changed 5 years ago  
Published Linked with GitHub

Chapter 14: Other Advanced Crypto Applications

From THE CYPHERNOMICON

14. Other Advanced Crypto Applications

THE CYPHERNOMICON: Cypherpunks FAQ and More, Version 0.666, 1994-09-10, Copyright Timothy C. May. All rights reserved. See the detailed disclaimer. Use short sections under "fair use" provisions, with appropriate credit, but don't put your name on my words.

14.2. SUMMARY: Other Advanced Crypto Applications

14.2.1. Main Points

14.2.2. Connections to Other Sections

14.2.3. Where to Find Additional Information

  • see the various "Crypto" Proceedings for various papers on topics that may come to be important

14.2.4. Miscellaneous Comments

14.3. Digital Timestamping

14.3.1. digital timestamping

  • The canonical reference for digital timestamping is the work of Stu Haber and Scott Stornetta, of Bellcore. Papers presented at various Crypto conferences. Their work involves having the user compute a hash of the document he wishes to be stamped and sending the hash to them, where they merge this hash with other hashes (and all previous hashes, via a tree system) and then they publish the resultant hash in a very public and hard-to-alter forum, such as in an ad in the Sunday "New York Times."
    In their parlance, such an ad is a "widely witnessed event," and attempts to alter all or even many copies of the newspaper would be very difficult and expensive. (In a sense, this WWE is similar to the "beacon" term Eric Hughes used.)
    Haber and Stornetta plan some sort of commercial operation to do this.
    This service has not yet been tested in court, so far as I know. The MIT server is an experiment, and is probably useful for experimenting. But it is undoubtedly even less legally significant, of course.

14.3.2. my summary

14.4. Voting

14.4.2. costs also high

14.4.3. Chaum

14.4.4. voting isomorphic to digital money

  • where account transfers are the thing being voted on, and the "eligible voters" are oneself…unless this sort of thing is outlawed, which would create other problems, then this makes a form of anonymous transfer possible (more or less)

14.5. Timed-Release Crypto

14.5.1. "Can anything like a "cryptographic time capsule" be built?"

  • This would be useful for sealing diaries and records in such a way that no legal bodies could gain access, that even the creator/encryptor would be unable to decrypt the records. Call it "time escrow." Ironically, a much more correct use of the term "escrow" than we saw with the government's various "key escrow" schemes.
  • Making records undecryptable is easy: just use a one-way function and the records are unreachable forever. The trick is to have a way to get them back at some future time.
    • Approaches:
  • Legal Repository. A lawyer or set of lawyers has the key or keys and is instructed to release them at some future time. (The key-holding agents need not be lawyers, of course, though that is the way things are now done.
  • The legal system is a time-honored way of protecting secrets of various kinds, and any system based on cryptography needs to compete strongly with this simple to use, well-established system.
  • If the lawyer's identity is known, he can be subpoenaed. Depends on jurisdictional issues, future political climate, etc.
  • But identity-hiding protocols can be used, so that the lawyer cannot be reached. All that is know, for example, is that "somewhere out there" is an agent who is holding the key(s). Reputation-based systems should work well here: the agent gains little and loses a lot by releasing a key early, hence has no economic motivation to do so. (Picture also a lot of "pinging" going to "rate" the various ti<w agents.)
  • Cryptography with Beacons. A "beacon agent" makes very public a series of messages, somehow. Details fuzzy. [I have a hunch that using digital time-stamping services could be useful here.]
    • Difficulty of factoring, etc.
  • The idea here is to-use a function which is presently hard to invert, but which may be easier in the future. This is fraught with problems, including unpredictability of the difficulty, imprecision in the timing of release, and general clumsiness. As Hal Finney notes:
  • "There was an talk on this topic at either the Crypto 92 or 93 conference, I forget which. It is available in the proceedings…The method used was similar to
    the idea here of encrypting with a public key and requiring factoring of the modulus to decrypt. But the author had more techniques he used, iterating functions forward which would take longer to iterate backwards. The purpose was to give a more predictable time to decrypt…One problem with this
    is that it does not so much put a time floor on the decryption, but rather a cost floor. Someone who is willing to spend enough can decrypt faster than someone who spends less. Another problem is the difficulty of forecasting the growth of computational power per dollar in the future." [Hal Finney, sci.crypt, 1994-8-04]
  • Tamper-resistant modules. A la the scheme to send the secrets to a satellite in orbit and expect that it will be prohibitively expensive to rendezvous and enter this satellite.
  • Or to gain access to tamper-resistant modules located in bank vaults, etc.
  • But court orders and black bag jobs still are factors.

14.5.2. Needs

  • journalism
  • time-stamping is a kind of example
    • though better seen in the conventional analysis
  • persistent institutions
  • shell games for moving money around, untraceably

14.5.3. How

  • beacons
  • multi-part keys
  • contracted-for services (like publishing keys)
  • Wayner, my proposal, Eric Hughes

14.6. Traffic Analysis

14.6.1. digital form, and headers, LEAF fields, etc., make it vastly easier to know who has called whom, for how long, etc.

