waashk/20ng huggingface dataset:
In <1993Apr27.071549.22910@random.ccs.northeastern.edu> rogue@ccs.northeastern.edu (Free Radical) writes:  >As anyone who attended HoHoCon will attest, you can pick information                         ^^^^^^^ >off the video chip.  It's surprisingly easy too.  The guy did it with >a portable TV, with very minor mods.  It only worked from 3 feet, but >then it was just a demonstration.  A convention for Santa Claus impersonators?  Please elaborate, enquiring minds (those in the second and third jars from the left) want to know....
In article <strnlghtC5M2Cv.8Hx@netcom.com> strnlght@netcom.com (David Sternlight) writes: > >Here's a simple way to convert the Clipper proposal to an unexceptionable >one: Make it voluntary. > >That is--you get high quality secure NSA classified technology if you agree >to escrow your key. Otherwise you are on your own. >  As long as "you are on your own" means that you can use your own encryption, I'm sold.
In article <C614BJ.BK6@agora.rain.com> jhart@agora.rain.com (Jim Hart) writes: >"The security of the system should depend only on the secrecy of >the keys and not on the secrecy of the algorithms" -- Dorothy Denning  Cite source, please.   --Mike
In article <gthomas.735070935@sfu.ca>, gthomas@fraser.sfu.ca (Guy Thomas) writes: > zrepachol@cc.curtin.edu.au (Paul Repacholi) writes: >  >>In article <1993Apr16.055100.1@cc.curtin.edu.au>, zrepachol@cc.curtin.edu.au (Paul Repacholi) writes: >>... >>> If you can't be bothered reading, get the video "Manufacturing Consent". >>>  >  >>In reply to mail queries; I don't know if a video is available yet. I asked >>about a month ao and was told RSN. >  > Yes it is. From the National Film Board of Canada.  Ah, not in the USA. Thats a relief, thought 'reality' must be slipping for a second. :-)  St Noam was on the radio tonight, he has just published a new book "501 years". Published by South End i guess. Could some bostonian confirm please?  I would love to hear what he thinks of the Clipper scam.  ~Paul
>From: denning@guvax.acc.georgetown.edu >                           Revised, April 21, 1993  >The chips are programmed by Mykotronx, Inc., which calls them the >"MYK-78."  The silicon is supplied by VLSI Technology Inc.  >All Clipper Chips are programmed inside a SCIF (Secure Compartmented >Information Facility), which is essentially a vault.  The SCIF contains >a laptop computer and equipment to program the chips.  About 300 chips >are programmed during a single session.  The SCIF is located at >Mykotronx.  >ACKNOWLEDGMENT AND DISTRIBUTION NOTICE.  This article is based on >information provided by NSA, NIST, FBI, and Mykotronx.  Permission to >distribute this document is granted.  So, who is Mykotronx, Inc.?  It would be nice to know that they are not a front company used by an intelligence or other agency of the  U.S. government.  While we are at it, the chip design(s) should be examined and verified against silicon to insure no trap doors or hidden protocols exist in silicon, regardless of the security level of the encryption algorithm.  There is no proof that the chip won't squeel and role over for someone with the proper knowledge to interrogate it via the communications link.  The design examination should be done to the gate level.  Also, how does one verify that what you are looking at is reflected in tapeout, or masks?  The silicon should be examined as well, the design in hand (a clean room publicly defined clipper chip) can be merged with another design later, or changed between completion and mask out.  There is little proof that what you are told is in the chip is all that is in the chip.  Put the (verified) masks in escrow, and use them for chip production, use a third escrow party for programming the chips.
