August 1993 - cypherpunks-legacy

Re: CAKE--Citizens Against Key Escrow
by lazylion＠netcom.com 05 Aug '93

05 Aug '93

>The cypherpunks remailer was designed to be run out of a user account, >and can be modified to be just such an email server. The remailer as >it is now is just such an email server, whose only function is to >remail. Handling lists and votes as above is straightforward. > >I do take it that you're a patriotic cypherpunk, no? > >Eric So Eric, how's bout we all send messages to cypherpunk-cake(a)toad.com with a valid reply-to and it sends back a response such as "Please confirm that this is a valid signiture by ... (doing something random?) BTW, do you remember who it was that was talking about pgp mail headers who has not yet responded to my groovy idea of using rfc822's "Encrypted:" field? So far, the only responses I've seen are from others saying "Yea, when ya find out, let me know too..." Any thoughts? +---------------------------- Ben Weiss -------------------------------+ ! Telephone: (510) 841-5709 voice Internet: LazyLion(a)Netcom.com ! ! (415) 325-9600 fax Ben_D._Weiss(a)bmug.org ! +-------------- Packet Radio: WB5QAL(a)N6EEG.#NOCAL.CA.US ---------------+ ! This message is protected by 18 USC 2511 and 18 USC 2703. Monitoring ! ! by anyone other than the recipient is absolutely forbidden by US Law ! +---------------------------- Ben Weiss -------------------------------+

1 0

CAKE--Citizens Against Key Escrow
by L. Detweiler 05 Aug '93

05 Aug '93

Hey cypherfolks. It seems to me that the fundemental issue of the acceptability of key escrow is not getting debated well enough in the mainstream media. The Clipper debate keeps getting framed in terms of `who will be the escrow agencies' or `how secure is the algorithm really' or whatever. Also, I'm a bit disappointed in both EFF and CPSR not coming out with firm positions *against* key escrow systems in general (CPSR spokesman: `I don't want to sound too stridently opposed...'). We have something of a void. The problem is that the stance is seen as anti-law enforcement by these organizations (or they are afraid it will be perceived that way). Anyway, as part of the propaganda effort, I am proposing starting a new `group' called the Citizens Against Key Escrow. (Now, don't get too excited.) To start out, what would be ideal is just a document describing Clipper, a lot of anti-Clipper propaganda, and the appended *signatures* of everyone who is a `member' of CAKE and affirms the position `unlimited and unrestricted use of strong cryptography is an inalienable right.' Please do *not* mail me saying that you want to sign it. I'm not ready. In particular, I'd like to propose that a patriotic cypherpunk set up a mini-email server to handle signature additions, so that people can send automated messages. Then, when this is posted to sci.crypt and circulated to every dark corner of Cyberspace, the ability to handle the traffic will be automatic, and hopefully we will collect *many* signors. (Yes, there could be tricky authentication issues with names. I would like to see the utmost attention given to the veracity of signors if possible. If `David Sternlight' makes it to the list we know its fake, and people could criticize it on that ground. Maybe some way to `contest signatures' via email--if a signature is contested it is removed?) By the way, the supposed `comprehensive policy review' blared in the Clipper announcement by the Clinton adminstration regarding cryptographic policies (export, freedom of use, etc.) is rumored to be over in mid-September. Surprise, they haven't contacted us yet! This document would be something tangible to present and herald to them *prior* to a big ugly hand-me-down announcement. If we got press coverage of our view, saying that we're being excluded, that these are the real issues at stake, and then the real announcement came out shortly thereafter with all the inevitable bad news, it would be a great PR coup. Anyway, here are some propaganda items that will be included in the final document if this actually happens. I'd really appreciate if anyone would contribute *specific* paragraphs. (I've never really gotten great response from this kind of query, despite a lot of lip service and excitement, and judging by the current Cypherpunk FAQ this is not uncommon, but I'm the eternal optimist.) - Description of Clipper - Emphatic terms: we think Skipjack could be a strong algorithm, but key escrow is inappropriate for a civilized cyberspatial society - of course, we're not against law enforcement in general! we just believe that just as the government currently has the capability to wiretap insecured communications, the public has a right to thwart wherever it wants with it secured - Debate on security of key agencies, who will be `it' etc. are smokescreen decoys by the NSA - Indications that key escrow is not the actual fundamental motivation of Clipper, from FOIA documents (the classification of the national security reasons), the rather pathetic circumlocutions about vaults and the agencies, etc. - Maybe a little history of NSA and the abuses from Bamford - Jefferson as cryptographic innovator, other revolutionaries requiring anonymity and security in their writing - Constitutional issues: freedom of speech and illegal search & seizure - cryptographic device export restriction by the NSA - Quotes from the FBI and NSA: cryptography is like nitroglycerin, we might have a lot of dead bodies lying around, all the waffling quotes about whether cryptography should be regulated, etc. If you have anything on the above, please send it! In particular I need `mini-essays'. This is another project that everyone can contribute to and prove we're not just a bunch of listless, noisy, inconsequential nihilists. (Once again, my optimism overshadows my memory.)

