EFFector Online 07.04 - FBI Digital Telephony Nightmare Recurs
Stanton McCandlish
________________ _______________ _______________
/_______________/\ /_______________\ /\______________\
\\\\\\\\\\\\\\\\\ \ ||||||||||||||||| / ////////////////
\\\\\\\\\\\\\\\\\/ ||||||||||||||||| / ////////////////
\\\\\\_______/\ ||||||_______\ / //////_____\
\\\\\\\\\\\\\ \ |||||||||||||| / /////////////
\\\\\\\\\\\\\/____ |||||||||||||| / /////////////
\\\\\___________/\ ||||| / ////
\\\\\\\\\\\\\\\\ \ ||||| / ////
\\\\\\\\\\\\\\\\/ ||||| \////
=========================================================================
EFFector Online Volume 07 No. 04 Feb. 24, 1994 edi...@eff.org
A Publication of the Electronic Frontier Foundation ISSN 1062-9424
In This Issue:
Digital Telephony - FBI "Wiretap Bill" Resurrected
EFF Statement on FBI Draft Digital Telephony Bill
NIST Press Release on Clipper Decisions
FCC ftp site now online
Nat'l Symposium on Arts & Humanities Policies for NII
What YOU Can Do
----------------------------------------------------------------------
Subject: Digital Telephony - FBI "Wiretap Bill" Resurrected
-----------------------------------------------------------
The Clinton Administration is backing a proposal by law enforcement
agencies that could make the entire communications infrastructure
susceptible to surveillance. The Digital Telephony Proposal, reintroduced
this year after being successfully thwarted last year, would require
communications service providers to include "back doors" in their software
through which "wiretapping" can be done. In addition, the proposal would
give law enforcement officers access to records *about* communications,
such as who you call and how long you talk. Such traffic analysis can
can reveal vast amounts of information about you. EFF is extremely
concerned about this proposal and has prepared the following summary to
explain it and the harm it could do. More on what *you* can do to fight
the Digital Telephony Proposal will be coming soon.
------------------------------
Subject: EFF Statement on FBI Draft Digital Telephony Bill
----------------------------------------------------------
EFF has received a draft of the FBI's new, proposed "Digital Telephony"
bill. After initial analysis, we strongly condemn the bill, which would
require all common carriers to construct their networks to deliver to law
enforcement agencies, in real-time, both the contents of all communications
on their networks and the "signalling" or transactional information.
In short, the bill lays the groundwork for turning the National Information
Infrastructure into a nation-wide surveillance system, to be used by law
enforcement with few technical or legal safeguards. This image is not
hyperbole, but a real assessment of the power of the technology and
inadequacy of current legal and technical privacy protections for users of
communications networks.
Although the FBI suggests that the bill is primarily designed to maintain
status quo wiretap capability in the face of technological changes, in
fact, it seeks vast new surveillance and monitoring tools. Among the new
powers given to law enforcement are:
1. Real-time access to transactional information creates the ability to
monitor individuals "live".
The bill would require common carrier networks (telephone companies
and anyone who plans to get into the telephone business, such as cable TV
companies) to deliver, in real-time, "call setup information." In the
simplest case, call setup information is a list of phone numbers
dialed by a given telephone currently under surveillance. As we all come
to use electronic communications for more and more purposes, however, this
simple call setup information could also reveal what movies we've ordered,
which online information services we've connected to, which political
bulletin boards we've dialed, etc. With increasing use of
telecommunications, this simple transactional information reveals almost as
much about our private lives as would be learned if someone literally
followed us around on the street, watching our every move.
We are all especially vulnerable to this kind of surveillance, because,
unlike wiretapping the *content* of our communications, it is quite easy
for law enforcement to get permission to obtain this transactional
information. Whereas courts scrutinize wiretap requests very carefully,
authorizations for access to call setup information are routinely granted
with no substantive review. Some federal agencies, such as the IRS, even
have the power to issue administrative subpoenas on their own, without
appearing before a court.
The real impact of the FBI proposal turns, in part, on the fact that it is
easy to obtain court approval for seizing transactional data.
The change from existing law contained in the FBI proposal is that carriers
would have to deliver this call setup information *in real-time*, that is,
"live", as the communication occurs, directly to a remote listening post
designated by law enforcement. Today, the government can obtain this
information, but generally has to install a device (called a 'pen
register') which is monitored manually at the telephone company switching
office.
2. Access to communication and signalling information for any mobile
communication, regardless of location allows tracking of an individual's
movements.
The bill requires that carriers be able to deliver either the contents or
transactional information associated with any subscriber, even if that
person is moving around from place to place with a cellular or PCS phone.
It is conceivable that law enforcement could use the signalling information
to identify that location of a target, whether that person is the subject
of a wiretap order, or merely a subpoena for call setup information.
This provision takes a major step beyond current law in that it allows for
a tap and/or trace on a *person*, as opposed to mere surveillance of a
telephone line.
3. Expanded access to electronic communications services, such as the
Internet, online information services, and BBSs.
The privacy of electronic communications services such as electronic mail
is also put at grave risk. Today, a court order is required under the
Electronic Communications Privacy Act to obtain the contents of electronic
mail, for example. Those ECPA provisions would still apply for the
contents of such messages, but the FBI bill suggests that common carriers
might be responsible for delivering the addressing information associated
with electronic mail and other electronic communications. For example, if
a user connects to the Internet over local telephone lines, law enforcement
might be able to demand from the telephone company information about where
the user sent messages, and into which remote systems that user connects.
All of this information could be obtained by law enforcement without ever
receiving a wiretap order.
4. The power to shut down non-compliant networks
Finally, the bill proposes that the Attorney General have the power to shut
down any common carrier service that fails to comply with all of these
requirements. Some have already called this the "war powers" provision.
Granting the Department of Justice such control over our nation's
communications infrastructure is a serious threat to our First Amendment
right to send and receive information, free from undue government
intrusion.
********************************
This posting represents EFF's initial response to the new FBI proposal.
Several documents, including the full text of the proposed bill and a more
detailed section-by-section analysis are available via anonymous ftp on
EFF's ftp site, as well as an archived copy of this announcement, and
FBI Director Louis Freeh's Digital Telephony speech from late 1993.
This docuemnt is digtel94.announce
The documents can be located via ftp, gopher, or www, as follows:
ftp://ftp.eff.org/pub/EFF/Policy/Digital_Telephony/digtel94_bill.draft
ftp://ftp.eff.org/pub/EFF/Policy/Digital_Telephony/digtel94_analysis.eff
ftp://ftp.eff.org/pub/EFF/Policy/Digital_Telephony/digtel94.announce
ftp://ftp.eff.org/pub/EFF/Policy/Digital_Telephony/digtel93_freeh.speech
for gopher, same but replace first part with:
gopher://gopher.eff.org/00/EFF/...
for WWW, same but replace first part with:
http:/www.eff.org/ftp/EFF/...
The directory also contains older Digital Telephony materials from earlier
incarnations of the FBI's wiretapping scheme; see digtel92* and digtel93*
********************************
Press inquiries, contact:
Jerry Berman, Executive Director <jbe...@eff.org>
Daniel Weitzner, Senior Staff Counsel <d...@eff.org>
+1 202-347-5400 <voice>
+1 202-393-5509 <fax>
Basic EFF info: in...@eff.org
General queries: a...@eff.org
Membership info: membe...@eff.org
------------------------------
Subject: NIST Press Release on Clipper Decisions
------------------------------------------------
(EMBARGOED FOR RELEASE: 3:00 P.M., Friday, Feb. 4, 1994)
Fact Sheet
NIST Cryptography Activities
Escrowed Encryption Standard
On April 16, 1993, the White House announced that the President
approved a directive on "Public Encryption Management." Among
other items, the President directed the Secretary of Commerce, in
consultation with other appropriate U.S. agencies, to initiate a
process to write standards to facilitate the procurement and use of
encryption devices fitted with key-escrow microcircuits in federal
communications systems that process sensitive but unclassified
information.
