June 1993 - cypherpunks-legacy

RE: Work the Work!
by fergp＠sytex.com 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- Date: Tue, 1 Jun 93 21:32:24 -0700 Eric Hughes <uunet!soda.berkeley.edu!hughes> wrote - > Paul, you of all people don't need to feel slighted when I urge > people to do something, anything, about the wiretap chips. Agreed. There are many, many things that we need to do to support opposition to this ruse. > Here is my own very short version of my policy toward the wiretap > chips: > "The government has no right to restrict my use of cryptography in > any way. They may not forbid me to use whatever ciphers I may like, > nor may they require me to use any that I do not like." Hear, hear. > The hypothetical backdoor in clipper is a charlatan's issue by > comparison, as is discussion of how to make a key escrow system > 'work.' Do not be suckered into talking about an issue that is not > important. If someone want to talk about potential back doors, refuse > to speculate. The existence of a front door (key escrow) make back > door issues pale in comparison. > If someone wants to talk about how key escrow works, refuse to > elaborate. Saying that this particular key escrow system is bad has a > large measure of complicity in saying that escrow systems in general > are OK. Always argue that this particular key escrow system is bad > because it is a key escrow system, not because it has procedural > flaws. > This right issue is that the government has no right to my private > communications. Every other issue is the wrong issue and detracts > from this central one. If we defeat one particular system without > defeating all other possible such systems at the same time, we have > not won at all; we have delayed the time of reckoning. Very lucid and wise observation. I have suggested several times that attention should also be directed to the (what I call) "potential factor" in regards to the entire "key escrow" system. The potential for abuse and unconstitutional invasions of personal privacy are ripe for the picking under this scheme. In my own public comment letter to the Computer System Security and Privacy Advisory Board, I stressed this fact and also pointed out that although the system was probably designed with good intentions (right), it will not prevent zealots and spooks from monitoring communications under certain circumstances. My other peeve is that after this "technology" has been entrenched (read: forced) on the public, I see the rug being pulled out from under the feet of any other crypto system available. That's also why I attach a great deal of importance to some form of PGP being developed where all parties (Phil Z., Jim B., and me) are happy (excluding Uncle S.). (But I suppose that's another topic...) Patriotically yours, -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAzzZJRLcZSdHMBNAQEzEwP7BVrQ4KxuFgf19Dq0avHEq8fN4+k2lVFU UBPAZYWNwzyPV3IkmrFf4RGR84H/pdWm09GmYH5wptOuKEut0M5NzO30Z9+c2SW3 7FYr5TF2rygg0mHn6SDSiZZBLuLt/XqWIwGOzJBtrTnPsrLMqZ18Xk60lH3yqUme FzTiDxDnjqA= =wnNa -----END PGP SIGNATURE----- Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0

Crypto/Clipper debate rages on in comp.risks
by fergp＠sytex.com 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- For those of you who don't follow RISKS Digest (comp.risks): you're really missing some good stuff. At the risk of redundantly posting messages which may have already been discussed, I couldn't resist the opportunity to cross-post this portion of a response to Peter Junger's original post on "Risks of teaching the law without breaking it," where Mr. Junger expresses his displeasure and confoundedness of the export restrictions on simple (and all) cryptography. 8<----- Snip, Snip ------------ RISKS-LIST: RISKS-FORUM Digest Tuesday 1 June 1993 Volume 14 : Issue 67 >Date: Tue, 1 Jun 93 14:17:52 BST From: jharuni(a)micrognosis.co.uk (Jonathan Haruni) Subject: Re: Peter D. Junger's risks of teaching... (RISKS-14.6)5 Organization: Micrognosis International, London Peter D. Junger (junger(a)samsara.law.cwru.edu) wrote: > [ about his amusing and sad conundrum of being unable to teach law > students about a law without breaking it. ] I think that if you give your students copies of your comp.risks article, they should all be sufficiently disheartened with American law that they will quit the program and you can then present your lectures to a class devoid of foreign (or any) students. Alternatively, you could check passports at the door, and boot out foreign students during the parts of your class which are essential to American Sickurity. By doing so you will raise eyebrows well outside of the computer-and-law sphere of interest and you may bring this ludicrous situation into the limelight. But then, you may get sacked. Probably a much more effective solution to your problem, and one which has recently been proven perfectly legal and acceptable in an American court, would be for you to merely shoot dead all the foreigners in your class, after which you can speak freely. - ----[ remainder of post omitted ]------- -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAz9X5RLcZSdHMBNAQHQnwP9F8asul5g8tl4hhb9cLJZ9rz+0UeNUQb2 aGK+Bhx6onigi/HwseMjZP3BFSDHUzB3IuzpIjkIBj1BBEB24ZCtZVx9i4M9cIwI wObnkA7YQ0LIr2Ut4d37vQRU36VyltprRB7toqhuGWpv1ZMAp91uNQ4H3tIgXMYL 6sUplUkFMGQ= =C1Qo -----END PGP SIGNATURE----- Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0

