Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Encryption Security

FBI Reports on Encryption 170

Posted by CmdrTaco from the encrypt-this dept.
Loki writes "A few goverment reports on encryption. Mostly talking about the fears of letting the public have high grade encryption, and how that is a hindrance for law enforcment. " Somewhat older documents, and in .pdf format, but I guess that this is the FBIs justification. I'm so glad its all being challanged.
This discussion has been archived. No new comments can be posted.

A few U.S. Goverment Reports on Encryption More

A few U.S. Goverment Reports on Encryption

Comments Filter:
  • Face it, encryption is like a gun in the sense that if it is outlawed, bad guys will still find a way to have it and use it.

    It would have to necessarily have to be a very big operation before the government would devote the resourcez to cracking a encryption scheme - even poor ones take a lot of rescources to crack. Since bad guys do not need public key schemes it is that much tougher.

    If I were a bad guy and wanted to send messages to another bad guy via some sort of encryption scheme, I would be far less worried about the government breaking my encryption than I would be of them having someone undercover in my orginization stealing the key! Matter of fact, I am reasonably confident that is the only way that they would be able to break a even moderately difficult crypto scheme.

    If I were a bad guy and wanted to send coded messages, I would develop a dual book crypto scheme. To add an extra degree of protection, I would send out bogus messages that would not contain any real data, these messages would tie up their crypto people without causing my co-conspiritors any real problem. Finally, I would change the way that I was doing things after every face to face meeting with my fellow bad guys, changing books, ISP's, email addresses and etc so that they would have a hard time following me.

    I'm no genius, yet I am 99% sure that the government guys would not be able to break my schemes or even do very well following my trail. A few simple precautions and mixing things up from time to time is all it would take to toss the dogs off your trail.

  • Re:Strangely enough.... (Score:1)

    by Anonymous Coward
    Note, it's not the "government" as a whole I'm concerned about. Just the half that wants to control our live. Bush and the republicans in 2000, baby :) !

    Right, all and only Dems are bad and all and only Reps. are good. Please think before you post.

    The issues cross party lines here; "the Republican half" is, if you haven't noticed, the one that cries loudest to increase the powers of law enforcement officials. Besides, without Gore we wouldn't have had the internet

  • The Real Scoop on Eschelon (Score:1)

    by Anonymous Coward
    Eschelon was created by a well known politician so that he'd have access to all the internet pr0n, including the pay stuff. That's what they're keeping in all those terabytes of storage. They throw text messages out immediately.

  • Enforcement is not the issue (Score:2)

    by Anonymous Coward
    The government doesn't care about crypto with respect to law _enforcement_. How many times do you think they *really* run a DEScracker to sniff packets from somebody using 40-bit encryption?

    The _real_ issue is fear. When people know that the government *can* snoop on them, they are much more likely to stay in line. But if you hand them a mathematical proof that they cannot be snooped (assuming P=NP of course), the temptation to break the law is much greater.
  • Doors, locks, and safes can be kicked down, cut off, or cut open with a torch. That's why the gov't doesn't care about all those deadbolts on your front door or your triple combination locked gunsafe. They can still get in when they need to. Even if your house is a fortress (armor plated walls, generators, stockpiled food and water, underground bunker, etc.) They can just cut off your water/power/gas and wait you out. You will have to come out eventually (recall the Montana freemen). But with strong crypto, the gov't is SCREWED. The info is locked away for the 1e35 years it would take to break it. No amount of brute force gets the data out. And if the one with the key in his head won't talk or is killed, well, that data is just random noise for all eternity.

    I've been toying with the idea of creating an encrypted filesystem for use under Linux (with strong crypto, not DES). You supply the password when you mount the FS (the password stays in memory to allow transparent access to the FS). If the FBI or other Bad Guys kicks down the door downstairs, you hit the power switch on your PC and *poof* your data is secure. Feds cannot mount your FS without the password and see noise otherwise. What am I trying to hide that requires this level of security you ask? That's not the point. It could be banking data, w4r3z, my personal phone book, or grandma's casserole recipe. The point is, my computer is an augment to my own brain and thoughts. And I have the right to protect it with the same level of security regardless of what I "might" be able to hide.
  • "republicans" ... "keeping thier butts out of private lives"...

    ROFLMAO!

    I'm not going to defend the Democrats, not after a Democratic President signed not one but two different CDAs into law. But remember, it was a Republican Congress that handed those bills to him to sign to begin with. Each of the major parties is exactly as bad as the other one. The differences at this point are nothing more than cosmetic.

    Screw 'em all. Vote Unarchist. Next time someone passes a law, stop and ask yourself, "Why am I obeying this law, anyway?" If you're honest about the answer to that question, you may surprise yourself...
  • First incorrect assumption: That legality and morality necessarily have something to do with each other.
  • I don't recall Microsoft having a particularly bad track record for cryptographic software.
  • Regarding encryption and self-incrimination: has this even been tested in court, US or otherwise? (I think maybe the Kevin Mitnick case did)

  • Posted by FascDot Killed My Previous Use:

    If the Feds can't even prove that there is something available to be decrypted they can't lock you up for hiding the passphrase. Check out steganography. It concerns hiding Data A inside Data B invisibly. Kind of like a digital watermark.
    --
    "Please remember that how you say something is often more important than what you say." - Rob Malda
  • Posted by Forward The Light Brigade:

    the steganographic filestystem does one better;

    instead of encrypting in using a standard form of crypto, it scatters the data around the drive, filling the rest with noise.... except you can have n such partitions; there is no way to tell how many partitions are concealed in this manner, since _SOME_ amount of the bits on that HD are nothing but noise...

