We've got a nice crowd today.
I'd like to welcome you all to the Distinguished Lecture
series.
We have the pleasure of having Bob Morris here
to talk to us about the protection
of valuable information.
And before we get into that, I'd like
to continue with the tradition of giving a somewhat
extended bio to our attended group
here, particularly the new students, who
like to take our distinguished speakers as role models.
And so we'll do a little of that.
Mike [INAUDIBLE] is unfortunately ill with the flu.
Otherwise, we would have had him play the traditional role.
So Bob Morris is a legendary figure
in many areas of computer security in particular.
He was born in Boston, grew up in northern Connecticut
and went to school at Exeter, and then went
to this little school down the street
that sometimes has tried to an excess but has always failed.
Majored in--
[INAUDIBLE]?
That direction.
Majored in chemistry, but actually,
during the middle of his career at Harvard, he
was drafted and spent a couple of years in Germany
as a signal [INAUDIBLE] Heidelberg,
working with the radio there.
And was majoring in chemistry, and then changed his mind
just as he got near the end of his career at Harvard,
and decided he didn't want to be a salesman for DuPont.
And so he switched to a math major his senior year, math
being one of the fields he recognized
as being something you could do almost anything you
wanted afterwards.
And as you'll see, he's done many, many things
in many different directions ever since.
He stayed on at Harvard, did a master's in mathematics,
studying areas of algebra and number theory,
particularly, looking at class field theory
and putting bounds on the size of class groups for his thesis
there.
After that, he went directly to Bell Labs
as a mathematician in 1960, then.
And he was working on a very interesting project, which
didn't have the term at the time,
but now has become to be known as modems.
He was working on the first modems.
They didn't exist at the time, and people at Bell Labs
thought maybe that would be a good idea, not realizing
of course that the whole internet and everything else
is built around these things at the time now.
So they were aiming for a high-speed modem
of 48 bits per second.
[LAUGHTER]
With an error rate of 10 to the minus 5th bit error that.
So that was a couple of years they were working on that,
and he pointed out that at the time,
it seemed maybe they would be getting
near the theoretical limit.
And the theoretical limits have been reached and passed
several times since then at 1,200 and 9,600.
Now we're at 56 kilobits, but every time people
say that we're at the theoretical limit.
But at the time, they were working
near the theoretical limit then.
I asked him if he knew Claude Shannon at the time.
Claude had left Bell Labs at that time,
but Bob had known him in other contexts, and used to love,
he said, trampolining with them.
[LAUGHTER]
So then he moved into the math department at Bell Labs.
Ron Graham was there.
The math department was shifting into computer science
at the time, and Bob got interested in computer science
a number of different ways.
One of the interesting things, and the connection
with MIT here, was he got involved with the Multics
project.
So he wrote the first PLO, PL/I compiler for the Mutlics
project, which was around for, I think,
he said an embarrassing, long, long time afterwards
or something.
So he was involved with that, and up here, he's
used Multics quite a bit since.
I'm surprised to see that some of the design errors
are still around.
I guess there was a question as to whether Multics is still
running anywhere.
We were talking with him.
I don't think either of us knew exactly, maybe up until quite
recently, anyway.
He did a lot of number theory, and he kept his mathematics
going too.
He did a lot of number theory at the same time he was there.
He worked on implementations of various mathematical functions
for the 7090, and for Unix, he did all the math
implementations, sines, cosines and things like that,
for the Unix implementation.
Also did the Unix security scheme,
the password scheme the way, et cetera, a password works.
Passwords get hashed into that.
In 1980-- so that was software, some mathematics.
Then he got into hardware.
He started on a project working with the Navy
on very high-speed computer, one of the fastest in time.
They were aiming for $100 million operations per second.
This was for sonar processing.
He said it was interesting.
He got into the project, and he was talking to some Navy guys,
and they realized he'd never been on a boat.
And they said some order like, get his ass out to sea,
and so they took him out on a nuclear submarine
for a week, which he said was very interesting.
So that that machine he was working on,
it actually got built and was in service for quite a while.
The machine was interesting.
It was primarily hardware design he was involved with then.
It had multiple processors, and so the usual issues
of synchronization and coordination of the processors
was a big issue.
In 1984, he retired from Bell Labs and went to work at NSA.
I asked him if he'd done any cryptography before he went
over to NSA, and he admitted that actually he
had worked on a paper on cryptanalysis
that he thought was kind of interesting.
And he sent it off to the NSA-- this
is while he was at Bell Labs.
He sent it off the NSA saying, you
don't mind if if publish this, do you?
And they came back and said, yes.
And [INAUDIBLE] several high-level visitors
from the agency coming to Bell Labs,
and it was agreed that he wouldn't publish this.
And it still has not been published,
and I look forward to seeing it someday.
But he says it was perhaps the best
paper he's ever written, so.
[LAUGHTER]
But he also feels that it's maybe not appropriate
for it to be published either, so, one of these days.
At NSA, he started off as chief scientist
of the Computer Security Center, which
was a new center at the time, working on computer security,
both inside the government and outside.
Did consulting, a number of different directions.
He was promoted to chief scientist of the Information
Security Section thereafter, working
on protection of information in general, which
is the topic of today's talk.
While he was there, he had an interesting experience,
as it's the destiny of most children
to embarrass their parents.
In November of '88, the internet worm came up.
So again, interesting experience with him
to deal with that both in his family and externally.
In August of 1990, his career took a very interesting turn
with the invasion of Kuwait.
He was pulled out of his ordinary work
and put on a special team whose goal was to essentially nullify
the Iraqi air defense system.
And he spent eight months on this project
and effectively had the rank of a two- or three-star general,
and was getting everything he needed in terms
of cooperation, of course.
And he didn't say a lot about what he did
or the details of that, but I think we all
know that what happened in that war
was astounding in a number of regards.
Then in 1994, he retired from the NSA.
He's now living up in Hanover next to our sister institution,
Dartmouth, where he has an adjunct professorship.
