waashk/20ng huggingface dataset:
In article <930424031634.176183@DOCKMASTER.NCSC.MIL>, Grant@DOCKMASTER.NCSC.MIL (Lynn R Grant) writes: > About 50 people so far have asked, "Once the FBI gets your Clipper keys, > won't they be able to read all your future and past traffic?" >  > There has been no response from NIST, NSA, Ms. Denning, Mr. Hellman, or > anyone else who might be able to give us an authoritative answer. > This is troubling. >  > Didn't NSA think about this?  Or is it a feature, and they thought we > wouldn't notice? >  > I would have thought that by now they would have responded with something > of the form, "Well, that won't be a problem because ...."  Don Alvarez posted a good partial solution to this problem to comp.risks.  I'll present my variant on it instead, since I feel it's a bit stronger against some likely attempts to cheat.  depends on the protocol that's followed for reading traffic.  Briefly, the cops get a wiretap warrant, and record the call.  They then notice the encryption and the disclosure header.  It, along with a copy of their warrant, is sent to the FBI, or whoever it is who holds the family key.  The F-holder decrypts the header, and sends the serial number N and the encrypted session key U[K] to the escrow agents.  They, in turn, use U1 and U2 to recover K, and send that to the local police.  Note how this solves the problem of wiretapping forever.  Neither the cops nor the FBI ever see U, so they can't read other traffic.  Every request must be validated by both the FBI and the escrow agents.  The cops and the FBI together can't cheat, since they don't have U.  (I regard that as a likely pairing of folks who might try to beat the system.  It's to prevent this that I modified Alvarez's scheme.)  The escrow agents can't read the conversation, since they don't have it; all they have is N and U[K].  And the police don't even see N.
res@colnet.cmhnet.org (Rob Stampfli) writes: > >Wouldn't a a second monitor of similar type scrolling gibberish and adjacent >to the one being used provide reasonable resistance to tempest attacks?  It would be in a different location, so a directional antenna could probably lock in on just the one monitor. Failing that, a phased array could likely seperate the signals. Admittedly, this is expensive, but so is all the rest of this stuff anyway.  -- Perry Metzger		pmetzger@shearson.com
amolitor@nmsu.edu (Andrew Molitor) writes: >Yes, those evil guys in the FBI can probably, with some >effort, abuse the system. I got news for you, if the evil guys in >the FBI decide they want to persecute you, they're gonna, ...  And if Richard Nixon had had this kind of toy, he wouldn't have had to send people into the Watergate.  But that's not really the issue.  The real issue is whether this  will be used to justify a ban against individuals' use of private  (i.e., anything else) encryption methods.  Unrelated question...isn't the term "Clipper," as neat as it is, already taken by Intergraph?
gtoal@gtoal.com (Graham Toal) writes:  > Whatever happens though, the effect of this new chip will be to make private > crypto stand out like a sore thumb.  ONLY IF this chip catches on. Which means alternatives have to be developed. Which will only happen if Clipper is discredited.
This announcement is somewhat disconcerting; it doesn't do anything evil in and of itself, but bodes badly for the future of open algorithms and standards in information security.  I won't start panicking until/unless DES or RSA or stuff like that is prohibited, but I'm a little anxious.  (No doubt it won't be long before someone posts explaining how this just a small part of some far-ranging and long-lived NSA-PKP-IRS-FBI-CIA-HandgunControlInc-Clinton conspiracy to subvert freedom, democracy, and mathematics.)  My feeling is that the administration probably isn't that worried about things like DES and RSA and PGP and RIPEM, since they'll never be used by a group much wider than us computer geeks.  The fact that this just came out now suggests one of two things:  1.  The NSA has been working on this for a long time, and it only just     now happened to be ``ready'' to release to the world at this time.  2.  The NSA has been working on this for a long time, but wasn't able     to get the Bush administration to go along with this plan.  (I     find it unlikely that this would have been because of a sympathy     for the unescrowed use of cryptography; more likely the     administration felt that even escrowed, secret-algorithm and, for     all we know, trivially breakable cryptography should not be made     widely available.)  Thus said clipper@csrc.ncsl.nist.gov (Clipper Chip Announcement): >This new technology will help companies protect proprietary >information, protect the privacy of personal phone conversations >and prevent unauthorized release of data transmitted >electronically.  