April 1993 - cypherpunks-legacy

MYK-78
by Arthur Abraham 26 Apr '93

26 Apr '93

26-Apr-93 For those awaiting my promised comments regarding this chip, I have the disappointing report that the individual I anticipated talking to was out of his town, and so not available today. If you have the data sheets for this chip, and have read them, I would be very interested to see your comments. Please respond to me directly, rather than the list at large, since my intent in this exercise it to replace deduction with disclosure, and avoid spreading any mis- or partial information. -a2.

1 0

Re: Privacy International (fwd)
by whitaker＠eternity.demon.co.uk 26 Apr '93

26 Apr '93

Nick Szabo writes: > > The following forwarded from alt.privacy. Anybody have experience > with this group? Have they taken a position on the wiretap chip? > > Subject: Group Info: Privacy International > Message-ID: <1993Apr12.184129.11455(a)mont.cs.missouri.edu> > Originator: rich(a)pencil.cs.missouri.edu > Organization: Privacy International > PRIVACY INTERNATIONAL > > A WATCHDOG ON SURVEILLANCE > > GENERAL INFORMATION > > PRIVACY INTERNATIONAL - THE BIRTH OF A WORLDWIDE MOVEMENT > > [Text elided for brevity] > If you are interested in getting involved in the work of > Privacy International, please contact Simon Davies, Marc > Rotenberg, or David Banisar at : > Simon Davies is in London now. He will have an email account soon. However, anyone who needs to contact him - on non-confidential matters - can send email to privacy(a)eternity.demon.co.uk. This is my machine; Simon will have his own soon. Russell Russell Earl Whitaker whitaker(a)eternity.demon.co.uk Communications Editor AMiX: RWhitaker EXTROPY: The Journal of Transhumanist Thought Board member, Extropy Institute (ExI) ================ PGP 2.2 public key available =======================

1 0

MacWeek article on Clipper/Capstone
by matt＠oc.com 26 Apr '93

26 Apr '93

MacWEEK 04.26.93 Page 1 SECURITY CHIPS TRIGGER ALARM Clipper and Capstone open digital back door. By Mitch Ratcliffe Washington -- The White House and National Security Agency, as part of a wide-ranging retooling of U.S. privacy policies, are preparing two encryption chips for use in the computer and telecommunications industries. Privacy advocates cried foul last week because the chips include a back door that allows police to monitor communications. The Clipper chip announced this month can encrypt voice and data communications at up to 16Mbps. Clipper is due to debut in secure telephones from AT&T Co. this summer. The second chip, called Capstone and currently under development at the NSA, is a superset of Clipper that will implement the much-criticized Digital Signature Standard to add authentication capabilities. Its existence was revealed during a briefing at the Massachusetts Institute of Technology in Cambridge last week. President Clinton ordered the National Institute of Standards and Technology to establish Clipper as a federal standard. Since the government is the largest computer customer in the world, its Federal Information Processing Standards (FIPS) often are imposed on the industry as de facto standards. If Capstone follows Clipper into the FIPS requirements, DSS could usurp RSA Data Security Inc.'s public-key encryption scheme, which Apple licensed for AOCE (Apple Open Collaboration Environment). But Apple's representative at the NSA briefing, Gursharan Sidhu, technical director of collaborative computer and leader of the AOCE project, said he is not worried that the government will force an encryption scheme on the industry. "We were given the impression that they are very open to suggestions," Sidhu said, adding that the government is faced with a growing conundrum as it tries to simultaneously protect privacy and maintain its ability to tap lawbreakers' communications. "People have the idea that in cellular the security of communications had gone away, so there is pressure to encrypt. [Without a back door], even the casual criminal would be able to communicate with invincible security," Sidhu said. "Law-enforcement agencies wouldn't be able to collect intelligence." A spokesman for NIST said Capstone will not be introduced unless the president's review of national encryption policy conclueds it is needed. But he also said the Department of Defense and NSA are already working to develope a PCMCIA card-based implementation of Capstone for a classified defense messaging system. The NSA confirmed it is working on Capstone but could not confirm the Capstone PCMCIA card project. Clipper and Capstone use a "key escrow" technology that lets law-enforcement agencies with a court order unscramble conversations and documents. To reduce the potential for wiretap abuse, two agencies to be named by Attorney General Janet Reno will hold half of each key. The NSA said the key escrow agents will not be law-enforcement agencies. Privacy advocates complained that the algorithms that perform Clipper scrambling functions will remain classified. Encryptin technologies typically gain acceptance only after cryptographers pore over the component algorithms and key management systems. "We can't protect the key escrow features if we reveal the algorithm to the public ... that's caused some heartburn," said John Podesta, staff secretary to President Clinton. "I'm not suggesting that the public should trust us any more than any other government agency, but we are doing a more comprehensive review [than any previous administration]." Podesta said the Clinton team is taking a free-market approach to encryption, in contrast to the previous administrations, which tried to legislate simplified approaches. "In the wireless communications environment, we have to more the ball forward on security and privacy," Podesta said. "The jury's still out on whether [Clipper] is the answer." Jim Bidzos, president of RSA Data Security of Redwood City, Calif., said the NSA is using Clipper and Capstone in an attempt to confuse the market for privacy-enhancing technologies. "It takes three or four years fo rthis kind of proposal to die." Bidzos said. Computer and communications companies might withhold support for any standard, giving the NSA more time to prepare for the encrypted world, he said. Computer Professionals for Social Responsibility, a Washington, D.C. based public-interest group, has filed 11 Freedom of Information Act requests for access to Clipper development records. The group suspects the NSA and NIST violated the Computer Security Act of 1987, whic limits the NSA's role in development of public encryption technologies to providing advice and assistance. NSA said it developed both chips.

