August 28, 2016

Archives for April 2005


New ClipBlog Site

My clipblog has moved to DashLog, a new clipblogging site. My clipblog gives quick pointers to interesting sites or pages, with only minimal commentary. It’s designed as a complement to this blog.

New addresses for my clipblog:


U.S. Considering Wireless Passport Protection

The U.S. government is “taking a very serious look” at improving privacy protection for the new wireless-readable passports, according to an official quoted in a great article by Kim Zetter at Wired News. Many people, including me, have worried about the privacy implications of having passports that are readable at a distance.

The previously proposed system would transmit all of the information stored on the inside cover of the passport – name, date and place of birth, (digitzed) photo, etc. – to any device that is close enough to beam a signal to the passport and receive the passport’s return signal.

The improved system, which is called “Basic Access Control” in the specification, would use a cryptographic protocol between the passport and a reader device. The protocol would require the reader device to prove that it knew the contents of the machine-readable text on the inside cover of the passport (the bottom two lines of textish stuff on a U.S. passport), before the passport would release any information. The released information would also be encrypted so that an eavesdropper could not capture it.

I have not done a detailed security analysis of the crypto protocols, so I can’t vouch for their security. Juels, Molnar, and Wagner point out some protocol flaws (in the Basic Access Control protocol) that are probably not a big deal in practice. I’ll assume here that the protocols are secure enough.

The point of these protocols is to release the digital information only to an entity that can prove it already has had access to information on the inside of the passport. Since the information stored digitally is already visible (in analog form, at least) to somebody who has that access, the privacy risk is vastly reduced, and it becomes impossible for a stranger to read your passport without your knowledge.

You might ask what is the point of storing the information digitally when it can be read digitally only by somebody who has access to the same information in analog form. There are two answers. First, the digital form can be harder to forge, because the digital information can be digitally signed by the issuing government. Assuming the digital signature scheme is secure, this makes it impossible to modify the information in a passport or to replace the photo, steps which apparently aren’t too difficult with paper-only passports. (It’s still possible to copy a passport despite the digital signature, but that seems like a lesser problem than passport modification.) Second, the digital form is more susceptible to electronic record-keeping and lookup in databases, which serves various governmental purposes, either legitimate or (for some governments) nefarious.

The cryptographic protocols now being considered were part of the digital-passport standard already, as an optional feature that each country could choose to adopt or not. The U.S. had previously chosen not to adopt it, but is now thinking about reversing that decision. It’s good to see the government taking the passport privacy issue seriously.


Recommended Reading

Following the lead of other bloggers, I’ll be writing occasionally to recommend books or articles that I found interesting. Today, I’m recommending two books that could hardly be more different in topic and tone.

The 9/11 Commission Report

This book was a real surprise. I started reading from a sense of obligation, but I was quickly hooked. It isn’t light reading, and parts are simply horrifying; but it explains the events of 9/11, their causes, and the aftermath with admirable depth and clarity. Most surprising of all is the quality of the writing, which rivals the best journalism or historical writing. The tick-tock in Chapter 1 is riveting and will surely be the definitive account of what happened that day.

The Commission had broad access to documents and people, a sizeable staff, and bipartisan national support, all of which allowed them to see clearly the history of the 9/11 plot, the U.S. government’s efforts to deal with al Qaida over the years, and the response to the attacks. Much of this is eye-opening. The sheer chaos and lack of information flow that confronted first responders is sobering. We also see the national security community’s wavering focus on the al Qaida threat and the gathering of significant intelligence about it, coupled with a cultural inability to strike boldly against it before 9/11.

Overall, the report was much better than I expected – much better, really, than a government commission report has any right to be.

Rammer Jammer Yellow Hammer: A Journey into the Heart of Fan Mania, by Warren St. John

Bummed out by the 9/11 report? This book is the antidote. It’s a group portrait of the most rabid University of Alabama football fans, written by a New York journalist who grew up in Alabama and knows firsthand the lure of Bama football. It’s a nicely polished little book packed with laugh-out-loud moments.