At the same time this technology preserves the >ability of federal, state and local law enforcement agencies to >intercept lawfully the phone conversations of criminals.   The majority of the discussion involving this "Clipper Chip" seems to pertain to the encryption of telephone conversations.  Does anyone know if that means this chip is designed to work primarily with analog signals?  The language sort of suggests this, but it's hard to say.  The main thing I just don't get is whether this chip implements symmetric or asymmetric cryptographic techniques.  Anybody know?  I'm guessing symmetric, but they don't get very clear about it.  If it is symmetric, how is it useful for anything other than link-level encryption with an identical chip at each end?  How can you negotiate a per-session key using symmetric cryptography without using a trusted third party who knows your key?  (Or does it even use a per-session key?)  If it's asymmetric, what about PKP's patents, which they claim cover all methods of doing asymmetric cryptography?  Are they getting royalties, or is hiding infringement the real reason for keeping the algorithm secret? :-)
Right on the heels of the Clinton "registered encryption key" debacle comes:  sphughes@sfsuvax1.sfsu.edu (Shaun P. Hughes) writes: >[From yesterdays S.F. Chronicle]  >"President Clinton has asked Congress for authority to spend more money >on spy agencies, satellites and other intelligence activities in fiscal >1994 than it allotted for 1993, congressional and administration >officials say. "  >.... Clinton had promised to slash intelligence spending by $7 billion >over four years.  >.... Although the size of the nations' vast intelligence budget remains >an official secret, administration and congressional officials disclosed >yesterday that it would total about $28 billion if the increase >requested by Clinton is approved.  Wonder how much of that extra money goes into coming up with encryption schemes they can easily crack?
I can think of a couple of ways of guaranteeing authenticity in a one-time pad encrytped scheme, though I'm not sure how to prove that what kind of authenicity they provide.      An obvious first-attempt might be to prepend a truly random (unpredictable for Eve) block to the message, and then calculate a CRC which included the random starting block and all of the message.  This could be encrypted after the message.  The problem is, I'm not sure it's impossible to come up with a message that will hash to the same CRC regardless of the random starting block.  (It intuitively seems like it ought to be hard, but I'm not *that* sure....)  Clearly, a crypto-strength hash like MD5 or the SHA would be stronger, but again, I'm not sure I'm comfortable claiming that it's unbreakable.      A scheme to use up some of the pad bits to decide how many bits of 0's to include in the plaintext stream before going on wouldn't be too bad, either.  At the cost of increasing the speed with which you use up your pad, this could be used to give you arbitrarily low probability that your opponent could spoof a valid-looking message, since any deciphered plaintext in a spot that should be carrying 0's will show that something funny's going on.      If, for each message bit M_i, we used up one random bit, R_i, to decide whether to insert a 0 into the plaintext stream, we'd get a total pad use of 2.5 times the message length.  (We'd expand the message size by about half.)  Each 0 that should appear in the plaintext stream that doesn't is a guess for our would-be spoofer.  At each bit, she has to guess.  I'm trying to see how to quantify her chances of making it all the way through the spoofed message, but it gets a little complicated, because she can get un- synched, and still happen to have a 0 in that place in the spoofed message.      Now, I can see a simple way of doing this that's got to be as secure as a one-time pad, at a cost of using 4 times the message length in pad bits.      For each message bit, M_i, use one random bit, R_i, and xor them together to get X_i.  Now, encrypt the three bits with the one-time pad.  The enemy has no way of guessing what R_i is, so he/she can't guess what X_i is, either. Any change she makes in the ciphertext stream will have to involve a guess of what R_i was.  Is there any way to do this without using so many pad bits?      Spoofing the message is equivalent to correctly guessing as many random bits as there are bits in the message.  Clearly, this makes spoofing messages just as hard if you know the whole message text as if you know none of it. In fact, it looks to me like this makes it just as hard to generate a spoofed message with the ciphertext as without it, but I'm not entirely sure about that.      Is there an easier way of doing this that's provably as secure as the one-time pad?