Security in a VR world
by poier＠sfu.ca 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- For anyone interested, there is a discussion on the multiverse maillist at multiverse(a)medg.lcs.mit.edu about "portal security", that is, the ability / inability for certain users passing through certain "portals", as well as verification of user identity... Unfortunately, the developer is in Europe, and as we all know, PGP is export-controlled... :( Skye - -- - -----====> Skye Merlin Poier <====----- Undergrad in CMPT/MATH (Virtual Reality) |||| |||| email: poier(a)sfu.ca p-OO <--> OO-q THINK PGP Public Key available on finger \== ==/ -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAzWoy0bkpXW3omvAQFpVQQAvN+Q+fj+04DGgjXAyDhsBcRG5QEXES3a u6/lTKzhyqZEOCVX+ObivZOLUrc7OsbED0hGE4Wn/jIEeoeM//b9cA10JmTYu1Ce WgXPPuAa+YKAin9dMdIxNNiTzSaQhx+dQ3saPssQ45ErYWCPiix4ceBJWuITZJEG 9RfehK/yLws= =rHJv -----END PGP SIGNATURE-----

2 1

Re: Clipper replacement chip
by fnerd＠smds.com 02 Jun '93

02 Jun '93

RYAN Alan Porter <rtfm!rtfm.mlb.fl.us!ryan(a)mlb.semi.harris.com> sez > Just out of curiosity, does anyone on the cypherpunks list posess the > technical skills that would be necessary to begin a project of hacking out > a pin compatible version of the Clipper that didn't have the backdoors > once the chip is out, a la AMD and CYRIX? > ... > So I guess the really important question is: does anybody know how to > reverse engineer a chip and build a duplicate, pin-compatible device from > the ground up while hiding from the feds the whole time and still managing > to make a living? Well, there's an easier end-run: a piggyback board. This would plug into the Clipper's slot, and the Clipper would plug into it. Then it could either run in Clipper or PGP/DH-IDEA/Whatever mode. I don't understand enough about the Clipper protocols and interface to know whether there's room to squeeze in bits to signal which of these two modes, unbeknownst to the rest of the phone, but you could certainly attach a Clip vs. Secure switch. -fnerd

1 0

CryptoStacker
by RYAN Alan Porter 02 Jun '93

02 Jun '93

Thanks for all of the responses on my questions concerning the CryptoStacker idea. I am kind of sick of talking about it though, and so I went out today and did some research on drivers and such. I am planning to create a software implementation of a PGP driver starting maybe tomorrow (I am being payed real dollars to write other code at the moment) for on-the-fly HD encryption. I haven't quite figured out how to create a commercially distrubutable system yet, but there really is no point sitting around arguing about this and that detail until somebody actually goes out and tries it... I have a feeling that this version will be slow as balls without hardware support, but that's not really the problem, is it? The main focus that I have right now is making the thing work. There have been lots of neat suggestions about multiple layers and suchlike tooalso, which are all fine and dandy, but they kind of missed the point: mainly what I am interested in is preventing access to the data on my HD by anyone but ME, screw LANs and multi-user problems and all of that, I just want to create a system whereby if the Secret Service busts down my door tomorrow while I am not here to throw the drive across the room, they will never be able to fetch out any incriminating evidence by picking apart my system in some lab somewhere. I can also see the advantage of a business worrying about spying, or even government agencies (wouldn't that be ironic) worrying about security and considering networks insecure. Anyway, we can add bells and whistles like network support and multiple layers and suchlike after we figure out how to get the basic engine to work, right? I have also seen everyone suggesting DES instead of PGP. I suppose that would really be a great idea for speed and suchlike, for some reason I was kind of attached to the whole public key idea, but I suppose that would be kind of close-to-worthless in this context, wouldn't it? I suppose we are to the point where I can use some actual technical advice, no need to reinvent the wheel, right? If anyone has any information of the overall architecture of projects like Stacker or DoubleStor, I would appreciate the input. I have used both in the past and I am kind of leaning toward a system like DoubleStor (which maintains directory structures and such, but compresses each file in place) for simplicity, but I am kind of hesitant to leave even a hint of the overall structure of the disk laying around for prying eyes. Trouble is, I don't have much experience screwing around with the FAT and such so I wouldn't want to do anything so bold as munching the entire disk into a single file and suchlike. Any ideas? -Ryan the Bit Wallah

