- cypherpunks-legacy@lists.ogf.org

Let's see here ...
by fergp＠sytex.com 20 Apr '93

20 Apr '93

Once again, I pull together my collective thoughts (that _was_ rather difficult) and send them along for the remainder of the cypherpunks to ponder. It would appear that several things have happened; let's see if I can summarize - - The Clinton administration was presented with a golly-gee proposal from either the NSA or the NIST (probably both) on a way to "offer" public encryption. ('Nuf said.) - From what we have surmised (researched, hypothesized and down-right taken for face value), the government (whether it be the NIST or whomever) has obviously been working on this "technology" for a few years. Albeit, their negligence to inform anyone. - Mr. Clinton and crew obligingly acknowledge this new, technological wonder, and think that they're doing us all a favor. - Enter the "Clipper Chip", and all it's fanfare. Okay. I took The Dark One's advice (not that I needed the prodding, mind you) and faxed every one of the contacts on the list that he posted earlier (a couple of which were voice numbers, BTW). The big three (ABC, NBC and CBS + CNN) got my fax and my thoughts on the subject. I'm mad as hell, too -- yet I'm more prone to bringing this highly volatile subject (it would seem that it's only an explosive situation to those of us who understand it's implications) into the public eye. Let's put this topic into proper prospective -- for the layman, for the "man in the streets." Let me try to put this into prospective for some of our less politically inclined participants. For those of you who live within earshot of the "Beltway", you are probably familiar with the G. Gordon Liddy radio show. Well, to make a long story short, one afternoon the topic was computer crime. A young man called in to express his concern with the topic of "underground" computer virus distribution and all that rot. He was talking on a deaf ear, folks. The program was dominated by yuppies, calling in worried about their precious credit records and how they could possibly be disclosed or damaged by the computer criminals. I turned off the show in disgust at that point, but the point is this: No matter how hard you attempt to bring matters into the light that the _computer_ public should be concerned about, they revert into their own realm of protected computerdom. This is an observation, not a conviction. What we need to do, is to make folks understand that this is not just a computer issue -- it's privacy issue, for cryin' out loud! If the techno-fascists within certain levels of government service think that they can _impose_ their will on the computer community at large, they are most definately ill-informed. Most would probably think that they could fluff this little tidbit of "legislation" into reality. Bottom line: I stand by the ideals that we have every right, as common citizens, to encrypt and cipher as we see fit. Legality be damned. (This is not a legality issue, for christ's sake!) This is an issue where the government is playing bully and we find ourselves on the receiving end of their quest for superiority. I urge each and every one of you to take the time to write your congressman, fax the closest televison or radio station and make this topic as public as possible! I refuse to be treated like a criminal because I desire electronic privacy. Say "No". Cheers. Oh. By the way, I'm looking for some kind sort to offer an avenue to place Legal Net News on an archive site on a regular basis. I find it extremely difficult to meet subscription requests and would prefer to offer this compilation as an anon FTP'able newsletter. Any takers? Issue 2 has bee released, which covers our recent travails .... Paul Ferguson | Uncle Sam wants to read Network Integration Consultant | your e-mail... Alexandria, Virginia USA | Just say "NO" to the Clipper fergp(a)sytex.com | Chip...

2 1

Unsubscribe
by Nathan Rorvig 20 Apr '93

20 Apr '93

Please, unsubsribe me now. Thanks. The mail volume is way to much.

1 0

Subscribing
by greg＠amex-trs.com 20 Apr '93

20 Apr '93

Hello, Please add me to your list of subscribers. Thanks. Greg Thompson greg(a)amex-trs.com

1 0

send info
by cburian＠uiuc.edu 20 Apr '93

20 Apr '93

send info #or, if you're human, _please_ send info on how to subscribe & send the FAQ. #Thanks, Chris Burian -------------------------------------------------------------------------- | Chris Burian | PGP public key available on a server near you | -------------------------------------------------------------------------- <cburian(a)uiuc.edu> <NeXT: cburian(a)sumter.cso.uiuc.edu>

