January 1993 - cypherpunks-legacy

Re: 5th AMENDMENT & DECRYPTION
by tony＠morgan.demon.co.uk 26 Jan '93

26 Jan '93

In message <9301260801.AA18233(a)netcom3.netcom.com> you write: > > > from: john.nieder(a)f33.n125.z1.fidonet.org > > (commenting on the strategy of "taking the 5th" on the matter of > decrypting one's files) .................. > > With strong crypto, e.g., with 300 decimal digit moduli, the "costs" > of decryption by brute force could easily exceed the GNP/GDP of the > U.S. ........ > bagged" the house, perhaps a simple pass phrase was used in lieu of > memorizing 300 digits, and so on. But what is encrypted with the 'simple phrase' is quite short and does not provide much material for cryptanalysis. Tony +-----------------+-------------------------------+--------------------------+ | Tony Kidson |`morgan' is an 8MB 486/33 Cat-| Voice +44 81 466 5127 | | Morgan Towers, |Warmer with a 670 MB Hard Disk.| E-Mail | | Morgan Road, |It resides at Morgan Towers in| tony(a)morgan.demon.co.uk | | Bromley, |Beautiful Down Town Bromley. | tny(a)cix.compulink.co.uk | | England BR1 3QE |Honda ST1100 ==*== DoD# 0801 | 100024.301(a)compuserve.com| +=================+===============================+==========================+

1 0

Re: 5th AMENDMENT & DECRYPTION
by tony＠morgan.demon.co.uk 26 Jan '93

26 Jan '93

1 0

Re: 5th AMENDMENT & DECRYPTION
by karn＠qualcomm.com 26 Jan '93

26 Jan '93

Mike Godwin (formerly, I understand) of EFF and I had a lively discussion on precisely this topic back at the Hackers' Conference. Mike insists that there is no firm legal theory or case law on which to base an assertion that the 5th amendment would shield you from being compelled to divulge an encryption key that could then be used to decrypt information to be used as evidence against you. He says that the closest the Supreme Court came to this issue was an offhand remark in a 5th amendment case to the effect that "of course, we couldn't compel the defendant to, say, reveal the combination on a lock". I forget the precise legal term that Mike used to refer to this comment, but he said it didn't establish a binding legal precedent because it didn't relate directly to an issue in the case at hand. On the other hand, several other lawyers I've asked have responded "of course!" when I ask them whether the 5th amendment would protect a defendant from being compelled to divulge an encryption key without immunity for the evidence it might decrypt. My own opinion, given that I seem unable to get a complete consensus from the lawyers, (has this *ever* been possible?) is that the issue is as yet untested in court and could go either way depending on the actual case. But Mike seems much more pessimistic, and he *is* a lawyer. I'm not. Don't give up working on those steganographic schemes just yet. And wherever practical (e.g., for communications as opposed to storage), use a key management scheme that doesn't leave anything around that can be seized or subpeonaed after the fact (e.g., Diffie's "perfect forward secrecy" scheme.) Phil

1 0

Re: This list...
by Phiber Optik 26 Jan '93

26 Jan '93

> > The whole point of this list is to develop techniques to ensure privacy -- > > most of us understand that there isn't much right now. > > but but but ... sendmail already offers an easy way to hide the membership > of a mailing list. why not use it? > > peter > Thank you. Welcome to the world of common sense. It's a given that certain things you just can't be secure against. But when you don't take every precaution, no matter how small, it's called laziness. Not fixing it with the excuse that people have to understand or accept the overall insecurity of things in general sounds pretty idiotic to me. It isn't such a big deal.

