- cypherpunks-legacy@lists.ogf.org

Re: Sound bite time
by peb＠PROCASE.COM 20 Apr '93

20 Apr '93

I like the newer sound bites. ``Having to deposit copies of all your private letters with the authorities, "in case" they need to later read them...'' and ``Giving the government keys to your encrypted messages is like giving them keys to the front door of your house.'' seem best. Phil, About the right to bear arms and crypto-privacy...you are right--it is not a good sound bite for J. Q. Public, but could be a good angle for *understanding* (uhg, I hate this sound bite stuff.) Paul E. Baclace peb(a)procase.com

1 0

WIRETAP: Non-technical statement
by dstalder＠gmuvax2.gmu.edu 20 Apr '93

20 Apr '93

I've had some people ask me about a non-technical synopsis of the Wiretap Chip proposal. What follows is it. Can you please look over it for errors? I am still very much the amateur when it comes to cryptography. The WIRE-TAP Proposal: Problems with it. The White House sent out a press release on Friday 16 April about a voice encryption chip called the Clipper chip. This has come to be known as the Wiretap chip since it allows any Law Enforcement agency to automatically decrypt any conversations made with it with a search warrant. The LE presents said search warrant to two different escrow agencies to obtain the keys (80 bits long) that automatically decrypts your conversation. The Electronic Freedom Foundation (EFF) and the Computer Professionals for Social Responsibility (CPSR) have both criticized the proposal. There was even a negative article already in Network World (19 Apr 93). The paragraphs that follow are facts and problems I have collected by listening to other discuss the Wiretap chip. Say you wanted to encrypt your talk with someone over a phone. Well, since you and the person you want to talk to both have the Wiretap (Clipper) chip in your phones, you can automatically encrypt your conversation. All fine and good encryption for the consumer. Now, what if you come under investigation by the local constabulary? The get a court order and ask the escrow agencies (non-law enforcement types) for your key. They already have the family key since that is the same in each chip. They now have your specific key. With these two keys, they can decrypt all conversations that you have. This includes conversations that are not legal to wiretap such as attorney-client, doctor-patient and so on. They also have that key for any all future sessions that you use that phone for. Start to see the problem? This part is all legal... Search warrants are even exceedingly easy to get at times. There have been reports of the FBI get groups of 50 signed and blank search warrants from the DoJ. Now, there are other problems. Would you give the IRS keys to your house and filing cabinet as long as they promised that they would only use it under proper authorization? The key length of 80 bits is still considered cryptographically weak. It would take determined effort by an agency with a supercomputer but your key could be broken. The cryptographic algorithm is also being kept classified. This is not the usual practice. In the cryptographic community, algorithms are public. This way people can be assured there aren't any back doors and that the algorithm can stand on its own strengths, not that of secrecy. It has also been hinted at by NIST (the agency behind the technical implementation of the chip.) that the chip could be compromised if the algorithm was made public. It is not that difficult to reverse engineer a chip these days. Finally, some of the implications behind this announcements are dire. The Wiretap chip could become the market or legislative standard. This could mean that other implementations of cryptographic voice transactions would be very difficult to obtain or would be illegal to obtain. Why would a criminal use the Wiretap chip when they knew it wouldn't encrypt their conversations against the LE agencies? They wouldn't, they would use other encryption technologies. Would this mean that using something other than the Wiretap chip is probable cause and puts you under suspicion? One last fishy thing is that AT&T has already (on the same day) announced phones with this chip. This implies (means?) that AT&T has known about this chip for a while. They seem to be more concerned about getting a jump on the competition than producing a product that will actually give their users real security. 'Course, there is the question of collusion between the governement and industry. Only two companies will be allowed to manufacture the chip, VLSI and Mykotronix. Jeff Hendy, director of new product marketing for VLSI, says his company expects to make $50 million of the chip in the next 3 years. (This from the San Jose Mercury News.) Hopefully, I haven't left stuff out. I am going to forward this to cypherpunks for the experts there to check it out. Think free, -- Defeat the Torin/Darren Stalder/Wolf __ Wiretap Chip Internet: dstalder(a)gmuvax2.gmu.edu \/ PGP2.x key available. Proposal! Bitnet: dstalder@gmuvax Finger me. Write me for Sprintnet: 1-703-845-1000 details. Snail: 10310 Main St., Suite 110/Fairfax, VA/22030/USA DISCLAIMER: A society where such disclaimers are needed is saddening.

