December 2003 - cypherpunks-legacy

Re: Golden Key Campaign
by Hal 17 Dec '03

17 Dec '03

From: frantz(a)netcom.com (Bill Frantz) > Some people say that the millennium comes on Jan 1, 2000. Others say it > comes on January 1, 2001. I say it comes on September 20, 2000 when the > RSA patent expires. It is traditional to commemorate big events with annual observances. I say there's no reason the observances can't predate the event when it is known in advance. So I propose that September 20 be known as Crypto Freedom Day, and an annual celebration be held on that day. With each year closer to 2000 the party gets bigger, culminating on the day that the patent actually expires. We can all run our RSA in three lines of Java that Adam Back will have prepared, and taste for the first time the freedom which the rest of the world will have known for the past 17 years. Hal

1 0

ANNOUNCE: new Microsoft Code Signing mailing list
by Microsoft Internet Announcements 17 Dec '03

17 Dec '03

CodeSign on ListAdmin(a)lists.msn.com CodeSign is a mailing list (discussion list) for discussions on Microsoft's Windows Trust Verification Services, a set of API's which determine whether a software component contains digital certificates that identify it as being authentic software released by a publisher trusted on the local user's system. For more information about Code Signing, see <http://www.microsoft.com/intdev/>. You can subscribe to the regular mailing list or a digest version. To subscribe, send e-mail to ListAdmin(a)lists.msn.com with the following text in the message body (not subject line): subscribe CodeSign your(a)email.address or digest CodeSign your(a)email.address where your(a)mail.address is your actual e-mail address (don't just use "your(a)mail.address"). To unsubscribe, send e-mail to ListAdmin(a)lists.msn.com with the following text in the message body (not subject line): unsubscribe CodeSign your(a)email.address To send a message to the subscribers of the list, send e-mail to CodeSign(a)lists.msn.com.

1 0

Re: Is the public involved in the crypto policy debate?
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Apr 26, 1996 02:05:40, 'tcmay(a)got.net (Timothy C. May)' wrote: > >(If we were leftist theoreticians, we could debate for years or even >decades whether our movement is truly a mass movement, or just a vanguard >movement, etc.) > >--Tim May > I do not mind being trolled from time to time. Based on my anthropological, political, and journalistic researches, I look at cypherpunks as a heterogeneous, not homogenous, movement. By this, I mean that it can be examined in a variety of ways based on significantly different points. 1) Development (more accurately spread) of public key crypto: definitely vanguard. 2) Development and spread of anon remailers: definitely vanguard. 3) Opposition to CDA, etc.: Part of a smallish mass movement. Participation in the movement definitely limited to a small number of issues involved. E.G. good contributions to publicity; no contribution to issues of mass sexual hysteria around "kiddie porn," etc. 4) Other issues, like future role of e-cash, etc. Not vanguard, not mass movement, a "bunch of loons." --tallpaul

1 0

Re: Mindshare and Java
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:47 PM 4/24/96 -0700, Rich Graves wrote: >I agree that the major innovation, and cypherpunk opportunity, of Java is >in its cross-platform nature, not its vaunted ability to run untrusted >code safely. I'm sorry, I'm just not interested in running untrusted code. >Give me digitally signed code that I can trust, or for which the author >can at least be held accountable, and I'll be happy. I, for one, am interested in running untrusted code. If I can run untrusted code, I can greatly reduce my exposure to Trojan horses and bugs. It bothers me that if I run Microsoft Word, it can trash my MacWrite files. Even if I get these programs from reputable dealers, in original shrink-wrap boxes, so I have good reason to believe I know who the author is, I am still exposed to these problems. I should note that Java's one-straitjacket-fits-all approach to running untrusted programs is not adequate to satisfy my desires. However, it is a start, and it does run in todays complex Input Output Control Systems that have been misnamed "Operating Systems". (If it can't enforce a security policy, it isn't an Operating System.) I would rather use technological means to prevent damage than legal means. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

3 3

Anti-porn activists' old memo on alt.sex.*, anonymous remailers
by Declan B. McCullagh 17 Dec '03

