Thursday, September 11, 1997

Wikipedia - Advanced Encryption Standard process

On January 2, 1997, NIST announced that they wished to choose a successor to DES to be known as AES. Like DES, this was to be "an unclassified, publicly disclosed encryption algorithm capable of protecting sensitive government information well into the next century." However, rather than simply publishing a successor, NIST asked for input from interested parties on how the successor should be chosen. Interest from the open cryptographic community was immediately intense, and NIST received a great many submissions during the three-month comment period.

The result of this feedback was a call for new algorithms on September 12, 1997. The algorithms were all to be block ciphers, supporting a block size of 128 bits and key sizes of 128, 192, and 256 bits. Such ciphers were rare at the time of the announcement; the best known was probably Square. 

Tuesday, August 26, 1997

New York Times - New Subtle Bug Infests PGP

In other recent news, computer hackers at the Hacking In Progress conference also announced that they had scanned in a paper copy of the source code of PGP 5.0. The company released the source code to lessen the fears of users that a secret backdoor may have been inserted in the software.

Paper copies of the software were exported because the United States government has never objected to the export of paper. The paper versions are more obviously protected by the First Amendment than the electronic versions.

Sunday, August 10, 1997

Who's Hacking Whom? HOPE Springs in Manhattan

Melding Minds and Passions in the Global Bit Stream

What Galls a Hacker Most? The Metrocard

Cypherpunks list - CFP: What the Hack '05 and Blind Signature Expiration Party

HIP '97 and the Summer that surrounded it represented a pivotal event in my and many other attendee's lives. 1997 was the peek of the Crypto Wars: while strong cryptography was spreading rapidly throughout the world from authors outside the U.S., most, if not all, I consider dear friends, the U.S. Government continued to insist on imposing draconian export regulations. 3DES? 1024-bit RSA? Forget it.

In about May '97, PGP, Inc. released printed copies of the PGP 5 source code in full compliance with the U.S. export regulations in effect at the time. Electronic copy was illegal, but printed books were fine. Having attended the source code release event, at a Cypherpunks meeting, I walked away with two copies of the printed source. The source code books spanned many boxes. I hurt my back lifting those heavy boxes into the trunk of my car. My back to this day never fully recovered. Equally in compliance with the export laws, I immediately fedexed those boxes at my own expense to individuals in Europe standing by with scanners equipped with sheet feeders to OCR the source.

Three months later, the OCR effort had stalled. While most pages had been OCR'ed, passing the per-page checksums, many pages remained unprocessed. In some cases this was because one of the numerous proof readers failed to return the result. In the more challenging cases it was because the checksum differentiated between spaces and tabs. We learned that consumer-level OCR programs are dismal at differentiating between 5 or 6 leading spaces. Or a tab.

At HIP '97 on a camp ground near Amsterdam, many breakthroughs happened.

...

My precise words, if I recall correctly, were: "Come Hell or high water, before HIP is over, the proofreading of the PGP source code *will* be completed". Followed by a call for non-U.S. citizen volunteers to report to the Cypherpunks tent to finish the job. And finish the job they did. Visualize a scene most akin to "The Matrix", with a gaggle of volunteers frantically working on a row of computers held up by beer crates, writing scripts to brute force the OCR output past the checksums, while a raging party with dancers literally hanging off the rafters took up the core of the tent space, music blasting from the sound system in the early morning hours. Special thanks go to Ian Grigg, who lead the team of volunteers.

On the last day of HIP, the last page of the PGP 5 source had passed the last checksum. As the volunteers retired to bed after in most cases over 48 hours of straight work, one lone hold-out decided that now that the source code had been legally exported and turned into electronic form, somebody ought to compile it. He proceeded to compile the PGP 5 source on a PC that I had hand-carried to HIP in my luggage. The source compiled without errors. I was sound asleep at the time. By the time I woke up, cryptography had entered a new era: the U.S. Government, and in fact the entire world, woke up to a day from which on the only path remaing to stem the flow of strong crypto out of the U.S. was to ban books. And even the staunchest advocates of cryptographic export regulations knew that albeit the U.S. Supreme Court Justices may perhaps be bamboozled by declarations of the dangers of this new "Internet" thing, banning books was a proposal not in the least novel to the Court, standing no chance of meeting with the Justices approval.

Cornered into an untenable position and with no help from the courts in sight, the U.S. Government eventually acknowledged the inevitable and relaxed the exports laws for strong cryptography to the point of insignificance in January of 2000.

Saturday, August 9, 1997

A Community Sprouts In a Culture That Resists It

RADIO: interview with the Cypherpunks

PGP is a program protected by American law. This means that you are not allowed to export the program in its electronic form. The cypherpunks found a way around this problem, and think they'll have a legal running copy of PGP 5 this weekend.

Flickr - Image 7 - 8:9:97

38th Chaos Communication Congress