April 1993 - cypherpunks-legacy

Artilce
by Haywood J. Blowme 21 Apr '93

21 Apr '93

The Washington Times April 17, 1993 Saturday, Final Edition Government picks affordable chip to scramble phone calls. By Frank J. Murray [Nasty sarcastic comments inserted by psionic(a)wam.umd.edu ] [Typing errors by me. ] President Clinton gave a major boost yesterday to one telephone- scrambler technology in a decision its delighted manufacture likens to the choice of VHS over Beta for videotape machines. Mr. Clinton's action could allow the use of relatively cheap scramblers on almost every cellular, business and government phone and make scramblers common even on ordinary home telephones. An administration official said the consideration will be given to BANNING more sophisticated systems investigators cannot crack, thereby creating a balance between banning private encryption and declaring a public right to unbreakably coded coversations. ^^^^^ [Does this assert that the government has an inherent right to ] [hear everything its citizens say? Or does it mean that only ] [the government has a right to good encryption systems?? ] "We've got a balance we've got to strike between the public's important need for privacy and the public's need to be assured it's save from crime," ^^^^^ [What crime? Please cite an example where an encrypted message was later] [proven to be connected with a criminal activity. (Messages intercepted ] [from the CIA don't count because they never do anything illegal.) ] [Also what are the chances that a criminal that doesn't want to get ] [caught will actually use this crippled chip? ] said Raymond G. Kammer, acting director of the National Institute of Standards and Technology, which developed the system with the National Security Agency. [And of course the NSA would never think of listening to every sattelite ] [communication coming into and out of this country would they? ] In an unusual decision he said was examined by the National Security Council, Mr. Clinton directed the Commerce and Justice departments to encourage the development of the high-tech system, which inludes electronic master keys to enable law enforcement officials to decode transmissions if they obtain court orders. "This technology preserves the ability of federal, state and local law enforcement agencies to intercept lawfully the phone conversations of criminals." Mr. Clinton said, citing the fear that encryptoed phones could aid terrorists and drug dealers. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [If you want to spook americans, just say the word terrorist or drug ] [dealer. Realistically, they have the money to buy good, secure crypto] [gear. Again, is this system to realy catch "Drug dealers" and ] ["terrorists", or is it to spy on citizens and businesses?? ] The system is designed to protect from unauthorized interception the electronic transmission of conversations, computer data and video images at a cost per telephone that could be under $30, said Ted Bettwy, executive vice president of the manufactureer, Mykotronx Inc. of Torrance, Calif. He said the chip announced yesterday, internally referred to as MYK-78, costs about $40 and uses an algorithm 16 million times more complex than that used by chips now on the market. Computer hackers have penetrated the current chips. ^^^^^^^^^^^^^^ [This is incorrect. If they have penetrated the "Current Chips" this is ] [news to me. If they could break the current technology so easily then ] [there would be no need for the clipper chip would there? ] The new chip uses an 80-bit code instead of the 56-bit code that is the digital encryption standard (DES). [Yeah, well IDEA uses a 128 bit key. My RSA Public key is 1024 bits. ] [If I were to use an 80 bit public key that would be considered weak. ] [So I don't care how many bits it has, I want to see the algorithm and ] [then decide. Too bad it's classified... ] The new chip eventually could sell in lots of 10,000 for about $25 each, Mr. Kammer said, with later versions priced around $10 each. Government engineers at NSA and the Commerce Department's NIST designed and developed the chip, which was then produced by privately owned Mykotronx and a publicly traded subcontractor, VLSI Technology. A Silver Spring [Maryland] competitor cried foul, particularly because the commercial device was developed without notice or competitive bids in a classified laboratory that does work for the National Security Agency. "If the purpose of this chip is to catch bad guys, then no bad guy will use it." said Stephen Bryen of Secure Communications Technology in Silver Spring, which produces a competitive chip he said could sell for $10. "The answer is to invest more money intor breaking codes," Mr. Bryen said in an interview after yesterday's announcement. "They're trying to put us out of business." Mr. Kammer said the secrecy was justified. "The technology we're using was actually developed in a classified environment in the first place and then transferred to a sole-source supplier. I don't know that there was any way around it," he said in an interview. The Justice Department will buy several thousand of the Mykotronx devices, which use a "Clipper Chip." They are being incorporated into other systems by Mororola and American Telegraph & Telephone Co., Mr Bettwy said. [So this means that secret agencies will still have access to secure ] [communications devices. While the ordinary person will not. Sounds ] [fair enough for me! ] Other sophisticated encryption systems do not allow ready access for authorized law enforcement purposes, said Mr. Bryen, who predicted that an ^^^^^^^^^^ [Also don't allow access for unauthorized law enforcement either] elaborate security plan for the electronic master key would not prevent misuse. Mike Newman, a spokesman for the National Institute of Standards and Technology, said "The key is split into two parts and stored separately to ensure security of the key system." ^^^^^^^^^^^^^^^ [If the key is stored in a computer database, then unauthorized access] [is possible no matter what precautions are taken to ensure security. ] Access would be provided to the two parts for an agency that produced legitimate authority or a court order, he said. The Justice Department will determine whether the two parts will be held by separate federal agencies or a federal agency and a private agency. "This chip is going to do something that we, the citizens, really need, and that is to allow us the privacy we want as common citizens," Mr. Bettwy said in a telephone interview from California yesterday. [Translation: "This chip is going to do something that we, the NSA, ] [really need, and that is to allow us to listen to whoever we want ] [whenever we want to, whether they are private citizens, or commercial] [organizations." ] He said the vital part of yesterday's decision is the government's declaration that it intends to use the device. Mr. Bettwy says that use will establish his device as the new standard and will require private facilities to use the same system to communicate with the govenment. He said the decision's impact is "exactly" like the adoption of VHS standards, making most private use of Beta video systems obsolete. [But that doesn't mean that VHS is better just because it is the standard] "I hope that's true," he said of the business implications for Mykotronx. "We're hoping this will become the new standard." [Translation: "I hope that's true," he said of the business implications] [for Mykotronx. "Because were going to reap a lot of cash out of this ] [bloated hoax of a system. ] Only compatible phones can receive secure communications from a phone using a clipper chip. "To me the real siginificance is if everybody uses this, everybody can talk to anyone else," Mr. Bettwy said. [And only the govt. can listen. That makes me feel safe.] "It creates false hope," Mr. Bryen said. "The secret key could fall into other people's hands. When you create a system that has a back door, other people will find the back door." [Amen. ] ------------ end of article ----------------- The government is making this chip out as a great gift to humanity. This is really too bad because people are losing quite a bit of privacy with this new farce the government is trying to pull. I'm writing my congressman tommorrow to voice my concerns. Also I'll try to contact the company mentioned in there (in Silver Spring, MD) to find out information about their chip. I'll post the information here.. ============================================================================= /// | psionic(a)wam.umd.edu | Fight the WIRETAP CHIP!! Ask me how! __ /// C= | | \\\/// Amiga| PGP Key Available | "Those who would give up liberty for \/// 1200 | by request. | security deserve neither." =============================================================================

