HDTenEightyP/NetNews huggingface dataset:
From: res@colnet.cmhnet.org (Rob Stampfli)
Subject: Re: A Copper Balloon
Organization: Little to None
Date: Wed, 11 Nov 1992 14:47:40 GMT

In article <1992Nov10.090133.1707@guvax.acc.georgetown.edu> denning@guvax.acc.georgetown.edu writes:
>... I am also
>not content to let society drift in the direction of completely 
>unregulated crypto without attempting to understand the consequences
>of that from the view of LE as well as the view of protecting privacy
>and proprietary interests.

This argument is a red herring.  As someone who has employed personal
cryptography for years, I am unaware of any successful attempt at
regulating its use directly.  Rather, the government has attempted to
minimise its impact through secrecy with respect to the dissemination
of strong algorithms developed (it is claimed) internally, and of course,
through those stupid export restrictions.  Now that such algorithms
are readily available to the masses, there is this sudden perceived need
to restrict their free use.

We are not "drifting in the direction of completely unregulated crypto",
we are already there -- and always have been.  What Dr. Denning is
proposing is the curtailment of an already existing right.  As we consider
the alleged advantages her proposals would provide to law enforcement, we
must also consider the deprivation of our essential liberties would follow
from their adoption.
-- 
Rob Stampfli  rob@colnet.cmhnet.org      The neat thing about standards:
614-864-9377  HAM RADIO: kd8wk@n8jyv.oh  There are so many to choose from.
Newsgroups: sci.crypt
From: butzerd@columbia.eng.ohio-state.edu (Dane C. Butzer)
Subject: If CFM/CBC patented?
Organization: The Ohio State University Dept of Electrical Engineering
Date: Fri, 6 Nov 1992 15:32:01 GMT

Does anybody know if CFM (cipher feedback mode) and/or CBC (cipher block
chaining) are patented techniques?  I've read about them in many books and
articles, and I've seen nothing to indicate that they are.  However, with
certain people out there seemingly trying to patent Math itself, I didn't want
to assume anything...


Dane Butzer


-------------------------------------------------------------------------------
 HappY HappY JOY JOY !!!  |  Long disclaimer does not follow.  Press n to skip
          - Ren & Stimpy  |  anyways...          butzerd@ee.eng.ohio-state.edu
-------------------------------------------------------------------------------

Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns
From: starr@genie.slhs.udel.edu (Tim Starr)
Subject: Re: Registering "Assault Keys"
Organization: UDel, School of Life & Health Sciences
Distribution: inet
Date: Thu, 5 Nov 1992 08:34:35 GMT

In article <CKD.92Nov2104215@loiosh.eff.org> ckd@eff.org (Christopher Davis) writes:
}Tim> == Tim Starr <starr@genie.slhs.udel.edu> 
}
} Tim> You're apparently ignorant of any distinction between
} Tim> command-and-control regulation from the "public sector" and
} Tim> contractual terms in the "private sector".  You don't have to deal
} Tim> with RSA if you don't consent to it.  If you refuse to deal with
} Tim> the government, it deals with you.
}
}What if RSA brings a patent infringement suit against you?  It's not as
}simple as you paint it.  You can't simply "refuse to deal" with RSA if
}you're using public key encryption in the US.

What I meant was that you don't have to use public key encryption.  Patents
are irrelevant (and I don't believe in 'em, anyways.  Copyright, yes, patents,
no).  You and RSA are both freely contracting parties.  However, if you want
to use RSA in a prohibited fashion, you have no choice about whether you will
deal with the enforcement agency of that prohibition.


Tim Starr - Renaissance Now! - Think Universally, Act Selfishly
starr@genie.slhs.udel.edu

"True greatness consists in the use of a powerful understanding to enlighten
oneself and others." - Voltaire
Newsgroups: sci.crypt
From: lwloen@rchland.vnet.ibm.com (Larry Loen)
Subject: Re: New Encryption System - Challenge!
Date: Mon, 09 Nov 1992 15:28:39 GMT
Reply-To: lwloen@vnet.ibm.com
Disclaimer: This posting represents the poster's views, not necessarily those of IBM
Organization: IBM Rochester
Keywords: FAQ Challenge New Encryption

In article <n0dc8t@ofa123.fidonet.org> Erik Lindano writes:

>Seeing that there are many capable cryptanalysts here, adept at 
> decrypting various sorts of scrambling, encryption and passwords, 
> I'd like to pose a question and ask for some help.
>  
> A person has approached me and said he has devised an unusual 
> encryption method.

