December 2003 - cypherpunks-legacy

Re: Zimmermann case is dropped.
by Frank Stuart 17 Dec '03

17 Dec '03

Since there is no longer an ongoing investigation, perhaps now would be a good time to file FOIA requests to see if there is evidence of the Justice Department acting improperly. | (Douglas) Hofstadter's Law: Frank Stuart | It always takes longer than you expect, even fstuart(a)vetmed.auburn.edu | when you take into account Hofstadter's Law.

1 0

Re:NSA
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMPVGgyoZzwIn1bdtAQG/1wGAwFELRklL0jv58QWSXMg8Z+OUNPX1OtXJ UaI51iIBh2IjH1hggHtyMUi1B6xrlbmo =h/+n -----END PGP SIGNATURE-----

1 0

Re: Domains, InterNIC, and PGP (and physical locations of hosts, to boot)
by tim＠dierks.org 17 Dec '03

17 Dec '03

At 3:00 AM 1/10/96, Bill Stewart wrote: >At 11:15 PM 1/6/96 -0500, Michael Handler <grendel(a)netaxs.com> wrote: >> ftp://ds.internic.net/rfc/rfc1876.txt >>Again, I'm not too sure of the viability of this proposal. Not on >>effectiveness of proving true location -- it is more geared toward >>"visual 3-D packet tracing" -- but simply because I have _no_ fricking >>idea where our machines are (in terms of lat and long) to any degree >>of accuracy. > >There are several geography servers on the net, which can tell you >the lat/long for a city (more useful if your city is, say, >Holmdel NJ than if it's Los Angeles.) For what it's worth, you can use the mapping software at <http://tiger.census.gov> to find your location fairly accurately; you may need another map to locate yourself, since the streets are unlabeled. I managed to figure out that I'm currently at latitude 37.3435 degrees, longitude -121.8925 degrees. I think that's correct to within about 100 feet or so. - Tim Anyone with a GPS device, feel free to stop by; I'm in unit A2, and I've got homebrew in the fridge. Tim Dierks - Software Haruspex - tim(a)dierks.org If you can't lick 'em, stick 'em on with a big piece of tape. - Negativland

1 0

E-cash and Interest
by Frank O. Trotter, III 17 Dec '03

17 Dec '03

Once the Ecash Mint and the account (in our case the WorldCurrency Access account - others will be different) are merged, the balance you hold in the Mint may be able to earn interest. Like an individual, the amount of interest offered will involve a cost benefit relationship based on cost of funds, regulation, and operational costs, but there should be no obvious reason not to pay something in most curencies. One note, under US banking regulation, "transaction accounts" fall under different rules than money market accounts, savings accounts, and NOW accounts. Depending on the exact functionality desired, and future regulation changes, there will be more or less incentive and/or legal ability to pay interest. Given the current functionality of Ecash there will be little incentive to hold balances on your hard drive once interest is available. It is just too easy to move the money down when you need it. Today there is no specific cost incentive between the Mint and your hard drive. It does not take a long leap to see that when the account and the Mint are merged, that since the Mint _is_ the account, PC/Internet banking, debit and all other regular banking functionality can become immediately integrated! Frank Trotter ftrotter(a)marktwain.com Opinions expressed are my own.... > On Wed, 10 Jan 1996, Tim Philp wrote: > > > With the E-cash systems that I have seen, you generate your own E-cash > > and have it signed by a 'bank' At that moment, it becomes like cash in > > your wallet and you loose interest that this money could be earning. > > >From the standpoint of monetary economics, this is correct. The (ecash) > bank has the right to use your deposits to give out loans. When you > withdraw your money (and turn it into either cash or ecash) they (the > bank) no longer have the right to turn your deposits into loans. > Withdrawn cash/ecash can not earn interest. > > This is the problem of (e)cash: if you have it on hand you _must_ forgo > any interest earnings. Theoretically, the optimum holding of (e)cash is a > function of interest rate (the greater the interest rate, the less cash on > hand), transaction cost of making withdrawals (the easier and more > convenient the withdrawals, the less cash on hand), and the "providence > value" of cash (the more you value instant gratification, the more cash on > hand). > > Thats why ATM machines have caused us to hold less cash. We can now keep > money in the bank (letting it earn interest and letting the bank create > loans with it) and withdraw from ATM terminals only when we need it. > > ------------------------------------------------------------------------------- > Patiwat Panurach Whatever you can do, or dream you can, begin it. > eMAIL: pati(a)ipied.tu.ac.th Boldness has genius, power and magic in it. > m/18 junior Fac of Economics -Johann W.Von Goethe > -------------------------------------------------------------------------------