17 Dec '03

This is a note I came across in my archives hinting at how anti-porn groups used the content of the alt.sex.* groups to pass the CDA, and how they may not exactly be a fan of anonymous remailers. Attached is a memo from Deen Kaplan, previously a vice president at the then-named National Coalition Against Pornography, to other anti-porn activists. Note that John McMickle soon afterwards became a member of Sen. Chuck Grassley's staff and helped recruit witnesses for the July 1995 cyberporn hearings. (You may recall that Grassley was pushing for a law even worse than the CDA.) Some of the names on the To: line are easy to identify, like Rice-Hughes and Jepsen from Enough is Enough! And Cathy Cleaver from the Family Research Council, whom I'm debating in a few weeks. The others I haven't figured out yet. (The FRC is run by Gary Bauer, a former policy assistant to Reagan and a former undersecretary at the Department of Education. Now Bauer heads the FRC, the DC-based lobbying extension of James Dobson's Focus on the Family." Dobson's history includes serving on the Attorney General's Commission on Pornography, aka the Meese Commission. Bauer also embraced Marty Rimm's cyberporn study as gospel, calling the ACLU and EFF "porn industry apologists" who are "taking cheap shots at this comprehensive study.") I'm passing this along as an FYI. -Declan My Rimm web site: http://www.cs.cmu.edu/~declan/rimm/ The attached article and followup: http://www.cs.cmu.edu/~declan/rimm/asst/anti_porn_group_11_22_94.letter Cleaver's op-ed on CDA: "Kids Need Protection in Cyberspace, Too" http://fight-censorship.dementia.org/dl?num=1153 ---------------------------------------------------------------------- Note for Donna Rice-Hughes From: Deen Kaplan Date: Tue, Nov 22, 1994 1:43 PM Subject: Alt.sex.pedophilia To: Cathy Cleaver; Dee Jepson; Dianna Denney; Dixie Sanner; Donna Rice-Hughes; Jan LaRue/Lillian; John McMickle; Lori Fender; Maryam Kubasek; Monique/Ginny/Stacy; Paul Maurer; Rick Schatz Here's an anonymous message posted last night on the Usenet Board Alt.sex.pedophilia. REALLY sick and a good example (even if the person is kidding, which is unlikely in this area.). I'll do a demo of how the USENET boards work in the office for D.C. people after Thanksgiving. ---------------------------- Receiving information ... 1. Help I'm here with you and must know more about this group 2. Now what? 3. Now what? --> 4. fun at the hospital Message-ID:<090418Z21111994(a)anon.penet.fi> Path:msuinfo!uwm.edu!math.ohio-state.edu!howland.reston.ans.net!pipex!demon!kaa rna.cc.jyu.fi!news.funet.fi!news.eunet.fi!anon.penet.fi Newsgroups: alt.sex.pedophile.mike-labbe From: an141380(a)anon.penet.fi X-Anonymously-To: alt.sex.pedophile.mike-labbe Organization: Anonymous contact service Reply-To: an141380(a)anon.penet.fi Date: Mon,21 Nov 1994 09:02:17 UTC Subject: fun at the hospital Lines: 10 Those orphan kids in the terminally ill section of the hospital are so fun at night when they are drugged out. I love sucking on their tiny finger-sized cocks and probing their tight holes. Their slender little bodies are completely smooth. They're going to die pretty soon so they won't come back to me several years from now as hairy grown up men blaming me for why they are all mentally messed up. And since they are orphans with no one to look over them except for overworked staff, I could get away with just about anything. ------------------------------ To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi

1 0

Re: [NOISE] The Iron Mountain Report
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:33 PM 4/24/96 -0700, Rich Graves wrote: >The author of the Iron Mountain Report was interviewed on PBS a few weeks >ago. It was a really over-the-top parody published in 1967. That's _Nationalized_ Public Radio; any conspiracy that couldn't get somebody on their denying that they were the secret power behind the government is obviously not competent to be the _real_ secret power behind the government. The interview just shows how pervasive they are. :-) Meanwhile, Robert Ludlum's got a new book out, doing another "hidden Nazis-will-rise-again" conspiracy. It's ok, though not as good as his best work. Among other events, the disinformation leaked out by the Neo-Nazis frames many prominent people as Nazis, a critical few of whom really are. And there's a bad parody of a fat talk-show host somewhat to the right of Attila the Hun (Caller: "Double whippo, Arnie!") who gets framed on the air... >Every once in a while, I get mail asking whether I really have contacts in >Sendero Luminoso, since a bit of satire I wrote was quoted in the Web >Review (which made no attempt to contact me before printing the satire as >my position). Foo - even I've had contacts in the Sendero Luminoso, though they all would have strictly denied it - they were just "good Socialist college students" and "immigrant refugees" from Peru, which _does_ have a fairly brutal and sleazy elected dictator. Not everybody in the anti-war business is pro-peace. >Truth is far more fragile than fiction. Sure, cause fiction's supposed to make sense. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

2 1

Re: Golden Key Campaign
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:27 PM 4/25/96 -0400, Perry E. Metzger wrote: >Bill Frantz writes: >> I will add to Bill's list: >> >> 7) RSA is the best known and vetted of the Public Key algorithms. > >Nota at all, Mr. Frantz. There are no proofs of security associated >with RSA. Rabin has excellent proofs that breaking a message is >strictly equivalent to factoring. I do not equate good vetting with proofs of security. Given the Verona intercepts, I don't think there are any valid proofs of the security of complete crypto-systems. While anyone who can factor RSA keys can break RSA, factoring has been intensively studied since RSA was published. The public information says that in spite of improvements, factoring is still a hard problem. If people in Maryland can factor big RSA keys, they're Not Saying Anything. So far, I'll stand by my two contentions: 7a) RSA is the best known public key algorithm. 7b) RSA is the best vetted public key algorithm. Do you have any counter examples to help me change my mind? ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

