waashk/20ng huggingface dataset:
(34AEJ7D@CMUVM.BITNET) wrote: : In light of recent events, it may soon become a very good idea : to include the ability to produce transparent, or at least non-obvious, : cyphertext in upcoming revisions.  This won't help if the NSA/FBA axis requires all messages to undergo textual analysis and reduction to canonical form to eliminate concealed messages.  After reading several National Computer Security Center documents, I'm convinced that they are already using this filter.  DoubleplusgoodNOT.
In article <1993Apr21.113152.395@gems.vcu.edu> , langford@gems.vcu.edu writes: >However, it's likely to be as hard or harder to exercise this right as it >is getting to exercise the other rights that the government is slowly >restricting.  Maybe the NRA _would_ be the best existing organization? >(Although I think a new one might be better, but perhaps would take too long >to start up.  I would certainly join.)  The NRA is successful because (among a number of things), on the drop of a hat, they can get a congresspersons office flooded with postcards, faxes and phone calls.  Certainly, with our way-cool Internet powers of organization, we can act in the same way, if such action is appropriate.  As long as we are kept informed of events, anyone on this bboard can make a call to action.  Hopefully, we're a strong enough community to act on those calls.  I realize this is a little optomistic, and I'm glad EFF is working in the loop on these issues, but don't underestimate the potential of the net for political action.
In <1r47l1INN8gq@senator-bedfellow.MIT.EDU> jfc@athena.mit.edu (John F Carr) writes:  >In most cases information you come by properly is yours to use as you wish, >but there are certainly exceptions.  If you write a paper which includes >sufficiently detailed information on how to build a nuclear weapon, it is >classified.  As I understand the law, nuclear weapons design is >_automatically_ classified even if you do the work yourself.  I believe you >are then not allowed to read your own paper.  This has now been thrown out by the courts.  (The "Progressive" case.)  >A less serious example: if you tell drivers about a speed trap they are >about to run into, you can be fined, even though you might argue that you >broke no law when you discovered the location of the policeman.  The charge >is interfering with a police officer, which is quite similar what you would >be doing by reverse engineering the Clipper chip.  This is outright illegal.  It DOES violate the first amendment.  If you would, give a case in which your "speed trap" example has been upheld by the courts.
nobody@alumni.cco.caltech.edu correctly states Jerry Berman's 1985 view on privacy, but he mistakenly assumes that this represents Berman's 1993 view as EFF Executive Director.  As one of the people who convinced Jerry that legal protections for privacy are insufficient, and that technical measures, especially public key cryptography, are also vitally necessary, I can tell you that Jerry and EFF are fully committed to this position.  The previous poster is apparently unaware of a long series of EFF positions in support of this view.  I suggest those interested read EFF's position on Clipper or our other work in digital privacy.  Check ftp.eff.org for more details.  One of the great things about human beings is that they are capable of change and evolution in their thinking.  The idea that crypto is critical to privacy is one which is no longer limited to certain net afficianados, but is  spreading to parts of the public policy community in Washington.
In article <ygoland.735123994@wright> 	ygoland@wright.seas.ucla.edu (The Jester) writes:  >Ignoring for the moment the question of patented processes (such as >Public Keys), can the government stop me from using an encryption >process?  Following precedent in other areas, the government is likely to put a tax on encryption technology.  Once the tax is imposed, it becomes a federal matter and suspicision of an unlicensed cryptographic tool will bring the BATF or FBI tossing grenades into your house.  (The BATF appears to be the logical agency to enforce such regulations: federal control over alocohol, tobacco, and firearms is similary based on taxes.)  Look at the FCC: they won't allow sale of any receiever that can receive bands that are supposed to be private.  This has nothing to do with any desire to prevent harmful interference. If the government can make a radio receiver illegal what makes you think they won't claim the right to control encryption?
