waashk/20ng huggingface dataset:
In article <19930419.155204.305@almaden.ibm.com> ameline@vnet.IBM.COM (Ian Ameline) writes: >  I also believe that someone will reverse engineer the clipper chip, >and knowlege of the algorithm will likely be fairly widespread. Any back- >doors or weaknesses would further discredit the scheme, and help grow >the market demand for a secure alternative.  I must admit that this point has been running through my mind for most of the discussion: one the dice are out there, it won't be long before someone decaps it and, after a bit of work, has full details of the Clipper algorythm.  This isn't trivial to do, but then again, it is not impossibly difficult either.  Any half way decent VLSI design student should be able to take a photograph of a technology s/he is familiar with, and given a description of the input, output, control and supply lines, figure out  the function of various subsystems on the die.  Indeed, this is not an uncommon exercise performed during training (because it makes you think about design decisions made by other designers.  I could speculate that these chips are going to be manufactured using "tamperproof" carriers (unlikely - such techniques are *very* expensive and this thing is supposed to be relatively cheap to produce), or that there will be some legal or legislative framework to prevent publication of the algorythm (unlikely - please correct me if I am wrong but aren't these supposed to be sold internationally?).  I suppose that the most likely reason the algorythm is remaining secret for the moment is that some idiot bureaucrat, untrammeled by the realities of the situation, decided that "well, we should keep it a secret because it is supposed to be secret, isn't it?"  Just some random thoughts...
From: pmetzger@snark.shearson.com (Perry E. Metzger)  	denning@guvax.acc.georgetown.edu (Vidkun Abraham Lauritz Quisling) writes:  	   Each chip includes the following components:  	      the Skipjack encryption algorithm 	      F, an 80-bit family key that is common to all chips 	      N, a 30-bit serial number 	      U, an 80-bit secret key that unlocks all messages encrypted with the chip  	Hmmm. A thirty bit serial number. And, we are told, the unit key U is 	derived deterministically from this serial number. That means that 	there are only one billion possible unit keys.  Oh hell, it's *much* worse than that.  You think they'll ever make more than a million of them?  Serial numbers aren't handed out at random you know, they start at 1 and work up...  Call it a 20 bit space maybe.
Quoting amanda@intercon.com (Amanda Walker) in article <1rn1b3$khb@news.intercon.com>: >george@tessi.com (George Mitchell) writes: >> Guns are offensive.  Cryptography is defensive.  See the difference?   >Nope.  Information, properly delivered, can be just as deadly as lead.
I just joined this group recently and really do not know much about cryptography, but a couple things came to mind while reading through the posts.  1.  Is the Clipper chip going to be exported?  If not, how will people communicate with other countries?  Will they have to do that in un-crypt-mode.  Will other encryption techniques be legal (assuming the government cracks down on using others) when going overseas, but not within the states?  2.  I've read about authentication systems that use an electronic   security card that looks like a calculator to create an encrypted PIN based on the time/date.  The host system has the algorithm built into it as well so that it can authenticate a user. Is there some form of encryption technology that would create keys that are only valid at a certain instant in time?  The  systems would then allow a "window" of time around this instant where the key would work. I realize that this technique would increase the amount of information needing to be stored because you would need entire algorithms rather than just keys.  But for smaller scale things it might work. Could some similar method be used to make the two 80-bit keys that are issued to police/FBI/etc to tap a phone only usable for one-week (for instance).  If further surveilance was needed, they would have to go back to the escrow service to get another key.  This would make it useless for local police to database keys they have used.  I assume this is not possible because the receiving phone would need to be able to decypher the message.  But any thoughts on the subject?  Thanks, Tauren Mills
jhesse@netcom.com (John Hesse) writes: >Oh great. Wonderful news. Nobody can listen in--except the feds.  And anybody who can get the keys from the escrow company.  This is a database that's going to take plenty of updating - they think they can keep it secure?  Please...  and that's just primary, not secondary sources, such as police using the key under a warrant.  Would anyone be surprised if they just "neglected" to erase the key if it turned out they couldn't nail you on anything?
