- cypherpunks-legacy@lists.ogf.org

Blasting Bidzos Blather
by L. Detweiler 18 Jun '93

18 Jun '93

The following message is FOR CYPHERPUNKS ONLY. I specifically *prohibit* further distribution past the mailing list! Please do not betray my trust! [Bidzos] >I'm genuinely > confused, as I believe the situation is as simple as I put it to you. > Our claims of patent infringement by DSS, made over the last 18 > months, were well-known and publicized. NIST has capitulated. Seems > pretty straightforward to me. The more I read from Bidzos, the less I believe he has any overall control or even awareness of the company, or is purposely duplicitous. His vague and weak defenses I find personally intelligence-insulting. DSS seemed to defy the face of all public input into the standard, which opposed the NIST algorithms (`handed down' in a dictatorial and authoritarian manner, sound familiar?) in favor of RSA. How is it that Bidzos makes no reference to this? Apologists for DSS such as Denning do so on two major grounds: 1) it is part of the larger plan involving Clipper, therefore lack of duality in encryption and authentication features (an implicit characteristic of RSA) is not a problem 2) the security is `no weaker' (cunningly disguised as to appear to say `better') than RSA. Both are noxiously misleading arguments in themselves, but are also decoys (like key escrow agencies and procedures) to the critical issues at stake. The critical point is that even the *appearance* of a `fair and impartial' standards making process was totally defied, to the point of suggesting a complete clandestine backroom collusion! (hm, sound familiar?) But gosh, I wonder how many people would have advocated RSA back then when they could predict the future: that NIST would not only embrace PKP but would award them a complete monopoly on signature standards. Somehow proponents of this new NSA-Clipper-Capstone obscenity are now pointing back to history and saying that the main objections to DSS standards were *technical* (strength of the algorithm) and *legal* (PKP patenting) and that they have been wholly ameliorated by improvements (in key size) and recent events (PKP support). This is historical revisionism at its worst! From my point of view, critical main objections were on the warped process that permitted an unpopular (and perhaps even subversive) standard be adopted! This revisionism definitely suggests something deeper and `ulterior' is going on---that a comprehensive NSA-PKP alliance is in place? > BTW, on Clipper, ATT, Motorola, IBM could have done Clipper without > ever talking to us. Contrary to popular belief, we don't dictate > terms to licensees. First, I find it absolutely ridiculous for an informed agent of PKP, and for that person to coincidentally be called the *president*, to claim that `we don't dictate terms to licensees'. This is only true in the sense that if the licensee does not agree to the terms put down by PKP, they don't get the license! Second, I would like to see PKP contracts. There are probably more clauses than a bad run-on sentence. I'll go out on a limb and wager that PKP *does* limit the use of RSA in the company's products, and that the licenses are fairly specific. It seems rather inconceivable to me that any such corporate agreement that could be so simplistically summarized as `PKP gives rights to company [x] to use RSA in *any* of their products as long as they pay [y] royalties'. The agreement is very likely product-specific and implementation-limiting. Perhaps Mr. Bidzos or representatives of companies involved would be willing to forward copies of these agreements for our consideration of Mr. Bidzos' claims, assuming they are not `classified'... Third, regardless of presence of product-specific limitations in the licenses, and even if PKP has sold licenses to companies that somehow permit them the latitude to include RSA technology in their Clipper implementations, PKP can certainly take the future stance that they will prohibit that use in future corporate contracts! If Mr. Bidzos really thinks that Clipper is `ill-conceived, ill-timed, and undesirable' perhaps he should figure out how to keep his company from supporting, nay, *promoting* and *profiting* from it. Let's look again at the announcement: >PKP will also grant a license to practice key management, at no >additional fee, for the integrated circuits which will implement >both the DSA and the anticipated Federal Information Processing >Standard for the "key escrow" system announced by President Clinton >on April 16, 1993. `at no additional fee'? What does that mean, `for free'? This apparently means Mycotronx, despite being a private company, does not need to license (read: pay for) the RSA patents on the critical key-exchange function for use in Capstone for *any* implementations (public or private), nor does any other company NSA decides to induct into its privileged enclave. Hm, I wonder how RSA's other `customers' feel about that? And why would PKP voluntarily give up this potentially valuable revenue source? Clipper implementations could be *extremely* lucrative for PKP. That they don't license them specifically, and in fact voluntarily give up the perogative to do so, suggests that they gave up something greater in return for them. Namely, the award of an official U.S. government-endorsed monopoly on DSS and arguably all valuable cryptographic techniques. By the way, let's look Mr. Bidzos' quote on Clipper. Clipper is `ill-timed'? What does this suggest, that a NSA-PKP partnership would be better served if it came out sooner or later? Clipper is `ill-conceived and undesirable'? For who? Was it that PKP perhaps didn't hear about it soon enough to rob all the tasty new cryptographic algorithm patents surrounding it, like it did with the Schnorr patent? The licensing notice (which was probably reviewed and approved by PKP representatives) refers to Clipper as `an anticipated Federal Information Processing Standard?' How, Mr. Bidzos, can this new revelation possibly be construed to indicate that Clipper `will go away'? Yes, I suppose Mr. Bellovin was right. The omnipresent underlying message here is that nothing is unethical if PKP profits from it. I advise cypherpunks not to take Mr. Bidzos' comments literally. They are, however, interesting from the perspective of the study of the speech of either an uninformed figurehead or a capitalist (or even nationalist) co-conspirator. P.S. all cypherpunks `for' an alliance with PKP, please raise your hand. I personally find the image of `lumbering but ultimately benevolent corporation' too incredible to hold in the face of recent events, and am now actually quite embarrassed to have advocated some `good faith' proposals involving the company which look naively misguided in hindsight. PKP is not going to go away when a few of its patents expire. To the contrary, it appears to be clutching everything within reach to ensure its eternal domination in the commercial cryptographic field. (sound familiar? a PKP-NSA alliance makes perfect sense.)