3 2

mail-to-news error (fwd)
by nowhere＠bsu-cs.bsu.edu 05 Aug '93

05 Aug '93

This is what was in my mailbox... Just so you know, the anonymous remailer here strips out your ENTIRE header. It will process commands in the header, but the original message's subject won't get passed on. Anything in the pasted "::" header block will get tacked onto the outgoing header unless it is a command to the remailer. So put a "Subject:" line in the pasted header block and it will get through the news gateway barring any other difficulties. Chael Hall Forwarded message: >From daemon(a)cs.utexas.edu Wed Jul 32 23:59:59 1993 >Delivery-Date: Wed, 32 Jul 93 23:59:39 -0600 >Date: Wed, 32 Jul 93 10:00:00 -0600 >From: daemon(a)cs.utexas.edu >Message-Id: <9312345678.AA00001(a)cs.utexas.edu> >To: nowhere(a)bsu-cs.bsu.edu >Subject: mail-to-news error > >The post failed. >Required "Subject" header is missing or empty. >(Article not posted.) > >------- original message appended ------- > >>From nowhere(a)bsu-cs.bsu.edu Wed Jul 32 23:59:59 >Received: from bsu-cs.bsu.edu by deepthought.cs.utexas.edu (5.64/1.2/relay) with SMTP > id AA00001; Wed, 32 Jul 93 10:00:00 -0600 >Received: by bsu-cs.bsu.edu (5.57/Ultrix3.0-C) > id AA00001; Wed, 32 Jul 93 11:00:00 -0600 >Date: Wed, 32 Jul 93 10:00:00 -0600 >Message-Id: <9312345678.AA00001(a)bsu-cs.bsu.edu> >From: Anonymous <nowhere(a)bsu-cs.bsu.edu> >To: alt-test(a)cs.utexas.edu >X-Remailed-By: Anonymous <nowhere(a)bsu-cs.bsu.edu> >X-Ttl: 0 >X-Notice: This message was forwarded by a software- > automated anonymous remailing service. > >[Remains of the bounced message] -- Chael Hall nowhere(a)bsu-cs.bsu.edu, 00CCHALL(a)BSUVC.BSU.EDU, chall(a)bsu.edu (317) 776-4000 from 8 am - 5 pm CST

1 0

Anon remailer to USENET gate bogus
by fergp＠sytex.com 05 Aug '93

05 Aug '93

I have been experimenting the past few days with anon remailer to USENET gateway systems to see what the results would be -- nada. I used Chael's BSU system (nowhere(a)bsu-cs.bsu.edu) to attempt a usenet post which never (magically?) appeared in the desired group (alt.privacy, I believe). I waited for several days for the post, but nada, zilch, zero. I retried the bsu remailer with a test message to make sure it was still active, and yes, it seemed to work perfectly. My guess is that the usenet gateway at utexas refuses anon e-mail. Anyone got any other suggestions? I haven't tried any other gateways -- yet. Cheers. Paul Ferguson | "Government, even in its best state, Network Integrator | is but a necessary evil; in its worst Centreville, Virginia USA | state, an intolerable one." fergp(a)sytex.com | - Thomas Paine, Common Sense I love my country, but I fear its government.

