December 2003 - cypherpunks-legacy

CDA Court Challenge: Day #2
by Declan B. McCullagh 17 Dec '03

17 Dec '03

The DoJ also quizzed Donna Hoffman about anonymous remailers. They wanted to make sure that she wasn't an expert on them, had conducted no studies of remailers, and had collected no statistics on their use. -Declan ----------------------------------------------------------------------------- The CDA Challenge, Day #2 ----------------------------------------------------------------------------- By Declan McCullagh / declan(a)well.com / Redistribute freely ----------------------------------------------------------------------------- March 22, 1996 PHILADELPHIA -- At 2:21 pm today, one of the judges hearing our challenge to the Communications Decency Act finally "got it." "The folks in Luxembourg don't give a damn what our laws are. So my son, who's 10, can still view 'Sexy European Girls?'" asked U.S. District Court Judge Stewart Dalzell. "That's correct," replied Scott Bradner of Harvard University, who took the stand today to describe net.technology. Bradner told me afterwards he thought Friday's hearing went well -- he had come to Philadelphia to testify because this "is such an important issue." Judge Dalzell's remark hints that he, at least, is starting to understand the Internet -- and the consequences of the court's eventual ruling. This comes not a picosecond too soon for those of us who have been fidgeting in our seats, wincing as Department of Justice attorneys misuse technical terms and hoping the judges can sort through the cyberconfusion in just six days of hearings. Dalzell has a keen sense of humor and seems sympathetic to our arguments. In fact, I'd guess he's been doing some out-of-court web-surfing himself. In an _astounding_ question at the end of the day, he asked Bradner: "Isn't it true that the exponential and incredible growth of the Internet came about because the government kept their hands off of it?" Bradner gladly agreed. (What else would he say?) The other two judges aren't quite as reflective. In an incomprehensible decision last month, Judge Ronald Buckwalter granted us only a _partial_ restraining order preventing the Feds from enforcing the CDA. Now he's justifying his original mistake by taking a critical stance during this hearing -- that is, when he's not dozing. During one of his more alert moments, Buckwalter asked if labeling all online content is possible: "Your problems are technical and financial? If thse problems are solved and we agree on the definition of indecent, is it possible?" "Yes, it is," our witness replied. Buckwalter also asked earlier: "What do you mean by saying the Internet is a very democratic medium? Isn't there someone who steers discussion?" As proof, he held up a copy of a recent Atlantic magazine article that claimed the most popular USENET newsgroups are moderated and are therefore "quasi-authoritarian." I suggested to our attorney, Chris Hansen from the ACLU, that he clarify what percentage of newsgroups were moderated. On redirect, Hansen posed that question to Donna Hoffman of Vanderbilt University. She replied that most newsgroups are unmoderated. Later, Bradner of Harvard University added that moderated newsgroups amount to less than 10 percent of the total. Dolores Sloviter is the third judge on the panel. As the chief judge of the U.S. Third Circuit Court of Appeals, she penned a sparkling decision upholding free expression in a phone sex case. In this hearing, Sloviter's questions are the most pointed and incisive. When Robert Cronenberger of Pittsburgh's Carnegie Library was testifying, Sloviter asked him if under the CDA "would something have to be removed from your collection?" Cronenberger replied: "We don't know. We would be afraid that someone might find something indecent or patently offensive." The Department of Justice attorneys are an interesting lot. Jay Baron is a short, heavyset man who tries hard to land roundhouse punches during cross-examination but instead comes across as prone to malapropisms. I think he was the DoJer who confused <http://www.eff.org/> with <http://www.itef.org/> and "ISP" with "IP address." Before the hearing resumed for the afternoon, I introduced myself to him. He recognized me as a plaintiff and said he included one of my articles on Marty Rimm as evidence (!) and used it during depositions. <http://www.cs.cmu.edu/~declan/rimm/> Tony Coppolino is more reserved and didn't say much when we chatted, except to say that his office is busy enough with this case that they won't be sending anyone to the Computers, Freedom and Privacy conference next week. I was impressed by the poise of Patricia Rosado, the DoJ's point person on porn. Yesterday she floated the MacKinnonesque theory that porn is harmful not just to minors, but also to women. Today she greeted our witnesses with a barbed, stinging cross-examination. Unfortunately for Rosado, she was up against Cronenberger, a likable gent who came across as a traditional librarian close to the judges' own ages -- not a net.geek like Donna Hoffman and Scott Bradner. (At one point, Judge Sloviter demanded that Bradner explain URLs and linking in English, not net-ese.) The judges gladly related to Cronenberger's description of the Net as a library -- finally, something they could grasp! The ACLU's Chris Hansen expanded on this in a brilliant redirect, pointing out that the concept extends beyond that of a traditional library, allowing a user to link "from the fourth floor of Wiedner Library in Boston to the third floor of the Carnegie Mellon University library in Pittsburgh." Rosado from the DoJ rallied with questions like: DoJ: "You can do a keyword search on the seven dirty words?" DoJ: "Would a search on Abraham Lincoln turn up articles about sex?" R.C.: "I've read many articles about his sex life, or lack of sex life. DoJ: "Would a search on travel turn up articles about sex?" DoJ: "Would a search on geology turn up articles about sex?" R.C. "Only if rock is put together with roll!" <laughter>) DoJ: "Would a search on food turn up articles about sex?" DoJ: "You exercise discretion as to what you make available. You don't carry everything, do you?" DoJ: "You select materials that reflect the local community standards?" Not surprisingly, the DoJ is trying to keep the hearing focused on porn and sex. (At least it keeps Buckwalter awake!) Not the truly extreme stuff that obscenity laws already ban online, but the softcore Playboy-style cyberpix that would be permitted in the absence of the CDA. The Justice Department asked Vanderbilt's Hoffman: DoJ: "You stated in your deposition that you were generally familiar with the web page called Bianca's Smut Shack?" Judge Dalzell immediately looked up, startled: "Bianca's WHAT?" DoJ: "Bianca's SMUT Shack." Judge Dalzell: "Oh, okay." Other DoJ questions included a passing reference to would-be cyberporn researcher Marty Rimm, who claimed that pornographers were using the Net to recruit customers. (Last month, the DoJ attached Rimm's study as an exhibit in their response to our complaint and cited it as evidence of the pervasiveness of nasty stuff on USENET.) Some examples: DoJ: "You will concede, will you not, that this law will not have a profound adverse effect [on password-protected smutty sites]?" DoJ: "Pornographers are using USENET newsgroups to advertise, are they not?" DoJ: "Tell us about bots and spiders." Judge Dalzell, trying hard: "That's an acronym, right?" My fellow plaintiffs are wonderful. Kiyoshi Kuromiya testified the first day, followed by Patricia Nell Warren. Warren and I had dinner on Thursday with Jonathan Wallace of the Ethical Spectacle; we talked about the political and social forces behind the push for the CDA. I asked Wallace why he came down from New York City -- he told me because "this is the most important free speech case in 60 years." Today I sat next to the DoJ's net.experts, who kept leaning forward to whisper technical data into the ears of the Justice Department's attorneys. One of the two experts was from Brigham Young University. The other was Steve Nesbitt from the Department of Defense. One or both likely will be testifying as expert witnesses for the DoJ, but Justice isn't releasing the list until April 3. Stay tuned for more reports. ----------------------------------------------------------------------------- We're back in court on 4/1, 4/12, 4/15, and 4/26. The DoJ will be taking depositions from our remaining witnesses the week of March 24. For more information and breaking updates, check out: http://fight-censorship.dementia.org/top/ To subscribe to the fight-censorship announcement list, send email with "subscribe fight-censorship-announce" in the body to: majordomo(a)sojourn.com Other relevant web sites: http://www.eff.org/ http://www.cs.cmu.edu/~declan/rimm/ http://www.cdt.org/ http://www.aclu.org/ -----------------------------------------------------------------------------