3 2

Re: Webs of Trust vs Trees of Trust
by Mark C. Henderson 21 Apr '93

21 Apr '93

-----BEGIN PGP SIGNED MESSAGE----- Subject: Re: Webs of Trust vs Trees of Trust On Apr 20, 14:45, Norman Hardy wrote: } Subject: Webs of Trust vs Trees of Trust } As I understand RIPEM there is a tree of agencies such that everyone } must trust all elements of the tree between him and the root. I just want to point out (as has been pointed out before) that it is a mistake to confuse RIPEM with PEM. RIPEM is an implementation of a subset of PEM. At this moment, RIPEM has absolutely no support for certificates or signed public keys. PEM on the other hand, is a draft internet standard which requires certificates and a hierarchy that can be described as a "Tree of Trust". There are at least a couple of full PEM implementations. Probably the best known at this point is the one from T.I.S. which is currently in beta test. Apologies in advance for cluttering the mailboxes of the majority of cypherpunks who already know this. Mark - -- Mark Henderson mch(a)squirrel.wimsey.bc.ca markh(a)wimsey.bc.ca -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK9S+T+I11LPFgBXjAQF9EwP+J69peq9ccWAvKIlzVRI88QbD5ZN4RIwA GmVw8FzOCAu0tK3MQqoeBu+//gQfD6MoEBeGXvBzXJffNGVc2UvPk8vr/uB1y9Je K5y7mlQNrGoil9wxv6kR9IgVgHzkOsXBSo3Uv/ldpVQL82jR4Ms0qccF8fAcjpHB wDtNiEZkPc4= =Yo4O -----END PGP SIGNATURE-----

