waashk/20ng huggingface dataset:
In article <1qnn7b$ddc@sol.TIS.COM> mjr@tis.com (Marcus J Ranum) writes: >	When you've got HRH Prince of Wales saying stupid things over >cordless phones, it's not hard to imagine that drug dealers, child >pornographers, commies, LISP programmers, and other threats to the >civilized world might transact incriminating business over "encrypting" >cellular phones. >  Let's assume, for the moment, that the system really is secure unless you get both halves of the encryption key from the two independent escrow houses.  Let's say you even trust the escrow houses -- one is the ACLU and the other is the EFF.  (And I'm not entirely joking about those two names)  In that case the Prince of Wales has nothing to worry about on this system.  Indeed, as pointed out, since the current systems, even the current digital systems, are very easy to decode -- right now anybody with an old TV can hear them -- for most people, this will be viewed as an "oh goody" step upwards.  And look at how tolerant the public is.  They're willing to let the neighbours with the radios hear right now.  It was suggested by one person that a *lot* of non-evidentiary wiretapping is going on right now without warrants, because anybody can do it and it's just an ECPA violation.  This would stop that.  All tapping would need a warrant, or a breach of security at the escrow houses.
In article <1993Apr15.160415.8559@magnus.acs.ohio-state.edu> ashall@magnus.acs.ohio-state.edu (Andrew S Hall) writes: >I am postive someone will correct me if I am wrong, but doesn't the Fifth >also cover not being forced to do actions that are self-incriminating? >e.g. The police couldn't demand that you silently take them to where the >body is buried or where the money is hidden.  But they can make you piss in a jar, and possibly provide DNA, semen, and hair samples or to undergo tests for gunpowder residues on your hand.  (BTW, that was why the chemical engineer arrested in the WTC explosion thrust his hands into a toilet filled with urine as the cops were breaking down the door -- the nitrogen in the urine would mask any residue from explosives.  I found it interesting the news reported his acts, but not his reasons).  Somewhere, perhaps a privacy group, they discussed the legal ramifications of using a password like    I shot Jimmy Hoffa and his body is in a storage locker in Camden  a while back.  The impression I got was that real judges would dismiss arguments that this password is self-incrimination as first-year law school sophistry -- the fact that you use a statement for a password has no bearing on the veracity of that phrase.  You are not being asked to incrimidate yourself (e.g., "where did you bury the body?"); you are being asked to provide information necessary to execute a legal search warrant.  Refusing to provide the password is akin to refusing to provide a key to a storage locker... except that they could always _force_ their way into the locker.  Of course, that doesn't mean you have to help them _understand_ what they find, or point out things they overlooked in their search!
In article <1993Apr21.150815.6657@chpc.org> rboudrie@chpc.org (Rob Boudrie) writes: >In article <C5so84.Hxv@demon.co.uk> Graham Toal <gtoal@gtoal.com> writes: >>In article <2073@rwing.UUCP> pat@rwing.UUCP (Pat Myrto) writes: >>:If the Clinton Clipper is so very good, why not make its algrithm public >>:so many people can exchange ideas and examine it, rather than a few >>:isolated 'respected experts' (respected by whom?  for what?  Perhaps a > >One more time... > >    If they released the algorithm, it would be possible for someone >    to come up with an implementation which was identical, but >    lacking an escrowed key. > >    Note that the press announcement mentioned that the algorithm was >    being kept secret for security of the key escrow system.  In this >    case security means "an escrowed key for EVERY clipper chip". > > >    Assuming you believed all that is said about the effective of >    the algorithm, and the escrow system, which would you buy : > >     (a)  Chip from firm A with the escrowed key >     (b)  Second source chip from reputable firm B with no key >          in government escrow. > >    There would obviously be powerful economic incentives for a second >    source, non escrowed, vendor.  But what about second sources for pin-compatible non-Clipper algorithm chips that also have escrowed keys?  If a "reputable firm" produces a chip (with escrowed key) that is a pop-in replacement for the Clipper chip in my phone, and uses an algorithm that is widely known and evaluated and "trusted," then what's the problem?  The Clipper is going to be reverse engineered anyway by any organization with sufficient resources (can you say "billions of cocaine dollars?") so those drug dealers they're so worried about will be slipping through the cracks.  We law-abiding (non-incredibly-wealthy) citizens, naturally, will not have this recourse.  But claiming that the algorithm can't be released to prevent people from using non-key-escrowed chips is plain deceitful... analysis of the chip output will provide information on the necessary headers and whatnot, so the "bad guys" could build chips using a *different* algorithm and still not escrow their keys.  Or, they could just buy bunches of cheap phones at K-mart every week, and play Swap-the-Clipper-Chip with their cellular phone every day.