1 0

True Randoms
by KINNEY WILLIAM H 19 Apr '93

19 Apr '93

A little nuclear physics anyone? Seems like one real bitch with roll-your-own cryptography is the scarcity of good random numbers to work with. I've read about various schemes using I/O buffers, or keystroke timing like PGP does (even there, true randoms are referred to as "precious"). So I thought a bit about how one could construct a true random generating box. Went out to Sears and bought a $7 smoke detector, a "Family Gard" model FG888D, and took it apart. What's inside is a 1.0 microCurie chunk of Americium 241 (I checked other models, and they seem to all be AM241, right around the 1 uCi activity range, although I have an older one at home with 5.0 uCi). I did a little research on the isotope in the CRC Handbook and the Brookhaven National Lab's online database, and what I found was pretty interesting: About AM241: Half-Life: 458 years Decay: AM241 ---> (Neptunium 237) + (5.5 MeV alpha particle) 1.0 uCi = 37,000 decays/second average NP237 has a half-life of around 2 million years This is very good design. AM241 has only one basic decay mode, and it decays to an essentially inert daughter product without any intermediate daughters to worry about. Very simple and safe. In addition, the 1.0 uCi activity of the sample makes the decay rate just right for counting alphas with electronic devices -- a 100 KHz sample rate would be overkill for resolving individual alphas. And the half-life is long enough to make the source relatively stable over a reasonable period of use. I took my sample into the lab and it barely registered on the geiger counter, but when I set it up on a scintillating detector, I got about 1200 counts/sec above a background of 25 count/sec. A nice clear signal. Seems to me it would be pretty easy to buy a small solid-state detector and a couple of chips and wire it up to toggle a pin on an RS232 cable, giving a nice true random source -- for instance, assuming the 1200 counts/sec rate I saw in the lab, you could count alphas for 10 milliseconds and send a 1 down the cable if you saw an odd number, a 0 if you saw an even number. Could probably do better than 1200 /sec, too, I bet. Does anyone see a real need for something like this? Any hardware jocks out there who could lend some expertise? Radiological safety data (permissible quarterly intake): AM241 (oral): 7.6 uCi AM241 (inhalation): 3.8E-03 uCi NP237 (oral): 6.2 uCi NP 237 (inhalation): 2.5E-03 uCi In other words, whatever you do, don't smoke it... -- Will

1 0

The first casualty of war
by sneal＠muskwa.ucs.ualberta.ca 19 Apr '93

19 Apr '93

ld231782(a)longs.lance.colostate.edu writes: >Who Has the Keys? >----------------- > >The evasion of `who stores the keys' makes me wonder. It suggests that >the proposal was poorly crafted (which is true in any case), but, more >likely, IMHO, the scheme is weak enough for the NSA (but maybe not >cops) to break regardless, and hence their casual disregard for this >seemingly monumentally crucial point. It appears that the opposition is using the old rhetorical trick of "begging the question." Rather than stating the important question (which is "Should there be a key registration scheme?"), they jump right over it to "Who will register the keys?". The purpose is to focus debate on the latter issue without anyone stopping to examine the former. However, two can play at that game, as in: "Nobody seems to have thought about what will happen when Clipper is broken." "Developing a system that is "impervious" (to anyone but its developers) required at least four years." Sleazy? Yeah. Not that I'm advocating fighting fire with fire or anything.

1 0

comments on the clipper
by Andrew Loewenstern 19 Apr '93

19 Apr '93

Going through all the messages on the Clipper, I noticed what may be a flaw that wasn't quite addressed... The family key, which is the same for all devices, is hardwired onto the chip with the algorithm. However, the device serial number and the unit key must be burned into a ROM. This is somewhat like the EIN/MIN burned into the ROM of a cellular phone. Just ask anyone who is familiar with cellular fraud how difficult it is to change the EIN/MIN of the phone. So it should be more than possible for anyone to throw a wrench into the system by using hacked phones that have a random device serial number. In this way it would not be possible for authorities to obtain the proper unit key since the device serial number would not exist in the escrow authority's database or would have the incorrect unit key associated with it. Of course, it is possible that the scheme (i.e. the algorithm and the handshaking) is not secure. Assuming it is not truly secure, I would think that only such agencies as the NSA and FBI would have not only the resources to decrypt Clipper generated communications without the session key, but the resources to keep such equipment from public knowledge (i.e. there is a companion device that breaks such communications). It would most likely be too difficult to keep such equipment secret if it were available to local and state authorities. Furthermore, the whole idea of escrow agents is hogwash to me. How difficult is it to get someone's credit report? How difficult is it to get social security records on a person? Apparently no information held by a government or even private agency like TRW is impossible or even exceedingly difficult to obtain, and anyone wishing to intercept your communications will simply have to buy off the appropriate persons at each escrow authority. To sum up, I think the whole idea stinks. andrew