1 0

apology
by Ed Mehlschau 26 Apr '93

26 Apr '93

Damn! I forgot to put the "-request" in the address. My sincere apologies; you know, it's Monday. -- Ed

1 0

subscribe
by Ed Mehlschau 26 Apr '93

26 Apr '93

subscribe (please) Thanks, -- Ed

1 0

CASH: Disney Dollars...
by Hal 26 Apr '93

26 Apr '93

I know we're all focused pretty closely on Clipper right now, but as time goes on we will pay attention to other things, and one of those is digital cash. We've had a lot of debate here about whether it would be legal to issue private cash. I went to Disneyland last week, and discovered that they are issuing their own form of cash: "Disney Dollars" (presumably a Disney trademark). Disney Dollars come in at least three denominations: $1.00, $5.00, and $10.00. They are very attractively printed notes, about the size and shape of American dollars. They're quite a bit more colorful but the layout of the bills is similar to other forms of currency. Disney Dollars can be exchanged with U.S. dollars on a one-for-one basis at the park. No sales tax is involved in the transaction. I saved a $1.00 Disney Dollar, a special issue to commemorate Mickey Mouse's 65th anniversary this year. Here is what it says: On the face: "Disney Dollars" "Mickey's 65th". In the fine print: "May be used as legal tender only at Disneyland park, Disneyland Hotel, Walt Disney World resort and the Disney Store (U.S.A. & Puerto Rico)." Another block of fine print: "Disney Dollars may be spent or collected and saved as souvenirs and are redeemable at any time before or after any period of inactivity." At the bottom: "A00651375A" "Series 1993" "One Disney Dollar". There is a picture of Mickey Mouse in the middle with the word "Mickey" under it. "Scrooge McDuck" has signed the bill above the word "Treasurer". On the back: "Disney Dollars" at the top; "One Disney Dollar" at the bottom, and a large colorful picture of Mickey in a car filling most of the middle. "(C) The Walt Disney Company" in fine print. If Disney can issue its own currency, maybe other people can, too. These are basically gift certificates. If somebody had some goods or services to sell, they could issue their own "dollars" which would be good for purchasing their things, but which could also be exchanged back for U.S. dollars if needed. Hal Finney 74076.1041(a)compuserve.com

1 0

REMAIL: Anonymous postin
by Hal 26 Apr '93

26 Apr '93

The message forwarded by Mark Ringuette was apparently posted to sci.crypt by using a cypherpunks remailer followed by a mail-to-news gateway. To recap on how to do this, put :: Request-Remailing-To: sci-crypt(a)cs.utexas.edu then a blank line at the front of your message, and mail to one of the remailers (Karl Barrus posts a list every month). For more security and in-practice untraceability, use one of Karl's scripts to set up a chained request with encryption. By bouncing your message around the country like this, decrypting at each stage, you get much better security than with just one hop. Change "sci-crypt" in the address above to the name of the newsgroup you want to post to, replacing the "." in the name with "-". (No, I don't know how you post to a newsgroup with a "-" in it. Maybe it just works.) I notice that the Comment field I put out on remailed message cautioning that it is coming from an anonymous remailer did not get passed through the mail-to-news gateway software at utexas. This leaves little clue about where it came from. It does make it pretty clear that you can't reply to it since it comes from "nobody(a)alumni.caltech.edu". As an aside, I'd like to encourage people not to use hal(a)alumni.caltech.edu so much and to use one of the others more. I have one at hfinney(a)shell.portal.com which I think may be more immune to political pressure. Unlike the alumni account, I'm paying for this one, which should give me some clout; and also, I remember hearing that at the hackers conference the head of Portal offered some support to the idea of anonymous remailers, so I'm hoping that management won't be quick to shut me down when people complain. Hal 74076.1041(a)compuserve.com