    check it out (sorry I do not have a url, but freshmeat lists this fs)

    the point is such that you can have a few partitions that you dont particularly care if the fbi gets access to, an you never tell them about the one that is sitting there in plain site, diguised as random noise...

    that way no prison

    PS performance is obvious much worse than ext2, but it is meant for data one wants to conceal, not /usr/bin...

    keep the stuff that has to run fast somewhere else.... or use initrd to buffer in ram those bins that need to hide in this fs, to get performance without security compromise...
  • Posted by FascDot Killed My Previous Use:

    So what's wrong with the Kennedy ballistics. And keep to the known facts, not the lies and misdirection of Stone's "JFK".
    --
    "Please remember that how you say something is often more important than what you say." - Rob Malda
  • Posted by FascDot Killed My Previous Use:

    They have a bad crypto track record for two reasons:

    1) They don't provide enough.
    2) Some of what they have provided it would be better to do without. cf: Office, NT passwords, etc.
    --
    "Please remember that how you say something is often more important than what you say." - Rob Malda
  • Posted by FascDot Killed My Previous Use:

    How can you prove someone is using illegal encryption? Even assuming you have access to allegedly encrypted data (which might not be the case if Al Capone is smart and uses steganography), all it is is a bunch of random characters. There's no way to look at an encrypted file and say "Yep, looks like 2048-bit encryption to me".
    --
    "Please remember that how you say something is often more important than what you say." - Rob Malda
  • As far as not decrypting the contents of your HD, I believe the 5th amendment (?) covers the right to avoid self-incrimination.

    (I've never understood how that amendment works, though, as invoking it would basically be a confession of guilt.)

    And there's also the "right to remain silent" whenever someone's arrested.

  • Amendment IV The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

    Looks to me like I have the right (in the US) to secure my papers. I think that the court would agree that papers would cover anything on my computer which I could easially print.

    Now with a warrent they can search my papers, and I suppose I have to give up my key then, but not without a court warrent.

  • >He then proceeds to silly analogies, such as "Would we allow a car to be driven with features which would evade and outrun police cars?"

    The real analogy Freeh should be using is would be "Would we allow a car to be driven that doesn't include a remote shutdown control so the police can stop it whenever they wish?" Or, "Would we allow people to put locks on their houses that we can't unlock without resorting to a battering ram?" Of course, then Freeh would look like an even bigger idiot if he said no to those.
  • Replace "FBI" with "NSA", negate the negative, and let the rumors fly.

  • Actually, this has been argued in court. I believe the decision was something on the order of "Since the police seek to use new sneaky ways of monitoring us, we should have the right to know that we are being monitored." It doesn't make speeding legal, it just tells us that we are being watched.

  • You're right that it covers self-incrimination, but I don't know that that is how encrypting information would be viewed. They could call it destruction of evidence.

  • What about radar jammers? What is their justification for those? As I understand it, they interfere with signals being returned from your car so that they will end up being wildly innaccurate. I don't know how the law looks at those, or even how well they work.

  • A couple years ago, I discovered how easily tempest can work.

    I was watching TV on broadcast channel 5 with a set-top antenna. There was an odd and regular pattern of interferance on the screen which looked like bleed from another channel. I got up close to the screen to see if I could figure out what it was, and to my surprise, it was my screen saver.

    If it worked that well by accident, I can imagine that a deliberate attempt would be quite successful. I added a bit more shielding to eliminate casual interferance, but I have no delusions about it blocking a concerted effort.

  • One need not mistrust the intentions of government to object to the clipper scheme. Why worry about government misuse when you can worry about the under paid, over worked, frustrated, and generally powerless government clerk with a heavy gambling debt and delusions of grandure? All it takes is one, and suddenly everyone's secrets are for sale to the highest bidder. 'Give me that key, and we'll set you up with a new (and very wealthy) life where there's no extradition'.

    Yeah, such a clerk would probably end up dead instead, but who ever said the government is staffed exclusivly with street wise geniuses?

  • here's van Eck's [jya.com]
    original paper from Computers & Security, 1985 Vol. 4.

    You will find a lot more information under "Tempest radiation" named for the TEMPEST standards for EMF emmission reductions.

    I found an article [sciam.com] from the December 98 Scientific American which mentions a Microsoft connection. It was featured [slashdot.org] on Slashdot but only has one remaining comment attached to it (bit rot or conspiracy?)

    Finally there is The Complete, Unofficial TEMPEST Information Page [eskimo.com] which has all you (can|should|need to) know.


    --
  • here's van Eck's [jya.com]
    original paper from Computers & Security, 1985 Vol. 4.

    You will find a lot more information under "Tempest radiation" from the TEMPEST standards for EMF emmission reductions.

    I found an article [sciam.com] from the December 98 Scientific American which mentions a Microsoft connection. It was featured [slashdot.org] on Slashdot but only has one remaining comment attached to it (bit rot or conspiracy?)

    Finally there is The Complete, Unofficial TEMPEST Information Page [eskimo.com]


    --
  • Emacs beat you to it.
    --
  • 2-3 years is pretty old in the technology field, and lots has happened in the encryption field since then.

    --
    Timur Tabi
    Remove "nospam_" from email address
  • If crypto is illegal enforcing it before hand wouldn't be the goal. It'd be more workable enforcing it after the fact. You get picked up on some other offense, data on your hard drive is encrypted and an additional offense is added to the list. If you refuse to decrypt it there are probably present laws that they can already hit you with like interfering with a criminal investigation. It could end up being used a bit like tax laws were in the gangster days: We don't have the evidence to book you for murder, extortion, rape or racketeering but you were dumb and didn't pay your taxes. Off into the clink you go.

