- cypherpunks-legacy@lists.ogf.org

(fwd) Registering "Assault Keys"
by tcmay＠netcom.com 28 Oct '92

28 Oct '92

Cypherpunks, Things have gotten truly exciting. The posting I made alerting sci.crypt readers to the plans of the Crypto Establishment has generated something close to a hundred responses! And lots of private mail for me (moral support, questions, etc.). Dorothy Denning, in what writer correctly called a "spirited defense" of her proposal, acknowledged the truth of my posting and then went on to embellish her plan. I urge you all to read her well-written comments, if only to see how the Establishment views crypto technology. Several members of this list have also written cogent comments. My latest article is included below, for those of you who may not have Net access. Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns Path: netcom.com!tcmay From: tcmay(a)netcom.com (Timothy C. May) Subject: Registering "Assault Keys" Message-ID: <1992Oct28.235027.28039(a)netcom.com> Organization: Netcom - Online Communication Services (408 241-9760 guest) X-Newsreader: Tin 1.1 PL5 Date: Wed, 28 Oct 1992 23:50:27 GMT Registering "Assault Keys" -- How the Proposal to Register Encryption Keys Has Ominous Parallels to Gun Control The recent proposal that encryption keys be registered with the government has some natural and terrifying implications. (For those to whom this proposal is new, strange, or disturbing, please see the debate raging mainly in the newsgroup "sci.crypt".) Once the principle is established that private communications, letters, faxes, modem transmissions, etc. must be in a form readable--under court order, as Dorothy Denning's proposal goes--by the government, and that "public key encryption" keys must be registered with the authorities, then we can expect the following: * _Classes_ of encryption keys, with some especially strong (in a cryptograhic sense) keys being declared "assault keys," just as certain classes of semiautomatic rifles have been branded "assault weapons" and subjected to media villification and even confiscation by the authorities. In analogy with firearms, there may be "Class 1" dealers in "dangerous" keys. * There may even be _bans_ on the registration (and hence use) of certain classes of algorithms and key lengths. For example, "civilians" may be allowed to use DES, but not RSA. Or the key length may be restricted in various ways. * Strict controls over the types of algorithms allowed. After all, what use will a key be if the government can't run the algorithm? This, by the way, will be another way to control the spread of encryption technology: if only licensed, inspected, and approved algorithms are acceptable to the key registration authorities, innovation and experimentation will suffer. This may make RSA Data Security, Inc., very happy, as it may get the "franchise," while users of bootleg/contraband/experimental algorithms like PGP 2.0 ("Pretty Good Privacy") face severe sanctions. * Spot checks will have to be done to ensure compliance. This may be done in various ways, such as by randomly checking bitstreams and demanding the sender open the message. (Note: Many have posted that this would not be possible. Untrue. The Rehnquist Supreme Court ruled a couple of years ago that the police could enter a bus and ask the passengers to "voluntarily" accept a search of their baggage. Failure to volunteer, so reasoned the court, constituted probable cause for a search! "Catch-22" meets "1984.") * The penalties for noncompliance, or for hiding encrypted messages inside other messages, will likely be severe, else widespread civil disobedience and claims of "ignorance" will result. (Personally, I _expect_ widespread noncompliance. Many people will even flaunt their noncompliance, encrypting truly innocuous messages that few courts, they will hope, will convict them for. Here in California, the noncompliance rate for registration of those evil "assault weapons" is estimated to be as high as 80%.) (My best guess is that the "RICO" (Racketeer-Influenced and Corrupt Organizations Act) and civil forfeiture approaches will be used to simply seize the equipment of anyonone caught sending messages without the suitable seals of approval. Such seizures, used with suspected gun sellers, suspected X-rated video sellers, suspected drug dealers. and so on, have had a profoundly chilling effect.) * A registration system, even if well-intentioned and secured against casual government snooping (and some of the multi-party escrow systems may help do this), will still _greatly complicate_ the use of encryption and will forestall certain very exciting applications of cryptology. Many of the new proposals, for things like anonymous credentials to protect privacy, for digital cash, and for cryptographic voting systems, essentially require the _dynamic_ generation of keys! That is, keys are generated frequently as part of the protocols...there is not single static "public key" that one generates once and then takes down to the crypto equivalent of the DMV for registration. * As with guns, true criminals will of course ignore these laws. Computer networks are already being used for messages that evade wiretaps (as one example, a Mafia guy in New Jersey, on the run, used a well-known computer service to communicate untraceably with his wife), that are used for laundering information and money, and so on. Taking encryption away from citizens will do nothing. I urge readers to get involved in this debate. "If encryption is outlawed, only outlaws--and the NSA--will have encryption." -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP 2.0 and MailSafe keys by arrangement.

