July 1993 - cypherpunks-legacy

carbon copy
by Timothy Newsham 22 Jul '93

22 Jul '93

Forwarded message: > From owner-cypherpunks(a)toad.com Wed Jul 21 17:00 HST 1993 > Resent-Message-Id: <9307220127.AA16447(a)emory.mathcs.emory.edu> > Resent-Date: Wed, 21 Jul 1993 21:21:11 EDT > Resent-From: <cypherpunks(a)indigo.mese.com> > Resent-To: <CYPHERPUNKS(a)toad.com> > Date: Wed, 21 Jul 1993 15:36:55 -0400 > From: Peter Wayner <pcw(a)access.digex.net> > Message-Id: <199307211936.AA08235(a)access.digex.net> > To: cypherpunks(a)toad.com > Subject: Simmons Subliminal channels and more... Every single cypherpunk message I am receiving comes in duplicate. The first from cypherpunks list, the second with added header lines as above. Tim N.

1 0

Encrypted data across international lines
by L. Detweiler 22 Jul '93

22 Jul '93

From: gdale(a)apple.com (Geoff Dale) >Does anybody have pointers to the actual statutes prohibiting transmitting >encrypted data across international boundries. > >I had an argument with somebody who didn't think this was illegal. This is similar to the question `do any countries prohibit certain kinds of cryptography' that arose after the Clipper announcement suggested that some do. The FCC prohibits the use of codes in amateur radio transmissions, and violations are sufficient to revoke the license. This is enforced by legislation. Also, various countries have rules against using encryption in telegrams. I believe Australia has one, and also Britain. Or maybe it was that Australia had an `official' code under which other codes were illegal. The question is, how are these enforced in practice? I'd like to see a bit of information from the experts on this. What constitutes `codes'? A friend operator told me that, unusual statements, non sequiturs, qualified. Have any operators lost their licenses this way? What is the enforcement like? On a related subject, I recall the discussion here a few months ago about `numbers stations' (or was it sci.crypt?). These are broadcast frequencies where the announcer simply reads off long lists of numbers. They are used for encrypted communication to clandestine operatives, etc. Apparently most are Iron Curtain originating, from what I understand. I saw on TV (nightly news) that there was a great deal of hullaballoo about using the VOA (Voice of America) to send secret communications. A director told a disk jockey to play a certain song and say that it was for a request from `country [x]' where [x] was a very obscure locality in Russia, and the song was unusual. Apparently a disk jockey complained about the practice, and a previous director was against it. A new director was not unequivocally against the practice. There was disagreement on whether the VOA charter allowed it (private analysts saying emphatically no, shady slippery shifty-eyed gov't types saying `well, ...'). If anyone else can expand on this one I'd appreciate it.

