THE  CYPHERNOMICON: Cypherpunks FAQ and More, Version 0.666,
   1994-09-10, Copyright Timothy C. May. All rights reserved.
   See the detailed disclaimer. Use short sections under "fair
   use" provisions, with appropriate credit, but don't put your
   name on my words.

14.2.1. Main Points
14.2.2. Connections to Other Sections
14.2.3. Where to Find Additional Information
  - see the various "Crypto" Proceedings for various papers on
     topics that may come to be important
14.2.4. Miscellaneous Comments

14.3.1. digital timestamping
  - The canonical reference for digital timestamping is the
     work of Stu Haber and Scott Stornetta, of Bellcore. Papers
     presented at various Crypto conferences. Their work
     involves having the user compute a hash of the document he
     wishes to be stamped and sending the hash to them, where
     they merge this hash with other hashes (and all previous
     hashes, via a tree system) and then they *publish* the
     resultant hash in a very public and hard-to-alter forum,
     such as in an ad in the Sunday "New York Times."
     
     In their parlance, such an ad is a "widely witnessed
     event," and attempts to alter all or even many copies of
     the newspaper would be very difficult and expensive. (In a
     sense, this WWE is similar to the "beacon" term Eric Hughes
     used.)
     
     Haber and Stornetta plan some sort of commercial operation
     to do this.
     
     This service has not yet been tested in court, so far as I
     know. The MIT server is an experiment, and is probably
     useful for experimenting. But it is undoubtedly even less
     legally significant, of course.
14.3.2. my summary

14.4.1. fraud, is-a-person, forging identies, increased "number"
   trends
14.4.2. costs also high
14.4.3. Chaum
14.4.4. voting isomorphic to digital money
  - where account transfers are the thing being voted on, and
     the "eligible voters" are oneself...unless this sort of
     thing is outlawed, which would create other problems, then
     this makes a form of anonymous transfer possible (more or
     less)

14.5.1. "Can anything like a "cryptographic time capsule" be built?"
  - This would be useful for sealing diaries and records in
     such a way that no legal bodies could gain access, that
     even the creator/encryptor would be unable to decrypt the
     records. Call it "time escrow." Ironically, a much more
     correct use of the term "escrow" than we saw with the
     government's various "key escrow" schemes.
  - Making records undecryptable is easy: just use a one-way
     function and the records are unreachable forever. The trick
     is to have a way to get them back at some future time.
  + Approaches:
    + Legal Repository. A lawyer or set of lawyers has the key
       or keys and is instructed to release them at some future
       time. (The key-holding agents need not be lawyers, of
       course, though that is the way things are now done.
      - The legal system is a time-honored way of protecting
         secrets of various kinds, and any system based on
         cryptography needs to compete strongly with this simple
         to use, well-established system.
      - If the lawyer's identity is known, he can be
         subpoenaed. Depends on jurisdictional issues, future
         political climate, etc.
      - But identity-hiding protocols can be used, so that the
         lawyer cannot be reached. All that is know, for
         example, is that "somewhere out there" is an agent who
         is holding the key(s). Reputation-based systems should
         work well here: the agent gains little and loses a lot
         by releasing a key early, hence has no economic
         motivation to do so. (Picture also a lot of "pinging"
         going to "rate" the various ti
14.6 -  Traffic Analysis

14.6.1. digital form, and headers, LEAF fields, etc., make it vastly
   easier to know who has called whom, for how long, etc.
14.6.2. (esp. in contrast to purely analog systems)


14.7 -  Steganography

14.7.1. (Another one of the topics that gets a lot of posts)
14.7.2. Hiding messages in other messages
  - "Kevin Brown makes some interesting points about
     steganography and steganalysis.  The issue of recognizing
     whether a message has or mighthave a hidden message has two
     sides.  One is for the desired recipient to be clued that
     he should try desteganizing and decrypting the message, and
     the other is for a possible attacker to discover illegal
     uses of cryptography.
     
     "Steganography should be used with a "stealthy"
     cryptosystem (secret key or public key), one in which the
     cyphertext is indistinguishable from a random bit string.
     You would not want it to have any headers which could be
     used to confirm that a desteganized message was other than
     random noise." [Hal Finney, 1993-05-25]
14.7.3. Peter Wayner's "Mimic"
  - "They encode a secret message inside a harmless looking
     ASCII text file.  This is one of the very few times
     the UNIX tools "lex" and "yacc" have been used in
     cryptography, as far as I know.   Peter Wayner, "Mimic
     Functions", CRYPTOLOGIA Volume 16, Number 3, pp. 193-214,
     July 1992.[Michael Johnson, sci.crypt, 1994-09-05]
14.7.4. I described it in 1988 or 89 and many times since
  - Several years ago I posted to sci.crypt my "novel" idea for
     packing bits into the essentially inaudible "least
     significant bits" (LSBs) of digital recordings, such as
     DATs and CDs. Ditto for the LSBs in an 8-bit image or 24-
     bit color image. I've since seen this idea reinvented
     _several_ times on sci.crypt and elsewhere...and I'm
     willing to bet I wasn't the first, either (so I don't claim
     any credit).
     
