Devil's Advocate (again)

I notice the argument against "why do you need crypto... are you
doing something ILLEGAL" is that the argument that "why don't you
want a camera in your house... are you doing something ILLEGAL".

This is good, but where in the Constitution does it say that people
can have crypto not regulated by the Government?  Would this be
under the First Amendment of free speech?

Again, I am playing Devil's Advocate here.


------------
To respond to the sender of this message, send mail to
remailer@soda.berkeley.edu, starting your message with
the following 8 lines:
::
Response-Key: ideaclipper

====Encrypted-Sender-Begin====
MI@```%IS^P;+]AB?X9TW6\8WR:"P&2%))6DK&_"'9H7Z#TP^%/-Q).;<[88Q
ME30D:-V2"G!=KV&$CCA?;+(6+E.#?2%P`0:V-J'.#NA:J^2@,\;GUI)DG5,O
%CR6`-HX`
====Encrypted-Sender-End====

Anonymous User says:
> I notice the argument against "why do you need crypto... are you
> doing something ILLEGAL" is that the argument that "why don't you
> want a camera in your house... are you doing something ILLEGAL".
> 
> This is good, but where in the Constitution does it say that people
> can have crypto not regulated by the Government?  Would this be
> under the First Amendment of free speech?
> 
> Again, I am playing Devil's Advocate here.

The first amendment is a good start.
The fourth amendment protections against unreasonable search could be
held to not require that everyone conduct all their business in such a
way as to make search maximally easy. (The courts have already held,
for instance, that you are under no obligation to keep your business
records in english.)
The ninth amendment, and the derived "right to privacy" ideas that
culminated in Roe v. Wade, could also be invoked.

.pm

On Fri, 1 Jul 1994, Perry E. Metzger wrote:

> The ninth amendment, and the derived "right to privacy" ideas that
> culminated in Roe v. Wade, could also be invoked.
> 
> .pm
> 

Additionally, since properly executed crypto can only be breached by the 
application of torture to the key holder, The VIIIth Amendment's 
prohibition of cruel and unusual punishment may apply.

DCF

"Not to mention the IInd Amendment RKBA and in the case of the Digital 
Telephony Initiative the IIIrd Amenment's prohibition on quartering 
troops in private homes."

DCF wrote:

| Additionally, since properly executed crypto can only be breached by the 
| application of torture to the key holder, The VIIIth Amendment's 
| prohibition of cruel and unusual punishment may apply.

There are a number of good ways to breach modern cryptography without
torture.  They include:

Van Eck (Tempest) monitoring.
Sodium pentathol & its more modern cousins.
Bribery.
Blackmail.


Adam

-- 
Adam Shostack 				       adam@bwh.harvard.edu

Politics.  From the greek "poly," meaning many, and ticks, a small,
annoying bloodsucker.

> 
> There are a number of good ways to breach modern cryptography without
> torture.  They include:
> 
> Van Eck (Tempest) monitoring.
> Sodium pentathol & its more modern cousins.
>
I believe this is considered torture in the US.

Bribery.
> Blackmail.
>
Both of these are great but any evidence is inadmissable in court and 
therefore of no use to a prosecutor.
> -- 
> Adam Shostack 				       adam@bwh.harvard.edu

Jim choate <ravage@bga.com>:

> Both of these are great but any evidence is inadmissable in court and 
> therefore of no use to a prosecutor.

"Your honor, we would like a (search warrant)(wiretap order)(arrest
warrant) for XXX based on the following information we received from a
confidential informant."

C'punks,

Let's keep our eyes on the prize.  Courts will do what courts will do.  
Maybe someone will shoot us up with sodium pentathal, maybe not.  The 
real point of Cypherpunks is that it's better to use strong crypto than 
weak crypto or no crypto at all.  Our use of crypto doesn't have to be 
totally bullet proof to be of value.  Let *them* worry about the 
technicalities while we make sure they have to work harder and pay more 
for our encrypted info than they would if it were in plaintext.