1 0

Re: DAZ_zle
by jim bell 17 Dec '03

17 Dec '03

At 10:53 PM 3/21/96 -0500, John Young wrote: > Foreign Affairs, March/April, 1996, features two policy > essays on "The Information Edge: A technological change is > transforming the nature of power and the United States is > clearly in the lead." [deleted] > He observes that misunderstanding of > revolutionary technology all too often has had unexpected, > disastrous, consequences: "A revolution in military affairs > is under way. It will require changes of a magnitude that > military people still do not completely grasp and political > leaders do not fully imagine." Sounds like this guy has been reading my stuff.

1 0

e$'s (mini-rant)
by Gary Lee Jeffers 17 Dec '03

17 Dec '03

e$'s (mini-rant) I have some thoughts on John Humphrey's post. I thought the big problem with E$ was with the clearing house. Is it the consensus that it is the e$ patents? If the problem is that the inventors are sitting on their patents, then why can't we just RIP THEM OFF$ When the patent system was started in the U.S., it was done for the population in order to stimulate the invention process and so improve the lot of the people. Invention is a SPECIAL kind of production. It is not normal mass property! Patents are only property because it is considered that they are of value to the people rather than the owners! Patents pro- cess was started to give property to patent "owners" in order to persuade the inventors to invent for the people. If an inventor "SITS ON A PATENT", then it is ABUSE OF PATENT! Fuck the patent owner! Fuck him with bells on! RIP HIM OFF! its a noble cause! If this has become a serious problem then finding techniques of riping off e$ patent owners is a moral and practical undertaking. Then it should be a topic of Cypherpunks. I am not sure that hoarding of patents is the main hinderance of useful e$. What do other Cypherpunks say? patents? workable e$ schemes! clearing- houses? P.S. Maybe doing private Internet business while hiding from the owner of the e$ patent will be a new privacy concern :-) P.P.S. Thoughts for a rip-off technique. Take a good private e$ tech., restate it in different terms, throw in a few changes, options, extras so it doesn't look so much like the original. Then offer it to the public with a variety of very low cost deals - especially for start-ups. By the time the original inventor gets you into court, you'll have a ton of money he'll have nothing and with our system of "justice" you can bury him. :-) Even if he "wins" - with your privacy skills you can take it with you and hide it - talk to Duncan Frissell. Note: You'll have the money to talk to Duncan, the original inventor won't. :-) P.P.P.S Why not just take the best features of several private e$ tech.s and make a hybrid? It wouldn't even be plaguerism! (sorry, I lost my dict- ionary). Central power is stolen freedom. THE UNITED STATES "FEDERAL" GOVERNMENT HAS NO LEGITIMACY. The United States "Federal" Government - We'll be even more American without it. PUSH EM BACK! PUSH EM BACK! WWWAAAYYYY BBBAAACCCCK! BBBEEEAAATTTT STATE! Gary Jeffers

1 0

Re: e$'s (mini-rant)
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:00 AM 3/24/96 -0600, Gary Lee Jeffers <gjeffers(a)ns.htc.net> wrote: > e$'s (mini-rant) > I have some thoughts on John Humphrey's post. I thought the big problem >with E$ was with the clearing house. Is it the consensus that it is the e$ >patents? If the problem is that the inventors are sitting on their >patents, then why can't we just RIP THEM OFF$ Yes, it's the patents. Chaum owns them, and he's not Easy To Do Business With. On the other hand, a couple of banks _have_ recently started doing business with him - Mark Twain Bank in St. Louis, and Merita Bank in Finland - check the cypherpunks archives (www.hks.net / nntp.hks.net) for details. There were a couple of earlier attempts, in which one group discovered that there are an appalling number of banking laws which make it hard to get a real bank started, and another group discovered that it's much easier to be a Credit Union than a Bank under US banking law, but it's still hard to get a business model that's likely to make non-negative amounts of money that way. The reason you can't just rip them off (unlike, say, PGP's early relationships with RSADSI/PKP) is that electronic commerce can only work well if it's legitimate - if you want real businesses to deal with you, and real banks to handle money for you, they need to be assured that they won't lose their assets in a patent lawsuit. On the other hand, Doug Barnes posted some interesting articles on "agnostic banking", a variant on Chaum's digicash where the bank can run simpler digital cash protocols that don't violate Chaum's patent, but the bank can't tell whether the customer is using Chaum's blinded signatures or not, so the customer can rip off Chaum's intellectual property without the bank having to be knowledgeable or involved (nudge, nudge, wink, wink.) On a non-financial level, Chaum didn't complain about the Magic Money / Tacky Tokens demos that some of the cypherpunks did, and Digicash came out with a play-money version that some of us used before the commercial deal was done. > [patent rant] Yeah, yeah, many of us can rant against patents as well. Been there, done that, even invented stuff and found somebody else had previously invented and patented it. The League for Programming Freedom has some high-quality detailed patent rants, and if you give RMS a grant for airfare he'd probably be happy to go picket Chaum's company for you :-) As far as Chaum hoarding the patents, he's always been willing to deal, but since he's mostly an academic rather than a businessman, he's set a very high up-front price so little guys don't bother him, only mega-banks that will come now that he built it. I'd guess the prices the banks he's now dealing with paid are rather lower than that, but it's a start for getting real business to evolve. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

Re: (X:x)e$ 's other use
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:31 PM 3/23/96 -0800, Bill Stewart wrote: >Method 3 you'll recognize. There'd be nothing wrong with the Federal >Reserve if they only used methods 1 and 2; individual consumers can >decide whether to trust them not to print a lot more zeros than they should. >And they don't have a monopoly on currency - there are some kinds of >taxes that apply to some private currencies, but you can go into the >average bank today, ask them to write a cashier's check to someone >(and probably still to "bearer"), pay them, and they'll be happy to do it >for only a small commission, and American Express will do it as well. >And people will take their paper, though in the case of traveller's checks >it's sometimes a hassle to accept on an occasional basis. My experience in China in 1993 was that US Federal Reserve Notes were easy to use and American Express Traveler's checks were not. After hearing that the dollar isn't worth anything, it was refreshing to go to a country where they are in high demand. I recommend carrying good old fashioned USA dollars when going to communist countries. Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Crypto CD
by Ben Holiday 17 Dec '03