2 1

Re: Electronic Contracts
by wcs＠anchor.ho.att.com 02 Jun '93

02 Jun '93

Don't know if there have been specific tests of it in courts, but, yes, signing contracts is definitely something people want digital signatures for. Also, anything else that requires a signature, we'd like to be able to sign digitally, so we can do it online instead of hauling paper around. That's not just a cypherpunk thing, it's what a large fraction of the business community would like to be able to do - it speeds business cycles, cuts ordering time, and means we don't have to keep all this paper around, especially in storage; while the paperless office won't be reality for a while, it would really be nice if we could store the important stuff digitally, where it's easy to retrieve later, and save paper for transient uses like convenient reading, unlike the current situation where digital is for convenience but the important stuff is paper that has to be stored somewhere MIME-Insert-Video-Clip: Indiana Jones, Government Warehouse Scene..... A certain amount of this has been done with the various telex networks; I get the impression from somewhere that a telex can be a legal document for things like sending purchase orders, just like paper can; it will be interesting to see if fax acquires the same status, but forging a fax is terribly easy, just as email is. Bill Stewart

3 2

ADMIN: incoming ftp site works now
by Eric Hughes 02 Jun '93

02 Jun '93

I've arranged so that the pub/cypherpunks/incoming directory will accept uploads now. So if you have stuff to send, please ftp it to that directory rather than using e-mail. Of course, if you don't have ftp access, please continue to use email. For those of you who tried this before, the problem was that the wuarchive ftpd that the system was running needs a line in its configuration file to say that uploads are peritted in a directory. Eric

1 0

RE: Software infrastructure
by Pat Farrell 02 Jun '93

02 Jun '93

In Message Tue, 1 Jun 1993 22:13:48 -0500, Eric Hughes <hughes(a)soda.berkeley.edu> wrote: >Let's go back to the DOS-as-terminal issue. The politics and >economics of DOS shareware is such that source code is almost never >made available. > >I propose that interested cypherpunks write a DOS terminal program >which _is_ free software. I think writing a "terminal" program, such as Kermit, is not particularly useful. I am writing a SMTP/POPPER client program that will work over standard serial (dial-up) lines. It will not require SLIP, PPP, or any other magic (mostly because getting _my university_ to provide competent TCP/IP access is impossible). Enhancing it to support SLIP or PPP will be simple, but it is not the market that I'm aiming at. Clearly any decent mail client has to have a roledex of commonly accessed coorespondents. It is trivial to enhance the data structure to add a flag that says "Use encryption" and another with "PGP (or RIPEM) key available" and another to hold a handle (PGP's 0x123456) that identifies the key. Spawning your favorite encryption program is then also trivial. The audience is not the cypherpunks. The audience for strong cryptography is the art, history, econ or english major. It has to be "pig easy" and reliable. My program is written for Windows. Like it or not, Windows has 80% or more of the total computers being sold. I want my mailer client to reach mass markets. The program will be free, and sources will be available under some restrictions that I haven't yet figured out. In a while, I'll be looking for beta testers. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Re: FYI: White House Mail
by Mark 02 Jun '93

02 Jun '93

> President Clinton Vice President Gore > > PRESIDENT(a)WHITEHOUSE.GOV VICE.PRESIDENT(a)WHITEHOUSE.GOV Hmm, 10 bucks says some larrikin sends fakemail from PRESIDENT to VICE.PRESIDENT asking him 'what this little red button does' etc. Though in real.life I suspect 10 press secretaries sitting behind the mail alias. They're going to need them. Lets hope no one is stupid enough to try busting into there... Mark mark(a)coombs.anu.edu.au

1 0

GIMME YOUR GOODIES!
by Stanton McCandlish 02 Jun '93

02 Jun '93

NitV is still hoarding all sorts of PGP utils for any and all platforms, mail systems, and potential uses. If you make anything new, please send it along (uu it, or upload it to the board, or whatever). I get QUITE a few calls for such material (suprisingly much of the Unix stuff is downloaded, and long distance at that, so I guess there is a lot of value in having a BBS-based, multi-platform crypto-tools site.) I MUCH prefer to get the new material direct from the author, so please do send it!! Help spread crypto to the OtherNets! -- When marriage is outlawed only outlaws will be inlaws! Stanton McCandlish, SysOp: Noise in the Void DataCenter Library BBS Internet anton(a)hydra.unm.edu IndraNet: 369:1/1 FidoNet: 1:301/2 Snail: 1811-B Coal Pl. SE, Albuquerque, New Mexico 87108 USA Data phone: +1-505-246-8515 (24hr, 1200-14400 v32bis, N-8-1) Vox phone: +1-505-247-3402 (bps rate varies, depends on if you woke me up...:)

1 0