 S a n d y

On Fri, 1 Jul 1994, Jim choate wrote:

> > There are a number of good ways to breach modern cryptography without
> > torture.  They include:
> > 
> > Van Eck (Tempest) monitoring.
> > Sodium pentathol & its more modern cousins.
> >
> I believe this is considered torture in the US.
> 
> > Bribery.
> > Blackmail.
>
> Both of these are great but any evidence is inadmissable in court and 
> therefore of no use to a prosecutor.

	Do you think the NSA cares either about the majority of US laws 
or the admissibility of evidence? If they want your key badly enough, 
they will get it, and in all probability will have no compunctions 
against any of those methods.

--------------------------------------------------------------------------
Michael Brandt Handler                                <grendel@netaxs.com> 
Philadelphia, PA                                    <mh7p+@andrew.cmu.edu>
Currently at CMU, Pittsburgh, PA            PGP v2.6 public key on request
Boycott Canter & Siegel                <<NSA>> 1984: We're Behind Schedule

> 
> 	Do you think the NSA cares either about the majority of US laws 
> or the admissibility of evidence? If they want your key badly enough, 
> they will get it, and in all probability will have no compunctions 
> against any of those methods.
> 
> --------------------------------------------------------------------------
> Michael Brandt Handler                                <grendel@netaxs.com> 

True, but then again the NSA does not have a history of using torture and
violence againsta US citizens. They may be implicit in the sicking of other
more rabidly violent agents but violence is not in their best interest.

I am more worried about the local police department, state law agencies, and
traditional federal law enforcement. These are the folks who spend the majority
of their funding spending time watching individuals and their behaviour on a
regular basis. I really doubt the NSA is able to monitor single individuals
for long terms (the Puzzle Palace makes several references to their asking
other agencies for assisstance when this was needed because they didn't have
the resources). I don't think this historical pattern is broken at this 
point.

C'punks,

On Fri, 1 Jul 1994, Michael Handler wrote:

> . . . Do you think the NSA cares either about the majority of US laws 
> or the admissibility of evidence? 

Actually, yes, for two reasons:  First, they cannot overtly break the 
law.  Other groups of thugs such as the FBI, the justice system, etc. 
will take umbridge if their turf is invaded.  Second, though the NSA must 
have its share of evil people, they must also have their share of decent 
folks.  Decent folks would include whistleblowers who could blow the 
cover of the NSA's bad folks.  Hell, they might even use strong crypto 
routed through anonymous remailers!

> If they want your key badly enough, 
                        ^^^^^^^^^^^^ 
> they will get it, and in all probability will have no compunctions 
> against any of those methods.

All actions have costs.  How badly do they have to want it to risk 
exposure to public/legal scrutiny?  Even if they want it that much, must 
we assume they have no compunctions?  Calm down.  If the world were as 
lopsided as some of us seem to think, we would all be in jail or in the 
ground.  Perceptions of powerlessness result in paralysis.  Don't let the 
boogyman keep you from writing code.


 S a n d y

> There are a number of good ways to breach modern cryptography without
> torture.  They include:
> 
> Van Eck (Tempest) monitoring.
> Sodium pentathol & its more modern cousins.
> Bribery.
> Blackmail.


> Adam Shostack 				       adam@bwh.harvard.edu

Much more likely:

* Diskettes left lying around. Secret keys on home computers.

* Incompletely erased files. (Norton Utilities can recover erased
files; mil-grade multiple-pass erasure may be needed.)


A simple search warrant executed on your premises will usually crack
open all your crypto secrets. (Fixes to this are left as an exercise.)

Where to store one's secret key is an issue that makes academic the
issue of whether one's key can be compelled. A diskette stored at
one's home, in one's briefcase, etc., can be gotten. A pendant or
dongle or whatever that stores the key can also be gotten. The
passphrase (8-12 characters, typically) is secure, but not the key.

--Tim May


-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."

Excuse my ignorance of PGP, I am fairly new to using it, and thinking about
its operation and source code. Is not your secret key stored encoded by
the pass phrase, so that if the pass phrase is in your head, the secret
key on disk is useless to an attacker? Of course, while PGP is running,
after you have entered the pass phrase, the secret key is available within 
your machine, and could be stolen, and if your OS leaves pagefiles etc
arounnd, might even be taken after you shut down PGP.