2 1

Reliance Limits Considered Harmful
by Jueneman＠gte.com 17 Dec '03

17 Dec '03

>Suppose I am a CA. I am worried that by issuing a certificate with a >lifespan of more than 2 milliseconds I am opening myself up to unlimited >liability if for some reason, despite my best efforts, I issue an >erroneous certificate. > >I know I can write disclaimers, but that's not reliable since courts >often ignore them, and anyway it scares off customers. > >I know I can put an expiration date on the certificate, but that's not >enough. I can accumulate a lot of exposure in a few seconds, much less >weeks. > >I know I can put a reliance limit in the X.509 ver 3 certificate, but >that's not enough. Even a $1 limit could be used many millions of times. > >Is it feasabile to say: Can only be relied on once per day/week/month? >Is this something the relying parties can reasonably be expected to monitor? > >It seems to me that this sort of a limit is essential if a CA is to feel >comfortable outside Utah.... > >A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) >Associate Professor of Law | >U. Miami School of Law | froomkin(a)law.miami.edu >P.O. Box 248087 | http://www.law.miami.edu/~froomkin >Coral Gables, FL 33124 USA | It's warm here. > I have been troubled from the first with the concept of a reliance limit, in particular because of the problem Prof. Froomkin cites. In the "normal" paradigm for digital signatures, neither the CA nor the relying party(ies) have any knowledge of how many times that particular certificate/key has been used. As a result, there are few if any controls that would operate to enforce the notion of a reliance limit. Even in the electronic credit card environment where there is some sort of a closed loop system (the purchases are reported back to the Issuing Bank, and presumably would be or could be known by the CA, which is probably acting as an agent of the bank), there are some substantial problems. The first problem is one of privacy. If I have a very high credit limit, I certainly don't want to advertise that fact in a public certificate. On the other hand, if I have a low limit, I don't want to advertise that either. And in any case, the reliance limit is not intended to be a "floor limit", i.e., an amount below which it is not required to contact the credit card company for authrotization. (Floor limits used to be popular, especially in Europe where the cost of telecommuncations was high. But now almost all transactions are authorized against the customer's current balance and credit limit, and if the merchant doesn't check he can be stuck with the charge if the customer doesn't pay.) I have argued (quite unsuccessfully in the credit card community) that the reliance limit can provide a useful means of limiting the subscriber's exposure (as well as the CA's) in the event of a security compromise affecting the subscriber's private key. Since there are no perfect computer security solutions available at any price, much less an affordable price, both the subscriber and the CA have to make a tradeoff between their risks and the rewards of greater convenience, etc. I tried to get around the privacy issue in the credit card environment by treating a negative reliance limit as a percentage of the customer credit limit. But no one in the credit card industry was convinced, and maybe I'm not either. The concept of a reliance limit is enshrined in the Utah Digital Signature statute (and the ABA draft Digital Signature Guidelines), where it is wrapped up with a draconian requirement that registered CAs have to put up a surety bond or irrevocable letter or credit in the amount of 30% of the aggregate of all outstanding reliance limits. This is not just an insurance policy -- a CA's corporate assets are pledged to back up the certificates issued, not withstanding the fact that the identification system we have in this country is not sufficiently reliable to warrant such representations. And surely no CA is going to hire private investigators to check out who someone claims to be with sufficient credibility as to be able to issue certificates to individuals -- at least if they intend to charge any kind of a reasonable price for the certificates. In my personal opinion, that requirement in the Utah law makes it highly unlikely that anyone will ever become a registered CA in Utah, unless the reliance limit is set to $1 and/or the expiration period to about 1 millisecond. (Maybe the Utah statute was really trying to set up a lottery, rather than a system for registering CAs. Everyone gets to play, and if you can find a person who has invalid credentials, even if issued through an innocuous clerical error (someone misspelled the street name in someone's address), you can claim you were harmed in some way, sue them big time and collect millions. That's the American way, isn't it? :-) Although X.509 v3 provides a simple mechanism to allow additional attributes, potentially including a reliance limit, to be included in the certificate, there are at present no plans that I know of for any existing CA to actually do so, or more importantly, for anyone else's software to be able to read and comprehend those reliance limits or perform any checking. As a purely technical matter, the problem could be solved by requiring the relying party to validate the transaction (not just the certificate) with the CA in real time. (Checking a CRL database isn't good enough.) By providing a transaction amount, the CA could keep track of the extent of its liability, and