 - cypherpunks-legacy@lists.ogf.org

hi guys
by Tom Keenan 24 Apr '93

24 Apr '93

sub Thomas P. Keenan -- Dr. Tom Keenan, I.S.P. Associate Dean, R&D, Faculty of Cont. Ed. University of Calgary 2500 University Dr. NW Calgary, AB T2N 1N4 CANADA (403) 220-4715 (voice) (403) 284-5702 (fax) keenan(a)acs.ucalgary.ca (email)

1 0

hi guys...
by Tom Keenan 24 Apr '93

24 Apr '93

sub Thomas P. Keenan -- Dr. Tom Keenan, I.S.P. Associate Dean, R&D, Faculty of Cont. Ed. University of Calgary 2500 University Dr. NW Calgary, AB T2N 1N4 CANADA (403) 220-4715 (voice) (403) 284-5702 (fax) keenan(a)acs.ucalgary.ca (email)

1 0

saltzer and schroeder on information protection
by peter honeyman 24 Apr '93

24 Apr '93

this is taken from a paper i'm writing with avi rubin. it's not a sound bite, more like a snack. peter =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Experts dismiss systems that hide cryptographic algorithms or protocols (a.k.a. "security through obscurity"). Kahn [1] cites Kerckhoffs' classic treatise on military security [2]. Saltzer and Schroeder [3] reflect the modern view in describing "open design" as one of the basic principles of information protection: The design should not be secret. The mechanisms should not depend on the ignorance of potential attackers, but rather on the possession of specific, more easily protected, keys or passwords. This decoupling of protection mechanisms from protection keys permits the mechanisms to be examined by many reviewers without concern that the review may itself compromise the safeguards. In addition, any skeptical user may be allowed to convince himself that the system he is about to use is adequate for his purpose. Finally, it is simply not realistic to attempt to maintain secrecy for any system which receives wide distribution. 1. D. Kahn, The Codebreakers, Macmillan Publishing Co., New York (1967). 2. A. Kerckhoffs, La Cryptographie Militaire, Libraire Militaire de L. Baudoin & Cie., Paris (1883). 3. J.H. Saltzer and M.D. Schroeder, "The Protection of Information in Computer Systems," Proc. of the IEEE, Vol. 63(9), pp. 1278-1307 (September, 1975).

1 0

Re: Privacy International (fwd)
by Dave Banisar 24 Apr '93

24 Apr '93

RE: PI and Clipper Privacy International recently nominated the FBI for its Big Brother Award (see below) for the digital telephony proposal. Need I say more? For more info on PI, check out the CPSR Internet Library at cpsr.org /privacy_international Dave Banisar Director, PI Washington Office (one of my many hats) ------ Forwarded Message The following forwarded from alt.privacy. Anybody have experience with this group? Have they taken a position on the wiretap chip? ... THE BIG BROTHER AWARDS Governments, private sector organizations, credit bureaus, police departments and the military in many countries are engaging in programs which have the effect of eroding the rights and privacy of individuals. These practices often breach international human rights conventions, and threaten the balance or evolution of free and open societies. In many cases, information technology is used for the purposes of increasing the power of authorities, while diminishing the rights of individuals. These violations occur in all parts of the world. The Big Brother awards sponsored by Privacy International, will be given to the organization, initiative, government or act which is most invasive of private life, or which is responsible for the most dangerous and intrusive acts of surveillance. Privacy International believes that there should be a more widespread awareness of these practices. We believe people have the right to know when governments or other organizations are engaging in intrusive practices that limit individual rights. We aim to provide an effective context for viewing these invasive practices, by establishing an international benchmark. The establishment of the Big Brother awards aims to provide a world-wide focus on surveillance and privacy.

