May 1993 - cypherpunks-legacy

CPSR Seeks Clipper Docs
by Dave Banisar 29 May '93

29 May '93

PRESS RELEASE May 28, 1993 CPSR Seeks Clipper Documents - Brings Suit Against NSA and National Security Council Washington, DC -- Computer Professionals for Social Responsibility filed suit today in federal district court seeking information about the government's controversial new cryptography proposal. The "Clipper" proposal, announced by the White House at an April 16 press conference, is based on a technology developed by the National Security Agency that would allow the government to intercept computer encoded information. Law enforcement agencies say that capability this is necessary to protect court ordered wire surveillance. But industry groups and civil liberties organizations have raised questions about the proposal. They cite the risk of abuse, the potential loss in security and privacy, costs to US firms and consumers, and the difficulties enforcing the policy. Marc Rotenberg, CPSR Washington office director, said "The Clipper plan was developed behind a veil of secrecy. It is not enough for the White House to hold a few press conferences. We need to know why the standard was developed, what alternatives were considered, and what the impact will be on privacy. " "As the proposal currently stands, Clipper looks a lot like 'desktop surveillance,'" added Rotenberg. David Sobel, CPSR Legal Counsel, said "CPSR is continuing its oversight of federal cryptography policy. These decisions are too important to made in secret, without public review by all interested parties." In previous FOIA suits, CPSR obtained records from the General Services Administration questioning the FBI's digital telephony plan, a legislative proposal to require that communications companies design wiretap capability. More recently, CPSR obtained records through the FOIA revealing the involvement of the National Security Agency in the development of unclassified technical standards in violation of federal law. CPSR is a national membership organization, based in Palo Alto, CA. Membership is open to the public. For more information about CPSR, contact CPSR, P.O. Box 717, Palo Alto, CA 9403, 415/322-3778 (tel), 415/322-3798 (fax), cpsr(a)cpsr.org

1 0

Electronic Contracts
by RAGLAN54%MMC.BITNET＠uga.cc.uga.edu 29 May '93

29 May '93

Just a thought here. I'm still new to this cryptography thing, taking it seriously, have read through the FAQ and the past week or so of posts here. I just got a copy of PGP tonight, and on reading through the manual, something leaped out at me: electronic signature validation. If your private key acts as validation for a message, then what you have is an electronic signature that could be verified, and thus you could sign a contract online; you're snet the contract in email, you attach your private-key signature to it and email it back, and voila, you've entered into a contractual agreement that would stand up in court. Has there been a test case of this? Are there any lawyers or other legal types on this echo that could give an opinion on the validity of this idea? Or has this issue been discussed before? Andrew *5

1 0

Sternlight forgery
by L. Detweiler 29 May '93

29 May '93

Sheesh, hours spent on the Mycotronx posting are rewarded with uniform deafening apathy, and this gets all the reaction. I'd never have thought I'd be flamed for condemning a forgery. When did it happen that cancelling other's postings and deceitful forgeries wasn't taboo? Ok, ok, maybe it never was, and nothing's sacred in cyberspace; don't flame me with the history of Usenet taboos. Perhaps I didn't make this clear, but the names and themes (Zimmerman, Bidzos, RSA, PGP, other cypherpunk members) in the forged letter suggested to me a cypherpunk subscriber may have been responsible. Otherwise, I would not have posted it here. It's just my modest warning and reminder that while we might be revolutionaries we're not scoundrels. I take exception to the description of the posting as an `innocent joke'. I have no problem with an `innocent joke' like this being posted under someone's name or even anonymously. It seems to me at least some of the intent was rooted in malice and deceit. Ah, but I'm starting to sound like Depew. peter honeyman <honey(a)citi.umich.edu> >go hang with spaf if you want to deal out this kind of bullshit. >cypherpunks are not the cops of the net. Ouch. I assure you Mr. Spafford is not my type, and anyway he has apparently resigned from the position of net.policeman so the point is mute. (At the quasi-demise of anon.penet.fi there was a lot of rumor and speculation that he was the `highly regarded net personality' who sent the poison letter alluded by Helsingius. I wonder if that tipped him over the edge?) Excuse me, I just thought it might give some bored cypherpunk something to do with their afternoon in helping track down the posting. I think I'll just go lurk in a dark Usenet corner. L.