1 0

Clipper fact
by fergp＠sytex.com 18 Jun '93

18 Jun '93

On Wed, 16 Jun 93 22:41:33 PDT, Marc Briceno <uunet!ideath.goldenbear.com!mbriceno> wrote - > I am representing the anti-clipper side in an ongoing debate in > the "Wired " conference on OneNet. The governmental lemmings > question the existence of the "Law Enforcement Exploitation > Field" and want citations. Would the person who posted the > hard facts about Clipper please send me all the info? > Thanks in advance, I've collected about 700 kb worth of information regarding Clipper/Capstone, but this post from Dorothy Denning should be exactly what you are looking for. It was originally posted to sci.crypt and reposted to cypherpunks by Tim May. 8<------- Cut Here --------------------

1 0

Stegosaurs
by fnerd＠smds.com 17 Jun '93

17 Jun '93

Hal Finney <74076.1041(a)compuserve.com> sez > (...did anyone notice that there weren't any stegosaurs in Jurassic > Park? Just another sign of the government crackdown on crypto?) No, silly! They were hiding behind treetrunks and disguising themselves as tourguides! Don't you know the first thing about stegosaurs? -fnerd quote me time to recycle some elephant jokes

1 0

Re: Weak steganography
by kqb＠whscad1.att.com 17 Jun '93

17 Jun '93

Hal Finney said: > Another problem is that encrypted files look different from executable > files. Encrypted files have a uniform histogram (that is, all 256 different > possible byte values are equally frequent), but exe files do not. ... I am building a "steganosaurus" and eventually will need to solve a similar problem. (A "steganosaurus" applies a primitive steganographic technique to English text by using a thesaurus to generate enough word variation to encode a hidden message.) One of the weaknesses of this "steganosaurus" is that the resulting output has statistical differences from normal English text. For example, word frequency will be skewed. Worse, I have to assume that the eavesdropper knows my steganization algorithm and can "desteganize" any innocuous-looking text I produce. That "desteganized" text will show clearly the existence of a hidden, encrypted message because, as Hal pointed out, it has a uniform histogram. What I want is a program that will transform an encrypted file to a (slightly larger) file that mimics the distribution achieved by applying the "desteganization" algorithm to normal English text that does *not* contain any hidden message. The steganization algorithm then gets applied to this stealthy, mimic file, not directly to the encrypted hidden message. By the way, since we must assume that the eavesdropper knows all our algorithms but not our secret keys, this algorithm will require a *second* secret key in addition to the secret key used in the original encryption. I'm not ready to tackle that yet. Unless I hear otherwise, I'll assume that if anyone knows how to achieve this, they're not telling... Kevin Q. Brown INTERNET kqb(a)whscad1.att.com or kevin_q_brown(a)att.com PS: I found that a simple, semi-automatic algorithm can generate a public message only 5 to 10 times as long as the hidden message. Unfortunately, the public message from my simple algorithm is almost always a bizarre, disconnected sequence of rants, which, for most people, is not normal. That is why I am building my "steganosaurus". After that I will see if combining a natural language parser with transformational grammars can produce a less primitive, more efficient "trans-steganosaurus".

