- cypherpunks-legacy@lists.ogf.org

Simmons Subliminal channels and more...
by Peter Wayner 21 Jul '93

21 Jul '93

I too received a copy of Gus Simmons paper in the mail and I called him on the phone to discuss it with him. He sent me a copy of his latest version of the paper. The significance of the paper is that it is possible to use the DSS algorithm to send messages disguised as signatures. The specs for the DSS used by NIST required that it could not be used to hold secrets. This would make it more exportable and this was one of the reasons why RSA was not chosen as the DSS. On a more philosophical level, it shows that the DSS and the El Gamal system really aren't signature systems. They convey extra information. That means that they really aren't that different from RSA on a functional level. The easiest way to understand how the message passing system works is notice that the DSS uses a random number to compute the signature. If we could somehow recover this number, then we could have the information. What's the simplest hidden way to send a message? Let's say that you want to send a bit. Just keep rerunning the algorithm with different random numbers until the right parity appears. The real approach is more sophisticated than this. My personal feeling is that this shows how utterly impossible it is to keep secret bits from hiding in the noise of the world. If the NSA can't do it, then there is a good chance that no one can. -Peter

1 0

Simmons...
by Peter Wayner 21 Jul '93

21 Jul '93

I have no idea about the reason behind his departure from Sandia, but I did note with curiosity that Sandia refuses to forward mail to him. This may be Standard Operating Procedure at secure sites, but the Journal of Cryptology reported this in its latest issue. He is still an editor. -Peter

1 0

Re: Remailers/PayPhones and Today's NYT
by smb＠research.att.com 21 Jul '93

21 Jul '93

I thought it was interesting that the danger of untraceable drug dealers popped into the reporters mind when they were researching the article. After all, they don't tend to mention illegal problems when they speak about used car dealers or other services. Well, the article said that some of the phone store operators raised the issue, often defensively. Even if the reporter didn't know about the issue beforehand, they sure knew after that. Also note that part of the market for such stores is that NY Telephone has cut off some payphone service in certain areas, thereby sensitizing the reporter to such questions.

1 0

chicago area cypherpunks
by Brian D Williams 21 Jul '93

21 Jul '93

Samuel Pigg posts: >Is there a Chicago area cypherpunks group/meeting time/place? >(or have I just not been paying attention..?) There is no current group/meeting that I know of, but we could start one ( don't let the well.sf.ca.us fool you, I work in Downtown Chicago) any other Chicago area cypherpunks? Brian Williams

1 0

Subliminal Channels in the Digital Signature Algorithm (DSA)
by tcmay＠netcom.com 21 Jul '93