> >  Well, actually, this one's easy. It's their job. The NSA is > >supposed to develop cryptosystems. If the government chooses to go > >ahead and sell those cryptosystems to the masses, so be it. > >  Ah, but developing cryptosystems which are specificially designed to >protect the government's domestic spying capabilities takes them beyond >that mandate, into the forbidden field of domestic wiretapping. > >     The NSA's charter forbids them from doing any purely domestic intelligence work, I would think that even providing assistance in development of the Skipjack algorithom is a violation of that charter.  But as with any intrenched government agency, they will do what they think is expedent.
steve-b@access.digex.com (Steve Brinich) writes:  >  >As a flaming libertarian paranoid extremist (:-), I'at a loss for >  >specific objections that don't sound frighteningly technical. >  >   The idea that foisting the Cripple Chip standard on US manufacturers would > result in saying "Sayonara" to yet another high-tech market isn't technical, > isn't in the least difficult to understand, and plays on a concern lots of > people are worried about already.... >  >  Could you expand on this? I have a feeling you're right, but I don't quite understand.
Okay, let's suppose that the NSA/NIST/Mykotronix Registered Key system becomes standard and I'm able to buy such a system from my local radio shack. Every phone comes with a built in chip and the government has the key to every phone call.  I go and buy a phone and dutifully register the key.   What's to prevent me from swapping phones with a friend or  buying a used phone at a garage sale? Whooa. The secret registered keys just became unsynchronized. When the government comes  to listen in, they only receive gobbledly-gook because the  secret key registered under my name isn't the right one.   That leads me to conjecture that:  1) The system isn't that secure. There are just two master keys that work for all the phones in the country. The part about registering your keys is just bogus.   or   2) The system is vulnerable to simple phone swapping attacks like this. Criminals will quickly figure this out and go to town.
In article <2bb29f4c@mash.boulder.co.us: rmashlan%mash@csn.org (Robert Mashlan) writes: :tarnold@vnet.IBM.COM (Todd W. Arnold) said in article <19930322.101356.617@almaden.ibm.com>: :>It's OK as long as you trust the end-user to stay out of your application :>program - or as long as it runs in a system where the user can't get to it. :>Otherwise, you can't stop him from finding the "load a module" code in your :>program, and simply bypassing the check for a valid module.  The devious user :>can either modify the object code before running the program, or he can run :>the program under a debugger and change the instructions in memory. :There is a way to foil debuggers, by clearing the single step  :interrupt, on which a debugger depends, every few instructions in  :the sensitive areas of the code.  This assumes the person is using the hardware debug instruction of an X86 type processor.  It can be negated by NOP'ing the clear debug instruction, or by running the code on a machine simulator, like one I wrote as a senior project in college.  It can bypass and trace practically anything one could write in software.  Kind of like being on a Star Trek Holideck :-).
In article <1qs6cg$7cq@msuinfo.cl.msu.edu> mrr@scss3.cl.msu.edu (Mark Riordan) writes: >A few more sources are statistics on your filesystems (easily >and quickly obtained) and the output from the "rusage" system >call.   > >You can also exec a finger to one or more favorite heavily-used >systems, though this can take several seconds. > >cf. the source code to RIPEM on ripem.msu.edu. > >Mark R.  Other alternatives include output of vmstat, iostat, pstat and friends with various flags, or even better crash.   e.g. on an RS/6000 (AIX 3.2) you can get lots of relatively unpredicatble data out of crash. (the output from the following script  usually gives about 600k of goo on a moderately busy system.)  #!/bin/sh crash <<! proc - tty stack pcb callout vfs - socket vnode inode - mbuf file mst buffer le !