1 0

anonymous server compilation?
by ld231782＠longs.lance.colostate.edu 26 Jan '93

26 Jan '93

Hello. To my knowledge no public listing of known anonymous servers has been compiled. I'd like to start one. This could possibly turn into a FAQ if response is good. I will put in this newbie-type introductory information at the end of this document for review. Please help me improve this by sending constructive/informative feedback, esp. sections flagged with (?). This all is very weak right now but with your help it could become very thorough and valuable. pax.tpa.com.au -------------- The most sophisticated anonymous posting system to my knowledge. Uses public key encryption for traffic in both ways (to/from) the server. No anonymous remailing capabilities yet but dclunie(a)pax.tpa.com.au, the administrator, says he's considering it. Had a serious bug recently fixed that caused a reassignment of previously allocated anonymous addresses. Located in Australia. anon.post.g(a)pax.tpa.com.au for anonymous USENET posting where `g' is the group anon.info(a)pax.tpa.com.au for information anon.subscribe(a)pax.tpa.com.au to subscribe to the mailing list acs(a)n7kbt.rain.com ------------------ no info (?). given to me by dclunie(a)pax.tpa.com.au godiva.nectar.cs.cmu.ed ----------------------- operated by Karl_Kleinpaste(a)cs.cmu.edu. Mentioned by julf(a)penet.fi in an introductory information. This person has posted code to alt.sources that implements anonymous server capabilities. (?) anon.penet.fi ------------- operated by julf(a)penet.fi. Both anonymous posting and remailing capabilities. (?) hh(a)pmantis.berkeley.edu ----------------------- no info (?). given to me by tcmay(a)netcom.com Anonymity and Identity on the Internet ====================================== Generally, identity is amorphous and almost nonexistent on the Internet for a variety of reasons. One is the inherent fluidity of "cyberspace" where people emerge and submerge frequently, and absences are not readily noted in the "community". You currently do not really have any great assurance that the messages you get in mail and the messages you see on USENET are from the people they appear to be from, nor do others have of you. Be careful not to be led astray; gullibility is perhaps the greatest crime here, and skepticism the most useful virtue. Neither are there currently good assurances of privacy in your personal email, and cases where it has been compromised are not uncommon. New encryption technologies are slowly gaining acceptance and penetration into systems that make possible digital encryption and authentication that will make the systems more trustworthy. These can also protect your identity and privacy by offering anonymous posting and mailing capabilities. USENET USENET is a worldwide decentralized news distribution system, adhering to Internet standards described in RFC977 (?). MAIL The characters that you are reading are almost certainly encoded in ASCII, the American Standard Code for Information Interchange that maps alphabetic and symbolic characters onto numeric codes and vice versa. Virtually every computer system uses this code, and if not, has ways of converting to and from it. When you write a mail message, it is being sent in ASCII, and since the standard is virtually universal, there is no intrinsic privacy. Anyone with access to hardware involved in forwarding the message can theoretically read it. Internet mail standards, described in RFC (?), are still evolving rapidly and not entirely orderly. For example, standards for mail address `munging' or `parsing' tend to vary slightly between sites and frequently mean the difference between finding addresses and bouncing mail. New standards are calling for uniform introduction of "privacy enhanced mail" (PEM) which uses encryption technologies to ensure privacy. The current internet mailing protocol is slightly anachronistic in that it was created when the system was somewhat obscure and not widespread, with only a fraction of the traffic it now sees. Today about (?) of internet traffic is mail, comprising about (?) messages. (Source: (?)) A person's mailing address is far from an identification of an individual. First, anyone with access to the account, e.g. they know the password, either legitimately or otherwise, can send mail with that address in the From: line. Secondly, as part of current mailing protocol standards, forging the From: line is a fairly trivial operation for many hackers. Much less forgable is the status and path information prepended to messages by intermediate hosts. Note that bounced messages go to postmasters at a given site in their entirety. This means that if you address mail with an incorrect address it has a good chance of being seen by a human other than the recipient. Theoretically people at any site in the chain of sites that forwards a given mail message over the Internet (about a half-dozen (?) on average, depending on the distances) could potentially compromise the privacy of that message and read it. In practice, this appears to be rare or unheard of. Something more common is instances of immature and unscrupulous system operators reading private mail at a local site, such as a university. The requirements and screening for getting a system administration job (and access to *all* information on a system) vary widely between sites and are sometimes frighteningly lax. ANONYMOUS MAILING ----------------- Some people find it useful to send anonymous mail to others. Examples of this include (?). Here the distinction should be made between sort of "hit and run" mail, where the sender does not want to carry on any further communication, and anonymized mail, where the recipient can respond but has no idea of the sender or origination of a message. The servers listed above allow for the latter type of communication. The former type is now largely confined to hackers who find it convenient for scurrilous threats or whatever, but probably has legitimate uses as well (?). Another category is people who want to appear to have regular but not traceable appearances, i.e. the userid and site origination do not obviously flag their mail as anonymous. Unfortunately, no set of standards is in place to handle the procedures for anonymous posting. Typically the approach is to set up an "anonymous server" that, when activated by email to its address, responds by allocating and supplying an "anonymous ID" that is unique to the person requesting it (based on his email address). This will vary for the same person for different machine address email originations. To send anonymous mail, the user sends email directed to the server containing the final destination. The server "anonymizes" the message by stripping of identification information and forwards the message, which appears to originate from the anonymous server only from the corresponding anonymous user id.