1 0

How far would this extend...
by mark＠coombs.anu.edu.au 28 Oct '92

28 Oct '92

With regard to the FBI bill, the definition of electronic communication provider is rather vague IMHO. It seems to cover a BBS, any unix site (or equiv) etc. (I deleted the article so I cant quote it) Anyway if the above is true will this mean all machines that electronic communication traverses have to have a 'backdoor' so the gov can sit in their offices and run through the mail spool as root? :) Or log into any BBS and do the same? There hasnt been any talk of it as such, probably because they can do it fairly easily anyhow, but it just seems like another loophole in their (the FBI's) favour. _Sometimes_ I'm glad Im an aussie. Mark

1 0

One-time pads and DC Nets
by tcmay＠netcom.com 27 Oct '92

27 Oct '92

"Nobody" writes about the dining cryptographers protocol. We talked about it at length at our first face-to-face meeting, but the subject has barely come up on this list. People should read the Chaum articles in the handout, and the excellent tutorial by Jurgen Bos, also in the handout. It is truly exciting stuff, much more so than the usual "classical cryptography" that we mostly talk about here on this list. Part of my great concern about the public key registration proposal is that it will, if enforced, kill off many of these approaches that rely on dynamically changing keys and digital pseudonyms. If there's interest out there in the DC Net approach that "Nobody" so nicely summarized, I'll forward some articles I wrote a while back for another list. --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP 2.0 and MailSafe keys by arrangement. -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP 2.0 and MailSafe keys by arrangement.

1 0

Keystone
by Eric Hughes 27 Oct '92

27 Oct '92

Ah. A small PGP subset. You hadn't mentioned this. When you said you weren't requiring the user to run PGP, I assumed key generation must occur on the board. As for your fatal flaw I hadn't spotted, I had spotted it, and the location of the private key was the critical point. If the key is on the BBS, the message goes out in the clear. Look, it boils down to this. If the message traffic to the BBS is to be encrypted, then the user has to generate a key on his own machine and decrypt it on his own machine. There's no way around that. But the user interface problem can be solved. Just make a bunch of .com files which do nothing but spawn pgp by invoking the correct arguments. Very simple; a few lines of C is all. Even the PGPPATH can be set before the spawn. It's an easy encapsulation. It will run a bit slower for load time, but not appreciably. And you won't have to recompile PGP from the distributed executables. Eric

6 9

Messages in the Least Significant Bits
by tcmay＠netcom.com 27 Oct '92

27 Oct '92

Cypherpunks, Here's a message I just posted to another mailing list. It has rather strict policies against cross-posting, so I've edited out the headers and the initial chunk of text I quoted. That should make me kosher. (This topic also came up in some e-mail with George Gleason.) Forwarded message:

1 0

re: Hackers Conference--Crypto Session
by Tom.Jennings＠f111.n125.z1.FIDONET.ORG 27 Oct '92