    OBDisclaimer: I'm not a lawyer and/or cop and to the best of my knowledge I'm not a criminal.
  • The PPTP implementation is vulnerable to several well known cryptographic attacks. MS's record on good crypto is as good as their record on fixing security exploits.

    Check out Counterpane's report here [counterpane.com]. Counterpane is the company owned by the same guy who wrote Applied Cryptography and the Solitare system used in Cryptonomicon.

    If you need a VPN, use FreeS/WAN.
  • with the subject of the government and encryption. For some reason the government (at least in the US) still thinks that they can control encryption and that publicly availible strong encryption is a bad thing for everyone. As long as the Internet is too big to police and people what their privacy there isn't much that can be done.

    ---------
  • Ok, so we have a reactionary government that takes everything at face value without thought. Why don't people start playing up the idea that because encryption isn't widely available or hindered our computers are subjected to cracking and shutdowns...put it in words they understand.

    "The blah-blah-blah.gov site was cracked. That was unfortunate, but they left themselves wide open for not using ssh."

    Somehow put it in their heads that encryption is an aspect of computer security, and start blaming cracking activities being caused partially by misguided cryto-laws.
  • Actually you are the one who does not get the point. Radio emmisions are on a particular frequency and you are only looking for an "interesting" signal. Van Ecking a computer is not a trivial task, and there is no way for you to effectively hide the radiated signal without spending a lot of effort to shield the system (e.g. do all your work inside a Farraday cage).
  • I wonder if such a regulation would be constitutional, since it's nothing else than forcing a defendant to accuse himself, which would not be considerd a fair process in most civilised states. (however, I think that France used to have or still has a similar regulation. - Anyone with details?)

    I addition to that, you're neclecting the practical Problem Stormin mentioned: If you use standard steganographic techniques, than there is no way, they can prove that a certain audio- or graphicfile acually contains encrypted data (even the oldest pgp versions contain hooks for this very purpose).

    But this all doesn't matter here, since the real purpose of crypto-regulation is not to fight crime or terrorism but to prevent the the general adoption and legal use of crypto (esp. by companies) to allow for (economic) espinonage and political control.
  • Hmm, wasn't Bush the one that said something like "freedom should be limited"? I believe it was in regards to the Internet, as well. I think both halves are just two sides of the same coin.

    logan

  • No matter what idea you think of, in the linux community it always seems someone beats you to the punch try

    http://zaphod.ethz.ch/linux/tcfs/tcfs-faq.html
    --

  • Yeah, like the maths needed to implement or even _discover_ encryption is restricted to - or originated from - the USA.

    Case in point can be the Unix crypt library, where the rest of the world were quite happy to download Ultra Fast Crypt from Finland instead.

    Boo to export restrictions which only hurts companies wanting to sell their products abroad, to people who most likely already can get equivalent encryption anyway.

    Though with the Wassenaar agreement, it seems the stupidity is not limited to USA anymore.

  • Don't forget radar detectors! Why are those things legal?

    Because I have a reasonable right to do what I please with the electromagnetic waves that enter my car? Speeding's still illegal.

  • IIRC, there is one state that bans jammers but allows detectors (MN, where I live), one state that bans both (somewhere in the northeast?), and one that bans detectors but allows jammers (OK).

    Don't ask why they would allow jammers but not detectors. It makes no sense to me at all.

    (This is based on mail order catalogs' statements of where these devices will not be shipped. I suppose other states may have bans on use, but still allow sale, but I haven't seen any information on that.)

  • Comment removed based on user account deletion
  • Note 1) lead time

    If you're using a music CD as a one time pad, I'd suggest dropping all data which represents silence. Otherwise you'll get nice repeating patterns for your adversary's cryptanalysts to play with at the start and end of each song.

    Note 2) rule complex enough to foil casual observation

    a) if you're only trying to foil casual observation, then you might as well just use RSA public key and triple DES or something, instead of a pseudo-one time pad.
    b) you might as well use the secure channel used to agree upon the rule to exhange a better pad itself, or agree upon a pseudo-random number generator and seed. That way, if you use a good generator, your pad will have less of a pattern to it. Especially when Janet Reno breaks down the door and sees that program on your drive that lets you use 12:22 on the CD as a one time pad. :-)
  • The republicans do cry about increasing the powers of law enforcement officials. They also cry the loudest about keeping thier butts out of private lives and matteres of the american people and minimal government control! It's not that dems are bad, but my opinion is that they have hurt more than helped in the past few years when it comes to personal freedoms.

    By the way, moderating me down then posting as an AC, all because of that minor poilitcal "Whoop!" is lame, I hope your mamma's proud :)
  • I "invented" an unbreakable encryption scheme and used it with friends when I was, like, 10. It's very simple: Add the key to plaintext to get cyphertext. It's called a one time pad. Works perfectly, as long as you never use that key again. Impractical, but quite unbreakable. Of course, I was by no means the first person to come up with this - not by a long shot.

    Once you get into public key cryptography, I am convinced that there is always a shortcut to breaking it. It's just a matter of finding it.
  • Subject says it all. They don't dispute your right to have it. But they don't want you to make it available to anyone overseas. That means it must be downloaded for a server that can tell the difference.

    It can't go into general use if it can't be exported.
  • There was a article a couple weeks ago about the Linux OS winning first prize in a contest for computer art. The justification given by the judges was that they believe computer code is a form of artistic expression. If you want to use the bill of rights to justify strong crypto export, use that. Artistic expression is free from export controls, right? Computer code is art. Therefore... O.E.D. !!!!!!!!