1 0

Re: "RSA sells out" hue and cry (fwd)
by Stanton McCandlish 17 Jun '93

17 Jun '93

This is in reference to the material direct from Jim Bidzos of RSA that I have posted, re: the charges that NSA is selling out to the Clipper scheme by licensing NIST to use their "patented algorithms" <snort> Quoth FutureNerd Steve Witham, verily I saith unto thee: > > Draw your own conclusions. I sure will. > > What the hell kind of conclusions are you drawing? Will you cut the > sniffing and say what you mean? Sniping is tiresome. Sniping that > doesn't even make a whiff of sense is doubly so because it's > confusing. Pardon my pique but there's a *real* war on. RELAX, fnerd! I almost sent you my new "Dear flamer" form letter, but I guess this deserves an answer. Please don't yell at me like this. My cautious conclusion from this and other discussions with Jim directly (at least I presume it is he; as I said before I get suspicious when the head of the worlds largest cryptography corp. does not use his own signatory authentication software), is that 1) RSADSI/PKP cares only for its bottom line. People like Jim Bidzos may care about stopping Clipper, but that is largely irrelevant in a corp. It's like your brain deciding it doesn't want food. Your body will go on craving food if you like it or not. 2) DSI is more-or-less anti-clipper, because it will hurt their biz in the long term. It is, being a typical corp., driven more by immediate profit motive; thus it calls bullshit on the Gov't violating their "patent", and thus accepting the deal when the govt "capitulates". In typical corporate double think, it does not see the blindinly obvious conflict of interests here. The weasel factor is likely the rationalization that key escrow does not equal clipper, which is true, though as we all know, they two are intertwined like snakes in a basket. 3) there is no conspiracy of PKP/RSA with NIST/NSA. It's just a product of commercial short-sightedness and even outright stupidity and illogic. 4) regardless of this, this move on the part of RSA is likely to be detrimental to the cause, and is dangerous. As for your other points: A) I am "sniffing" and I said this is a "cautious" conclusion, because all the evidence is not in. B) sniping is USEFUL. Ask any revolutionary. This is not a pitched battle, it is a guerilla war, a propaganda war, & a political cold war. C) it makes plenty of sense. My intent was to present the facts and material I find (for which I actually expected some thanks, imagine that! Who else among you bothered to make the effort to contact Big Jim personally and get their side of the story?), and to encourage people to think about it and weigh the data and "draw your own conclusions". I do not Know All in this matter, and did not wish to try to force my view on the whole. Furthermore, I think you are upset with the messenger, rather than concentrating on the message. All I am doing is saying, "Here I got this. It made me think. Look at it and think about it too." D) Yes there's a war on. But I am not Rambo, I'm the USAF journalist who doesn't feel like getting shot thank you very much ;) Note this is being passed on to the appropriate list and groups, in case others need this clarification. -- Stanton McCandlish * Space Migration * Networking * ChaOrder * NO GOV'T. * anton(a)hydra.unm.edu * Intelligence Increase * Nano * Crypto * NO RELIGION * FidoNet: 1:301/2 * Life Extension * Ethics * VR * Now! * NO MORE LIES! * Noise in the Void BBS * +1-505-246-8515 (24hr, 1200-14400, v32bis, N-8-1) *

1 0

Re: fast des
by smb＠research.att.com 17 Jun '93

17 Jun '93

The DEC gigabit/second DES chip was based on the FURY VSC15K gate array from Vitesse. It's a gallium arsenide device. The full paper is ``A High-speed DES Implementation for Network Applications'', by Hans Eberle, SRC Research Report 90, DEC Systems Research Center. Abstracts are (apparently) online in pub/DEC/srcabstracts.list, on gatekeeper.pa.dec.com. You can get hard-copy by sending email to src-report(a)src.dec.com. Oh yeah -- he gives the search time as 16 days, for about $1M in DES chips alone, without any support circuitry. The chips are estimated to cost $300 apiece. His chip is well-suited for DES-cracking because it has a separate key-loading port, so you can change the key each cycle without slowing down the pipeline.

1 0

Contempt of Court
by axelrod＠s106.es.llnl.gov 17 Jun '93

17 Jun '93

If the key itself had embedded testimony that was incriminating, then it is possible one could invoke the 5th amendment to avoid disclosure of the key. But, I suppose a court could do an end run around that by giving limited use immunity for the incriminating content of the key. Comments? Mike.

