- cypherpunks-legacy@lists.ogf.org

SEA Letter to New York Times Editors re Clipper (fwd)
by Simona Nass 24 Apr '93

24 Apr '93

I faxed this out last night. The press release is our next step. We are looking to put together a more detailed, more technologically savvy version to send to computer mags and stuff. Those who want to help, subscribe to sea-media-request(a)panix.com. We can use your help on this next version. -S. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Society for Electronic Access Post Office Box 3131 Church Street Station New York, NY 10008-3131 Internet: sea(a)panix.com Phone Contact: Steve Barber, (212) 787-8421 April 23, 1993 Via Fax: (212) 556-3690 Letters to the Editor The New York Times 229 West 43rd St. New York, NY 10036 Dear Editor: Last week the Clinton Administration proposed a new standard for encrypting telephone messages and other electronic transmissions (see John Markoff's articles in the New York Times, "Electronics Plan Aims to Balance Government Access With Privacy," April 16, 1993, p. A1, and "Communications Plan Draws Mixed Reaction," April 17, 1993, p. 35). The announcement took by surprise many people who are concerned with the security and privacy of digital communications. The Society for Electronic Access, an organization concerned with civil liberties and access issues involving computers, believes that the government is acting with undue speed in its desire to begin widespread use of the "Clipper chip" in six months, before the full implications of its plans have been explored. We strongly believe that more thought and study should be directed to the government's decision. In its haste to mediate between the desire of government agencies to intercept unlawful communications and the right of citizens to privacy, the administration may end up promoting a plan that is responsive to neither side. Among the issues that raise serious concerns: + Other encryption techniques currently in wide use have been subjected to rigorous public scrutiny, but the "Skipjack" algorithm embodied in Clipper is secret. No one knows whether it may contain unforeseen vulnerabilities or even deliberately-inserted backdoors for easy decoding. Examination by a government-picked panel of cryptographic experts is not sufficient to guarantee its security -- and certainly not the abbreviated examination that would be possible under the administration's fast-track plan for putting Clipper into service. At a very minimum, the Administration has an obligation to allow inspection by more independent experts, and to say why this scheme must be kept private, while other encryption standards of the past two decades have been widely published + The proposal to hold user's keys in escrow for wiretapping is inadequately defined. No one knows who will hold the keys, how they will protect the key database from illicit access or how a Clipper phone might be re-secured once its keys have been released for tapping. (Consider, by the way, that a magnetic tape cartridge holding keys for all the telephones in America could fit in a shirt pocket.) Such crucial issues should be settled before Clipper is even considered. + By throwing its weight behind the Clipper chip, the government appears to be unfairly subsidizing a handful of companies at the expense of the rest of the U.S. telecommunications industry. (Indeed, others who have attempted to develop secure communications equipment have as often as not found roadblocks thrown in their way.) The rationale for awarding such an enormous potential windfall is unclear. + Because the Clipper chip is not intended for export, U.S. companies that adopt it could be at a serious disadvantage in international markets. They would have to develop and maintain dual product lines or else cede the global competition for secure telecommunications to other nations. The government should abandon its attempt to rush Clipper-based equipment into the market until these and other issues have been addressed. Although introduction of the Clipper chip does not (at least at the moment) appear intended to foreclose the development and sale of other encryption technologies, the government's preferred solution is likely to have a strong impact. If it turns out to be vulnerable, or if it impedes the entry of U.S. firms into the international market for secure telecommunications, both our constitutional freedoms and our economic competitiveness will be severely damaged. Any technology that bears such risks must be subjected to thorough public scrutiny and open debate before a decision is made on whether to adopt it. Sincerely, Simona Nass President Board of Directors: Stacy Horn Joe King John McMullen Simona Nass Lance Rose, Esq. Alexis Rosen Paul Wallich

1 0

Re: saltzer and schroeder on information protection
by Peter Wayner 24 Apr '93

24 Apr '93

Although the "details" are classified at this time, I believe that the secrecy is just part of the plan to prevent software implementations that could easily spoof anyone who was trying to listen in by munging the law enforcement block. I'm sure the algorithm would continue to be secure even after the details are discovered. The secrecy is to control use not to prevent decryption. This is, I believe, the greatest achilles heel of this proposal. There are at least 40 million PC's in this country. They would like this chip to become the "standard" for all encryption. That would mean putting in every machine. The cost of this could range from $25 to $100 per machine. That means this whole plan could cost $1 billion to $4 billion dollars in real money. A new software encryption standard, however, could be promulgated with about one summer's work by an undergraduate handy with C. I believe that people aren't going to be willing to add the additional hardware to their PC boxes. Look how slowly better video standards have evolved in the PC domain. Look how slowly CD-ROMs are becoming standard. Everyone agrees that this technology would be nice, but no one is willing to raise the level of their standard boxes to include this hardware. Raising the price of their standard box puts them at a competitive disadvantage. So the lowest common denominator continues. DES chips have been around for _years_ and no one builds them into their boxes. Why is this chip going to be any different? -Peter