  • Patrick Ohly's DiskProtection [ira.uka.de] is an Amiga device driver that basically just mirrors another device, but with an encryption layer. It's been out for several years now. It'll mirror any disk device (though I think it has a 4 Gig limit which is kinda dated these days; he should update it or release the source :-) and you can run any filesystem on top of the device. It also uses the xpk standard to interface with an encryption library (DiskProtection doesn't actually have any crypto code in it) so you can plug in any crypto algorithm you want, if your current pet algorithm (e.g. IDEA) ever becomes outdated.

  • The us gov't has been trying to control encryption, supercomputers etc, for a long time now....but in reality, its pretty much impossible.

    If they create/enforce these kinds of rules, companies will simply move their hq's to other countries where such things are not illegal.

    Until every country in the world decides on the same guidelines (which will never happen), these rules are simply useless. Maybe they should stick to finding ways to improve security for their nuclear labs.

  • Maybe we ought to ban these too or require a TEMPEST compatible transmitter in all non-picture-tube monitors

    That might be true if the CRT was the only RF leaker in the typical computer system. The previous poster mentioned eavesdropping on the keystrokes containing the password. Since no reasonable encryption system echoes such keystrokes to the display, I would tend to assume they were talking about eavesdropping on the keyboard itself or something inside the computer directly attached to it. While there are probably less emissions from a device such as a keyboard than from a CRT, there are likely to still be measurable enough amounts that sophisticated and sensitive enough equipment could intercept it. The feds have plenty of money to buy/build such equipment.

  • I'll just list the things that will interfere with the RF leakage:

    While all of that is true to a certain extent, as someone who has seen 'Van Eck' type equipment in operation, I can tell you that you shouldn't be so quick to dismiss the interception of RF leakage as an eavesdropping risk. The basic 'Van Eck' type equipment can be further refined with highly directional antennas, amplification and filtering hardware to increase its ability to discriminately intercept data. It would be probably be safe to assume that the feds have already done this.

  • Radio emmisions are on a particular frequency and you are only looking for an "interesting" signal

    A very good point, albiet I'd argue that there is often a lot of bleed of signals across from one frequency to another (which in general makes it easier when it comes to eavesdropping, not harder). I've seen a lot of equipment where signals were repeated at various harmonic intervals so that any one signal source was basically polluting a large part of the radio spectrum. The advent of cheap and powerful digital signal processing really worries me when it comes to Van Eck style eavesdropping, because it could be used to very easily isolate those "interesting" signals.

  • You mention Van Eck eavesdropping: can you point to any online or print sources of information about this?

    Check out:

    "Electromagnetic Radiation from Video Display Units: An Eavesdropping Risk?" by Wim van Eck, Computers & Security, 1985 Vol. 4.

    If you can find it. The NSA made efforts to try to eradicate every copy of this publication, but thankfully were unsuccessful.

    Take a look here:

    http://jya.com/bits.htm [jya.com]

    The little that I do know about it is, frankly, unnerving.

    As well it should.

  • generate too much EM crap (very strong, very random)

    operate near soft drink vending machines

    The kind of signals emitted from that type of equipment doesn't really fit your criteria, as it is very organized and predictable. It also likely doesn't fall into the same frequency ranges as most of those generated by a laptop (at least not the interesting ones).

    While background noise may help some as a jamming source, I'd be suspicious of relying on it as the 'best' way to avoid being eavesdropped on. I have considered the possibilities of active jamming with specialized hardware, however, and that has more potential in my opinion. I don't think I'd consider it a substitute for also doing as much shielding as possible though.

  • Ever heard of a white-noise generator? You know what white noise does to *any* type of signal. It would be quite easy to jam your computer's interference (and legal too, just keep the amplitude close to your computer's).

    Now you are talking about specialized jamming equipment, something that I've said is a possibility, at least it sounds more feasable than relying on masking from generic appliances.

    Besides, getting back to the main topic, the police always have other evidence of crimes, beside the encrypted information.

    This assumes that the police would be the only people using electronic eavesdropping for surveilance. It can also be an effective tool for such things as industrial espionage, or even just spying on your neighbors, relatives, spouse, etc.
    The issue is, why make it any easier for someone who might be spying. That is why shielding is a good idea, and in general doesn't have much of a downside except cost. Cost wouldn't be so high if it was a standard practice thing.

    Why? Other people trying to save their own skins will 'rat you out'.

    That assumes that there is someone else that knows.

  • Re. Van Eck Phreaking, search with term "TEMPEST", which is what the Gov. calls it.

    As to why the Gov. is so all-fired against strong crypto, it really has very little to do with not being able to read criminals/terrorists mail. No criminal or terrorist in his/her right mind is going to use the key-escrowed products. The real fear is of untraceable "E-cash", and the impact that hard-crypto protected cash flows would have on the Gov.'s abiity to impose and collect taxes.

    Of course, if the Gov. loses the ability to monitor cash flows, it can always go over to a real-property taxation scheme, but the amount of taxation that could be collected by this is probably a full order of magnitude lower than is now collected.

    Other countries, notably China, would be in real deep shit if they had no way to control the flow of information to their serfs.
  • "Would we allow a car to be driven with features which would evade and outrun police cars?" Well... yes, we would, unless high performance sports cars were banned while I wasn't looking.