1 0

Ad hoc Cypherpunks meeting April 24
by Eric Hughes 21 Apr '93

21 Apr '93

ANNOUNCEMENT ============ Ad Hoc Cypherpunks Meeting on the recent Wiretap Chip proposal. Where: Cygnus Support, Mt. View (directions follow) When: 12:00 noon sharp - 6:00 p.m. I'm mad as hell. I know that a lot of other folks are too. So I'm calling an ad hoc meeting to vent some spleen, to calm our heads, and to plan a counterattack. If you have any interest in this whatsoever, please attend. As with all cypherpunks meetings, this meeting is open. Tell anyone you want to tell. Show up. Encourage your friends to show up. I'm going to try to get some of the folks from RSA Data Security to show up, as well as some others who would normally not attend. Eric Hughes cypherpunks list and ftp maintainer AGENDA ====== 12:00 - 6:00 Wiretap chip discussions. There will be a break. DIRECTIONS ========== Cygnus Support 1937 Landings Drive Mt. View, CA 94043 +1 415 903 1400 switchboard +1 415 903 1418 John Gilmore Take US 101 toward Mt. View. From San Francisco, it's about a 40-minute drive. Get off at the Rengstorff Ave/Amphitheatre Parkway exit. If you were heading south on 101, you curve around to the right, cross over the freeway, and get to a stoplight. If you were heading north on 101, you just come right off the exit to the stoplight. The light is the intersection of Amphitheatre and Charleston Rd. Take a right on Charleston; there's a right-turn-only lane. Follow Charleston for a short distance. You'll pass the Metaphor/Kaleida buildings on the right. At a clump of palm trees and a "Landmark Deli" sign, take a right into Landings Drive. At the end of the road, turn left into the complex with the big concrete "Landmark" sign. Follow the road past the deli til you are in front of the clock tower that rises out of one of the buildings, facing you. Enter through the doors immediately under the clock tower. They'll be open between noon and 1PM at least. (See below if you're late.) Once inside, take the stairs up, immediately to your right. At the top of the stairs, turn right past the treetops, and we'll be in 1937 on your left. The door is marked "Cygnus". If you are late and the door under the clock tower is locked, you can walk to the deli (which will be around the building on your left, as you face the door). Go through the gate in the fence to the right of the deli, and into the back lawns between the complex and the farm behind it. Walk forward and right around the buildings until you see a satellite dish in the lawn. Go up the stairs next to the dish, which are the back stairs into the Cygnus office space. We'll prop the door (or you can bang on it if we forget). Or, you can find the guard who's wandering around the complex, who knows there's a meeting happening and will let you in. They can be beeped at 965 5250, though you'll have trouble finding a phone. Don't forget to eat first, or bring food at noon! I recommend hitting the burrito place on Rengstorff (La Costen~a) at about 11:45. To get there, when you get off 101, take Rengstorff (toward the hills) rather than Amphitheatre (toward the bay). Follow it about ten blocks until the major intersection at Middlefield Road. La Costen~a is the store on your left at the corner. You can turn left into the narrow lane behind the store, which leads to a parking lot, and enter by the front door, which faces the intersection. To get to the meeting from there, just retrace your route on Rengstorff, go straight over the freeway, and turn right at the stoplight onto Charleston; see above. See you there! John Gilmore