1 0

OSF's DCE
by Kang Meng Chow 24 Apr '93

24 Apr '93

Can anyone tell me what is OSF's DCE, pls. And where can I find more information regarding DCE. Any ftp site carrying documentation on the DCE? Thanks. Kang

2 1

DEAD AIR
by Matthew J Miszewski 24 Apr '93

24 Apr '93

Wow, When the cypherpunks have a physical meeting cyberspace fills with an erie silence... Please for those of us who could neither attend the various meetings nor hook up with other transmissions, could ONE person post a good summary. My Mailbox was actually empty thisafternoon!!! Matt

1 0

Summary sheet?
by The Phantom 24 Apr '93

24 Apr '93

Does anyone have a summary sheet they have come up with that I could distribute? With some of my mailings (to my congresspeople, mostly) I'd like to inform them to exactly what I am talking about. Anything this weekend I can get my hands on would help -- Matt Matt Thomlinson Say no to the Wiretap Chip! University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 528-5732 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

1 0

hi guys
by Tom Keenan 24 Apr '93

24 Apr '93

sub Thomas P. Keenan -- Dr. Tom Keenan, I.S.P. Associate Dean, R&D, Faculty of Cont. Ed. University of Calgary 2500 University Dr. NW Calgary, AB T2N 1N4 CANADA (403) 220-4715 (voice) (403) 284-5702 (fax) keenan(a)acs.ucalgary.ca (email)

1 0

hi guys...
by Tom Keenan 24 Apr '93

24 Apr '93

sub Thomas P. Keenan -- Dr. Tom Keenan, I.S.P. Associate Dean, R&D, Faculty of Cont. Ed. University of Calgary 2500 University Dr. NW Calgary, AB T2N 1N4 CANADA (403) 220-4715 (voice) (403) 284-5702 (fax) keenan(a)acs.ucalgary.ca (email)

1 0

saltzer and schroeder on information protection
by peter honeyman 24 Apr '93

24 Apr '93

this is taken from a paper i'm writing with avi rubin. it's not a sound bite, more like a snack. peter =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Experts dismiss systems that hide cryptographic algorithms or protocols (a.k.a. "security through obscurity"). Kahn [1] cites Kerckhoffs' classic treatise on military security [2]. Saltzer and Schroeder [3] reflect the modern view in describing "open design" as one of the basic principles of information protection: The design should not be secret. The mechanisms should not depend on the ignorance of potential attackers, but rather on the possession of specific, more easily protected, keys or passwords. This decoupling of protection mechanisms from protection keys permits the mechanisms to be examined by many reviewers without concern that the review may itself compromise the safeguards. In addition, any skeptical user may be allowed to convince himself that the system he is about to use is adequate for his purpose. Finally, it is simply not realistic to attempt to maintain secrecy for any system which receives wide distribution. 1. D. Kahn, The Codebreakers, Macmillan Publishing Co., New York (1967). 2. A. Kerckhoffs, La Cryptographie Militaire, Libraire Militaire de L. Baudoin & Cie., Paris (1883). 3. J.H. Saltzer and M.D. Schroeder, "The Protection of Information in Computer Systems," Proc. of the IEEE, Vol. 63(9), pp. 1278-1307 (September, 1975).

1 0

Re: Privacy International (fwd)
by Dave Banisar 24 Apr '93

24 Apr '93

RE: PI and Clipper Privacy International recently nominated the FBI for its Big Brother Award (see below) for the digital telephony proposal. Need I say more? For more info on PI, check out the CPSR Internet Library at cpsr.org /privacy_international Dave Banisar Director, PI Washington Office (one of my many hats) ------ Forwarded Message The following forwarded from alt.privacy. Anybody have experience with this group? Have they taken a position on the wiretap chip? ... THE BIG BROTHER AWARDS Governments, private sector organizations, credit bureaus, police departments and the military in many countries are engaging in programs which have the effect of eroding the rights and privacy of individuals. These practices often breach international human rights conventions, and threaten the balance or evolution of free and open societies. In many cases, information technology is used for the purposes of increasing the power of authorities, while diminishing the rights of individuals. These violations occur in all parts of the world. The Big Brother awards sponsored by Privacy International, will be given to the organization, initiative, government or act which is most invasive of private life, or which is responsible for the most dangerous and intrusive acts of surveillance. Privacy International believes that there should be a more widespread awareness of these practices. We believe people have the right to know when governments or other organizations are engaging in intrusive practices that limit individual rights. We aim to provide an effective context for viewing these invasive practices, by establishing an international benchmark. The establishment of the Big Brother awards aims to provide a world-wide focus on surveillance and privacy.

1 0

Family key is symmetric
by fnerd＠smds.com 24 Apr '93

24 Apr '93

As I understand it, the Skipjack system is symmetric, i.e., decrypt key= encrypt key. Also, the unit serial number seems to only get encrypted with the family key. So, once the family key and the algorithm are known, it will be possible to create messages with any unit serial number you want, right? Wouldn't this be enough to foil the casual traffic-analysis feature of the crippler? --fnerd the keyhole chip the wing clipper co-intel inside as seen on whitehouse stationery only open a crack the taped lock cyphergate "Daffy, you quack me up." --Elmer

1 0