2 1

Weaver/BATF trial
by L. Detweiler 22 Jul '93

22 Jul '93

The Washington Post portrayal posted courtesy of P. Ferguson is beyond deeply disturbing, and borders on the horrifyingly shocking. Particularly the sniper aim on Weaver's wife--around her children!--I found brutally, heinously barbarian. One wonders if law enforcement is composed of responsible servants or maurading mercenaries. I'm really stunned not to see any reaction in the popular press so far to this editorial, but I suspect it won't sow ripples but hurtle shearing shockwaves through the media for years to come. However, perhaps just a few weeks have passed since T.C. May admonished and chastised various members for `demonizing' opponents, and then posts a few statements as follows (the sheer bluntness reminds me of the long-dead cries of Murderous Thug on this list, and I feel compelled to respond by blunting the mad, chaotic, rambling, and unfocused shooting): >The killing of that Fed in Idaho was fully justified, as the jury just >confirmed. >The BATF, DEA, Marshal's Service, and their kind have essentially >become a Gestapo-like band of secret police. They raid homes without >proper warrants (Phil Karn has told us of the San Diego case), they >entrap innocents, they use high tech satellite imagery to locate plots >of land they want for various purposes and then trump up charges (the >Oxnard-Santa Monica case where the County wanted a guy's land and then >drew up drug charges, raided him, and killed him...no drugs were >found), and they seize computers and modems of folks like Steve >Jackson without bothering to do their homework. Killing justified? Gestapo-like band of secret police? Yeeks. First of all, please resist the temptation to tar a vast number of law enforcement agents with the same brush under the polarizing heading `they'. It is more dangerous to see enemies everywhere than only somewhere (hm, I think the inspiration for that quote came from your own words). Unless they all showed up at an annual Loot & Pillage Conference and traded techniques and swapped success stories, my suspicions wouldn't be aroused. But as it stands your paragraph starts out with the explosion of `Gestapo band of secret police' and ends with a limp whine of `without bothering to do their homework'. As it stands, there is actually a bit of hostility between different law enforcement branches (best documented, I think, in Hacker Crackdown by Sterling, as in FBI vs. local police forces). This animosity prevents the various groups from wholeheartedly colluding, for which we can be ecstatically thankful for. Yes, the individual agencies are extremely dangerous in some of their recent actions, but this is more adequately explained in terms of local stupidity and imperialism than global malice and conspiracy. Ah, but the most dangerous call comes next: >And perhaps their next target will be "crypto-terrorists" like us. >After all, many of us advocate overthrowing the fascist/socialist >government (I know I do, and many of you do, too), and many of us >believe strong crypto is the key ingredient for bypassing tax systems, >for trading weapons technology details with others (how long before >some of us are charged with aiding and abetting the enemy?), and for >creating a transnational cyberspace. Uhm, I think if law enforcement officials were at all alarmed by our presence we would have encountered rather obvious signs by now. But look how little interference has been erected in front of cypherpunkesque adventurism. Cypherpunk remailers have only gone down for extremely mundane reasons. A rather feeble letter was sent to the operator of soda.berkeley.edu suggesting in the most delicate terms that something might be amiss (for which there was great ensuing fireworks, our nervous-edgy heavy barrage of artillery and cannons aimed at a wandering rabbit). *Nothing* has come of the Mycotronx postings like a Tianamen Square tank-rolling clampdown massacre response by the Establishment. We don't even have the whimper of a single misguided officer pursuing a lone local vigilante justice revenge power trip. We got spectacular coverage in Wired and the New York Times and not even a sneeze from a real red-blooded shifty-eyed Enemy in Black. >The Feds must surely come to see us as the enemy. The `Feds' are actually numerous and disparate agencies, have created their own realities that they live in, and so far have almost, apparently, *completely* ignored the Cacaphony of the Cypherpunks. I believe the situation is that the pillars we are targeting most directly (e.g. the NSA, FBI) are precisely those that are most limited in meeting and engaging us on our terms of warfare of a public-relations campaign. When they say anything in the media they sound absolutely ridiculous -- the FBI with their `a lot of dead bodies lying around' and `cryptography as nitroglycerin,' Denning's `I'm not sure if people should be informed' come to mind. Their clandestine preference is our strongest asset. We can advance by being loud and obnoxious and they cannot (a sort of Perotian-Clintonian relationship). So far I think we have exercised it effectively, galliantly, and perhaps even superbly. But as soon as we make statements that bespeak fanatic paranoia and dangerous and polarizing rhetorical posturing we will be swiftly discredited or hammered. >We need to be as prepared as Randy Weaver was! This is a rather irresponsible and dangerous sentiment and metaphor. I urge you to reconsider. Which cypherpunks are volunteering to barricade themselves from the police in their houses? To defy some court proceedings because of `distrust' of the prosecution? To arm their children with rifles for `defense'? Mr. Weaver was apparently subject to the most grave miscarriage of law enforcement in many years, perhaps only second to the Waco massacre in recent history if reported elements of the recent story hold up. But the fact remains that he refused to go to court and completely defied *our* `system' that has been erected to defend the innocent. He managed to delay going to court by a few months with absolutely disastrous and horrible payment. In fact, one could argue quite convincingly that Weaver was very clearly a victim of his own paranoia. If he had trusted the courts to minimize his plight the gruesome horror show might have been averted. Perhaps not. But are we cypherpunks now going to take on the American Judicial System? Dissolute focus means dissolute energy. Finally, I would like to take up the question of the Weaver Debacle in relation to the nation's media. First, anything this horrendous takes *years* to penetrate and percolate through the American consciousness and media, so we should be patient. It is like the trickle of Chinese water torture--one can go insane in the process. The fallout from the Steve Jackson games case has taken that long. (This is not to discourage public relations but to encourage it.) Secondly, the American public is actually firmly supportive of some of these bloody miscarriages. For example, Reno's approval/popularity soared after her public post-Waco culpability speeches. That is, we have met the enemy, and he is us. We *must* change American attitudes if we are to thwart future egregious law enforcement violations. And in this quest I think there is nothing but grave pallor in elevating Weaver as an epitomizing icon of our cause.