A typical vignette introduces a couple who skipped their own daughter’s wedding to go to a Bama football game. (The game got over in time for them to attend the reception.) They seem like fairly normal people, and when asked to explain why they did this thing, they’re at a loss. The author reports asking many Alabamans what they thought of the couple’s story. Three-quarters shook their heads and wondered why in the world loving parents could skip their daughter’s wedding. The other quarter shook their heads and wondered why in the world a loving daughter would schedule her wedding on the day of the Tennessee game.

The beauty of the book is that the author doesn’t caricature the fans. He tells their stories sympathetically, and one comes to see their obsession as not so different from the obsessions or hobbies that many of us have. Indeed, the author himself is gently pulled into their community, buying himself an RV and driving it to the games just like the most devoted fans. He weaves together the stories of the fans, his own story of being drawn into their world, and references to academic studies of fans and their behavior, into a revealing and very entertaining mix. I’m a big fan of this book.


"Censorship" Bill Lifts Ban on Speech

The House has now joined the Senate in passing the Family Movie Act; the Act is almost sure to be signed into law soon by the President. (The Act is bundled with some unrelated provisions into a multi-part bill called the Family Entertainment and Copyright Act. Here I’ll focus only on Section 201, called the Family Movie Act, or “FMA”.)

Some people who haven’t read the FMA, or haven’t thought carefully enough about what it says, decry it as censorship. In fact, it is best understood as an anti-censorship proposal.

The Register, under the headline “Congress legalizes DVD Censorship” summarizes the FMA as follows:

It will soon become legal to alter a motion picture so long as all the sex, profanity, and violence have been edited out, thanks to a bill called the Family Movie Act…

Let’s look at what the FMA actually says:

[The following is not an infringement of copyright:]

the making imperceptible, by or at the direction of a member of a private household, of limited portions of audio or video content of a motion picture, during a performance in or transmitted to that household for private home viewing, from an authorized copy of the motion picture, or the creation or provision of a computer program or other technology that enables such making imperceptible and that is designed and marketed to be used, at the direction of a member of a private household, for such making imperceptible, if no fixed copy of the altered version of the motion picture is created by such computer program or other technology.

There is nothing here (or elsewhere in the FMA) that says you can only skip the dirty bits. The FMA says that you can skip any portions of the movie you like, as long as the portions you skip are “limited”. You can skip the clean parts if you want, as long as they make up only a limited portion, which may be the case for some movies. If the motion picture has commercials in it, you can skip the commercials. If you don’t like the soccer scenes in “Bend It Like Beckham”, you can watch the movie without them.

The soccer-free version of “Bend It Like Beckham” is speech. The FMA allows that speech to occur, by preventing a copyright owner from suing to block it. And the FMA does this in an ideal way, ensuring that the copyright owner on the original work will be paid for the use of their work. That’s the purpose of the “from an authorized copy” and “no fixed copy” language – to ensure that a valid copy of the original work is needed in order to view the new, modified work.

Let’s review. The FMA prevents no speech. The FMA allows more speech. The FMA prevents private parties from suing to stop speech they don’t like. The FMA is not censorship. The FMA prevents censorship.


Berkeley to victims of personal data theft: "Our bad"

Last week I and 98,000 other lucky individuals received the following letter:

University of California, Berkeley
Graduate Division
Berkeley, California 94720-5900

Dear John Alexander Halderman:

I am writing to advise you that a computer in the Graduate Division at UC Berkeley was stolen by an as-yet unidentified individual on March 11, 2005. The computer contained data files with names and Social Security numbers of some individuals, including you, who applied to be or who were graduate students, or were otherwise affiliated with the University of California.

At this time we have no evidence that personal data were actually retrieved or misused by any unauthorized person. However, because we take very seriously our obligation to safeguard personal information entrusted to us, we are bringing this situation to your attention along with the following helpful information.