27 Oct '92

U> From: tcmay(a)netcom.com (Timothy C. May) U> asked me to help put together the crypto session at the U> Conference next week (6-8 November, Lake Tahoe). I of I consider it my job in the email world yto point out that the real problems are not technical, but social, and a discussion of privacy/crypto without underlying social stuff (how we interact, legal issues like liability, etc) will devolve into technophilia. Yes I'm volunteering. I'll write something up before Hackers. --- ReadMail * Origin: World Power Systems / FidoNews / San Francisco CA (1:125/111) -- Tom Jennings - via FidoNet node 1:125/555 UUCP: ...!uunet!hoptoad!kumr!fidogate!111!Tom.Jennings INTERNET: Tom.Jennings(a)f111.n125.z1.FIDONET.ORG

1 0

One-time pads and DC Nets
by nobody＠soda.berkeley.edu 27 Oct '92

27 Oct '92

Regarding the previous discussion about one-time pads, there is another use for disks full of random numbers. They can be used to implement Chaum's DC-nets. For the degenerate case of just two people communicating, the DC-net is similar to using a one-time pad. However, what you are hiding is not _what_ you are sending, but _who_ is sending it. DC-nets ("DC" stands for "Dining Cryptographers", the example Chaum used to introduce the idea) are designed to hide message sources among some group of people. The people have to be fairly well connected, with near-real-time communications capability. It won't really work for people exchanging email. For the simple two-person case, suppose as in the case of the one-time pad that each person has an identical CD-ROM filled with random bits. What they do is, at some predetermined rate, each person just transmits the bits off his pad. Both people are sending the same bits. When one wants to send a message, he starts toggling certain of his bits. To send a "1" he sends the opposite of the next bit from the one-time pad; to send a zero he sends the correct version of the next bit from the one-time pad. Assuming they don't start transmitting at the same time, what an outside observer will see is that, where before they were both producing exactly the same bits, now they are producing a certain number of opposite bits. Interpreting each opposite bit as a 1, and each case of same bits as a 0, produces a recognizable message. But, the outside observer can't tell which person is sending that message. All he sees is two totally random streams of bits, which disagree at certain spots. Without access to the one-time pads, there is no way for him to tell who is sending. (Of course, the two people involved know who is sending, since one of them is and one of them isn't.) Generalizing to larger numbers of people, you need to have a separate one-time pad shared with each other person in the group. In other words, for a group of N people there has to be a total of N(N-1)/2 one-time pads; each person has N-1 of them. That is, for each pair of people in the group, there is a unique and secret one-time pad which they share. (This is for maximal security - you can get by with fewer pads if you trust each other some.) Now, they all send all the time. What they send is the "XOR" of the next bits of all their N-1 one-time pads. It turns out that if you then "XOR" everybody's output bits, you'll get nothing but zeros as a result. When someone wants to send, he sends the opposite of what he normally would for a "1", and he sends just what he normally would for a "0". Collisions can be handled like ethernet - back off and retransmit. (Chaum had another way involving reserving future blocks of transmit time.) With N people sharing N-1 one-time pads per person, nobody can tell who is transmitting. All anyone knows is whether he himself is transmitting or not; all an outside observer knows is that someone in the group is transmitting. DC-Nets eat up one-time pads even worse than using them for message secrecy does. But, with CD's, you can put a lot of data on a pad. And the system is fairly robust against pads being stolen. If one person's one-time pads are all secretly copied by a spy, then he can tell if that person is sending. But he learns absolutely nothing about which other people are sending. I wonder if it would be possible to experiment with a DC-Net system in the Internet environment. I recently acquired an account on a system with Internet connectivity (I know because I can telnet and ftp from it). I've done considerable programming with Unix socket communication in systems connected by ethernet, and I think the Internet provides a very similar programming interface. It shouldn't be that hard to create a very simple "chat" program in which message sources are strictly anonymous (assuming the existance of the required one-time pad random-number files - for testing, they could be created by random number generators at each end, started with identical seeds). I'll try some experiments along these lines over the next few days. Hal 74076.1041(a)compuserve.com