2 1

No Subject
by hughes＠toad.com 22 Jul '93

22 Jul '93

You have been added to the cypherpunks mailing list. The cypherpunks list is a forum for discussing personal defenses for privacy in the digital domain. It is a high volume mailing list. If you want to be added or removed from the list, send mail to cypherpunks-request(a)toad.com There is no automated list processing software; a human (me, Eric Hughes) will read your message and take the appropriate action. If you get two of these welcome messages, it likely means you've double subscribed and will have trouble getting off the list. Send mail to the above address and tell me if this happens. Do not expect instant turnaround. Remember, a human is looking at your requests, not a program. I try to do list maintenance every other day or so, but sometimes the delays are longer. Do not mail to the whole list asking to be removed. You'll just get the members of the list thinking you're a newbie and you'll get a note from me telling you to send mail the the -request address. If your mail bounces repeatedly, you will be removed from the list. Nothing personal, but I have to look at all the bounce messages. There is no digest version available. There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. Mail to cypherpunks-announce-request(a)toad.com if you want to be added or removed to the announce list. All announcements also go out to the full cypherpunks list, so there is no need to subscribe to both. There is an ftp site for cypherpunks. It is soda.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany. There is a glossary there that all new members should download and read. Also recommended for all users are Hal Finney's instructions on how to use the anonymous remailer system; the remailer sources are there for the perl-literate. Enjoy and deploy. Eric ----------------------------------------------------------------------------- Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy.

2 1

Thoughts on remailers
by cdodhner＠indirect.com 22 Jul '93

22 Jul '93

I have recently encountered a situation (ongoing in the newsgroup alt.zines) in which some person has been sending a woman harassment mail and threats, etc in an anonymous manner. She has tried to put his name on her kill list, but he uses a different ID each message. I assume that he is telneting to the mail port, so analysis of the message headers will show what system the message is from. I will be happy as soon as she can kill all his messages and ignore him. But during conversation with her, I mentioned that it was a good thing he wasn't useing a cypherpunk remailer, else we would never be able to identify the source. She responded with the comment that she could just kill all messages incoming from the remailers and be done with it if that were the case, which gets me thinking... The remailers are perfect for those who would harrass and abuse others. Freedom of speech with 0 responsibility, etc. They are also good for many other things, and the amount of junk mail going through them must be FAR less than the usefull traffic, however we all have seen or heard about what a few obnoxious people can do. The problem I forsee is that junk mailers and porno-grams like the ones I've been dealing with this week will start using our remailers as their method of choice, and once word gets around of that, many, many people could put all the remailers in thier kill lists, thinking "Why would anybody need to send ME anonymous mail?", and the effectiveness of the remailers would be drasticly reduced. Then again, maybe it won't be a problem. I'm realy not sure, but it's worth a little thought. Happy Hunting, -Chris Odhner

2 1

Key revoked.
by J. Michael Diehl 22 Jul '93

22 Jul '93

To whom it may concern: I have completely destroyed my rsa encryption key, ID 700903. This key is no longer valid and any messages or files encrypted with it will be ABSOLUTELY UNREADABLE by me. My new key will be available via finger or the key servers. Thank you. +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | mdiehl(a)triton.unm.edu | But, I was mistaken. |available| | mike.diehl(a)fido.org | | Ask Me! | | (505) 299-2282 +-----------------------------+---------+ | | +------"I'm just looking for the opportunity to be -------------+ | Politically Incorrect!" <Me> | +-----If codes are outlawed, only criminals wil have codes.-----+ +----Is Big Brother in your phone? If you don't know, ask me---+

1 0

Re: more on FBI credit search access
by smb＠research.att.com 22 Jul '93

22 Jul '93

Hm, maybe someone could just check out the article (Sat Jul 17 NYT p. 7). This is a distinctly different interpretation. I already looked at the article. It didn't say much. But I tend to agree with Shari Steele's explanation, and in fact posted a similar analysis to comp.org.eff.talk. Here's what I said: Without more detail than appeared in the NY Times article (and yes, I did go and check it, too), it's impossible to say what that bill really means. But I strongly suspect that it's less of a change than one might think The government already has the right to conduct wiretaps against non- Americans without benefit of a court order. See the Foreign Intelligence Surveillance Act (50 USC 1801, if memory serves). Conversely, the prohibitions against eavesdropping on Americans under that act are quite strict, to the point of requiring destruction of any inadvertent recordings that would not be acceptable under the law. My reading of the NY Times squib is that they are simply bringing another form of intelligence-gathering under the rubric of the FISA, rather than just using it for electronic surveillance. Note: I'm not saying I approve of the new action -- but it doesn't seem to be as big a departure from current practice as one might think. --Steve Bellovin