2 1

Petition to Clinton, digisigned
by zane＠genesis.mcs.com 21 Apr '93

21 Apr '93

I noticed someone post about writing up a petition and emailing it to Pres. Clinton, signing it with digital signatures, but that was in a joking manner. To me it seems like a good idea. What do others think? Good/bad? (I'm not too PGP-experienced-- The petition would be circulated and people would create "signature certificates" and forward those to the person sending the petition-- once all the signatures are collected then the petition and all the certificates would be sent together? I'd imagine that the signatures certs could be sent in a different package than the petition, but I don't think Clinton's aides would be able to recognize that all the certificates belong with the petition.) -- | Sameer Parekh-zane(a)genesis.MCS.COM-PFA related mail to pfa(a)genesis.MCS.COM | | Apprentice Philosopher, Writer, Physicist, Healer, Programmer, Lover, more | | "Be God" - Me __ "Specialization is for Insects" - Robert A. Heinlein ____/ \_____________/ \____________________________________________________/

1 0

No Subject
by uni＠acs.bu.edu 21 Apr '93

21 Apr '93

Does anybody know of specific examples of wiretapping without a search warrant, or beyond the scope of the search warrant that we can cite? Especially famous ones (didn't Nixon wiretap somebody?) ----- By exec. order (12333 is it?) those suspected of espionage for a foreign may be wiretaped, searched without warrant. (foreign = foreign power)

1 0

Anonymous Remailers, WB etc.
by norm＠netcom.com 21 Apr '93

21 Apr '93

If I were chartered to be prepared to find the source of anonymous mail, and had the money, attitude and resources that skeptics among us assume are available for such efforts, here is how I would proceed. This plan is due, in part, to my experience in building secure operating systems. I would catalog the various weaknesses of Unix and perhaps other systems where the remailers live. I would make a list of remailers and suspected remailers. I would design programs that would inhabit the remailer machines benignly except for gathering information that I need. Such efforts are a natural by product of the public NCSC charter to know OS weaknesses. I would further examine the IP protocols for weaknesses. Those protocols trust not only the machines thru which the data flows but also trusts other machines on the net not to introduce phony datagrams that at least bolix legitimate traffic and may well spoof it. This is aided by a real time passive tap on the links carrying the legitimate traffic. It is not the style of this group to study OS security and I don't propose to change the style. OS security and protocol security may, however, be an Achilles heel to anonymity.

1 0

Webs of Trust vs Trees of Trust
by norm＠netcom.com 20 Apr '93

20 Apr '93

I have worked with the NCSC (National Computer Security Center) on certifying operating systems according to the "Orange Book". As I understand RIPEM there is a tree of agencies such that everyone must trust all elements of the tree between him and the root. This is much ingrained in all of the legally mandated security systems that I am aware of. It assumes, at first glance, that there is a root, an inner sanctum, which is totally trusted by all. The Orange Book for operating system security has such assumptions embedded deeply. We had to essentially weeken our security features by disableing our "mutually supicious user" logic to meet their requirements. >In <40485.pfarrell(a)cs.gmu.edu> Pat Farrell says: >At this Fall's National Computer Security Conference, Mr. McNulty >was a speaker on the NIST's digital signature session. They talked about >both the non-RSA DSS, and use of Certifying Authorities with a RSA-based >scheme. >>At that same conference, I gave a paper on security that described >a fishnet of trust between systems. This was written in February 92, >well before I read Phil's "web of trust" from the PGP docs, which I >read sometime over the summer. >During the Q&A, I asked Mr NcNulty to compare the advantages and >disadvantages of a heirarchical CA approach to an interlocking fishnet/web >of trust. I hoped he would at least recognize that any heirarchy has >problems from the top down if an upper level is compromised. Instead, >he could not address any differences. I believe that working in the >government has made the hierarchy seem to be the only implementation that >he envisioned. He fobbed the question off to one of his technical >underlings, but he, too, was unable to answer it (or even coherently >address it). It is a pervasive mind-set in military security.