17 Dec '03

I'm considering the idea of cutting a crypto CD, and wanted to see if there was any potential interest in the idea, or not. Basically what i forsee is a disk with the basic algorithms (DES/IDEA/Etc), and steg tools, along with a few large crypto aps like PGP, and basic cracking software (Crypt Breakers Work Bench, XOR-type crackers, and dictionary attacks with a few dozen dictionaries). I'd also like to include a remail directory with some remailer sources, remailer-aware clients, and the mixmaster sources. And of course as much infomation as possible -- cyphernomicon preferably, possibly even archives of this list.. I would plan to put unix/dos/mac all on one CD. I'm thinking that realistically I can expect 50 megs or so. Possibly as much as 100 if I find a TON of wonderful text. Could be useful to individuals, as well as for groups wishing to create FTP sites etc. Pricing with shipping would wind up around US$20.00, give or take 5 dollars.. I'd like to know first off whether such a thing already exists. Secondly whether anyone would be interested in possesing such a thing. And lastly any suggestions for/about content that I may have missed.. Thanks Benji

2 1

Re: protection on IoMega ZIP drives
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 2:45 3/23/96, Alan Olsen wrote: >The big problem is with the zip drivers. There is some sort of >incompatibility between SFS and the zip drivers. (I hacked on it for a >couple of hours with no luck.) Win95 makes the problem worse, as it is >difficult to judge just when the driver for the zip drive loads. (I have a >number of complaints about the zip drive drivers. Lack of documentation is >one of them...) I can state that with a Zip Disk formatted for Macintosh use (and the drive plugged into a Macintosh), the drive and disk are seen by the Macintosh as a NORMAL SCSI HD and eligible for use as a Boot Drive (ie: There is a Mac Driver on the Disk in a SCSI Driver Partition). I've Booted from a ZIP Disk so this is actual not just theoretical <g>. I'd assume that if a Wintel Machine had the Microcode to be able to boot off an external SCSI Drive (something I do not know is normal for Wintel machines as it is normal for Macintosh ones) the same situation would exist for Wintel Zip Formatted Disks. All NORMAL SCSI HDs (or Cartridges) have their driver in a Driver Partition so the HD/Cartridge can be read.

1 0

private key encryption program for you to hack at
by Jack Mott 17 Dec '03

17 Dec '03

Ok, I have been working on this for a while, and I wanted to let you guys have a go at it. I wrote a private key encryption program that I think should be hard to break, I will provide you with the EXE (MS DOS) file, some ciphertext, AND a big chunk of plaintext. The key is not ridiculously large, but it won't be anything obvious so don't bother brute forcing. To encrypt, the program read in some system/time specific info, uses it to encrypt the file along with the key. It then write the system/time specific info to the end of the file encrypted with the key. I THINK that the only weaknesses should be predicitability of the system/time info, or possibly finding patterns in the encrypted values. I dont want to give out any source code yet, but it anyone wants some pieces of it just ask. crackme.zip file with paradox.exe, cipher.txt, and plain.txt -- ___ ___ _____ / \/ \ / \ || | || | || | ||he \_____/row thecrow(a)iconn.net "It can't rain all the time"

3 2

Re: New Beta Test of PGPfone available WINDOWS '95 Included!
by jis＠mit.edu 17 Dec '03

17 Dec '03

(A copy of this message has also been posted to the following newsgroups: alt.security.pgp, sci.crypt) -----BEGIN PGP SIGNED MESSAGE----- I have received reports that some people are getting only partial files when downloading PGP and PGPfone with our new distribution server. This problem is caused by higher then normal packet loss on the Internet. Some browsers (notably the AOL browser) give up when they fail to receive any more data for a period of time (caused by high losses or other conditions that block our server). For now people should continue to attempt to download PGPfone and PGP until they get a good copy. Trying late at or on weekends when the net load is lower may help. I am working on a "fix" where our server will let the browser know up front (there is a way to do that with http) how large an item to expect. This hopefully will improve the situation, if not complete fix it. However this change will not be installed until at least Tuesday. So if you can wait, you might want to wait until Tuesday if you are having difficulties getting a complete distribution from MIT. Note: I will send out another message when this fix is in place. -Jeff -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMVVrMMUtR20Nv5BtAQEQ3gP/XjwEPbqSJXJesRYo+N4aAcMfl3O2PGoP LP/uGOOLCyx05EXkJidGly4IjY/qK325J8xDADCpJdoJgcM3CH+7EPghxAEmCIRd MttmADDv6U3QHnvPn7/L2mDtItueOCLsdeWtj7bQnRECoS/XsdQAUgZFbLlWsNhd uFm3bVG82LI= =m3v8 -----END PGP SIGNATURE-----