1 0

Family key is symmetric
by fnerd＠smds.com 24 Apr '93

24 Apr '93

As I understand it, the Skipjack system is symmetric, i.e., decrypt key= encrypt key. Also, the unit serial number seems to only get encrypted with the family key. So, once the family key and the algorithm are known, it will be possible to create messages with any unit serial number you want, right? Wouldn't this be enough to foil the casual traffic-analysis feature of the crippler? --fnerd the keyhole chip the wing clipper co-intel inside as seen on whitehouse stationery only open a crack the taped lock cyphergate "Daffy, you quack me up." --Elmer

1 0

Re: CLIPPER: Explanation sheet?
by Valerie Lambert 24 Apr '93

24 Apr '93

In article <Qfpqi9K00WBK8_O4gs(a)andrew.cmu.edu>, David Reeve Sward <sward+(a)cmu.edu> writes: >I (along with others) have some sort of phrase in our .signature saying >"Stop the Clipper Chip" or somesuch. Since adding this, I have had >several people ask me about this, and I have fired off an explanation to >them. I am wondering if there is a Wiretap Chip Explanation Sheet to >send to people instead of trying to make sure I remember everything (and >without double-checking everything I say). Has anyone written such a >beast? I have compiled a "layperson's" Clipper-shit I mean sheet containing a very short intro, announcements from the White House, AT&T, the EFF, the CPSR, and various news articles. David, I will mail you a copy. If anyone else wants one, let me know. -- Valerie Lambert * valerie(a)biocad.com * 415/903-3923 * AT&T: phones with Big Brother Built Inside! Just say "NO" to the Clipper wiretap chip.

1 0

KPFA at Sat Meeting
by geoffw＠nexsys.net 23 Apr '93

23 Apr '93

I took the liberty of calling KPFA's (The Pacifica Affiliate here in the Bay Area and telling them about this saturday's meeting. I figured we could use the help of the "sympathetic pres" and they do have 50,000 watts of power. We could craft a real good statement that would go out to most of the "activist" types in the area. I've take one or two of their phone calls but have been vectoring them over to John (gnu(a)toad.com) and Tim` <tcmay(a)netcom.com> to answer more detailed questions. They seem to know about us as they mentioned John and Eric by name. I sent them the dirtections to the meeting and a couple of e-mail messages (press releases and a few comments) to their account on kpfa(a)well.sf.ca.us. Hope this is a help not a hinderance. ------------------------------------------------------------------------------- NEXUS SYSTEMS/CYBERTRIBE-5 Editor/Instigator/Catalyst : Geoff White <geoffw(a)nexsys.net> Production Crew : Universal Movement Trinity <umt(a)nexsys.net> "They might stop the party, but they can't stop the future" --PGP Public key available upon request-- -------------------------------------------------------------------------------

1 0

Re: encrypted telnet
by Hal 23 Apr '93

23 Apr '93

I missed the context because my mailbox overflowed, but Eric mentioned Diffie-Hellman key exchange. If the need is for a one-shot quick-n-dirty session key exchange (as for the audio talk program John Gilmore mentioned) an alternative is to do a quick PGP keygen, send the session key across using the PGP key, then destroy the PGP key. The only reason I mention this is that it can be done in a couple of minutes with existing tools tomorrow, if you need it. Eric is right that if you are designing something from scratch DH is often more appropriate (although PK's allow for authentication if you have a trusted signature, preventing spoofing attacks). Hal