In response to the President's directive, on July 30, 1993, the
Department of Commerce's National Institute of Standards and
Technology (NIST) announced the voluntary Escrowed Encryption
Standard (EES) as a draft Federal Information Processing Standard
(FIPS) for public comment. The FIPS would enable federal agencies
to procure escrowed encryption technology when it meets their
requirements; the standard is not to be mandatory for either
federal agency or private sector use.
During the public review of the draft standard, a group of
independent cryptographers were provided the opportunity to examine
the strength of the classified cryptographic algorithm upon which
the EES is based. They found that the algorithm provides
significant protection and that it will be 36 years until the cost
of breaking the EES algorithm will be equal to the cost of breaking
the current Data Encryption Standard. They also found that there
is no significant risk that the algorithm can be broken through a
shortcut method of attack.
Public comments were received by NIST on a wide range of issues
relevant to the EES. The written comments submitted by interested
parties and other information available to the Department relevant
to this standard were reviewed by NIST. Nearly all of the comments
received from industry and individuals opposed the adoption of the
standard. However, many of those comments reflected
misunderstanding or skepticism about the Administration's
statements that the EES would be a voluntary standard. The
Administration has restated that the EES will be a strictly
voluntary standard available for use as needed to provide more
secure telecommunications. The standard was found to be
technically sound and to meet federal agency requirements. NIST
made technical and editorial changes and recommended the standard
for approval by the Secretary of Commerce. The Secretary now has
approved the EES as a FIPS voluntary standard.
In a separate action, the Attorney General has now announced that
NIST has been selected as one of the two trusted agents who will
safeguard components of the escrowed keys. Digital Signature Standard
In 1991, NIST proposed a draft digital signature standard as a
federal standard for publiccomment. Comments were received by NIST
on both technical and patent issues. NIST has reviewed the
technical comments and made appropriate changes to the draft.
In order to resolve the patent issues, on June 3, 1993, NIST
proposed a cross-licensing arrangement for a "Digital Signature
Algorithm" for which NIST has received a patent application. The
algorithm forms the basis of the proposed digital signature
standard. Extensive public comments were received on the
proposed arrangement, many of them negative and indicating the need
for royalty-free availability of the algorithm. The
Administration has now concluded that a royalty-free
digital signature technique is necessary in order to promote
widespread use of this important information security technique.
NIST is continuing negotiations with the aim of obtaining a
digital signature standard with royalty-free use worldwide. NIST
also will pursue other technical and legal options to attain that
goal.
Cooperation with Industry
During the government's review of cryptographic policies and
regulations, NIST requested assistance from the Computer System
Security and Privacy Advisory Board to obtain public
input on a wide range of cryptographic-related issues, including
the key escrow encryption proposal, legal and Constitutional
issues, social and public policy issues, privacy, vendor and
business perspectives, and users' perspectives. The Board held
five days of public meetings. Comments obtained by the Board were
useful during the government's review of these
issues. In addition, NIST met directly with many industry and
public interest organizations, including those on the Digital
Privacy and Security Working Group and the Electronic
Frontier Foundation.
As directed by the President when the key escrow encryption
initiative was announced, the government continues to be open to
other approaches to key escrowing. On August 24,
1993, NIST also announced the opportunity to join a Cooperative
Research and Development Agreement (CRADA) to develop secure
software encryption with integrated cryptographic key escrowing
techniques. Three industry participants have expressed their
interest to NIST in this effort; however, the government still
seeks fuller participation from the commercial software industry.
NIST now is announcing an opportunity for industry to join in a
CRADA to develop improved and alternative hardware technologies
that contain key escrow encryption capabilities.
Additionally, the Administration has decided to strengthen NIST's
cryptographic capabilities in order to better meet the needs of
U.S. industry and federal agencies.
2/4/94
------------------------------
Subject: FCC ftp site now online
--------------------------------
NEWS News media information
Federal Communications Commission 202/632-5050
1919 M Street, N.W. Recorded listing of releases and texts
Washington, D.C. 20554 202/632-0002
This is an unofficial announcement of Commission action. Release of the
full text of a Commission order constitutes official action. See _MCI_v._
FCC_, 515 F.2d 385 (DC Circ 1974)
February 22, 1994
FCC TO MAKE DOCUMENTS AVAILABLE ON INTERNET
On February 22, the FCC will begin making some of its information
available through Internet. Starting today, the FCC Daily Digest, the FCC
News Releases, some Public Notices, and speeches by Commission officials
will be accessible. The file name by which each document can be accessed
will appear in the Daily Digest. In the future, the Commission will be
making more of its documents available through Internet.
The FCC's Internet address is ftp.fcc.gov
- FCC -
Office of Public Affairs contact: Rosa Prescott at (202) 632-5050.
------------------------------
Subject: Nat'l Symposium on Arts & Humanities Policies for NII
--------------------------------------------------------------
CALL FOR PAPERS, PANELS, AND PRESENTATIONS
On October 14th, 15th and 16th, the Center for Art Research in Boston will
sponsor a National Symposium on Proposed Arts and Humanities Policies for
the National Information Infrastructure.
Participants will explore the impact of the Clinton Administration's AGENDA
FOR ACTION and proposed NII (National Information Infrastructure)
legislation on the future of the arts and the humanities in 21st Century
America.
The symposium, which will be held at the American Academy of Arts and
Sciences in Cambridge, Massachusetts, will bring together government
officials, academics, artists, writers, representatives of arts and
cultural institutions and organizations, and other concerned individuals
from many disciplines and areas of interest to discuss specific issues of
policy which will effect the cultural life of *all* Americans during the
coming decades.
To participate, submit a 250-word abstract of your proposal for a paper,
panel-discussion or presentation, accompanied by a one-page vitae, by March
15, 1994.
Special consideration will be given to those efforts that take a critical
perspective of the issues, and are concerned with offering specific
alternatives to current administration and congressional agendas.
Thank you,
Jay Jaroslav
NOTE: PLEASE FORWARD AND/OR RE-POST TO APPROPRIATE NEWSGROUPS & MAILING LISTS.
Jay Jaroslav, Director jaro...@artdata.win.net
CENTER FOR ART RESEARCH 241 A Street, Boston, MA 02210-1302 USA
voice: (617) 451-8030 fax: (617) 451-1196
------------------------------
Subject: What YOU Can Do
------------------------
"Relying on the government to protect your privacy is like asking a peeping
tom to install your window blinds."
- John Perry Barlow, EFF co-founder, "Decrypting the Puzzle Palace"
You've been following the newspapers and reading EFFector Online.
You know that today there are several battles being fought over the future
of personal privacy. The Clipper Chip, export restrictions, the Digital
Telephony Proposal - the arguments are numerous and complex, but the
principles are clear. Who will decide how much privacy is "enough"?
The Electronic Frontier Foundation believes that individuals should be
able to ensure the privacy of their personal communications through any
technological means they choose. However, the government's current
restrictions on the export of encrytion software have stifled the
development and commercial availability of strong encryption in the U.S.
Rep. Maria Cantwell has introduced a bill (H.R. 3627) in the House that
would liberalize export controls on software that contains encryption, but
needs vocal support if the bill is to make it out of the committee stage.
The decisions that are made today will affect our futures indefinitely.
EFF is a respected voice for the rights of users of online technologies
and EFF members receive regular online updates on the issues that affect
our online communications and particpate in shaping the future.
Now, more than ever, EFF is working to make sure that you are the one that
makes that decision for yourself. Our members are making themselves heard
on the whole range of issues. To date, EFF has collected over 4100 letters
of support for Rep. Cantwell's bill to liberalize restrictions on
cryptography. We also have over 1000 letters asking Sen. Leahy to hold
open hearings on the proposed Clipper encryption standard.