2 1

NSA STRENGTH
by John.Nieder＠f33.n125.z1.FIDONET.ORG 26 Jan '93

26 Jan '93

from: john.nieder(a)f33.n125.z1.fidonet.org >> I am doubtful of the 40,000 figure even with contract employees. That's >> a small army. What the hell could keep that many people busy? (shudder) >NSA occupies two very large office buildings, including the longest >corridor in the world (a mile, if I recall correctly, but my copy of >"The Puzzle Palace" is not handy). I went and took a look, and can >confirm the parking lot is _huge_. As is the case with a good many other gov't. agencies, one can be sure that all the crew are not 9-to-5ers showing up at one office. >The 40,000 figure may or may not be accurate, as the NSA won't say. >Some say the employment is closer to 100,000. Certainly it is much >higher than that of the CIA. It has been a good many years since I traveled in the lower strata of these circles, but it was my information that the NSA, at least at that time, had a manpower pool "hugely greater than the CIA's." It is my understanding that the NSA budget is highly classified - unavailable even to most members of Congress. >Bear in mind that they are the nation's >primary SIGINT facility... I believe you'll find that the NSA also is involved in SATINT & ELINT as well. Never Say Anythings are busy little bees. >operating the various listening posts in >conjunction with military personnel (via Army Security Agency, Naval >Security Group, Air Forc, etc.). It is my belief from personal experience that the NSA requests & receives operational assistance from those innocuous agencies in positions to gather information of use to the NSA in the course of their routine duties. >As always, read James Bamford's "The Puzzle Palace," which gets >referred to a lot on this list. I've tried to read this famous tome a couple of times, but have been unable to hack its turgid prose. Someday. perhaps... > Public Key: waiting for the dust to settle. Excuse me, Tim? JN -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.1 mQCNAitWeuoAAAEEAN2DcLjYiri8Th9HlUFfCxSyxt/FZLjIX121kWoGax9hb8wM QRTtjeN+FKHdkdzD8zr7P+GbExF0X5DhZp02O1te6/2fuHDESHYUsymQpyDqoJpH wd7xZ/VraYhEX6eQzbbS4k5jbdQLzzIdgD8URzAMXYmTkvLrXhAm8ppE4nk3AAUR tDFKb2huIE5pZWRlciA8am9obi5uaWVkZXJAZjMzLm4xMjUuejEuZmlkb25ldC5v cmc+ =237u -----END PGP PUBLIC KEY BLOCK----- ... Who has the USSR's BIOWAR contageous snakebite virus? --- Blue Wave/Opus v2.12 [NR] -- John Nieder - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!33!John.Nieder INTERNET - John.Nieder(a)f33.n125.z1.FIDONET.ORG

1 0

Re: New Anonymous Remailer site avail.
by The Phantom 26 Jan '93

26 Jan '93

On Mon, 25 Jan 1993, Peter Honeyman wrote: > > After the forcing down of the penet site ... > > you mean pax, not penet, right? > > peter Yes -- sorry. Matt Thomlinson University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 528-5732 PGP 2.0 key availaible via email or finger phantom(a)hardy.u.washington.edu

1 0

Re: New Anonymous Remailer site avail.
by Peter Honeyman 26 Jan '93

26 Jan '93

> After the forcing down of the penet site ... you mean pax, not penet, right? peter

1 0

Re: anonymous server compilation?
by Peter Honeyman 26 Jan '93

26 Jan '93

> Unfortunately, the anonymous sytem at pax has been closed, as the local > network in Australia was considered unsuitable for this kind of thing, > partly due to the narrow bandwidth of the link to the US, and partly because > of the prevailing attitude at the US end that anonymous mail is generally > a bad thing. i thought the latter theory was debunked -- ? peter

1 0

Re: public servant privacy
by Peter Honeyman 26 Jan '93

26 Jan '93

i believe there is a special exception related to automobiles that makes them subject to search without a warrant when the driver is placed under arrest. but check with a lawyer. peter

1 0