And he also has an adjunct professor
at Cambridge University in England,
so he goes back and visits there substantially as well.
So he's retired now.
He says he likes to split wood.
I know he's interested in languages too.
He speaks very many languages.
I think if you came up and challenge him with languages,
ask him questions on languages at the end
or after the talk or something, he's
probably better able to respond than anybody I know.
He spends Tuesday afternoons at lunch,
he tells me, reading the Bible in ancient Greek
with a reading group.
And so as usual, we like to ask our speakers
to sum up their life experiences in an epigram to follow,
and what kind of advice to give very young students.
And after thinking, he said, if you're not having fun,
you should be doing something else.
And that actually makes a lot of other distinguished lectures
[INAUDIBLE] too.
You know, find your passion.
Go after it.
So without further ado, I am pleased to introduce
Bob Morris.
That's a yes.
Oh.
Yeah, high tech.
In order to deliver what message I have,
I actually have to change the way you think
about some kinds of things.
And when we're finished--
well, when I'm finished talking and you're
finished listening to me, we have to check back
with these initial notions.
I worked for an organization, NSA,
which is characterized as being, let's
say, somewhat paranoid, to which I can respond,
just because you're paranoid doesn't mean
the whole world is against you.
And even at NSA, I was considered,
in that organization, unusually paranoid.
[LAUGHTER]
And let me give you some examples of this.
These are, by the way, random view graph
that I'm putting up here with--
perhaps relevant but not necessarily very well ordered.
I've given a talk on this subject
to many groups in the past, some academic,
as this is, some military, some God knows what.
But the best abstract of the talk that I've given
is in, God help us, WIRED magazine.
Is there no dignity?
[LAUGHTER]
[APPLAUSE]
But it's the March 1996 issue of WIRED magazine,
and actually, if you care more about what I'm talking about,
it's a good place to look for it because it
is a very good and rather accurate
summary of what I talked about at a talk I gave just
over two years ago.
And it also goes into some details
of a conversation I had with Phil
Zimmerman at that conference, and you
can imagine, if you know the people involved,
that that must have been a hell of an interesting conversation.
Now, paranoia.
This appears to be a telephone.
This is commonly called a line cord and this the handset cord.
I have to tell you in the strongest terms
that I have different names for this.
This is called an antenna.
[LAUGHTER]
This is also called an antenna.
Many people refer to this object as a microphone and this
as an earphone.
I think of this as a rather high-quality microphone
and this as a rather low-quality microphone.
People think that I have a tendency of seeing microphones
and antennas everywhere.
[LAUGHTER]
I do, and that habit is a necessary habit
to be at all effective in the kind of job
that I was doing in NSA.
I was involved in--
I was the chief scientist of the section of NSA
that deals with the protection of valuable or sensitive
US information.
And we did things like, there was
a crew of young people who went over to the Pentagon,
to the office of the Chairman of the Joint Chiefs,
and looked at that office in great detail
to assure themselves and others that there were not
any undue number of bugs planted in his office.
And they came to me many times for advice and help
and consultation, and I recollect the day
when they came back and pointed out to me
that in the office of the Chairman of the Joint Chiefs,
there was a bathroom.
Oh my god.
One might have noticed in a bathroom
that if somebody opens the door or closes
the door of a bathroom, you look at a sink with water in it,
or the toilet bowl, and you notice
it actually changes level.
I mean, there actually is some connection between air pressure
waves and water pressure waves, and the fact
that he had his own bathroom caused
us more cost, time and expense than you would ordinarily
believe.
But that kind of thing does happen.
It was.
More paranoia.
Now, this is a building without an outside window, which
means that I don't have a prop for the next thing
I was going to talk about, but I might, with any luck--
Yeah, I do have some chalk.
I probably even know how to use it.
Think of this as a window.
If you aim a laser beam from a distance--
and that distance can be quite long, like easily half a mile,
probably more--
then that laser beam will illuminate objects
in the window.
This is very convenient.
This is the best example.
This, by the way, is going to turn out
to be, no great surprise, a microphone.
You put it on the windowsill.
Now, a laser beam coming in the window--
hits that, reflected back--
will be subject to ordinary Doppler shift
changes of frequency.
You can detect those very easily with very inexpensive
equipment, and then with the laser
beam aimed through the window at this,
you can hear everything that is spoken in a room.
If this had-- well, I wasn't set up to do that,
but if this room had an outside window,
it would be a very easy demonstration
to show just how accurately this can be done,
and it can be done with rather high quality.
That's a high-quality microphone.
Plastic is much better.
The cardboard cups do a poor job.
The plastic cups do a rather good job.
Now, I'm talking about the protection of information,
and a couple of things that I need to--
I had some notes here once.
Well, it doesn't matter.
I ought to say a bit about what I view as valuable information.
In the past, the valuable information
that people most wanted to protect
or most wanted to exploit were sort of
both the same, were primarily military and diplomatic
messages.
In peacetime, you wanted to know what some foreign government
was planning to do.
Obvious the thing to do was to tap the ambassador's telephone.
In wartime, you wanted to know what the military was planning
to do, and so you would intercept,
in World War I and II, their radio communications.
Well, this is not new, then.
I mean, you couldn't in the United States during the Civil
War find any telegraph line anywhere in the country
where there was fighting going on that didn't have taps on it.
I mean, that was a really, really big deal
during the Civil War.
All telephone and telegraph lines--
in those days, it was telegraph, not telephone.
They were all tapped, mostly encrypted
or protected some way or another,
but people got the messages.
So it's nothing new, but military
and diplomatic is sort of--
it's becoming a thing of the past.
Not that it's less important, but other things
are gaining importance to shift the balance.
So currently, the most important information
that's floating around is probably largely financial.
Suppose that there is a good deal of money
in some Swiss bank account, but it's
the wrong account, like not yours,
and you want to fix that.
[LAUGHTER]
Well, OK.
That means that the people who are responsible for this system
probably go to some lengths--
in fact, they do--
to protect the information.