If you'd like to add your voice in support of the Cantwell bill and the
Leahy hearings, you can send your letters to:
cant...@eff.org, Subject: I support HR 3627
le...@eff.org, Subject: I support hearings on Clipper
Your letters will be printed out and hand delivered to Rep. Cantwell and
Sen. Leahy by EFF.
You KNOW privacy is important. You have probably participated in our online
campaigns. Have you become a member of EFF yet? We feel that the best
way to protect your online rights is to be fully informed and to make your
opinions heard. EFF members are informed, and are making a difference.
Join EFF today!
------------------------------
INTERNET CONTACT ADDRESSES
--------------------------
Membership & donations: membe...@eff.org
Legal services: sst...@eff.org
Hardcopy publications: pu...@eff.org
Online publications, conferences, & other resources: me...@eff.org
Technical questions/problems, access to mailing lists: e...@eff.org
General EFF, legal, or policy questions: a...@eff.org
------------------------------
MEMBERSHIP IN THE ELECTRONIC FRONTIER FOUNDATION
================================================
Print out in monospaced (non-proportional) font and mail to:
Membership Coordinator
Electronic Frontier Foundation
1001 G Street, NW, Suite 950 East, Washington, DC 20001
SIGN ME UP!
-----------
I wish to become a member of the Electronic Frontier Foundation. I enclose:
___ Regular membership -- $40
___ Student membership -- $20
Special Contribution
I wish to make an additional tax-deductible donation in the amount of
$__________ to further support the activities of EFF and to broaden
participation in the organization.
PAYMENT METHOD:
---------------
___ Enclosed is a check or money order payable to
the Electronic Frontier Foundation.
___ Please charge my:
___ MasterCard ___ Visa ___ American Express
Card Number: _____________________________________________
Expiration Date: _________________________________________
Signature: _______________________________________________
NOTE: We do not recommend sending credit card information via email!
YOUR CONTACT INFORMATION:
-------------------------
Name: __________________________________________________________
Organization: __________________________________________________
Address: _______________________________________________________
_______________________________________________________
Phone: _____________________
FAX: _____________________
BBS: _____________________ BBS Name: ____________________
E-mail addresses: ______________________________________________
______________________________________________
PREFERRED CONTACT
___ Electronic: Please contact me via the Internet address listed above.
I would like to receive the following at that address:
___ EFFector Online - EFF's biweekly electronic newsletter
(back issues available from ftp.eff.org,
pub/EFF/Newsletters/EFFector).
___ Online Bulletins - bulletins on key developments
affecting online communications.
NOTE: Traffic may be high. You may wish to browse these
publications in the Usenet newsgroup comp.org.eff.news (also
available in FidoNet, as EFF-NEWS).
___ Paper: Please contact me through the US Mail at the street
address listed above.
NOTE: Paper documents available upon request.
"Networks & Policy" Newsletter automatically sent via US Mail.
PRIVACY POLICY
--------------
EFF occasionally shares our mailing list with other organizations promoting
similar goals. However, we respect an individual's right to privacy and
will not distribute your name without explicit permission.
___ I grant permission for the EFF to distribute my name and contact
information to organizations sharing similar goals.
This form came from EFFector Online (please leave this line on the form!)
The Electronic Frontier Foundation is a nonprofit, 501(c)(3) organization
supported by contributions from individual members, corporations and
private foundations. Donations are tax-deductible.
End of EFFector Online v07 #03
******************************
$$
--
Stanton McCandlish * me...@eff.org * Electronic Frontier Found. OnlineActivist
F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G
O P E N P L A T F O R M O N L I N E R I G H T S
V I R T U A L C U L T U R E C R Y P T O
Red Herring
>
>
>In This Issue:
>
>Digital Telephony - FBI "Wiretap Bill" Resurrected
>EFF Statement on FBI Draft Digital Telephony Bill
>NIST Press Release on Clipper Decisions
>FCC ftp site now online
>Nat'l Symposium on Arts & Humanities Policies for NII
>What YOU Can Do
>
>----------------------------------------------------------------------
>
>
>Subject: Digital Telephony - FBI "Wiretap Bill" Resurrected
>-----------------------------------------------------------
>
>The Clinton Administration is backing a proposal by law enforcement
>agencies that could make the entire communications infrastructure
>susceptible to surveillance. The Digital Telephony Proposal, reintroduced
>this year after being successfully thwarted last year, would require
>communications service providers to include "back doors" in their software
>through which "wiretapping" can be done.
What is next? Requiring every bedroom door to be made with
a "Clipper" peephole?
Alain Simon
> > [ ... ]
> >The Clinton Administration is backing a proposal by law enforcement
> >through which "wiretapping" can be done.
> What is next? Requiring every bedroom door to be made with
> a "Clipper" peephole?
No need for this: every citizen will be issued a brain
tap implant that will broadcast thoughts directly into
the administration's computers.
If you think it is far fatched, think harder. The
arguments invoked for all attacks on our rights and
freedoms imply that a) if it is to fight against some
form of imagination catching evil (raping children is
today's favorite, but the red menace is not that far,
nor are witch burnings) it is OK; b) the presumption
of innocence is an unncessary burden on law enforcement.
Given these two premises I can see no reason why our
bureaucrats and politicians would stop at Clipper.
--
Alain - Virtually me, really
General Mail
result of which being that you can still beat the FEDS if you
really want to. Just the same as today minus clipper. There are
two dangers though: 1) Ordinary people will be lulled into a
false sense of security about what they say on the phone.
2) Government will be less open to the kind of accidental leaks
that reveal they are flogging arms to [insert your fave bogey-
man state] in return for [backhanders/secrets/sex/heroin/hostages]
It is too easy to get paranoid about _lack_ of secrecy. If you're
doing political things as secret cabals you are barking up the
wrong tree. The real danger is in too much secrecy, and if you
want the prime example, look at the British state. Most info does
not come from intecepted comms though; as it is too low level.
To understand something properly you need an insider. Rumours and
conspiracy theories have gone on for years about all sorts of
things to do with our government and royalty, what matters is not
whether there is a supposed tape, but whether people belive,
and the mainstream (tory) press disseminate.
Roland, in personal capacity, using gen a/c
Jay Troy
> I may be wrong, but presumably you can layer encription. The
> result of which being that you can still beat the FEDS if you
> really want to.
You can never beat the feds (or anyone else dedicated enough) through
encryption. The bottom line is that all you can really hope to do is
delay someone from decoding your broadcast long enough that the information
is irrelevant. Of course, the use of encryption can affect the cost/benefit
curve significantly enough to make would-be decoders look elsewhere for
gratification. I beleive that's the ultimate goal of any encryption.
The idea of hiding behind encryption for illegal purposes is stupid for
this same reason. Most illegal activity has a statute of limitations
attached to it, at least in the US. So, if the lawmen want you, and you
broadcast incriminating info, they just need the time and resources to
decode your transmissions. With a 5-10 year statute, you're done.
I think Clipper is a waste of my tax dollars. If I was developing a secure
Clipper device for the non-military. I would definitely include a layer of
encryption on top of any required Clipper-type encryption to insure security
for my customers. Clipper is like the government requiring a key to the
lock on the front door of my house. Sure, they can have one, but I'm
gonna have a couple of additional ones, too.
> There are two dangers though: 1) Ordinary people will be lulled into a
> false sense of security about what they say on the phone.
> 2) Government will be less open to the kind of accidental leaks
> that reveal they are flogging arms to [insert your fave bogey-
> man state] in return for [backhanders/secrets/sex/heroin/hostages]
True. The only real recourse in the US is to vote Libertarian. A great
US statesman once said, "The man who sacrifices freedom for security
deserves neither". Of course, he's long dead, and he's only remembered
for stupid things like flying kites in rain storms.