2 1

US law - World Law - Secret Banking
by Black Unicorn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Thu, 25 Apr 1996, Anonymous wrote: > Financial Times, April 23, 1996, p. 8. > Long arm of US law threatens business > By Clay Harris > > The extra-territorial reach of US law poses a growing > threat to non-US companies doing business, even indirectly, > with that country, an expert on money laundering said > yesterday. It amazes me that this is new news. I've been watching this since the mid 80s. > Mr Rowan Bosworth-Davies, senior consultant at London > solicitors Titmuss Sainer Dechert, told a conference in > Lisbon that US courts had been "consistent in concluding > that US law enforcement interests outweigh a foreign > nation's interests in preserving the confidentiality of its > banking or its business records". The earliest of these decisions dates back to the 60s. Good morning reporters. Have a nice nap? [...] > The due diligence required was "truly awesome," Mr > Bosworth-Davies said. "Any new proposed business client who > is a US citizen, who proposes to do business on US > exchanges, buy US property, transfer money from a US > institution, pass money through a US institution or return > money to a US institution must become subject to a level of > investigation not hitherto contemplated." What has consistently alarmed me is the United States trend of extending her own moral and ethical standards world wide. Granted the United States is the foremost world economic power, but the power to control markets and the political power to invade the sovereignty of other states are two distinct issues. The United States is, in one form or another, attempting to homogonize the legal systems of the world to comply with her own concept of what is "right" or "fair." This is disturbing. I will not go so far as to propose that this is some grand conspiracy or some "one world government" plot. I will comment, however, that what started with concepts of anti-trust, and progressed into the field of securities regulation, has (publically) become an issue of banking secrecy and cryptography. By no means are the states of the world united on the meaning of anti-trust, the appropriate levels of regulation therein, or the manner in which to enforce these segments of the law. That the United States should seek to impose her own will and concepts on foreign states strikes me as the antithesis of this once noble power's call, indeed the central focus of her foreign policy, for the self determination of all nation states. One sees a larger trend. The dream of European unification, many times attempted attempted militarily (France, Napoleon, Germany), then politico-economically (The European Union) has become a global legal financial reform effort led by the United States. While from the prespective of the United States, the position seems rational, what is constantly ignored is the imposition on foreign states, particularly those with a long culture of independent and unintrusive legal regimes. (Switzerland, Austria, Sweden have all felt the pressure from the United States of late). Perhaps unwittingly, under the guise of protecting her shores from 'Money Laundering,' 'Narco-Terrorism,' Terrorism and any number of international criminal problems, the United States appears to be a united front for worldwide financial legal reform. It is my prediction that this policy, which ignores the international comity between nations, will severely disadvantage the country in the years and decades to come. Mr. May (I believe) on this list predicted the inevitable clash between strong cryptography and the technologies and capacities it creates and statist trends. I join in his assesment. Private banking in cyberspace is in its infancy. At the moment institutions are identified, have a geographical base, and depend on the graces of a single host state to exist. Many or most institutions hold significant assets within the borders of the United States, and still others derive a large portion of their income from U.S. branches. These days will not last forever. The introduction of a geographically diverse, multi-jurisdiction, crypto and secret sharing institution with completely blinded assets assured and accountable merely through blind digital signatures is around the corner. Such an institution will be impervious to the whims of the United States or any other power. She may even hold stock secretly in U.S. institutions, offer mutual funds investing in U.S. stocks, and yet remain beyond the reach of the legal systems and intelligence apperatus of the western world. It is my vision to create such a system. > A former legal adviser to the UK intelligence agencies MI5 > and MI6, meanwhile, told the conference that organised > criminals should be declared "illegal international > organisations" (IIOs) and made subject to administrative > sanctions similar to those applying to "rogue states". Any individual understanding the jargon of intelligence will appreciate the meaning of this statement. What is being called for here is the application of the full brunt of intelligence assets and even covert actions to enforce that which cannot be enforced by law alone. > Mr David Bickford, deputy chairman of Strategy > International UK, said organised criminals planned their > crimes to take advantage of different national legal > systems and mutual legal assistance treaties. As do tax attornies, multi-national corporations, wealthy individuals, and import-export traders. The United States has become expert in the process of criminalizing the act of being a criminal. > A solution, he said, was to treat them as organisations, > not individuals. Once they were identified as IIOs, assets > would be subject to seizure and forfeiture. > > The system would require strict oversight and a forum to > determine complaints and claims. Revenue provided by > forfeited assets could be applied to the cost of > investigation and to the parties which lost revenue as a > result. A dangerous, frightening concept. Akin to worldwide application of the RICO act. > Financial Times, April 24, 1996, p. 8. > US prosecutor attacks bank secrecy laws > By Clay Harris > Mr Moscow, who since 1989 has been assigned to prosecute > cases related to Bank of Credit and Commerce International > said: "In the BCCI case, we had $3bn going from Egypt, > through New York, to Nassau in the Bahamas and back. I > don't suppose that there has been $3bn in trade between > Egypt and the Bahamas in all recorded history. A prudent > banker would have asked what business his customers were > in." And that prudent banker might have been told by the CIA to shut up or take a walk. BCCIs problem was that the prosecutors in Miami and the Federal system never bothered to do any work until the Iran Contra scandal. This despite constant allegations and indications of major frauds. BCCI is a poor example because it involved corrupt bankers who formed the bank with the intent of defrauding depositors and investors, not a bank which was merely annoying to the tax authorities of the United States. > In a strong attack on bank secrecy laws, he said: "The > ancient concept that bank secrecy must be preserved to keep > a gentleman's financial affairs confidential -- dating back > to the days when only gentlemen had cheque accounts, and > their servants did not -- must give way to the current > reality. Which reality? That the United States wants access to the financial records of anyone and everyone on the planet? > "Bank secrecy statutes in international finance are used by > crooks, tax evaders, securities fraudsters, and capital > flight fellows; they are used by narcotics dealers. But > they are not needed by honest folks engaged in honest > transactions." Neither are walls, envelopes, whispers or any other manner of secret keeping. Correct? Haven't we seen this before? If prosecutors would do their job and concentrate on the crimes themselves as opposed to reforming the entire international financial system to make their work a bit easier, noone would be concerned. Financial investigations are a crutch for poor prosecutors. > He added: "There is no reason why the people in Vanuatu > cannot have rigid bank secrecy laws. I do not care what > they do among themselves, so long as they are consenting > adults. I do care, however, if they try to merchant their > sovereign status and impose their sovereignty on New York > (along with rest of the civilised world), to protect the > narco dollars from detection... As we see it, if the money > goes through Manhattan, we may well have jurisdiction." Jurisdiction over the Manhattan bank, fine. What are you going to do? Invade Vanatu? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMX/lzy1onm9OaF05AQHYfAgAj99lS+cdF8Nn4oTSu6IukBzTgdQf97em GtAWp2N47RwA5GEtRl/b/zGBMPOHdsUh6OLklpy4MIeurPYlMAWH49nJlT2viV0e MBU9q9/9q5w+7wGMHci76hRzb1gYYqBEvT9fGRhQx+fkL4Be8ZxuyYnhanapisZL zFdqMhRJa1o6lKXA9MQjmJ42A2SR74HnjzuTkpjzc3Wq3V1jdByhs57xZj+gJWB1 fP1w4ii43zI54ZlWR6P88zYyYc5UYeYoaGVqe1hYGUEJ+2J+K/px2/AgH5p8LQAa 9zVTXMqLPwBxb8JDfV7ThcQilVTKTQKSfj2I8RRwHF4lI5cvIG4W/A== =SZov -----END PGP SIGNATURE----- --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information Opp. Counsel: For all your expert testimony needs: jimbell(a)pacifier.com

