June 1993 - cypherpunks-legacy

Another chaining utility
by nobody＠soda.berkeley.edu 02 Jun '93

02 Jun '93

I am working on a utility I call "chain" which is inspired by Karl Barrus's hopmail and related scripts. I am sending this message with the command: chain -m -s "Another chaining utility" cypherpunks(a)toad.com caltech jarthur extropia soda The "-m" means for chain to pipe its output into sendmail so that it is actually sent (otherwise it just writes to standard out and you have to arrange to mail it on your own). The "-s" sets the subject for the last leg of the message to the following arg. Then comes the destination address, then a list of remailer nicknames, which are just substrings of the remailers, read from an initialization file. This message is passing through four remailers. The "-m" feature is implemented only on Unix systems. On DOS you always get the output in a file and then send that however you normally would. I also have a "-e" switch which encrypts the message using a public key looked up by the destination address. Cypherpunks doesn't have a public key so that's not appropriate here. But if I wanted to send an encrypted note to, say, Phil Zimmermann, I could just do: chain -em prz(a)sage.cgd.ucar.edu portal mead Hi, Phil, give me a call when you have a chance -- Hal ^D and it would go via the Portal and Mead remailers, encrypted at each step, and finally to Phil, encrypted with his public key. Pretty easy. I couldn't get Karl's hopmail.bat to run on my PC (not enough environment space?) so I wrote this in C and it works OK. I'll be sending the code to Eric to be archived in a few days. If anyone has any wish lists for features I will be glad to try adding them. (I am composing this on a Unix system in order to demonstrate the -m switch, so I can't cleartext sign as I normally would. I am in the vi editor and I am sending the message with "1G!G", which tells vi to pipe the whole file into a command, followed by the "chain" command line above, verbatim. That's all there is to it.) Hal Finney 74076.1041(a)compuserve.com

1 0

EFF, AT&T, Clipper, and $
by greg＠ideath.goldenbear.com 02 Jun '93

02 Jun '93

Eric Hughes writes: > The EFF is going to be involved with the cryptography issue. More > than that and I defer to John Gilmore, who is on the EFF board and > this list and who can speak more authoritatively than I. The 5/24/93 issue of "The New Republic" has a (largely uninteresting) cover story about Mitch Kapor and the EFF. One interesting tidbit gleaned from that article, however, was that AT&T has contributed money to the EFF. I am particularly curious to see how AT&T and the EFF will deal with each other with respect to the Clipper chip, and the politics around that. If anyone knows anything more about this, I'd love to hear it. -- Greg Broiles greg(a)goldenbear.com Golden Bear Computer Consulting +1 503 465 0325 Box 12005 Eugene OR 97440 BBS: +1 503 687 7764

1 0

How about it? My letter to the Pres
by Clark Reynard 02 Jun '93

02 Jun '93

What about some form of my letter as the form letter petition? Not as critical as I was, of course. But STRESS issues he used in his campaign (Prescott Bush, opposing Vietnam); and maybe one of his flunkies will have the smarts to cope with it. The email response for the form letter from postmaster(a)whitehouse.gov was very fast, so they have put money into it. Maybe they actually DO give a damn. Try it. ---- Robert W. Clark Just Say No! to the rclark(a)nyx.cs.du.edu Big Brother Chip

1 0

My letter to the President, for all the good it'll do
by rclark＠nyx.cs.du.edu 02 Jun '93