3 2

Re: InfoWorld Letter
by wcs＠anchor.ho.att.com 05 Aug '93

05 Aug '93

Paul Goggin sent the list a copy of Steven Fisher's letter to InfoWorld about NSA harassment for offering commercial crypto back in 1981. The NSA is supposedly a bit better behaved these days, at least in public :-), but it's no surprise. Sometime around then, they slapped patent secrecy orders on a guy who had designed an analog scrambler for CB radio; a real crypto-system must have been a much more significant threat to them. A couple of comments were interesting: One was the assertion in the letter he received from the BATF that their product, as munition, could not only not be exported, but could also not be sold to *multinational companies*. Was that the law then? Or was the BATF just a bit over-enthusiastic about what they could get away with? It's also interesting that it was the BATF. Another was that the NSA asked them to put in a trapdoor. These days, escrow is the politically correct way of implementing a trapdoor, but - I wonder if it would be possible to make a trapdoor/weak escrow system, which escrows the keys for *some* kinds of keys, enough to make the bureaucrats think it's ok, but which also has a class of keys for which the escrow is non-effective, bogus, or otherwise doesn't let the cops in, which could be revealed to users after the system has been approved and sold? Perhaps a system which requires 2**N steps to retrieve most keys from escrow, but has a small set that can be gotten quickly for demos? Could you do a system like that and hide it from the NSA for a while? Some alternative approaches would be a system that obscured the escrow (easy to build from clipper if you've got a programmable phone; you just encrypt the Wiretap Field with your session key), or worked fine with a bogus Wiretap Field, or a system where the escrow can be made ineffective administratively (either lost by the escrow agents, or requiring the participation of the telephone owner, or tampered by the owner) At the very minimum, having a system that doesn't let the NSA cheat during the escrow process would be a good start - where each part of the escrow key is really installed separately, and verifiable hardwarily-random numbers are used to seed the key generation. Since the NSA\b\b\bNIST hasn't announced their plans for how to select escrow agents, much less who they are, or how they *really* plan to set the keys, I suppose it's premature to ask them to announce what the rules will be for approval of escrow procedures or agencies or guarantee that if you follow them, you'll be allowed to export your products? :-) Bill Bill Stewart wcs(a)anchor.ho.att.com +1-908-949-0705 fax-4876 ROT13 public key available upon request

1 0

Re: Anon remailer to USENET gate bogus
by edgar＠spectrx.Saigon.COM 04 Aug '93

04 Aug '93

Paul Ferguson wrote: I have been experimenting the past few days with anon remailer to USENET gateway systems to see what the results would be -- nada. ... My guess is that the usenet gateway at utexas refuses anon e-mail. Anyone got any other suggestions? I haven't tried any other gateways -- yet. I had a similar experience with utexas. It worked the first time I tried it, but failed on a subsequent attempt. I suspect that after some complaint utexas was modified to reject anonymous input. Here is my list of E-mail/Usenet gateways: group-name(a)ucbvax.berkeley.edu * (blocked from non-bky sites) group-name(a)cs.utexas.edu * (was working but now blocked???) group-name(a)pws.bull.com * (Bounced to remailer) group-name(a)demon.co.uk group.name.usenet(a)decwrl.dec.com group.name(a)news.cs.indiana.edu Note that some of these require trans-literation of periods to dashes in the newsgroup name; others do not. Ucbvax is supposed to block mail from non-Berkely sites; it might work from these Cypherpunks remailers (I haven't tried it): 1: hh(a)pmantis.berkeley.edu 2: hh(a)cicada.berkeley.edu 3: hh(a)soda.berkeley.edu Utexas see above, bull bounced to the (wimsey) remailer; I haven't tried the others yet. But I'm afraid that the utexas story will be repeated for any gateway that continues to allow anonymous posting to newsgroups. I see the obvious solution is for the Cypherpunks remailers to support direct anonymous posting. Certainly the programming should be trivial. The "political" risk is something to consider, however. But we are supposed to be the fearless leaders to crypto-anarchy. "If not us, who? If not now, when?" -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