  < details of the proposed challenge deleted >

Please send your friend to the library first.  Also, please see
my recent posting "temporary, independent FAQ" for sci.crypt.

It is much, much easier to propose a system than to analyze it 
properly.  You will probably find little enthusiasm here and that may
be a mystery to you until you read the FAQ file.

-- 
   Larry W. Loen        |  My Opinions are decidedly my own, so please
                        |  do not attribute them to my employer
From: mcclary@netcom.com (Michael McClary)
Newsgroups: sci.crypt
Subject: Re: A new encryption problem?
Date: 11 Nov 92 01:26:21 GMT
Organization: Netcom - Online Communication Services (408 241-9760 guest)

In article <7986@transfer.stratus.com> cme@ellisun.sw.stratus.com (Carl Ellison) writes:
>
>The problem here is that both c and p must carry information and be
>believable both in style and as a real communication. []
> Since that cover communication needs to be
>uniform in style, so as to fool the censors, you have very few choices.
>This means that the bit rate is rather low...or, in other words, the
>ciphertext will be much larger than the plaintext.

Alternatively, get a poet for your encyphering cypher clerk.  B-)

-- 
=	=	=	=	=	=	=	=	=	=
Michael McClary						mcclary@netcom.com
For faster response, address electronic mail to:	michael@node.com
Xref: sparky sci.crypt:4712 comp.org.eff.talk:6994 alt.privacy:2233 talk.politics.guns:24081
From: ehorne@zeus.calpoly.edu (Eric T Horne)
Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns
Subject: Re: Registering "Assault Keys"
Date: 13 Nov 92 03:21:58 GMT
Organization: California Polytechnic State University, San Luis Obispo

>>In article <1992Nov10.044148.22135@netcom.com> gurgle@netcom.com (Pete Gontier) writes:
>>>
>>Wrong, it would hurt.  History has proven this time and time again.
>>New York, Wash. DC, Chicago, all places that have banned guns and have
>>the highest crime rates in the country, with the crime rates rising
>>dramatically after the citizenry was unarmed.  History has also proven
>>that the first steps in oppressing a populace is to disarm them.

  I have heard this arguement many times before, but haven't seen any
  sources or data to back it up! Does ANYONE have data to correlate the
  crime rates to gun-control legistation in any (or all) of the cities/
  states in the country? I need this for a speech on Monday (11-12-92),
  so an e-mail response would be best.

  Thanks

  -Eric
Newsgroups: sci.crypt
From: denning@guvax.acc.georgetown.edu
Newsgroups: sci.crypt
Subject: Re: A Copper Balloon
Date: 10 Nov 92 09:01:33 -0500
Distribution: world
Organization: Georgetown University

Carl Ellison gave a good description of the algorithm I had in mind.
One possible extension would be for the parties to pass their values
both ways around the loop for redundancy, but this would increase the
overhead.

While I appreciate that some people prefer to answer the question
"can/should crypto be regulated" with a blanket NO, I prefer to first
get a better idea of what crypto options might be available and the 
conditions, if any, under which they might be appropriate.  I am also
not content to let society drift in the direction of completely 
unregulated crypto without attempting to understand the consequences
of that from the view of LE as well as the view of protecting privacy
and proprietary interests.

Whatever regulation, if any, might be considered, it would seem that
it would have to be aimed mostly at crypto products, not use.

Dorothy Denning
Newsgroups: sci.crypt
From: newsham@wiliki.eng.hawaii.edu (Timothy Newsham)
Subject: is this bad?
Organization: University of Engineering, College of Engineering
Date: Tue, 10 Nov 1992 23:13:38 GMT


I would like to have a scheme for encrypting a serial stream
of data.  I have thought of one method that might work (and 
it also has some other nice qualities that make it apealing to
me).  So I put it before you to tell me why I cant possibly
use it without being cracked by every 10 year old kid who
has a calculator....

At some point in the middle of the stream there is a collection
of previous 8 bytes.   This data is encrypted with DES to form
another 8 byte block.  This block is used 1 byte at a time to
xor with the next bytes in the stream.  When this 8 byte block
is used up the previous 8 bytes of plaintext are crypted and
used to xor the next 8 bytes.  To decrypt you similarly encrypt
a block with the last 8 bytes of plaintext and use it to xor
the next incomming 8 bytes recovering the plaintext.