1 0

FWD: Jerry Berman, Mitch Kapor
by Marc.Ringuette＠GS80.SP.CS.CMU.EDU 26 Apr '93

26 Apr '93

A couple of interesting messages from sci.crypt: an anonymously forwarded letter from 1985 from Jerry Berman (Exec Director of EFF) to David Chaum, and a response to the posting from Mitch Kapor. To sum up: Berman suggested to Chaum (in '85) that he prefers legal remedies to technological ones, and doesn't like the idea of a society where people routinely hide from the law. The anonymous reposter is concerned with the discrepancy between EFF policy and these sentiments from Berman. Kapor responds to his concerns by saying that Berman now recognizes the role of technological solutions in the privacy equation. The EFF continues to be the best representative of hacker culture in Washington. -- Marc Ringuette (mnr(a)cs.cmu.edu) From: nobody(a)alumni.cco.caltech.edu Subject: Jerry Berman on pseudonymous privacy Date: 24 Apr 1993 10:38:38 -0500 Sender: daemon(a)cs.utexas.edu Hello all, I thought you all might like to see this. It's a letter from Jerry Berman to David Chaum from November of 1985, in response to information that Mr. Chaum sent to Mr. Berman. While I have to congratulate EFF for its prompt response to the Clipper Chip announcement from the White House, I think it's important to recognize the philosophy of their Executive Director, as explained below. I agree that legal remedies are important, but when pressed, I'd prefer to retain the ability to use purely technical solutions to preserve my privacy, because they'll hold up under fire. Mr. Chaum has consented to the publication of this letter on the Net. I don't work for, nor am I a member of EFF, ACLU, or any similar organizations, but I do agree with them on a great many things. --Aristophanes ---------- AMERICAN CIVIL LIBERTIES UNION WASHINGTON OFFICE 122 Maryland Avenue, NE November 1, 1985 Washington, DC 20002 -------------------- National Headquarters Mr. David Chaum 132 West 43rd Street Centre for Mathematics and Computer Science New York. NY 10036 P.O. Box 4079 (212) 944-9800 19O9 AB Amsterdam Norman Dorsen President Dear Mr. Chaum: Ira Glasser Executive Director Eleanor Holmes Norton CHAIR National Advisory Council Thank you for sending me a most interesting article. A society of individuals and organizations that would expend the time and resources to use a series of 'digital pseudonyms' to avoid data linkage does not in my opinion make big brother obsolete but acts on the assumption that big brother is ever present. I view your system as a form of societal paranoia. As a matter of principle, we are working to enact formal legal protections for individual privacy rather than relying on technical solutions. We want to assume a society of law which respects legal limits rather than a society that will disobey the law, requiring citizens to depend on technical solutions. e.g. require a judical warrant for government interception of data communications rather than encrypt all messages on the assumption that regardless of the lawt the government will abuse its power and invade privacy. As a matter of practicality, I do not think your system offers much hope for privacy. First, the trend toward universal identifiers is as much.-a movement generated by government or industry's desire to keep track of all citizens as it is by citizens seeking simplicity and convenience in all transactions. At best, your system would benefit the sophisticated and most would opt for simplicity. The poor and the undereducated would never use or benefit from it. Finally where there's a will, there's a way. If government wants to link data bases, it will, by law, require the disclosure of various individual pseudonyms used by citizens or prohibit it for data bases which the government wants to link. Since corporations make money by trading commercial lists with one another, they will never adopt the system or if it is adopted, will use "fine printn contracts to permit selling various codes used by their customers to other firms. The solution remains law, policy, and consensus about limits on government or corporate intrusion into areas of individual autonomy. Technique can be used to enforce that consensus or to override it. It cannot be used as a substitute for such consensus. Sincerely Yours, /Sig/ Jerry J. Berman Chief Legislative Counsel & Direrector ACLU Privacy Technology Project cc: John Shattuck From: mkapor(a)eff.org (Mitch Kapor) Subject: Re: Jerry Berman on pseudonymous privacy Originator: mkapor(a)eff.org Sender: usenet(a)eff.org (NNTP News Poster) Date: Sat, 24 Apr 1993 17:16:28 GMT nobody(a)alumni.cco.caltech.edu correctly states Jerry Berman's 1985 view on privacy, but he mistakenly assumes that this represents Berman's 1993 view as EFF Executive Director. As one of the people who convinced Jerry that legal protections for privacy are insufficient, and that technical measures, especially public key cryptography, are also vitally necessary, I can tell you that Jerry and EFF are fully committed to this position. The previous poster is apparently unaware of a long series of EFF positions in support of this view. I suggest those interested read EFF's position on Clipper or our other work in digital privacy. Check ftp.eff.org for more details. One of the great things about human beings is that they are capable of change and evolution in their thinking. The idea that crypto is critical to privacy is one which is no longer limited to certain net afficianados, but is spreading to parts of the public policy community in Washington. Mitch Kapor co-Founder, EFF

