- cypherpunks-legacy@lists.ogf.org

Mitch on the Clipper Mailing list
by Harry Shapiro 18 Apr '93

18 Apr '93

I had asked Mitch to repost any communications that have gone over this list. He has. I appreciate his willing to clear up this issue. As I have stated before, I believe him, that NIST simply created this list of people they wanted to be in direct contact with. /harry a conscious being, Mitchell Kapor wrote: > From mkapor(a)eff.org Sun Apr 18 00:58:00 1993 > Message-Id: <199304181257.AA06031(a)eff.org> > Date: Sun, 18 Apr 1993 08:58:00 -0800 > To: habs(a)Panix.Com > From: Mitchell Kapor <mkapor(a)eff.org> > Subject: Re: The mysterious mailing list > > I received the statement of the Press Secretary and the public fact sheet > from Ed Roback. I have not repoduced the full text as it is readily > available elsewhere. > > Following this is a thread between Gerano Cannoni and Martin Hellman. I > have deleted the text of Marty's longest response, as it is being > circulated elsewhere. > Last, there is a single message from A. Pagett Patterson. > And that's it (assuming I haven't missed something in reviewing my mail stream). > Feel free to re-post this, put in on an FTP, whatever. I don't have any > more time to deal with this issue. > > Date: Fri, 16 Apr 93 11:02:59 EDT > From: Ed Roback <roback(a)first.org> > Organization: FIRST, The Forum of Incident Response & Security Teams > Posted-Date: Fri, 16 Apr 93 11:02:59 EDT > To: clipper(a)csrc.ncsl.nist.gov > Subject: text of White House announcement and Q&As on clipper chip encryption > > Note: This file will also be available via anonymous file > transfer from csrc.ncsl.nist.gov in directory /pub/nistnews and > via the NIST Computer Security BBS at 301-948-5717. > --------------------------------------------------- > > THE WHITE HOUSE > > Office of the Press Secretary > > _________________________________________________________________ > > For Immediate Release April 16, 1993 > > > STATEMENT BY THE PRESS SECRETARY > > > The President today announced a new initiative that will bring > the Federal Government together with industry in a voluntary > program to improve the security and privacy of telephone > communications while meeting the legitimate needs of law > enforcement. > ... > > Date: Fri, 16 Apr 93 16:44:10 EDT > From: Ed Roback <roback(a)first.org> > Organization: FIRST, The Forum of Incident Response & Security Teams > Posted-Date: Fri, 16 Apr 93 16:44:10 EDT > To: clipper(a)csrc.ncsl.nist.gov > Subject: White House Public Encryption Management Fact Sheet > > > > Note: The following was released by the White House today in > conjunction with the announcement of the Clipper Chip > encryption technology. > > FACT SHEET > > PUBLIC ENCRYPTION MANAGEMENT > > The President has approved a directive on "Public Encryption > Management." The directive provides for the following: > ... > > Posted-Date: Sat, 17 Apr 93 01:26:06 +0200 > From: caronni(a)nessie.cs.id.ethz.ch (Germano Caronni) > Date: Sat, 17 Apr 93 01:26:06 +0200 > To: clipper(a)csrc.ncsl.nist.gov > Subject: Clipper-Chip Escrow-System Flaws > Newsgroups: > alt.privacy,sci.crypt,alt.security,comp.security.misc,comp.org.eff.talk > Organization: Swiss Federal Institute of Technology (ETH), Zurich, CH > Cc: > > > Good day, > as a non-citizien of USA I have read your announcment of the > 'Clipper-Chip' with great interest, and am happy to see a increase > in lawful privacy in the USA. I hope this policy will extend to > other countries too. > In the meantime I suspect two flaws in the 'Clipper-Chip' as it was > announced today via NIST/electronic media. > > 1) Keeping secret the algorithm which performs encryption is in my > humble opinion a bad idea. It hinders 'Clipper' to get publicly > accepted, and hinders the minute examination of the Clipper- > Algorithm by other then a few experts. > But I am sure this was well considered. > > Now the important suggestion :=) > > 2) By splitting the 80-Bit-Key of clipper in two parts, and give > them to different organizations, you add an