1 0

Re: Public Apology [ARTICLE IS A FORGERY]
by kocherp＠leland.stanford.edu 28 May '93

28 May '93

Here's a copy of the forged note, plus my response. Regards, Paul Kocher kocherp(a)leland.stanford.edu - ------------------------------------------------------------------------------- Article 499 in alt.privacy.clipper: Path: nntp.Stanford.EDU!headwall.Stanford.EDU!agate!howland.reston.ans.net!usc!c s.utexas.edu!not-for-mail From: strnlght(a)netcom.com (David Sternlight) Newsgroups: alt.privacy.clipper Subject: Public Apology Date: 27 May 1993 01:58:35 -0500 Organization: DSI/USCRPAC Lines: 36 Sender: daemon(a)cs.utexas.edu Message-ID: <9305270624.AA00395(a)silverton.berkeley.edu> NNTP-Posting-Host: cs.utexas.edu In article <9305270624.AA00395(a)silverton.berkeley.edu> you write: >Dear Friends, > >Many of you have come to know me through my public analysis of >encryption technology and the law as I understand it. I have taken the >past few days to reflect on my positions. I now realize that I myself >have been misled and in turn may have been misleeding some of you. I am >very impressed with the quality and clarity of thought that many of you >on the system have displayed in your numerous and extensive replies to >my ruminations. Unfortunately, I have also been impressed with the >misleading and self-serving views presented by my former friend Jim >Bidzos, and by my colleagues in the United States Government. Recently, >some have called me a dupe, and, understandably, I have reacted >strongly. Only now do I realize how right they have been. > >Let me now try to explain my current thinking: Democracy, as defined by >our founding fathers, and the Greek philosophers before them, has as its >cornerstone free and unfettered public discourse. In our modern world, >privacy and the ability to speak without fear of disclosure or reprisal, >is a prerequisite for all but the most perfunctory such discourse. If >there is one thing I should have learned in my journeys to our spanish- >and portuguese-speaking neighbors to the south, it is that the >government can never be relied upon as the guarantor of privacy. >Contrariwise, it is all too often positioned as the infractor. We should >not, nay, we must not, allow the trivia of narrow-minded export >restrictions and the tyranny of questionable patents to stand in the way >of our personal liberties. > >I therefore undertake to present my public apologies to such enlightened >and forward-thinking members of our community as Daniel Bernstein, >Vesselin Bontchev, Peter Honeyman, Perry Metzger, and especially Phil >Zimmermann. I can only hope they will find the generosity to judge me >not on my past, but on my present and future actions. > >-- >David Sternlight Great care has been taken to ensure the accuracy of > our information, errors and omissions excepted. - ------------------------------------------------------------------------------- My article to sci.crypt and alt.privacy.clipper follows Newsgroups: alt.privacy.clipper,sci.crypt Subject: Re: Public Apology [ARTICLE IS A FORGERY] Summary: Expires: References: <9305270624.AA00395(a)silverton.berkeley.edu> Sender: Followup-To: alt.privacy.clipper Distribution: Organization: DSG, Stanford University, CA 94305, USA Keywords: In article <9305270624.AA00395(a)silverton.berkeley.edu> strnlght(a)netcom.com (David Sternlight) writes: >Only now do I realize how right they have been. I'm quite certain this post is a forgery. Plenty of things seem wrong here. For example, David doesn't usually post through cs.utexas.edu (which is reportedly is one of the least difficult sites to use for forging news articles). Other things are also wrong with the header... FLAME MODE: In my opinion, posting this represents a disgusting violation of net ethics (and the law). It is frightening that someone could be so immature as to attempt to damage David's relationships with Jim Bidzos and others. Hopefully someone can kill the article before it propigates too far... Regards, Paul Kocher kocherp(a)leland.stanford.edu [I'm sending this to sci.crypt in addition to alt.privacy.clipper, where a supposed "Public Apology" from David Sternlight was posted.] ------- End of Forwarded Message