Or am I missing something? Thanks, Andy

> 
> Excuse my ignorance of PGP, I am fairly new to using it, and thinking about
> its operation and source code. Is not your secret key stored encoded by
> the pass phrase, so that if the pass phrase is in your head, the secret
> key on disk is useless to an attacker? Of course, while PGP is running,
> after you have entered the pass phrase, the secret key is available within 
> your machine, and could be stolen, and if your OS leaves pagefiles etc
> arounnd, might even be taken after you shut down PGP.
> 
> Or am I missing something? Thanks, Andy

I haven't seen a formal analysis of the strength of PGP if the secret
key is known but the passphrase is still secure, but from conventional
crypto we would assume that the search space would be greatly reduced.
My passphrase, for example, is 11 characters long. Other folks may use
fewer characters. 

And many people pick passphrases of less total entropy (that is, more
predictable). Fragments of names, phrases, etc.

The number of passphrase guesses that would have to be made depends on
the characters used and the particular characters chose. For example,
if most people use 8 characters chosen from the 26 letters, in one
case, then 26^8 = 2 x 10e11 possibilities. Increasing this to, say, 40
characters and a length of 10 implies 4 x 10e17 possibilities, which
is almost out of reach for brute-force cracking.

(But most passphrases picked by humans have lower entropy than this.)

Speculatively, knowing the passphrase-encrypted secret key may make it
easier to crack RSA; this is just a speculation. It is not yet even
been proven that RSA is a strong as factoring. i.e., we don't know for
sure that the RSA information provided as part of the protocol doesn't
in some way make the problem simpler than straight factoring of the
modulus.

In short, these are reasons to keep your secret key secret. Your
passphrase alone may be insufficient (else why not just dispense with
the secret key and just have a passphrase?).

I haven't checked to see what Schneier or Zimmermann had to say about
this, so maybe they have more information.

--Tim May





-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."

[good discussion of how the pass phrase is more guessable 
 that the secret key deleted ]
>> In short, these are reasons to keep your secret key secret. Your
>> passphrase alone may be insufficient (else why not just dispense with
>> the secret key and just have a passphrase?).

Well, because the secret key is part of a <secret key, public key> pair,
and is thus some un-rememberable number, rather than a hash of something
rememberable.

Tim May writes:
>Speculatively, knowing the passphrase-encrypted secret key may make it
>easier to crack RSA; this is just a speculation. It is not yet even
>been proven that RSA is a strong as factoring. i.e., we don't know for
>sure that the RSA information provided as part of the protocol doesn't
>in some way make the problem simpler than straight factoring of the
>modulus.

Here is a little-known fact.  In fact, I had forgotten it myself until
what Tim said reminded me.  Your PGP secret key file is partially encrypted
using IDEA keyed with the hash of your pass phrase.  But some fields are
left in the clear.  In particular, the number of bits in p and q is left
exposed, as is the number of bits in d, the decryption exponent.

Now, this is not really a big deal.  Usually with a 1024-bit key p and
q will both be 512 bits long, so knowing this for sure doesn't add that
much information.  And I don't think that knowing the exact number of
bits in the factors will help with the factoring when the two factors are
about the same size.  Nevertheless it does represent an information leak
that many people may not be aware exists.

One way an attacker might exploit this is as follows.  Suppose he wants
to do an exhaustive search of pass phrases.  As Tim said, a lot of people
may have ones which are easy to guess.  How does he know when he's guessed
correctly?  The secret key has a checksum (in the clear).  After decrypting
all of d, p, q, and u, PGP accumulates a checksum as it does this and com-
pares it with the checksum stored in the secret key.  If they match, PGP
(or the cracker) knows that he has used the right pass phrase.

This requires decrypting all four of these numbers, a total of about
320 bytes.  But he can do a provisional check much faster by using the
in-the-clear lengths.  Just decrypting the first byte of each MP number
allows you to see immediately what the bit length of the resulting MP
value will be since they are stored in MSB form.  For the most extreme
case, suppose the length of p were one more than a multiple of 8, say
505 bits.  Now we decrypt the first part of p and see if the first byte
of the decryption is exactly 1.  If not, we can know immediately that we
have the wrong pass phrase and move on without doing any more IDEA op-
erations.  This will immediately reject 255 out of 256 wrong pass phrases.