In article <1993Apr19.180049.20572@qualcomm.com>, karn@unix.ka9q.ampr.org (Phil Karn) writes: > In article <1993Apr18.233112.24107@colnet.cmhnet.org>, res@colnet.cmhnet.org (Rob Stampfli) writes: > |> >Sadly, it does not. Suspects can be compelled to give handwriting and > |> >voice exemplars, and to take blood and DNA tests. > |>  > |> I am sure that Mike is correct on this point.  I am also pretty sure that > |> administering "truth serum" would be ruled a violation of your right > |> not to incriminate yourself.  But, what is the salient difference? >  > You can find the salient difference in any number of 5th amendment > related Supreme Court opinions. The Court limits 5th amendment > protections to what they call "testimonial" evidence, as opposed to > physical evidence.  I have a question that is a slight variation on the previously mentioned examples that perhaps people could give me some pointers on (it has been a couple of years since my Con Law class in college so I hope I am not missing something obvious here...)  Basic Scenario:  	I set up a bbs that uses public-key encryption and encryption of 	files on disk.  The general setup is designed so that when users  	connect they send a private key encrypted using the system public 	key and the user's public-private keypair is used to wrap the 	one-time session keys used for encrypting the files on disk.  The 	result of this is that even if I reveal the system private key it 	is impossible for anyone to gain access to the files stored on the 	machine.  What is possible is for someone to use the revealed 	system private key to entice users into revealing thier personal 	private keys during the authentication sequence.  Questions:  	Does the fact that the system private key does not provide any 	information useful for a search give me any protection as far as 	being coerced to reveal the key?  (I doubt it myself..)  	It seems providing the system private key does not mean that I am 	assisting in "entrapment" (the users would send thier key anyway 	and are not being enticed into doing something they would not 	otherwise do) but is there any other hook that can be used?  	Would the user private-key enticement require wiretap approval?  Any answers or general musings on the subject would be appreciated...  jim
In article <9304221116.AA02093@pizzabox.demon.co.uk> gtoal@gtoal.com (Graham Toal) writes: >:    Does Dorothy Denning read this group?  If not, is someone on the group >: forwarding questions like these to her, or Martin Hellman, or anyone else >: who's seen more details about the chip? > >Of course she does; it's just she's been toasted so often for being >an NSA patsy that she's keeping her head down.  You can always mail >her directly as denning@guvax.acc.georgetown.edu, >denning@cs.cosc.georgetown.edu or denning@cs.georgetown.edu > >G  I found the personal attacks on Prof. Denning pretty disgusting. I don't agree with all her positions; but I think scholars can disagree without the argument getting into the gutter.  If these personal attacks are what stopped Prof. Denning from replying on issues of substance, they have cause real harm to the serious debate here.
In article <19930426.113215.145@almaden.ibm.com>, jbs@watson.ibm.com writes: |>          Is it realistic for the government to try to keep the details |> of the encrytion algorithm secret if it intends to use evidence from... |>                           James B. Shearer  I do not think they can use the eavesdropping as evidence at all. However, using the info they gather while listening, they can go searching THE right place and find good, strong evidence, which they can use in court.   Question : currently, it is easy to wire-tap, from the technical point of view, at least. Anybody using the appropriate radio receiver can listen to communications between a car-telephone and the ground station. The police also, obviously. The clipper chip will make it much more difficult for the non-authorized person to eavesdrop (note that I DO NOT write << impossible>> ). The privacy will thus improve from the current situation. Poeple who REALLY have something to hide already DO NOT use the phone to speak of these things. If an illegal operation is really worth, one can afford having critical data carried by a person rather than sending it electronically.  The clipper chip will not change this.   The problem is more politic. Foreign countries will never accept the clipper chip is the access to the escrow cannot be directly granted to their own police following their OWN law, not the US law. i.e. each country will have its own escrow. How then will it be possible to monitor the international traffic? or, will encrypted international traffic be possible ? or will there be an international escrow, some kind of U.N. thing ?  Forbidding crypted communication is impractical: how is it possible to spot a crypted communication in the thousands of megabytes of data which circulate on the various existing networks. What about private networks ? And this will be more and more impossible as the volume of electronic traffic will increrase in the next years.  I think that the clipper chip can only be an interesting device to limit the risk of , for instance, one's girlfriend's husband listening to his wife's communications. It will bring no more as regards to security. Is it worth ? I think so if its cost is limited, I think that many privacy invasions are done not only by official services, but also by private entities. The clipper can help reducing these. Provided we do not hope too much of it, it is not a real danger and it can be helpful.