1 0

Re: Hack MSN anyone?
by Lee Fisher 17 Dec '03

17 Dec '03

I was curious about the below message, and checked... MSN uses CHAP (PPP's challenge-response handshake) for network layer authetication, and NTLM (Windows NT's challenge-response handshake) for application-layer authentication. The password is never sent in across the network. Challenge-responses encrypted with the password are sent. Lee Fisher | The names have been changed to protect the innocent... | I need say no more I'm sure. | || Yes, windows95 dialup networking uses compression to send the password || when connecting. Thanks for using the Microsoft Network || ||| Problem Description: Microsoft being security conscious and all, I ||| would hope that when I connect to MSN over the Internet, that my MSN ||| client has the decency to ENCRYPT my password when it sends it over the ||| net, yes? This is the first time I couldn't get through to a dial-up ||| connection and had to access MSN using my ISP. Having done so, I find ||| it extrememly convenient, and would like to continue to do so. Thanks.

2 1

Brock Meeks: "The Encryption Clock"
by Declan B. McCullagh 17 Dec '03

17 Dec '03

[Near end, Mike Nelson is quoted insisting that White House wants voluntary key escrow, etc. --Declan] http://www.hotwired.com/muckraker/ The Encryption Clock When US Attorney General Janet Reno held a high-profile news conference crowing about the first successful use of an "Internet wiretap," she set the "Encryption Clock" in motion. The Encryption Clock (my own invention) is shamelessly stolen from the "Doomsday Clock" ginned up by nuclear scientists during the Cold War. Since 1947 the Bulletin of Atomic Scientists has moved the minute hand on the Doomsday Clock forward or backward; the placement was a guess by the planet's top minds as to how close the world was to full-scale nuclear holocaust. Midnight signaled the end of humanity. At the height of Reagan's "Evil Empire" rhetoric, the clock was 3 minutes from striking 12. It was only after the USSR self-destructed that the clock was rolled back from the brink, and it now sits at 14 minutes from 12. If the Encryption Clock strikes midnight, we will see the FBI's crypto wet dream realized: A ban on encryption schemes that were not developed or endorsed by the government. The ban will be swift and brutal and will come without public debate. It will cover the FBI's encryption "hat trick," outlawing private encryption during all phone calls, modem communications, and even of files stored on your hard disk. [...]

1 0

Re: US law - World Law - Secret Banking
by Hal 17 Dec '03

17 Dec '03

From: Black Unicorn <unicorn(a)schloss.li> > What has consistently alarmed me is the United States trend of extending > her own moral and ethical standards world wide. Granted the United States > is the foremost world economic power, but the power to control markets and > the political power to invade the sovereignty of other states are two > distinct issues. The United States is, in one form or another, attempting > to homogonize the legal systems of the world to comply with her own > concept of what is "right" or "fair." This is disturbing. I was encouraged to read the description by former NSA lawyer Stewart Baker of Japan's attitudes towards crypto policy (from the URL posted here by wb8foz(a)nrk.com, http://www.us.net/~steptoe/276915.htm) We can all take heart in what Baker finds alarming: In the United States and Europe, encryption policy is formed by a mix of interests. Advocates of business, national security agencies, and more recently the police -- all play a large role in the policy debate. This policy triumvirate is difficult to see in Japan. For a variety of reasons, commercial interests are predominant in Japanese government thinking about encryption. Time after time during my interviews, I was reminded that Japan was an island nation that has not had to defend itself for fifty years and so has not had to confront the national security concerns associated with encryption. And Japanese police face severe political and constitutional constraints on wiretapping, so the prospect of losing this criminal investigative tool seems not to be as troubling to the Japanese government as to the United States and many European nations. [...] All in all, the emerging Japanese consensus on cryptography could pose a major challenge to U.S. (and perhaps European) government hopes of striking a compromise between commercial and governmental interests with respect to cryptographic policy. If Japan puts the weight of its government and industry behind strong, unescrowed encryption, competitive pressure will quickly doom any attempt to influence this technology through export controls and standard-making. Governments will be forced to choose between overt regulation in the Russian and French manner or laissez-faire policies of the sort that now prevail in the domestic markets of countries like the United States, Great Britain, and Germany. I love the description of the choice facing the government, between laissez-faire policies versus the kind of system prevailing in Russia. This is a remarkably clear and frank description of the policy directions which are available. Hal