14.6.2. (esp. in contrast to purely analog systems)

14.7. Steganography

14.7.1. (Another one of the topics that gets a lot of posts)

14.7.2. Hiding messages in other messages

  • "Kevin Brown makes some interesting points about steganography and steganalysis. The issue of recognizing whether a message has or mighthave a hidden message has two sides. One is for the desired recipient to be clued that he should try desteganizing and decrypting the message, and the other is for a possible attacker to discover illegal uses of cryptography.
    "Steganography should be used with a "stealthy" cryptosystem (secret key or public key), one in which the cyphertext is indistinguishable from a random bit string.
    You would not want it to have any headers which could be used to confirm that a desteganized message was other than random noise." [Hal Finney, 1993-05-25]

14.7.3. Peter Wayner's "Mimic"

  • "They encode a secret message inside a harmless looking ASCII text file. This is one of the very few times the UNIX tools "lex" and "yacc" have been used in cryptography, as far as I know. Peter Wayner, "Mimic Functions", CRYPTOLOGIA Volume 16, Number 3, pp. 193-214, July 1992.[Michael Johnson, sci.crypt, 1994-09-05]

14.7.4. I described it in 1988 or 89 and many times since

  • Several years ago I posted to sci.crypt my "novel" idea for packing bits into the essentially inaudible "least significant bits" (LSBs) of digital recordings, such as DATs and CDs. Ditto for the LSBs in an 8-bit image or 24- bit color image. I've since seen this idea reinvented several times on sci.crypt and elsewhere…and I'm willing to bet I wasn't the first, either (so I don't claim any credit).
    A 2-hour DAT contains about 10 Gbits (2 hours x 3600 sec/hr x 2 channels x 16 bits/sample x 44K samples/sec), or about 1.2 Gbytes. A CD contains about half this, i.e., about 700 Mbytes. The LSB of a DAT is 1/16th of the 1.2 Gbytes, or 80 Mbytes. This is a lot of storage!
    A home-recorded DAT–and I use a Sony D-3 DAT Walkman to make tapes–has so much noise down at the LSB level–noise from the A/D and D/A converters, noise from the microphones (if any), etc.–that the bits are essentially random at this level. (This is a subtle, but important, point: a factory recorded DAT or CD will have predetermined bits at all levels, i.e., the authorities could in principle spot any modifications. But home-recorded, or dubbed, DATs will of course not be subject to this kind of analysis.) Some care might be taken to ensure that the statistical properties of the signal bits resemble what would be expected with "noise" bits, but this will be a minor hurdle.
    Adobe Photoshop can be used to easily place message bits in the "noise" that dominates things down at the LSB level. The resulting GIF can then be posted to UseNet or e-mailed. Ditto for sound samples, using the ideas I just described (but typically requiring sound sampling boards, etc.). I've done some experiments along these lines.
    This doesn't mean our problems are solved, of course. Exchanging tapes is cumbersome and vulnerable to stings. But it does help to point out the utter futility of trying to stop the flow of bits.

14.7.5. Stego, other versions

  • Romana Machado's Macintosh stego program is located in the compression files, /cmp, in the sumex-aim@stanford.edu info-
    mac archives.
  • "Stego is a tool that enables you to embed data in, and retrieve data from, Macintosh PICT format files, without changing the appearance of the PICT file. Though its effect is visually undetectable, do not expect cryptographic security from Stego. Be aware that anyone with a copy of Stego can retrieve your data from your PICT file. Stego can be used as an "envelope" to hide a previously encrypted data file in a PICT file, making it much less likely to be detected." [Romana Machado, 1993-1123]

14.7.6. WNSTORM, Arsen Ray Arachelian

14.7.7. talk about it being used to "watermark" images

14.7.8. Crypto and steganography used to plant false and misleading nuclear information

  • "Under a sub-sub-sub-contract I once worked on some phony CAD drawings for the nuclear weapons production process, plotting false info that still appears in popular books, some of which has been posted here…The docs were then
    encrypted and stegonagraphied for authenticity. We were told that they were turned loose on the market for this product in other countries." [John Young, 1994-08-25]
    • Well…

14.7.9. Postscript steganography

14.8. Hiding cyphertext

14.8.1. "Ciphertext can be "uncompressed" to impose desired statistical properties. A non-adaptive first-order arithmetic decompression will generate first-order symbol frequencies that emulate, for instance, English text." [Rick F. Hoselton, sci.crypt, 1994-07-05]

14.9. 'What are tamper-responding or tamper-resistant modules?"

14.9.1. The more modern name for what used to be called "tamper-proof boxes"

14.9.2. Uses:

  • alarmed display cases, pressure-sensitive, etc. (jewels, art, etc.)
  • chips with extra layers, fuses, abrasive comounds in the packaging
  • to slow down grinding, etching, other depotting or decapping methods
  • VLSI Technology Inc. reportedly uses these methods in its implementation of the MYK-78 "Clipper" (EES) chip
  • nuclear weapons ("Permissive Action Links," a la Sandia, Simmons)
  • smartcards that give evidence of tampering, or that become inactive
  • as an example, disk drives that erase data when plug is pulled, unless proper code is first entered
  • whew! pretty risky (power failures and all), but needed by some
    • like "digital flash paper"

14.9.3. Bypassing tamper-responding or tamper-resistant technologies

  • first, you have to know

14.10. Whistleblowing

14.10.1. This was an early proposed use (my comments on it go back to 1988 at least), and resulted in the creation of alt.whisteblowers.

  • So far, nothing too earth-shattering

14.10.2. outing the secret agents of a country, by posting them anonymously to a world-wide Net distribution…that ought to

​​​​shake things up

14.11. Digital Confessionals

14.11.1. religious confessionals and consultations mediated by digital links…very hard for U.S. government to gain access

14.11.2. ditto for attorney-client conversations, for sessions with psychiatrists and doctors, etc.

14.12. Loose Ends

  • more work needed, clearly

Chapter 15: Reputations and Credentials

Select a repo