I think this didn't get posted before (I've been reading USENET for the longest time, but never had much interest in posting until recently).  This is what I typed before:  	I have written Mr. Limbaugh before, and I loathe to use the name Rush in association with him, because he is unworthy to have a name in common with some of the greatest musicians in our time, the BAND, Rush.   	His address, as some of you wanted is: 	70277.2502@compuserve.com 	He has been to wrapped up in himself to respond to me, but maybe some of you will have better luck.  :)  bye! -- 	g'bye for now...  	-=I   Tree   I=-                  a.k.a. Andy Novak  ---------------------------------------------------------------------             anovak@titan.ucs.umass.edu                    anovak@twain.ucs.umass.edu --------------------------------------------------------------------- -- 	g'bye for now...  	-=I   Tree   I=-                  a.k.a. Andy Novak  ---------------------------------------------------------------------             anovak@titan.ucs.umass.edu                    anovak@twain.ucs.umass.edu
I've recently been reading a paper of Merkle's (publixhed only on the net, I think) discussing three potential replacements for DES.  Was anyting ever done with these?  Are Khufu, Khafre, and/or Snefru still being discussed anywhere?  (I know Snefru is referenced in the RSA FAQ, and I think it may also be in the sci.crypt FAQ.)    On a related topic, can anyone point me toward good sites to find papers/articles/discussions of cryptology?  I think I've about exhausted the Math/Sci library here, which doesn't seem to have anything more recent than about '84.      Thanks.
In article <1993Apr19.130132.12650@afterlife.ncsc.mil> rlward1@afterlife.ncsc.mil (Robert Ward) writes: +In article <bontchev.734981805@fbihh> bontchev@fbihh.informatik.uni-hamburg.de writes: +>and since the US constitutions guarantees the right to every American +>to bear arms, why is not every American entitled, as a matter of + +Have you read the applicable part of the Constitution and interpreted it IN  +CONTEXT?  If not, please do so before posting this misinterpretation again. +It refers to the right of the people to organize a militia, not for individuals  +to carry handguns, grenades, and assault rifles.    Hmmm, this could become a flame war very quickly.  The text is "...well regulated militia..."  When that amendment was written and approved, "regulated" meand "armed".  Remember all of those Westerns where bounty hunters were called "regulators"?  This is now an archaic usage of the word, but the original intent of the amendment was about weapons, not control.  My $0.02.
holland@CS.ColoState.EDU (douglas craig holland) writes:   >	With E-Mail, if they can't break your PGP encryption, they'll just >call up one of their TEMPEST trucks and read the electromagnetic emmisions >from your computer or terminal.  Note that measures to protect yourself from >TEMPEST surveillance are still classified, as far as I know.  1. I don't think they are classified.  2. I could independently invent about half a dozen right off the top of my head. If I had studied Advanced E & M a little better, I could probably come up with a _very_ good system.  ... >	If the new regime comes to fruition, make sure you protect your First >Amendment rights by asserting your Second Amendment Rights.  >						Doug Holland
It seems to me that all discussions about Clipper security are almost  irrelevant - if I cannot choose the key, but have to use a key chosen for me by the foundry, the security of the WHOLE UNIVERSE OF USERS is as good (or as bad) as the security of VLSI Technologies Inc.  It is a trivial effort to run any ciphertext agains ALL THE KEYS EVER  MANUFACTURED - after all we are talking about 1 to 100 million keys that will ever be manufactured. The key depositories can be as secure and incorruptible as they wish to be, nobody cares anyway...:-(  Now if someone would convince me that the shipping docks of VTI, ATT and others are impenetrable (remember: the chips have to ship with the key -  you or the dealer are going to submit it to the authorities eventually) I'd be a bit happier. But do we really believe that the various governments (including ours) won't have the full lists of all the keys ever manufactured?  Did I miss something here?  My own opinions, quite obviously... --
I am both new to this news group and to the net.                  I am facinated by the things I have heard about the PGP encryption program.  Does anybody out there know where I might get a version of this program that runs under Windows 3.1, MS-Dos, Unix w/source?  As of this writting I have no UNIX access and am running on a nifty windows implamentation of uucico.         Thanks in advance!