The people who want the money go to some lengths--
they do-- to extract the information
and engage in various transfers of wealth
from the wrong place to the right place.
And there have been a number of very few of these incidents.
About 5% are ever reported even to the police
so that it is difficult to get a good measure of just how
much of this is going on.
There was a widely publicized event
at Citibank a few years back.
Others, even larger ones, have not become public,
but they have in any case happened.
So that's the present.
I'll talk about ATMs in a minute.
For the future, we're getting, I think,
into a number of areas that are a bit different.
Moving from financial to generally
commercial transactions, the best
figures I have, which are good and relatively recent,
from people who run their businesses associated
with the internet, so that somebody orders
something on the internet and gets it shipped to them--
the percentage of transactions that turn out
to be fraudulent fraudulent in the sense
that the person does not intend to pay for what he's getting,
is about 20%.
Hey, that's low.
Just wait.
And so in the future, I think we are
going to see more emphasis on privacy,
more emphasis on commercial transactions,
and these will shift the balance.
If the World Wide Web turns out to be a big success,
then this i going to vastly overweigh all
of the other considerations.
That hasn't happened yet, but likely, it will happen.
OK.
We've seen enough of this, but if you ask me, is cryptanalysis
my my answer is, yes, it is.
Sending things encrypted with weak codes
puts you at considerable risk, and if you
want to gather information using cryptanalysis,
it is a method that pays off rather well.
Is it the most important?
No, it is not the most important.
Within the past 20 or 30 years, the other four--
all of them begin with B, by the way--
burglary, blackmail and bribery have
become much more important ways of gaining information
for the best of all possible reasons.
They're cheaper.
Cryptanalysis costs a lot of money.
And when you think in terms of encryption,
don't keep thinking in terms of, oh, we can't use this code.
It's been broken.
Or go out and use that one.
It hasn't been broken.
That's not the way life is.
People often ask me, can you read such and such code.
The answer is always yes, but some are cheaper than others.
Some are more expensive than others.
It's a dumb answer to a dumb question.
The core question was, can you afford to read that code,
and the answer to that in many cases,
yeah, we can read that code, but it costs so much.
So think in those terms.
And I sort of want to bend your brains a bit
at this point to make sure that you understand
that the intelligence area is very, very financially based,
cost-based.
If you ask me a detailed question like how much would
the Soviets--
well, I'm going back a few years.
We're talking now about the former Soviet Union.
How much would they be willing to pay
to get a good, long-term wiretap on the president's telephone
or on the ambassador's telephone?
The answer is, a million dollars?
Oh, yeah.
They would be happy to get something like that
for a million dollars.
$10 million?
Nah, that's a bit high.
So that's the range we're working with.
To get a good line on, well, the US ambassador to Moscow,
it's something that they would spend a few million dollars,
barely questioning the idea.
So it is important.
The other area-- people have been
trying to work on me to change the wording of this a bit,
but it remains the way it is, so it goes.
It's become an important notion, unathorized modifications
of equipment.
It's very difficult to protect, for example,
your cryptographic equipment at night from the cleaning lady.
I mean, embassies and other military installations
have cleaning ladies and janitors and things
of that sort.
That's unavoidable, and there is always the risk
that your equipment will be modified
without you knowing it.
So I put this up here, and it has become extremely important.
Why?
Because it's cheap.
I should say a few things.
I promised people that at the beginning of this talk--
and it's still the beginning of the talk--
that I would detail some subjects that either I
don't talk about much or at all, or that you cannot expect me
to tell the truth about.
[LAUGHTER]
I will detail those.
You cannot expect me to tell the truth about the vulnerabilities
of any cryptographic equipment, whether it's used by the US
or our allies or by our opponents.
I don't talk about the vulnerabilities
of cryptographic equipment.
My knowledge in that area is world class,
so much so the NSA is not happy about me
being loose on the streets.
OK, that's one.
Second, though I would tell the truth if I talked about it,
I don't talk about cryptanalysis.
That's mostly because even among the bunch of people here,
it's basically none of your business.
Cryptanalytic techniques?
No.
I'd be happy to help you with a newspaper cryptogram,
show you an easier your way to solve them,
but that's about as far as I'd go.
The third thing is, though, certain goings-on
during the Gulf War.
I was closer to the Gulf War than most honest civilians
were.
Ron started to talk about some of the aspects of that,
but it got worse.
Yeah, the worst day was the day when
I went to the general counsel of NSA and said,
Elizabeth, two or three people and I
are planning to assassinate a foreign head of state.
And she said, Bob.
She was able to guess pretty rapidly which
foreign head of state we had in mind,
but still, it was not a part of the normal business
of the National Security Agency to assassinate anyone,
certainly--
[LAUGHTER]
And certainly not foreign heads of state.
So I'm going to be talking to some degree
about cryptographic protection and exploitation
of encrypted things, but to a greater
degree about the other aspects of it,
because they are far more important.
And I really mean to pound on that,
but cryptanalysis is only one of the weaknesses of information
that allows exploitation.
The others really exist, more used, and are generally
enough cheaper that are you don't try to use cryptanalysis
on some system unless the other techniques have failed.
But if you're dealing with cryptanalysis,
now, here are some of the things you need to think about,
because I read in the press, all over the place,
in fact, all of the discussion that goes on of people who
say that such and such a scheme doesn't
have a long enough key length.
Only 40-bits.
Ought to have 60 or 100 or some other number.
And I hear a good deal of weeping and moaning
about systems that have inadequate key length, to which
part of my response is, what in the world difference
does it make if you've got a 40-bit key or 60-bit key when
I've already stolen the information?
And that's real.
I mean that, that a key length is
just one factor of cryptographic systems
that needs to be looked at.
Important?
Yes, it's important.
Most important?
Not by any means.
Proper custody of cryptographic material is right there.
If one of your employees is peddling this stuff
to the Soviet Union, that's not proper custody.
The name Walker and Whitworth should ring a bell.