In article <1qpg8fINN982@dns1.NMSU.Edu> amolitor@nmsu.edu (Andrew Molitor) writes: >In article <tcmayC5M2xv.JEx@netcom.com> >tcmay@netcom.com (Timothy C. May) writes: > >>-Tim May, whose sig block may get him busted in the New Regime >                           ^^^^^^^^^^^^^^^^^^ >Isn't this just a little melodramatic?  Not at all. Two weeks ago I registered a concern about some programming that was being conducted by a student organisation here at the University of Texas at San Antonio.  As a result, I was interrogated by the capus police, who also attempted to create a positive-identification file (photo, fingerprints, etc.). I refused to permit this, and filed a complaint with the University administration.  The Vice-President for Business Affairs (the 'boss' of the campus police) stated that he had no interest in the legal/Constitutional implications of those actions.
In article <1993Apr20.161838.13213@coop.com> felixg@coop.com (Felix Gallo) writes: >pat@rwing.UUCP (Pat Myrto) writes: > >>If the Clinton Clipper is so very good, [...] > >Please note that Bill Clinton probably has little if anything to do >with the design, implementation or reasoning behind this chip or behind  Can't we move the political bickering to a more appropriate group? --  Brad Kepley                  Internet         kepley@photon.phys.unca.edu Work-days                    Voice            (704)252-8330
amanda@intercon.com (Amanda Walker) writes: > I don't get up in arms when  > the government fails to protect the interests of the people, because in  > my lifetime it never has--therefore, I have no expectation that it will.   Just to make sure everyone is clear on this: "it never has" refers to  "protects", not "fails to protect"; i.e., in my lifetime I have never seen  the U.S. government consistently protect the interest of U.S. citizens,  except by accident.
In article <1993Apr21.192615.3465@guvax.acc.georgetown.edu>, denning@guvax.acc.georgetown.edu writes:  > Each chip includes the following components:  >    the Skipjack encryption algorithm >    F, an 80-bit family key that is common to all chips >    N, a 30-bit serial number (this length is subject to change) >    U, an 80-bit secret key that unlocks all messages encrypted with the chip [ ... ]  > To see how the chip is used, imagine that it is embedded in the AT&T > telephone security device (as it will be).  Suppose I call someone and > we both have such a device.  After pushing a button to start a secure > conversation, my security device will negotiate an 80-bit session key K > with the device at the other end.  This key negotiation takes place > without the Clipper Chip.  In general, any method of key exchange can > be used such as the Diffie-Hellman public-key distribution method.  > Once the session key K is established, the Clipper Chip is used to > encrypt the conversation or message stream M (digitized voice).  The > telephone security device feeds K and M into the chip to produce two > values:  >    E[M; K], the encrypted message stream, and  >    E[E[K; U] + N; F], a law enforcement field ,  [ ... ]  > which are transmitted over the telephone line.  The law enforcement > field thus contains the session key K encrypted under the unit key U > concatenated with the serial number N, all encrypted under the family > key F.  The law enforcement field is decrypted by law enforcement after > an authorized wiretap has been installed.  One very interesting thing I notice about this is that the only use of the chip key is to encode the session key for the law enforcement field. It is not used at all by the encryption algorithm.  It seems like it would be possible to create a device that would be otherwise compatible, but would send out a bogus law enforcement field. This might render the device unusable with "normal" devices if there's some sort of validation involving the law enforcement field, but it could certainly be used with other such modified devices.  Of course, this is irrelevant if the NSA has a backdoor in the algorithm, but it does make it possible to defeat the key escrow system.
smb@research.att.com (Steven Bellovin) writes:  >Thousands?  Tens of thousands?  Do some arithmetic, please...  Skipjack >has 2^80 possible keys.  Let's assume a brute-force engine like that >hypothesized for DES:  1 microsecond per trial, 1 million chips.  That's >10^12 trials per second, or about 38,000 years for 2^80 trials.  Well, >maybe they can get chips running at one trial per nanosecond, and build >a machine with 10 million chips.  Sure -- only 3.8 years for each solution.  Normally I'd be the last to argue with Steve . . . but shouldn't that read "3.8 years for *all* solutions".  I mean, if we can imagine the machine that does 1 trial/nanosecond, we can imagine the storage medium that could index and archive it.
