%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\documentstyle[12pt,twoside,alltt]{article}
\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1996}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture 12 : October 17, 1996 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: Ron Rivest \hfill Scribe: Milyn C. Moy} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{12}{October 15, 1996}{Ron Rivest}{Milyn C. Moy} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Crytography has become a very controversial field. Government and individuals
have different perspectives on using it to secure communications. On one hand,
individuals demand their citizen rights for secrecy. On the other hand, the
National Security Agency is concerned that terrorists, drug dealers, and other
dangerous people might become very difficult to catch if they start using
good cryptographic algorithms.

There are several technical proposals suggested to resolve this controversy:
\begin{itemize}
\item Banning of cryptography.
\item No regulation at all.
\item The regulated use of cryptography, striving for a balance between 
the previous two.
\end{itemize}

Compromises that have been reached:
\begin{itemize}
\item Search and seizure: No wiretapping without warrant.
\item  Export laws: Need a license to export cryptographic output (not very
popular in the commmercial side of the world). Example: need a license to
teach a class in cryptography.
\end{itemize}

Questions have been raised as to what level of cryptography should be easily
accessible to individuals and with what limits.  There is an increasing
need to protect various information infrastructures using encryption.  However,
the government, seeing the potential of misuse of this technology, is pushing
key escrow so that it can gain access to private information.  This
supposedly voluntary act does not make sense if the aim is to deter criminals
since they will find ways around it.
 
Here are examples of some technical proposals that have attempted to reach
a middle ground.

\section{The Clipper Chip}
 
The Clipper proposal fulfills the need for encryption while preserving
the ability of the U.S. government to decrypt the information it
needs. The Clipper Chip is a device that would allow the government to
reconstruct everyone's cryptographic keys, but only with a court order and
with legitimate cause.

Each Clipper chip manufactured by the government uses a secret
algorithm called Skipjack (never published). It contains an 80-bit
key, a unique 32-bit serial number (UID), an 80-bit Family Key (K$_F$)
which is the same for all chips, and an 80-bit Unit Key (K$_U$) unique
to each chip.

For each key K$_U$, an 80-bit random number K$_{U_1}$ is selected,
and then K$_{U_2}$ = K$_U$ $\oplus$ K$_{U_1}$ is computed. Then, K$_U$ =
K$_{U_1}$ $\oplus$ K$_{U_2}$. K$_{U_1}$ and K$_{U_2}$ are kept by two
different escrow agents, which are presumably trustworthy.

Any agency wanting the K$_U$ will have to obtain the necessary keys
from the two escrow agents.  The K$_U$ is then used to initialize a
decrypt processor, which can obtain K$_S$ since it knows both K$_F$
and K$_U$.

When two chips want to communicate, a session key (K$_S$) is chosen
using some mechanism not specified in the Clipper standard. A Law
Enforcement Access Field (LEAF) is transmitted along with the
encrypted data.

The LEAF is computed as follows:
\begin{itemize}
\item The first 80 bits is the session key (K$_S$) encrypted with the unit key
(K$_U$).
\item The next 32 bits is the unique serial number (UID).
\item The last 16 bits are 0's (used to provide redundancy).
\item the above 128 bits are then encrypted using the family key (K$_F$).
\end{itemize}
 
The government can easily decrypt the LEAF with K$_F$. The field UID enables it
to retrieve K$_U$, and then use it to decrypt the session key K$_S$.

Possible problems with Clipper:
\begin{itemize}
\item How secure are the escrow agents? How do they store the keys?
\item Random trash in LEAF could cause encryption line to be broken.
\item If K$_U$ is discovered by the FBI, it can hold it and listen to your past
and present conversations.
\item Somebody could discover K$_F$ and build a device that interoperated with
Clipper devices and foiled wiretapping by generating garbage for UIDs and K$_S$.
\end{itemize}

\section{Based Around PKI}

A Public Key Infrastructure is a network which makes possible secure
financial electronic transactions and exchanges of sensitive information
between relative strangers. A PKI will provide Confidentiality,
Authentication, Integrity, and Non-repudiation support to information
technology applications and electronic commerce transactions. A PKI will:
manage the generation and distribution of Public/Private Key pairs; and
publish the Public Keys with the user's identification as "certificates" in
open bulletin boards (i.e. X.500 Directory Services).

A PKI provides a high degree of confidence that:
\begin{itemize}
\item private keys are kept secure;
\item specific public keys are truly linked to specific private keys; and
\item the party holding a public/private key pair is who the party purports
to be.
\end{itemize}

The PKI will be made up of several central systems known as Certification
Authorities (CA). These CAs are set up in a tree-like hierarchial
structure. Each users' public key and identification are placed in a message
(certificate). The user's CA will digitally sign each certificate and make
the user's public key certificate available through publicly accessible
bulletin boards (i.e. X.500 Directories) along with all other users'
certificates. Therefore any user will be able to get any other user's public
key from a bulletin board and verify that it is authentic by using the CA's
public key to verify the CA's signature on the certificate. The root will
sign the certificates containing the public keys of CAs directly subordinate
to it and these CAs will sign the certificates of any other CAs below
themselves and so on. This process allows Public Keys that are signed by
other CAs in the infrastructure to be verified, since a chain of trust has
been set up between CAs in the infrastructure.


\section{The Lotus Trick}
This is a scheme implemented in Lotus Notes. Individuals believe that
a maximum key size of 40 bits (as allowed by the government for
exports) is not big enough to ensure a secure communication since 40
bits is easy to break. Thus, Lotus came up with the idea of using an $n$
bit key with $n > 40$ (e.g. 128 bits). In order to conform
with the government, the cyphertext will be encrypted using an $n$ bits
key and it will carry along with it the first $n-40$ bits encrypted with
a federal agency's public key, such as the public key of the NSA. Only
the other 40 bits of the key that are left are kept secret from the
respective federal agency. 40-bits is not very difficult to break,
but it is not trivial.

This scheme can become more sophisticated. If it is desired that two
federal agencies be required to be able to decrypt the first $n-40$ bits
of the key, then those bits can be xor-ed with a $n-40$ bit pad.  One
of the agencies (e.g. the NSA) gets the resulting cyphertext, and the
other one (e.g. ACLU) gets the pad. Thus, to get the first $n-40$
bits of the key, the two agencies have to work together and xor their
respective shares. Then, the federal agencies will still have to work
to break the other 40 bits to obtain the complete key and be able to
listen in.


\section{Translucent}
Translucent Cryptography is another ``key escrow'' technique useful for
the government to access encrypted communications. It was developed by
Ron Rivest in 1996.  Its name comes from the fact that it explores the
``transparent'' (encryption without key escrow or no encryption at
all) and ``opaque'' (encryption with key escrow) space. The main idea
is that a set of n keys is being used for encryption of the
communication (with the particular key being chosen at random from
among the n). Then, certain fractions of the set of keys are given to
different agencies (e.g. 5 to the FBI, 3 to the NSA, etc.).

Then, each agency can only decrypt a certain percentage of the communications
it is monitoring. Several agencies getting together will be able to decrypt
more. This scheme also prevents a certain agency from being able to 
decrypt previous/future conversations using the particular key they have.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