You may want to take the precaution of placing a fraud alert on your credit file. This lets creditors know to contact you before opening new accounts in your name. This is a free service which you can use by calling one of the credit bureau telephone numbers:

Equifax 1-800-525-6285     Experian 1-888-397-3742     Trans Union 1-800-680-7289

To alert individuals that we may not have reached directly, we have issued a press release describing the theft. We encourage you to check for more details on our Web site at The following Web sites and telephone numbers also offer useful information on identity theft and consumer fraud.

California Department of Consumer Affairs, Office of Privacy Protection:

Federal Trade Commission’s Website on identity theft:

Social Security Administration fraud line: 1-800-269-0271

Unfortunately, disreputable persons may contact you, falsely identifying themselves as affiliated with US Berkeley and offer to help. Please be aware that UC Berkeley will only contact you if you ask us, by email or telephone, for information. We recommend that you do not release personal information in response to any contacts of this nature that you have not initiated.

UC Berkeley deeply regrets this possible breach of confidentiality. Please be assured that we have taken immediate steps to further safeguard the personal information maintained by us. If you have any questions about this matter, please feel free to contact us at or toll free at 1-800-372-5110.

Jeffrey A. Reimer
Associate Dean

In a few days I’ll post more about my experience with the “fraud alert” procedure.

UPDATE 11:45pm – I should add that I gave Berkeley my ‘personal data’ when I applied to their computer science PhD program in 2003. (I ended up at Princeton.) Why, two years later, are they still holding on to this information?


Why Does Anybody Believe Viralg?

A story is circulating about a Finnish company called Viralg, which claims to have a product that “blocks out all illegal swapping of your data”. There is also a press release from Viralg.

This shows all the signs of being a scam or hoax. The company’s website offers virtually nothing beyond claims to be able to totally eradicate file swapping of targeted files. The “Company” page has no information about the company or who works for it. The “Customers” page does not mention any specific customers. The “Testimonials” page has no actual testimonials from customers or anybody else. The “Services” page refers to independent testing but gives no information about who did the testing or what specifically they found. The “Contacts” page lists only an email address. There is no description of the company’s technology, except to say that it is a “virtual algorithm”, whatever that means. Neither the website nor the Viralg press release nor any of the press coverage mentions the name of any person affiliated with Viralg. The press release uses nonsense technobabble like “super randomized corruption”.

The only real technical information available is in a patent application from Viralg, which describes standard, well-known methods for spoofing content in Kazaa and other filesharing networks. If this is the Viralg technology, it certainly doesn’t provide what the website and press release claim.

My strong suspicion is that the headline on the Slashdot story – “Finnish Firm Claims Fake P2P Hash Technology” – is correct. But it’s not the hashes that look fake, it’s the technology.


Next-Gen DVD Encryption: Better, but Won't Stop Filesharing

Last week, specifications were released for AACS, an encryption-based system that may be used on next-generation DVDs. You may recall that CSS, which is currently used on DVDs, is badly misdesigned, to the point that I sometimes use it in teaching as an example of how not to use crypto. It’s still a mystery how CSS was bungled so badly. But whatever went wrong last time wasn’t repeated this time – AACS seems to be very competently designed.

The design of AACS seems aimed at limiting entry to the market for next-gen DVD players. It will probably succeed at that goal. What it won’t do is prevent unauthorized filesharing of movies.

To understand why it meets one goal and not the other, let’s look more closely at how AACS manages cryptographic keys. The details are complicated, so I’ll simplify things a bit. (For full details see Chapter 3 of the AACS spec, or the description of the Subset Difference Method by Naor, Naor, and Lotspiech.) Each player device is assigned a DeviceID (which might not be unique to that device), and is given decryption keys that correspond to its DeviceID. When a disc is made, a random “disc key” is generated and the video content on the disc is encrypted under the disc key. The disc key is encrypted in a special way and is then written onto the disc.

When a player device wants to read a disc, the player first uses its own decryption keys (which, remember, are specific to the player’s DeviceID) to unlock the disc key; then it uses the disc key to unlock the content.