--
Jay Troy Delaware Valley Solution Systems, Inc.
Computing Solutions for Business and Industry
P.O. Box 190 // Claymont, DE 19703 // (302)798-DVSS
Internet: ...!udel.edu!dvss!jtroy (jt...@dvss.UUCP)
leppik peter
>You can never beat the feds (or anyone else dedicated enough) through
>encryption. The bottom line is that all you can really hope to do is
>delay someone from decoding your broadcast long enough that the information
>is irrelevant. Of course, the use of encryption can affect the cost/benefit
>curve significantly enough to make would-be decoders look elsewhere for
>gratification. I beleive that's the ultimate goal of any encryption.
Not quite true. There are encryption techniques which are mathematically
unbreakable. I can think of two:
1) The "one time pad", where each individual character is encrypted by a
random key, and the decrypter has a caopy of the entire key. The
disadvantage is that the key has to be as long as the message, so
exchanging keys can be cumbersome.
2) So-called "quantum encryption," where the encryption is carried out
via exchange of paired photons. Anybody intercepting either (or both)
streams of photons collapses the wavepackets, and ruining the encryption
for the receiver, making it obvious that the stream has been intercepted
(and allowing the two parties to discontinue their communication). The
disadvantage is that nobody has ever built a practical device to do this--
they exist in theory only (though the relevant physical principles have
been amply demonstrated in the lab).
--
Peter Leppik-- p-l...@uiuc.edu
Assistant Head, Department of Mad Science
University of Illinois at Urbana-Champaign
Benjamin Snowhare Franz
: rol...@tquest.demon.co.uk writes:
: > I may be wrong, but presumably you can layer encription. The
: > result of which being that you can still beat the FEDS if you
: > really want to.
: You can never beat the feds (or anyone else dedicated enough) through
: encryption. The bottom line is that all you can really hope to do is
: delay someone from decoding your broadcast long enough that the information
: is irrelevant. Of course, the use of encryption can affect the cost/benefit
: curve significantly enough to make would-be decoders look elsewhere for
: gratification. I beleive that's the ultimate goal of any encryption.
Depends on what you mean by "beating them". If you mean "you can make a
code they can't break". Yes. It is trivially easy to do so. The one time
pad is very old and provably impossible to break. It is just not
convienent to use. I suppose that by using automated generation of
electronic one time pads stored to CD-ROMs even that objection could be
overcome for specialized usages. If you are only interested in known point
to known point conversation and have a sercure way to distribute the
necessary key material you CAN render material absolutely secure
cryptographically speaking.
The problems arise when you want to talk securely between two points that
are unknown in advance. So the first thing you have to do is establish a
secure channel. This is where public key cryptography comes in, along with
the debates over whether a particular scheme is secure or not. SOmething
worth remembering is that public key is *best* used to bootstrap you into
an ultra-secure mode like CD_ROMed one time pads.
If you meant "The feds will find some other way to obtain the information
they want - without necessarily cracking the code and reading your messages."
Then also yes. They probably can obtain a lot of the information they want
through other sources than reading your mail.
: The idea of hiding behind encryption for illegal purposes is stupid for
: this same reason. Most illegal activity has a statute of limitations
: attached to it, at least in the US. So, if the lawmen want you, and you
: broadcast incriminating info, they just need the time and resources to
: decode your transmissions. With a 5-10 year statute, you're done.
I thnk you are implying that they will crack the code in that kind of
time. Sorry - no.
: I think Clipper is a waste of my tax dollars. If I was developing a secure
: Clipper device for the non-military. I would definitely include a layer of
: encryption on top of any required Clipper-type encryption to insure security
: for my customers. Clipper is like the government requiring a key to the
: lock on the front door of my house. Sure, they can have one, but I'm
: gonna have a couple of additional ones, too.
Problem is that they seem to be trying to mandate it be built in a way that
prevents superimposing another layer of encryption on top of theirs.
--
Benjamin Franz
David Sternlight
Jay Troy <dvss!jt...@udel.edu> wrote:
>Clipper is like the government requiring a key to the
>lock on the front door of my house.
Actually, a better analogy would be that it's like the government's National
Antiburglary Agency developing a special lock which they say is secure
against burglars. They'll let you buy one, but only if the manufacturer
deposits your key in two separately-unusable pieces in two escrow agencies,
in case the police get a search warrant.
--
David Sternlight The views expressed in this message do not necessarily
represent those of the author, who reserves the right
to modify, amend, withdraw, or attack them at any time.
Ben Campbell
: In article <940315.075449.2...@dvss.uucp>,
: Jay Troy <dvss!jt...@udel.edu> wrote:
: >Clipper is like the government requiring a key to the
: >lock on the front door of my house.
: Actually, a better analogy would be that it's like the government's National
: Antiburglary Agency developing a special lock which they say is secure
: against burglars. They'll let you buy one, but only if the manufacturer
: deposits your key in two separately-unusable pieces in two escrow agencies,
: in case the police get a search warrant.
Neither analogy works. In the "lock" analogy, if you don't like it, you don't play. You just keep your old lock.
If Clipper becomes popular, you won't have that choice. Even if you have a non-clipper encrypted telephone, who would you talk to with it? Maybe a few friends, if you're lucky.
Ben Campbell.
: --
Chuck Kincy
>In article <940315.075449.2...@dvss.uucp>,
>Jay Troy <dvss!jt...@udel.edu> wrote:
>
>
>>Clipper is like the government requiring a key to the
>>lock on the front door of my house.
>
>Actually, a better analogy would be that it's like the government's National
>Antiburglary Agency developing a special lock which they say is secure
>against burglars. They'll let you buy one, but only if the manufacturer
>deposits your key in two separately-unusable pieces in two escrow agencies,
>in case the police get a search warrant.
Of course, the government shouldn't mind if I put a few more locks on
my door, should they?
cpk
--
UNOFFICIAL CORRESPONDENCE. The opinion expressed in this post is not
based upon the author's capacity as an employee of the USGS.
---
Chuck Kincy --- cki...@mcdgs01.cr.usgs.gov --- +1 314 341-9391
David Sternlight
>In article <strnlghtC...@netcom.com> David Sternlight,
>strn...@netcom.com writes:
>> In article <940315.075449.2...@dvss.uucp>,
>> Jay Troy <dvss!jt...@udel.edu> wrote:
>>
>>
>> >Clipper is like the government requiring a key to the
>> >lock on the front door of my house.
>>
>> Actually, a better analogy would be that it's like the government's
>National
>> Antiburglary Agency developing a special lock which they say is secure
>> against burglars. They'll let you buy one, but only if the manufacturer
>> deposits your key in two separately-unusable pieces in two escrow
>agencies,
>> in case the police get a search warrant.
>
>locks to artificially create a market, "drops by" competing lock-makers
>to get them to tow the line, and then restricts "non-escrowed" locks from
>being exported.
Almost fair enough but not quite. The NAA orders thousands of said locks for
their own needs (the "artificially create a market" is an imputation),
offers to give competing lock makers the right to use the NAA lock design if
they adhere to the key safeguards, and continues their existing policy that
most locks cannot be exported. However, recognizing that some may wish to
use the NAA lock overseas, they offer to permit export of those locks if the
keys are escrowed.
>
>Add to this the fact that they can open your lock, poke around and take
>whatever they want without your knowledge. If your rights are violated,
>you may not even know to complain.
They can do that now for those who don't use locks, or perhaps use competing
locks. On the other hand, with the NAA lock, the burglars can no longer do
that. Thus it is a step forward for those who wish to buy the NAA lock, and
for those who prefer to take their chances with competing locks or none at
all, they are free to do so.
>Now you have a reasonably close analogy.
Russell Nelson
I would definitely include a layer of encryption on top of any
required Clipper-type encryption to insure security for my
customers.