> I believe there is no technical means of ensuring key escrow without the  >government maintaining a secret of some kind.
In article <1r0ausINNi01@senator-bedfellow.MIT.EDU> jfc@athena.mit.edu (John F Carr) writes: >The chip and algorithm are classified.  If you reverse engineer it and >tell people, you are likely to go to jail.  I don't find this a credible argument, for two reasons.  One you have supplied below: unless I care about entering the USA at any time in the future (eg. the Taiwanese backyard cloners - who BTW have been known to decap custom silicon and reproduce it on daughterboards when pirating high-profit arcade machines and the like - who wouldn't care less), I am not  going to care much about US confidentiality, am I?  Only people like the real me, who does care about travelling to various countries for business reasons, will sit up and follow laws like this, but I would contend that we're not the main threat.  I also have grave doubts whether an algorythm widely distributed in silicon could possibly be called "classified."  It's like handing out military secrets to the whole world in envelopes marked "don't open me."  I can imagine several credible defences which could be employed if it came to a trial.  One would be the stupidity of the government's actions.  >Perhaps some foreign governments or corporations could help us out by >cracking the system outside the USA.  The US government could probably >stop importation of clone hardware, but a software implementation >should be practical.  Amusing thought: could they have employed an algorythm which is infeasable for a fast software implementation, but which is easy in custom hardware? In DES, the extensive use of permutation tables (trivial in hardware: you just swap bus lines), but relatively slow in software have had a big effect on the speed difference between hardware and software implementations of that cipher (indeed, I suspect that Lucifer's designers were well aware that it would be, and approved.)  Certain algorythms (usually parallel search algorythms) can be very slow in software, yet can fly in custom hardware. I have no proof of their employment in Clipper -- it is pure conjecture.   However, as a software implementation of this cipher is something that its  designers would have been trying to avoid at all costs, then the inclusion  of such techniques seems credible.  Hmmm... I also wonder what Intergraph thinks about the use of the name "Clipper" for this device. :)
>I mean, if we can imagine the >machine that does 1 trial/nanosecond, we can imagine the storage medium >that could index and archive it.  	I think you'd have to do some massive data compression just to fit a bit of key information on each primary particle of the known universe. 	But, hey, it's fun to imagine.
In article <116664@bu.edu> uni@acs.bu.edu (Shaen Bernhardt) writes:   > >So don't give me any bullshit analogies about how we trust coke not to >put mind control drugs in every can to get us to buy more.  Shhh--coke drinkers haven't found out about Phosphoric Acid yet.  :-)  David
jhan@debra.dgbt.doc.ca (Jerry Han) writes: > Somebody asked me what was wrong about overreacting in cases such as this.  That was probably me. I meant only that nobody has overreacted yet.  It seemed to me that Jerry was suggesting that people are currently overreacting, and I  vehemently disagree.  I see a lot of talk, but not much action. I see now that I misunderstood Jerry's position.  > The reason is very simple:  How many people do you want to die in a riot?  > In a new Civil War?  > > Everybody is jumping up and down and screaming about it, and I'm worried > that people are going to reach for their hammers and rifles before their pens > and paper.    Not this bunch.  They'll just bitch on the Net for a while, and  then go back to lurking.  > Can people work within the system before trying to break it?  Examine your > history books, and find out how many armed revolutions led to Democratic > (or Democratic style) governments.  I think you'll only find one in over > five thousand years of written history.  Actually, it's not quite that bad, but it's close.  Look, we (collectively) have the power to throw the bums out, but we don't use it.  We clearly don't need to go burning things down, but we clearly do need to throw at least some of the bums out. Unfortunately, the bums have learned to target only small groups of people at a single time, so the masses won't react and throw them out. Eventually, the masses will react, unless the bums cease their relentless encroachment on liberty and despoilment of the economy. The sooner it happens, the less the damages will be.  I don't want to live in a war zone, either -- I want to see the bums thrown out before they do some *real* damage.