This scheme limits entry to the market for players, because you can’t build a player without getting a valid DeviceID and the corresponding secret keys. This allows the central licensing authority, which hands out DeviceIDs and keys, to control who can make players. But there’s another way to get that information – you could reverse-engineer another player device and extract its DeviceID and keys, and then you could make your own players, without permission from the licensing authority.

To stop this, the licensing authority will maintain a blacklist of “compromised” DeviceIDs. Newly manufactured discs will be made so that their disc keys can be unlocked only by DeviceIDs that aren’t on the blacklist. If a DeviceID is added to the blacklist today, then players with that DeviceID won’t be able to play discs that are manufactured in the future; but they will still be able to play discs manufactured in the past.

CSS used a scheme rather like this, but there were only a few distinct DeviceIDs. A large number of devices shared a DeviceID, and so blacklisting a DeviceID would have caused lots of player devices in the field to break. This made blacklisting essentially useless in CSS. AACS, by contrast, uses some fancy cryptography to increase the number of distinct DeviceIDs to about two billion (2 to the 31st power). Because of this, a DeviceID will belong to one device, or at most a few devices, making blacklisting practical.

This looks like a good plan for controlling entry to the market. Suppose I want to go into the player market, without signing a license with the licensing authority. I can reverse-engineer a few players to get their DeviceIDs and keys, and then build those into my product. The licensing authority will respond by figuring out which DeviceIDs I’m using, and revoking them. Then the players I have sold won’t be able to play new discs anymore, and customers will shun me.

This plan won’t stop filesharing, though. If somebody, somewhere makes his own player using a reverse-engineered DeviceID, and doesn’t release that player to the public, then he will be able to use it with impunity to play or rip discs. His DeviceID can only be blacklisted if the licensing authority learns what it is, and the authority can’t do that without getting a copy of the player. Even if a player is released to the public, it will still make all existing discs rippable. New discs may not be rippable, at least for a while, but we can expect new reverse-engineered DeviceIDs to pop up from time to time, with each one making all existing discs rippable. And, of course, none of this stops other means of ripping or capturing content, such as capturing the output of a player or infiltrating the production process.

Once again, DRM will limit competition without reducing infringement. Companies are welcome to try tactics like these. But why should our public policy support them?

UPDATE (11:30 AM): Eric Rescorla has two nice posts about AACS, making similar arguments.


Texas Bill Would Close Meetings About Computer Security

A bill (HB 3245) introduced in the Texas state legislature would exempt meetings discussing “matters relating to computer security or the security of other information resources technologies” from the state’s Open Meetings Act.

This seems like a bad idea. Meetings can already be closed if sufficient cause is shown. The mere fact that computer security, or matters relating to it, will be discussed should not in itself be sufficient cause to close a meeting. Computer security is a topic on which Texas, or any state or national government, needs all the help it can get. The public includes many experts who are willing to help. Why shut them out?

The bill is scheduled for a hearing on Monday in the Texas House State Affairs Committee. If you live in Texas, you might want to let the committee members know what you think about this.

(Thanks to Adina Levin for bringing this to my attention.)


Why Use Remotely-Readable Passports?

Yesterday at CFP, I saw an interesting panel on the proposed radio-enabled passports. Frank Moss, a State Department employee and accomplished career diplomat, is the U.S. government’s point man on this issue. He had the guts to show up at CFP and face a mostly hostile audience. He clearly believes that he and the government made the right decision, but I’m not convinced.

The new passports, if adopted, will contain a chip that stores everything on the passport’s information page: name, date and place of birth, and digitized photo. This information will be readable by a radio protocol. Many people worry that bad guys will detect and read passports surreptitiously, as people walk down the street.

Mr. Moss said repeatedly that the chip can only be read at a distance of 10 centimeters (four inches, for the metric-impaired), making surreptitious reading unlikely. Later in the panel, Barry Steinhardt of the ACLU did a live demo in which he read information off the proposed radio-chip at a distance of about one meter, using a reader device about the size of a (closed) laptop. I have no doubt that this distance could be increased by engineering the reader more aggressively.