1 0

Webs of Trust vs Trees of Trust
by norm＠netcom.com 20 Apr '93

20 Apr '93

I have worked with the NCSC (National Computer Security Center) on certifying operating systems according to the "Orange Book". As I understand RIPEM there is a tree of agencies such that everyone must trust all elements of the tree between him and the root. This is much ingrained in all of the legally mandated security systems that I am aware of. It assumes, at first glance, that there is a root, an inner sanctum, which is totally trusted by all. The Orange Book for operating system security has such assumptions embedded deeply. We had to essentially weeken our security features by disableing our "mutually supicious user" logic to meet their requirements. >In <40485.pfarrell(a)cs.gmu.edu> Pat Farrell says: >At this Fall's National Computer Security Conference, Mr. McNulty >was a speaker on the NIST's digital signature session. They talked about >both the non-RSA DSS, and use of Certifying Authorities with a RSA-based >scheme. >>At that same conference, I gave a paper on security that described >a fishnet of trust between systems. This was written in February 92, >well before I read Phil's "web of trust" from the PGP docs, which I >read sometime over the summer. >During the Q&A, I asked Mr NcNulty to compare the advantages and >disadvantages of a heirarchical CA approach to an interlocking fishnet/web >of trust. I hoped he would at least recognize that any heirarchy has >problems from the top down if an upper level is compromised. Instead, >he could not address any differences. I believe that working in the >government has made the hierarchy seem to be the only implementation that >he envisioned. He fobbed the question off to one of his technical >underlings, but he, too, was unable to answer it (or even coherently >address it). It is a pervasive mind-set in military security.

1 0

Re: Another Clipper weakness
by Hal 20 Apr '93

20 Apr '93

-----BEGIN PGP SIGNED MESSAGE----- From: "Perry E. Metzger" <pmetzger(a)lehman.com> > The number N is not secret and is not random -- it is therefore not > necessary that the PRNG generate N, and indeed N is not generated, it > is given. Its presumably just an ordinary serial number. Yes, sorry, I was confused about that. N is indeed an ordinary serial number. > Why not just generate U1 and U2 by a more straighforward approach that > doesn't involve strange padding and odd randomly selected constants? > Indeed, why not just use true random numbers? Surely a radioactive > source isn't unavailable to Mykotronix. Again, I think the fact that the S1 and S2 are introduced by agents of the escrow organizations is supposed to make the process appear more trustworthy. Since the escrow organizations must be trusted, it does not add any weaknesses to have them creating the random seeds for the keys. Getting numbers from a true random source would be better in some ways, but it would be hard to know whether the source was truly random and was not subtly hacked by the NSA to reduce the randomness. Verifying the randomness of a black box could not be done easily on site. With the S1/S2 approach, theoretically an escrow agent could stop the process at some point and issue a challenge, making S1 and S2 public and verifying that the keys were in fact generated by the specified algorithm. However, there has been no discussion of such a challenge in the key-creation protocol. > Furthermore, Denning says about 300 chips are programmed in a batch > using baroque methods in a vault. Well, folks, that just won't do if > twenty or thirty million of these babys are being sold a year -- or > even if just five million are sold a year. Seems to me that the > processing is going to have to get more efficient, and likely thus > much more sloppy. Yes, this is a good point, although it depends on the specific numbers of chips being produced and how long it takes to go through this process for a batch of 300 chips. I gather that the chips are actually programmed in this vault, under control of the laptop computer which holds the keys (and is then destroyed? Ha!). If they had a batch programmer which actually did 300 chips in a tray, then several batches could be done in a sitting. There are probably a few hundred million phones in the U.S., but I doubt that more than a few percent of them would be secure phones in the next three or four years. This might correspond to a production level of a few hundred thousand chips per year, which would be a couple of dozen batches per week. This sounds doable. Beyond this point there would be problems, though. Probably other manufacturers would be involved by then. Hal -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK9Q8HKgTA69YIUw3AQEYkwP/USkSY0pWeJEBXT+A8guzc+pVXJzNXExk alGJoOLo3E9ZvJEW/e1sbO9TM1AjGnXdHrPMACqIdPUHdn+wnKE3jLBH/026ncQw POeYBIaKuqvkV0HMkf3ebu4YXr06D9o3sapl0DnpZDm5RNUkoGpUvKpWa6EEJUDt yBuCGiW5qsk= =tpn9 -----END PGP SIGNATURE-----