Don't count on being able to do that. They'll only sell you clipper
chips for approved applications. Capstone chips might be easier to
double-encrypt, but clipper *will* be a pain; count on that.
--
-russ <nel...@crynwr.com> ftp.msen.com:pub/vendor/crynwr/crynwr.wav
Crynwr Software | Crynwr Software sells packet driver support | ask4 PGP key
11 Grant St. | +1 315 268 1925 (9201 FAX) | Quakers do it in the light
Potsdam, NY 13676 | LPF member - ask me about the harm software patents do.
Alexandra Griffin
Russell Nelson <nel...@crynwr.crynwr.com> wrote:
> [pre-encrypting data before Clipper]
>
>Don't count on being able to do that. They'll only sell you clipper
>chips for approved applications. Capstone chips might be easier to
>double-encrypt, but clipper *will* be a pain; count on that.
If the Clipper chip is being used in a phone, couldn't someone build a gizmo
to connect in-line with the phone handset and encrypt/decrypt the data at
that point? They can't very well ban detachable phone handsets! I guess
the extra analog-digital-analog conversion would be a hassle, though-- in
particular it would be problematic to convert the pre-encrypted data back to
analog form to send to the phone, since it would no longer really be an audio
signal and would thus undergo distortion in the phone's front-end section (and
with most encryption schemes one flipped bit means the whole transmission
becomes unusable). Still, maybe possible in theory?
--
______
\ / //////////////////////////////////////////////
\ / / Alexandra Griffin /// a...@kzin.cen.ufl.edu /
\/ //////////////////////////////////////////////
Alain Simon
: Not quite true. There are encryption techniques which are mathematically
: unbreakable. I can think of two:
: 1) The "one time pad", where each individual character is encrypted by a
: random key, and the decrypter has a caopy of the entire key. The
: disadvantage is that the key has to be as long as the message, so
: exchanging keys can be cumbersome.
there are ways to manage one-time pads which are practical
without weakening the system's strength.
: 2) So-called "quantum encryption," where the encryption is carried out
: via exchange of paired photons. Anybody intercepting either (or both)
: streams of photons collapses the wavepackets, and ruining the encryption
: for the receiver, making it obvious that the stream has been intercepted
: (and allowing the two parties to discontinue their communication). The
: disadvantage is that nobody has ever built a practical device to do this--
: they exist in theory only (though the relevant physical principles have
: been amply demonstrated in the lab).
I would not hold my breath for a practical application
(out of the lab) and I would not trust my secrets to
something so thoroughly misunderstood as quantum mech.
At the risk of repeating myself (and others), steganography makes all
of the above soul searching moot.
Matthew Holiday
-> In article <netnewsC...@netcom.com>, Plaz <pl...@netcom.com> wrote:
-> >In article <strnlghtC...@netcom.com> David Sternlight,
-> >strn...@netcom.com writes:
-> >> In article <940315.075449.2...@dvss.uucp>,
-> >> Jay Troy <dvss!jt...@udel.edu> wrote:
-> >>
-> >>
-> >> >Clipper is like the government requiring a key to the
-> >> >lock on the front door of my house.
-> >>
-> >> Actually, a better analogy would be that it's like the government's
-> >National
-> >> Antiburglary Agency developing a special lock which they say is secure
-> >> against burglars. They'll let you buy one, but only if the manufacturer
-> >> deposits your key in two separately-unusable pieces in two escrow
-> >agencies,
-> >> in case the police get a search warrant.
-> >
-> >And then the NAA (National Antiburglary Agency) orders thousands of said
-> >locks to artificially create a market, "drops by" competing lock-makers
-> >to get them to tow the line, and then restricts "non-escrowed" locks from
-> >being exported.
->
-> Almost fair enough but not quite. The NAA orders thousands of said locks for
-> their own needs (the "artificially create a market" is an imputation),
-> offers to give competing lock makers the right to use the NAA lock design if
-> they adhere to the key safeguards, and continues their existing policy that
-> most locks cannot be exported. However, recognizing that some may wish to
-> use the NAA lock overseas, they offer to permit export of those locks if the
-> keys are escrowed.
->
-> >
-> >Add to this the fact that they can open your lock, poke around and take
-> >whatever they want without your knowledge. If your rights are violated,
-> >you may not even know to complain.
->
-> They can do that now for those who don't use locks, or perhaps use competing
-> locks. On the other hand, with the NAA lock, the burglars can no longer do
-> that. Thus it is a step forward for those who wish to buy the NAA lock, and
-> for those who prefer to take their chances with competing locks or none at
-> all, they are free to do so.
->
-> >Now you have a reasonably close analogy.
You left out the little detail whereby the new lock design requires the use of a
hasp that only allows the NAA lock to be used. A niggling detail, so I've been
told. :-)
I think I like the Benjamin Franklin quote I've seen recently in a signature:
``Those who sacrifices freedom for security deserve neither.''
--
Matt Holiday #include <std/disclaimer>
hol...@bnr.ca
BNR Richardson, TX "Proud owner of an unregistered computer"
David Sternlight
Matthew Holiday <hol...@bnr.ca> wrote:
>
>You left out the little detail whereby the new lock design requires the use of a
>hasp that only allows the NAA lock to be used. A niggling detail, so I've been
>told. :-)
There's no requirement for such a hasp unless one wishes to put a lock on
one's door to the government.
C. D. Tavares
> >You left out the little detail whereby the new lock design requires the use of a
> >hasp that only allows the NAA lock to be used. A niggling detail, so I've been
> >told. :-)
> There's no requirement for such a hasp unless one wishes to put a lock on
> one's door to the government.
My, my. Now who would even consider needing one of those.
"B.A.T... I mean, Candygram!"
--
c...@rocket.sw.stratus.com --If you believe that I speak for my company,
OR c...@vos.stratus.com write today for my special Investors' Packet...
Robert Krawitz
In article <940315.075449.2...@dvss.uucp>,
Jay Troy <dvss!jt...@udel.edu> wrote:
>Clipper is like the government requiring a key to the
>lock on the front door of my house.
Actually, a better analogy would be that it's like the government's National
Antiburglary Agency developing a special lock which they say is secure
against burglars. They'll let you buy one, but only if the manufacturer
deposits your key in two separately-unusable pieces in two escrow agencies,
in case the police get a search warrant.
Actually, that's not a bad analogy. Don't tell me you'd actually go for
such a harebrained scheme, though.
There'd also have to be the proviso that the workings of the lock were
classified, that all applications of the lock would have to be reviewed
to prohibit people from using other locks, and so forth...
--
Robert Krawitz <r...@think.com> OS/IO Software Engineer (617)234-2116
Thinking Machines Corp. 245 First St. Cambridge, MA 02142
Member of the League for Programming Freedom -- mail l...@uunet.uu.net
Tall Clubs International -- tci-r...@think.com or 1-800-521-2512
Alain Simon
: >Clipper is like the government requiring a key to the
: >lock on the front door of my house.
: Actually, a better analogy would be that it's like the government's National
: Antiburglary Agency developing a special lock which they say is secure
: against burglars. They'll let you buy one, but only if the manufacturer
: deposits your key in two separately-unusable pieces in two escrow agencies,
: in case the police get a search warrant.
by your standards, the right to remain silent should
be waved because it gets in the way of investigations.
by your standards, my thoughts belong to the state, if
only to insure that I don't plan some monstrous crime.
by your standards, we are all drones in the android
hive... is that the world you want to live in?
Mark O. Wilson
|In article <940315.075449.2...@dvss.uucp>,
|Jay Troy <dvss!jt...@udel.edu> wrote:
|>Clipper is like the government requiring a key to the
|>lock on the front door of my house.
|Actually, a better analogy would be that it's like the government's National
|Antiburglary Agency developing a special lock which they say is secure
|against burglars. They'll let you buy one, but only if the manufacturer
|deposits your key in two separately-unusable pieces in two escrow agencies,
|in case the police get a search warrant.