02 Jun '93

Well, this and fifty cents will get you a cup of coffee, but here's my letter to the Pres. ------ I oppose the Clipper chip vehemently. As the President, or the duly authorized representative of the President, you will understand that I find the idea that you will monitor my communications reprehensible and intolerable. You have espoused a policy of covert surveillance of American citizens of which Bush would be proud. You, a protester of the Vietnam War, who understands that the government can, and should be opposed when it is wrong, should understand why privacy is necessary to the people of any democracy, lest it cease to be a democracy. Nevertheless, you approved the Clipper Chip proposal, which is the furthest step backward that even a politician could take. Shame on you! Even George Bush's father, Prescott Bush, who despised and opposed Senator McCarthy's Communist witch-hunt, would loathe such a retrogressive move! We computer professionals, who supported your rise to power, feel betrayed by your sudden reversal, by no means unique among your sudden reversals. By siding with those who would rob Americans of those freedoms which are our inalienable right, you have betrayed democracy and made a sham of the Bill of Rights. If, as a White House official suggested, criminalizing alternative, secure encryption standards is an "option on the table," I am disgusted by your betrayal. You, who seemed proud to have protested an unjust war, and should understand why protest, even anonymous protest, should be an inalienable right, have no right even to consider this as an option. If you consider criminalizing privacy, and encryption, you have signed over the soul of the nation to be monitored at will by the NSA and CIA, organizations which you, at one time in your life, opposed. Perhaps, like many Sixties rebels, you have been bought by the government, and no longer care about the rights of the American people. It would not be the only time this has occurred. While I doubt that you, the President, shall read this, perhaps some subordinate shall. Perhaps, if the miraculous is possible, that subordinate shall deem this worthy of your consideration. While I am not used to pleading, I plead that you reconsider this policy, which, if enacted, would doom privacy in the United States, and turn this nation into the sort of nation that the Soviet Union has finally decided not to be. I beg that you consider, at least for a moment, the evil that you may unleash. You may be motivated by an understandable concern for the protection of the American people from drug dealers and mobsters, but it is not the mobsters you shall crush in supporting the Clipper chip. It is those eager, agile young minds who oppose the government when it is wrong, and only wish to be able to have their voice, without being monitored by the CIA and NSA in case that voice occasionally is overly strident. Thank you, Mr. President. I hope that you have carefully studied the holy Consitution of this nation, which you have sworn to uphold. I fear for the consequences if you have not. Robert W. F. Clark 440 S. Franklin St. Bloomfield, IN 47424 Telephone # (812) 384-3465 email addresses: clark(a)metal.psu.edu rclark(a)nyx.cs.du.edu

1 0

WH email petition.
by J. Michael Diehl 02 Jun '93

02 Jun '93

In light of the White House getting on the net, how effective do you all think an electronic petition, about the BigBrotherChip, would be? Do you think that they would listen? Do you think that, perhapse, we would simply be put on a list of "trouble makers?" I was thinking of writting a petition and distributing it in every way I can think of, and encouraging people to send it to the White House. Any comments? +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | mdiehl(a)triton.unm.edu | But, I was mistaken. |available| | mike.diehl(a)fido.org | | Ask Me! | | (505) 299-2282 +-----------------------------+---------+ | | +------"I'm just looking for the opportunity to be -------------+ | Politically Incorrect!" <Me> | +-----If codes are outlawed, only criminals wil have codes.-----+ +----Is Big Brother in your phone? If you don't know, ask me---+

3 4

Re: WH email petition.
by smb＠research.att.com 02 Jun '93

02 Jun '93

In light of the White House getting on the net, how effective do you all think an electronic petition, about the BigBrotherChip, would be? Do you think that they would listen? Do you think that, perhapse, we would simply be put on a list of "trouble makers?" I was thinking of writting a petition and distributing it in every way I can think of, and encouraging people to send it to the White House. Any comments? In general, petitions are a notoriously ineffective way to lobby. That's doubly so for email versions, for obvious reasons. Even without that problem, an electronic petition will (rightly) be ignored on the grounds that it represents the opinions of a small elite minority. With signatures collected in the streets and shopping malls of America, you have at least some chance of reaching a cross-section of people. But on the net? (And even if I'm wrong about the net's population, would they know it?) As for a trouble-maker list -- not likely. Apart from the political hell there'd be to pay if word ever leaked (the right to complain to the government is quite explicit in the Constitution, and is legally far stronger than the still-controversial right to privacy (remember Bork?)), I haven't seen any evidence that broad-scale ``enemies lists'' have been collected since Nixon's day. That may, of course, mean they've just gotten smarter about how they do it... Based on my past experience, your name will be collected -- but just as a person interested in certain issues, so that you can be solicited for funds on certain issues. --Steve Bellovin