could detect misuse. Alternatively, the subscriber could request a new certificate for each one time use. However, both of these "solutions" would require a significant extension to the current mechanisms, and also give rise to a number of privacy issues. In addition, there are other practical problems. If I am the relying party (or the CA), and the subscriber is using his digital signature to confirm an order to sell futures on the commodities market, how can I evaluate the potential risk? If the subscriber is selling futures for orange juice and a storm wipes out all of the orange trees, his losses could be unbounded. Similar situations could exist in the case of a signature on a patent claim, and creative people can probably think of many more cases. Although the notion of a reliance limit usually arises in conjunction with digital signatures, it would presumably apply to certificates used for message encryption, to set up encrypted sessions, etc., as well. This puts the CA in an even more difficult position, for now we are not talking about a (single) financial transaction. If I send an encrypted message to someone, and it turns out that the person who received it was not who he claimed be, I may in fact be greatly harmed. (If the message wasn't important, why would I have encrypted it in the first place. Suits for violation of privacy have resulted in millions of dollars in damages -- does that mean that the CA ought to provide a million dollar reliance limit? My conclusion after having thought about this a lot is that reliance limits are at best ineffective and at worst positively harmful. They are difficult or impossible to enforce in any meaningful way, they raise substantial privacy issues, and at least as codified in the Utah Act and the draft Digital Signature Guidelines they will almost surely act to dissuade any prudent business from setting up a licensed CA. Does this mean that the subscriber, relying party, and CA all have effectively unbounded liability, absent a stated reliance limit? No, I don't think so, but we may have to change our paradigm a little bit. Most people accept a driver's license as providing a degree of proof of someone's identity, but very few would consider it proof positive. Since the state-issued driver's license is the only practical means of identication available to a CA in the case of private individuals, that consitutes the weakest link in the system and is quite likely to remain so. The only other identification document I am aware of that is available to private individuals that provides substantially better identification than a driver's license is a permit to carry a concealed weapon. Here in Massachusetts, obtaining a pistol permit requires a trip to the local police station, where you are photographed, fingerprinted, and two or more affidavits concerning your character are reviewed prior to submitting your fingerprints and picture to the FBI, where a search of the NCIC database is used to determine if you have any prior arrests, etc. The permit card that is issued carries your residence or business address, your picture, fingerprint, date and place of birth, height, weight, complexion, hair color, eye color, and occupation. Since the Brady Bill was passed, I believe that many states have set up similar systems. (Of course many jurisdictions sharply limit who can actually receive a weapons permit. I'm only describing the process, not debating the reasonableness or unreasonableness of gun controls.) Even if state laws were amended to make this degree of identification assurance available for purposes other than weapons permits, many if not most people would have strong reservations about the privacy implications. And to the best of my knowledge, private companies are not allowed to access the NCIC, also for privacy reasons. Does all this mean that digital signatures are worthless? No, not at all. But it does mean that they are unlikely to convey a degree of surety as to someone's identity that is very much stronger than a driver's license identification. In my personal opinion, I think we need to establish a stronger degree of "no fault" protection for CAs that follow the rules. Whose rules are to be followed, and who audits them for conformance are valid issues. We clearly don't want irresponsible CAs issuing certificates to all and sundry, but we can't make the cost of entry into the business so high that no one takes on the burden of being a CA at all. The issue is how to balance risks, the costs, and the rewards equitably between the subscriber, the relying party, and the CA. In the case of the credit/debit card industry, the credit card companies charge a fee that covers both the risk and their administrative costs. If digital signatures can be used to reduce their risks, presumably the fees charged to the merchants can be reduced somewhat. But in any case, the fee that is charged is proportional to the amount of the transaction, and therefore statistically covers the risk. The real question is what to do outside of the credit card industry, where certificates may be used for transactions are much more complex, and where there may not be the infrastructure to collect a percentage fee for each use. Please copy me directly on any replies, as (to the best of my knowledge) I am not a subscriber to cypherpunks. Bob ---------------------------- Robert R. Jueneman GTE Laboratories 1-617-466-2820 "The opinions expressed are my own, and may or may not reflect the official position of GTE, if any."