3 2

Re: coderpunks not elite
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:14 PM 4/25/96, Hal wrote: >From: tcmay(a)got.net (Timothy C. May) >> Well, I was not invited to join the elite and secret coderpunks list, but I >> still have some thoughts on coding and, especially, on the opportunities >> offered by Java. > >As far as I know, the coderpunks list is neither secret nor elite. I >joined it about a month ago, andd there wasn't any problem. Just send >mail to majordomo(a)toad.com saying "subscribe coderpunks". It's just as >easy as cypherpunks. My reference was maybe a tad unfair. It was based on a reading of the hks archives of the coderpunks archives covering the December 1995 foudning. The hks archives no longer being available to me, I can't quote the specific messages, but the secretive and elite nature was discussed in the first dozen or so messages. Widespread knowledge of this list did not become available until February. My conclusion: keeping such a list secret and invitation-only for a couple of months, until L. Todd Masco let the cat out of the bag by announcing that hks was archiving it, is not a "cypherpunkish" thing to do. Having a list oriented toward code is fine, but keeping it elite and secret is a "cabal"-like thing to do. In my opinion, of course. >I do share Tim's concern about the political views of coderpunks >subscribers. Despite the "punks" in the name it seems to be somewhat >more of a mainstream group. Nevertheless I am determined to act as >though the group favors unlimited access to privacy tools by individuals >and to post under that assumption. If it comes to the point that someone >complains there may have to be some air clearing but I don't think it's >likely to come up. I don't disagree _necessarily_ about separate lists. But I think some discussion beforehand would have been nice....were any of you reading this involved in such discussions? I know I wasn't, nor was there any public list discussion that I saw. There are lots of issues we could consider about future directions for our main group, or for sublists, etc. The "by invitation only" nature of the Coderpunks list, at least before the L. Todd Masco announcement of its existence, seems like rather a harsh way of avoiding off-topic posts. It does distress me that the main list is now so bogged down in back-and-forth flames, ad nauseum. And contrary to Perry straw man assertions, I have never argued for this as a desirable thing. My main objection to Perry's objections is that he rarely posts essays or work results, preferring instead to send "perrygrams" stating his unhappiness with some topic. My preference, and I think my posts generally show it, is to avoid "timgrams" saying a topic if off-charter and simply lead by example, as it were, by writing articles and essays I think are germane. Those who don't like my choice of topics are free to delete them. But this is a different thing than saying the current banality of the list discussion is _caused_ by me, as both Perry and Detweiler seem to think is the case. Basic errors of logic covered in Logic 101. >Cypherpunks continues to have a lot of vitality. What I object to most >is the back and forth arguments people get into. I don't mind reading >one message off-topic, but to have the thread drag on for days, with >dozens of messages, is wasteful. People should just make their points >and let them stand. They shouldn't feel they have to keep coming back >and refuting the other guy. I of course agree with Hal on this. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Golden Key Campaign
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Bill Frantz writes: > At 1:11 AM 4/25/96 -0700, Bill Stewart wrote: [...why do people continue to promote the RSA method?...] > > > >Sure. Because 1) it's a good algorithm for the job, And there are other equally good algorithms which can also do the job. > >2) we've learned it, and have a PGP base behind our inertia, A pretty insignificant base actually (at least compared to the internet as a whole) and supposedly PGP 3.0 will support multiple encryption methods so maybe the RSA reliance can die the ignoble death it deserves. One point left out from the original posting is that a Rabin exchange can use a RSA public key provided that the p and q in the public key are Blum integers (which also lets you use the public key for probabalistic PKE, as well as a few other neat tricks), so changing PGP to support Rabin would not be much of an inconvenience... > >3) The legalities of RSA are well-defined, Yes, and the most well-defined point is that until September in the year 2000 you will pay an arm and both legs to use RSA. > >4) the Stanford patents mostly run out in 1997, unless Roger's suit > > succeeds first, A point in favor of non-RSA public-key methods. > >5) the price of RSA is fairly low, once free RSAREF came out You must be joking. Have you ever tried to deal with RSA lawyers? > >6) the price of licensing Cylink patents is high and/or unpredictable True, but Cylink needs to milk their patents for all they are worth for the remaining 481 days they have left. In a little more than one year they will not be left with much more than a footnote in the crypto history books. > > I will add to Bill's list: > > 7) RSA is the best known and vetted of the Public Key algorithms. Best known perhaps, but ElGamal and Rabin have also been studied in depth (in fact, Rabin is provably as secure as factoring, RSA has not been proven this secure, it is only assumed that it is.) Most public key methods fall back to only a handful of real trap-doors, so there is only a limited amount of vetting to be done (esp. when compared to symmetric encryption methods.) > Some people say that the millennium comes on Jan 1, 2000. Others say it > comes on January 1, 2001. I say it comes on September 20, 2000 when the > RSA patent expires. Nope, it starts on August 19, 1997. After that point it becomes possible to deploy systems using secure public-key crypto worldwide without needing to pay someone royalties... :) jim

1 0

Re: [NOISE] What is "laser material"?
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

>> The Washington Post, April 25, 1996, p. A12. >> >> Army officials envision the >> Nautilus would be beamed from a truck capable of firing 50 >> shots before requiring more laser material. At 09:05 PM 4/25/96 -0700, Bill Frantz wrote: > Does anyone have any idea what "more laser material" means? It is a chemically pumped laser. The lasing material is driven to population inversion by a shock wave passing through explosive material. There is a loud bang, and all the optics go to hell for a while. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

RE: Mindshare and Java
by James Childers 17 Dec '03

17 Dec '03

> > As cool as many of the people on the Java team are, though, I am dubious > > that Java is going to live up to the hype. Same here. If someone writes a secure electronic-wallet type system with Java, then I'll be impressed. Until then, all I've seen implemented is kEWL text graphics. > There was an official announcement at their Professional Developers Conference > a few weeks back. In short, full support in the browsers (and apparently MS > is now the keeper of the reference implementation on Win32) and also > a full blown Java development environment code-named 'Jakarta'. Didn't MS ditch their proprietary Java-like language? Interesting, if so...