brad@optilink.COM (Brad Yearwood) writes: | If Clipper comes to cellular phones along with legal proscriptions against | using other cipher systems on these phones, a new and potentially dangerous | class of crime is created. |  | Criminals who very badly want inscrutable tactical communications | (specifically the terrorists and drug dealers who proponents of key escrow | cite as threats) will be highly motivated to steal the cipher phone of a | legitimate user, and to kill this person or hold them hostage so discovery | of compromise of the device will be delayed.      Yow - get some sleep Brad!  You mean that people (i.e. life-is-cheap terrorists & drug-dealing warlords) who want to communicate in privacy will prefer to break into my house, kill or kidnap me, and steal my telephone, rather than:          - Spending $15 at K-mart to buy a new phone.          - Purchasing a load of phones from the black market / flea market /           super market.          - Talking (*gasp*) face-to-face.          - Walking down to any one of millions of pay phones.          - Using messengers.          - Going to excruciating effort to think of code phrases like "I had           a blowout on the freeway today".      Look, this system does nothing to threaten folks who _know_ they're being wiretapped, since it's trivial to find other avenues of communication; they'd have no reason to resort to extreme measures, since a plethora of simple alternatives are easily available to them.      Among all the legitimate reasons to damn the proposed system, I don't think we need to worry about terrorist commie drug warlord assasin thugs murdering our families, kicking the dog and leaving the toilet seat up just to steal a $15 telephone.  The system is more like urine testing:  it catches some small number of very stupid people, has no effect on the "bad guys" with at least three neurons working in unison who wish to subvert it, and penalizes most heavily those who have no cause to be subject to it.
[Apologies for not posting to alt.clipper, or whatever, but it seems it may not be in the newsfeed here.]  There may be another reason (good from NSA's point of view, horrible from everyone else's) why the algorithm/chip design might be secret.  First, note that the "experts" will only look at "details", and of just  the algorithm:      In addition, respected experts from outside the     government will be offered access to the confidential details of     the algorithm to assess its capabilities and publicly report     their findings.  Why not the chip design?  Well, here's the possiblity:  in addition to encryption, the chip pre-processes voice signals to make them easier to analyze/transcribe electronically.  The chip, once widespread, might effectively be part of a massively parallel computer for "voice- grepping" the US phone network (or the criminal & wrong-thinking patrons thereof).  I wouldn't put it past the NSA.  Think how much easier it would make life for them.  And if this is indeed the case, think of the possible public outcry should it become widely known.  Thus the secrecy.  It might be a good idea to have experts in DSP, voice recognition, and AI conversation-understanding to be on that panel, and insist they be given (authenticatable) design specs and implementation documentation.
In article <1r4vo3$koj@access.digex.net> steve-b@access.digex.com (Steve Brinich) writes:  >  I suspect that the decisive element in the political battle will be the >FUD (Fear, Uncertainty, Doubt) factor. >  If the people who would be end users of the Cripple Chip hear of the whole >debate only vaguely -- the government says it's solid; other people in the >field say it's Swiss cheese -- the balance of doubt could shift against the >Feds.  Any attempt to limit other forms of encryption could then be presented >as the government covering its own butt by protecting its poor product from >superior competition. >  Comments? > Since you asked, the above is a bit inaccurate. More accurate is that the government says its solid, other people in the field who might be able to find out haven't yet done their review of the chip design, and there's been a lot of wild speculation and guesswork from those with little information that it might be Swiss cheese.  David
In article <6040@osc.COM> Joe Keane <jgk@osc.com> writes: :As a matter of fact, i do keep random files on my disk.  The reason is, :without special-purpose hardware, it takes a long time to generate good random :bits.  I have programs that crank out a couple bits per minute, which is :pretty conservative, but over time that's more than i need.  Sounds like a useful program - interested in posting it to alt.sources?