1 0

Denning Unmasked
by L. Detweiler 20 Apr '93

20 Apr '93

Denning, April 19 >I'd like to add that I was not in >any way involved. I found out about it when the FBI briefed me on >Thursday evening, April 15. Mr. May calls Mrs. Denning's claims that she was ``not in any way involved'' with this project ``curious''. I'm a bit amazed at everyone's tiptoeing around Mrs. Denning and reluctance to challenge her outright given overwhelming evidence as to her two-facedness. Maybe it is her established reputation in the field, maybe it is her cryptography book, maybe it is her participation at conferences like CFP. Nevertheless, I cannot let lies stand. Mrs. Denning wants to have her cake and eat it too. She wants to be perceived as an unbiased academic and taken seriously for her participation in scientific forums. She also wants to mask her involvement in this proposal, which for me, appears unequivocal, and only the *degree* and *extent* is unclear. I cannot comprehend how she cannot be involved. It would not be so outrageous if she stated that ``I cannot comment on my involvement for obvious reasons''. But her denial to me has all the signs of a desperate fabrication. Lets look at what she's done: 1. She was the *first*, if I'm not mistaken, to bring up the idea of splitting keys among impartial agencies many months ago on sci.crypt after the firestorm and barrage of protests on the initial balloon on key registration. 2. She has shown ``prescient insight'' (as another tiptoer noted on sci.crypt) into anticipating major aspects of the proposal. Key registration itself was largely unheard-of until she began advocating the idea. She posts a massive technical description to sci.crypt less than a week after her initial ``briefing''. 3. The rhetoric (more aptly called propaganda) of the public announcement closely mirrors words and arguments she used in the initial debate on sci.crypt, esp. the ``need to balance legitimate law enforcement goals with privacy.'' 4. Since she persists in her sheer, ugly chutzpuh, and people here and on sci.crypt are still pussyfooting around her, I must offer my new evidence. In early April I became extremely concerned about her continuing advocation of key registration in the recent further CACM articles in the face of such vocal opposition and defiance on sci.crypt. I was astonished with the claims in her latest posting to sci.crypt when I read it on 28 March, and replied to it. I expressed my appreciation for her postings, because ``you're definitely one of the most highly regard personalities in this area posting publicly,'' (I was disenchanted enough then not to say `authority') and I wrote of my extreme concern with her seeming evasion of addressing critical aspects of the key-registration idea from a scientific standpoint. I advised her to ``abandon the idea to salvage the remainder of your reputation''. I will be quoting only some critical parts of her letter now (there is only one, but it speaks volumes), and I ask that I not be assaulted for this, because in my opinion the extreme circumstances merit it, and her hypocrisies cannot go unchallenged! Her comments follow her pattern of revealing a few more details of the overall plan after being violently assaulted on the revealed ones. (I remind the reader that this all transpired before any knowledge on my part whatsoever of the Clipper proposal, but apparently not before her own...) - - - L.D.: (Sun, 28 Mar 93 22:13:06 -0700) >The issue is not that "the government is corrupt QED" but that such a >system would be such a tremendous temptation to a government only bordering >on moral rectitude, as ours generally is... Part of the idea of >democracy is not even INTRODUCING mechanisms that have a potential for >extremely insideous and treacherous abuse. D.D.: (Tue, 30 Mar 93 17:23:14 EST) >I am convinced that with the new technologies and crypto, we can make it >extremely difficult -- much more difficult than now -- for the government >to perform illegal taps. L.D.: (Sun, 28 Mar 93 22:13:06 -0700) >I like those new technologies for the same revolutionary reasons. >hehe, we can make it IMPOSSIBLE right now for the government to tap AT >ALL. I guess you can imagine how appealing your proposal is in the face >of this. We're doing just fine, thank you very much. The best thing >the government can do on this issue is STAY OUT OF IT. Given it's >unweildy and intrusive history, this is quite an optimistic expectation. - - - L.D.: (Sun, 28 Mar 93 22:13:06 -0700) >There are just no good assurances that these kind of systems won't >be radically abused, and until