For Texas Instruments, Calculator Hackers Don't Add Up
spectrum.ieee.org
spectrum.ieee.org
Gentlemen,
A mathematical morsel for your entertainment and edification.
The number
6,857,599,914,349,403,977,654,744,967,
172,758,179,904,114,264,612,947,326,
127,169,976,133,296,980,951,450,542,
789,808,884,504,301,075,550,786,464,
802,304,019,795,402,754,670,660,318,
614,966,266,413,770,127
is the product of
5,174,413,344,875,007,990,519,123,187,
618,500,139,954,995,264,909,695,897,
020,209,972,309,881,454,541
and
1,325,290,319,363,741,258,636,842,042,
448,323,483,211,759,628,292,406,959,
481,461,131,759,210,884,908,747. [Source of MS Windows in binary] + 1 = [Source of MS Windows in binary + 1]
However, I while I feel that breaking into systems should be punishable, I think that breaking cryptography should not be, as long as you inform the owner a six months before going public, and do not use the result for any personal gain.I think that breaking cryptography should not be, as long as you inform the owner a six months before going public, and do not use the result for any personal gain.
It worries me that anyone would say something like this. I notice that 2 * 2 is 4, and I have to wait 6 months before telling anyone? Or what? What would TI do with this information? Why does TI have a right to tell me what I can do with chunks of plastic with TI's logo on it? (Remember, he's not copying their software; he wants to delete their software and use his own.) What legal framework would this fit into? Factoring numbers has nothing to do with copyright law, and a new law suppressing the publication of scientific research is a clear violation of the Constitution. Even if it is illegal, people can't be stopped; you can't police the entire Internet, and you can't stop people from installing software on their calculator. There is no way a government or corporation could monitor this.
So you basically want to make a law that is a violation of hundereds of years of American principles, that is completely impossible to enforce, and that will drastically slow down scientific and mathematical progress. All so a piece of plastic that says "TI" on it can only run TI's buggy code?
Wow. I ... just don't know what to say.
You also use the word "owner". Who owns a number? Does TI own the number because they used it to sign some software? Can I "own" the number 4 because I say I do? If you are in a situation where you have four pieces of candy, and want to split them between you and your friend, should you have to inform me of your intentions and wait 6 months before giving yourself two pieces of candy and your friend the other two pieces? Why not? I'm the owner of the number 4, and anything you do with it needs my approval.
The thing about "personal gain" is also insane. Everyone uses facts for personal gain. Big investment banks analyze market trends to make themselves billions of dollars. TI assumes you can't factor a number, and they use that to prevent you from cheating on math tests. All "personal gain" of the same variety. Should all enterprise be made illegal?
Now that I think about it, I guess your post is sarcasm... but you had me worried there for a minute.
If you ask me in private, I think that copyright is no longer enforceable, and thus should be done away with. And philosophical, so called intellectual property restricts what I can do with my physical property.
My grandparent post expressed a more guarded opinion. And telling somebody that you broke his cryptosystems (or his key) before going public with it, is at least good manners.
(US laws are not in general properties of the universe, though I understand that appearances can be deceiving.)
Anyway, enough arguing. Let me just say `Hitler' to close this thread by Godwin's law.
Breaks of cryptography systems in general can also be expressed as numbers. Quite naturally. And so can all binary representations. The American law system certainly does view numbers as being able to be placed under copyright (or similar restrictions).
And numbers aren't a property of the universe. They are made up by humans.
But more philosophical, it's the question of `oneness' that problematic. How can you define objects? All edges are arbitrary and if you look close enough they even blur.
(Of all the numbers the `natural' numbers are the most unnatural. Though they do describe some features of nature quite well, most scientiest would agree that e.g. complex numbers and vector fields are much more closely aligned to nature.)
Leopold Kronecker thought, "God created the integers; all the rest is the work of Man." Today we now better. The integers are no exception.
(Anyway, in practice every mathematician behaves like a Platonist no matter what his philosophical viewpoints are.)
(1) If you're trying to teach mathematical _concepts_ then make your problems come out to whole numbers that are easily done with pencil and paper.