Paul Repacholi (zrepachol@cc.curtin.edu.au) wrote:  : PS The first posting I saw I thought was a joke in *VERY* bad taste. My appologies : to the person who broke the news.  For what it's worth...  Clipper Chip Announcement (clipper@csrc.ncsl.nist.gov) wrote:  : Note:  This file will also be available via anonymous file : transfer from csrc.ncsl.nist.gov in directory /pub/nistnews and : via the NIST Computer Security BBS at 301-948-5717. :      --------------------------------------------------- :  :                          THE WHITE HOUSE :   I haven't been able to open an ftp session with that machine.  Operating under the assumption that the address was wrong, I tried using nslookup and nicname/whois...  > ls nist.gov  [nnsc.nsf.net] Host or domain name            Internet address               [...]  ncsl                           server = mail-gw.ncsl.nist.gov           mail-gw.ncsl                   129.6.48.199  ncsl                           server = dove.nist.gov                   ncsl                           server = ecf.ncsl.nist.gov               ecf.ncsl                       129.6.48.2  ncsl                           server = enh.nist.gov                    ncsl                           server = SUNMGR.NCSL.NIST.GOV            SUNMGR.NCSL                    129.6.48.12 [...]  That's all I could find about the ncsl domain...oh, and I tried an MX lookup on the machine in question, which failed.  Nicname/whois domain lookups at both registries failed, too.   So I thought, "hey, I'm just not using the tools right" and tried calling the BBS number -- no answer.  I'm probably doing something wrong...or, perhaps, the machine has been put behind a firewall.  But it does look like csrc.ncsl.nist.gov has become an un-machine.  If someone would try ftp'ing to it, or knows what's up, I'd really appreciate the info.
In article <9304201003.AA05465@pizzabox.demon.co.uk> gtoal@gtoal.com (Graham Toal) writes: >	gtoal@gtoal.com (Graham Toal) writes: >	> >	>In the UK, it's impossible to get approval to attach any crypto device >	>to the phone network.  (Anything that plugs in to our BT phone sockets >	>must be approved - for some reason crypto devices just never are...) >	> > >	Whats the difference between a V.32bis modem and a V.32bis modem? > >	I'm not being entirely silly here: what I'm pointing out is that the >	modems that they have already approved for data transmission will work >	just fine to transmit scrambled vocoded voice. > >Absolutely.  I just meant that no secure *dedicated* crypto device has >ever been given approval.  Guerrilla underground devices should be well >possible with today's high-speed modems (not that I can think of many v32bis >modems that are approved either mind you - just the overpriced Couriers) > >Can someone tell me if hardware compression is or is not needed to run >digital speech down 14.4K?  I think it is; I've heard it's not.  Lets >say 8 bit samples.  Would *raw* data at the corresponding sampling rate >be usable?  If not, how fancy does the compression need to be?  Reasonably fancy.  Standard "voice" circuits run at 56kbps inter-exchange in the US. Therefore, you need to achieve 4:1 to get standard voice quality.  If you're willing to give up some quality, you need only 2:1.  This is still acceptable from a speech standpoint; it will be a little less faithful to the original, but certainly intelligable.  That's all you really need for this application.
Steve Bellovin writes a well-thought-out and nearly persuasive article about why the Clipper (are we still calling it Clipper today, or have they figured out a non-infringing word yet?) protocol is almost as good as one can do given their marching ordes.  In article <1993Apr24.160121.17189@ulysses.att.com> smb@research.att.com (Steven Bellovin) writes: >         I issue this invitation:  assume that you were charged with >implementing such a system, with complete regard for civil rights and >due process.  What would you do differently?  In answering this >question, please accept NSA's fundamental assumptions:  that both >strong cryptography against outsiders, and the ability to wiretap >*some* domestic users, is necessary.  I'll accept the second assumption only for the sake of argument.  In my view the primary remaining flaw is that the encryption algorithm is secret, leading to suspicion that there is a back door.  Without complete disclosure this suspicion cannot be dispelled, no matter how many trusted experts are allowed to look at it in isolation.  Is it possible to do this whole thing with a public algorithm?  The only concern I've seen with making Skipjack public is that someone could build Clipperphones without registering the keys.  Assume F can really be kept secret as the Government assumes.  Then as part of the initial connection, a Clipperphone executes a protocol with the Pseudophone to demonstrate that they both know F.  For example, the initiating phone picks a number Q and sends E[Q; F].  The receiver sends back E[Q+1; F], and the initiator sends back E[Q+2; F] to demonstrate that her first packet wasn't just a random 64-bit block.  Repeat in the opposite direction with another Q so it can't be defeated by somebody building up a library of sequential numbers by remembering responses and using those responses as the initial numbers of subsequent challenges.  This way Clipperphones will talk only to other Clipperphones.  Of course the Pseudo Company can build their own proprietary Skipjack phone, but the Presidential Fact Sheet implies that they won't get approval for it without equivalent key escrow.  What's wrong with this picture?  It depends of F staying secret and on Skipjack being resistant to cryptanalysis, but the Government appears to believe in both of these.  Even if the particular Q&A I suggest has some flaw, I imagine there's a zero-knowledge-proof protocol that doesn't.  smb says: >The third, and most serious issue, is whether or not Clipper is a good >idea even if carried out strictly according to the letter of the law.  Agreed.  My view, and you can quote me: if it's not worth doing, it's not worth doing well.