    Don't forget radar detectors! Why are those things legal?
  • I don't have any links thuis far on Van Eck phreaking/eavesdropping but I would suggest picking up a copy of Cryptonomicon by Neal Stephenson. There is a rather lengthy discussion and example of one being setup in the books storyline. I don't know how accurate it is but basically by reading the waves given off by a computer monitor, with the right equipment, you can redraw the display elsewhere. Of course i could be totally wrong and it was all bullshit in the book but then again it IS fiction.
  • ONe, it doesn't have to be random noise. Oh, if you're using something as simple as XOR, maybe it does so that the output is non-obvious. But with only a slightly more sophisticated one-time-pad lookup it could be an actual music CD, not just noise. The advantage is lower-obviousness during a physical search. (Mind, if they're really serious and suspect this is the technique you're using, they'll try to decrypt against every CD in your collection.)

    And you don't have to start with a new CD for each transmission, unless you're sending 650 MB at a shot. A single CD will cover a lot of message traffic. You just both (all involved) need to agree on which recording of which CD you're going to use.

    (The traditional low-tech version of this is using an agreed-upon edition of a mass market book, "Catcher In The Rye", say.)

  • > without Gore [...]

    Problem is, if that gets repeated enough even in jest, people are going to end up believing it.

    Hell, it'd probably be horrifying to find out just how many people do believe it now (the ones that don't believe that Bill Gates/Microsoft invented the Internet.)
  • I think you meant to say "P is not equal to NP" instead of "P=NP." But even then, what existing encryption algorithms have NP-complete strength (which would have to be the case in order for such a proof to exist)?
  • The only way to prove that factoring is not NP-complete would be to present a polynomial time algorithm to do it (or you could show that one exists without showing how to do it, but I don't see how you'd do that). However, the absence of such a proof certainly does not prove that factoring *IS* NP-complete.
  • You'd also have to prove that P!=NP, but then again, who cares about np-complete if P==NP.
  • I was thinking the other day about the whole privacy issue while I was flashing some bios's up to Y2K compliance. It dawned on me that locating compromising code here would be pretty much impossible for Joe User to ever notice. Connected to the web, it could broadcast every key you type to a remote DB, catagorized and stored.
    Yikes...
  • The way I see it is that until they completely outlaw any crypto technology except the government approved one, they'll never succeed in getting everyone on their side. However, if they make the use of non-approved crypto "prima facie" (sp? I'm not a lawyer) evidence of a crime, then we're all in trouble.

    So how would they get a bill like this through congress? A well-publicized bill would get attacked by all the right people, so we're kind of safe there.

    The ones we need to worry about are the stealth attempts. And I hope that the EFF or the ACLU (and every other watchdog) is well-resourced enough to keep a sharp eye out for such things.

    Of course the arguments on the gov't side will continue along the lines of fear mongering. Given the recent spate of gun legislation, let's just hope that the next shocking high profile crime doesn't involve crypto, or the balance may shift the wrong way...

    (Kind of rambling, but hey - just my 2 cents.)

  • Yeah, all that stuff interferes with my FM radio reception too... you get the point.
  • And of course, most guns in the US are never used against a human. So a person could, logically, be a "gun supporter" even if they would never condone using a gun against a human.

  • For those of us that have been following this for some time, the situation is pretty clear. I remember following the comp.org.eff newsgroup way back (1992?) when the Clipper chip concept was first introduced, and all these arguments were hashed out many times even then.

    The US Government doesn't need to have breakable or escrowed encryption for investigating known criminals. In a criminal investigation, they can almost always get the information they need some other way - video or audio bugs, surveillance, TEMPEST, blackmail, force, etc.

    But all those techniques are labor intensive. The whole point of escrowed or otherwise restricted cryptography is to reduce labor cost. That is the ONLY way to explain the US government's otherwise irrational encryption policy.

    They want the ability to conduct easy, cheap, automated, wide spread electronic surveillance, Echelon-style, for all digital communication.

    Once you understand this, all government encryption policy makes sense.


  • As far as I know, no commonly used encryption algorithms are based on NP complete problems.

    However, if I remember correctly, it has been proved by Michael Fellows (a former professor of mine) that encryption algorithms can be created based on NP-complete problems, such that breaking the encryption can only be done in non-deterministic polynomial time (unless P == NP).

    Sorry I don't have a reference here. If someone is really interested, I think I could find it. I don't remember if the encryption algorithm would be at all practical to actually use, however.

  • Mere "proofs of existance" like that do exist for some problems. That is, there are proofs that polynomial time algorithms exist for some problems which do not actually show what the algorithm is.


    Theoretical computer science (my former specialty) is a very strange field.

  • The point with crypto control is simple. If the "bad guys" have strong crypto, and the Gov't outlaws strong crypto, they can bust the "bad guys" for having crypto and get them off the street. Sound familiar? Ask the deceased Al Capone, who was "caught" for tax evasion.

    Go figure.
  • Note, it's not the "government" as a whole I'm concerned about. Just the half that wants to control our live. Bush and the republicans in 2000, baby :) !

    Meet the new boss, same as the old boss. I don't see a Bush, or any other Republican, administration that would be any nicer than the current bunch.

    "Save the children" can get a lot of mileage.
  • > Without supporting or condeming the IRA, one > persons terrorist is another's freedom fighter.

    The IRA are scum, and that's _it_. Why do so many Americans insist on making assertions about places in the world that they have no knowlege of? Take it from me, the analogy with the Continental Congress, or Washington's Continental Army, is utterly laughable and, leaving slavery aside, a slander. I'm Irish, by the way, and I can tell you that the IRA have no mandate anywhere on this island. Find a better candidate for a group deserving of strong crypography.