1 0

Threat to our privacy
by pmetzger＠shearson.com 27 Oct '92

27 Oct '92

For Cypherpunks: A copy of mail I just sent to... libernet(a)dartmouth.edu, extropians(a)gnu.ai.mit.edu, prz(a)sage.cgd.ucar.edu, mike(a)eff.org, mkapor(a)eff.org [This is being sent out to a wide audiance. If you receive this, its because My friends, its rare of me to try to encourage panic. Occassionally, however, by panicing early we can avert a disaster later on. Risks, an internet mailing list, reported about a week ago on a proposal by Dr. Dorothy Denning, one of the most prominent people in the field of cryptography, that copies of all private encryption keys associated with public key cryptographic systems be held, effectively by the government, to permit them to read people's encrypted messages to each other. Naturally, such invasions of privacy will only be permitted "when a warrant is produced". It has been suggested that this idea might be taken up by several government agencies for "review". Many have noted that the dawning of cheap and effective cryptographic systems could spell the end of the ability of governments to invade people's privacy. Unfortunately, it appears that the government and its cronies have also realized this, and intend to take preemptive action. Our notion of civil rights has decayed so far that it is now considered a citizen's duty to not merely be quiet while he is enslaved but to actively cooperate with his own enslavement. Not merely must we put up with the indignity of the government being granted the right to read our papers and communications to each other, not merely has the FBI attempted to get legislation passed to make phone companies give them easier access to tap phone lines under color of "maintaining the current capability in the presense of new technology", but now it is suggested that we ordinary citizens must personally cooperate to make it easier for them to read our communications. We will be branded criminals if we fail to cooperate, presuming that ideas like this are enacted. It is crucial that the fiends proposing this be convinced that resistance will be too high to implement their plan. It is crucial that before they can even propose legislation that the threat here be brought to the attention of the news media. If the currently proposed FBI legislation were passed, a dictatorial government would have all the tools it would need to tap all the phones in the country -- the only thing restraining that behavior would be a system of warrants that could disappear with a mere change in attitude. If Denning's more serious and sinister idea were proposed for future enactment as legislation (this has not yet been proposed), it would become impossible for individuals to take any action to protect their own communications privacy from a dictatorial regime, even ignoring the question of abuses that could occur right now. I'm convinced that the only thing that prevented the FBI bill from passing this year was the fact that media attention was brought to bear. Its important that this new proposal be exposed to similar sunshine. Far be it for me to suggest restraint of free speech, but I would like to see people think of making such suggestions as having the social acceptability of calling a black person "nigger". Here, for reference, is a copy of an article Dr. Denning just posted to sci.crypt on usenet. I encourage people, rather than discussing this matter on libernet or extropians, to discuss this on sci.crypt where the topic is just breaking. Perry Metzger ---------------------------------------------------------------------- Article 6275 of sci.crypt: Path: shearson.com!uunet!uunet!think.com!sdd.hp.com!zaphod.mps.ohio-state.edu!darwin.sura.net!guvax.acc.georgetown.edu!denning From: denning(a)guvax.acc.georgetown.edu Newsgroups: sci.crypt Subject: Re: A Trial Balloon on Registered Keys Message-ID: <1992Oct27.143737.1574(a)guvax.acc.georgetown.edu> Date: 27 Oct 92 14:37:37 -0500 Distribution: world Organization: Georgetown University Lines: 94 The posting about the proposal I made at the NCSC for key registration is essentially correct. Let me add to it the following: 1. The government is not taking any action to curb crypto and is unlikely to take any such action in the near future. No proposal has been made and no government agency that I am aware of has plans to make such a proposal. The closest we've had to a proposal was a "Sense of Congress" resolution in Senate Bill 266 over a year ago. This would not have mandated anything, but said it was the sense of Congress that service providers should provide accesss to the plaintext of encrypted communications under a court order. It got a lot of opposition and was withdrawn. Thus, don't panic folks -- this was just me making a suggestion. I didn't realize I had that much clout to cause such a stir and call to arms! I expect that the next step will be government sponsored discussions about crypto policy, probably sponsored by NIST, at the recommendation of the Computer System Security Advisory Board headed by Willis Ware. That will provide a forum to work through these issues. 