1 0

Re: [NOISE] What is "laser material"?
by Peter Monta 17 Dec '03

17 Dec '03

> Does anyone have any idea what "more laser material" means? Well, you see, the lasing species is set in an argon matrix (yes, it's an excimer!); once the argon has evaporated, you need another rod. :-) Peter Monta pmonta(a)qualcomm.com Qualcomm, Inc./Globalstar

1 0

Mixmaster message formats
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I was thinking about how Mixmaster needs a separate message format so it can make messages a fixed size and add a packet ID. However, couldn't all this be done with PGP? With PGP, the length of the file being encrypted is encrypted itself, so it would be possible to append random data to the end of the file to make the message a fixed length like Mixmaster. Also, the packet-ID could be implemented by putting a line such as the following in the message: :: Packet-ID: foobar The only other thing that would have to be taken care of is chaining. The way I could see this working is to have a header in the encrypted message that tells the remailer whether it should de-armor the message at the next layer, append random data, then re-armor, and pass it to the next remailer. Am I missing something? - -- Mark =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= markm(a)voicenet.com | finger -l for PGP key 0xf9b22ba5 http://www.voicenet.com/~markm/ | bd24d08e3cbb53472054fa56002258d5 "The concept of normalcy is just a conspiracy of the majority" -me -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQCVAwUBMYAXxLZc+sv5siulAQG5CwP/Qbgune3sjNyB7Y8xNxNW6hCahtgBNJDk oT+hZHdlmcB6CZXjgDUSczIfAnygS71PBBysB4DJnugluMTMTGfqmgeikXdvL1zt vnwx5xlG0HQeTbVE2+c1uW4uamkdb0MZmNLR06S9M+2i0ROaWzGwNO6WEHqoEL3W qwXZ7zPtId0= =MaO4 -----END PGP SIGNATURE-----

2 1

ROC_poc
by John Young 17 Dec '03

17 Dec '03

4-25-96. WaPo: "Israelis Eye U.S. Laser As Anti-Rocket Defense. Nautilus High-Energy Laser Beam Burns Surface of Weapon." Two months ago, in a test at the White Sands Missile Range in New Mexico, the U.S. Army used the laser to shoot down two Katyusha rockets that earlier had been seized by Israel. The test caught the attention of the aerospace community because it offered evidence of Nautilus's efficacy, especially its new tracking system upgraded with more sophisticated computer software. The laser, beamed at a rocket for only a second or two, disables it by melting its surface, causing it to explode and crash to Earth. "Spy Chief's Grasp Reaches Other Pockets." The Senate intelligence committee yesterday approved a major expansion in power for the director of central intelligence (DCI) by giving the director authority not only over the CIA budget but also over all intelligence spending, most of which currently is controlled by the Pentagon. Such a radical change is likely to run into strong opposition not only from the military services themselves, but also from other congressional committees with Pentagon oversight. ROC_poc