I tried to mail Peter Boucher, who posted the question, but my e-mail bounced, so, apologies to thsoe who are not interested. >trinomials are all of the form X**a + X**b + 1, where a Have you read: Bremner,A., On Trinomials of Type x$+n$-+Ax$+m$-+1. Math. Scand. 49(1981) pp. 145-155. Zbl. 458.12012. MR 83k:12002.  Ljunggren,W., On the Irreducibility of Certain Trinomials and Quadrinomials. Math. Scand. 8(1960) pp. 65-70. .  Tverberg,H., On the Irreducibility of the Trinomials x$+n$-$mpm$$x$+m$-$mpm$$1. Math. Scand. 8(1960) pp. 121-126.  Tverberg,H., On Cubic Factors of Certain Trinomials. Math. Scand. 53(1983) pp. 178-184. Zbl. 513.12003.
In article <1993Apr21.001230.26384@lokkur.dexter.mi.us>, scs@lokkur.dexter.mi.us (Steve Simmons) writes: > smb@research.att.com (Steven Bellovin) writes: >  > >Thousands?  Tens of thousands?  Do some arithmetic, please...  Skipjack > >has 2^80 possible keys.  Let's assume a brute-force engine like that > >hypothesized for DES:  1 microsecond per trial, 1 million chips.  That's > >10^12 trials per second, or about 38,000 years for 2^80 trials.  Well, > >maybe they can get chips running at one trial per nanosecond, and build > >a machine with 10 million chips.  Sure -- only 3.8 years for each solution. >  > Normally I'd be the last to argue with Steve . . . but shouldn't that > read "3.8 years for *all* solutions".  I mean, if we can imagine the > machine that does 1 trial/nanosecond, we can imagine the storage medium > that could index and archive it.  At the company I worked for previously, I received a file that was des encryped and the person that had sent it, went on vaction.  Rather than wait two weeks I set up a straight frontal attack with one key at a time.  It only took two(2) days to crack the file.  No, I don't have any faith in DES.  A.G.
In article <1993Apr17.032022.14021@clarinet.com>, brad@clarinet.com (Brad Templeton) writes: |> |> Let's assume, for the moment, that the system really is secure unless |> you get both halves of the encryption key from the two independent |> escrow houses.  Let's say you even trust the escrow houses -- one is |> the ACLU and the other is the EFF.  (And I'm not entirely joking about |> those two names) |>  |> In that case the Prince of Wales has nothing to worry about on this |> system.  I must respectfully disagree with this assertion, Brad.  The government is notoriously sloppy with physical, communications, and information security.  They can't keep their computers safe, and they're "trying".  Read "DEA is Not Adequately Protecting National Security Information" [GAO/IMTEC 92-31] for an excellent example of what I'm talking about.  Private sector organizations tend to be even more lax in their security measures. I believe that the escrow organizations will be penetrated by foreign intelligence services within months, if not weeks, of their selection.  Private organizations that lack the resources of a full-fleged intelligence service will take longer - perhaps on the order of one to two years.  Nonetheless, the penetrations will take place, without question.
A while ago there was a reference to a paper on a crypto file system (CFS) given by someone at at AT&T (?).   How can I get a copy?   Is it available on the net?   Was it published? Who was the author?     Thanks
-----BEGIN PGP SIGNED MESSAGE-----  Hi all..  Does anyone know of a UNIX utility allowing encrypted telnet sessions using public-key? I'd like something so that nobody can snoop my password or session text while I'm logging in remotely over the network.  Thanks  g.  - ------------------------------------------------------------------------- PLEASE REPORT UNSIGNED (HENCE UNAUTHORISED) MESSAGES PURPORTEDLY FROM ME, SENT AFTER 22/04/93.                                gtf1000@cus.cam.ac.uk - -------------------------------------------------------------------------   -----BEGIN PGP SIGNATURE----- Version: 2.2
In article <1993Apr25.193300.1707@microsoft.com> gideony@microsoft.com (Gideon Yuval) writes:  >If these personal attacks are what stopped Prof. Denning from >replying on issues of substance, they have cause real harm >to the serious debate here.  They are and they have.  David
In article <rdippold.735426379@qualcom>  (Ron "Asbestos" Dippold) writes:    ... > The only thing that worries me is that 2:1 compression - the > SoundBlaster can do it automatically in hardware, but other than that > I don't have a good feel for how processor intensive it is, so I can't > estimate how fast a PC you'd need.          There's a better way. Doesn't Qualcom have a secure design         that it decided not to market?  Since they aren't going to         use it, wouldn't the patriotic thing be to put the design in         the public domain? How about selling a "Cryptography         Educational Kit" with the critical parts? Something that could         end up as a PC option board with two phone jacks?          Cheers,                 Marc  ---  Marc Thibault                             | marc@tanda.isis.org  Automation Architect                      | CIS:71441,2226  R.R.1, Oxford Mills, Ontario, Canada      | NC FreeNet: aa185
I need to know the following information about the upcoming Crypto Conference; The address to submit articles, and the number of copies needed.  Thanks, 				Jonathan DeMarrais  				jed@pollux.usc.edu  --  --- Jay      jed@pollux.usc.edu          (University of Southern California)
Short summary of what Bellovin says Hellman says the NSA says: There is a global key G, plus one key U_C for each chip C. The user can choose a new session key K_P for each phone call P he makes. Chip C knows three keys: G, its own U_C, and the user's K_P. The government as a whole knows G and every U_C. Apparently a message M is encrypted as E_G(E_{U_C}(K_P),C) , E_{K_P}(M). That's it.  The system as described here can't possibly work. What happens when someone plugs the above ciphertext into a receiving chip? To get M the receiving chip needs K_P; to get K_P the receiving chip needs U_C. The only information it can work with is C. If U_C can be computed from C then the system is cryptographically useless and the ``key escrow'' is bullshit. Otherwise how is a message decrypted?