1 0

Re: Domains, InterNIC, and PGP (and physical locations of hosts, to boot)
by jim bell 17 Dec '03

17 Dec '03

At 11:22 PM 1/11/96 -0800, you wrote: >For what it's worth, you can use the mapping software at ><http://tiger.census.gov> to find your location fairly accurately; you may >need another map to locate yourself, since the streets are unlabeled. I >managed to figure out that I'm currently at latitude 37.3435 degrees, >longitude -121.8925 degrees. I think that's correct to within about 100 >feet or so. > > - Tim > >Anyone with a GPS device, feel free to stop by; I'm in unit A2, and I've >got homebrew in the fridge. About 10 years ago, I bought a Loran unit from Heath, and (due to my association with some people who did laser photoplotting for PC boards) had a program written which generated a "LAT/LON" map plastic overlay. Apply over a USGS 7.5 minute map, and you can read LAT/LON directly. (It only needed to be photoplotted once, of course: positive contact printing duplicated it easily.) Only one problem: Since the width of longitude changes with latitude, a given map overlay can only be "exactly" accurate at one latitude. Still, it made estimating LAT/LON FAR easier.

1 0

Re: [NOISE] Microsoft continues to mislead public about Windows security
by daw＠quito.CS.Berkeley.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199601100451.UAA13211(a)infinity.c2.org>, <kolivet(a)alpha.c2.org> wrote: > On Tue, 9 Jan 1996, Frank Willoughby wrote: > > When a system is breached or a CERT Advisory is issued, this is a major > > embarassment for the company. > > What are CERT's criteria for a bulletin to be issued? Would the previously > mentioned Windows NT and Windows 95 security bugs qualify? CERT normally won't publish a security warning until the manufacturers have fixed the bug & offered a patch. So I doubt the Win95/NT bugs will be announced by CERT tomorrow. If you want to publish a bug, CERT is probably not the best place to go. CERT often ends up sitting on bugs for ages, because nobody knows about the hole, so nobody can pressure the vendors to fix 'em, so CERT refuses to release a bulletin-- a vicious cycle. IMHO, embarassing public pressure often seems to be the quickest way to get attention & fixes from uncooperative vendors... But then again, that's the old "full disclosure" (and "security through obscurity") debate(s). - -- Dave "a believer in security through caffeine" Wagner - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMPWugyoZzwIn1bdtAQFYrgGAyQhuXiFCK36qFdJzEw4PSp2f/oIvpoi+ 8peJmKjle86aBlY20SGYQBQoactyKcza =3NOo -----END PGP SIGNATURE-----

2 1

Minor correction about tax rates and witholding
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:21 PM 1/11/96, Gary Howland wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >> you think that's a bit ridiculous? i'm paid via an NIH grant given to my >> adivisor by the govt. this stipend is taxed. it didn't used to be >> (started to be taxed around '86 i believe). why the hell doesn't the >> govt just save everyone the trouble and pay me less. i'm sure they could >> get rid of a couple of IRS people this way. > >It's even sillier over here in Europe, and the paperwork is probably .. I didn't comment when the first remark was made, several days ago, but if others are going to elaborate on it, I will now comment. The government cannot simply take its cut before sending the stipend/salary for a very good reason: they don't know the final tax rates of the taxpayers! Some people will end up paying no taxes, for whatever reasons (low overall wages, lots of deductions and dependents, offsetting capital losses, etc.). Others will pay 20%, and some may even pay more (doubtful, on a stipend, but you get the point). Clearly the government cannot simply "withold" 15%, say, nor can it know in advance the precise amount to withold. A flat tax rate would make this more possible, but would still not be completely accurate. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