In article <1qna0tINNf5p@rodan.UU.NET>, avg@rodan.UU.NET (Vadim Antonov) writes: |> I somehow started to doubt technical competence of the |> people who designed the system.  Why on the Earth split the |> 80-bit key in 40-bit parts to keep them in escrow separately |> (having 40 bit and large volumes of data voice links produce |> it should be relatively easy to break it) when they simply |> could keep 80-bit sequences in N (N>=2) independent places |> and then XOR all the partial keys to get the actual key (N-1 |> sequences should obviously be selected randomly and Nth is the |> actual key XOR-ed with the random sequences).  Without real technical details, it's hard to answer this question. But suppose they already *are* XORing the two 40-bit parts to produce only 40 bits of real key material? Maybe they're using the exportable version of RC2...? :-)
In article <strnlghtC5wHo2.1FK@netcom.com> strnlght@netcom.com (David Sternlight) writes:    >I wouldn't think so.  Asking people to trust a secret algorithm seems    >unsound to me.     Maybe so, but it's quite common. There are millions of Macintosh users who    have no idea what's in Apple's patented ROMs. Many have modems connected.    How do you know all your business secrets aren't being stolen? Answer:    1. Because you trust Apple;    2. Because if any such attempt, however sophicsticated, came out, it would    destroy Apple's credibility forever.  Then there's also 3) Because it's NOT SECRET.  If I want to, I CAN go look at Apple's copyrighted ROMs in a Mac, so they're not keeping any secrets.   You don't even have to pry the top off the chip and use an electron microscope, you just have to read the data in memory and see if you can figure out what it means. (Motorola object code isn't all *that* obscure!)   Yes, it's copyrighted, so I can't go selling copies, or using the copy myself, but I CAN see it, and disassemble it.  4) They're not asking me to trust their honesty.  They're asking me to trust the quality of their assembly language programming :-), but I can see for myself what the performance, price, and crashes/day are. NSA, an organization not known for its honesty or openness,  is asking me to trust them with my privacy, but they won't trust me.  Feh!
>The cryptographic protocol, though, is another matter.  I see no valid >reasons for keeping it secret, and -- as I hope I've shown above -- there >are a lot of ways to do things that aren't (quite) as bad.  It just occurred to me why the algorithm is secret.  If it were published, one could then build physically identical clone versions of the chip that would interoperate with official Clipper chips.  But the cloner wouldn't provide the keys to the escrow houses.  Hmmn.  Or is there a technical hack that I've missed?  E.g. how about if the chips were made unprogrammed but serialized, and then shipped to the two escrow houses who programmed in their halves of the keys, but in a way that requires that secret keys known only to the escrow houses be installed as well, without which clone versions wouldn't interoperate?  This is getting awfully complicated, but that's crypto for you.
In <2109@rwing.UUCP> pat@rwing.UUCP (Pat Myrto) writes:  >How come the media is not telling about the provisions of the Clipper >decision? ...  >How can the bulk of the people be informed, when the media refuses to >do it?  The answer to your second question lies in the way you phrased the first one:  'the media is...'.  The medis isn't 'is'.  The media 'are'.  'Media' means 'more than one medium.'  There are thousands of publications.  Some say this, some say that.         How can the bulk of the people be informed, when they won't read      informative publications?
In article <1993Apr18.225502.358@iecc.cambridge.ma.us> johnl@iecc.cambridge.ma.us (John R. Levine) writes: >It just occurred to me why the algorithm is secret.  If it were >published, one could then build physically identical clone versions >of the chip that would interoperate with official Clipper chips.  But >the cloner wouldn't provide the keys to the escrow houses.  Hmmn.  Not necessarily --- they could release the details of the algorithm without releasing the "system key" (called SK by Hellman).  That would make most people happy, and with some sort of verification procedure before key exchange, the "official" chips would only work with other "official" chips.  In other words, secrecy of SK makes "physically identical clone versions" impossible;  secrecy of the algorithm shouldn't be necessary.  Of course, revealing the algorithm opens them up to attacks on SK --- since all units share this key, compromising it may be a big deal. Personally, I wouldn't feel too comfortable knowing that one "secret" 80-bit number held in many places was all that guaranteed my security. Of course, compromise of SK doesn't necessarily mean that the system is compromised, but it's impossible to tell whether or not that's true with a secret algorithm.  Incidentally, what's to keep a "secret algorithm" from using the secret SK as the main key, with UK being only marginally important.  Then a court order for UK may not even be necessary to do a wiretap.
psionic@wam.umd.edu (Haywood J. Blowme) writes: > Additonally I spoke with Mr. Melnick about their algorithm. He couldn't tell > me much about their new agorithm because it hasn't been patented yet. [...] > Right now the company is afraid that the new clipper chip will put them out > of business. This is a very real possibility. So they really need help in > stopping the clipper chip from becoming a standard.  If they're planning on patenting an algorithm, then I hope they go out of business as quickly as possible.  And you can tell them I said that.  I'm sure many other readers of these newsgroups will agree, too.