In article <1rn458INNguj@dns1.NMSU.Edu> jcho@dante.nmsu.edu (CHO) writes:  >My father having worked for American Cyanamid for sometime did mention >that the "recipe" is a secret... Neither of us know of just how toxic >the stuff is...but you can synthesize a simliar substance that is >available to just about any organic lab...called Luminol.  You can usually >find this in an organic lab book or something similiar...   These substances are normally not the secret, but how to get at them. The  method of preperation is normally patented, which means that no-one else can  make the chemical in the same way, without undergoing an agreement with  American Cyanamid. (But I guess you knew what a patent is :-) )  If you know what substance is used, you'll also know its toxicity.  >Rumor has it that luminol is some base form for the stuff used in the  >light sticks...  The Luminol reaction has the disadvantage of not lasting as long as the  commercial version.  Remember that cyano compounds are found in nature, and not all are poisonous.  Regards,
Does anyone know where I can get a hold of some secure encrypting chips or devices before they are banned completely?!?  Steve
I agree that notifying your elected officials of your feelings on this (and any other, for that matter) issue is the way to go.  And by the way, the phone #s on the list posted the other day were all in Washington D.C.  --  For most of you, your elected officials will also maintain a local office in your area code.  When I 'manage' my elected officials, I use their local office #'s exclusively, and my fax modem and windows-print-capture software are my tool of choice.  They see my words as I have stated them, rather than a summary as they would if I called in /voice/ and left a comment with the office staff.
steve-b@access.digex.com (Steve Brinich) writes:  > > Second question: Why!?!? Why is such a strange procedure used, and not > >a real RNG ? This turns those S1,S2 in a kind of bottleneck for system- > >security.  >  The only theory that makes any sense is that S1 and S2 are either the >same for all chips, or vary among very few possibilities, so that anyone >trying to break the encryption by brute force need only plow through the >possible serial numbers (2^30, about one billion), multiplied by the number >of different S1, S2 combinations.  My interpretation of Denning's description is that S1 and S2 are chosen randomly by agents of the key escrow companies at the start of each 300- chip programming session.  I imagine that the chips are in a carrier which will allow them all to be programmed fairly quickly - there would not be a need to transfer chips one at a time into a little PLA programmer as some people have envisioned.  My guess as to why this procedure is used is that basing the keys on the S1 and S2 using a specified algorithm provides an (in-principle) checkable way to verify that no back doors exist in the choice of the random numbers used to generate the keys.  Since we have to trust the escrow companies anyway, it does not weaken the system to have the keys be generated from random seeds entered by the escrow agents.  And since the algorithm for key-generation is public (modulo Skipjack secrecy) then in principle an agent could challenge the procedure, ask for S1 and S2 to be exposed, and run his own independent calculation of U1 and U2 to verify that that is what is actually being put onto the floppies.  And yes, there are many ways in which failures to follow this scheme could be hard to check.  The laptop probably will not really be destroyed each time.  Hidden cameras in the ceiling could see the S1 and S2 entered by the trusted escrow agents.  Back doors in the chip could allow U to be recovered.  Heck, each chip could be recorded with the same U, ignoring what was on the floppy.
I guess the cryptowranglers read this group too.  But of course I knew that because it is so easy to do.  There is not a single doubt in my mind that every byte that passes every significant gateway or 'bone is captured for the colligation of data about __________?  (Maybe your name is here).  Maybe we should start a newsgroup for the distribution of encrypted  posts intended of members of affinity groups with a shared private key.  For example at the coming up Cypherpunks meeting, a private key corresponding to that particular meeting could be passed out by a moderator.  Minutes, followup comments to other participants, and so on could be posted to the alt.encrypted group for the use of the people who attended. Communiques intended by the group for non-attendees could of course just be signed using the private key but otherwises not encrypted.  Starting a alt.encrypted newsgroup rather than just maintaining mailing lists is better for several reasons.  First, it would be easier to archive for people who might join a group "late" and who might like to easily read earlier posts; second, traffic analysis to know exactly to whom an affinity message is directed would be foiled; three, a newsgroup is much more public and would serve to publicize available privacy measures on the internet.  And it would be fun to accumulate a secret keyring full of such keys -- it beats giving out t-shirts as a door prize.  We could send a copy of alt.encrypted directly to Judge William Sessions or Admiral Studeman to save them the time of having it collected for them.