uneeded WEAKNESS > to the escrow-system. This way, corruption of one escrow will > allow an easier attack on the Key than might be possible. > (e.g. if I obtain 40 bits of possible 80 bits keys, exhaustive > keysearch is definitively no problem.) > You might instead generate 2 (or even more, if this ist not > politically indesired) 80-Bit-Sequences which, when XOR-ed > together will provide the original, needed key, but alone they > are worthless. I am sure persons with knowledge in this area, which > surely can be found at NIST (or wherever) will agree. > > I hope that this remark is of interest for you. > > Friendly greetings, > > Germano Caronni > > > P.S. > I am sure you have remarked, that the current policy is interpretable > to tend toward an abolition of 'unbreakable' secure communication > via electronic Media, and hope that this will _not_ come true. > > Disclaimer: This mail is in now way whatsoever connected to the Swiss > Federal Inst. of Technology, but expresses my personal thoughts. > > > > > Organization: FIRST, The Forum of Incident Response & Security Teams > Posted-Date: Fri, 16 Apr 93 22:32:14 PDT > Date: Fri, 16 Apr 93 22:32:14 PDT > From: "Martin Hellman" <hellman(a)isl.stanford.edu> > To: caronni(a)nessie.cs.id.ethz.ch, clipper(a)csrc.ncsl.nist.gov > Subject: Re: Clipper-Chip Escrow-System Flaws > > I received your message suggesting: > > 2) By splitting the 80-Bit-Key of clipper in two parts, and give > them to different organizations, you add an uneeded WEAKNESS > to the escrow-system. This way, corruption of one escrow will > allow an easier attack on the Key than might be possible. > (e.g. if I obtain 40 bits of possible 80 bits keys, exhaustive > keysearch is definitively no problem.) > You might instead generate 2 (or even more, if this ist not > politically indesired) 80-Bit-Sequences which, when XOR-ed > together will provide the original, needed key, but alone they > are worthless. > > In a conversation with NSA today, I was told > that two random 80-bit numbers will be XORed to produce > the 80-bit key and the two individual numbers kept by > two separate escrow authorities -- who they are is > to be decided. So your suggestion is, in fact, how it > will be handled. > > martin hellman > > Disclaimer: this in no way should be interpreted to mean > that I approve of the Clipper Chip. While I am still in the > process of learning more about it, my immediate reaction > was not positive. More later. > > Organization: FIRST, The Forum of Incident Response & Security Teams > Posted-Date: Sat, 17 Apr 93 23:05:23 PDT > Date: Sat, 17 Apr 93 23:05:23 PDT > From: "Martin Hellman" <hellman(a)isl.stanford.edu> > To: ...clipper(a)csrc.ncsl.nist.gov... > Subject: Clipper Chip > > > Most of you have seen the announcement in Friday's NY Times, > etc. about NIST (National Institute of Standards & Technology) > announcing the "Clipper Chip" crypto device. Several messges > on the net have asked for more technical details, and some have > been laboring under understandable misunderstandings given > the lack of details in the news articles. So here to help out > is your friendly NSA link: me. I was somewhat surprised Friday > to get a call from the Agency which supplied many of the missing > details. I was told the info was public, so here it is (the cc of this > to Dennis Branstad at NIST is mostly as a double check on my > facts since I assume he is aware of all this; please let me know > if I have anything wrong): > > ... > > > Organization: FIRST, The Forum of Incident Response & Security Teams > Posted-Date: Sat, 17 Apr 93 08:55:31 -0400 > Date: Sat, 17 Apr 93 08:55:31 -0400 > From: padgett(a)tccslr.dnet.mmc.com (A. Padgett Peterson) > To: "clipper(a)csrc.ncsl.nist.gov"@uvs1.dnet.mmc.com > Subject: Panel > > I would like to be considered for the "outside panel" assessing the > Clipper Technology. > A. Padgett Peterson, P.E. > > > -- Harry Shapiro habs(a)panix.com List Administrator of the Extropy Institute Mailing List Private Communication for the Extropian Community since 1991