1 0

Another Clipper weakness
by Hal 20 Apr '93

20 Apr '93

Perry asks about the 30-bit serial number. Actually, it appears that the unit key UK is a function of the serial number plus the two 80-bit random numbers input by the escrow agents when the chips are programmed. This would prevent an easy guessing attack as long as these random numbers S1 and S2 are unknown. The one problem is that S1 and S2 are not changed for each chip, but are rather kept the same in programming a batch of about 300 chips. Then they are supposed to be destroyed. The potential weakness is that if someone managed to keep a copy of the S1 and S2 values which were used to program all clipper chips (only about 3000 such values for a million chips), then Perry's suggested attack could work. This would be few enough bits that the unit key could be guessed. Those who are asked to judge the safety of the system will presumably pay careful attention to the measures used to insure that S1 and S2 are not saved. I don't know how they'll check for NSA micro-cameras in the vault ceiling, though... Hal

1 0

(fwd) THE CLIPPER CHIP: A TECHNICAL SUMMARY
by tcmay＠netcom.com 20 Apr '93

20 Apr '93

Cypherpunks, Here's the most complete and readable summary of the Wiretap Chip I've seen. Ironically, it comes from none other than Dorothy, the Wicked Witch of the East, who claims she knew nothing of it until Thursday night, just before the announcement. Curiouser and curiouser. -Tim May From: denning(a)guvax.acc.georgetown.edu Newsgroups: sci.crypt Subject: THE CLIPPER CHIP: A TECHNICAL SUMMARY Date: 19 Apr 93 18:23:27 -0400 Distribution: world Organization: Georgetown University The following document summarizes the Clipper Chip, how it is used, how programming of the chip is coupled to key generation and the escrow process, and how law enforcement decrypts communications. Since there has been some speculation on this news group about my own involvement in this project, I'd like to add that I was not in any way involved. I found out about it when the FBI briefed me on Thursday evening, April 15. Since then I have spent considerable time talking with the NSA and FBI to learn more about this, and I attended the NIST briefing at the Department of Commerce on April 16. The document below is the result of that effort. Dorothy Denning --------------- THE CLIPPER CHIP: A TECHNICAL SUMMARY Dorothy Denning April 19, 1993 INTRODUCTION On April 16, the President announced a new initiative that will bring together the Federal Government and industry in a voluntary program to provide secure communications while meeting the legitimate needs of law enforcement. At the heart of the plan is a new tamper-proof encryption chip called the "Clipper Chip" together with a split-key approach to escrowing keys. Two escrow agencies are used, and the key parts from both are needed to reconstruct a key. CHIP STRUCTURE The Clipper Chip contains a classified 64-bit block encryption algorithm called "Skipjack." The algorithm uses 80 bit keys (compared with 56 for the DES) and has 32 rounds of scrambling (compared with 16 for the DES). It supports all 4 DES modes of operation. Throughput is 16 Mbits a second. Each chip includes the following components: the Skipjack encryption algorithm F, an 80-bit family key that is common to all chips N, a 30-bit serial number U, an 80-bit secret key that unlocks all messages encrypted with the chip ENCRYPTING WITH THE CHIP To see how the chip is used, imagine that it is embedded in the AT&T telephone security device (as it will be). Suppose I call someone and we both have such a device. After pushing a button to start a secure conversation, my security device will negotiate a