And the trick is that we are suppossed to trust the government not to use
those keys unless they get a search warrant. Not to make copies of the keys
while they have a search warrant, and to return the keys when they are done.
Yeah right.
--
Mob rule isn't any prettier merely because the mob calls itself a government
It ain't charity if you are using someone else's money.
Wilson's theory of relativity: If you go back far enough, we're all related.
Mark....@AtlantaGA.NCR.com
David Sternlight
Mark O. Wilson <mwi...@ncratl.AtlantaGA.NCR.COM> wrote:
>In <strnlghtC...@netcom.com> strn...@netcom.com (David Sternlight) writes:
>
>|Jay Troy <dvss!jt...@udel.edu> wrote:
>
>
>|>Clipper is like the government requiring a key to the
>|>lock on the front door of my house.
>
>|Actually, a better analogy would be that it's like the government's National
>|Antiburglary Agency developing a special lock which they say is secure
>|against burglars. They'll let you buy one, but only if the manufacturer
>|deposits your key in two separately-unusable pieces in two escrow agencies,
>|in case the police get a search warrant.
>
>those keys unless they get a search warrant. Not to make copies of the keys
>while they have a search warrant, and to return the keys when they are done.
Exactly. And there are a number of safeguards built in, including that the
two parts of the key cannot be combined to make the real key, but must be
put in a black box which actually opens the lock, and which destroys the
keys after the search warrant expires. That several people have to sign to
get the keys. That the black box is closely controlled.
It's not perfect, but then, you don't have to use the NAA's lock if you
don't trust the above conditions--you can still go on using no lock at all,
or one that's been beaten by some burglars. Or you could go out and buy a
Medeco lock for the same price as the NAA one. The government won't say if
the FBI can pick the Medeco lock or not, but Medeco says it's "pretty good",
and so do those locksmiths who don't have access to the FBI's lock picking
technology.
David
Alain Simon
: against burglars. They'll let you buy one, but only if the manufacturer
: deposits your key in two separately-unusable pieces in two escrow agencies,
: in case the police get a search warrant.
:
: Actually, that's not a bad analogy. Don't tell me you'd actually go for
: such a harebrained scheme, though.
: There'd also have to be the proviso that the workings of the lock were
: classified, that all applications of the lock would have to be reviewed
: to prohibit people from using other locks, and so forth...
From everything the poster in question has written so far,
it seems that he is willing to throw away everybody's freedom
in order to have some illusion of safety for himself.
Peter da Silva
David Sternlight <da...@sternlight.com> wrote:
> It's not perfect, but then, you don't have to use the NAA's lock if you
> don't trust the above conditions--you can still go on using no lock at all,
> or one that's been beaten by some burglars. Or you could go out and buy a
> Medeco lock for the same price as the NAA one. The government won't say if
> the FBI can pick the Medeco lock or not, but Medeco says it's "pretty good",
> and so do those locksmiths who don't have access to the FBI's lock picking
> technology.
And the NAA is saying the Medeco lock is illegal, and implies they can open
it, and won't let Medeco sell it outside your town, and you have to build it
from a kit because Medeco can't make money selling completed locks in your
town only, so everyone who goes down and buys their locks from the hardware
store gets the NAA lock and only the locksmithing hobbyists are safe.
--
Peter da Silva `-_-'
Network Management Technology Incorporated 'U`
1601 Industrial Blvd. Sugar Land, TX 77478 USA
+1 713 274 5180 "Hast Du heute schon Deinen Wolf umarmt?"
David Lesher
>Or you could go out and buy a
>Medeco lock for the same price as the NAA one. The government won't say if
>the FBI can pick the Medeco lock or not, but Medeco says it's "pretty good",
>and so do those locksmiths who don't have access to the FBI's lock picking
>technology.
But they do have full and open access to the Medeco design. You can
examine and inspect it. Further, there is a large body of literature
and experience on Medeco locks. They are not "pick-proof" any more than
ballistic glass is "bullet-proof". But both buy you LOTS of time
& safety.
But as I said in alt.locksmithing, if you are prepared to _personally
demonstrate_ your ability to open a USG keyway Medeco, I'll be happy to
put you in touch with folks who will want to see you perform.
--
A host is a host from coast to coast.................wb8foz@nrk.com
& no one will talk to a host that's close...........(v)301 56 LINUX
Unless the host (that isn't close)....kibo# 777............pob 1433
is busy, hung or dead..............vr....................20915-1433
David Sternlight
Hardly. If you want to remain silent, just don't use Clipper, or use
something else.
The rest is rather overblown, eh?
David
Gregory Stewart-Nicholls
da...@sternlight.com "David Sternlight" writes:
I'd rather buy a lock that has to be blown open by experts spending time
and money to do it, than a lock that Buford T Justice can open with a stroke
of his pen.
--
Vidi | Gregory Stewart-Nicholls
Vici | ni...@olympus.demon.co.uk
Veni | TeknoLogika ltd
Doug Sewell
: In article <CMtyI...@rco.qc.ca>, Alain Simon <al...@interax.net> wrote:
: > From everything the poster in question has written so far,
: > it seems that he is willing to throw away everybody's freedom
: > in order to have some illusion of safety for himself.
: What nonsense! Since Clipper is voluntary and other systems aren't
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
: proscribed, nobody is throwing away anybody else's freedom. In truth it's
^^^^^^^^^^
How long do you expect this state of affairs to last ????
--
Doug Sewell (do...@cc.ysu.edu, do...@ysub.bitnet)
Meetings are indispensable when you don't want to do something.
-- John Kenneth Galbraith
Snowhare
: In article <763997...@olympus.demon.co.uk>,
: Gregory Stewart-Nicholls <ni...@olympus.demon.co.uk> wrote:
: > I'd rather buy a lock that has to be blown open by experts spending time
: >and money to do it, than a lock that Buford T Justice can open with a stroke
: >of his pen.
: Actually, the lock you'd rather buy can be opened by experts with their new
: Z-ray. Nobody knows how long it will take them, but when they do, they can
: enter you house and leave, closing the lock behind them, without a trace.
Now that is a downright misleading statement. Clipper has a guarenteed
"backdoor": the escrow. Completely independent of *any* mathematical tricks.
And Clipper cannot even be analysed to find out if there are any
mathematical backdoors due to "national security". (What an abused phrase
"national security" is).
I (and others) have already shown that there *ARE* guarenteed unbreakable
codes. It is not a matter of applying more computer power or magic z-rays.
If *I* encrypt something and want it ultimately secure: it will be.
Even for the mathematically weaker schemes, such as RSA, despite well
over a decade of analysis no one has found any loopholes or mysterious
mathematical symmetries hidden away for the would be cracker to exploit.
It still depends on the mathematical difficulty of factoring out two
large prime numbers. And I can make it secure to a *known* degree just
by increasing my key length.
Oh - I'm sorry: I misread your statement. You meant CLIPPER is the one
where "they can enter you house and leave, closing the lock behind them,
without a trace."
Correcto-mundo.
--
Benjamin Franz
David Lesher
> ...... and right away, since apparently the bill has now been introduced.
Sigh,
UnProfessor {again} LEAPS to conclusions on subjects he knows little
about.....
I was in Dirkson 226 for that hearing, as was Jerry Berman (as a
witness), other EFF staffers, David Banister and a FULL HOUSE of
interested press and public observers.
[Here's my best no-notes recollection of what was said. If you want
exact transcripts, call the Hill, cuz I do not claim these remarks
are..]
NO legislation has been introduced. Freeh read his part of his prepared
speech, but the panel cut him off and started asking THEIR questions.
Sen. Spectre asked several piercing questions, as did Leahy.