In <C5Jzsz.Jzo@cs.uiuc.edu> kadie@cs.uiuc.edu (Carl M Kadie) writes:  >The crypto-key disclosure issue hasn't come up yet, but current law >suggests that it's a loser for the defendant--he'll be compelled to turn >over the key.  It has actually come up (or it will in a week or two) in NZ.  I'll post the outcome when the trial finishes (which could take months BTW).  Overall it looks like you can't be forced to reveal a password, if anyone can provide a convincing legal argument to the contrary (ie an actual court case) I'd be most interested...  Peter.
(alt.security.clipper added, to keep them informed of this issue)   David Sternlight (strnlght@netcom.com) wrote: .... : The proposal could be modified so that if they get a court order to tap you : and don't charge you with a crime within, say, 90 days, they have to buy you : a new phone. :  : If they do charge you, and you are found innocent, they have to buy you a : new phone. :  : :-)  Yes, but will they buy you a ticket on a time machine to allow you to go back and use the phone with the new key instead of the phone whose key they obtained?  It is unclear whether obtaining the key at time 0 also unlocks messages recorded (by whomever) at earlier times. The announcement was silent on this. The betting seems to be that once your key has been obtained (by the authorities, by divorce lawyers, by the Mafia, by the FBI, by lost or stolen backup tapes, by the NSA, etc.). all previous conversations are unsecure. (Session keys are negotiated, but knowing the private key is believed by many commentators here to break the security. No doubt more details will emerge.)  So, the loss of a key, whether one is guilty or innocent, may mean a lot more than merely replacing the phone.  Sort of like saying to someone, "Oh, I copied your diary. But I'll buy you a new one."   And the system, if made mandatory (as I expect), will make such storing of conversations much easier, I fear. For one thing, the transmission of the escrow key field acts as a clear signal to anyone listening, a kind of "Caller ID" and "Callee ID" on a grand scale. Also, the phone companies may not care as much about protecting the privacy of the calls, as they perceive them all to be useless encrypted junk. (This is a bit of a reach, I know, suggesting that the Clipper will make security more lax...).  Anyway, still lots of issues unresolved.   -Tim May
I change login passwords every couple of months.  I sure would suck if I had to get a new sparc station everytime I wanted to do this.  It seems that this is what they expect you to do if you want to routinely change your password on your phone.  I'm sure the government contractor doesn't mind, but a system where you can cheaply change keys (DES) has inherent security advantages,  regardless of the algorithms involved.
I suspect that this clipper thing could backfire on the Gov in a big hurry. I expect that products using these chips will socket them rather than soldering them, since once the keys are handed over by the escrow agencies, the chip is so much garbage, and will need to be replaced. I expect that someone will come along with a pin compatible chip that uses secure encryption -- possibly even disguised so that it's not possible to tell it from the clipper chip until you try to use the 2 backdoor keys.     If I were to manufacture such a chip, as part of my marketing strategy, I would try to subvert one or both escrow agencies either through bribes or industrial espionage -- and then publicize the fact. (doing my best not to be connected with such activities -- which would likely not be legal :-) Publicly discrediting the escrow agencies would go quite far towards creating a market for a secure alternative.    I also believe that someone will reverse engineer the clipper chip, and knowlege of the algorithm will likely be fairly widespread. Any back- doors or weaknesses would further discredit the scheme, and help grow the market demand for a secure alternative.   I believe that the company that provides such an alternative will make few friends in the LE community, but lots of money. I also believe that the government will do it's best to make such plug replacements illegal. I expect that they will see the same success in limiting the availability of such alternatives as they have seen in limiting the availability of certain illicit drugs -- ie. little to none.