[... a bunch of well-meaning (maybe) cynnical text about screw-thread 	sizes, the rights of people to have their own standards, 	and the non-right of the gov. to regulate screw-threads...]  Well, as funny as your little comment may seem, it has very little to do with your personal privacy as a citizen, and about the governemnt being able to look at everything you have ever typed into a computer at one point or another.  This "Clipper Chip" stuff is the seeds for nightmares to make the  Nightmare on Elmstreet cheese-on-celluloid movies look like episodes of Mr. Roger's Neighborhood.  IF the gov establishes a cryptography standard that has to be used by everyone, and everyone's personal key is divided into two segments and stored at two separate, albeit easy to find places, and that key is only 80 bits to begin with, we are screwed (pardon the allusion to the  affore-mentioned article)!  the gov, I believe, as do many others probably already have the cracking chips for this Clipper Chip made.  Hell, they probably based the encoder on the  chip that cracks it, that way it's easier to break the code, but since it is a  classified algorythm, no one knows that they can crack it so easily.  I, for one, and quite scared of this kind of thing, and plan to support  organizations (and even disorganizations) who are fighting against this Clipper Chip in any way that I can.  I do not want the government to be able to have access, even with a search warrant, to my keys... and I don't want those keys to be only 80 bits long to begin with!  -nate sammons
In article <1993Apr21.163929.21149@eff.org> A. Charles Gross <acg@eff.org> writes: >Certainly, with our way-cool Internet powers of >organization, we can act in the same way, if such action is appropriate. > >As long as we are kept informed of events, anyone on this bboard can make >a call to action.  Hopefully, we're a strong enough community to act on >those calls.  I realize this is a little optomistic, and I'm glad EFF is >working in the loop on these issues, but don't underestimate the >potential of the net for political action. > >Adam >* I speak for myself  I second the motion.  All in favor?  BTW>> a few days ago, Charles Fee <CXF111@psuvm.psu.edu> posted the names, addresses, and phone numbers (voice and fax) of almost all the 103rd  congress's members.  This info, along witha great number of cabinet men, etc... I captured it, as did many others, I am sure.  We should single out a few of the people on the list, and bombard them  with lobbying against the Clipper Chip, et al.  -nate
In article <1993Apr17.031520.13902@clarinet.com>, brad@clarinet.com (Brad Templeton) writes: |> The actual algorithm is classified, however, their main thrust here is |> for cellular phones, and encryption is only over the radio end, not |> end to end, I think.   End to end will come later.
In article <1993Apr19.162936.7517@bernina.ethz.ch> caronni@nessie.cs.id.ethz.ch (Germano Caronni) (actually Dorothy Denning) writes: >The seeds S1 and S2 do not change.    Let me see if I have this straight --- if a person knows S1 and S2, and the serial number of the unit, it's easy to reconstruct UK. Of course, if they know SK, the "family key", they can easily get the serial number of any unit that has made a transmission.  So with S1 and S2 being used for a while "batch" of the unit keys, the number of used S1/S2 pairs will probably be fairly low.  Of course, you have to believe that the NSA/FBI/name-your-favorite-government agency will know SK so all it needs is the S1/S2 pairs, and presto, nasty details  like court orders for wire taps are no longer necessary.  Now, I'm not one of the people who distrusts the government at every turn, but taking someone's word for it that the S1/S2 pairs are not kept around is pushing what I'm willing to believe just a little bit too far.
From: res@colnet.cmhnet.org (Rob Stampfli)  	>separate locations to gain credibility. If they are seized and you are 	>compelled to decrypt it, you simply explain that you are an amateur 	>cryptologist playing around with one time pads, and that the first 	>file is the pad for the second. They XOR the two files, and sure 	>enough, out pops a copy of "War and Peace".  	So, judging from recent history, at this point they drop the original 	charges, preemptively find you guilty of copyright violations, and seize 	your computer, your home, and your financial reserves under federal 	forfeiture laws.  Ah no - what *really* happens is that they turn up at the court with *another* file which when exored with your document gives up the famous E911 document :-)  [And I tell you, some judges would fall for it...]