1 0

Capability Security in Java
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 4:38 PM 4/25/96 -0700, Simon Spero wrote: >One thing that could be retroactively added to the vm pretty easily would >be the ability to add capability requirements to methods, and have the >class loader automatically generate code to check for those requirements >before executing the body of the method Now there is a statement that makes me sit up and take notice. I certainly havn't thought this subject thru carefully, but to start, I think I would like capabilities to be held by a specific object, so if I give a Java object permission to read a file, that permission is not automatically inherited by other objects, or instances of the same object which use the common method. There would also have to be a technique where capabilities could be passed from object to object to allow subcontracting. Having the capabilities held by objects means that access the objects needs to be controled as well. I notice some items on Hal's list of Java security problems which indicate weaknesses in this area, but it is not clear if they are bugs (which will be fixed) or "features". Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Welcome to cypherpunks
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Welcome to the cypherpunks mailing list! If you ever want to remove yourself from this mailing list, you can send mail to "Majordomo(a)toad.com" with the following command in the body of your email message: unsubscribe cypherpunks Cypherpunks Mailing List <cypher(a)infinity.nus.sg> Here's the general information for the list you've subscribed to, in case you don't already have it: About cypherpunks ----------------- I. Administrivia (please read, boring though it may be) The cypherpunks list is a forum for discussing personal defenses for privacy in the digital domain. It is a high volume mailing list. If you don't know how to do something, like unsubscribe, send mail to majordomo(a)toad.com and the software robot which answers that address will send you back instructions on how to do what you want. If you don't know the majordomo syntax, an empty message to this address will get you a help file, as will a command 'help' in the body. Even with all this automated help, you may still encounter problems. If you get really stuck, please feel free to contact me directly at the address I use for mailing list management: cypherpunks-owner(a)toad.com Please use this address for all mailing list management issues. Hint: if you try to unsubscribe yourself from a different account than you signed up for, it likely won't work. Log back into your old account and try again. If you no longer have access to that account, mail me at the list management address above. Also, please realize that there will be some cypherpunks messages "in transit" to you at the time you unsubscribe. If you get a response that says you are unsubscribed, but the messages keep coming, wait a day and they should stop. For other questions, my list management address is not the best place, since I don't read it every day. To reach me otherwise, send mail to eric(a)remailer.net This address is appropriate for emergencies (and wanting to get off the list is never an emergency), such as the list continuously spewing articles. Please don't send me mail to my regular mailbox asking to be removed; I'll just send you back a form letter. Do not mail to the whole list asking to be removed. It's rude. The -request address is made exactly for this purpose. To post to the whole list, send mail to cypherpunks(a)toad.com If your mail bounces repeatedly, you will be removed from the list. Nothing personal, but I have to look at all the bounce messages. There is no digest version available. There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. Mail to cypherpunks-announce-request(a)toad.com if you want to be added or removed to the announce list. All announcements also go out to the full cypherpunks list, so there is no need to subscribe to both. II. About cypherpunks The cypherpunks list is not designed for beginners, although they are welcome. If you are totally new to crypto, please get and read the crypto FAQ referenced below. This document is a good introduction, although not short. Crypto is a subtle field and a good understanding will not come without some study. Please, as a courtesy to all, do some reading to make sure that your question is not already frequently asked. There are other forums to use on the subject of cryptography. The Usenet group sci.crypt deals with technical cryptography; cypherpunks deals with technical details but slants the discussion toward their social implications. The Usenet group talk.politics.crypto, as is says, is for political theorizing, and cypherpunks gets its share of that, but cypherpunks is all pro-crypto; the debates on this list are about how to best get crypto out there. The Usenet group alt.security.pgp is a pgp-specific group, and questions about pgp as such are likely better asked there than here. Ditto for alt.security.ripem. The cypherpunks list has its very own net.loon, a fellow named L. Detweiler. The history is too long for here, but he thinks that cypherpunks are evil incarnate. If you see a densely worded rant featuring characteristic words such as "medusa", "pseudospoofing", "treachery", "poison", or "black lies", it's probably him, no matter what the From: line says. The policy is to ignore these postings. Replies have never, ever, not even once resulted in anything constructive and usually create huge flamewars on the list. Please, please, don't feed the animals. III. Resources. A. The sci.crypt FAQ anonymous ftp to rtfm.mit.edu:pub/usenet-by-group/sci.crypt The cryptography FAQ is good online intro to crypto. Very much worth reading. Last I looked, it was in ten parts. B. cypherpunks ftp site anonymous ftp to ftp.csua.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany. There is a glossary there that all new members should download and read. Also recommended for all users are Hal Finney's instructions on how to use the anonymous remailer system; the remailer sources are there for the perl-literate. C. Bruce Schneier's _Applied Cryptography_, published by Wiley This is required reading for any serious technical cypherpunk. An excellent overview of the field, it describes many of the basic algorithms and protocols with their mathematical descriptions. Some of the stuff at the edges of the scope of the book is a little incomplete, so short descriptions in here should lead to library research for the latest papers, or to the list for the current thinking. All in all, a solid and valuable book. It's even got the cypherpunks-request address. IV. Famous last words My preferred email address for list maintenance topics only is hughes(a)toad.com. All other mail, including emergency mail, should go to hughes(a)ah.com, where I read mail much more regularly. Enjoy and deploy. Eric ----------------------------------------------------------------------------- Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy. [Last updated Mon Feb 21 13:18:25 1994]

1 0

Your Majordomo request results
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Your request of Majordomo was: >>>> subscribe cypherpunks Succeeded. Your request of Majordomo was: >>>> end END OF COMMANDS

1 0

RE: Mindshare and Java
by Blake Coverett 17 Dec '03

17 Dec '03

> Yes, I had the misfortune to post that skeptical bit at precisely the same > moment that the public press releases were proving me wrong :-( [shrug] Happens to all of us. Sometimes just keeping up on press releases seems to be a full time job. > My source at the PDC indicated that Microsoft was still pushing Visual > Basic, but I'll accept that there's been a change... They are, but not exclusively. They are supporting both JavaScript and VBScript in IE3. For that sort of work I think Basic might be more appropriate anyway. (Added to the fact that they have committed to making the reference source for VBScript available online with a free for whatever you want type of license.) The spin at TechEd last week seemed to be a complete spectrum running C++ -- Java -- VB depending on the desired speed/control vs. easy of development. > Still, integrating Java and Internet browsing into the OS does not bode > well for Netscape. <CRYSTALBALL> My bet is that five years from now Netscape will be remembered as the company that forced MS to give it away for free. </CRYSTALBALL> -Blake (who's keeping all his irons in the fire anyway :-)

1 0

VENONA followup
by John Young 17 Dec '03

17 Dec '03

Last year DCI Deutch said that as part of the new "openness" for intelligence archives and as followup to the release of VENONA documents, a conference was planned on Soviet intelligence attempts to penetrate the USG in the 1940s and 1950s. (See excerpt below.) Has anyone heard more on this conference? ---------- http://www.odci.gov/cia/public_affairs/speeches/dci_speech_71195. html DCI Speech 7/11/95 DCI John M. Deutch at VENONA Press Conference [Snip] Next year we will sponsor a conference on Soviet Intelligence attempts to penetrate the United States government during the 1940s and 1950s and our efforts to counter those efforts. We hope that all scholars will attend, including Russian scholars.