1 0

A parable
by pmetzger＠lehman.com 23 Apr '93

23 Apr '93

I just posted this to the net. ---------------------------------------------------------------------- Newsgroups: alt.privacy.clipper,sci.crypt Subject: A Parable. References: <1993Apr20.013747.4122(a)cs.sfu.ca> <1993Apr21.210353.15305(a)microsoft.com> Distribution: usa Organization: Partnership for an America Free Drug scottmi(a)microsoft.com (Scott Miller (TechCom)) writes: >Stikes me that all this concern over the government's ability >to eavesdrop is a little overblown... what can't they do today? >My understanding is that they already can tap, listen, get access >exc. to our phone lines, bank records, etc. etc again. Well, they can't listen in on much of mine, since I already use cryptography for much of my electronic mail, and will start using it for my telephony as soon as practical. However, allow me to tell a parable. There was once a far away land called Ruritania, and in Ruritania there was a strange phenonmenon -- all the trees that grew in Ruritainia were transparent. Now, in the days when people had lived in mud huts, this had not been a problem, but now high-tech wood technology had been developed, and in the new age of wood, everyone in Ruritania found that their homes were all 100% see through. Now, until this point, no one ever thought of allowing the police to spy on someone's home, but the new technology made this tempting. This being a civilized country, however, warrants were required to use binoculars and watch someone in their home. The police, taking advantage of this, would get warrants to use binoculars and peer in to see what was going on. Occassionally, they would use binoculars without a warrant, but everyone pretended that this didn't happen. One day, a smart man invented paint -- and if you painted your house, suddenly the police couldn't watch all your actions at will. Things would go back to the way they were in the old age -- completely private. Indignant, the state decided to try to require that all homes have video cameras installed in every nook and cranny. "After all", they said, "with this new development crime could run rampant. Installing video cameras doesn't mean that the police get any new capability -- they are just keeping the old one." A wise man pointed out that citizens were not obligated to make the lives of the police easy, that the police had survived all through the mud hut age without being able to watch the citizens at will, and that Ruritania was a civilized country where not everything that was expedient was permitted. For instance, in a neighboring country, it had been discovered that torture was an extremely effective way to solve crimes. Ruritania had banned this practice in spite of its expedience. Indeed, "why have warrants at all", he asked, "if we are interested only in expedience?" A famous paint technologist, Dorothy Quisling, intervened however. She noted that people might take photographs of children masturbating should the new paint technology be widely deployed without safeguards, and the law was passed. Soon it was discovered that some citizens would cover their mouths while speaking to each other, thus preventing the police from reading their lips through the video cameras. This had to be prevented, the police said. After all, it was preventing them from conducting their lawful surveilance. The wise man pointed out that the police had never before been allowed to listen in on people's homes, but Dorothy Quisling pointed out that people might use this new invention of covering their mouths with veils to discuss the kidnapping and mutilation of children. No one in the legislature wanted to be accused of being in favor of mutilating children, but then again, no one wanted to interfere in people's rights to wear what they liked, so a compromise was reached whereby all homes were installed with microphones in each room to accompany the video cameras. The wise man lamented few if any child mutilations had ever been solved by the old lip reading technology, but it was too late -- the microphones were installed everwhere. However, it was discovered that this was insufficient to prevent citizens from hiding information from the authorities, because some of them would cleverly speak in languages that the police could not understand. A new law was proposed to force all citizens to speak at all times only in Ruritanian, and, for good measure, to require that they speak clearly and distinctly near the microphones. "After all", Dorothy Quisling pointed out, "they might be using the opportunity to speak in private to mask terrorist activities!" Terrorism struck terror into everyone's hearts, and they rejoiced at the brulliance of this new law. Meanwhile, the wise man talked one evening to his friends on how all of this was making a sham of the constitution of Ruritania, of which all Ruritanians were proud. "Why", he asked, "are we obligated to sacrifice all our freedom and privacy to make the lives of the police easier? There isn't any real evidence that this makes any big dent in crime anyway! All it does is make our privacy forfeit to the state!" However, the wise man made the mistake of saying this, as the law required, in Ruritanian, clearly and distinctly, and near a microphone. Soon, the newly formed Ruritanian Secret Police arrived and took him off, and got him to confess by torturing him. Torture was, after all, far more efficient than the old methods, and had been recently instituted to stop the recent wave of people thinking obscene thoughts about tomatoes, which Dorothy Quisling noted was one of the major problems of the new age of plenty and joy.

1 0

subliminal channels on ham radio
by Do you know what's in the trunk? 23-Apr-1993 1646 23 Apr '93

23 Apr '93

KLB says: >Hmm... if authenticating signatures can be transmitted, then some >enterprising and patient cryptographers can also transmit messages, >encrypted if desired, back and forth using one of the "subliminal >channel" protocols! [and goes on to explain such steganography] yes, you could _theoretically_ use steganography in the authentication block, but it would be illegal. Very simply, you must not transmit a message over the Amateur bands if that message contains information that is not "in the clear". And I doubt any ham would knowingly transmit such a message... hams would consider it "poor form". Hams and amateur radio has been self- policing since WW 1 and Hiram Maxim's passage of a congressional bill *making* ham radio self-policing to the greatest extent possible. That's why the US hams were not silenced "for security reasons" during WW I, and the tradition of self-policing ham radio has held up ever since. Besides, essentially *all* ham traffic is monitored- usually by other hams, as well as by shortwave listeners, scanner groupies, and even, occasionally, the FCC. Hams will DF (direction-find) in on anybody on their frequencies who break the rules with the ruthless efficiency of Truly and Justly Annoyed Citizens, and the FCC has (at last!) agreed to accept tapes made by hams as legal evidence in seizure proceedings. Thus, the ham radio frequencies are "the wrong pool to piss in", if you get my drift. -Bill, N1KGX

1 0