That was basically a family operation.
That's the American use of the word "family,"
not the Sicilian use.
[LAUGHTER]
Who were peddling US Navy key material
to the Soviets for 12 years before they got caught.
They got caught in the early, early 1980s,
and most of them at this point are in jail
under relatively uncomfortable situations.
So it's not a good idea, but still, we
had a tremendous loss of information
over that period of time because the cryptographic material that
was being used was also being sold to the Soviets,
and that's not the way to do business.
Now, choice in distribution of keys.
I don't see this much directly in terms of encryption keys.
I do see it in terms of login passwords on like Unix systems
and systems like it that require a password before you log in.
You find on that in many cases, in too many cases,
people are using names of girlfriends,
names of dogs and things like that for passwords.
So if I know Ron's wife's name and his dog's name,
I'm halfway there.
I mean, he will claim that his password--
[INAUDIBLE]
Blind.
OK, that's good.
[LAUGHTER]
Actually, I got a percentage of that, a paper
that I published in the late 1970s
where we came to the conclusion that about 5% of all passwords
were names of dogs.
Still, nothing much I can do except just
to keep pointing to it and saying,
actually, it is important.
And if you let users pick encryption keys,
you had a patrol.
This happened in some ways which were quite publicized
during World War II.
Adequate key space.
40 bits is a fairly small key, and you want something bigger
than that, but it is only one of a number of factors.
Another thing which is quite important people don't
pay much attention to is that that text
that you're trying to produce is typically awfully predictable--
ASCII characters, perhaps, where the letters come together
to make words and the words come together to make sentences.
If you reduce that predictability--
and any good compression scheme will,
and the better the compression is
the better this works to help cryptography--
it's a useful thing, fairly cheap,
and it may have even other advantages that might help.
You compress first and then encrypt,
and this actually makes it more difficult to decrypt text.
Now, when I say system design where
the entire key participates in each encryption operation.
I'm reminded of newspaper cryptograms
where all you have is some permutation of the alphabet.
A turns into X every time A appears,
and B turns into V every time it appears.
It was just a permutation.
Now, in that case, you've got a key length
which is absolutely enormous.
Anybody that wants to work out what
is 26 factorial, that's the number of possible keys
for the scheme.
And newspaper cryptograms choose a key, one key out
of 26 factorial possible ones.
But the entire key does not participate in each encryption
operation.
It's quite the reverse of that.
So as a matter of fact, all you need
is something on the order of 6, 8, 10 words
to be able to come up with and know
you've come up with the plain text of the message.
By the way, I'm a very experienced and very relaxed
speaker.
And I welcome questions, complaints, whatever.
The more interaction, in fact, the better.
If anybody wants to say something, just say it.
That's purely cryptographic.
But it's only part of the story because cryptography is only
part of the story.
This gets into a number of things--
carelessness-- important in many cases,
you find that if you want some information,
you don't need to do cryptanalysis.
You just go in the back of the organization's parking lot
and pick the stuff you want out of the garbage can, which
is where it got thrown.
And it shouldn't happen.
But it does happen.
Overconfidence-- well, overconfidence probably
reached its peak during World War II
when the Germans had this encryption machine called
Enigma.
And they thought, hey, it was designed by a German.
By the way, who speaks fluent German here?
One, two.
Yeah, OK.
Oh, I'll apologize in advance.
Probably I'll write some things in German, some of which
will be misspelled, and some of which
will not be politically correct.
But you'll understand that.
One of the things that came out of World War II that provided
a long-term lesson for the Allies
was that the Germans drastically underestimated the time, money,
expense that the Allies would put into decrypting the Enigma
traffic.
They totally underestimated that.
And since then, a good deal of attention has gone--
and they set up committees several times
during the war to reassess the Enigma encryption scheme.
And the answer always came back from these committees
that everything was fine.
It's just too many possibilities here
for anyone to get in any trouble.
All the time, the Allies were reading them.
It makes you wonder about committees.
Sir?
It makes you wonder about committees.
Yes.
In David Cohen's book, David Cohen
talks about those committees in some detail.
But hey, the machine was designed by a German.
But that overconfidence can really kill you.
And in many cases, people nowadays
are using, on the internet and on the world wide web,
encryption schemes which are plainly too weak to do
the job that needs to be done.
Information is most often lost by theft or purchase.
Most inside jobs-- now, I have in my pocket a floppy--
not a floppy disks, what do you call those guys?
A CD that is enough to contain the whole Encyclopedia
Britannica.
It's a lot of information.
And if I walk out the door, no one's
going to know that I have one of these in my pocket.
And that's true at any installation,
whether it's diplomatic, or military, or whatever.
Information just gets packaged into tiny forms.
It started with floppy disks and went from there to CDs.
Most jobs are, in fact, inside jobs
or have an inside component.
I mentioned [INAUDIBLE] before, but it keeps coming up.
And these two-- microphones are everywhere,
and antennas are everywhere.
Just again reflects my paranoia about that sort of thing.
But that paranoia tends to be very global.
I mean, suppose I'm at a military base working
in a military base.
And a piece of cryptographic equipment that we ordered
arrives on the loading dock, perfectly good
KG84 encryption machine that we ordered.
And hey, it arrived.
My attitude towards it is, even though it says KG84 on it
and it looks like KG84, it looks like the last KG84 that I saw,
what is it?
How did it get here?
Who sent it here?
What were the motives of whoever sent it here?
Now, there we've crossed the line into clinical paranoia.
But that is still the way that I think about such a thing
and that I recommend that others think about a thing.
You need to carry paranoia about to that point.
For the last several years I was in NSA,
I was one of the roadblocks in the development
and design of new US cryptographic equipment.
And I would get, every few months,
about any project that was under development design
a briefing by the designers as to the details of what
it was they were designing.
And we would have these conversations
that went like, well, is your machine resistant to this sort
of attack.
The response was, oh, no one would ever do that.
Uh huh.
Well, you need to get on my side.