1 0

Re: Crypto CD
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

> Could be useful to individuals, as well as for groups wishing to create > FTP sites etc. Excellent Idea. At least I haven't seen one around. > Pricing with shipping would wind up around US$20.00, give or take 5 dollars.. > I'd like to know first off whether such a thing already exists. Secondly > whether anyone would be interested in possesing such a thing. And lastly > any suggestions for/about content that I may have missed.. How about PGP key archives? Vipul .od8888bo. \|/ .d%::::88::888b. (@ @) .d888::::::::8:888%. ------------------oOO-(_)-OOo----------------- 88888:::::::88888::%. You walk across with your flowers in your hand d888888:::88;888888::b Trying to tell me no one understands 888888888:888888888888 Trade in your hours for a hand full of dimes Y8888888::::::888888%P Gonna make it baby in our prime. '8888888:::::::8888:%' ---------------------------------------------- '88888888:::888888%' Vipul Ved Prakash Fax : +91-11-3328849 '8888888::88888%' Positive Ideas. Internet : vipul(a)pobox.com '"Y88%B8P"' ---------------------------------------------- PGP Key : Finger <vipul(a)pobox.com> PGP Key fingerprint = 35 FF A2 CA BD 6B 80 82 61 30 F2 23 96 93 77 E4 ~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=~-=

1 0

RE: If you can't take the heat... (Was Re: Keep the pressure!)
by blanc 17 Dec '03

17 Dec '03

From: Timothy C. May And I think the anonymity issue is interesting. In the past, Detweiler railed against the uses of anonymity while himself being the single most prolific user of anonymous insults and the like, so it's an interesting pathology to study. ....................................................................................... Just wanted to mention that the reason Detweiler used anonymity was as a counter-example of why he opposed the use of it. He wanted to impress upon the cpunks the points he was making against anonymity by using it in the ways which he warned could become a problem. As he said in his recent post "detweiling", he aimed his efforts against those whom he considered the "big egos" - i.e., the ones who disagreed with him on his prognosis for the future. .. Blanc

1 0

Re: protection on IoMega ZIP drives
by Alan Olsen 17 Dec '03

17 Dec '03

At 02:47 AM 3/24/96 -0500, Robert A. Rosenberg wrote: >At 2:45 3/23/96, Alan Olsen wrote: > >>The big problem is with the zip drivers. There is some sort of >>incompatibility between SFS and the zip drivers. [snip] >I can state that with a Zip Disk formatted for Macintosh use (and the drive >plugged into a Macintosh), the drive and disk are seen by the Macintosh as >a NORMAL SCSI HD and eligible for use as a Boot Drive (ie: There is a Mac >Driver on the Disk in a SCSI Driver Partition). I've Booted from a ZIP Disk >so this is actual not just theoretical <g>. I'd assume that if a Wintel >Machine had the Microcode to be able to boot off an external SCSI Drive >(something I do not know is normal for Wintel machines as it is normal for >Macintosh ones) the same situation would exist for Wintel Zip Formatted >Disks. All NORMAL SCSI HDs (or Cartridges) have their driver in a Driver >Partition so the HD/Cartridge can be read. The SCSI Zip drives do act as normal SCSI drives (though they have a limited number of SCSI ids available. (5 & 6 if I remember correctly.) Later drives may have this changed.) The problems i am encountering are due to the _parellel_ version of the Zip drive. (I bought it because I needed to be able to visit customer sites and not all of them have SCSI.) The drivers fake a scsi port. (Some laptops use a similar driver to attach hard drives to non-scsi systems.) Maybe I will just get a Jaz drive and not worry about it... --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

Re: Crypto CD
by Alan Olsen 17 Dec '03

17 Dec '03

At 01:52 AM 3/24/96 -0500, Ben Holiday wrote: >I would plan to put unix/dos/mac all on one CD. I'm thinking that >realistically I can expect 50 megs or so. Possibly as much as 100 if I >find a TON of wonderful text. If you include the archives of this list, the main forign archives, and the various sources in the US, you will EASILY exceed 100 megs. (More like 200.) If you seperate out all the duplications, you might squeeze under the 100 megs mark. >Could be useful to individuals, as well as for groups wishing to create >FTP sites etc. It would be a nice thing to have if it is reletivly complete. Hopefully it can be created with a minimum of government interfearence. (But then, I have been xpecting alt.binaries.crypto to be created as well...) >Pricing with shipping would wind up around US$20.00, give or take 5 dollars.. Sounds about right. You will probibly need to run about 1000 or so. Actually, the prices for CDs in bulk are pretty cheap. (Just expensive up front.) Depends how much premastering you are able to do up front. (If you need information and/or contacts to get mastering done, send me private e-mail. I used to work for a CD-ROM company.) >I'd like to know first off whether such a thing already exists. Not that I know of... I have seen a few of the "Hacker" discs with crypto code on it, but nothing complex (other than ancient versions of PGP) and you have to wade though alot of crap to get to it. >Secondly >whether anyone would be interested in possesing such a thing. And lastly >any suggestions for/about content that I may have missed.. Archives of the PGP key database, the archive at hacktic.nl, ftp.dsi.unimi.it, ftp.informatik.uni-hamburg.de, and probibly a few other archives would be useful. An index/search engine would also be helpful. --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