Freeh backpeddled at Warp 2 on the $10,000/day penality, when the panel
took him to task. I'm glad I was not sitting behind him ;-}
Freeh claimed that 91 taps had been foiled in the last year. Industry
introduced the CPSR FOIA response that showed none. (Freeh had left by
then, so the Senators never got an answer as to that one...) Freeh also
made general insinuations that wire tapping had been vital "in a recent
esponiage case" but gave no specifics. (For those out of touch with
recent Beltway politics, the game is to somehow work "Ames" into any
topic. Increase in first-class postage? Gotta repaint that chalked
mailbox, etc..)
It was clear that several of the Senators were very concerned about the
FBI effectively telling industry how they can build switches. Leahy
made _pointed_ remarks about how USG communications (military and White
House being the best examples) lag industry by 2 decades. And as he put
it, if Justice can't keep its top slots full -- who's going to decide
on switch feature packages?
There was vast disagreement about the cost. Freeh said he thought that
~$500M will fix all. Industry said ~1.2Bil _just_ to do what the
Feebes' want with call-forwarding. They also pointed out the ongoing
cost of having 24hr on-call personnel at every Vermont One-town Telco
to meet the FBI demands. (They, ahhem, also complained about getting
the Feeb's to pay outstanding past-due bills ;-}
The finger-pointing was illuminating. Freeh claimed that industry, at
the Quantico meets, was saying that they can't meet the FBI's demands.
Thus the (proposed bill) was their fault. Industry said "Get the FBI
to write down _exactly WHAT_ they want that is new and different --
WE can't!"
It was clear there will LOTS more work before ANYTHING is marked up.
========================
I do urge each of you to write to your House member and both Senators
and let them know how you feel. They may not read each letter,
but you can be sure their staff will. There's enough public fat
in this fire to make smoke. Add yours.
David Sternlight
Gregory Stewart-Nicholls <ni...@olympus.demon.co.uk> wrote:
> I'd rather buy a lock that has to be blown open by experts spending time
>and money to do it, than a lock that Buford T Justice can open with a stroke
>of his pen.
Actually, the lock you'd rather buy can be opened by experts with their new
Z-ray. Nobody knows how long it will take them, but when they do, they can
enter you house and leave, closing the lock behind them, without a trace.
David
Gregory Stewart-Nicholls
> In article <763997...@olympus.demon.co.uk>,
> Gregory Stewart-Nicholls <ni...@olympus.demon.co.uk> wrote:
>
> > I'd rather buy a lock that has to be blown open by experts spending time
> >and money to do it, than a lock that Buford T Justice can open with a stroke
> >of his pen.
>
> Actually, the lock you'd rather buy can be opened by experts with their new
> Z-ray. Nobody knows how long it will take them, but when they do, they can
> enter you house and leave, closing the lock behind them, without a trace.
>
Perhaps, however it's certainly going to take longer that sheriff Justice's
pen. In the event that it doesn't, I'm really no worse off, am I ???
You're comparing one worst case scenario, with a certainty. For better or
worse, I'll risk the Z-ray.
Alain Simon
I have added can.politics to the already long list of X-posted
groups. Recent events in Canada lead me to believe that our
government has finally realized what information superhighway
means for law enforcement and political control.
Now, the meat:
In article <strnlghtC...@netcom.com>,
strn...@netcom.com (David Sternlight) tries to put a stop to my
lyricism:
> In article <CMsHM...@rco.qc.ca>, Alain Simon <al...@interax.net> wrote:
> > by your standards, the right to remain silent should
> > be waved because it gets in the way of investigations.
> > by your standards, my thoughts belong to the state, if
> > only to insure that I don't plan some monstrous crime.
> > by your standards, we are all drones in the android
> > hive... is that the world you want to live in?
> Hardly. If you want to remain silent, just don't use Clipper, or use
> something else. The rest is rather overblown, eh?
True, I could abstain from using Clipper. But what you don't say
here is that I would not be allowed to use anything else instead.
And the argument (from you, Denning et all) is law and order and
national security.
Without this little piece of information, my stand does sound a bit
overblown. Talking of which, somebody else thought so as well and
e-mailed me a rather stinging rebuke, pointing out that I was not
really answering to Mr Sternlight's position. Here is my side of
this particular exchange, slightly edited, in lieu of response:
My sloppy debating is certainly to be regretted. However,
in the great David Sternlight debate, style and rules of
engagement went out the window at the word go.
Arguments, and point by point refutations have been presented
in vain to Mr Sternlight (and a few other) and to the members of
the US Administration we could reach. It appears that we are
pissing in a violin to make music: their reasons for wanting
such devices as Clipper and Key Escrow has nothing to do with
reason, it has to do with politics for some, with fears for most.
Marxists thought they could build the perfect economy if only
they could control all parameters. Reality intruded into their
dream: it is impossible to know all parameters, far less control
them. Likewise, there are those who would build the perfect
society (Marxists tried that too, we know what happened) by
making sure nothing can happen that was not planned by the State.
Within such mind set, it is very likely that the idea of thought
itself becomes scary to those who would do the controlling.
Autonomous, independant thinking is the first thing targeted
by tyrannies. Free will and opinion, the thing politicians
fear most. I can't reproach law enforcement for wanting all
the help they can get. I blame politicians for having an agenda
when they propose to give in to the demands. If Mr Sternlight's
(I don't know what, if any of these groups he belongs to) finds
that having peace and order justifies such things, who will draw
the line for him, and where? My response was addressing his
point very well, albeit not at the expected level.
I am afraid it's not Queensburry Rules anymore, and the gloves
are off.
The technical aspects of these proposals have been shown to be
so weak as to be laughable; their only strength is in *who* is
supporting them. I will not repeat the thread here.
The social implications are scary. They are in line with the
normal evolution of societies in that people (specially those
who did not study history) are too often willing to trade some
illusion of safety for a bit of very fragile liberty. It is
natural and it keeps happening. Today, people are willing
to give up on their freedom of speech in order to gain feeble
protection from verbal abuses (Polical Correctness).
By default, things like Key Escrow will happen, with or without
a push from the FBI or an endorsement by demagogues. Let's not
default on this duty to ourselves.
End of excerpt.
Just a question: what will steganography do to the Clipper chip
and Key Escrow issues?
> David
--
Virtually me, really...
David Sternlight
Snowhare <snow...@netcom.com> wrote:
>David Sternlight (strn...@netcom.com) wrote:
>: In article <763997...@olympus.demon.co.uk>,
>: Gregory Stewart-Nicholls <ni...@olympus.demon.co.uk> wrote:
>
>: > I'd rather buy a lock that has to be blown open by experts spending time
>: >and money to do it, than a lock that Buford T Justice can open with a stroke
>: >of his pen.
>
>: Actually, the lock you'd rather buy can be opened by experts with their new
>: Z-ray. Nobody knows how long it will take them, but when they do, they can
>: enter you house and leave, closing the lock behind them, without a trace.
>
>Now that is a downright misleading statement. Clipper has a guarenteed
>"backdoor": the escrow. Completely independent of *any* mathematical tricks.
>And Clipper cannot even be analysed to find out if there are any
>mathematical backdoors due to "national security". (What an abused phrase
>"national security" is).
>
>I (and others) have already shown that there *ARE* guarenteed unbreakable
>codes. It is not a matter of applying more computer power or magic z-rays.
>If *I* encrypt something and want it ultimately secure: it will be.
That's false, except for one-time pads. It's just a matter of time before
PGP or Ripem can be cracked by brute force. The issue is how long, and the
answer to that question depends on whether one has the money to buy multiple
parallel processor power (thousands or more of parallel processors in the
machine) at cutting edge speeds, or whether one is thinking of a
single-processor workstation. There have been quite a few posts here showing
the calculations for a single processor case at various commonly-used key
lengths. What's more, we don't know if there's been some classified
breakthrough in directly attacking DES, TDES, or IDEA.