You need to get on the paranoid side
that indeed no one would ever do that, sure.
I've run out of new graphs at probably
just the right time because this is part of the important--
the most important of the things I have to address.
But I'll leave it up.
Might as well stare at it.
OK.
So World War II had a number of effects
on protection of information that are old but still valid
in very many important ways.
Certainly, this kind of thing is an important part of it.
And the overconfidence probably was the most important
negative aspect of the way people
thought about protection of information
and actually did the protection.
First off was loss of machines.
During the war--
I'm talking about World War II.
And I'm talking about the war that began in 1939.
Remember that.
Don't think about Pearl Harbor.
Think about the actual war, which began in 1939.
The Germans lost quite a few Enigmas that were currently
in use to send messages.
Lost them, that's a dishonest way of putting.
We stole a large number of them from the Germans.
And as happens fairly often, the Germans
changed the internal wiring of the Enigma machine.
It made it very difficult-- and by difficult,
I mean expensive--
for us to continue cryptanalysis with the modified Enigma.
And what we would do-- we knew that the Germans,
in order to get decent weather forecasting,
stationed a whole bunch of--
well, not a whole bunch, a few, two or three--
ships in the Atlantic, Central Atlantic,
to get them reasonable weather forecasts
of Germany a few days later.
Those ships had up-to-date Enigmas on board
and have the keying material for them.
We would send out a Naval vessel to basically demolish
that weather ship, sink if necessary,
and steal the Enigma and the key material
from it, which would typically make
all everything happy for another couple of months.
We did that constantly during the war.
I remember sitting at dinner with the Brit who
was actually responsible for sending those things up.
And I said, you're morally bankrupt.
He smiled and said, you bet.
So there was a lot of loss of machines,
whereas the Brits had actually a machine which
was very similar to the Enigma.
It had a different name.
It was called Typex.
And I don't know whether or not they lost any during the war.
I believe they did not.
The US had also a very small machine,
which was called the SIGABA, which
one can be quite certain we did not lose any during the war,
did not lose custody of a single one through the war.
And that provided a great deal in protection.
Codes using the American machine were never read during the war.
And to a large extent, that was because we
didn't lose track of them.
Now, some habits of the German signal authorities
were a bit unfortunate.
For example, for most of the war,
every German military message began with the three letters
ANX.
Why?
Well, I'm not going to teach you much German.
But this is just a way you would normally
expect a message to begin.
The X stands for space.
It just says to somebody, and who cares.
But having the message begin with a known set of characters
is just asking for trouble because when
you get into key search now, you can speed the thing up
enormously by knowing that the message begins
with these letters.
This was changed later in the war.
But for the first two or three years of the war,
this was always used.
Another habit which the Allies found very useful
was the habit of, particularly with a high ranking
and important officer, never abbreviating
his name or position.
And that's combined with a particular characteristic
of the Enigma that--
it doesn't seem very important.
But it never encrypted a character
into the same character.
If the plain text character was A,
the ciphertext character was never A.
Now, that means that after you get a few dozen characters
and you have a suspected text might have appeared
in the plain text, you will simply
run it through until you don't get any letter going
into the same letter and with some probability, which
I can compute, place that text.
Now, the kind of thing that would happen would be--
I'm going to write down the beginning of a message
to a very high ranking officer.
And here, I will have both the misspelling
and the politically incorrect material
that I spoke of earlier.
ANX, that's just to, to somebody.
I'm going to write the rank of a very high ranking SS officer,
partly just so you see how long it is.
Oh, hey.
That's the title.
By the way, did I spell it incorrectly?
That's correct.
That is correct?
Yeah.
OK, fine.
Other people have not been sure whether they should be HN.
I believe this is correct.
[INAUDIBLE]
Yeah.
But that's not the end of it because you would never
omit or abbreviate his name.
It just would not be a habit that would ever occur
in the German signal service.
So we have to continue with the guy's name.
And this will go on forever.
And I'm not exaggerating.
This kind of thing at these lengths actually occurred.
I haven't gotten to his name yet.
And now, well, for the Germans, the apologies
apply here, of course.
Pardon?
[INAUDIBLE]
Oh.
This is not particularly untypical.
This kind of thing happened in actual messages all the time.
And when you have the--
and with a high ranking like this,
you knew he was traveling around, planning
to visit North Africa.
You could be absolutely sure that his name and title, not
abbreviated, would occur in a message where he was going.
So you knew that this was highly likely to appear.
So you could put this as a probable text
against the encrypted text.
And it meant that key search became almost a triviality
once you knew that kind of thing.
The other kinds of things which would
be sigma carelessness of one kind or another
that some German unit that had an Enigma
and was not doing anything of the slightest importance
was ordered to report every day.
OK, they reported every day.
And that's the precise German that would, in fact, be
used to say, nothing to report.
And there was one unit that throughout the war dependably,
every day nothing to report.
OK.
But don't imagine the Germans were dumb or dumber
than others.
The Allies were dumber.
And the dumbest was the US.
And the use of a code in World War II that the Brits knew
had been read by the Germans during World War I, Admiralty
Cipher.
I have a copy that I didn't bring.
It's called Admiralty Cipher Number 2.
I keep it because if there's another war,
it might come in useful.
So that kind of thing goes under the general category
of carelessness, which it is, inappropriate procedures,
the predictability.
The cases where identical messages were
sent over different systems--
what used to happen as regularly as clockwork
is that the German military would
go to a new system, a complete new scheme.
And they'd say, hey, you start using
the scheme on November 20.
And what would happen would be Unit
A would send a message to Unit B. Unit B
would send something back that says, hey, we can't read that.
We don't have the new code yet.
OK.
So they would send the message again in the old code.
That happened on all parties.
The Germans did it.
But also, the Allies did that.
And it was reasonably common.
Some of those problems were very serious and not
very widely publicized, particularly the fact
that Admiralty Code and Admiralty Cipher Number
2 was used throughout the war, from beginning
to end, to order the track of convoys across the Atlantic.