gtoal@gtoal.com (Graham Toal) writes: 	> 	>In the UK, it's impossible to get approval to attach any crypto device 	>to the phone network.  (Anything that plugs in to our BT phone sockets 	>must be approved - for some reason crypto devices just never are...) 	>  	Whats the difference between a V.32bis modem and a V.32bis modem?  	I'm not being entirely silly here: what I'm pointing out is that the 	modems that they have already approved for data transmission will work 	just fine to transmit scrambled vocoded voice.  Absolutely.  I just meant that no secure *dedicated* crypto device has ever been given approval.  Guerrilla underground devices should be well possible with today's high-speed modems (not that I can think of many v32bis modems that are approved either mind you - just the overpriced Couriers)  Can someone tell me if hardware compression is or is not needed to run digital speech down 14.4K?  I think it is; I've heard it's not.  Lets say 8 bit samples.  Would *raw* data at the corresponding sampling rate be usable?  If not, how fancy does the compression need to be?
Thus said djb@silverton.berkeley.edu (D. J. Bernstein): >Short summary of what Bellovin says Hellman says the NSA says: There is >a global key G, plus one key U_C for each chip C. The user can choose a >new session key K_P for each phone call P he makes. Chip C knows three >keys: G, its own U_C, and the user's K_P. The government as a whole >knows G and every U_C. Apparently a message M is encrypted as >E_G(E_{U_C}(K_P),C) , E_{K_P}(M). That's it. > >The system as described here can't possibly work. What happens when >someone plugs the above ciphertext into a receiving chip? To get M >the receiving chip needs K_P; to get K_P the receiving chip needs U_C. >The only information it can work with is C. If U_C can be computed >from C then the system is cryptographically useless and the ``key >escrow'' is bullshit. Otherwise how is a message decrypted?  Given the description of the algorithm given, the only plausible explantion I can find is that K_P must be agreed to out of bandwidth in advance by the two parties; i.e. it's a standard shared symmetric key.
In article <1993Apr20.000359.20098@bernina.ethz.ch> caronni@nessie.cs.id.ethz.ch (Germano Caronni) writes:      Just a question.     As a provider of a public BBS service - aren't you bound by law to gurantee    intelligble access to the data of the users on the BBS, if police comes    with sufficent authorisation ? I guessed this would be  a basic condition    for such systems. (I did run a bbs some time ago, but that was in Switzerland)  You are obliged to let the police search the equipment if they have a proper court order. You are under no legal obligation to keep the data intelligble. If you wish to run your BBS entirely with all data encrypted such that if the police show up they cannot read anything, well, thats their problem. There are no legal restrictions on domestic use of cryptography in the United States -- YET.  -- Perry Metzger		pmetzger@shearson.com
In article <897@pivot.sbi.com> bet@sbi.com (Bennett Todd @ Salomon Brothers Inc., NY ) writes: >This came up because I decided to configure up MIT-MAGIC-COOKIE-1 security >for X11R5. For this to work you need to stick some bits that an intruder >can't guess in a file (readable only by you) which X client applications >read. They pass the bits back to the server when they want to establish a >connection. > >... >What I settled on was grabbing a bunch of traffic off the network. >Basically, I ran > >	etherfind -u -x greater 0|compress > >and skipped over 10K of output, then grabbed my bits. As best I can tell, >these are bits that can be expected to be reasonably uniformly distributed, >and quite unguessable by an intruder.
In article <1993Apr21.132318.16981@ulysses.att.com> smb@research.att.com (Steven Bellovin) writes: > And key size is one of the things that can be > verified externally.  Gee. Say they feed the 80-bit key through Snefru-8 and take the first 60 bits of the result, then use those 60 bits as the real key. How do you figure out that each key is one of 2^20 ``equal'' keys? You can try a birthday attack, but if the key can be changed only once a second then you will need several lifetimes to get reliable statistics. Somehow I don't think you could catch the NSA at this sort of skulduggery.