session key K with the device at the other end (in general, any method of key exchange can be used). The key K and message stream M (i.e., digitized voice) are then fed into the Clipper Chip to produce two values: E[M; K], the encrypted message stream, and E[E[K; U] + N; F], a law enforcement block. The law enforcement block thus contains the session key K encrypted under the unit key U concatenated with the serial number N, all encrypted under the family key F. CHIP PROGRAMMING AND ESCROW All Clipper Chips are programmed inside a SCIF (secure computer information facility), which is essentially a vault. The SCIF contains a laptop computer and equipment to program the chips. About 300 chips are programmed during a single session. The SCIF is located at Mikotronx. At the beginning of a session, a trusted agent from each of the two key escrow agencies enters the vault. Agent 1 enters an 80-bit value S1 into the laptop and agent 2 enters an 80-bit value S2. These values serve as seeds to generate keys for a sequence of serial numbers. To generate the unit key for a serial number N, the 30-bit value N is first padded with a fixed 34-bit block to produce a 64-bit block N1. S1 and S2 are then used as keys to triple-encrypt N1, producing a 64-bit block R1: R1 = E[D[E[N1; S1]; S2]; S1] . Similarly, N is padded with two other 34-bit blocks to produce N2 and N3, and two additional 64-bit blocks R2 and R3 are computed: R2 = E[D[E[N2; S1]; S2]; S1] R3 = E[D[E[N3; S1]; S2]; S1] . R1, R2, and R3 are then concatenated together, giving 192 bits. The first 80 bits are assigned to U1 and the second 80 bits to U2. The rest are discarded. The unit key U is the XOR of U1 and U2. U1 and U2 are the key parts that are separately escrowed with the two escrow agencies. As a sequence of values for U1, U2, and U are generated, they are written onto three separate floppy disks. The first disk contains a file for each serial number that contains the corresponding key part U1. The second disk is similar but contains the U2 values. The third disk contains the unit keys U. Agent 1 takes the first disk and agent 2 takes the second disk. The third disk is used to program the chips. After the chips are programmed, all information is discarded from the vault and the agents leave. The laptop may be destroyed for additional assurance that no information is left behind. The protocol may be changed slightly so that four people are in the room instead of two. The first two would provide the seeds S1 and S2, and the second two (the escrow agents) would take the disks back to the escrow agencies. The escrow agencies have as yet to be determined, but they will not be the NSA, CIA, FBI, or any other law enforcement agency. One or both may be independent from the government. LAW ENFORCEMENT USE When law enforcement has been authorized to tap an encrypted line, they will first take the warrant to the service provider in order to get access to the communications line. Let us assume that the tap is in place and that they have determined that the line is encrypted with Clipper. They will first decrypt the law enforcement block with the family key F. This gives them E[K; U] + N. They will then take a warrant identifying the chip serial number N to each of the key escrow agents and get back U1 and U2. U1 and U2 are XORed together to produce the unit key U, and E[K; U] is decrypted to get the session key K. Finally the message stream is decrypted. All this will be accomplished through a special black box decoder operated by the FBI. ACKNOWLEDGMENT AND DISTRIBUTION NOTICE. All information is based on information provided by NSA, NIST, and the FBI. Permission to distribute this document is granted. --