I don't know how much of a speedup you would actually see from this; IDEA
has a setup phase and you still have to run MD5 on each pass phrase.
But possibly it could be significant.


Hal Finney
hfinney@shell.portal.com

-----BEGIN PGP SIGNED MESSAGE-----

In list.cypherpunks, Mssr. tcmay@netcom.com (Timothy C. May):

> In short, these are reasons to keep your secret key secret. Your
> passphrase alone may be insufficient (else why not just dispense with
> the secret key and just have a passphrase?).

Another reason for a secret key and passphrase... with a passphrase
alone, you couldn't change it without changing the public key too.
Since I stupidly typed my passphrase in the clear in front of someone
once, I was very glad the phrase was changeable! :)
- -- 
Roy M. Silvernail --  roy@sendai.cybrspc.mn.org
  perl -e '$x = 1/20; print "Just my \$$x! (adjusted for inflation)\n"'
        "What do you mean, you've never been to Alpha Centauri?"
                                               -- Prostetnic Vogon Jeltz

-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAwUBLhWpQhvikii9febJAQGNggP/eWj28ovHgb6y45TZA1OqAR6S/jCMgi0z
QqfB+TvpLbf6WZYVI1K44DiLgjAn2IWddSqWQ2lz3IuhyXMM4S8V5tFoGNWE+lUn
FG1hO4fjV1XUn+tJCqeeJdN77gd1+Nzszu8m8/Pq9eU+q+bcehTIaRCQNvrOC9D/
ZkEuSDYcBVY=
=/C3u
-----END PGP SIGNATURE-----

> 
> Additionally, since properly executed crypto can only be breached by the 
> application of torture to the key holder, The VIIIth Amendment's 
> prohibition of cruel and unusual punishment may apply.
>
How can sitting in jail cell under contempt of court charge for undetermined
periods be considered cruel or unusual punishment? Would seem to me that if
a person refuses to comply and reveal their keys they should expect some
form of legal retribution.

If a person were to sit there long enough I am shure they would crack if
for no other reason than family pressure and the sure realization that 
their homes and other possessions will be repossessed or otherwise lost.

On Fri, 1 Jul 1994, Duncan Frissell wrote:
> Additionally, since properly executed crypto can only be breached by the 
> application of torture to the key holder, The VIIIth Amendment's 
> prohibition of cruel and unusual punishment may apply.
This is not even slightly true.  They can say that if you don't show them 
your tax status, they sieze everyting you have.  This would require some 
random key.  This dosn't involve tourture, just tax.

Roger.

On Fri, 1 Jul 1994, Roger Bryner wrote:

> This is not even slightly true.  They can say that if you don't show them 
> your tax status, they sieze everyting you have.  This would require some 
> random key.  This dosn't involve tourture, just tax.
> 
> Roger.
> 

However, strong crypto can protect "everything you have" or at least cash 
and securities behind unbreachable walls.  Likewise it can protect 
ownership structures so that you can even control physical assets without 
governments being able to sieze them.

DCF

C'punks,

On Fri, 1 Jul 1994, Anonymous User wrote:

> . . . where in the Constitution does it say that people
> can have crypto not regulated by the Government?  Would this be
> under the First Amendment of free speech?

Try the 9th and 10th Amendments.


 S a n d y

::
Response-Key: ideaclipper

====Encrypted-Sender-Begin====
MI@```%IS^P;+]AB?X9TW6\8WR:"P&2%))6DK&_"'9H7Z#TP^%/-Q).;<[88Q
ME30D:-V2"G!=KV&$CCA?;+(6+E.#?2%P`0:V-J'.#NA:J^2@,\;GUI)DG5,O
%CR6`-HX`
====Encrypted-Sender-End====

The 1st ammendment guarantees freedom of speech.  This includes the right
to speak in any "language" you want.   Cryptography is a way of changing
the "language" of a text or binary file so that only the intended recipient
is able to understand it.  Hence, cyphertext is protected by the 1st ammendment.

Whether this will hold up in court....