     A 2-hour DAT contains about 10 Gbits (2 hours x 3600 sec/hr
     x 2 channels x 16 bits/sample x 44K samples/sec), or about
     1.2 Gbytes. A CD contains about half this, i.e., about 700
     Mbytes. The LSB of a DAT is 1/16th of the 1.2 Gbytes, or 80
     Mbytes. This is a _lot_ of storage!
     
     A home-recorded DAT--and I use a Sony D-3 DAT Walkman to
     make tapes--has so much noise down at the LSB level--noise
     from the A/D and D/A converters, noise from the microphones
     (if any), etc.--that the bits are essentially random at
     this level. (This is a subtle, but important, point: a
     factory recorded DAT or CD will have predetermined bits at
     all levels, i.e., the authorities could in principle spot
     any modifications. But home-recorded, or dubbed, DATs will
     of course not be subject to this kind of analysis.) Some
     care might be taken to ensure that the statistical
     properties of the signal bits resemble what would be
     expected with "noise" bits, but this will be a minor
     hurdle.
     
     Adobe Photoshop can be used to easily place message bits in
     the "noise" that dominates things down at the LSB level.
     The resulting GIF can then be posted to UseNet or e-mailed.
     Ditto for sound samples, using the ideas I just described
     (but typically requiring sound sampling boards, etc.). I've
     done some experiments along these lines.
     
     This doesn't mean our problems are solved, of course.
     Exchanging tapes is cumbersome and vulnerable to stings.
     But it does help to point out the utter futility of trying
     to stop the flow of bits.
14.7.5. Stego, other versions
  - Romana Machado's Macintosh stego program is located in the
     compression files, /cmp, in the sumex-aim@stanford.edu info-
     mac archives.
  - "Stego is a tool that enables you to embed data in, and
     retrieve data from, Macintosh PICT format files, without
     changing the appearance of the PICT file.  Though its
     effect is visually undetectable, do not expect
     cryptographic security from Stego.  Be aware that anyone
     with a copy of Stego can retrieve your data from your PICT
     file.  Stego  can  be used as an "envelope" to hide a
     _previously encrypted_ data file in a PICT file, making it
     much less likely to be detected." [Romana Machado, 1993-11-
     23]
14.7.6. WNSTORM, Arsen Ray Arachelian
14.7.7. talk about it being used to "watermark" images
14.7.8. Crypto and steganography used to plant false and misleading
   nuclear information
  - "Under a sub-sub-sub-contract I once worked on some phony
     CAD drawings for the nuclear weapons production process,
     plotting false info that still appears in popular books,
     some of which has been posted here....The docs were then
     encrypted and stegonagraphied for authenticity.  We were
     told that they were turned loose on the market for this
     product in other countries." [John Young, 1994-08-25]
  - Well...
14.7.9. Postscript steganography
  - where info is embedded in spacings, font characteristics
     (angles, arcs)
  - ftp://research.att.com/dist/brassil/infocom94.ps
  - the essential point: just another haystack to hide a needle


14.8 -  Hiding cyphertext

14.8.1. "Ciphertext can be "uncompressed" to impose desired
   statistical properties.  A non-adaptive first-order
   arithmetic decompression will generate first-order symbol
   frequencies that emulate, for instance, English text." [Rick
   F. Hoselton, sci.crypt, 1994-07-05]


14.9 -  "What are tamper-responding or tamper-resistant modules?"

14.9.1. The more modern name for what used to be called "tamper-proof
   boxes"
14.9.2. Uses:
  - alarmed display cases, pressure-sensitive, etc. (jewels,
     art, etc.)
  + chips with extra layers, fuses, abrasive comounds in the
     packaging
    - to slow down grinding, etching, other depotting or
       decapping methods
    - VLSI Technology Inc. reportedly uses these methods in its
       implementation of the MYK-78 "Clipper" (EES) chip
  - nuclear weapons ("Permissive Action Links," a la Sandia,
     Simmons)
  - smartcards that give evidence of tampering, or that become
     inactive
  + as an example, disk drives that erase data when plug is
     pulled, unless proper code is first entered
    - whew! pretty risky (power failures and all), but needed
       by some
    - like "digital flash paper"
14.9.3. Bypassing tamper-responding or tamper-resistant technologies
  - first, you have to _know_


14.10 -  Whistleblowing

14.10.1. This was an early proposed use (my comments on it go back to
   1988 at least), and resulted in the creation of
   alt.whisteblowers.
  - So far, nothing too earth-shattering
14.10.2. outing the secret agents of a country, by posting them
   anonymously to a world-wide Net distribution....that ought to
   shake things up


14.11 -  Digital Confessionals

14.11.1. religious confessionals and consultations mediated by digital
   links...very hard for U.S. government to gain access
14.11.2. ditto for attorney-client conversations, for sessions with
   psychiatrists and doctors, etc.
14.11.3. (this does not meen these meetings are exempt from the
   law...witness Feds going after tainted legal fees, and
   bugging offices of attorneys suspected of being in the drug
   business)


14.12 -  Loose Ends

14.12.1. Feigenbaum's "Computing with Encrypted Instances"
   work...links to Eric Hughes's "encrypted open books" ideas.
  - more work needed, clearly