Quoting jgfoot@minerva.cis.yale.edu in article <1r3jgbINN35i@eli.CS.YALE.EDU>: >Perhaps these encryption-only types would defend the digitized porn if it >was posted encrypted?  >These issues are not as seperable as you maintain.
In article <gradyC5uAMw.BnG@netcom.com>, grady@netcom.com (1016/2EF221) writes: > Maybe we should start a newsgroup for the distribution of encrypted  > posts intended of members of affinity groups with a shared private > key.  For example at the coming up Cypherpunks meeting, a private > key corresponding to that particular meeting could be passed out > by a moderator.  Minutes, followup comments to other participants, > and so on could be posted to the alt.encrypted group for the use > of the people who attended. Communiques intended by the group for > non-attendees could of course just be signed using the private key > but otherwises not encrypted.  	I like it.  PGP would be useful, I guess.  Although I don't have a working version for VMS yet... :-(
"Numerical Recipes in C"..Fortran..Pascal  has a nice section on encryption and decryption based on the DES algorithm.  There is also source code provided (I think some versions of this book are  distributed with the source code on disk; the source code can also be ordered from the publisher).
In article <CMM.0.90.2.735554186.jon@gode.ifi.uio.no>, "Jon \\lnes" <jon@ifi.uio.no> writes: > A person I know, belonging to a research lab of a rivate > company, claimed to me during a priavte conversation that, given the > equipment in his lab, he could crack a Kerberos ticket in 15 minutes to > an hour. He had access to rather powerful DES hardware, but not of an > extraordinare kind, I believe. The attack was possible because of the > amount of known plaintext in the ticket, which itself constitutes a small > message. This was two years ago. > DES is no longer usable for encryption of really sensitive data. For a > lot of purposes, however, it is still very adequate.  This sounds an awful lot like a password-guesser, not a weakness in DES.  Merritt and I pointed out this weakness in Kerberos in a paper that came out about 2.5 years ago, in both Computer Communications Review and Usenix.  For that matter, it was loudly discussed on the Kerberos mailing list even earlier.  The problem has nothing whatsoever to do with DES, and everything to do with bad password selection.
In article <C5trGt.Ew4@news.claremont.edu> ebrandt@jarthur.claremont.edu (Eli Brandt) writes: >Remember in the >announcement they described this scheme as balancing the two >extremes of having no privacy and claiming that citizens had a >Constitutional right to encryption?   > >So much for Clinton's support of the "right of privacy".  There's an out for him.  The announcement talked about strong cryptography I believe.  Specifically:  	nor is the U.S. saying that "every      American, as a matter of right, is entitled to an      unbreakable commercial encryption product."  Every vendor claims his product is unbreakable -- so this was sloppy wording.  I am not claiming that we private citizens should have access to the NSA's best, secret algorithms.  I don't want any NSA algorithms, actually.  I'll let them break my pitiful amateur algorithms -- and RSA's.  All I want is what I have already -- the ability and right to invent and use my own algorithms, share them with my friends and sell them.