    ObCryptoPolicy: Of course, the idea that crypto restrictions will keep strong cryptography out of the hands of the IRA is just too funny: it has extensive stockpiles of automatic rifles, light AA guns, and scentless plastic explosive (great for blowing up shopping malls), and all this in a country, where, yes, gun advocates, restrictive gun laws *are* generally very effective in keeping guns out of the hands of criminals.
  • So I take my clipper chip, encrypt some data using as many private keys as I want, generating as many private key/encrypted key pairs as I need. I then go after recovering the government's private key using any convienient super computer, beowolf cluster, playstation or a the idle time of a few hundred thousand computers on the net. Not knowing the exact algorithm would hurt - diferential cryptography could possibly help. Emagine the resources that other governments could bring to bear on the problem.

    Or perhaps good old fasioned cloak and dagger social engineering could dig it out.

    And what other governments would get to share the secret? Would they protect it with appropriate care? Would they use it as responsibly?

    Clipper met the same sort of suspicion that DES did, and for good reason.
  • There are parts of the world where "anyone who thinks for themself and speaks their mind is a criminal".

    I happen to think that my (US) government is the greatest, and I don't trust them without checks and balances (that they often want to shake off). There was a lot of talk about not long ago about protecting the identities Kosovar internet users. And how about users in any of a dozen other coutries. Your list of countries may well be different than mine, but that does not change the argument. Public access to strong encryption is a powerful weapon against totalitarian systems.

    I think public access to strong encryption and public access to firearms have similar advantages, but that public access to encryption caries fewer risks.

  • Yeah, and probably what should happen is that the US government should pass an amendment to the US constitution saying:

    All citizens have the right to use encryption.

    At which point some people will misinterpret that as meaning that they have a responsibility to encrypt things. Otherwise normal people will start encrypting everything, from their recipes to their web pages. They will freak out if anyone ever implies that they really don't need 2048 bit encryption for their emails to their mother. The US will then be looked upon strangely by the rest of the world. "What's with the US and their encryption??"

    Tourists from overseas will be shocked when they see signs like "You can have my PGP key when you pry it from my cold dead hands!". Incidents of Encryption Accidents will flood the headlines:

    "Jimmy was such a nice boy! Who would have thought he would encrypt all the school's files like that?"
    "Postal worker goes crazy! Encrypts all co-worker's files!!"

    ...

    The difference between encryption and guns is huge.

    Guns are designed to kill or seriously injure. Gun supporters think that killing and seriously injuring can be good, if the person being killed or seriously injured is a "bad person".

    Crypto, on the other hand, is just privacy protection and authentification. It's not using crypto itself that anybody sees as bad, but rather the information being hidden by that crypto.

    If the US did go crazy about cryptography the way they do about guns, the world wouldn't really care. Afterall, crypto is essentially harmless. The same, unfortunately, can't be said about guns.

  • Ok, now go to the other extreme...

    • Assault rifles
    • Grenade launchers
    • Bazookas
    • Armored personnel carriers
    • Tanks
    • Battleships

    The difference between the objects is the potential for mass damage. If an otherwise average joe goes on a rampage with a knife, how many people is he likely to kill? Ok, now how many people is he likely to kill if he's armed with a gun?

    The fact is that humans are aggressive, warmongering, emotional, stupid, and occasionally completely psychotic. I personally feel it's stupid to give the average such a human the ability to kill many people with relative ease.

  • What makes guns bad is that there is no "stun" setting.

    It's an easy argument to say "if you come across a massacre, killing the assailant saves lives". But in practice it's not that simple or that easy.

    The biggest problem with guns is they tend to cause death. It's a very simple concept. It's also very simple to look at statistics.

    Canada is very similar to the US. Most laws are similar, culture is nearly identical, climate is similar, standard of living is similar, etc. But Canada's murder rate is a tiny fraction of the American murder rate. And that difference is due mostly to the US 4th Amendment.

    I personally would rather take my chances unarmed in a land where nearly everyone else is unarmed, than armed in a land where nearly everyone else is armed. And the above statistics are the compelling reason why.

  • actualy, as it stands, you have to decript data if it's supened(sp?), if you don't its obstruction of justice.

    the "not incriminating yourself" thing is to stop forced admitions
    ---------------
    Chad Okere
  • And, the converse: steganography in the least significant sample bits of an audio CD track. Listen to your crypto. Now what did I put on Track 51 again? :)
  • Sure, you can have my guns.
    What? Oh, knives too?
    Sharp Sticks?

    It's a simple situation of blaming an inanimate object (Or the existence of the object) for the faults of the people using it. If we weren't such an aggressive, warmongering race, the whole point would be moot.

    Incidentally, automatic weapons have been illegal for many, many a year. Yet somehow, they still find their way into the hands of criminals.
  • The system that the FBI wants could be done with algorithms that are quite good. A few years ago the Clinton Administration wanted to outlaw all forms of encryption except for their Clipper Chip.

    The Clipper Chip encoded messages with an secret algorithm designed by the NSA called 'Skipjack'. Skipjack is a secret key algorithm like DES, RC4, IDEA, etc. Reviews by outside cryptanalysts working under NDA were largely positive on the strength of Skipjack which uses a 64bit key although it was no better than many of the other
    algorithms publicly availible.

    However, when sending the message encoded with Skipjack, the Clipper Chip prepended a header which was the key used by Skipjack to do the encoding. The header was then encrypted with a public key algorithm like RSA. The government would maintain the private key necessary to decrypt the header thus exposing the "secret" key
    used by Skipjack and allowing the benevolent government to read the message.

    A point of clarity, the "secret" key used by Skipjack was not burned into the Clipper Chip but could be chosen by the user.

