Re: HP announcing some International Cryptography stuff on Monday

At 12:49 PM 11/15/96 -0800, Timothy C. May wrote:
>It sounds ominous to me. Another backroom deal, probably for some form of
>key recovery strategy, aka GAK.

I'd bet GAK too.  RSADSI has been working on GAK protocols, so these ones
might actually work.  I feel as pessimistic about this one as Lucky usually
is.

At 12:05 PM 11/15/96 -0800, John Gilmore wrote:
>Are they the next Big Company to knuckle under to the Feds?  Their
>pcmcia-with-local-country-surveillance-chip-socket initiative never
>seemed to go anywhere.

Since I am inherently optimistic, one ray of light may be that the San Jose
Mercury News was mentioning the ability to export the system, and then when
the necessary licenses (US and foreign) were obtained, turn on the
encryption.  I guess from this that the encryption is in hardware.  Now,
software/hardware interfaces are usually fairly simple, so what we have
here is a software system with a crypto hook.


-------------------------------------------------------------------------
Bill Frantz       | The lottery is a tax on    | Periwinkle -- Consulting
(408)356-8506     | those who can't do math.   | 16345 Englewood Ave.
frantz@netcom.com |       - Who 1st said this? | Los Gatos, CA 95032, USA

On Sun, 17 Nov 1996, Bill Frantz wrote:

> At 12:49 PM 11/15/96 -0800, Timothy C. May wrote:
> >It sounds ominous to me. Another backroom deal, probably for some form of
> >key recovery strategy, aka GAK.
> 
> I'd bet GAK too.  RSADSI has been working on GAK protocols, so these ones
> might actually work.  I feel as pessimistic about this one as Lucky usually
> is.

I have a hard time believing that Netscape caved. As I wrote in July, HP 
was working on selling our children's birthright to obtain an export 
license for their product. But Netscape participating in this just 
doesn't sound right.

> Since I am inherently optimistic, one ray of light may be that the San Jose
> Mercury News was mentioning the ability to export the system, and then when
> the necessary licenses (US and foreign) were obtained, turn on the
> encryption.  I guess from this that the encryption is in hardware.  Now,
> software/hardware interfaces are usually fairly simple, so what we have
> here is a software system with a crypto hook.

One possibility is that all crypto is done in hardware. The recent 
announcements by many hardware manufacturers that smartcard readers will 
be included in all their products (MS will put them into their keyboards) 
might get the necessary infrastructure deployed.

Of course, no crypto will work without the hardware token. The 
applications use signed code. Hardware tokens are only valid for a 
certain time. Making future mandatory upgrades to Fortezza, etc. a cinch.

--Lucky

On Sun, 17 Nov 1996, Lucky Green wrote:

> One possibility is that all crypto is done in hardware. The recent 
> announcements by many hardware manufacturers that smartcard readers will 
> be included in all their products (MS will put them into their keyboards) 
> might get the necessary infrastructure deployed.
> 
> Of course, no crypto will work without the hardware token. The 
> applications use signed code. Hardware tokens are only valid for a 
> certain time. Making future mandatory upgrades to Fortezza, etc. a cinch.
> 
> --Lucky

Ok... I want everybody to go buy a box of diskettes, and put copies of PGP
on them.  Then we'll save our boxes of PGP for when everything but GAK is
illegal, and the thought police are stealing hard drives.  BTW, I really
like that thermite on the HD thing. A possibly better idea could be
something that eats the platters.... little container of nitric acid.
Anyway.. that's off topic. 

If I'm understanding correctly, In the year 2000 (whatever) when we use
crypt(3) it's just a call to the NSAcryptoGAK chip on the board. and
that's supposed to be good enough for everyone.  What's next? A processor
that detects an unGAK'd software crypto program running and phones the NSA
or whoever?

One more thing... what's this about MD5 being broken... references,
webpages, whatever would be nice.

--
Chris Kuethe <ckuethe@gpu.srv.ualberta.ca> LPGV Electronics and Controls
http://www.ualberta.ca/~ckuethe/
http://www.dcs.ex.ac.uk/~aba/rsa/
RSA in 2 lines of PERL
print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<>
)]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

Timothy C. May wrote:
>
> At 6:44 PM -0800 11/17/96, Lucky Green wrote:
>
>> I have a hard time believing that Netscape caved. As I wrote in July,
>> HP was working on selling our children's birthright to obtain an
>> export license for their product. But Netscape participating in this
>> just doesn't sound right.
>
> Indeed, some comments from the usually-vocal Weinstein brothers would
> be most welcome.

Our position on hardware crypto is that if it has a PKCS#11 interface,
we'll probably support it.  To the best of my knowledge, we aren't
endorsing the HP scheme in particular.

-- 
You should only break rules of style if you can    | Tom Weinstein
coherently explain what you gain by so doing.      | tomw@netscape.com

At 6:44 PM -0800 11/17/96, Lucky Green wrote:

>I have a hard time believing that Netscape caved. As I wrote in July, HP
>was working on selling our children's birthright to obtain an export
>license for their product. But Netscape participating in this just
>doesn't sound right.

Indeed, some comments from the usually-vocal Weinstein brothers would be
most welcome.

(I presume they "won't comment on rumors." After Monday's announcement, I
hope we'll hear from the various Netscape people who have commented in the
past.)

If Netscape is part of this sorry situation, it will mean that Jim Clarke's
expression of support for GAK a year ago was the _real_ story, with the "we
won't cave" noises just a pacifier.

By the way, Netscape once promised that their new corporate position was
this: that if the U.S. government insisted on a crippled version for
export, the domestic version would not be crippled at all.

I for one don't think that having the same smartcard, but with different
permissions or approval processes, constitutes having the U.S. version be
"uncrippled."

(Why? Because if Netscape and others widely deploy the H-P/Intel GAK
product, the government could decide any time they want to tighten
licensing for U.S. users, for felons, etc.)

--Tim May



"The government announcement is disastrous," said Jim Bidzos,.."We warned IBM
that the National Security Agency would try to twist their technology."
[NYT, 1996-10-02]
We got computers, we're tapping phone lines, I know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^1,257,787-1 | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

-----BEGIN PGP SIGNED MESSAGE-----

frantz@netcom.com (Bill Frantz) writes:
> At 12:05 PM 11/15/96 -0800, John Gilmore wrote:
> >Are they the next Big Company to knuckle under to the Feds?  Their
> >pcmcia-with-local-country-surveillance-chip-socket initiative never
> >seemed to go anywhere.
> 
> Since I am inherently optimistic, one ray of light may be that the San Jose
> Mercury News was mentioning the ability to export the system, and then when
> the necessary licenses (US and foreign) were obtained, turn on the
> encryption.  I guess from this that the encryption is in hardware.  Now,
> software/hardware interfaces are usually fairly simple, so what we have
> here is a software system with a crypto hook.

So what if the "license" is really the key? Sure, it would be
possible to generate your own kwys, but it's possible to export strong
crypto. Large commercial interests tend not to want to run afoul of
the USG. 

Jer

"standing on top of the world/ never knew how you never could/ never knew
 why you never could live/ innocent life that everyone did" -Wormhole

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQB1AwUBMo/v6skz/YzIV3P5AQG6RwMAleccaFPQO1R4iJbAV/wXj3dF41L8c/5f
pS8meubkoHfxuoywGwXiEyXKL1exzDNFE83L7E5jEHH8XR+gBZEpbV57zt4Ggyyr
eV2DUXWSPmFhO8Pl+BohDYadjY4oFkvQ
=YZut
-----END PGP SIGNATURE-----