In article <1993Apr20.034724.3748@colnet.cmhnet.org> res@colnet.cmhnet.org (Rob Stampfli) writes: >>>	With E-Mail, if they can't break your PGP encryption, they'll just >>>call up one of their TEMPEST trucks and read the electromagnetic emmisions >>>from your computer or terminal.  Note that measures to protect yourself from >> >>2. I could independently invent about half a dozen right off >>the top of my head. If I had studied Advanced E & M a little better, >>I could probably come up with a _very_ good system. > >Wouldn't a a second monitor of similar type scrolling gibberish and adjacent >to the one being used provide reasonable resistance to tempest attacks?  Actually, old video games and pinball machines are supposed to work pretty good (at blocking EM eavesdropping), too.  Those things put out a LOT of EM noise.  Back in the 80's, I read about computer companies putting bunches of games in their buildings for just this purpose (not to mention the $$$).
In article <16BB71018.C445585@mizzou1.missouri.edu> C445585@mizzou1.missouri.edu (John Kelsey) writes: >In article <1993Apr21.001230.26384@lokkur.dexter.mi.us> >scs@lokkur.dexter.mi.us (Steve Simmons) writes: >  >>Normally I'd be the last to argue with Steve . . . but shouldn't that >>read "3.8 years for *all* solutions".  I mean, if we can imagine the >>machine that does 1 trial/nanosecond, we can imagine the storage medium >>that could index and archive it. >  >   Hmmmm.  I think, with really large keyspaces like this, you need to >alter the strategy discussed for DES.  Attempt decryption of several >blocks, and check the disctribution of the contents.  I don't think it's >at all feasible to keep 2**80 encryptions of a known plaintext block on >*any* amount of tape or CD-ROM.  And certainly not 2**128 such encrypted >blocks.  (Anyone know a cheap way of converting every atom in the solar >system into a one bit storage device?) [...]  I don't claim to be a crypto analyist... there isn't a whole lot of good literature on the subject, and the best people don't seem to publish their work :)  but I rather doubt the approach such folks use is brute force (sorry to have implied that in my previous post).  The history of these things is folks find clever ways of limiting the search and bang from there.  I guess my real problem with Skipjack is I can not believe NSA would make publicly available a system they couldn't break if they wanted... it just isn't in their charter.  Remember DES came from IBM, not NSA and, when first published, was given a useful life of 20 years... I think we are well past that point now :(  Remember, based on the size of the NSA budget, they spend a lot more on the technology of decryption than most computer companies spend on R&D.  I have to imagine their stuff is real interesting...  A friend who once worked for them (he is dead now) said he always enjoyed monitoring SAC's (Strategic Air Command) crypto traffic :)  and I rather suspect that stuff is a bit more complex than Skipjack  (Or was it the military got the stuff from the NSA just like we get Skipjack from them ;) [BTW, folks, NSA wasn't being given the keys.  And the Walker spy case shows for some of the systems, the KGB didn't need them either.]
In article <3702.204.uupcb@ssr.com>, dick.zeitlin%acc1bbs@ssr.com (Dick Zeitlin) wrote: >  > PK> .Perhaps we need the telephony equivalent of an anonymous remailer for >   > .the telephone network? Back in Prohibition days (alcohol, that is) I >   > .understand a device called the "cheesebox" was a popular means to thwart >   > .the tracing of telephone calls. It connected two phone lines in the back >   > .room of an otherwise uninvolved business. It was the conceptual predecesso >   > .of today's anonymous email remailer. >  > The old "cheesebox" was the pre-Carterphone version of the "call > diverter."  After the Carterphone decision there were several vendors > that sold call diverters.  I've got a couple in my basement that > were used to redirect my office phone to my home number when I > didn't feel like going into the office. >  > It'd be quite easy to generate an "anonymous redialer" version of the > call diverter. >   About 18 months ago, I heard a report on NPR about a 900-number "1-900-STO-PPER" or some such, for placing untraceable calls. You call them, and on "bong" tone dial the number you want to call; they told the NPR interviewer that nothing short of a court order (which they'd fight) would make them release their records.                                                                                                                  Matt Healy "I pretend to be a network administrator;  the lab net pretends to work"
strnlght@netcom.com (David Sternlight) writes:  [...] >The Attorney General publishes the number of court-ordered taps each year. [...]  I believe you are mistaken. I don't believe the AG publishes the number of state wiretaps.  - Carl