US DoJ Zimmermann Press Release
by Declan B. McCullagh 17 Dec '03

17 Dec '03

>From Mike Godwin and Stanton McCandlish. Transcribed from fax. -Declan ----------- [begin] [logo] United States Attorney Northern District of California _____________________________________________________________________________ San Jose Office (408) 535-5061 280 South First Street, Suite 371 San Jose, California 95113 FAX: (408) 535-5066 PRESS RELEASE FOR IMMEDIATE RELEASE January 11, 1995 Michael J. Yamaguchi, United States Attorney for the Norther District of California, announced today that his office has declined prosectution of any individuals in connection with the posting to USENET in June 1991 of the encryption program known as "Pretty Good Privacy." The investigation has been closed. No further comment will be made by the U.S. Attorney's office on the reasons for declination. Assistant U.S. Attorney William P. Keane of the U.S. Attorney's Office in San Jose at (408) 535-5053 oversaw the government's investigation of the case. [end]

2 1

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Got this off the web - it's a link to the letter that Phil got from the US attorney: http://www.eff.org/pub/Alerts/usatty_pgp_011196.announce U.S. Atty. DROPS PGP INVESTIGATION! - -- Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com 214/993-3935 voicemail/digital pager 800/558-3408 SkyPager Finger ecarp(a)netcom.com for PGP 2.5 public key an88744(a)anon.penet.fi "Past the wounds of childhood, past the fallen dreams and the broken families, through the hurt and the loss and the agony only the night ever hears, is a waiting soul. Patient, permanent, abundant, it opens its infinite heart and asks only one thing of you ... 'Remember who it is you really are.'" -- "Losing Your Mind", Karen Alexander and Rick Boyes -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPXZYyS9AwzY9LDxAQG4BgP+PmA6GoUSMCpnvUfo+1v1MpFX0pdg66jN Foo5yuT+G2fIG1m+K4aVrZusPHhC+tHjx2kaMqn0ZSE9nC8U32blpt01+CE+xgp3 x4q5L6llkyEK4oWSrnjbZImcjm3VIrAiaj8S3+qGfAz3FEZ5ChJZ2Q4J91lsqv5z 3FY/xiKqu60= =Nrr2 -----END PGP SIGNATURE-----

1 0

Re: Zimmermann case is dropped.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:29 PM 1/11/96, sameer wrote: > We've made no progress. Phil has lots lots of time and gained >lots of grey hairs, and everyone who donated to his defense fund lost >money. > The US can still harass people if they want, and make their >life hell. Yes, I think it likely that another case will be filed, a case the government senses is more winnable. In many ways, what Phil and/or some of his friends may or may not have done was too "stale." None of the Four Horsemen were involved directly, and Phil's case generated publicity that tended to make him a hero, not an Enemy of the People. I would look for something like a prosecution of a remailer operator, though only after laws are passed making it illegal to remail certain items. (Right now there is no law against redirecting a message, so prosecution would be difficult.) --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

For once, Thatcher said it best: "Just Rejoice." However, Churchill said it better: "This is not the end. This is not the beginning of the, but rather the end of the beginning". But has Phil sold the photos to a tabloid yet? Simon (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n))))

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- First of all, let me apologize for not being very knowledgable about CA's and https and SSLeay, apache, and generating renegade (ie, your own) certificates. If someone wants to go over this [again] certainly it'd be welcome. I was today playing around with a Mozilla 2.0beta5 that someone gave me [more bells and whistles than my 1.12, but not much more bang for the buck] and was showing a friend all the nifty information that netscape tells about you when you visit sites, then went to c2 to show off the apache web server and when I tried to use https:// to show off how you can have your own encrypting web server for free and everything, a window popped up and said the certificate was expired. I couldn't really tell if it meant that the certificate that Sameer generated really needed to be updated, or if Netscape beta 5 had just been rigged to reject non-netscape certificates, but the end result was no encryption. (Jeff, if you're reading this, of course we know that Netscape, with it's open loving policies wouldn't do anything underhanded, but the thought does come to mind, and by the way, when are we going to see an option to turn off or control what information is passed out to the other end. Specifically, I'd like http://anonymizer.cs.cmu.edu:8080/prog/snoop.pl to come up nearly blank.) Soooo, anyway, I was wondering if anyone knows anything about the use of privately generated certificates. Yes, Jeff, we know that Netscape is jumping to fully support user-specified certificates, but personally I saw, relating to certificates, a lot of *nifty* options and displays, but really didn't see much in the way of anything that looked like "add". ...Looking forward to the day where end-to-end encryption is king, and the TLA, my competition, or anyone else can take their packet sniffer and kiss my butt. Don PS: my predictions on the PRZ-secretly-sold-out-rumor-index: 6. my predictions on the IQ of those making those claims: 6. (cumulative) woohooo Phil! - -- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://students.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Junk mail to root(a)127.0.0.1 * This user insured by the Smith, Wesson, & Zimmermann insurance company * -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMPXDV8La+QKZS485AQHkXwMAnGWVeLB6ntpkK1ksZ7a8+iklA/sPfIT2 XqqJRRX0Ddg2UuAAxmk6WOC/nxnRPRlM/4AkkaEohZRv14ccnlvv3qVGFxpLlxKG iYgbn1x9/xgHjwAB31HqozQix79wPfB/ =v9ni -----END PGP SIGNATURE-----