Advantages:  Can send 1 byte at a time , no need to collect
blocks of 8 bytes.  Next 'key' depends on previous data and
is not just the same for each block of data.  If the stream
is restricted to 7 bits of data you can simply leave off the
upper bit and everything still works (as long as the other
end also realizes that the high bit isnt used).


Disadvantages:  must have synchronization.  Any errors in
the stream will render the rest of the stream unreadable.

So, are there any negative security implications I am overlooking?
Are there any better schemes I could use that have less dis-
advantages?


thank you for any comments,  email prefered.

Xref: sparky sci.crypt:4396 comp.org.eff.talk:6809 alt.privacy:2114 talk.politics.guns:23621
From: starr@genie.slhs.udel.edu (Tim Starr)
Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns
Subject: Re: Registering "Assault Keys"
Date: 6 Nov 92 07:52:27 GMT
Article-I.D.: genie.1992Nov6.075227.25577
Distribution: inet
Organization: UDel, School of Life & Health Sciences

In article <1dcauhINNaf5@iskut.ucs.ubc.ca> unruh@physics.ubc.ca (William Unruh) writes:
}starr@genie.slhs.udel.edu (Tim Starr) writes:
}
}>Not really.  Consent and coercion are opposites; if Switzerland has a high
}>degree of consent compared to other countries, then it has a low level of
}>coercion by the same standard.
}
}Not necessarily, a government can have a high degree of consent by a
}large majority, and still be increadibly coercive to a minority.

Perhaps you don't know what I referred to when I said that Switzerland has
citizen vetoes.  A minority of of the Swiss electorate can nullify legislation.
My understanding is that one third is required to do this, and this doesn't
completely bar oppression of smaller minorities, but I stand by my claim that
Switzerland thus has the highest degree of consent by the governed in the
world.

True, there still may be oppression, but less than anywhere else.


Tim Starr - Renaissance Now! - Think Universally, Act Selfishly
starr@genie.slhs.udel.edu

"True greatness consists in the use of a powerful understanding to enlighten
oneself and others." - Voltaire
Newsgroups: sci.crypt,alt.privacy,comp.org.eff.talk
From: ritter@cactus.org (Terry Ritter)
Subject: Re: A Silver Bullet to Limit Crypto?
Followup-To: sci.crypt
Organization: Capital Area Central Texas UNIX Society, Austin, Tx
Date: Thu, 12 Nov 1992 20:23:30 GMT


 In <1992Nov12.042549.11780@clarinet.com> brad@clarinet.com
 (Brad Templeton) writes:


>Sorry to join this too-voluminous-to-read thread at this point, but I
>don't understand why people are proposing registration of encryption keys.
>
>The implication seems to be that this is to placate law enforcement people
>who want to continue to be able to tap/intercept/read private communications,
>perhaps to stop them from trying to ban encryption altogether?
>
>Is this some sort of joke?  Do people seriously suggest such sort of
>placation is necessary or a good idea?  Or is it law enforcement that's
>pushing for this registration?

 I am reading this under sci.crypt where we have been discussing
 arguments against possible legislation.  There have been a few
 posted, but none come close to the impact of preventing child
 molesting, finding terrorist plots or thwarting assassinations, the
 sort of things which would be used to propose such legislation.

 Basically, I would like to hear a cogent argument which would
 influence legislation.  I doubt that calling it "a joke" would
 do that.


>There is no need to compromise.  Law enforcement is just going to have to
>face a hard fact -- in a few years they won't be able to wiretap.

 The issue is not so much wiretapping, although we will need strong,
 cogent arguments against that as well.  The questionable area is
 the (preservation of?) the ability of society to penetrate
 individual secrecy *after* due process.  Two ways are suggested:

    1. By requiring key registration (presumably, the use of an
       unregistered key would itself be a crime);

    2. By requiring the user to provide access to enciphered
       messages (presumably by retaining ciphertext and keys), with
       the inability to provide such access itself being a crime.

 As to whether or not we "compromise," I can only assume that you
 expect the courts to come to our aid *after* legislation has been
 passed.  Maybe they will, but I think that attitude wastes any
 opportunity we may have to influence the legislation in the first
 place.