21 Jul '93

The recent discussion of possible subliminal channels (which some call covert channels) in the DSA reminds me of a preprint of a paper I received several months back with a rather mysterious note attached to it. There was no return address on the envelope. Apparently a number of Cypherpunks and folks active in the sci.crypt community also received it, as it came up on sci.crypt and we talked about it at a physical Cypherpunks meeting. The note read: "This needs to be made very public. Simmons resigned from Sandia over writing it." Some caveats: * this allegation that Gus Simmons left Sandia was denied by several folks on sci.crypt who actually _know_ Simmons. I don't know him, so I haven't checked directly. * some say this paper is hardly earth-shaking, though the possibility of subliminal channels should be taken seriously, especially in light of the cross-licensing of DSA/DSS with Public Key Partners (RSA Data, etc.). * I don't even know where this paper is being published--the preprint gave no clues. The timing of my getting it, several months back, suggests this year's Crypto Conference. The advance program ought to have it (I can't find my copy). I've OCRed the first page or so, including the Abstract. Too many OCR errors and too many equations with Greek symbols for me to scan-in the entire 20-page paper. The implications for Clipper, Capstone, Skipjack, etc. I'll leave for now. Here it is: The Subliminal Channels in the U.S. Digital Signature Algorithm (DSA) Gustavus J. Simmons Sandia Park. NM 87047. USA Abstract Since the DSA is derivative from El Gamal's digital signature scheme--which Simmons showed in 1985 permitted a subliminal channel--it should come as no surprise that the DSA also permits a similar channel. The subliminal channel in the El Gamal scheme, however, had several shortcomings. In order for the subliminal receiver to be able to recover the subliminal message, it was necessary for him to know the transmitter's secret key. This meant that the subliminal receiver had the capability to utter undetectable forgeries of the transmitter's signature. Also, only a subset of the desired message set could be communicated subliminally (phi (p-l) messages instead of p-1) and some of those that could be transmitted were computationally infeasible for the subliminal receiver to recover. The subliminal channels in the DSA avoid all of these difficulties! In fairness, it should be mentioned that not all are avoided at the same time. The channel in the DSA analogous to the one Simmons demonstrated in the El Gamal scheme can communicate messages conveying the full log-base-2 |X| bits, where X is the set of session keys; all of which are easily recovered by the subliminal receiver. However, this broadband channel still requires the subliminal receiver to know the transmitter's secret key. There are two other narrowband (<< 1og-base-2 |X|) subliminal channels in the DSA that do not give the subliminal receiver any better chance of forging the transmitter's signature than an outsider has. The price one pays for this integrity for the transmitter's signature is a reduced bandwidth for the subliminal channel and a difficult but feasible (dependent on the bandwidth actually used) amount of computation needed to use the channel. Two quite different such channels have been devised: one places the computational load almost entirely on the transmitter, the other almost entirely on the subliminal receiver. Since the total computation is essentially the same in either case, the choice of a particular channel would be based on which end is best equipped to do the necessary computation. To make clear what a remarkable coincidence it is that the apparently inherent shortcomings of subliminal channels using the El Gamal scheme can all be overcome in the DSA, we will analyze each of the channels implemented in both schemes. The inescapable conclusion, though, is that the DSA provides-the most hospitable setting for subliminal communications discovered to date. Introduction In 1983 Simmons introduced the notion of a subliminal channel existing in an encrypted communication channel by pointing out that if for each plaintext there existed two or more corresponding cipher texts, the identity of the cipher used to communicate a plaintext could convey information additional to that revealed by the decryptlon of the cipher [5]. In particular, in a public-key based authentication scheme in which the decryption key must be public information in order for public receivers to be able to decrypt cipher texts and verify the authenticity of the encrypted plaintext, this raised the possibility of there also being subliminal receivers who could recover information hidden from the public receivers: hence the name of a subliminal channel. Clearly subliminal channel receivers must have private information not known to public receivers--and as we will see, the nature of this private information provides a natural classification for subliminal channels. (rest of paper not OCRed...too many errors (blurred fonts), too many equations)

1 0

Re: Congressional contacts list
by mbl＠mail.msen.com 21 Jul '93

21 Jul '93

Just thought I ought to let you know... Carl Pursell (R-MI) is gone. I know because I worked on his opponent's campaign. You might want to advise the source of the list about that. (There are most likely more, but I don't know about them personally.) -- Matthew B. Landry | mbl(a)mail.msen.com President of Project SAVE | (313)971-5469 (H/W) My opinions are my most prized posession. I don't share them.

1 0

Re: Thoughts on remailers
by peter honeyman 21 Jul '93

21 Jul '93

pay phones and postal mail are also "perfect for those who would harrass and abuse others." peter