1 0

Steganography
by TO1SITTLER＠APSICC.APS.EDU 28 May '93

28 May '93

I headed to the library to check out what they had, crypto-wise. I found one book copyright 1939, which had a chapter on methods of steganography. Some of the suggestions I got from it: -Use every third letter of each word. -Use every nth letter of each word, where n varies depending on a key. (e.g., 2-4-1-5-5-3) -use every nth word of a sentence. -encode in base-3 before steganizing. -use the number of syllables in a word. -use the number of words in a sentence. Irrelevant suggestions: -use different fonts. (within the same word.) -use broken and whole pickets in a fence. -use empty and full positions in a cartridge-belt, as in machine gun. -use invisible ink instead, it's easier. :-) Maybe these will help those more able to program than myself. Kragen.

2 1

Re: Physical Links
by bakunin＠gnu.ai.mit.edu 27 May '93

27 May '93

Well, gee. Now, if we do all our encrypting at home, and only encrypted messages make it onto them thar links, wouldn't that help some? Not that physical links aren't a particular weak point. Just that. michael -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.2 mQCNAiwCUMgAAAEEALVBnm7CCroKf8P9qh+yB5c4QCCEhZ8AtaqMnqf7UEHxmHXW WTClI/LGZaMzTZGE6Mw8J8O6EVJK/7WvGg23YPXXm4t+8sLW+QESFbJbhksZjZaG dTmG4QH10b09K9/qYdugh2c7O01VqU7CD1ZgHMpp8VkVHcda0tF7S6aYxdMbAAUR tChNaWNoYWVsIEJha3VuaW4gPGJha3VuaW5AZ251LmFpLm1pdC5lZHU+ =xJ6U -----END PGP PUBLIC KEY BLOCK-----

1 0

Physical Links
by Kent Hastings 27 May '93

27 May '93

Physical Links Public key and other crypto techniques have been discussed here. So has TEMPEST shielding against eavesdropping. But, there hasn't been a discussion of physical data link options (unless it was "before my time"). IMHO, this topic should have a place in the FAQ. m. Physical Data Links. a. Telco/Dial-up b. Radio 1. VLF 2. MW (near Broadcast AM) 3. Shortwave 4. VHF 5. UHF 6. Microwave c. Infrared/Visible Free Space d. Laser/Maser Beam n. Modulation Techniques. a. AM b. SSB c. ACSSB d. FM e. SSTV f. FSTV g. Spread spectrum (hybrids of the following) 1. FH - frequency hopping 2. DS - direct sequence 3. TH - time hopping 4. TR - transmitted (noise) reference 5. SR - stored (usually pseudo-noise code) reference o. Network elements (?) 1. Wire and cable (underground, disguised) 2. Point-to-point (radio) 3. Simple repeaters/linear translators (transponders) 4. Regenerative repeaters (digital packet) 5. Satellites 6. Meteor scatter 7. Moonbounce I'd like to see pro and con discussion of these items. Having encrypted messages won't do any good if Our Enemy simply pulls the plug at the telephone company. Kent - kent_hastings(a)qmail2.aero.org. #000#

1 0

Interim patch for ytalk
by miron＠extropia.wimsey.com 27 May '93

27 May '93

I also intend to change the name of the program to PGTalk. If anybody has better ideas, please let me know. This patch is important for the security of the encryption. The idea was to have cipher feedback (pun intended!). Somehow I reversed a couple of lines. *** ytalk/idea.c Thu May 27 13:40:36 1993 --- pgtalk/idea.c Thu May 27 13:40:52 1993 *************** *** 504,510 **** { idea_ecb(iv,temp, Z); /* encrypt iv_idea, making temp. */ ! if (!decrypt) /* buf is ciphertext */ /* shift in ciphertext to IV... */ cfbshift((byte *)iv,buf,chunksize,IDEABLOCKSIZE); --- 504,510 ---- { idea_ecb(iv,temp, Z); /* encrypt iv_idea, making temp. */ ! if (decrypt) /* buf is ciphertext */ /* shift in ciphertext to IV... */ cfbshift((byte *)iv,buf,chunksize,IDEABLOCKSIZE); *************** *** 511,517 **** /* convert buf via xor */ xorbuf(buf,(byte *)temp,chunksize); /* buf now has enciphered output */ ! if (decrypt) /* buf was plaintext, is now ciphertext */ /* shift in ciphertext to IV... */ cfbshift((byte *)iv,buf,chunksize,IDEABLOCKSIZE); --- 511,517 ---- /* convert buf via xor */ xorbuf(buf,(byte *)temp,chunksize); /* buf now has enciphered output */ ! if (!decrypt) /* buf was plaintext, is now ciphertext */ /* shift in ciphertext to IV... */ cfbshift((byte *)iv,buf,chunksize,IDEABLOCKSIZE);