1 0

No Subject
by nobody＠eli-remailer 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- I don't think the idea of a "virtual server" for anonymity will really accomplish much. Even if you somehow manage to spread the software over several machines, you still need to publicize the entry and exit points for remailing requests. If the net police determine to shut down the server, they can go after those machines which are publically known to be the places where the anonymous messages come from and shut them down. Sure, if you have a network of machines you might be able to bring another one online pretty quickly to replace this one which has been shut down. But then the net police can go after that one. And so on. You'd get the same effect just by having a bunch of conventional remailing servers, only announcing one of them publically, and then having each one come online only after the one before it got shut down. The hard part in either of these scenarios is collecting more people who will run anonymity servers. I don't see that doing tricky stuff with virtualizing the calculations helps you much. Similarly, trying to put a machine at an unknown site, or perhaps in a friendly country, won't necessarily help. If the machine itself is inaccessible, the net police will go after its feeds, the points at which it connects into the network. Look at what happened to Julf. His machine was safe, sitting in a back room of his house. They went after his net feeds instead. The real answer is to publically defend remailers. I argue for remailing servers on the basis of preventing traffic analysis. Most people accept that the use of encryption is justified for email in order to protect individual privacy. I claim that remailing servers extend this protection to include not only the content of a message, but its destination as well. The net does little today to keep the facts private about whom you communicate with. Remailers provide that confidentiality. If we had enough remailers that we could confidentally run a virtualized system, knowing that we could keep brining them online faster than they could be shut down, I'd argue that a better use of those resources would be to publically identify all of the remailers and let them all operate on their own. This would provide a united front to oppose the anti-privacy forces, giving political strength to our goals. Hal Finney 74076.1041(a)compuserve.com -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAtoGqgTA69YIUw3AQGFeQQAsnAHwZpe+BRzhp9umLJzWJDFgcHYYYwu Bp5GJI2LmhQWB1pNluLxupW/ZZZqlO78HApOcU9jL/eFEhZakoAd4RJPVBjXpadm w1vkfSDQ6qXKnPyj28FM1sm3eSyfRu3evAd8+MfGNFOlCeyrYNfya6G3OBOcwpf1 bJFe7upKVVQ= =8apG -----END PGP SIGNATURE-----

4 3

"Newsweek" Article on Clipper and Encryption
by tcmay＠netcom.com 02 Jun '93

02 Jun '93

The following appeared in this week's "Newsweek," June 7, 1993, p. 70. Our own Eric Hughes is briefly quoted. Any mistakes are the fault of either me or my OCR program. The Code of the Future Uncle Sam wants you to use ciphers it can crack Forget the castle. If only Queen Elizabeth had given Chuck and Di a thumbnail-size computer chip for their wedding, she would have been spared reading in the London tabs how her son" wanted to live in [his lover's] trousers," among other excerpts from taped phone conversations. Instead, the chip would have converted their words into "hsssssss." No signal analyzer, no supercomputer, no wiretap could have decoded the white noise. The device that works this reputation-saving magic is called a Data Encryption Standard (DES) chip, and there's no practical way to crack it. That's what America's supersecret spymasters, the National Security Agency, intended when they designed the cryptographic system in the 1970s with IBM. While that delights industry and privacy advocates, it's come back to haunt the government: wiretaps are useless against any suspect using a DES-encrypted phone. So in April the Clinton administration announced it was backing the NSA in its push to impose a universal encryption standard to which the Feds alone would hold the keys. The agency argues that's the only way to ensure it will always be able to decode foreign communications. Civil libertarians and corporations don't see it that way. Says computer-security expert Eric Hughes of Berkeley," The government is saying, 'If you want to lock something up, you have to [give us] the key'." No one doubts that the nation's voice, data, electronic mail and other communications need locks, and fast. Industrial spies grab fax, e-mail and other computer and microwave transmissions out of the air. Hackers broke into Internet, a world-wide computer network, 773 times last year, 90 percent more than in 1991. Hackers also peek into computers that hold medical records, credit-card purchases, even video rentals. Cellular phones offer as much privacy as going on "Oprah." The FBI can't keep up with all the cybercrime. Secret codes can, and since World War, II codes have been based on algorithms--formulas that transform one set of numbers into another. NSA's new chip, to be used in a secure phone sold by AT&T, encrypts computer transmissions and phone conversations with an algorithm so complex "it would take a CRAY YMP [supercomputer] over a billion years to solve," says Raymond Kammer of the National Institute of Standards and Technology (NIST), which worked with NSA on the algorithm. Yet the principle is simple. A sending phone and a receiving phone electronically choose one algorithm, out of millions, for their conversation (diagram). The only way to unscramble the resulting 10001100101s is to obtain the "keys," which will be held by two agencies chosen by the attorney general. The agencies-this is the part NSA likes-would give them to officials who have the requisite wiretap warrant. But industry has a couple of problems with this. First, NSA has yet to explain how the chip works, so outside verification that it's hackproof will have to wait. Worse, with millions of NSA chips in use, the agencies holding the keys would have to store them on computers, which are vulnerable to recreational hackers, foreign spooks and industrial spies. For now, no one is forced to use the NSA chip. But manufacturers who put a rival chip into, say, their modems would likely be denied government contracts, as well asexport licenses for the NSA-proof products. Even that may not appease the spymasters. "No one rules out a mandatory encryption standard," says NIST spokesman Mat Heyman. That's industry's greatest fear, which NIST will attempt to allay in meetings this week. And next week Rep. Edward Markey holds hearings on whether NSA can keep the keys to its codes safe from hackers. Or even Fleet Street. SHARON BEGLEY with MELINDA LIU in Washington and JOSHUA COOPER RAMO