In article <1993Apr16.001321.3692@natasha.portal.com> bob@natasha.portal.com (Bob Cain) writes:  >  Check your facts first and grow up. >Why is there such a strong correlation between interest in cryptography >and immaturity I wonder.  	Hmmm.  "Check your facts."  Good advice.  Let's check Mr. Cain's facts a bit, shall we?  >Charles Kincy (ckincy@cs.umr.edu) wrote:  >: Some limitation.  Let me guess:  don't use the code in any way PKP or >: RSA doesn't like....such as...providing secure communications for the >: average citizen. > >That was exactly its purpose if you know anything about it.  There is >nothing at all preventing the average citizen using it, only selling >it.  FACT:  It is unlawful to distribute code implementing RSA without a license to do so from PKP, whether or not one is charging for it.  Furthermore, any use of RSA, other than for research purposes allowed under US patent law, is similarly unlawful.  Therefore, the "average citizen" cannot use RSA to encrypt message traffic in the US without a license from PKP.  There is no licensed, freely available product in the US that uses RSA encryption other than RSAREF (and hence RIPEM), at least as far as I am aware.  If you know of another, please post it here.  >: All I have to say is...yeah, right.  If you're willing to pay them >: mucho big bucks and/or use the routines *they* tell you to do.   >: Doesn't sound very reasonable to me. > >All I have to say is this is full of shit.  I have negotiated a license >and the bucks are incredibly reasonable with an upfront charge on a >sliding scale depending on your capitalization.  If you are a startup >and can't afford it you can't afford to start up in the first place. >Why do people insist on making unequivocal statements about that which >they know nothing.  FACT:  The last contact I had with RSA Data Security, Inc was with some guy trying to sell me a license (unsolicited, I might add) for TIPEM. Cost: $15K plus 2-5 percent royalties.  I suppose it is a matter of opinion as to whether or not these terms count as "mucho bucks" or "incredibly reasonable."  Either way, however, this definitely falls into the "routines *they* tell you to (use)".  >: But I don't guess PKP and RSA are interested in big bucks.  Maybe >: they have some other agenda?  Secure communications only for  >: government agents, perhaps? > >Have you considered treatment for paranoia?  The government is the >single biggest thorn in RSA's side.  FACT:  There are no restrictions (yet!) on the use of cryptography under US law, although this is beginning to look like it will change.  The only impediments to widespread use of RSA cryptography in the US are PKP's patents.  	Mr. Cain, please shut up until you get your facts straight.  =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 	"Better than the whole world be destroyed and crumble to dust than a free man deny one of his desires." 		-Benito Mussolini, Italian anarchist and poet.
Secrecy in Clipper Chip  The serial number of the clipper chip is encrypted with the system key and transmitted as one part of a three part message.  Presumably the protocol can be recovered (if by nothing else, differential analysis).  Postulate if you will, a chip (or logic) sitting between the clipper chip and its communications channel.  The purpose of this chip is twofold:      	1) Transmit Channel  	    The spoof chip XORs the 30 bit encrypted serial number with 	    a secondary keying variable.  This renders the serial number 	    unrecoverable with just the system key  	2) Recieve Channel  	    The spoof chip XORs the incoming encrypted serial number 	    with a secondary keying variable (assuming the serial number 	    is necessary for local operation).  This has the net result of hiding the serial number.  This gets more interesting when the number of serial numbers issued becomes large, making it difficult to distinguish between valid serial numbers and a spoofed serial number.  Without knowing the system key, you could lie about the serial number, but risk detection of the lie.  IF you had the system key and the encryption algorithm you could successfully lie with a lower probability of detection by emulating the format of your own serial number.