1 0

No Subject
by Mario Enrique Sanchez 17 Dec '03

17 Dec '03

Can i be subscribed to the list?

1 0

Cryptology and classification
by nobody＠tjava.com 17 Dec '03

17 Dec '03

Hi all, Just received a memo, the "Desk Reference Guide" to Executive Order 12958. This memo/executive order discusses classified national security information. The cypherpunks-interesting aspect of this memo lies in exceptions to some new guidelines. Basically, this executive order removes the authority for the government to "permanently" classify information. Basically, classification is now limited to 10 years (or 25 years in some special cases). The exceptions to this allow classification for longer durations for certain types of material. These types include things like protecting intelligence sources and nuclear weapons design info. One of the other exeptions is for: "...information that would impair United States cryptologic systems or activities." This appears to be taken directly from the executive order, so these types of decisions are being made at high levels. Thought you might be interested. Hooker

1 0

Mitnick Road Show
by Andrew Barrett/CheckFree Corporation 17 Dec '03

17 Dec '03

Andy P. wrote: >Saw the Stanford seimnar given by Tsutomu Shimomura and John Markoff, >on the subject of Tsutomu's pursuit of Kevin Mitnick. Saw a teaser last night for Friday's broadcast of the Stone and Pauly show. Looks like they're doing a piece on Mitnick. They did not mention him by name, but used some of the epitaphs commonly associated with Mitnick since Markoff's Cyberpunk. Which makes sense, since most of the viewing public doesn't know Kevin Mitnick from Steve Jobs. I just hope this piece is better than the infamous Unsolved Mysteries treatments. I am not holding my breath.

1 0

Cybersloth
by John Young 17 Dec '03

17 Dec '03

Shimomura and Markoff give an illuminating account of tracking system break-ins; it is in those that Tsutomu and his road crew really dazzle. Skip the filmic crud and enjoy the gritty details of hackers hacking, stretching legality and propriety, emulating their mocking nemeses. Glimpse the far-side hackers, say, jsz and jft and xxx, still taunting, eluding, taking down, making pay for job- security cybersloths.

1 0

Re: Shimomura on TV?
by Douglas F. Elznic 17 Dec '03

17 Dec '03

At 08:15 PM 1/11/96 +0000, Michael C. Peponis wrote: > >> Has anyone heard anything else about this? I am getting real sick of the >> media's portrayal of the internet. They never say anything good about it. If >> they were to mention C2's system they would say how it is a no-rules server >> to hide thugs and pornos from the police. I am getting sick of watching this >> trash. The whole realm of the internet and computers and their associated >> areas are very dear to me I am sick of the media bludgeoning them to death. > >Douglas, > >Why let it bother you? You must understand that the majority of the >population of the United States is working class trash, the news >media is just peddeling to the masses, just like the morons that hold >elected office. > >They can keep up the bitching, but that's a good thing, I encourage >the spread of this kind of disinformation, it keeps even more of the >masses from getting on for fear of being offenced. > >Regards, >Michael Peponis >PGP Key Avalible form MIT Key Server,or via finger > > Mr. Peponis, I see what you are saying but doesn't it bother you the slightest bit? I guess it is the principle of the whole thing for me. Look at us. Members of a group that's purpose is to make computers free. We read hundred's and hundred's of messages a week talking about crypto and legal stuff, because we care about what happens on a economic, civil and most importantly a personal level. I don't know it just bothers me that they are dragging something so important to me throught the mud. They never mention the good stuff like the OK City support group page, the use in schools, the effectiveness of the internet as a research tool. And most of the time their "internet" is AOL. -- ==================Douglas Elznic=================== delznic(a)storm.net http://www.vcomm.net/~delznic/ (315)682-5489 (315)682-1647 4877 Firethorn Circle Manlius, NY 13104 "Challenge the system, question the rules." =================================================== PGP key available: http://www.vcomm.net/~delznic/pgpkey.asc PGP Fingerprint: 68 6F 89 F6 F0 58 AE 22 14 8A 31 2A E5 5C FD A5 ===================================================