In article <strnlghtC5puor.704@netcom.com> strnlght@netcom.com (David Sternlight) writes:     There has been extensive discussion in the eff forum, for example, about    inadmissible taps being used to develop information that could then lead to    admissible evidence.  This might put a stop to such things, which must from    time to time be simple fishing expeditions.  Far more likely, these things will continue to be done no matter what assurances we are given. "Key Escrow" is likely going to prove to be a joke.  -- Perry Metzger		pmetzger@shearson.com
In article <Apr18.204843.50316@yuma.ACNS.ColoState.EDU> holland@CS.ColoState.EDU (douglas craig holland) writes:   >	Let me ask you this.  Would you trust Richard Nixon with your >crypto keys?  I wouldn't.  I take it you mean President Nixon, not private citizen Nixon. Sure. Nothing I'm doing would be of the slightest interest to President Nixon .  David
Dave Ihnat (ignatz@chinet.chi.il.us) wrote: : In article <1qpg8fINN982@dns1.NMSU.Edu> amolitor@nmsu.edu (Andrew Molitor) writes: : >	Not to pick on Mr. May in particular, of course, but isn't this : >kind of the domino theory? When one little country falls, its neighbor : >will surely follow, and before you know it, we're all mining salt : >in Siberia for not turning in our Captain Crunch Secret Decoder Rings. :  : But, for all the wrongness of our attempt to correct it (VietNam, et. al.), : the domino theory wasn't disproved at all.  Ironically, the domino theory in fact *was* a reasonable metaphor for the collapse of communism, from the liberalizations in Poland and Hungary to the border crossings in the summer of '89 to the fall of the Wall later that year....and then to the ultimate collapse of the USSR.  -Tim May
pmetzger@snark.shearson.com (Perry E. Metzger) writes: > If the Clipper chip can do cheap crypto for the masses, obviously one  > could do the same thing WITHOUT building in back doors.   I agree.  So why is Cylink the only (and expensive) game in town?  Note: I think Cylink is great, and if my boss would double my salary, I'd buy  a bunch of their stuff :).  One thing that Clipper offers is interoperability, at a higher degree of  security than we currently have in non-proprietary voice encryption systems. This means it will be cheaper than anyone's proprietary scheme, and easier to  deploy.  This is, of course, either a bug or a feature depending on how you  look at it :).  > Indeed, even without special engineering, you can construct a good  > system right now. A standard codec chip, a chip to do vocoding, a DES  > chip, a V32bis integrated modem module, and a small processor to do  > glue work, are all you need to have a secure phone.  Great!  Where can I buy it?  Another note: If "Clipper" increases the incentive to bring stronger  encryption to the mass market, all the better.  It's far overpriced at  the moment.  > Yes, cheap crypto is good -- but we don't need it from the government.  I don't care where we *need* to get it from, I care where we *can* get it  from, and whether it will interoperate with everyone else.   > Indeed, were it not for the government doing everything possible to  > stop them, Qualcomm would have designed strong encryption right in to  > the CDMA cellular phone system they are pioneering. Were it not for the  > NSA and company, cheap encryption systems would be everywhere. As it  > is, they try every trick in the book to stop it. Had it not been for  > them, I'm sure cheap secure phones would be out right now.   You can build them right now as long as you don't want to export (a  restriction I firmly oppose).  The only thing stopping people from making  cheap encryption is greed: they want a lock on the market.  > They aren't the ones making cheap crypto available. They are the ones  > keeping cheap crypto out of people's hands. When they hand you a  > clipper chip, what you are getting is a mess of pottage -- your prize  > for having traded in your birthright.   Oh, come on.  Only if you trust it farther than it deserves.  A Clipper phone  *IS NOT* a substitute for a Cylink phone, or a STU-III.  It's a substitute  for the "voice scramblers" advertised in the back of Radio Electronics.  > Are we getting cheaper crypto  > for ourselves? No, because the market would have provided that on its  > own had they not deliberately sabotaged it.  I disagree.  Modulo ITAR, it's not the government that has sabotaged the  market.  > Someone please tell me what exactly we get in our social contract in  > exchange for giving up our right to strong cryptography?   Can you tell me where exactly we have given up that right?