1 0

The gov't makes sense ;-)
by baumbach＠atmel.com 18 Apr '93

18 Apr '93

My eyes have been opened, after reading the White House press release. Privacy can only be allowed if the users don't break any laws. If through accident or other means we find that someone who is using privacy has broken the law, we need to be able to discover what has been hidden by privacy in the past to see if other laws were broken. It is for the greater good! Let's have the gov't set a good example for us too follow. I want all government employees and anyone they have spoken to, to be recorded always. The tapes will be encrypted and stored safely in the hands of all losing presidential candidates. If a citizen has probable cause to believe that a person in gov't has broken the law, then, with proper safeguards, he will be given copies of the appropriate tapes and the keys, to get to the bottom of this. If through accident or other means we find that someone who is using privacy has broken the law, we need to be able to discover what has been hidden by privacy in the past to see if other laws were broken. It is for the greater good. Peter Baumbach baumbach(a)atmel.com

1 0

The mysterious mailing list (fwd)
by Harry Shapiro 18 Apr '93

18 Apr '93

There have been reports about a mailing list set-up at NIST that had a number of people on it including Mitch Kapor. The list is named "clipper" and it was through that list that part of the Wire Tap Chip announcement came. I asked Mitch directly, what is involvement with that list was; I asked him if he was involved with the development of the Wire Tap Chip. Below is is reply. I believe him. /harry a conscious being, Mitchell Kapor wrote: > From mkapor(a)eff.org Wed Apr 17 23:11:38 1993 > Message-Id: <199304181111.AA05559(a)eff.org> > Date: Sun, 18 Apr 1993 07:11:38 -0800 > To: habs(a)Panix.Com > From: Mitchell Kapor <mkapor(a)eff.org> > Subject: The mysterious mailing list > > I believe the list in the question is an informational list set up at NIST. > My name was placed on it. I did not ask to be put on such a list. We > were (obviously) not involved in the development of Clipper. > I was sent the Clipper announcement fact sheet, for instance. > There has been a small amount of traffic on it, none of it consequential. > I would appreciate it if you would make these facts known. I have told Mitch I will put this info out and have asked that he make clipper list mail public at some FTP site. I have also asked him when he started getting traffic from this list. /harry -- Harry Shapiro habs(a)panix.com List Administrator of the Extropy Institute Mailing List Private Communication for the Extropian Community since 1991

1 0

Media Blitz: May ourselves available
by Harry Shapiro 18 Apr '93

18 Apr '93

If there is going to me some kind of media blitz then we have to put some of ourselves forward as "experts" for the media to interview. Tim May, John Gilmore, come to mind. Any of us that are clean shaven and wear suits, etc. would also make good spoke-folks /harry -- Harry Shapiro habs(a)panix.com List Administrator of the Extropy Institute Mailing List Private Communication for the Extropian Community since 1991

1 0

Re: Wiretapping chip: vid clips & sound bites
by rjc＠gnu.ai.mit.edu 18 Apr '93

18 Apr '93

The best innovation you came up with is calling it the "wiretap chip." I propose that we stop referring to this chip as the "clipper chip" and always refer to it as "the wiretap chip." Also, when using analogies, don't bring up drug smugglers or terrorists. One key to winning this battle is to wage an information war. We have to manipulate the image of this proposal so it looks more like a menace instead of a "protection." -- Ray Cromwell | Engineering is the implementation of science; -- -- EE/Math Student | politics is the implementation of faith. -- -- rjc(a)gnu.ai.mit.edu | - Zetetic Commentaries --

1 0

Wiretapping chip: vid clips & sound bites
by szabo＠techbook.com 18 Apr '93

18 Apr '93

I was on a Portland-area TV forum this evening and was able to raise the wiretap chip issue to a lay audience (in addition to being in some ways a lay person myself on this issue, but quite concerned). Here are some talking points and phrases I found helpful: * Compared and contrasted a "wiretap chip", which gives government agencies the keys to your private conversations, and a "privacy chip" where you keep the keys (come to think of it, I'm not sure that second point is technically correct -- how would a truly private phone handle the keys?) * Compared giving government agencies crypto keys to giving the IRS the keys to your house and filing cabinet. * As examples I used lawyer/client, psychiatrist/patient, priest/confessor and political campaign work done over the phone. * Showed New York Times front page story (Fri. 4/16) to the camera, to demonstrate that this is important, not a fringe issue and that the wiretap chip is real. Quoted Stephen Bryen of Secured Communications Technologies Inc., "I think the government is creating a monster." * Emphasized importance of learning about telephone and e-mail technology, and how they can be made private with open cryptography. (As opposed to top-secret chip designs which I called "closed cryptography"). * Stated that I was switching from AT&T to another provider in protest of their selling phones containing wiretap chips. I wanted to use a see-thru telephone as a prop to point at computer chips inside the phone, but wasn't able to locate one in time. Some of this may sound corny and less accurate than a technical presentation, but I needed to make the lay audience at least mildly informed, sympathetic and perhaps even motivated to write their phone company or their Congresscritters within about the three minutes of air time. Further suggestions for sound bites, vid clips etc. to use in a media campaign greatly appreciated. Nick Szabo szabo(a)techbook.com