2 1

Second-Hand-Remailers
by faust＠cd.chalmers.se 21 Jul '93

21 Jul '93

Second Hand Remailers (SHR). As more users get a taste of the sweet flavor of freedom, more remailers must be connected. Not only to stand the pressure of the mail, but also to assure the cypherpunks that they aren't using remailerX.cypherpunks.GOV! As Mr. Zimmmerman so nice states in the PGP.DOC , we need a grassrot-like organisation. But how do we get this? Keeping a remailer on a system you don't own, are not THAT appealing for the usual 'heck-I-want-freedom-FREE' person. The answer is Second Hand Remailers. A Second Hand Remailer is just like a ordinary cypherpunk remailer, with one difference, it only forwards mail to 'approved' systems, i.e normally other SHR's or LHR's (Last Hand Remailers, like those existing today.). In this way, the owner of the account of a SHR will be able to check up ALL forward-to-adresses before he starts, and thus keeps HIM from getting any flame for pumping GIGs of bad things into the net. (Since there will only be few LHR's , operators who don't want to have anonymously postings in their newsgroups/systems can easily keep track of which to refuse mail from.) Since the mail only passes thru the SHR's and will not be dropped into the net by the SHR but rather thru a LHR, (which, btw even can be a remailer.GOV if you don't care about the reciever and don't include any revealing signatures, like encrypting with your public-key.) the SHR's can't really be blamed for anything. This fact that you can contribute to the great fight for freedom without risking anything, must certainly appeal to all you cypherpunks? What we just need is to change the script for the ordinary remailers to first match the remail-to adress with a aproved list of other remailers. This should not be hard, should it? Imagine, if we just can find an easy way for the ordinary user to set up a SHR, there will be no way to stop or track the remailing since there will be thousands of remailers available and many will be 'friend-of-a-friend's and maybe not even published. (you trade SHR adresses with people you trust in the same way as you introduce new public keys of people you trust to other by signing them.) And, when more remailers get's into the scene, there will be a possibility to make adress-headers by chaining SEVERAL SHR's with one or more LHR's. The SHR's can be chosen among people who you know and whose computers are located near you. But with increasing chains, there will be increasing header-sizes, and there will most certainly go down some SHR's/day so you have to update your headers often. This two fact forces us to install some kind of header-site where you can pick up a fresh adress-header for a given pseudonym, preferly together with that pseudonym's public key. (and send your new header when a SHR's you used have bailed out.) I've said it before, and I'll say it again, we need a service exactly like the PGP-key server but who also supports adress-headers! Regards, Faust - Ziffer macht frei -

1 0

Chicago area cypherpunks?
by b44729＠achilles.ctd.anl.gov 21 Jul '93

21 Jul '93

Is there a Chicago area cypherpunks group/meeting time/place? (or have I just not been paying attention..?) -Sam

1 0

Re: subliminal messages
by tcmay＠netcom.com 21 Jul '93

21 Jul '93

Here's my minor correction of Perry Metzger's minor correction: >Karl Barrus says: >> Eric Hughes just told me some extremely interesting information >> concerning subliminal channels and the DSS. Apparently, the DSS is >> very hospitable towards subliminal channels. (I won't summarize >> further since Eric may have posted to the list). > >A very good posting, Karl, but I will note in the literature these are >called "covert" channels, not "subliminal" channels. Otherwise, really >top quality posting. > >Perry Yvo Desmedt gave a very nice paper at the Crypto '88 conference, which I attented, entitled "Abuses in Cryptography and How to Fight Them." He begins: "[Sim83b] introduced the notion of subliminal channel. His example is related to two prisoners who are communicating authenticated messages in full view of a warden who is able to read the messages. The subliminal consists in hiding a message _through_ the authentication scheme such that the warden _cannot detect its use nor read the hidden part_." Later he writes: "Abuses (in particular subliminal channels) are not covert channels in the strict way, as will briefly be discussed in Section 2.2." Covert channels usually refer to using "out of band" techniques, such as signal crosstalk, time-jitter, amplitude modulation, etc., to pass information (e.g., to leak bits out of a classified computer facility), whereas subliminal channels rely on the crypto protocols. (I suppose the Clipper could use either or both, or could be rigged that way.) I've heard people use the term "covert channel" in a broader sense, encompasssing the subliminal channel term coined by Simmons as well as the tradional covert channel, but certainly the term "subliminal channel" is not incorrect as used by Karl. ("Covert" may be more descriptive than "subliminal," though such is life.) I'll leave the rest of the discussion for interested readers. "Advances in Cryptology--CRYPTO '88," ed. S. Goldwasser, Springer-Verlag, 1990. By the way, Desmedt's paper argues persuasively that "abuse-free cryptography" overcomes the objections to public key crypto that terrorists and others bad folks will be able to pass subliminal messages. If the weaknesses mentioned by Eric Hughes and Karl Barrus are confirmed, this could be another point of attack against Clipper. Like Perry, I enjoyed Karl's summary. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: by arrangement Note: I put time and money into writing this posting. I hope you enjoy it.

1 0