3 2

Waco, crypto, and unbreakable links
by pat＠tstc.edu 20 Apr '93

20 Apr '93

> We can only speculate that the loss of life > might have been much fewer if the Branch Davidian > cult had a copy of PGP as well as a 2m packet > radio. > > They could have maintained private links with journalists > who could have given us their side of the story, which > now, tragically will never be told. I thought about this yesterday at lunch, at about the time the fire started in the Davidian compound. Only as it applies to the overthrow of a government or such. Agree on the initial frequency and time, then send the next frequency and time encoded in the message text to avoid jamming. "A rebellion is not a few men huddled around a candle talking in whispers. But a large, well funded, organization with an intricate communications network." - Unknown -- Pat Hykkonen, N5NPL Texas State Technical College at Waco {pat,postmaster}(a)tstc.edu Instructional Network Services PGP Key available by finger. 3801 Campus Dr. Waco, Tx 76705 V:(817) 867-4830 F:(817) 799-2843

1 0

CLIP: Revised sample letter
by zane＠genesis.mcs.com 20 Apr '93

20 Apr '93

I finished my letter about the wiretap chip. (I still need to proof for grammar, but the content I have set.) I'm posting it here so others may see it and their efforts could be aided. Feel free to distribute this AS MUCH as possible. If you want to comment on the letter, so so publicly, because I am sending this tomorrow morning and sending to me privately will do no good-- I will have sent it by the time I read your comments. Comments *will* be helpful though for other people. I will keep the lists informed as to what response I get from my letter if people wish. -- | Sameer Parekh-zane(a)genesis.MCS.COM-PFA related mail to pfa(a)genesis.MCS.COM | | Apprentice Philosopher, Writer, Physicist, Healer, Programmer, Lover, more | | "Be God" - Me __ "Specialization is for Insects" - Robert A. Heinlein ____/ Editor: The Clinton administration on Friday unveiled their plan for establishing a standard data encryption system for voice communications. President Clinton says that he wants to bring the United States into the twenty-first century. This proposal is bringing us to 1984. I will mention first the technical reasons why the system is inadequate. The encryption algorithim is classified; only a select group of people will be allowed to examine the algorithim for flaws. The members of the cryptographic community continually and persistently emphasize that the only way to ensure security in a cryptographic system is to have as many people as possible analyze and try to break it for as long as possible. A system which has been examined by a small segment of the population should not be trusted. Release of the algorithim is crucial to verification of a good encryption method. The earlier Data Encryption Standard (DES) for data storage encryption was a very strong standard; the academic world examined it and after a number of months found weaknesses, spawning the now-standard "triple-DES" system which is more secure. From what little is known about the encryption system, it appears to be a weak system. Such a weak system lends itself to easy decryption by an unauthorized party. It would lend a false sense of security to laypersons in the field who do not realize that a key of such simplicity could be cracked easily by any talented criminal. The necessarily secure communications between a doctor and his patient could be thus breached. If the system were strong, the government would use it for internal use, but according to the AT&T release, the government will not be using the same chip which is marketed to consumers. Apart from the technical flaws in the system, there are many political problems with this big brother proposal. First, there is the assumption that the government has a right to spy on its own citizens. The proposal for this wiretap chip includes the registration of keys with two escrow agencies. This proposal is purported to allow law enforcement to keep track of "terrorists" and "drug-dealers." The first flaw in this key-escrow system is that no self-respecting criminal will use a cryptography system which can be easily tapped by law enforcement officials-- they will use strong cryptography. The only people who may end up using the wiretap encryption system will be law-abiding laypeople who don't fully understand cryptography. (Law-abiding citizens who do understand cryptography will use strong cryptography to preserve their privacy from a talented criminal.) The proposal states that in order to obtain the key of a wiretap chip user a law enforcement agency must first establish that they have a valid interest in the key. Translated out of legalese, that means that all a government agency will have to do to get access to all of the private communications, for example, between a lawyer and her client will be to fill out the necessary forms. Registering cryptographic keys with the government is similar to giving the IRS the keys to your house and filing cabinet. A criminal who wants access to the communications between a priest and confessor needs only to find a corrupt judge. The chip is being manufactured exclusively by one company. The release stated that the Attorney shall request (i.e. coerce) telecommunication product manufacturers to use this product. This aspect of the system is a government-mandated monopoly. Such monopolies result in high prices and the elimination of market forces which drive the improvement of technology. (One needs only look at the state of the Soviet Union to see how the lack of market forces affects consumer technology.) The system exposes our President's hypocrasy because of his campaign promise to protect womens' rights to privacy and that he will see a Supreme Court nominee who believes that the Bill of Rights guarantees a right to privacy. By mandating a weak cryptosystem he is reneging on his promise to provide privacy rights to the nation's citizenry. If Clinton supported a right to privacy to limit government interference with regards to abortions, he must limit government interference with regards to communication. Another element of Clinton's hypocrasy lies in his promise to reduce the budget deficit. By introducing additional responsibilities for government agencies (keeping track of the millions of keys registered in escrow) he is only using our tax dollars to invade our privacy, tax dollars which are better spent lowering the budget deficit. What I fear most from the proposal is that if the wiretap chip becomes the standard, strong cryptography will be declared illegal. If such is the case, then only criminals will have access to strong cryptography. As I have stated above-- the wiretap chip will not be used by criminals because of the obvious flaws in the crypto-system-- criminals will use strong crypto, while law-abiding citizens will have to use a system which can be easily defeated by any criminal. Strong cryptography already exists for data communications, for -free-. Strong cryptography for voice communications for -free- is only a few months away for people who own a personal computer. There is no way that making strong cryptography illegal will stop it-- it will only turn otherwise law-abiding citizens into criminals. Sincerely, Sameer Parekh 829 Paddock Lane Libertyville, IL 60048-3743 zane(a)genesis.mcs.com 708-362-9659