1 0

Intergraph speaks! (sort of)
by robichau＠lambda.msfc.nasa.gov 19 Apr '93

19 Apr '93

I just had a nice phonecon with Jim Ruester of Intergraph's public relations department. For those of you who don't follow CAD, Intergraph produces a line of workstations based on the Clipper CPU, a private-label RISC chip that Intergraph acquired from Fairchild some years ago. He hadn't seen the press release, or heard of the wiretap chip. His (predictable) reaction was to say that he'd forward it to their legal department. I asked that he pass any comments back to me for reposting here. A plea: please *don't* call Intergraph and bother them about this. Putting pressure on AT&T (which has announced products based on the wiretap chip) is one thing. Harrassing a company with a similarly named (and trademarked!) product, in the hope that they'll put pressure on the gov't, is nothing more than bothersome. -Paul -- Paul Robichaux, KD4JZG | HELP STOP THE BIG BROTHER CHIP! NTI Mission Software Development Div. | RIPEM key on request.

1 0

Another forwarded message
by TO1SITTLER＠APSICC.APS.EDU 19 Apr '93

19 Apr '93

From: APSICC::GR2KITTRELL "TOO MANY SECRETS" 18-APR-1993 21:52:10.16 To: TO1SITTLER CC: Subj: Process From: SMTP%"igor(a)e5.ijs.si" 18-APR-1993 18:05:57.69 To: gr2kittrell(a)apsicc.aps.edu CC: Subj: (fwd) Re: Secret algorithm [Re: Clipper Chip and crypto key-escrow] Date: Mon, 19 Apr 1993 01:34:02 +0200 From: Igor Petrovski <igor(a)e5.ijs.si> Message-Id: <199304182334.AA00721(a)kekec.e5.ijs.si> To: gr2kittrell(a)apsicc.aps.edu Subject: (fwd) Re: Secret algorithm [Re: Clipper Chip and crypto key-escrow] Newsgroups: sci.crypt Organization: Open Systems & Networks, ijs, Slovenia Relay-Version: VMS News - V6.1 30/1/93 VAX/VMS V5.5-1; site cathy.ijs.si Path: cathy.ijs.si!arnes.si!scsing.switch.ch!ira.uka.de!sol.ctr.columbia.edu!zaphod.mps.ohio-state.edu!darwin.sura.net!haven.umd.edu!uunet!looking!brad Newsgroups: sci.crypt Subject: Re: Secret algorithm [Re: Clipper Chip and crypto key-escrow] Message-ID: <1993Apr17.204850.26711(a)clarinet.com> From: brad(a)clarinet.com (Brad Templeton) Date: Sat, 17 Apr 1993 20:48:50 GMT References: <strnlghtC5LGFI.JqA(a)netcom.com> <jhesseC5LuMC.2Ex(a)netcom.com> <rdippold.735042679@qualcom> Organization: ClariNet Communications Corp. Keywords: encryption, wiretap, clipper, key-escrow, Mykotronx Lines: 24 One presumes the system could work as follows: a) Blank clips are manufactured by Mykotronx and VLSI. The number produced is carefully audited and they are shipped to the first escrow house. It programs the chips with its half the key, and prints out a paper slip with the key half and non-secret chip serial number. The reams of paper are filed in locked boxes in the vault, a fuse is burnt in the chip so that the key is now unreadable. The chip then goes to the next escrow house, where the same thing is done. This continues through N escrow houses, perhaps, could be more than 2. The last one provides the chip to the cellular phone maker. And yes, this has to be a public key system or it would be almost impossible to handle. It might not be RSA, but that does not mean that PKP doesn't get paid. Until 1997, PKP has the patent on the general concept of public key encryption, as well as the particular implementation known as RSA. -- Brad Templeton, ClariNet Communications Corp. -- Sunnyvale, CA 408/296-0366

1 0

AT&T Announcement?
by fnerd＠smds.com 19 Apr '93

19 Apr '93

> AT&T announced yesterday that will will begin selling devices with these > Clippers in them immediatly. We've been sold down the river by ma bell again. > > Dave Banisar > CPSR Washington Office Does someone know how to get an official-looking printed form of this announcement? I want something to xerox and send in when I switch long distance service. -fnerd quote me

1 0