2 1

Re: Free speech debate on MSN Encarta
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

At 8:57 PM 3/23/96, Mark M. wrote: On Sat, 23 Mar 1996, I wrote: >> However, I don't think it likely that many ISPs will go this route from a >> liability point of view - if some parent is paying them to filter out smut, >> and little Zippy finds a brand new x-rated site, chances are some irate >> parent will sue them. With the proliferation of new pages, it is >> impossible for anyone to keep up, unless the authors voluntarily include >> some smutscan codes in their pages. > >Couldn't the proxy be configured to deny access to all "unrated" pages? Yes. The same filter software that Exonizes the language could also replace the whole html body with "Access Denied" if the ratings codes aren't present. >Of course, this would mean that some kind of standardized web page rating >system be devised; however, I think there are already several proposals for >rating schemes. BTW, does anyone know how such a proxy system could be >used in all Internet traffic, not just the web. It is not very difficult >to get a gopher client or telnet client to communicate with a web server, >bypassing any access restrictions. CERN will already proxy gopher & ftp as well as http. There is another package, delegate, that will proxy nntp & telnet. However, the main problem with using proxies as a censorship tool is that nothing prevents the client software from just not using the proxy. By the time Zippy is old enough to care about hunting down smut/bomb designs/drug formulae, Zippy is a lot more likely to know how to do this than the parental units, in a manner undetectable by the parent (invisible System Folder/Windows directories with unsanitized browser prefs files comes immediately to mind - now that 1GB drives are common, it isn't too difficult to hide them) >ObCrypto: The next step would be a rating system using digital signatures >and the proxy software being setup to trust certain signatures more than >others. I agree, if you're going to bother with rating pages, digitally signing the signature so that terrorist X can't just copy the "Good Clean Fun" rating code into his Phosgene formula page is the only rational solution. Gotta love that overhead, though. Joseph Block <jpb(a)miamisci.org> "We can't be so fixated on our desire to preserve the rights of ordinary Americans ..." -- Bill Clinton (USA TODAY, 11 March 1993, page 2A) PGP 2048bit-Fingerprint: F8 A2 A5 15 56 42 9B 16 3F BD 57 0F 8A ED E3 21 No man's life, liberty or property are safe while the legislature is in session.

1 0

Re: protection on IoMega ZIP drives
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:55 PM 3/24/96 -0800, Alan Olsen <alano(a)teleport.com> wrote: >The SCSI Zip drives do act as normal SCSI drives (though they have a limited >number of SCSI ids available. (5 & 6 if I remember correctly.) Later drives >may have this changed.) >The problems i am encountering are due to the _parellel_ version of the Zip >drive. (I bought it because I needed to be able to visit customer sites and >not all of them have SCSI.) The drivers fake a scsi port. (Some laptops >use a similar driver to attach hard drives to non-scsi systems.) Hmmm - I've got the Syquest parallel-port drive. Syquest offers SCSI and IDE flavors of their drive - and the parallel port version emulates IDE (don't know if it's EIDE or vanilla IDE...) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