1 0

NPR piece on "Clipper Chip" this morning
by robichau＠lambda.msfc.nasa.gov 20 Apr '93

20 Apr '93

NPR did a (for them, anyway) well-balanced piece on the wiretap chip this morning. Per their standard, the reporter (Dan Charles) had sound bites from both sides: Whit Diffie, representing the strong-privacy-through-crypto crowd, and the (acting?) director of NIST, Raymond whose-last-name-I-forget. Highlights: Diffie compared Clipper to a real estate lockbox. The feds don't have to have the key to the house (=phone), just the key to the lockbox. If you change your Clipper key, the chip keeps a copy. NIST guy said that he strongly supports individual privacy, but law enforcement needs have to be counted, too. Diffie (rough quote): "Technology makes policy. If the gov't spends hundreds of millions of dollars on a chip which allows them to tap phones, they will do so because the technology's there." Good for NPR. A balanced piece. -Paul -- Paul Robichaux, KD4JZG | HELP STOP THE BIG BROTHER CHIP! NTI Mission Software Development Div. | RIPEM key on request.

1 0

Re: True Randoms
by jrk＠information-systems.east-anglia.ac.uk 20 Apr '93

20 Apr '93

I have seen mentioned in sci.electronics (not recently) that true random number generator chips are available off-the-shelf. Texas Instruments was mentioned as one source, but I don't remember details. -- ____ Richard Kennaway \ _/__ School of Information Systems Internet: jrk(a)sys.uea.ac.uk \X / University of East Anglia uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K.

1 0

Re: Sound bite time
by tcmay＠netcom.com 20 Apr '93

20 Apr '93

Phil Karn, referring to some parallels with gun control, writes: >I really, *REALLY* hope that this argument doesn't catch on. >Regardless of your opinions on gun control, you have to admit that >linking crypto to weapons saddles it with an enormous amount of >political baggage that we simply doesn't need. And it plays right into >the hands of those in the government who consider it as a "munition" >for export control purposes. > >I think we already have plenty of strong arguments in defense of the >right to encrypt without opening up this can of worms. It can only >turn off a lot of people who would otherwise support us. I agree. Mentioning guns raises too many confusing issues, including emotional reactions, talk of private vs. public ownership, etc. Several decades ago it might have been better received. The compelling "sound bites" revolve around these kinds of examples: - having to deposit copies of all your private letters with the authorities, "in case" they need to later read them... - not being allowed to use locks--on anything--that the government can't bypass - recording all private conversations and escrowing the tapes, just in case the government later wants to hear them - video cameras in all bedrooms to allow the police to check for illegal activities (even with proper "court orders," most people will react with shock at this suggestion) These are things that everyone can understand. And be shocked by. When they realize just how similar the "key escrow" idea is to these examples, they may get more indignant. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, smashing of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available. Waco Massacre + Big Brother Wiretap Chip = A Nazi Regime

1 0

Re: Sound bite time
by karn＠qualcomm.com 20 Apr '93

20 Apr '93

Paul E. Baclace: >As we move into the electronic frontier, the freedom to use crypto-privacy >technology is becoming the equivalent to the right to bear arms: >it is the last line of defense against a tyrannic government. The good >news is that privacy is a defensive technology, not an offensive one. >Giving up this un-enumerated right could be disasterous to future >generations. I really, *REALLY* hope that this argument doesn't catch on. Regardless of your opinions on gun control, you have to admit that linking crypto to weapons saddles it with an enormous amount of political baggage that we simply doesn't need. And it plays right into the hands of those in the government who consider it as a "munition" for export control purposes. I think we already have plenty of strong arguments in defense of the right to encrypt without opening up this can of worms. It can only turn off a lot of people who would otherwise support us. Phil

1 0