So if the German submarine service
wanted to know where the current convoy was going,
it was in Admiralty Cipher, encoded
in Admiralty Cipher Number 2.
And one tends to read more about all the wonderful things that
happened at Bletchley Park, rather than some of the equally
wonderful, long-term of course, things
that the Allies did that were comparable or worse.
I shudder to think of that.
But it did happen.
Speak.
Why did they [INAUDIBLE] three years of code if they
knew it had been broken?
Yeah, that's my question, too.
[INAUDIBLE] policy [INAUDIBLE].
Maybe that's the reason.
I can't answer the question.
I mean, this was done by the Brits,
done by Naval intelligence.
And that's what they did.
Why they did it beats me.
It's not widely publicized.
I don't think that appears, for example, in Cohen's book, which
talks mostly about Bletchley Park kinds of things.
But Bletchley Park was not the only kind of thing
that happened.
[INAUDIBLE]
No, we lost convoys because of that.
It's bad, actually very bad.
Now, after World War II, the intelligence business
changed in a number of fairly important ways.
Because of the downfall of the Enigma and machines like it,
the intelligence services of countries
decided to go to different schemes,
go away from these rotating, highly mechanical cipher
machines we used in World War II to go to better things.
By the way, I brought with me a cipher machine was actually
used all over the place by the US military
during World War II.
It's called the M-209.
It's a lovely machine, in the sense that the Army was
able to bring this into the trenches,
the frontline units in the trenches,
for example in the desert in North Africa.
And after six months, it would still
be working, just beautiful construction and a fairly
decent encryption scheme.
The instructions that went with it during the war
said, you can expect that the enemy will not
read something enciphered with this machine in less
than 24 hours.
And it may not seem like much.
But for frontline activities, often a day just fine,
particularly if you know it's just a day.
So it was a good machine and beautifully constructed.
And its secrecy was perfectly adequate for what
it was being used for.
Not much better than that, though.
Other kinds of things began to show up
beginning about 10 years after the war.
For example, if the Russian government
gives a beautiful four foot in diameter
great seal of the United States to the US ambassador
to hang up in the embassy--
I'm going back to what I said earlier.
My question is not, is there a microphone in it?
My question is, where is the microphone in it?
And where is the antenna in it?
But then the ambassador at the time
was not sufficiently paranoid.
And it was, in fact, installed at the embassy
and certainly some harm came of it.
That's one.
As time went on, during the '50s and '60s,
small computers began to be used for cryptography
instead of these kinds of mechanical monsters.
And the kinds of errors that used to occur gradually
changed from unwise operator actions, unwise
choice of key material to machine failure.
And machine failure became quite important.
I need to keep track of time.
10:15.
OK.
So that gets me to a rule which became very important
during the '50s and '60s.
The first thing to do with a message that
comes over one of these important channels
is check for plain text because one of the most common error
modes of the kind of equipment being used
was, in fact, that it would mistakenly send plain text out
instead of encrypted text.
When the typewriters at the US embassy in Moscow
broke and needed to be repaired, they
were sent out to a local Soviet typewriter repair company.
Do I have to go on with the rest of the story?
Not really.
And what you expecting would happen in fact did happen.
And it was important.
Where was the microphone?
Well, the microphone was where it
needed to be to detect what was happening
when the typewriter typed.
And the message being sent out--
if you listen for it, all you'd hear would be some
occasional clicks, about one click a second.
But there's nothing unusual about that.
If you look at the power line in this building,
looking for noise on it, you would find zillions of places
where there were clicks and various kinds of signals
going into the power.
And in fact, in the average kitchen--
what with microwave ovens, toasters ovens,
and things of that sort--
various kinds of noise and clicks
occur all over the place.
But I have a problem for you.
In the case that actually happened,
all that was noticed when people bore in on it
was that the typewriter, the repaired typewriter
was sending out what appeared to be a click about once a second.
That's all, not very suspicious.
The clicks appeared to be nearly identical.
The timing between the clicks appeared
to be very close to one second.
As far as one can determine, the clicks were the same.
And they were sent once per second.
I have a problem for you, a homework exercise.
Putting reasonable assumptions on all this,
how much information could be sent with one click per second
where the clicks pretty much looked all the same
and they were pretty much all one second apart?
If you look at the data rate and work out
with just some reasonable assumptions about this,
you might be surprised at what the data rate could be.
The question is, would it keep up with the typewriter?
I'll tell you the answer to that,
yes, with essentially identical clicks
being sent out essentially once per second.
There's lots of other things like that.
Both us, and our allies, and our opponents
have many times sent out communication equipment, even
cryptographic equipment, to basically the local Radio
Shack to get them repaired.
When they come back, they're nearly the same
as when they were sent out.
OK.
Again, we're getting into my paranoia.
But I think I'm putting a few underpinnings
under the paranoia to convince you that this kind of thing
does happen.
And that's real.
I'll tell a story on the other side.
The Russians-- no, Soviets, had some equipment that sent out
encrypted traffic by FM radio.
There also happened to be a very small modulation of this signal
AM.
Though the main signal itself was FM,
there was a tiny bit, 30 decibels down
from the real signal, was an AM signal
that everybody viewed was too weak to hear.
OK, fine.
The CIA rented space in the first floor of the building--
this is in Vienna in the '50s--
and listened to the low, very dim AM
signal, which they could do because they were very close.
They just basically set up a shop
to sell lederhosen or something like that.
In fact, they were quite embarrassed that the store
they set up, which was really just a fake CIA store--
was selling sufficiently high quality goods
that they had too many customers.
That went on for over five years when
we were, in fact, intercepting traffic from the principle
Soviet officer in Vienna back to headquarters
from this lederhosen store on the first floor of Austria.
Again, OK, so there's microphones everywhere.
That was the one.
But even in cryptography, one doesn't necessarily
have to do poorly.
I'm going to finish up on the bright side of things.
Suppose I have a cryptographic setup.