(2) If (1) was true then maybe we'd see some real innovation in the calculator space, especially if the single-purpose electronic device costing $100 from TI had to compete with iphone apps costing $1. Or Google Calculator. Or Wolfram Alpha.
(3) I've anecdotally heard from my math-tutoring friends that there is a growing pandemic of high school kids in America that can't multiply single-digit numbers anymore. O_o
That's painful!
I would tell the students: "The numbers should come out easy. If you get something weird, then one of us made a mistake!"
This simple change made a huge improvement in comprehension in the class. It wasn't about "number jamming" any more, but about learning.
Part of our jobs is to prepare students to use mathematics in engineering, physics, chemistry, etc. We don't want to always give problems where the numbers are nice.
Is (3) a problem? How many people can find interpolating polynomials? Very few. Interpolating polynomials are no longer needed by most students of mathematics because computing power is cheap and ubiquitous. The skill set for mastering mathematics has changed given this reality.
Think of it this way. Very few people can start fire without matches or flint. This used to be common knowledge years ago but is no longer needed. Fire making devices are cheap and plentiful.
AI researchers came to this conclusion a long time ago. Reasoning or experience is not enough - you must have codified, accessable knowledge on which to work.
Not knowing basic arithmetic cripples you when you need to work on the next stage. Not knowing that 7*8 is 56 means you can't work out the expansion of (x+1)^8. Working simple cases like that makes it clear what's happening when you differentiate, and gives insight that you can't obtain without doing the work.
The maxim from medicine is "See one, do one, teach one." The middle step is crucial. If you get the computer to do everything, you never gain the experience, and rarely have the insights.
And, personally, I can interpolate polynomials. It's an interesting example, because recently it allowed us to implement a new feature in our system. No one else to work out how to do it, and were amazed when I did.
In your terms, I can make fire in a world where most people can't. It just earned us real money.
The division of labor has rendered many once necessary skills the province of specialists. This is a good thing. Is arithmetic one of those things? I begin to believe so. The expansion of (x+1)^8 does not require the ability to do 7*8. One can do the expansion using Pascal's Triangle.
Besides, the real question is ought one do the expansion of (x+1)^8 by hand? The answer is no. The expansion is a purely mechanical process. A computer does it faster and more accurately. In such a long problem I am likely to make a mistake and this mistake does not mean that I don't know what I am doing.
I do want my doctor to thumb through reference books particularly if my condition is rare. In such a case it is unlikely that the doctor will have encountered my condition and I want her to gain from the shared experience and collective wisdom of experts. That's what a reference book is for and it's a good thing. I want my doctor to be able to read and understand the book. That is what her training is for.
One can get insights into algebra using a computer. It's just that the insights are different than what one could get without a computer. Instead of teaching interpolating polynomials in high schools they are teaching basic statistics and in this present age the latter is much more beneficial than the former.
The point of doing the expansion of (x+1)^8 (to continue the example) is not to get the answer, but to see the patterns building. You say you can do it easily enough by using Pascal's triangle, but finding that insight alone is worth the time.
Just last week I saw someone differentiate x^(1/2) by using a calculator to convert 1/2 to a decimal, putting it at the front, then carefulyl subtracting 1 from it, and getting 0.5 x^(-0.5). Right answer. Then they did the same for x^(1/3) and got 0.334 x^(-0.667) and got full marks. Follow the process by rote, and don't think.
I know I'm fighting a losing battle, because "Get the computer to do it" is too easy. What is lost is hard to see, and once it's gone it's impossible to regain. I wish I'd learned a langauge when I was 15 or younger, instead of now when I'm nearly 50. I'm constantly surprised that I can get answers to questions far, far faster than my colleagues and employees using techniques I learned when I was 12. I'm not using experience or any great gift, I'm using what everyone was taught in school at that time.
It's still useful. Perhaps I should be grateful that these skills are disappearing because I'm certainly never out of work.
It used to be the case that high school students were taught interpolating polynomials but they aren't anymore. It used to be taught to make estimates on what log(1.0356) is based on a table to values. When calculators became common the old timers would say things like,
"Wow, kids these days. They don't know anything. They have to rely on a calculator to find what log(1.0356) is. I can do that using interpolating polynomials and a table of values."