1 0

A Long History for Clipper...
by tcmay＠netcom.com 18 Apr '93

18 Apr '93

George Gleason writes: >Agreed with Phil here. Clipper can't have been developed since Inauguration >Day; it has to be a hand-me-down from the Bush administration, and I'm >willing to bet that Clinton has been sold a bill of goods to get his >support. Now a lot of folks on this list are ideologically committed to It's clearly stated that the program is at least 4 years old and that, for example, the contracts with VLSI Tech and Mxxxxtronix (I keep forgetting the name of the previously obscure So. Cal. defense contractor) were let 14 months ago, that production of the chips has begun, blah blah. No argument that the program started under Bush, and perhaps under Reagan (recall his various NSDDs and the Computer Security Act...). This doesn't mean the proposal will be casually tossed aside by Clinton as some objections are raised. Most policies of this sort percolate up through the entrenched bureacracies in Justice, State, Defense, NSA, etc. In this case, the AG, Janet Reno, was a well-known drug warrior in the Miami/Dade area....undoubtedly she made use of wiretaps, seizures, etc. She also probably understands the issues of law enforcement pretty well and fully understands what the proposal means. So, I don't think Clinton will easily change this policy. A firestorm of proposed civil disobedience, scoffing at the Clipper, etc., *might* have some effect. But I don't favor concentrating on legislative fixes. Give me technology any day. -Tim P.S. However, I'm trying to find the net address to send ersatz "protest" letters to Intergraph Corp about "Clipper." Clipper is the name of their 32-bit RISC chip--my thought is that enough indignant letters to Intergraph, deliberately confusing the Clinton Clipper with their product, will get Intergraph's lawyers to file a protest with the Administration! Perhaps even a name change will be ordered....a minor embarrassment, to be sure, but a stick in their eye nonetheless. -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

1 0

Re: Thoughts on the proposal
by George A. Gleason 18 Apr '93

18 Apr '93

Agreed with Phil here. Clipper can't have been developed since Inauguration Day; it has to be a hand-me-down from the Bush administration, and I'm willing to bet that Clinton has been sold a bill of goods to get his support. Now a lot of folks on this list are ideologically committed to positions which are opposite to those of the Clinton amdministration, but please let's not let that blur our perception here. Clinton has shown a decent commitment to civil liberties (particularly concerning sexual freedom and reproductive rights, a very hard place to take a stand because there's such strong rightwing opposition); he's also shown an interest in telecom issues; I suspect what we're facing here isn't malice but lack of information on his part. Crypto is an elite area in math and computer science; for most people outside of this circle it's something they assume that they could never possibly understand and so they tend to accept the word of experts at hand. And the experts who are closest to the White House are at Fort Meade. The task we face is to bring the expertise of the best minds on our side, to the attention of the White House. -gg

1 0

Comments from Jim Bidzos, Pres. of RSA Data Security
by tcmay＠netcom.com 18 Apr '93

18 Apr '93

Jim Bidzos, Pres. of RSA Data Security, sent me a nice note this evening in response to my posting on sci.crypt. In that post, I suggested that only RSA has the algorithms and protocols ready to go for an alternative to Clipper, and that perhaps we should set aside our differences with RSA (over patents on software, etc.) and instead seek an alliance. Basically, Jim said he knew *nothing* of Clipper until he read about it in the Friday morning papers!! If true, this is astounding. (And having met Jim several times, I believe him.) He's also preparing a FAQ entitled "RSA/PKP/Clipper Flap FAQ" to deal with the many questions raised. Jim has some interesting theories about the motivations for Clipper, and why AT&T was so quick to jump on the bandwagon. Please don't quote my comments in public discussions of this issue (Jim asked me not to, which is why I'm being vaguely elliptic here.) This is all I can say for now, but I remain convinced that RSA was not involved (I suspect the presence of "jim(a)rsa.com" on the NIST mailing list, as reported in this group by a couple of folks, is not necessarily the cabal that put Clipper together). Interesting times indeed! -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

1 0

RE: CLIP: Media Blitz
by TO1SITTLER＠APSICC.APS.EDU 18 Apr '93

18 Apr '93

Sorry I can't quote, but Giant media blitz sounds like a great idea to me. Post the media list and put it on the FTP site too. Roots-up sounds much more cypherpunk than funds- and TV- and newspaper-down. Thank you, Matt. Kragen

1 0