2. The reason I made the proposal is because I am concerned that we may be facing a major crisis in law enforcement. I expect many of you will say "that's wonderful" but I don't see it that way. Electronic surveillance has been an essential tool in preventing serious crimes such as terrorist attacks and destabilizing organized crime. The economic benefits alone are estimated to be in the billions. This issue is not about snooping on innocent citizens but about doing what we can do prevent major crimes that could seriously disrupt other liberties. The problem is likely to get even worse if criminals know they use the telecommunications systems without any chance of getting caught. 3. My proposal was to register your private key with a trustee, different from the government. The key would be encrypted under some other public key so the trustee couldn't decrypt it. I have suggested it be the key of the DOJ, but it could be another independent trustee. I believe this would provide acceptably good protection since someone would need to get a court order and then the cooperation of 3 agencies to get at your communications: the telecommunications provider (to get the bit stream), the first trustee (to get the encrypted key), and the second to decrypt it. Experience with the telecom providers has been that they are very fussy about court orders -- you have to get the semicolons right! You can get even more security by using Silvio Micali's "fair public-key cryptosystem" approach. Called "fair" because it is designed to strike a balance between the needs of the Government and those of the citizens. With his approach, you would break your key up into 5 parts and give it to different trustees. All 5 parts are needed to reassemble it, but it is possible to veryify the parts individually and as a whole without putting them together -- ingenious! He presented this at CRYPTO '92. 4. Someone suggested that law enforcement routinely taps without court order. This is an ungrounded claim for which I have never seen any evidence. Regardless, their ability to do this is disappearing with the new digital based technologies. They need the help of the service providers, who in turn ask for court orders. Court orders are not all that easy to get as law enforcers have to document why other approaches have failed etc. 5. Many people have noted that you could not enforce key registration. They may be right, but I am not throwing in the towel yet. Let's take phones, which is what law enforcers are most interested in. Products are emerging that you can attach to your phone and that will do DES encryption. Criminals and everyone else are most likely to use commercial products -- easiest to get and cheapest. The products could be designed so key registration would essentially be part of the sales process. There can be social benefit to government regulation even when regulation is not 100% successful. None of our laws prevent the acts they outlaw. But this does not mean we should get rid of all laws. 6. Some people have said we should not give up our privacy to the government. But the constitution does not give us absolute privacy. We are protected from unreasonable searches and seizures, but not reasonable ones in response to "probable cause" of crime. In all areas of our lives, the government can invade our privacy if they have good reason to believe we are engaged in major criminal activity. They can break into our homes, our safes, and so on. Do we really want a society where electronic communications cannot ever be broken when there is good reason to believe some major threat against society is being planned? Thank you for your comments and for encouraging those on the other news groups to move over to sci.crypt. I'll try to keep up with this newsgroup and respond to other comments if appropriate, but I honestly can't track them all. Dorothy Denning denning(a)cs.georgetown.edu (posting from guvax) ----------------------------------------------------------------------