    Messages encoded by the Clipper Chip would be *very* difficult to crack without the private key for the header; even if someone reverse engineered the chip to reveal the secrets of Skipjack or the header public key.

    Disclaimer: I would never use the Clipper Chip or similar scheme; the potential for abuse by Big Brother is too high no matter how good the underlying technology.
  • Let's cut straight through the bullshit here and stop even pretending that the Govt. is telling us the truth.

    They don't want to ban strong crypto because it allows criminals to hide their activities. Don't fall for that crap. Don't even give it a second thought. It's the same line they always use. "Child Pornographers! Murderers! Rapists! Save the children! Save the children! Save the Children!"

    They want to ban strong crypto because it would ensure that they can always listen in on us as easily as they can now.

    Their argument doesn't even make sense. If they ban strong crypto, I'll go out and write some crude non-key-escrow RSA utility, and if I don't, a thousand other people will.

    I'm no paranoid conspiracy theorist. You don't have to be. Hell, I don't even blame them for doing what they are. If I was in their position I'm sure I'd be as paranoid as they are.

    My question is, why do we put up with them lying to us like that?

    To quote Bill Hicks, "All governments are lying cocksuckers." If you don't subscribe to that theory, let's have a long talk about the ballistics of the Kennedy assasination. ;)


    Anthony DiMarco
  • the kennedy thing was a joke, thus the ;)

    ;)

    i've never even seen JFK, for that matter...

    Anthony DiMarco
  • The FBI fears strong encryption in the hands of the common citizen the same way some (including many in the FBI) fear guns in the hands of that same citizen. Both are a source of power that make that individual just a little bit harder to control, which is the real reason the feds fear them. Why should I give up something just so that the feds will supposedly have an easier time catching criminals? What exactly do they mean by criminal anyway? What is to stop that definition from changing? You might wake up one day to find that anyone who thinks for themself and speaks their mind is a criminal. Before you make that face and scoff at me remember that it's happpened before and IT CAN HAPPEN HERE. Don't give up sources of power that serve as important safeguards against tyrrany. I'm far more afraid of the feds than I am of a criminal organization that would have a use for encryption.

    Lee
  • Both the Republican and the Democratic parties are
    corrupt and controlled by special interests, they only differ in their rhetoric. If you want to stand up for individual liberty and freedom, vote libertarian.
  • I have a few problems with this key recovery idea:
    • What algorithms do they want to use? An algorithm that has some sort of superkey can't be very good. Otherwise, would I have to send them a key everytime I encrypt something? (Of course I would do that over a secure connection, right? :)
    • Everybody knows that the stored keys will be used for unlawful purposes. The NSA is about the least trustworthy organization on the planet. Even those corporations that frequently pay it off know that.
    • They can't seriously believe that criminals will use their crappy endorsed products. Sure, many stupid ones will, but clever ones won't.
    • How do they plan on outlawing other encryption? There's an "unbreakable" encryption algorithm in chapter 12 of my math book; what prevents me from using it?
    As far as I am concerned, they'll never get away with that. Maybe laws will get passed, but this will never end up working.
  • IT forces a new election
  • The only reason the US Intelligence community cares about encryption so much is because of Echelon. Echelon works in real time and the NSA has a finite amount of 'puter resources to throw at data interception. The feds need to insure that people don't use too strong of an encryption because then Echelon couldn't handle it. The NSA listens in to everything that enters or leaves the USA and the EU. If you don't believe me check out this link to an EU site. [eu.int]
  • First of all, can you name one instance where any type of police investigation was hampered because of encrypted email messages?

    Criminals, and spies, have known for a long time that better than encryption for some purposes are codes. If you send "The blue geese fly tonight", then it doesn't matter if you can read the text, you don't know what's going to happen unless you have the code book.

    As this sort of protection is impossible to legistate against or prevent, then any laws against crypto are not going to prevent criminals from communicating secretly.

  • The increasing fear of free, educated people by the state is an unmistakable sign that it is on the road to despotism. I'm not ready to say how far along that superhighway we are in the USA, but...

    Item: That dang ol' printing press was considered a threat to the state at one time. "You mean the serfs are going to learn to READ?"

    Item: Old Communist dictatorships forbade unlicensed typewriters.

    Item: The biggest fear among 19th Century US slaveholders was that the slaves would become literate. As it was, information on escape routes was ILLEGALLY ENCRYPTED in the lyrics of spiritual hymns and the designs of quilts.
  • Why do so many Americans insist on making assertions about places in the world that they have no knowlege of?

    Being American, I will say that most of our knowledge of the IRA is only through television and the movies. Most of us really don't know what the IRA is all about. Ask one of us about IRA and well tell you about our retirement funds.

    Seriously, I was just in Omagh, North Ireland, for a tournament to help in a fundraiser to help those affected by the bomb that went off in the shopping center. It really was an eye opening experience. All of the people I met were very friendly and I could not understand how there could be any problems. But I guess there are a few that ruin it for everyone else.

    Anyway back to the point of encryption. The Government has plenty of reasons to stop people from encryption. Some of those reasons are probably secret as well (That's why they lie, or should I say "tell the half truth"!). What bothers me the most is the "recovery agent". Is this a centralized location that if compromised could be even more harmful then helpful? Enquireing minds want to know!

  • Extracting just the low bits from music or image files should produce a result which is fairly close to random noise. It won't be perfectly random, and therefore won't be absolutely uncrackable, but it should be pretty good.
    /.

  • Freeh's Lame Arguments (Score:5)

    by Steve B ( 42864 ) on Tuesday June 15, 1999 @08:55AM (#1849571)
    When reading " The Impact of Encryption on Public Safety [fbi.gov]", I noticed that Freeh cited several examples in which the bad guys were caught and convicted anyway. If anything, these cases are evidence against his position: they prove that the police simply do not need these additional powers.