apology - here is C source code
by Jack Mott 17 Dec '03

17 Dec '03

I apologize to everyone for the binary posting, I figured it was small enough to not cause problems. Here is the source. I do not claim to be either a good programer, or any good at cryptography. I am a junior in high school and I am interested in it, and I think I have some good ideas here. The code may be kinda hellish, any CONSTRUCTIVE criticism would be appreciated. I have been programming about a year. I can assure you though, this isn't some stupid XOR encryption...at least it is better than WordPerfect ecryption (I hope to god :) I originally wrote this in Pascal, and ported it to Turbo C++, I think the only C++ in it is the comments and inline declarations, might want to double check though. I think the only non-portable code is the gotoXY statements, and the random function works differently under GCC if I remember correctly (I have had Linux for a little while) Oh yeah, I kinda stretched the definition of HASH in my code a lot... here goes. --------------- // encryption program - constructive flames appreciated // ***************************INCLUDES************************************ #include <stdio.h> #include <sys\stat.h> // <-- dont need this in Unix #include <fcntl.h> #include <io.h> #include <math.h> #include <conio.h> #include <stdlib.h> #include <string.h> #define BLOCK 16384 #define HASHSIZE 256 // ***************************PROTOTYPES************************************ void input(void); // Input KEY, FILENAMES, etc. void openfiles(void); // Open files void closefiles(void); // Close em void encrypt(void); // Encrypt file void decrypt(void); void superhash(void); // Time/System/File/Specifics void initblocks(void); void grabhash(void); // Grabs encrypted hash value from file void CopyBack(void); // ***************************VAR***************************************** char key[80]; char ifn[12]; char ed[1]; int infile,outfile,backfile; int x,y; int i; float Havg,Kavg,BKHavg; char SuperHash[HASHSIZE],ESuperHash[HASHSIZE]; char BSH[BLOCK],KEY[BLOCK]; //**************************************************************************// // Main Program // //**************************************************************************// main(int argc,char* argv[]) { randomize(); if (argc < 4) { input(); } else { strcpy(ifn,argv[1]); strcpy(ed,argv[2]); strcpy(key,argv[3]); } openfiles(); if (ed[0] == (('e') | ('E')) ) { superhash(); initblocks(); encrypt(); } else if (ed[0] == (('d') | ('D')) ) { grabhash(); initblocks(); decrypt(); CopyBack(); } else printf("%s was not an option",ed[0]); closefiles(); } //**************************************************************************// // input() Takes in all inputs // //**************************************************************************// void input() { char vkey[80]; char c; for (i = 0; i < 80; i++) { key[i] = ''; vkey[i] = ''; } printf("\nEnter Filename:"); gets(ifn); printf("(E)ncrypt or (D)ecrypt?:"); gets(ed); printf("Enter Key:"); i = 0; int startx = wherex(); do { if (kbhit()) { c = getch(); if (c == 8) { if (wherex() != startx) { key[i] = ''; i -= 1; key[i] = ''; gotoxy(wherex()-1,wherey()); printf(" "); gotoxy(wherex()-1,wherey()); } } else { if (c != 13) { key[i] = c; i++; printf("þ"); } else break; } } } while (c != 13); flushall(); printf("\nVerify key:"); startx = wherex(); i = 0; c = 0; do { if (kbhit()) { c = getch(); if (c == 8) { if (wherex() != startx) { vkey[i] = ''; i -= 1; vkey[i] = ''; gotoxy(wherex()-1,wherey()); printf(" "); gotoxy(wherex()-1,wherey()); } } else { if (c != 13) { vkey[i] = c; i++; printf("þ"); } else break; } } } while (c != 13); if (strcmp(key,vkey) != 0) { printf("\nKeys were not the same. They need to be"); exit(EXIT_SUCCESS); } if (strlen(key) <= 0) { printf("\nThe key was blank, it needs to have some characters."); exit(EXIT_SUCCESS); } printf("\n"); } //**************************************************************************// // openfiles(void) -- Opens all files // //**************************************************************************// void openfiles(void) { infile = open(ifn,O_BINARY | O_RDONLY); if (ed[0] == (('e') | ('E')) ) { outfile = open(ifn,O_BINARY | O_WRONLY); } else { chmod("KRYPT000.TMP",S_IWRITE); unlink("KRYPT000.TMP"); outfile = open("KRYPT000.TMP", O_BINARY | O_RDWR | O_CREAT | O_TRUNC | S_IWRITE); } } //**************************************************************************// // Closes All Files // //**************************************************************************// void closefiles(void) { if (ed[0] == (('e') | ('E')) ) { close(outfile); close(infile); } else { close(backfile); close(infile); } } //**************************************************************************// // Main Encryption Routine // //**************************************************************************// void encrypt(void) { char buf[BLOCK]; float blocks = 0; long sizeoffile = filelength(infile); long numread; long maxblocks = sizeoffile / BLOCK; if (maxblocks == 0) maxblocks = 1; printf("\nEncrypting:"); x = wherex(); while ((numread = read(infile,buf,BLOCK)) > 0 ) { BKHavg = (blocks * Kavg) + Havg; for(i = 0; i < numread; i++) { buf[i] = buf[i] + floor(9845845*cos((KEY[i]+ BSH[i]) * (i+BKHavg))); } gotoxy(x,wherey()); int pd = floor(blocks/maxblocks*100 + 1); printf("%d%",pd); write(outfile,buf,numread); blocks++; } gotoxy(x,wherey()); printf("100%"); write(outfile,ESuperHash,HASHSIZE); } //**************************************************************************// // Copy Back For Decryption // //**************************************************************************// void CopyBack(void) { backfile = open(ifn,O_BINARY | O_WRONLY | O_TRUNC); char buf[BLOCK]; long pos; long size = filelength(outfile) - HASHSIZE; long blocks = 0; int numread; long maxblocks = size / BLOCK; if (maxblocks == 0) maxblocks = 1; printf("\nRemoving encryption block:"); x = wherex(); lseek(outfile, 0L, SEEK_SET); do { numread = read(outfile,buf,BLOCK); pos = tell(outfile); if (pos > size) { write(backfile, buf,numread - (pos - size)); break; } else { write(backfile, buf, numread); } blocks = blocks+1; gotoxy(x,y); int pd = floor(blocks/maxblocks*100 + 1); printf("%d% ",pd); } while (pos != size); close(outfile); chmod("KRYPT000.TMP",S_IWRITE); unlink("KRYPT000.TMP"); } //**************************************************************************// // Main Decryption Routine // //**************************************************************************// void decrypt(void) { char buf[BLOCK]; float blocks = 0; long sizeoffile = filelength(infile); long numread; long maxblocks = sizeoffile / BLOCK; if (maxblocks == 0) maxblocks = 1; printf("\nDecrypting:"); x = wherex(); while ((numread = read(infile,buf,BLOCK)) > 0 ) { BKHavg = (blocks * Kavg) + Havg; for(i = 0; i < numread; i++) { buf[i] = buf[i] - floor(9845845*cos((KEY[i]+ BSH[i])*(i+BKHavg))); } gotoxy(x,wherey()); int pd = floor(blocks/maxblocks*100 + 1); printf("%d%",pd); write(outfile,buf,numread); blocks++; } gotoxy(x,wherey()); printf("100%"); } //**************************************************************************// // SuperHash Procedure // // // // the idea here is to get a block of totally unpredictable bytes, // // if anyone has any 'true random number generators' stick em here // // this just pulls in HASHSIZE bytes from random positions from the file, // // the idea being that they would have to know what the whole file was // // in the first place to guess these values // // // //**************************************************************************// void superhash(void) { printf("Generating System/Time/File specific SuperHash:"); x = wherex(); long MaxPos = filelength(infile) - 1; char hbuf; int keylen = strlen(key); Havg = 0; for (i = 0; i < HASHSIZE; i++) { long SeekValue = ((93617583 * random(32000)) * key[i % keylen]) % MaxPos; if (SeekValue < 0) SeekValue *= -1; lseek(infile,SeekValue, SEEK_SET); read(infile,&hbuf,1); SuperHash[i] = floor(923723723 * cos(random(256) * hbuf * key[i % keylen])); ESuperHash[i] = SuperHash[i] + floor(989898989 * sin(key[i % keylen])+i); Havg = Havg + SuperHash[i]; printf("%d ",random(256)); gotoxy(x, wherey()); } if ((key[SuperHash[5] % keylen] + (key[SuperHash[3] % keylen] / 10)) != 0) { Havg = Havg / (key[SuperHash[5] % keylen] + (key[SuperHash[3] % keylen] / 1000)); } else { Havg = Havg / 7.2; } lseek(infile, 0L, SEEK_SET); } //**************************************************************************// //grabhash() Grab ESuperHash from file // //**************************************************************************// void grabhash() { printf("Grabbing SuperHash Values..."); long sizeoffile = filelength(infile); int keylen = strlen(key); lseek(infile,sizeoffile - HASHSIZE,SEEK_SET); read(infile,ESuperHash,HASHSIZE); Havg = 0; for (i = 0; i < HASHSIZE; i++) { SuperHash[i] = ESuperHash[i] - floor(989898989 * sin(key[i % keylen])+i); Havg = Havg + SuperHash[i]; } Havg = Havg / key[SuperHash[5] % keylen]; lseek(infile, 0L, SEEK_SET); } //**************************************************************************// //initblocks() Dumps small hash arrays into big BLOCK arrays // //**************************************************************************// void initblocks(void) { long total = 0; int keylen = strlen(key); for (i = 0; i < keylen; i++) { total += key[i]; } Kavg = total / keylen + total; for (i = 0; i < BLOCK; i++) { KEY[i] = key[i % keylen]; BSH[i] = SuperHash[i % HASHSIZE]; } } ---------- seeya - thanks -- thecrow(a)iconn.net "It can't rain all the time"