In article <Apr18.194927.17048@yuma.ACNS.ColoState.EDU> holland@CS.ColoState.EDU (douglas craig holland) writes:  [...] >	With E-Mail, if they can't break your PGP encryption, they'll just >call up one of their TEMPEST trucks and read the electromagnetic emmisions >from your computer or terminal.  Note that measures to protect yourself from >TEMPEST surveillance are still classified, as far as I know.  I don't know about classified, but I do seem to remember that unless you're authorized by the Govt, it's illegal to TEMPEST-shield your equipment.  Besides, effective TEMPEST-shielding is much more difficult than you might think (hi Jim!).  	RA  rogue@cs.neu.edu (Rogue Agent/SoD!)
In article <erwin.736304526@trwacs> erwin@trwacs.fp.trw.com writes:  >Anyone interested in adopting British Telecom's quantum encryption scheme? >They've demonstrated it over a 10 km link. It automatically detects >wiretapping. > If the BT phone system is anything to go by...me thinks this should be approached with great caution.  Mark
cuffell@spot.Colorado.EDU (Tim Cuffel) writes:  > There is no guarantee that the deleted space would be overwritten during > optimization.  Likely, but no guarantee.  A quicker and more secure method > would be a batch file that overwrote all of your free space.  For example > fill.bat: > 	echo %1 >> out > 	fill.bat > (This is off the top of my head.  #include <std_disclaimer.h>)  It is MUCH easier, faster, and probably even more secure to use Norton Utilties 6.0 (I'm talking IBM PC here) and to tell WipeInfo to (a) clean the free disk space and (b) clean the slack space at the end of the files. Use to Government standard option for more careful overwriting...  Regards, Vesselin
>In article <C61rDq.5v5@chinet.chi.il.us>, schneier@chinet.chi.il.us  >(Bruce Schneier) writes: >  >|> Unlike the CIA, the NSA has no prohibition against domestic spying.  Read >|> Bamford's THE PUZZLE PALACE. > >We had a senior NSA scientist in Cambridge at one of our workshops recently >(in fact he was here when the Clipper announcement was made, but we didn't >learn of it till after he'd gone). He said on this point that he was forbidden >by law to monitor conversations between US nationals (and he is a chap who is  >very precise about his choice of words). So I don't expect he'd have any qualms >about monitoring a domestic US conversation if one of the parties was an alien. > >However it got me thinking of the Navajo code talkers. Just imagine: > >+ `Hello, is that the Iraqi mission in New York? This is the Iraqi foreign >+ ministry in Baghdad, I am Farouq Hussein, US citizen, social security number >+ so-and-so' > >+ `Yes, indeed, this is the New York mission, Mustafa Jadid speaking, also a >+ US citizen, my social security number is such-and-such, here is our report >+ on activities against the Satan Clinton' > >Ross >         This one is easy, they 'tape' the conversation, call the FBI or Secret Service.  You see "activities against the Satan Clinton" could be construed as a threat against the President of the United States.  I am sure they(NSA,FBI,SS,...,...) have enough judges in their collective pockets to have a warrent before the call is over.....
In article <PMETZGER.93Apr19122105@snark.shearson.com> pmetzger@lehman.com writes: > >In article <strnlghtC5puor.704@netcom.com> strnlght@netcom.com (David Sternlight) writes: > >   There has been extensive discussion in the eff forum, for example, about >   inadmissible taps being used to develop information that could then lead to >   admissible evidence.  This might put a stop to such things, which must from >   time to time be simple fishing expeditions. > >Far more likely, these things will continue to be done no matter what >assurances we are given. "Key Escrow" is likely going to prove to be a >joke.  I feel like Winston Churchill in 1941 :( ...... but, the privacy Clipper will, TO THE EXTENT KEY ESCROW IS LEGITIMATE, stop most of the abuse of wiretaps by local cops, company cops, angry husbands/ wives, etc...  It is going to be hard for the keystone cops, the Proctor&Gamble cops, etc. to bypass even a product as flawed as the ClipJob.  Now I admit, I am hard pressed to find anything else good to say about it except that, if it actually takes off, someone will certainly come up with a REAL crypto chip (pin compatable!) that we can buy... Unless, of course, Big Brother makes it illegal to have real crypto 'cause good honest law abiding citizens will be HAPPY to let the government listen to their every word.... "Me? Did I say THAT?"          "I am not a crook." - President Richard M. Nixon                               ^^^^^^^^^
In article <1993Apr22.125402.27561@fripp.ri.cadre.com> rj@ri.cadre.com writes: >Someone in Canada asked me to send him some public domain DES file >encryption code I have.  Is it legal for me to send it?  I believe it is illegal to send any cryptographic code out of the country without an export license. (Others will correct me if this is inaccurate.)  Dunno if you'd get one for the particular code you have; the only way to find out is to apply for a license.  Note that you need to distinguish between what is legal to send to Canada if YOU have such a license, and what is legal to send if you don't.