1 0

Re: Golden Key Campaign
by Lou Zirko 17 Dec '03

17 Dec '03

Ok! OK! I expect to get hit for this, but maybe we could set up a graphic on our pages with the "broken Key" from the lower left corner of Netscape to commersate the RSA date. > Date: Thu, 25 Apr 1996 12:08:08 -0700 > From: Hal <hfinney(a)shell.portal.com> > To: cypherpunks(a)toad.com > Subject: Re: Golden Key Campaign > From: frantz(a)netcom.com (Bill Frantz) > > Some people say that the millennium comes on Jan 1, 2000. Others say it > > comes on January 1, 2001. I say it comes on September 20, 2000 when the > > RSA patent expires. > > It is traditional to commemorate big events with annual observances. I > say there's no reason the observances can't predate the event when it is > known in advance. > > So I propose that September 20 be known as Crypto Freedom Day, and an > annual celebration be held on that day. With each year closer to 2000 > the party gets bigger, culminating on the day that the patent actually > expires. We can all run our RSA in three lines of Java that Adam Back > will have prepared, and taste for the first time the freedom which the > rest of the world will have known for the past 17 years. > > Hal > > Lou Zirko (615)851-1057 Zystems lzirko(a)isdn.net "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzFseHQAAAEH/2gtDJSlsDvTo7m+Caj5zKuLO4dVl6L9e4xxFOAqKMtkHDIh 2z6NqqGnAKDai3eDXInBuOTGoyb82pkV7wD7naQDx7bppfwmJNguOPvlrErOZHcA NbAkyXCoKHgDxeXLq0MMcyC8+kBxYNKhMPm17g7tny4DKD+fzat4k3UiSAves6Y7 jLgQwwQ7TLYIGg7iPAsbMTnOF5iP51Ib47Ozjb3suJvJjUOTSUdl4V3e9EHWiniH G6kI1cfOdUmLXIgNZ34utTwwb2H/LhEDYrydmXJG6FfUolAThCwCbTG++Hq7/Ywr BOawFj3BhySTvpp/bSCJt1Mz/eELEq9xwQCaVD0ABRG0G0xvdSBaaXJrbyA8bHpp cmtvQGlzZG4ubmV0PokBFQMFEDFsfBcSr3HBAJpUPQEBRHoH/R+rkuMa9Vw+Civd 5QQM0tBMEPDUa7G2qNLKO0FBmVHoqq+VGeD9X2X+EBld0AwuWvshQfsViG2uBNxk Cr44y+Q0tXByCZqR8snTZG12BtFaCZv51XVieo2ygWQdmNp5DyMEyIOXUByORT2m 2Jx2VngcFt5rpzZLRALqwBDkV00Xcm8MPQzqGq8ZQA3nmExQkdpnSJIJX0irWjDM OueDrn9mBz2NwIZmddShYGUdhRXgpLYPHLMpo2fxE0dXiWkaDlyx47k4MIWaDoF4 nnTXxmEcS98AkT2PfqU4dT3UfZpZnHqkWQ7d4JqvXs9RmmH9K/NyBB+LykOvA1/t W6deAaWJAJUDBRAxbHtD30Eh39zrXZUBAYPsA/0dIEjlSuc8wrX5KJzAhXqUKBbg e3toQJk8RZwm4f80SC2DopEXYdmwAVrhOou7vezeu29mYVunKaDKg5xjnUfVR1WS ZXy54ZfYEG4Zrdi4vJgydb96AwoF3VAYyAbV45XBTfy3ujZjZRxpZS96X7iKk+6l quslrTmMFLhju4vWKw== =wksf -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: US law - World Law - Secret Banking
by Hal 17 Dec '03

17 Dec '03

Another thing Baker said in that report about Japanese crypto policy was interesting. He was talking about key escrow and how he thought the Japanese discussions about it were on the wrong track. Apparently the Japanese idea of key escrow combines it with a government Certification Authority (CA) infrastructure. You get certified keys which you will use in commerce, and these keys are escrowed. (Japan is not showing much enthusiasm for the escrow idea, to Baker's displeasure, but they are discussing it.) Baker's problem was that the keys would be used for signing as well as for encryption. He said that in the U.S. they had been careful to separate these functions in their plans. That's why we have DSS for signatures and Clipper (Capstone, Skipjack, etc.) for encryption. Only the Clipper keys get escrowed. The DSS keys are kept private. The problem with using one set of keys for both functions (as for example when RSA keys are used for both encryption and signing a la PGP) is that the escrow people can not only defeat encryption, they can forge signatures. If escrowed keys were stolen, not only would privacy be lost but also the reliability of signatures. Now at first this seems strange. Why would it be more of a problem that a broken escrow could forge signatures than break privacy? Well, from the corporate point of view it could be a lot worse. When you get a signature on a business document you want to be able to trust it. If a company can hope to get out of a commitment by saying that hackers must have broken in and stolen the keys, the value of digial signatures is much reduced. Privacy, on the other hand, at least from the point of view of someone like Baker, is not as important. His people eavesdropped all the time, and it wasn't that bad. So from his perspective it is reasonable that a possibly insecure escrow system is acceptable for encryption, but not for signatures. And that is apparently a principle behind the US crypto policies as they have unfolded over the last few years. This may shed light on the battle a few years back over whether RSA signatures would be adopted as the digital signature standard rather than the discrete log system which was finally chosen. It also suggests that the government has long realized the difficulties of keeping the escrowed key database secure. Hal

1 0