I have a box attached to a person,
and then a communication line someplace,
going to someplace else also attached to the person.
This is a long distance line that
causes these two cryptographic devices to communicate.
So somebody puts something in, in clear text.
The machine changes it to ciphertext,
sends it over the circuit.
It's decrypted here, and then the plain text.
And one can suppose that this line is tapped probably
more than once.
And the tap may be either passive,
in the sense that it just listens to the traffic going
over it, or it may be active, in that it changes
the traffic or inserts its own.
That's what I want.
I want secrecy of communication.
I want bad guys not to be able to find out what
this message actually says.
I want them to get only the cipher text.
Is it possible to design a system--
and this is another homework exercise for you, too.
Is it possible to design a system of this sort that
protects the secrecy of the information in such a way
that the enemy, in the form of a cleaning lady or janitor,
can get all the information out of one of these boxes,
like this box, every piece of information?
And I mean that in the broadest possible sense-- all data,
all programs, all keys, anything that's in that machine--
but still not be able to later read the encrypted traffic that
goes across the line.
Is it possible to design such a system?
It's a difficult question because you have
to think about a lot of things.
But again, I'll tell you the answer.
The answer is, yes, it is possible.
And in fact, it is done on some systems
that I know about and use.
But still, it's a difficult exercise
to work out just how do you do that.
But it can be done.
Sir?
[INAUDIBLE] they then been able to--
[INAUDIBLE]
Yeah, if both cleaning ladies were there
and the cleaning ladies could communicate,
then the system is broken.
I mean this only goes so far it goes.
But from on of the two machines, you
can get all the information in the broadest
sense that's in them.
But if you get two, then you can later decrypt any traffic
between those two stations, but not between one of them
and some third station someplace that wasn't broken into.
So that's about as far as you can go.
I'm going to quite while I'm ahead.
Questions, comments, whatever.
Speak.
Sir?
[APPLAUSE]
Speak.
[INAUDIBLE] about the protection of information
that is protected from knowing it
exists-- that is, you go to lengths
to ensure that no one knows if that's
that's the right telephone to tap.
How successful or problematic would that be?
It is done.
It is of some importance.
And it is done.
For example, in the intelligence business, we have sensors--
these are gatherers of information-- in some
of the goddamnedest place.
How do you send that information out?
A priori, you don't.
You have to work out where you can send it out.
What good does it do to tap a fiber optic cable going
across Siberia since you have no conceivable way of getting
that rate of information out?
You've got to somehow conceal it.
Yes, that is an important issue.
And people do worry about that.
And it's not been well-solved.
But there are partial solutions to the problem.
Fair?
yes? ?
Suppose that some big financial institution
hires you to be an advisor and asks you,
what do you think about the risks of key escrow
key recovery systems?
Should we let our keys be escrowed by a third party?
How would you advise that?
Do you trust your government, sir?
No.
You and I don't have to pursue it then.
I asked your opinion.
Well, my opinion is I would first ask,
do you trust your government?
And the answer to that would come out
mostly somewhat negative--
no, or not much, or whatever like that.
Do I trust my government?
I don't feel much differently from the way you feel.
I mean, there's good guys there and bad guys.
I won't characterize myself as being either side of that one.
But I can understand the FBI's position
in pushing for a key escrow scheme.
What do you do to counter the communications
abilities of the druggies or potential terrorists?
Yeah, it's an important issue.
Sir?
You mentioned that there were [INAUDIBLE]
compromised the financial security
of financial institutions which dwarf the Citibank episode
but that were largely unknown.
Could you give us a couple of examples?
[LAUGHTER]
Hey, suppose I want to rob a bank between now
and the end of the evening.
I don't walk into a bank with a gun.
That's dumb.
Because all I'm going to do, if I successfully
rob the bank is get enough money for a pleasant weekend in Las
Vegas.
If I start walking into the bank with a gun,
I'll spend an unpleasant weekend in the county jail followed
by an unpleasant couple of years in the state prison.
Go for the ATMs.
Consider, when I was last in Norway, indeed,
I have a card which I inserted into an ATM in Norway.
And 1,000 kroner, about $200, came out of the machine.
What actually took place in that transaction?
There are a number of parties to this.
There's me.
I don't want my pin spread all across the country,
particularly when it's combined with bank
identification and the account number at that bank.
That combined with a pin let's anybody get my money.
So I don't want that.
The bank that owns the ATM in Norway,
before it gets me the 1,000 kroner,
wants to make sure that it will get the money back
from the local bank in northern New Hampshire, out
in the boondocks of northern New Hampshire.
And the bank in New Hampshire wants
to make sure that you're talking about a real customer that
had some money in the bank and hasn't withdrawn
at all in the last day.
Now, there are both high tech and low tech ways of extracting
the money from an ATM.
The most common method in the UK and Europe
is to drive a forklift truck up to the ATM
and pull it out of the wall and take it home
where you can work on it in the comfort of your living
room with a cutting torch.
There are more sophisticated approaches.
The most common in the US, also fairly low tech,
is to go and buy an ATM--
and I assure you that can be bought rather readily and not
terribly expensive--
go and install it in the mall down the street.
When somebody comes up and puts a pin in into it,
you pass a message that says, sorry,
the machine is out of order.
Try again later.
But you've done is collected a whole bunch of pins and account
numbers.
Not very high tech, but very profitable.
It turns out that, in the weekend,
it's fairly easy to come up with, say,
$100,000 by this technique.
That has been done many times over.
I know it's only a partial answer to your question.
But it is, at least in part, an answer.
That does happen.
It's fairly common.
It's almost daily in the US.
Sir?
Do you think that a centralized financial system based
on book entry settlement is more vulnerable--
Based on what?
On book entry settlement.
That is [INAUDIBLE].
No, it takes too long.
[INAUDIBLE]
[INAUDIBLE] the Federal Reserve System
for something on the order of $100,000 a day.
And they won't notice for about a month.
Oh, I'm sorry.
Let me rephrase the question.