1 0

ADMIN: ftp usage statistics
by Eric Hughes 26 Apr '93

26 Apr '93

I get weekly statistics on the ftp usage at soda. We've been up at about near the top of the usage frequency for a while, but this week we hit number one, with over one third of the total ftp traffic here. We've even passed sfraves, which also runs on this machine. Hoo! Things are hoppin'. Eric ----------------------------------------------------------------------------- TOTALS FOR SUMMARY PERIOD Sat Apr 17 1993 TO Sun Apr 25 1993 For directory pub/cypherpunks: number of files: 1161 number of bytes: 180752541

1 0

talking to media
by mnemonic＠eff.org 26 Apr '93

26 Apr '93

[During the audio hookup at Saturday's meeting, the following paper of Mike Godwin's got mentioned; I asked if he could send a copy to cypherpunks. It's going in the ftp site, as well--Eric] Go ahead and forward this to cypherpunks. This is the short posting I wrote in 1990 when I explained how I got the Steve Jackson Games case into the press. ----- :r talking This is a file I posted to an Austin BBS back when I gave the SJG story to the local papers. 104: Talking to Media, part 1 By: Johnny Mnemonic [54] Date: 11:07 3/18/90 As I've promised on another message base, here's the beginning of discussion of how to bring stories to the media. Since I keep thinking of different things people ought to know about how to take a story to the media, I'm going to make this a multi-post discussion. 1) TRY TO THINK LIKE THE REPORTER YOU'RE TALKING TO. One of the things that happens when people know about an event or series of events that may make a good news story is that they assume the importance of the story will be obvious to anyone. Sometimes this is true (when the tipster knows about a murder, for example). Often it's not. So, when I tell a reporter about a story I think she should want to cover, I make sure to stress the aspects of the story that are likely to interest that reporter and/or the readers of her publication. For example, when I spoke to Kyle Pope about the Illuminati seizure, I stressed the following: a) Steve Jackson Games is an Austin business that may end up being damaged by the seizure. b) Nobody has given this story anything like major coverage in the national media, or (so far as I knew) in other geographic areas. (I was telling him he had a major "scoop" opportunity.) c) There are some very dramatic aspects to this story. (I told him about the 20-year-old LoD member who woke up on the morning of March 1 with a gun pointed at him by a Secret Service agent.) 2) IF YOU'RE GOING TO MEET THE REPORTER IN PERSON, TRY TO BRING SOMETHING ON PAPER. There are lots of good reasons to follow this rule: a) Believe it or not, but people take stuff on paper a little more seriously than the spoken word. It's nice to give the reporter something that lends substance to what you're saying, even if the substance is printouts from your own computer. b) It makes life easier for the reporter, who doesn't have to write down every single thing you tell her. Reporters like to have materials they can use for reference as they research and write their stories. c) It helps you remember to say everything you want to say. Nothing is more frustrating than trying to get a reporter interested in your story, getting inconclusive results, and then realizing later that you should have told the reporter about something. (E.g., "Damn! I forgot to tell him what 'cyberpunk' means, so he won't know how the federal agents misinterpreted the manual.") When I went to the Statesman, I took edited printouts of discussions from Flight, from SMOF, and from comp.dcom.telecom on Usenet. I also took some private Email I had received, with the names of the senders deleted. And I took my copy of the WHOLE EARTH REVIEW with the article on Usenet. My object was to convey to him the scale of concern about the seizures, plus give him enough background to be able to ask reasonably informed questions of the people he talked to. 3) GIVE THE REPORTER OTHER PEOPLE TO TALK TO, IF POSSIBLE. Two basic justifications for this rule: First, it'll help your credibility (especially if you don't already know the reporter personally). Second, multiple sources or witnesses usually enable the reporter to filter out what is mere opinion or speculation from what everybody actually knows for a fact. 4) DON'T ASSUME THAT THE REPORTER WILL COVER THE STORY THE WAY YOU'D LIKE HER TO. Reporters' accuracy and focus in a story are constrained by several factors: a) The amount of available time. Reporters have to be quick studies, and often have to assimilate a complex story in a hurry. This necessarily increases the risk of inaccuracy in a story, and gives you an even greater reason to follow Rules 1 through 3. 2) The reporters' obligation to be fair. This means they have to talk to people on the other side of the issues from you. This in turn means that you're unlikely to get a story that represents or promotes your point of view at the expense of those who oppose you. <More on this topic as I think of things. Please feel free to comment.> --Mike

1 0