1 0

AP story on PGP
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

U.S. Attorney Won't Prosecute Author of Computer Encryption Program By ELIZABETH WEISE= AP Cyberspace Writer= SAN FRANCISCO (AP) - A software writer won't be prosecuted for a program he wrote that was put on the Internet and is now widely used by computer users to keep their communications secret, the government said Thursday. Philip Zimmermann's Pretty Good Privacy encryption program turns computer messages into a jumble of numbers and letters unreadable to anyone except the intended recipient. The code is so unbreakable that it is classified as munitions under the Arms Export Control Act, making its export without a license a felony. Federal prosecutors began investigating Zimmerman in 1993 after the program appeared on the Internet global computer network. Zimmerman said that others put it there, not him. The government opposes export of cryptographic technology for fear it will make it harder to monitor electronic communications overseas, and domestic law enforcement agencies are concerned such programs could keep them from eavesdropping on digital conversations. U.S. Attorney Michael J. Yamaguchi announced the decision not to prosecute Zimmerman, but didn't say why. If convicted, Zimmermann would have faced 51 months in prison. ``I'm just really pleased that the sword of Damocles is not over me anymore and I wonder why it took so long,'' Zimmermann said in a phone interview from his home in Boulder, Colorado. ``This is not just for spies anymore. It's for the rest of us. The information age is here. The rest of us need cryptography to conduct our business.'' The case had been closely watched as computer users and the government square off over free speech and privacy rights. Some critics contended it was foolish of the government to claim that Zimmerman had broken the law because the same coding information forbidden for export electronically may be shipped abroad in print form. They also noted that the technology already circulates throughout the world, making the law unenforceable. ``Zimmermann never exported Pretty Good Privacy, so the U.S. Attorney seemed to be missing the point. Unfortunately there still is no clear ruling from our government as to whether or not making software available on the Internet counts as exporting it,'' said Simson Garfinkel, who wrote a book about the program. Zimmerman's supporters argued that without encryption, government could do widespread eavesdropping, perhaps for political reasons, scanning for words and phrases it considers subversive. They acknowledge that a few criminals may use programs like PGP to hide out in cyberspace, but believe that concern is outweighed by free speech and privacy rights. ``The case was part of the government effort to crack down on good technologies for privacy. We hope the government's decision signals a rethinking of federal policy in this very important area,'' said Marc Rotenberg of the Electronic Privacy Information Center in Washington, an on-line civil rights watchdog group. Others see the 2.5-year investigation of Zimmermann as intimidation. ``It seems to me is that all the U.S. Attorney is saying is that they don't want the public relations nightmare of prosecuting Philip Zimmermann, but they still want everyone scared so that they won't exercise their Constitutional rights,'' Garfinkel said. --- Pretty Good Privacy is available on the World Wide Web at http://www.epic.org/privacy/tools.html

1 0

Re: Zimmermann case is dropped.
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [My sincere congrats to PRZ & Mr. Goen, and to Mr. Keane for getting a clue. I am sure the timing of this happy news had *nothing at all* to do with politics...<g>] A few questions about the investigation: What did the ZLDF end up spending? What did the govt. end up spending? [I know, it's hard to track taxe$.] Was this decision on the part of the prosecution as voluntary as it's made to sound, or were some members of the grand jury starting to make "nullification noises" as the investigation progressed? Has the grand jury been dismissed yet? If so, have any jurors spoken publicly about the investigation? JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMPY6HW1lp8bpvW01AQH6oAQAjCePRH2YcEo/OlJrfXMG/K0Fk0/0gcE5 z9k0AYDeNb4iY7vaxSaauPlbQZrw2J48ItWf1y45LSiAE32+sJvYogrIyJbqTDhB 4yC5uXXPzLQcA3tp3AEkUe7Zbr7n1X1uAz2LwfddwRRiNnXxFtd0TIcReg4Bdv5g KB8S+9fCgk8= =hPyf -----END PGP SIGNATURE-----