Do you think that a centralized system
with a central clearinghouse is more
insecure than a decentralized system
where people are making peer to peer payments?
Yes, I do.
And it has, in practice, not the worked out very well.
Yeah.
Sir?
Do you think that the gap between best military
intelligence practice and cryptography
and cryptologists that publish academic commercial
cryptography and cryptoanalysis is widening or narrowing
over time?
I don't notice that it's gotten wider narrower.
Actually, compared to when I first knew about these things,
the gap has gotten somewhat narrower.
We mostly used one-time pads in the '50s,
went to machines in the late '50s, and on into the '60s
and beyond.
So I don't see a gap that's widened there.
I see a gap that's shrunk a bit.
Yet, the gap between them is there.
And it's big.
My notion is that the encryption systems of the US and allied
countries is pretty darn--
no, pretty good is one thing to say.
Adequate for the information they're protecting.
What are the factors that affect the size of that gap?
Do you foresee a change in them?
Nah.
Yeah, go ahead.
Suppose the key escrow system does get into place.
A key escrow database with a few billion keys in it
is a few cubic inches on proper storage media.
Could you estimate the dollar value of that information?
Probably very large.
Well, it depends-- dollar value to who.
I mean, how much would it cost me to find out
your social security number, credit card number for all
your cards, bank account number, and how well your payment
record is?
How much do you think that would cost me to find out?
Pardon?
$20.
Yeah, they got it.
It doesn't matter, so long as they were
able to say the number in it.
I mean, if they said $20, that's fine.
If they said $200, that's fine, too.
It actually is somewhere in that range.
To get what I asked for probably costs something like $200.
But the person that got it for them,
it doesn't cost that much at all.
It only costs $5.
So value to who, right?
[INAUDIBLE]
Well, I have two answers.
One is not much.
The other is I've delegated all responsibility for that issue
to the vice president.
[APPLAUSE]
[INAUDIBLE]
Yeah, OK, what?
OK.
Given the NSA's alleged budget and the fact
that you seem to say--
Does anybody obey this budget?
[INAUDIBLE]
And they even could be wrong.
And given the fact that you say that military and government is
so far ahead, why make such a big deal
about key escrow and all that?
Is it possible that current cryptography is actually
of some value and is actually difficult to break
by the government?
It could be linked, so yes.
It would not be difficult to construct
from things that are widely known
to commercial people in the US to produce an encryption
system that is quite expensive to break.
Now, I'm not saying hard to break.
I'm saying expensive to break.
And overseas-- well, there might be one or two Israeli citizens
in the audience.
They are better than us.
So our expectation is if we see an encryption system coming out
of Israel, we say things-- well, I don't want
to say it in Aramaic or Hebrew.
But that is quite worrisome because without--
well, using the expertise that they have in hand,
they could come up with a system that would be
very expensive for us to break.
That it?
Over there.
[INAUDIBLE] All right, do you think that that enough of these
authentication issues, like the bank machine and the internet
purchases, have happened that people are becoming aware--
people running these businesses are
becoming aware of these issues?
Or are they continuing to just blindly stumble along and not
pay much attention to--
I have not detected any awareness of ambition.
No, I'm serious.
And people come up with encryption methods which are
plainly inadequate to the job.
But you've got to remember that there
are other kinds of cultural issues
that are not unimportant.
I have a card, which is issued by the South African Power
Company.
It's a card that you take to the power company's office.
And they change the magnetic bits on it
that, in effect, add to the amount of money on it.
The one I have is good for 1,000 kilowatt hours.
But it is an organization where everyone
associated with the power company is dishonest.
In South Africa, normally a customer
does not pay the electric bill.
Why not?
Well, why pay it?
Do you think that the power company
is going to send someone out to disconnect
somebody's power in one of the townships in South Africa?
Not likely.
You'd never see them again.
In the South African yellow pages,
you will find a kind of business,
people who are in business, people
wire around electrical meters.
And I mean, there are cultural differences here
which take the whole subject matter away
from what you and I have been thinking
about in a very important way.
And that kind of thing has to be tracked.
If you intercept a message in Arabic
and it does not begin by saying God is great,
then you missed the beginning of the message.
And so we have to track the whole thing.
And what you're asking about is, to some degree,
a cultural question, much along the lines of do
you trust your government.
The majority answer here would be not very much.
Or the South African example--
well, I've talked around your question.
I guess I didn't answer it.
No, I don't perceive any awareness
on the part of the US.
That's the direct answer to the direct question.
One last question?
This is a bit more broad.
Recently, the Cold War is over.
There seem to be less enemies.
But also, there's a lot more enemies
that have more powerful ways of encrypting information
and more powerful ways of protecting it.
And information has just been put into a lot more use.
There used to be Pravda.
And now, there's 400 newspapers that we
have to get out of Russia.
Is the NSA able to keep up?
It costs.
But that's not a high expense.
We certainly track all unclassified publications,
for sure.
We read all newspapers.
And the number has increased because--
I mean, the Kazakhstan Times or the Uzbekistan Journal,
yeah we have to track that stuff.
And it does cost.
It is not a particularly high cost.
But it is done.
And it does cost money.
And it's done in the other way, too, done in both directions.
But your statement, the Cold War is over--
I'd want to-- yeah, I'd want to modulate that just a bit,
not much.
[INAUDIBLE]
Yeah.
Well, among all those little countries
that you see along the southern boundary of the former Soviet
Union, 8 or 10 little countries nobody's ever heard of,
One of them, Kazakhstan, is larger
than all of Western Europe.
So one has to keep some kind of balance in this kind of thing.
I don't even know what the capital it is anymore
because what used to be the capital
five years ago is politically incorrect now.
It's been changed to a Kazak word.
But then as soon as they did that,
they moved the capital about 50 miles to the north.
So it's hard to keep track.
But again, this is something that does happen.
And it does cost.
But it's not a major expense.
It's something we have to do.
Well, I'd like to thank you for a very interesting talk.
[APPLAUSE]