Even one-time pads aren't "guaranteed unbreakable"--there's always
"practical cryptanalysis".
But we were talking about locks. :-)
David Sternlight
Gregory Stewart-Nicholls <ni...@olympus.demon.co.uk> wrote:
> You're comparing one worst case scenario, with a certainty. For better or
>worse, I'll risk the Z-ray.
That's the crux of the individual decision. Some will risk the Z-ray and use
Pretty Good Locks (PGL), and others will not. In part it depends on the
value of the contents of your house to the government, vs. the value of the
contents of your house to bad guys who might have a Z-ray of their own.
David L Evens
: In article <2m7omo$d...@crchh327.bnr.ca>,
: Matthew Holiday <hol...@bnr.ca> wrote:
: >
: >You left out the little detail whereby the new lock design requires the use of a
: >hasp that only allows the NAA lock to be used. A niggling detail, so I've been
: >told. :-)
: There's no requirement for such a hasp unless one wishes to put a lock on
: one's door to the government.
Would you care to say that again without dangling any participals so the
we can tell what the hell you mean?
: --
Robert Krawitz
That's false, except for one-time pads. It's just a matter of time before
PGP or Ripem can be cracked by brute force. The issue is how long, and the
answer to that question depends on whether one has the money to buy multiple
parallel processor power (thousands or more of parallel processors in the
machine) at cutting edge speeds, or whether one is thinking of a
single-processor workstation. There have been quite a few posts here showing
the calculations for a single processor case at various commonly-used key
lengths. What's more, we don't know if there's been some classified
breakthrough in directly attacking DES, TDES, or IDEA.
Oh, for heaven's sakes. Of course PGP and Ripem can be cracked by brute
force. So can DES and ROT13. Of course the issue is how long it takes.
Parallel processing can give you linear speedup over a single processor.
Barring certain special effects (e. g. paging), it cannot give you more.
A good parallel machine can certainly do better than a simple cluster of
workstations in many cases, since the network is much faster and has
much lower latency, but even so it still takes longer to fetch data over
the network than it does to reference data from local memory (not that
that necessarily matters for brute force crypto attacks, which are often
embarrassingly parallel -- no communication whatsoever -- or so close to
it that you could use snail mail for the communication and it wouldn't
matter). The key length for PGP and Ripem can also be increased, with
the result that the time required to break the encryption, by any
publicly known techniques, increases exponentially. That's a huge
increase.
Perhaps there has been a classified breakthrough in attacking IDEA or
what have you. So what? Maybe Skipjack has some other back door that
the NSA isn't telling us about. IDEA has undergone a lot more public
review than Skipjack has -- five people working for a few months cannot
match the network community working for years.
Even one-time pads aren't "guaranteed unbreakable"--there's always
"practical cryptanalysis".
One time pads are guaranteed unbreakable if the OTP is truly random --
e. g. generated by quantum processes -- and if the pad does not fall
into enemy hands. Better yet, if someone ever produces a workable
quantum encryption device, that will be GUARANTEED unbreakable, since
any tap on the line can be detected.
BTW, you have just hoisted your self by your own petard with your
comment about "practical cryptanalysis". That alone is a monumental
weakness in the entire Clipper system -- buying someone in each escrow
house should be relatively cheap, perhaps cheaper than a low-end
parallel processor.
David Sternlight
> From everything the poster in question has written so far,
> it seems that he is willing to throw away everybody's freedom
> in order to have some illusion of safety for himself.
What nonsense! Since Clipper is voluntary and other systems aren't
proscribed, nobody is throwing away anybody else's freedom. In truth it's
the anti-Clipper crowd who want to deprive the pro-Clipper types of THEIR
freedom to use it by trying to get it withdrawn.
David Sternlight
they quoted Freeh as saying something to the effect that if they don't get
it, it will be a big blow against stopping crime, while the phone companies
oppose it as an invasion of privacy and raising people's phone bills.
This one is going to require a lot of work with Congress, and right away,
since apparently the bill has now been introduced.
David
Peter da Silva
> proscribed,
Um, David, other systems *are* proscribed. You can sell them, you just
can't sell them outside the US. This makes them also useless for anyone
doing business across the US border.
Matthew Holiday
-> Matthew Holiday <hol...@bnr.ca> wrote:
-> >
-> >You left out the little detail whereby the new lock design requires the use of a
-> >hasp that only allows the NAA lock to be used. A niggling detail, so I've been
-> >told. :-)
->
-> There's no requirement for such a hasp unless one wishes to put a lock on
-> one's door to the government.
Precisely. Given the character of government in these latter days, I'd say most
people would prefer to lock that particular door.
Arthur Bernard Byrne
After suitible remix...
In article <alain-190...@maximon.rco.qc.ca>,
Alain Simon <al...@interax.net> wrote:
>In article <strnlghtC...@netcom.com>, strn...@netcom.com
>(David Sternlight) tries to put a stop to my lyricism:
>> In article <CMsHM...@rco.qc.ca>, Alain Simon <al...@interax.net> wrote:
>> >by your standards, the right to remain silent should
>> >be waved because it gets in the way of investigations.
>> >by your standards, my thoughts belong to the state, if
>> >only to insure that I don't plan some monstrous crime.
>> >by your standards, we are all drones in the android
>> >hive... is that the world you want to live in?
>
>> Hardly. If you want to remain silent, just don't use Clipper, or use
>> something else. The rest is rather overblown, eh?
>
>True, I could abstain from using Clipper. But what you don't say
>here is that I would not be allowed to use anything else instead.
This is an assumption about what government policy may become.
IMHO, a fairly cautious assumption, but by not making this explicit, you
make yourself look foolish, and leave yourself open to easy rebuttal.
AB^2
--
--------------------------------------------------------------------------
"You can have my encryption algorithm... when you pry my cold dead fingers
from its private key." -John Barlow, "Decrypting the Puzzle Palace"
David Sternlight
Black Unicorn <uni...@access.digex.net> wrote:
>
>My advice is to get to Sen. Leahy, Sen. Specter, they seem to be
>anti-DT for the most part.
>
>The strongest arguements seemed to be in the realm of
>
>1> Holding back technology until the FBI was ready to deal with it
>when technology is one of the US's strongest fronts of international
>markets.
>
>2> Cost figures (FBI says 200-500 Million, off by as much as 500
>million, telco's say 1.8 billion just to fix a small portion of
>the problems FBI is complaining about with regard to Call
>Forwarding.)
I want to associate myself with the writer's suggestions.
We're finally getting to the bottom of this--the FBI has trouble with call
forwarded calls even with a wiretap order, and they want the rest of us to
pay for fixing it. For what it will cost to do so, based on the number of
wiretaps they get each year, they could assign 20 people with parabolic
mikes to every suspect and still have enough left over to run a lot of
present Federal, State and Local law enforcement. $1.8 billion isn't chopped
liver, and they want the phone users, in the end, to pay for it.
As a matter of simple truth and honesty in government, let 'em put up a bill
in Congress for a $1.8 billion appropriation for this purpose and see how
far they get.
In fact, even if Congress were willing to appropriate such funds, first the
FBI would have to make a showing that they'd save at least $1.8 billion in
crime costs due to this additional capability alone.
I wonder how much new law enforcement technology (not involving putting
equipment in people's phone companies) $1.8 billion would buy? How many new
prisons? How many extra police on the streets? I wonder what the benefits of
those measures would be compared to the FBI proposal.
By the way, given the massively well documented evidence of government cost
estimates vs. final costs, even if the FBI honestly believes it's $300
million as an estimate, the phone companies are probably right about the
$1.8 billion. But they also often underestimate, so it's probably even more.
No, they haven't thought this one through, or if they have, they're a long
way from presenting a convincing argument.