1 0

VHDL des model
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

A mimimal DES chip implementation can be found at: ripem.msu.edu:/pub/crypt/des/vhdl_des.tar.z -rw-r----- 1 mrr ftpsec 93630 Jan 12 02:01 vhdl_des.tar.z It was written to go with a paper on DES Hardware I'm putting the finishing touches on. Note that this site requires a password to belong to group ftpsec to download. It will encrypt in 47 clocks (8 IP, 29 Key Schedule, 8 FP) or decrypt in 46 clocks (28 Key Schedule), and will fit in some of the larger FPGAs. The paper, when finished, will describe various performance enhancements such as double buffered IP and FP (which is covered by an Ultron patent, although probably invalid), direct key schedule (16 clocks), or superscalar DES (approaching 1 clock per 64 bit block). For any hardware wonks, this is done in Synopsys VSS, although the README file contains enough information for other VHDL implmentations. There are also 4 or 5 'C' programs for generating VHDL files of the S Boxes in various configurations, and a sample 'C' DES program done in 1988 for the original UNIX libdes (source included). The 'C' program can be used to generate equivalent structures for debugging your own DES hardware variations. The test vectors are from NBS Special Pub 500-20 (circa 1978).

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

On Thu, 11 Jan 1996 hallam(a)w3.org wrote: > make small ones out of big ones. Thats a big plus in many peoples books. > > > > > We've made no progress. Phil has lots lots of time and gained > >lots of grey hairs, and everyone who donated to his defense fund lost > >money. > > No progress? At least Phil is not going off on a trip to Alcatraz to > One of the most overdue reforms of the US government is the renaming of > the FBI building to remove the name of J Edgar Hoover. The abuse of power > under his administration of the FBI continues to poison the US polity > by providing clear proof to many citizens that their government cannot be > trusted. While the abuses of Hoover continue to be commemerated in this > fashion there can be little public confidence in any claims of reform. > > > The US can still harass people if they want, and make their > >life hell. > > Not just the US government. There are many crooks out there who have attempted > or are attempting worse. At least with the government there are means to > bring it to heel eventually. > > Phill > > (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n))))

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

> > We've made no progress. Phil has lots lots of time and gained > >lots of grey hairs, and everyone who donated to his defense fund lost > >money. > > No progress? At least Phil is not going off on a trip to Alcatraz to > make small ones out of big ones. Thats a big plus in many peoples books. I wish I could make another of my pollyannaish posts now, but I agree with Sameer. It's great that Phil's off the hook, but there's nothing to stop them from doing the same thing to someone else tomorrow. What's more,, everyone here knows that, and so the government gets what it really wants: a chilling effect on crypto development. How much credit do you give a guy when he stops beating his wife? They put Phil through the ringer, made him spend his money on lawyers, and added a lot of stress to his life. But they haven't admitted that they were wrong, and they haven't renounced such actions in the future. We're all very happy that Phil's out of the woods, and today's announcement is a great thing. But it's not enough.

1 0

PGP_foi
by John Young 17 Dec '03

17 Dec '03

1-12-96. NYPaper: "Data Secrecy Export Case Dropped by U.S." By John Markoff. PGP_foi

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

> From: Michael C. Peponis <mianigand(a)unique.outlook.net> > To: cypherpunks(a)toad.com > > Why let it bother you? You must understand that the majority of the ^^^^^^^^ > population of the United States is working class trash, the news ^^^^^^^^^^^^^^^^^^^ Hope you're including yourself in that. > media is just peddeling to the masses, just like the morons that hold ^^^^^^^^^ Can't spell - *must* be working class trash... > elected office. > > Regards, > Michael Peponis ^^^^^^^ Tell me: is the 'po' silent?

1 0