I suspect everyone on this website using a calculator to find log(1.0356).
I've interviewed senior candidates who can't do basic arithmetic in their head. I had one project management candidate, who was doing fairly well up until that point on the interview loop, who literally couldn't multiply 600 by 3 in their head, nor on the whiteboard.
Tell the truth: why did you choose those two numbers, specifically? Oh, because they allow you to unlock a TI calculator. So (the judge would say), you are publishing a secret key. You are not publishing random number products for the fun of seeing how many digits your calculator can handle.
Taken to the extreme, this is the same argument as a hacker saying: I didn't break into the bank's computers, I just wrote a program, and the program is the one that broke into the bank. I was just typing on a keyboard, that's all I did.
Intent.
What if there was a table of all numbers and their factorizations, 1 = 1, 2 = 2, 3 = 3, 4 = 2 * 2, ... If you noticed TI was using a number in this list as their signing key, you could just look it up. Would that be illegal?
Then why is it illegal to lazily generate this list as needed?
What other properties of integers are illegal to discuss?
(FWIW, I am almost certain that the DMCA does not apply to this case, anyway. TI is just sending letters Because They Can and because there is no penalty if they're wrong. I can send you a C&D telling you to take down the above comment. The appropriate response is to mock me, not to take the comment down.)
Basically, TI should have used a bigger integer. Why rely on something as flaky as the legal system to protect your business model when you can use mathematical fact instead? (Answer: because using a bigger number would have added 1 cent to the cost of every calculator sold. Sending C&Ds is free.)
Sir, is that the only large number that you published? Are you saying that your interest in this number has nothing to do with its presence as a key in TI's calculators? How come a search of your house found all those dumps of TI firmware? Seriously?
Don't get me wrong, I'm on your side, but this defense is called "playing stupid" and it is known not to work.
The question here is not about copyright, however. (Probably. Maybe.) The question here is whether it is legal to factor an arbitrary number and inform others of the results.
But anyway, how hard does the math problem have to be before it becomes illegal to solve? If my signing key is 4, would it be illegal for someone to say "Gentlemen, it has come to my attention that the number 4 is the product of 2 and 2."? Why?
How is 4 different from 68575999143494039 77654744967172758 17990411426461294 73261271699761332 96980951450542789 80888450430107555 07864648023040197 95402754670660318 614966266413770127 ? (I need to know what the law is before I can try to avoid breaking it.)
Also, is the mere act of looking up the factorization of this number in a table illegal? If not, what about using a program that has the number stored in a table? If not, what if that program lazily computes the factorization. Is strict evaluation legal, but not lazy evaluation?
How about if I have a friend that randomly wants to know the factorization of a number and I compute it in my head? What if it's for breaking a cryptosystem, but I don't know that, I just think it's a problem he's challenging me with? Who broke the law? What law was broken?
Anyway, I don't think you've thought this through. You used the word "cute" dismissively, though, which was very cute...
How is "Limp" different from "Limp, the body of Gorrister hung from the pink palette; unsupported—hanging high above us in the computer chamber; and it did not shiver in the chill, oily breeze that blew eternally through the main cavern. The body hung head down, attached to the underside of the palette by the sole of its right foot. It had been drained of blood through a precise incision made from ear to ear under the lantern jaw. There was no blood on the reflective surface of the metal floor. [...]"?
Well, that is the point, isn't it. It is about intent, not the difficulty of the problem. Picking up a wallet is easy, taking someone's wallet is illegal.
But, the intent here: "use my own software on my own hardware", is (or should be) legal - all the rest is fluff.
Yes, absurd, but if you can patent genes (!) is it that much of a stretch to assert copyright on specific numbers?
http://www.ornl.gov/sci/techresources/Human_Genome/elsi/pate...
I tend to disagree. Not with the argument itself, but with the deception in covering the original issue with a much toned down one. The hacker who did this was not trying to innocently post the results of some factoring problem. He posted the results to a specific factoring problem. Then he posted an article titled "83+ OS signing key cracked!". Clearly he was not trying to just factor those numbers.