1 0

Questionable instances?
by fergp＠sytex.com 27 May '93

27 May '93

On Wed, 26 May 93 2:18:52 CDT, Peter Meyer <uunet!cactus.org!wixer!wixer.bga.com!meyer> wrote - > My previous message to cypherpunks, the one which had > subject heading "AT&T" and which began: > "I recently switched my long distance carrier from AT&T to another, > since they bribed me to do so with an offer of $35." > seemed to be posted OK (it apparently came back to me as expected) > but I also got this funny bounce message: >From attmail.com!uucp(a)cactus.org Tue May 25 23:37:59 1993 [ remainder of header deleted ] > This seems odd. What's going on? Do all messages with "AT&T" in the > subject line get siphoned off somewhere for review? Did this one > generate a bounce message because the account of Bryan Petty, AT&T spy, > wasn't receiving tonight? OK, I'm just paranoid. (Paranoia - that's > your state of mind when you finally realize what's really going on.) At least I'm not the only one who has recently noticed this. I had to do a double take when I received not only my original post on UUNet questions from cypherpunks-request(a)taod.com, but I received a second copy with this header:

3 3

Re: VinCrypt
by greg＠ideath.goldenbear.com 27 May '93

27 May '93

-----BEGIN PGP SIGNED MESSAGE----- J. Michael Diehl <uunet!triton.unm.edu!mdiehl> writes: > > Even as a former 'hacker' myself, the second to last person I would > > trust not to install a backdoor (next to the NSA) is a hacker. > > Are you meaning to imply that there is a backdoor in this package? If so, how > do you justify this claim? It seems safer to assume that the software is insecure, until proven otherwise. This is the approach that's been taken with the Clipper chip, and seemed reasonable in that case - I suggest that it is in this case, as well. > > In addition, merely having been a systems hacker hardly qualifies > > one for writing complex crypto software. Without any assurance as > > to the authors' qualifications for writing a crypto package, or > > their integrity. Even if I could trust their integrity, I'm very > > leery of black-box software. > > You seem to know something about them that I do not. Care to share your > knowledge? Thanx in advance. Rather, the original poster (Clark Reynard) seems to *not* have information - e.g., information about how or why the author(s) of this crypto package are trustable, or why we should consider their software secure if we can't look at the source. If they are so naive as to think that the NSA can't afford a copy of Sourcer and a few person-hours to disassemble VinCrypt, what other (absurd) assumptions have they made? If a machine can execute it, a machine (or a machine and a person) can disassemble it. I can't believe that anyone's willing to take this VinCrypt crap even a little bit seriously. Any dork with a laser printer can print up a press release and mail it out - looks like maybe this was a slow week for the computer press. As far as I can tell, we're supposed to assume that VinCrypt is useful software because of the political/social perspective of its authors. While I share their suspicion of the powers that be, I do not trust them to write software that is free of intentional and/or nonintentional weaknesses. -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLARuSX3YhjZY3fMNAQESdQP+LP7jdBJLzvzDItehb4Lwwwch9Wi1LfS6 5pvPd/+NeXYNb2RDYSbf7RNvQ6nQTgLYvD9cs8Xw5kXAJzhA/6PVULgMj66OsC63 3SMeVzQuu3Ui0Ki0nF+RslKNDL/gffurPSzJ9Pwn4uCiAFiXObjkriYE5M02bJOw Ax7pVUq7ueQ= =Mj7Z -----END PGP SIGNATURE----- -- Greg Broiles greg(a)goldenbear.com Golden Bear Computer Consulting +1 503 465 0325 Box 12005 Eugene OR 97440 BBS: +1 503 687 7764

1 0