Re: Anon Bank Accounts?
by edgar＠spectrx.Saigon.COM 04 Aug '93

04 Aug '93

Duncan Frissell said: Did you know that it is still possible -- in 1993 -- to open a bank account in the United States in a nome de guerre? No, I sure didn't know that. My wife works in a bank, & she tells me that she needs to see two forms of ID to open a new account. So please, Duncan, elucidate! -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Cupertino, Ca

1 0

INSLAW
by DIC1241＠cup.edu 04 Aug '93

04 Aug '93

Ahhh, I was looking around on ftp.eff.org and I found something(a paper) on the INSLAW thingie... So if you want it, ftp ftp.eff.org and get pub/cud/papers/inslw*...

1 0

InfoWorld Letter
by Paul Goggin 04 Aug '93

04 Aug '93

Brought to without permission of anyone in authority. InfoWorld August 2,1993 Section: To the Editor (pg.54) _Big Brother's encryption_ In his Peer to Peer essay on the Clipper data encryption chip (see "Clipper chip won't clip your wings, it will just protect the unprotected," June 21, page 55), A. Padgett Peterson contends that "the government has more to lose by being exposed to world ridicule from a trapdoor or backdoor than it can hope to gain." My direct experience with the National Security Agency indicates otherwise. At the 1981 fall Comdex, Epic computer Corp. unveiled Kryptyk, the only commerical E-mail crypto package for CP/M computers. My software team and I had implemented the first RSA public key cryptosystem for microprocessors. Our booth was swamped with managers from the Fortune 500 and many international firms. Our ecstasy was still strong when a week later we were visited by the NSA. I proudly explained that we could not inject a trapdoor function -- that cracking the algorithm was computationally infeasible, even with the then- recent advances of prime number theory in France. Within a month we received a letter from the Bureau of Tobacco and Firearms the proclaimed our product was "strategic munition" and could not be sold either to multinational companies nor outside the continental United States -- a heavy penalty for not allowing a trapdoor. And we should believe that NIST and NSA did not boobytrap the Clipper chip? I agree with Mr. Peterson that "security by obscurity just does not work." Remember Watergate? Teh Warren Commission's magic-bullet findings? But as long as governments are the only people who can depend on having secrets, they will always view their citizenry as fools to be manipulated. And when governments sanction data security, rest assured they can freely "E-avesdrop" Steven Fisher, CDP Controlled Information Environments Compuserve: 71750,3203 All spelling mistakes my own. Paul -- R O All Comments Copyright by | Technofetisht A N Paul S. Goggin (1993) | Cypher, Cyber, Chaos V Information Broker | Ergoflux, Interzone E chaos(a)aql.gatech.edu | Carpe Diem: Stop the Clipper wiretap chip Finger account for latest _Phrack_ | Public Key: PGP and RIPEM available For anonymous communication:---> anonymus+4744(a)charcoal.com ------------------------------------------------------------------------------ Title 18 USC 2511 and 18 USC 2703 Protected -- Monitoring Absolutely Forbidden

1 0

Nice summary of NIST/PKP Deal in sci.crypt
by tcmay＠netcom.com 04 Aug '93

04 Aug '93

Ross Williams has distributed a nice summary of the current NIST/PKP/DSA situation in sci.crypt, entitled "NIST/PKP scandal: All you need to act." It's 2000 lines, so I'm not sending it out to the entire List (and, no, I was not the one Lance said chastised him, at least not so far as I know). Anyone without Usenet access to sci.crypt can mail me and I'll forward to you the Williams article. If enough folks are sci-crypt-deprived, perhaps I'll post the whole thing. Cheers, -Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

1 0