you describe precisely how to do this >most reasonable people will not touch your proposals with a 20ft >pole, even in cyberspace... D.D.: (Tue, 30 Mar 93 17:23:14 EST) >Obviously a much more detailed proposal would be needed in >order to answer all the questions people have asked. L.D.: (Tue, 30 Mar 93 17:03:04 -0700) >We eagerly await such a proposal from you or others, to show how none >of the specifics can possibly be implemented without a totalitarian >state, bizarre and unrealistic assumptions, unbearable and >anti-competitive commercial restrictions, or new grotesque government >bureacracies. - - - L.D.: (Sun, 28 Mar 93 22:13:06 -0700) >The issue is not that "criminals won't comply QED" >but that "enforcement is impossible except in a totalitarian state". D.D.: (Tue, 30 Mar 93 17:23:14 EST) >Not necessarily if you don't try to demand 100% compliance. Everyone is >required to register their car, and this has not required a totalitarian state. >Compliance might be enforced only when there is already probably cause and >a warrant issued. Compliance might be promoted by putting requirements on >products that are sold. L.D.: (Tue, 30 Mar 93 17:03:04 -0700) >I object to this vehemently. I consider this somewhat of a subterfuge. >The public then may not be aware how much they are spending to promote >an agenda of the anointed government officials' plans detrimental to >privacy. It would weaken technological competiveness, for companies to >be burdened by these artificial and warped restrictions. > >Unfortunately, I find it one of your most dangerously insidious ideas, >because it has the most likelihood of influencing some naive, >uninformed, and misguided policymaker... > >These policies you have in mind are exactly the kind that sound good on >paper and intent, but when implemented come nothing close to the >intentions of the purveyors, who on hint of failure would then >disassociate themselves, saying that ``it wasn't implemented according >to my suggestions.'' That's the problem, its an inherently flawed idea >to begin with, and NO implementation would have the desired effect... - - - D.D.: (Tue, 30 Mar 93 17:23:14 EST) >I do not find >sci.crypt a constructive environment to explore the issues or try to develop >a more concrete proposal, so I will use other forums for this. L.D.: (Tue, 30 Mar 93 17:03:04 -0700) >definitely, Usenet has all the delicacy, subtlety and finesse of a >melee. On the other hand, it also has a low tolerance for pretentious >and impractical ideas ... > >I'm serious. I think you ought to stop promoting the idea. Otherwise, >the label "Denning Proposal" will have all the valiant credibility that >the label "Chamberlain Treaty" had after WWII.... Don't say I didn't warn >you! > >Do you know how much trouble the NSA has caused for the development and >proliferation of cryptography? Do you think they have harmed American >interests in the international market? Weakened their ability to >compete? I guarantee that all this would PALE TOTALLY in comparison to >any kind of key-registration scheme, and would earn its advocates, in >historical hindsight, the utmost black discredit imaginable. - - - Mrs. Denning did not respond to my letter of Tue, 30 Mar 93 17:03:04 -0700, for obvious reasons... Let me add that of all the things she wrote about, the `commercial compliance by requirements on products sold' alarmed me the most, and I thought she might be hinting at Telephony-style bill. I considered sending a warning to the cypherpunk list, but decided that it would be premature and I intended to watch and wait for more signs first... Perhaps I am condemning aspects of my own future in academic circles for attacking Denning. Perhaps I am the subject of zealous blacklisting at this moment for my public comments on the Clipper chip. But I cannot be silent in the face of repulsive and outrageous hypocrisy. Because of her denial, I have no alternative but to recognize Mrs. Denning as the intellectual and moral equivalent of a double-agent. She is a traitor to at least *one* cause. I hope her friends involved in the Clipper proposal appreciate her work in that area, because, for me, she no longer has any credibility whatsoever as an unbiased cryptographic authority or an honest and ethical scientist. Like a compromised code, the integrity has been lost... NOTE! this letter is a *warning* for the private cypherpunks list only! I do not grant, and specifically prohibit, redistribution. If Mrs. Denning publicly addresses the points I have raised in this letter, I will consider my sincere trust misguided and violated.

1 0