1 0

Returned mail: User unknown
by Mail Delivery Subsystem 17 Jun '93

17 Jun '93

----- Transcript of session follows ----- While talking to RoseBud.EE.UH.EDU: >>> RCPT To:<nobody(a)rosebud.ee.uh.edu> <<< 550 <nobody(a)rosebud.ee.uh.edu>... User unknown 550 nobody(a)rosebud.ee.uh.edu... User unknown ----- Unsent message follows ----- Received: by eff.org id AA00334 (5.65c/IDA-1.5/ident for nobody(a)rosebud.ee.uh.edu) Thu, 17 Jun 1993 16:05:38 -0400 (ident-sender: mnemonic(a)eff.org) From: Mike Godwin <mnemonic> Message-Id: <199306172005.AA00334(a)eff.org> Subject: Re: Contempt of court To: nobody(a)rosebud.ee.uh.edu Date: Thu, 17 Jun 1993 16:05:37 -0400 (EDT) In-Reply-To: <9306171750.AA02648(a)toad.com> from "nobody(a)rosebud.ee.uh.edu" at Jun 17, 93 12:52:05 pm Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Content-Length: 1440 nobody writes: > People should not be able to be forced by a subpoena duces tecum to provide > incriminating documents. The fifth amendment protection against self- > incrimination normally extends to personal papers. There are cases > which show that corporate officers cannot avoid turning over corporate > papers even if they incriminate themselves, but personal papers are > provided much wider protection. This is true, but it's not precisely the issue with regard to encryption keys. > But none of these involve giving testimony against themselves. Producing > a personal diary or notes which provide incriminating testimony should > be protected by the fifth amendment. Providing the key would not be seen as legally identical to providing the unencrypted document. > By this reasoning, someone may be able to be forced to reveal an encryption > key, since that is not testimony. But if the resulting documents, when > decrypted, are personal and contain damaging, incriminating statements, > they would not be usable in court. To introduce them in court against > the wishes of the defendant would be a clear violation of his fifth > amendment rights. Unfortunately, this has not been Fifth Amendment law for a long time. If a search and seizure takes place at your house, and the investigating agents find your diary, they can use it against you. If the diary is in code, they can attempt to decode it. --Mike

1 0

Re: Weak steganography
by bear＠eagle.fsl.noaa.gov 17 Jun '93

17 Jun '93

Eric Hollander writes: >Another problem is that encrypted files look different from executable >files. Encrypted files have a uniform histogram (that is, all 256 different >possible byte values are equally frequent), but exe files do not. The >appending of an encrypted file to an executable file will be very obvious. So write an encryption routine that wastes bandwidth but outputs executable code. You could even encapsulate it within procedures which randomly call one another, to make it look more like real code. (Your encrypted data would be limited to shuffling data between registers and operations within registers, e.g.: mov ax, bx add ax, cx mov bx, dx or ax, bx It's not a crime to write bad assembler code... yet. A nice piece of misdirection would be a homebrew compiler for some really bizarre language. A compiler which produces output remarkably like the output of your encryption program. If someone asks why you are only using a small subset of the instruction set, you shrug and claim that optimized code generation is on your "to-do" list. Bear Giles

1 0

Re: fast des
by smb＠research.att.com 17 Jun '93

17 Jun '93

how fast is fast des these days? (i have measured over 2 mbps on decent workstations.) i was in a meeting today attended by someone from nsa who said that 2.4 gbps des chips exists today. (he got real silent after blurting this out. hmm.) 2.4 gbps is 37.5 million des per sec. it is probably not much challenge to put together a 65,536 element machine, which would run at 2.5 trillion des per sec. if i have my arithmetic right, this could exhaustively test the space of 56 bit keys in about eight hours. I don't know of any 2.4 gbps DES chips, but DEC has built a 1 gbps chip. They've even published a technical report on it, though I don't have the number handy. But there's more to know than simply the raw speed. First of all, most real DES chips -- i.e., those designed for encryption, rather than brute-force cryptanalysis -- are optimized for encrypting large blocks of data. Key-loading is a different operation, and that might not go nearly as fast. Any hardware assists (i.e., DMA) would be for the data, not for the next key to use on the same block of data. Second, what does this chip cost? If it costs, say, 10x what the DEC chip costs, it's not cost-effective; you can build your DES-cracker more cheaply with the slower chips. (The DEC TR gave cost figures for DES-cracking...)

5 4