2 1

Clipper
by RYAN Alan Porter 02 Jun '93

02 Jun '93

Just out of curiosity, does anyone on the cypherpunks list posess the technical skills that would be necessary to begin a project of hacking out a pin compatible version of the Clipper that didn't have the backdoors once the chip is out, a la AMD and CYRIX? If not, it would seem that we need to get some hardware geeks involved, as well as all of these software people around here, since crypto issues are moving more and more into the hardware, VLSI playing field. ("Cypherpunks write code.... and microcode"??) It would seem that one of the most direct ways to attack Clipper would be to pull another PGP, just create a chip that acts just like one, but a chip that we understand and we designed. There would be totally different problems involved, the Feds could much more easily seize chip production facilities, design would be more difficult, free distribution would be more difficult... I think that it would be quite possible, however. I mean, if an attack is truly to be made on the Clipper, writing letters to feds certainly won't help, the only thing that will help is making their proposal ineffective and uneconomical. Think about it, if a truly secure chip existed, it's sale would be almost certain; all of the 'criminals' that the feds are so afraid of would be sure to find us and buy one, not to mention every self respecting cypherpunk and cyberpunk in the universe, law enforcement agencies might even get into buying black market chips to protect themselves from escrow leaks... Also, if all of these shady types that the feds are using for their tactical arguments have truly secure chips anyway, all of the aformentioned arguments are rendered moot. So I guess the really important question is: does anybody know how to reverse engineer a chip and build a duplicate, pin-compatible device from the ground up while hiding from the feds the whole time and still managing to make a living? I guess that's a pretty rough question, but hey, this is war, right? -Ryan the Bit Wallah

1 0

eavesdropping druggies
by Phil Karn 02 Jun '93

02 Jun '93

Today's San Diego Union Tribune has a locally-written article on the investigation into the murder of the Mexican cardinal by drug gangs. The title is "Drug gangs eavesdrop on rivals", and begins as follows:L "TIJUANA - The two rival drug gangs whose attempts to kill each other's leadership have left a Mexican cardinal and six others dead apparently have been using sophisticated electronic gear to monitor each other's movements, Mexican authorities reported yesterday. "In addition to the assault rifles, grenades and police and army uniforms being discovered in a series of safe houses, Mexican federal police are reporting finding devices designed to trace and monitor calls made from cellular telephones. "They also are finding sophisticated communications-monitoring equipment, walkie-talkies, tape recorders and pages upon pages of documents." The article continues with other developments in the investigation unrelated to electronic eavesdropping. A few (semi-serious) thoughts come to mind: 1. Perhaps the government doesn't want secure telephones in the hands of the drug lords not so much because it will thwart wiretapping by law enforcement, but because it will protect the gangs from each other -- and they aren't inhibited by Constitutional requirements. 2. Gee. I thought the cellular eavesdropping problem was completely solved by the recent ban on cellular-capable scanners. 3. I can't wait for the Federales to discover computers with PGP in one of these safehouses. And when it does, expect all hell to break loose in the crypto propaganda war. Phil

1 0