1 0

Hackers Conference--Crypto Session
by tcmay＠netcom.com 27 Oct '92

27 Oct '92

Glenn Tenney, chairman of the Hackers Conference, has asked me to help put together the crypto session at the Conference next week (6-8 November, Lake Tahoe). I of course agreed....our correspondence is attached below. Sorry if I left off your name in my comments to Glenn ...it seems sometimes that nearly everyone I know has some interest in crypology, privacy, cyberspace, AND is going to Hackers! For those not going to Hackers this year, I'd still like your inputs, and I'll write up some kind of update after it's over, so you'll get some feedback on your ideas. This growing interest in cryptology and the protection of privacy--fanned by the availability of PGP 2.0, the books and articles on hackers and crackdowns by the Feds, the activities of the EFF and CPSR, and by our very own "Cypherpunks" crypto group--should make for an extremely interesting time at Hackers this year. Just about every year at Hackers there's a de facto theme. One year it was hypertext (and Xanadu got started when John Walker of Autodesk met Ted Nelson, Mark Miller, Roger Gregory, and others at Hackers in 1987), another year it was multimedia. Last year it was effectively the EFF, and so on. My hunch is that this year the de facto theme _could_ turn out to be crypto tools and digital protection of privacy. In addition to our session, there will be discussions of wireless communication, the work of the EFF, and a Sunday discussion of these critical issues. These will all fit nicely with our own session. Our session is in "prime time," mid-Saturday afternoon, tentatively (you all know how schedules change!), and is one of the "no competitors" tracks, so attendance should be very high. Accordingly, some premium should be placed on organization, to maximize the information flow. Too many people for the "circle discussion" that worked so well at last year's nanotechnology session (run by Ted Kaehler), so we need to figure out a good format. So give me your inputs! (Also, I think we should get togther informally Friday to bounce ideas around, the better to make the session on Saturday richer and more exciting. I'll let you know in the next several days what we decide, and where we'll meet.) * What topics need to be discussed the most? * What format? Panel discussion? A series of mini-lectures on the various topics? Free-for-all discussion? (Remember that we'll probably be in a big room, with perhaps as many as 100-150 attendees.) * Some ideas for topics (which I'll add to as people make suggestions): - A very brief review of modern cryptology (very brief because we need to move on quickly to the juicy stuff), including snapshot summaries of encryption, RSA (but no number theory!), anonymous mail, digital cash, etc. (Too many crypto panels spend the entire time bringing people up to speed on what prime numbers are, on how one-time pads are used, and so on. I favor giving people a good glimpse of the "exciting" stuff--anonymous mail, digital pseudonyms, information markets, dining cryptographers protocols, etc.--and then letting them go back and fill in the background. Give 'em a glimpse of the Promised Land.) - The uses of digital remailers to protect privacy, and progress on building them (a brief summary) - Possible summary of the "Crypto Anarchy Game" we've been experimenting with here in our Cypherpunks group (Note: we could describe it briefly and then invite folks to play it later that evening, perhaps around midnight) - PGP 2.0...what it is, how to get it, and how to use it - Proposed legislation for trapdoors in telephone equipment, and the possibility that crypto keys may be placed under strict controls (a la my recent post on Dorothy Denning's latest trial balloon) - What we can do about these trends, what we as hackers can do to protect our privacy. Things like: deploying encrypted e-mail as quickly as possible, using digital pseuodonyms, deploying "mixes," arguing for basic constitutional protections, etc. Ideally, people will get so worked up and excited that the rest of the Conference will be buzzing about these issues! Here's Glenn's message to me and my acceptance: > > Considering your keen interest in cryptography, I was > > wondering if you could have your arm twisted to help > > pull together the crypto session for the conference? > > > > It should be fairly easy... Let's see, Eric Hughes will > > be there, as will a couple of guys from BellCore (Sternetta > > and ... ??? ). > > > > If so, plesae let me know and I'll pass on some more names. > > > > Thanks much. > > Glenn Tenney > > Of course I'll help. Anything needed, including what you suggest. > > I'm in regular contact with Eric Hughes, John Gilmore, Fen LaBalme, > Hugh Daniel, Keith Henson, and others. I also know Stu Haber, from > Bellcore...if he could speak briefly about digital timestamping of > documents (and Internet mail applicaitions) that would be timely. > > So I'll so whatever I can. > > BTW, I'll forward my latest posting from sci.crypt about proposals to > require all crypto keys to be registered with the government! That, > alone, is worth of a "hacker politics" discussion at Hackers. > > --Tim (408-688-5409) .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP 2.0 and MailSafe keys by arrangement.

1 0

list status
by Eric Hughes 27 Oct '92

27 Oct '92

As of today, the list stands at 121 members, at least one of which is a mail gateway. Breakdown of the list by top-level domain: U.S. domains: 42 com 42 edu 1 gov 1 mil 10 org 6 us All other domains: 1 at 3 au 1 ca 1 de 2 il 1 nl 2 no 1 nz 1 pt 1 se 4 uk 1 za Eric

2 1