1 0

Re: People's rights????
by peb＠PROCASE.COM 22 Jul '93

22 Jul '93

Rant=on Over the past few years many LEA pseudo-documentary-tabloid shows have appeared on TV (I figure it all started with Raygun's WOD) with re-creations of events using actors. They usually are portrayed as if they were real to the extent of bluring out faces, etc. (that is, no disclaimers and everything appears to be done live with no indication of due process). I've seen this stuff whilst channel surfing in hotel rooms (the only time I watch TV, really) and it seems very sick. I suppose the producers of such shows don't find legalities like warrants to be interesting enough, so they leave it out. So much for TV being educational. If the general public becomes so dulled to apparent violations of rights as depicted in realistic settings, the cynicism that Nixon had for the general public might one day become true (e.g., Nixon, as documented by transcripts declassified this year, said that people don't care about wiretapping--they think it happens all the time. (I wonder why this statement by Nixon was protected for National Security for ~20 years...)) Rant=off Paul E. Baclace peb(a)procase.com

1 0

INTERNATIONAL ENCRYPTION
by Sandy 22 Jul '93

22 Jul '93

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Geoff Dale asks about statutes prohibiting the transmission of encrypted data across international boundaries. To the best of my knowledge, there's no such animal. If such exists, it is widely violated, with impunity, by me and folks I know, on a regular basis. Where do these urban legends come from? (Have I ever told you about what happened when I put my poodle in the microwave, or what my doberman was choking on?) S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