There was lots of back-and-forth about partial safeguards that might be added, such as building some kind of foil or wires into the passport cover so that the chip could only be read when the passport was open. Such steps do reduce the vulnerability of using remotely-readable passports, but they don’t reduce it to zero.

In the Q&A session, I asked Mr. Moss directly why the decision was made to use a remotely readable chip rather than one that can only be read by physical contact. Technically, this decision is nearly indefensible, unless one wants to be able to read passports without notifying their owners – which, officially at least, is not a goal of the U.S. government’s program. Mr. Moss gave a pretty weak answer, which amounted to an assertion that it would have been too difficult to agree on a standard for contact-based reading of passports. This wasn’t very convincing, since the smart-card standard could be applied to passports nearly as-is – the only change necessary would be to specify exactly where on the passport the smart-card contacts would be. The standardization and security problems associated with contactless cards seem to be much more serious.

After the panel, I discussed this issue with Kenn Cukier of The Economist, who has followed the development of this technology for a while and has a good perspective on how we reached the current state. It seems that the decision to use contactless technology was made without fully understanding its consequences, relying on technical assurances from people who had products to sell. Now that the problems with that decision have become obvious, it’s late in the process and would be expensive and embarrassing to back out. In short, this looks like another flawed technology procurement program.


RIAA Suing i2hub Users

Yesterday the RIAA announced lawsuits against many college students for allegedly using a program called i2hub to swap copyrighted music files. RIAA is trying to paint this as an important step in their anti-infringement strategy, but it looks to me like a continuation of what they have already been doing: suing individuals for direct infringement, and trying to label filesharing technologies (as opposed to infringing uses of them) as per se illegal.

The new angle in this round of suits is that i2hub traffic uses the Internet2 network. The RIAA press release is careful to call Internet2 a “specialized” network, but many press stories have depicted it a private network, separate from the main Internet. In fact, Internet2 is not really a separate network. It’s more like a set of express lanes for the Internet, built so that network traffic between Internet2 member institutions can go faster.

(The Washington Post article gets this point seriously wrong, calling Internet2 “a faster version of the Web”, and saying that “more and more college students have moved off the Web to trade music on Internet2, a separate network …”.)

Internet2 has probably been carrying a nonzero amount of infringing traffic for a long time, just because it is part of the Internet. What’s different about i2hub is not that some of its traffic goes over Internet2, but that it was apparently structured so that its traffic would usually travel over Internet2 links. In theory, this could make transfer of any large file, whether infringing or not, faster.

The extra speed of Internet2 doesn’t seem like much of an issue for music files, though. Music files are quite small and can be downloaded pretty quickly on ordinary broadband connections. Any speedup from using i2hub would mainly affect movie downloads, since movie files are much larger than music files. And yet it was the music industry, not the movie industry, that brought these suits.

Given all of this, my guess is that the RIAA is pushing the Internet2 angle mostly for policial and public relations reasons. By painting Internet2 as a separate network, the RIAA can imply that the transfer of infringing files over Internet2 is a new kind of problem requiring new regulation. And by painting Internet2 as a centrally-managed entity, the RIAA can imply that it is more regulable than the rest of the Internet.

Another unique aspect of i2hub is that it could only be used, supposedly, by people at univerisities that belong to the Internet2 consortium, which includes more than 200 schools. The i2hub website pitches it as a service just “by students, for students”. Some have characterized i2hub as a private filesharing network. That may be true in a formal sense, as not everybody could get onto i2hub. But the potential membership was so large that i2hub was, for all intents and purposes, a public system. We don’t know exactly how the RIAA or its agents got access to i2hub to gather the information behind the suits, but it’s not at all surprising that they were able to do so. If students thought that they couldn’t get caught if they shared files on i2hub, they were sadly mistaken.

[Disclaimer: Although some Princeton students are reportedly being sued, nothing in this post is based on inside information from those students (whoever they are) or from Princeton. As usual, I am not speaking for Princeton.]