 Inevitably there must be limits to all rights.  What are the limits
 on the individual's right to secrecy?

 ---
 Terry Ritter   ritter@cactus.org
From: jim@rand.org (Jim Gillogly)
Newsgroups: sci.crypt
Subject: Re: Attack Methods
Date: 12 Nov 92 17:57:47 GMT
Organization: Banzai Institute

In article <1992Nov11.213535.17788@csc.ti.com> jdailey@dadd.ti.com writes:
>In article 3997@randvax.rand.org, jim@rand.org (Jim Gillogly) writes:
>>
>>And another word of advice: don't try constructing new ciphers for some
>>niche unless you have practical experience in breaking them.  There's no
>>way you will anticipate the kinds of attacks that are available without
>>starting from the cryptanalysis end.
>
>So what are some of the methods used to attack an encrypted text, when the
>encryption method is unknown?

A lot of it depends on auxiliary info: how did you intercept it, and what do
you know about the correspondents?  Does your traffic analysis suggest that
they'll be using a high-level diplomatic cipher, or maybe a field-grade
tactical cipher that's likely to be done with pencil-and-paper or
unmodified calculator?

OK, suppose you don't know anything about it.  Frank Lewis says you should
*look* at the ciphertext and see if there's anything weird about it.  A
lot of people will just start throwing tools at it.  Is it in 6-letter
groups instead of the usual 5?  Is it totally missing J's, or Q's?  The
former might suggest a fractionating system, the latter a Polybius-based
system.

Do a frequency count.  Do the frequencies match your expected target
language?  If so, you're probably dealing with a plain old transposition
cipher.  Are they as rough as the [some?] target language, but different
values?  Maybe it's straight substitution, or maybe substitution with
transposition.

Do an index of coincidence, first on the ciphertext as-is, then on the
ciphertext broken up into periods.  Does it peak somewhere? E.g. if you're
expecting English, do you see the IC for the as-is ciphertext at .066, or
is it stuck down near the .033 you'd expect for random 26-letter text?  If
it peaks on one of the periods, you've got a periodic cipher, and can
start with a whole bunch of *other* tests.  Do a digraphic IC -- if that
peaks as English (or French, or whatever) would, maybe you've got a
Playfair or other digraphic system.

If you've got multiple captured ciphers, slide them against each other and
look at matching letters.  Are there more matches than you'd expect if
they were random?  If so, it may be a long-period system, but these
messages hit an overlap -- this was helpful in the PURPLE analysis.

And then there's crib-dragging, helpful in attacking many ciphers.

And so on and so on -- all driven by the stuff you've found out before, and
revisited as you go down false trails and then back up to something you
thought you'd eliminated.

And, of course, all these methods are 50 years out of date.  I have no clue
as to what's *really* going on inside the classified places, if anything.
-- 
	Jim Gillogly
	U.S. National Debt: $4,130,574,297,255
	Your Share: $16,151
Newsgroups: sci.crypt
From: Ari.Huttunen@hut.fi (Ari Huttunen)
Subject: Re: Limits on the Use of Cryptography?
Organization: Helsinki University of Technology, Finland
Date: Wed, 11 Nov 1992 12:59:28 GMT

In article <1992Nov11.061210.9933@cactus.org> ritter@cactus.org (Terry Ritter) writes:

!     The police bust an alleged child molester, and take possession
!     of his PC.  They believe that the hard drive contains a full
!     database of young kids who have been *or may be* assaulted.
!     That database is enciphered.

!  You *could* say that cryptography does not molest children, that
!  only molesters molest children.  Or you could say that if ciphers
!  are outlawed, only outlaws will have ciphers, and that criminals
!  would not register keys anyway.  But the district attorney might
!  point out that, if the law required key registration (or even just
!  the delivery of keys *after* a formal court hearing), the molester
!  could at least be convicted on *that* charge, and would not be
!  molesting anybody for a while.

How do you know he indeed is the molester if all you have is
an enciphered *something* and lot's of suspicion? What if the
enciphered *something* is a pile of old love letters? In this
case you would sentence an innocent man to prison for molesting.