How Texas Instruments should have ideally reacted to these results is debatable, the fact remains that what the hacker did was not pure white.
How would you feel if somebody figures out your SSN and post it online? Is it just another mathematical truth that is allowed to flow freely through the universe?
Dear HN, everything cannot be explained by math.
It's not stopping copyright violation at all. It's preventing "unauthorized" software from running on the hardware.
I simply don't see how the DMCA applies here. In fact I can't see how any copyright law at all applies here.
No one is copying any code, they are running their own code. The key they found convinces the device to use their code.
It's not that the number is being used to protect copyright - it's a signing key that prevents you from installing different software on your calculator.
But yes. The DMCA has the provision about publishing DRM circumvention techniques and tools. This seems to be one.
Stupid and unfair, BTW. TI is hurting itself more than its user base.
Excuse me, taking down a link to a discussion of the key? Does the DMCA really extend that far? If it does, it really sounds like it could be challenged on First Amendment grounds. Otherwise, either this guy has no backbone, or there is more to the story.
It's not the law as written, but as it plays out in the larger socio-economic sphere, that is often determinant. It doesn't matter what your rights are, if the other guy can spend you into the ground with impunity.
Taken to extreme, it's one reason we regulate monopolies (in the U.S.). You may come up with a better product, but if the other guy has a lock on the market...
If you don't have the resources, the wherewithal yourself to execute the fight, how do you make it? On your own, your one option is the shop for a lawyer who believe you have enough of a chance that their willing to invest in the effort (in return for a hefty share of any judgment in your favor). If you are fortunate, the EFF or another organization may take up your case and use the pooled contributions of its members to fund the fight.
Even then, what will the publicity do to your career and other aspects of your life, depending on who you work for, etc. Fighting such things, one way or another, is important, but it is not easy and not everyone has the means, financial or otherwise. The means to fight, and/or the means to survive if the judgment (and penalties) goes against them.
"Oh my good lord...
You need to explain how you did this. Now. To somebody.
EDIT: I just confirmed this is what I think it is. This needs to go to ticalc.org. Are you being intentionally cryptic about this and want to stay unknown?"
There might be a larger monetary value associated with the actual OS code, than with the hardware design itself.
As I said though, I'm not sure about the details here; you'd of course expect the CPU on the calculator to be able to access the ROM code in order to run it, but perhaps it's somehow obfuscated when that happens.
Even if they are somehow relying on this key to prevent cloning, are they seriously under the impression that a 512-bit key is sufficient to keep a bunch of guys in Shenzhen from making a firmware-compatible device? Any effort to clone has long since come to fruition, and it's extremely likely they know this.
My guess: lawyers justifying their existence by picking fights with people they expect can't fight back. I'm glad the EFF has stepped in.
Now imagine a homebrew OS where you hit the "press-to-test" keys, and the light blinks, but all the calculator's functionality is still there. If this became prevalent, then schools could outright ban the calculators on tests, so students would be less likely to buy them. Lost sales from this would dwarf any pickup from home hobbyists.
If you can hack the OS you can use it to store answers, notes or similar aids in cheating for an exam. If the platform isn't locked down they'll lose their exam board approval which would have a big impact on that models sales.
http://education.ti.com/educationportal/sites/US/productCate...
http://education.ti.com/educationportal/sites/US/productDeta...
Notice on the page it also says - "Count on TI calculators at exam time. You can use this TI graphing calculator on the PSAT, SAT, and ACT college entrance exams, IB, and AP tests."
2008-09 list of approved calculators:
http://www.collegeboard.com/student/testing/ap/calculus_ab/c...
Link to a letter from TI: http://www.brandonw.net/calcstuff/DMCA_notice.txt
Does TI have any competitors? Do they have an exclusive agreement to supply calculators that can be used on standardized tests?
In a great many cases, yes. That's why they never seen to change or innovate, and also why they're coming down like a load of bricks on anyone who hacks their firmware.
The HN userbase appreciates a high signal/noise ratio. Merely calling something "cool" is considered noise.
Hope that helps.