In article <1993Apr20.032623.3046@eff.org> kadie@eff.org (Carl M. Kadie) writes:    > Clipper might be a good way to cover the use of another layer of   > encryption.    But, if you are making custom equipment in any case, why not just roll your own Clipper implementation and report the wrong keys to the Escrow agency?  (Tells us who is going to be in the chip business if this thing goes through--NSA, and those with something to hide from NSA.)    If anyone can verify that your phone is not using the key registered to that serial number, either:    1) They have a court ordered wiretap.  But what are they going to do?  Tell the judge that this individual really does have privacy? All they know is that the keys are not enough, but not why.    2) They have a court ordered wiretap on a phone in this series. (This part is really scary.  Since the "expectation" is that all chips in a particular batch will uses seeds based on the same S1 and S2 and the serial number, getting the keys for one of a batch may give access to all.)    3) There is a backdoor which allows all messages to be deciphered without the keys.  I find this one especially threatening since the scheme seems very open to known plaintext attacks.  (What I need to decipher is the data in the header.  If I talk to someone who has one of these phones, presumably there will be an automatically negotiated key generated.  I'm not trying to decipher the record of the conversation to know what was said, I use it as a known plaintext to recover the backdoor represented by the header, but I know what the header says for conversations I participate in.  Even worse, if the phones in a series have related keys, I can buy a phone/chip from the same production lot.  Then I can recover its keys, either elegantly by talking to myself, or by brute force analysis of the actual chip, then apply the key generation process with those seeds to find the target keys.)      Hmmm!  I don't think I want to ever come close to these phones. Even DES is starting to look good.  Two cans and a string will provide much better security.    --  					Robert I. Eachus
In article <1993Apr23.134422.25521@rick.dgbt.doc.ca> jhan@debra.dgbt.doc.ca (Jerry Han) writes: >In article <116530@bu.edu> uni@acs.bu.edu (Shaen Bernhardt) writes:  [Text Deleted]  >>To be quite honest, the way things are going, I'd call it self defense.  >I never advocated not saying what you believe in.  I'm advocating second >thought, and calm.   > >"A smart warrior defeats the enemy in ambush on the battlefield" >"A smarter warrior defeats the enemy in open warfare on the battlefield" >"The smartest warrior defeats the enemy without using the battlefield" > >Think about it.    I have, my thesis was on Sun Tzu.  More to the point:  Those who are called the good militarists of old, could make opponents lost contact between front and back lines, lose reliability between large and small groups, lose mutual concern for the welfare of the different social classes among them, lose mutual accomodation between the rulers and the ruled, lose enlistments among the soldiers, lose coherence within the armies.  They went into action when it was advantageous, stopped when it was not.  Today it is.  Sitting on your hands will get you nowhere in this battle.  >--  >Jerry Han-CRC-DOC-Div. of Behavioural Research-"jhan@debra.dgbt.doc.ca" >///////////// These are my opinions, and my opinions only. \\\\\\\\\\\\\ >\\\\\\\\\ A proud and frozen member of the Mighty Warriors Band ////////   >"Memories of those I've left behind, still ringing in my ears."-Genesis-  uni@acs.bu.edu
In article <MJS.93Apr22194125@behemoth.genetics.wisc.edu> mjs@behemoth.genetics.wisc.edu (Mike Schmelzer) writes:  > >>>	Let me ask you this.  Would you trust Richard Nixon with your >>>crypto keys?  I wouldn't. > >> I take it you mean President Nixon, not private citizen Nixon. Sure. >> Nothing I'm doing would be of the slightest interest to President Nixon . > >Mr. Sternlight, your naivete and historical ignorance is appalling. > >[ History lesson detailing 1968-74 deleted. ]  Nonsense! I wasn't asked if Larry O'Brien should trust Nixon with his keys, but whether I would.  David