I always thought a man is innocent until proven guilty...
--
...............................................................................
Ari Huttunen
From: piet@cs.ruu.nl (Piet van Oostrum)
Newsgroups: sci.crypt
Subject: Re: Steganography (Was: A Trial Balloon on Registered Keys)
Keywords: steganography, cryptography
Date: 5 Nov 92 13:57:52 GMT
Reply-To: piet@cs.ruu.nl (Piet van Oostrum)
Organization: Dept of Computer Science, Utrecht University, The Netherlands
Supersedes: <1992Nov5.125740.20951@cs.ruu.nl>

>>>>> styri@hal.nta.no (Haakon Styri) (HS) writes:

HS> In the light of the Registered Keys thread I believe there is a good reason
HS> to discuss steganography.  How can the govt. tell that there's an encrypted
HS> message if I hide it? How can I prove there is no such message if the govt.
HS> says there is?

A very simple way to hide a message is the following:

Suppose your favorate Mafioso wants to send you a secret message. He
encrypts it with a non-registered key. Now he takes a digital picture of
his nice family (say with 8 bits per pixel) and replaces each low-order bit
with one bit of the message. If the color palette is suitably chosen or it
is a grey-scale picture or a 24 bit true color picture or similar, this
will not change the picture much, but just add a bit of noise. How is the
government to prove that the picture contains an encrypted message?

(NOTE: this method is an adaption of something that was published earlier
in sci.crypt)

Of course this method is difficult to use for encrypted telephone communication.
-- 
Piet* van Oostrum, Dept of Computer Science, Utrecht University,
Padualaan 14, P.O. Box 80.089, 3508 TB Utrecht, The Netherlands.
Telephone: +31 30 531806   Uucp:   uunet!mcsun!ruuinf!piet
Telefax:   +31 30 513791   Internet:  piet@cs.ruu.nl   (*`Pete')
Newsgroups: sci.crypt
From: amirza@bronze.ucs.indiana.edu (Anmar Caves)
Subject: Re: Registering "Assault Keys"
Organization: Indiana University
Date: Tue, 10 Nov 1992 15:16:49 GMT

In article <1992Nov10.044148.22135@netcom.com> gurgle@netcom.com (Pete Gontier) writes:
>
>>Or could it be that a ban
>>on guns looks to be the quick fix, even though I have yet to see any
>>evidence of its efficacy in reducing either homicide or other crimes of
>>violence, or overall accidental deaths.
>
>Quick, I dunno. Sure wouldn't hurt. Let's give it a try.

Wrong, it would hurt.  History has proven this time and time again.
New York, Wash. DC, Chicago, all places that have banned guns and have
the highest crime rates in the country, with the crime rates rising
dramatically after the citizenry was unarmed.  History has also proven
that the first steps in oppressing a populace is to disarm them.

>>The *ONLY* difference between a gun of some type and another tool that
>>can be used to cause death or bodily injury is that so much of our
>>movie/TV fare glorifies solving ones problems with a bullet.
>
>This leads into a whole other argument: what's the purpose of a
>handgun? I say it was designed solely for killing people. Others
>dredge up handgun hunter magazines. Who knows? But it's another
>argument, so let's leave it alone for the moment.

A handgun was designed to give short range destructive capability.
Wether or not it is used for killing someone or for punching holes in
paper is left up to the user.  A handgun is highly useful for
defending oneself in close ranges.  If defending myself means killing
someone, well, I'm sorry, but I refuse to lay my life down to the
random criminal.  Please don't ask me to give up a very useful means
of defending myself, as you have absolutely no stake in it.


>It's true that addressing the underlying problems would be the more
>elegant solution. But it'll never happen. All we can do at this point
>is patch the system. This seems like a good patch to me.

It's not a good patch.  See examples of certain major urban centers
above.

>>Of course, all this lacks the appeal of the 'magic bullet':  Just pass
>>this one more 'reasonable' law, and all our problems will go away...
>
>I understand that a ban on handguns would merely be a band-aid. That
>doesn't change my preference.

It won't be a band-aid.  It would be morally wrong, and it would not
achieve the desired effect.
Even then so, about 5% of adults will carry a gun no matter
if it's legal or not.
-- 
Anmar Mirza   # Chief of Tranquility  #My Opinions! NotIU's!#Purveyor of
EMT-D         # Base, Lawrence Co. IN # Legalize Explosives!#nontraditional
N9ISY (tech)  # Somewhere out on the  # Politicians prefer  #family values
Networks Tech.# Mirza Ranch.C'mon over# unarmed peasants.   #Space For Rent
Newsgroups: sci.crypt