FAQ, round 2
by boojum!esr＠gvls1.VFL.Paramax.COM 21 Jul '93

21 Jul '93

I've written some more material for it. Criticisms and additions welcome. --- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION --- From: esr(a)snark.thyrsus.com (Eric S. Raymond) Newsgroups: news.answers Followup-To: poster This is the Cypherpunks FAQ. It explains the projects and purposes of the Cypherpunks mailing list. It is also intended to serve as a general introduction to privacy and encryption issues. For details on the technical and theoretical aspects of computer cryptography, see the sci.crypt FAQ, available for FTP from rtfm.mit.edu (18.172.1.27) in the directory pub/usenet-by-group/sci.crypt. The cypherpunks archive is available for FTP at soda.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany, including the most up-to-date version of this FAQ. This FAQ is maintained by Eric S. Raymond <esr(a)snark.thyrsus.com>; send additions and corrections to that address. Sections contributed by others are credited to individual authors. We gratefully acknowledge, in addition, feedback and comments from David Mandl <dmandl(a)lehman.com> and Eric Hughes <hughes(a)soda.berkeley.edu>. Here is a table of contents for this FAQ: 1. Why cypherpunks? 2. What are the essentials of privacy software? a. Public-key cryptosystems for secure communication. b. Unforgeable electronic signatures for message authentication. c. DC-net or similar protocols to thwart spoofing. 3. What are the potential applications of good privacy software? a. Secure communications. b. Digital cash. c. Electronic voting. d. Electronic contracts. e. Secure anonymous remailers and posters. f. <more?> 4. What are the key algorithms, tools, and implementations for privacy software? a. RSA b. DES c. Clipper/Capstone/DSS d. PGP e. Possible non-RSA trapdoor functions. 5. What are the social and political implications of good privacy software? a. Drastically lower transaction costs for trade. b. Expansion of the counter-economy. c. Disempowerment of government. d. Anonymity for whistleblowers. 6. What are the legal, political, and technical obstacles? a. The Clipper/Capstone/DSS power grab. b. The RSA patent and the PGP/RSA fight. c. RSA's base problem may not be NP-complete. 7. What can I do to help? a. Work on cryptographic software. b. Agitate against the Clipper/Capstone/DES proposals. c. Promote the use of encrypted communication. To join the cypherpunks mailing list, send a request to: cypherpunks-request(a)toad.com Working with us could be your best shot at stopping Big Brother. So if you have skills to contribute, act now. The freedom you save could be your own. 1. Why cypherpunks? Because privacy is essential to freedom. If the government (or any other oppressor that behaves like one) can effectively monitor communications, it can control or suppress them. And it will do so, because the natural tendency of controllers is always to seek more control. The government cannot be relied on to protect your privacy rights. Nor can anyone else --- certainly not your employer, or the corporations that want to know all about you so they can sell you things. Given half the chance, governments and corporations will always push for security standards that protect *them*, but not *you*. Computer technology can help protect you against would-be snoopers, but only if somebody is sufficiently smart and dedicated to build the tools. The Cypherpunks list exists to build and propagate privacy software. Our aim is to give you the tools to keep your private information private, and to communicate with other people and computers in ways snoopers cannot tap. 2. What are the essentials of privacy software? a. Public-key cryptosystems for secure communication. A conventional cryptosystem consists of an encoding/decoding method and a single key. Two users who share a key can exchange private messages. A public-key cryptosystem uses a *pair* of keys; one private, one public. Anyone with either key can decode messages encoded with the other. For privacy, it must be impossible (or at least impractical) to deduce the private key from the public one. Public-key cryptosystems imply many exciting things --- unforgeable electronic signatures, digital cash, and secure electronic contracts are among them. The basic idea behind all of these is that, as long as your private key is secure, people can verify that an encoded message containg known text came from you by decoding with your public key. In the remainder of this FAQ we use `PKC' as an abbreviation for `Public Key Cryptosystem'. The best-known PKCs are the RSA system, the Federal Government's DES standard, and the government's Clipper proposal. We'll discuss these, and others, in more detail below. b. Unforgeable electronic signatures for message authentication. There are many circumstances in which you want to be able to check a public clear-text message for tampering. To do this, the message must contain a `digital signature' or `message digest code' or `message hash' derived from its clear text, which can be checked against the clear text by a receiver. For security, the message hash should have the property that no one knows how to modify a message in a way that preserves its hash. PKCs give you unforgeable signatures as a side-effect. Unfortunately, known PKCs are too slow to use practically for message hashing. Thus, there is a separate category of `Digital Signature Systems'. The three major DSS techniques are Snefru, MD5, and DSS. Snefru, invented by Ralph Merkle at Xerox PARC, is of historical interest only as it has been broken. MD5 is described in Internet RFC 1321, which also gives a reference implementation in C. As of July 1993 it is believed to be secure, but has not been *proved* to be secure. DSS is a Federal Government proposed standard associated with the Clipper proposal. <more needed here> c. DC-net or similar protocols to thwart spoofing. <more needed here> 3. What are the potential applications of good privacy software? a. Secure communications. With a PKC, you can send a message that no one but the intended receiver can decrypt by encoding it with the receiver's public key. If you encode it with *your* public key, the receiver can verify that it came from you. This means that it is possible to do secure communications even over public channels. Neither nosy neighbors, business competitors, nor the government or any (other) criminal gang can interfere with it. b. Digital cash. Unforgeable messages also imply digital cash. You could use a PKC to send to the receiver a code permitting them to draw a particular amount of money from your bank account. The bank, with access to both yours and the payee's public keys, can verify that the order is genuine. This means that it is possible to do trade over electronic links, without any part trusting any other party beyond the bounds of normal commercial risk. c. Electronic voting. Unforgeable messages also imply secure electronic voting. If you encode your voting form with a PKC, the vote-collecting authority can verify it with your public key. d. Electronic contracts. If two or more people encode known text with their private keys applied in succession, all their public keys will be required to decode it. This is an unforgeable contract. Furthermore, it is an unforgeable *private* contract. e. Secure anonymous remailers and posters. <more needed here> 4. What are the key algorithms, tools, and implementations for privacy software? a. RSA RSA stands for `Rivest-Shamir-Adelson', the names of the three computer scientists who developed the technique. RSA has withstood determined attacks for over a decade and is widely believed to be secure. It has been proposed as an Internet standard. The RSA technique is patented. The patents are held by RSA, Inc. <contact information should go here>. An implemenation in C called RSAREF is available for research and certain noncommercial uses. b. DES <more needed here> c. Clipper/Capstone/DSS <more needed here> d. PGP <more needed here> e. Possible non-RSA trapdoor functions. <more needed here> 5. What are the social and political implications of good privacy software? a. Drastically lower transaction costs for trade. <more needed here> b. Expansion of the counter-economy. <more needed here> c. Disempowerment of government. <more needed here> d. Anonymity for whistleblowers. <more needed here> 6. What are the legal, political, and technical obstacles? <more needed here> a. The Clipper/Capstone/DSS power grab. <more needed here> b. The RSA patent and the PGP/RSA fight. <more needed here> c. RSA's base problem may not be NP-complete. <more needed here> 7. What can I do to help? a. Work on cryptographic software. <list of current projects should go here> b. Agitate against the Clipper/Capstone/DES proposals. <more needed here> c. Promote the routine use of encrypted communication. <more needed here> You can help spread PGP and other appropriate tools far and wide (both to help get a better foothold to thwart the Clipper proposal and its ilk, and to work towards making crypto as commonplace as envelopes). --- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION --- -- >>eric>>

1 0