    He then proceeds to silly analogies, such as "Would we allow a car to be driven with features which would evade and outrun police cars?" Well... yes, we would, unless high performance sports cars were banned while I wasn't looking.

    Freeh concludes with a complaint that strong encryption will "drastically change the balance of the Fourth Amendment". Well, perhaps so, but he is conveniently silent about technologies which have already tipped the balance in the other direction. The net effect of Freeh's position is to create a one-way ratchet -- technologies which degrade privacy (e.g. drug testing, look-through-walls IR, etc) are deployed as widely as possible, while technologies which enhance privacy (e.g. strong encryption) are restricted as tightly as possible.

    That said, there might be a case for mandatory key access if there were simply no other way for the police to surveil people who fall under legitimate suspicion. Fortunately, this is not the case -- just off the top of my head, I can think of three alternatives (planting a bug in the target's hardware, remote viewing of the target's monitor via Van Eck emissions, Trojan Horsing the target's crypto software).

    The fact that these alternatives are more work than sitting in one's office and pulling up the target's key is, frankly, not my problem. The fact that these alternatives do not scale nearly as well as the government's desired mandatory-key-access regime (and are thus unsuitable for mass surveillance), is, IMO, a feature. The fact that the government seems to regard it as a bug raises a big red warning flag.
    /.

  • You do realize that there is no such thing as "complete freedom", don't you?

    All freedom is limited. You can't have complete freedom without the potential to infringe on someone elses freedom. Once that limit is there, then it's not complete.
  • Reading over the memo on the dangers of encryption in the realm of public safety reminds of me how the Church must have bantered back and forth over the dangers of public knowledge of the Copernican model of the universe. Why must governments continually impede progress? (rhetorical question) technological, scientific, or social - it makes no difference - The Man will attempt to rationally justify His attempts to eradicate change.
  • US Law Enforcement and Intelligence loves to play all sides of the encryption argument. Look at some of their sites and examples.


    (1)...Disgruntled employee corrupts corporate database.

    Huh? I don't see how this one plays out. If the employee encrypts information that she stores in the database, she could just as easily store false information and accomplish the same goal without encryption. If an employee encrypts the entire database, they could just as easily delete the db and accomplish the same purpose without encryption. Either way, don't most companies have backups and business continuity plans.


    (2)...IRA Terrorists.

    Without supporting or condeming the IRA, one persons terrorist is another's freedom fighter. I'm sure 223 years ago, British parliament wanted to keep guns out of the hands of George Washington and those terrorist colonists. In fact, that's why we have the 2nd amendment. Since the NSA keeps arguing that encryption is a munition and subject to export restrictions, wouldn't the general public have a constitutional right to have encryption?
  • No offense meant. My qualifier of "without supporting or condeming the IRA" was to avoid making a comment about a place in the world that I knew nothing of.

    I merely wanted to point out the hypocrisy of US Intelligence and Law Enforcement. One side argues that encryption is a munition; we must make sure our enemies do not have it. For several years, I have supported efforts to get these types of laws repealed. So far, no success. However, by virtue of my losing, and encryption remaining a munition, I should have a constitutional right to keep and bear it.

    Without arguing for or against the exceptions to this constitutional right, munitions that are not covered are those capable of mass destruction. The intelligence and law enforcement community want to make encryption on par with automatic weapons -- something they can have and use against their citizenry without the possibility of the citizenry using it against them.
  • "courts don't have a problem with locking up
    (for years, sometimes) somebody withholding
    subpoenaed evidence (e.g. crypto key passphrase);
    that's called contempt of court at the *least*,
    and possible obstruction of justice."

    I'm not with holding my key I can't remember it.

    Worked for Clinton, must work for us.


  • Hey! Yeah! I we have a right to keep and bear arms, and encryption is considered an armament, we have a Constitutional right to have it!

    Someone call the NRA!
  • A couple friends of mine and I have been mulling over the idea of placing encrypted sig files at the end of our email to each other to keep the NSA, FBI, or whoever busy. The idea, as my friend explained it to me, was to bog them down so much in cracking useless files that they stop, become more selective, or something.

    That, and placing words like 'bomb', 'allah', 'assassinate', 'president', etc. randomly in the body. That was after seeing Enemy of the State.

    We were bored college students, though.

  • I agree with the last point. Even if they pass legislation controlling crypto.. how the heck do they enforce it? If the cops come, I can just encrypt the crypto program with itself. Whos to say a random bit stream on my hard drive is encrypted data, and not just random leftovers from deleted temp files?
  • It's because they want us to believe them when they say that they wont invade privacy. When we dont trust them, and use encryption, Suddenly they cant know what we're talking about, And so they ask us nicely to stop Encrypting things, Not that they want to look at what a nice day you're having and how is your mother doing, They just dont want you to encrypt anything.. yeah.. that's logical, right?

    How do they even know when people are using "Illeagal" encryption unless they're violating privacy in the first place?

    What's next? will it now be illeagal to write letters in a language that the National Security Adviser doesnt understand?

    If it becomes illeagal to protect ourselves, that will only bring on better methods of doing so.

    But wait, Look at it this way: If you make using encryption illeagal, what will that do?
    Arent the people they want to catch, but cant, because of encryption, already breaking the law?

    This is just further proof that the Gov't just doesnt want encryption, so it can invade our privacy more easily.

Slashdot Top Deals

"Nuclear war can ruin your whole compile." -- Karl Lehenbauer

Close