1 0

The Crow meets the Troll...
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 4:23 PM 3/24/96, Larry Detweiler wrote: > Look, newbie, <troll> Heees Baaack! My guess is that Jim Bell's assassination server has gone up, and Detweiler's psychopharmacologist was the first hit on the list... Of course, given the quality of the post Larry's responding to, Mr. Mott may be a "tentacle" of Detweiler himself. ;-) Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: apology - here is C source code
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 6:00 PM 3/24/96, Jack Mott wrote: > I apologize to everyone for the binary posting, I figured it was small > enough to not cause problems. Here is the source.... <snip> I am a junior in high school ... <snip> > --------------- > // encryption program - constructive flames appreciated <snip> Looks like I spoke too soon about the "tentacle" thing. My apologies. Welcome, Mr. Mott. I have no idea of the quality of your code, but you *do* write code, which is a *good* thing around here (at least until the "coderpunks" flap). You should be aware, however, that even though there are many active cryptographers on this list, most of whom *do* write code, that people probably won't fall over themselves to look at your first effort. As people say, "cryptography is hard". It's a science. As such, it takes a long time to get to the point where you're actually improving the state of the art. Don't let that stop you from coding new stuff. Far from it. Especially if you're coding strong cryptographic software based on algorithms of proven reputation. Lord knows, there are lots of potentially good algorithms out there that need implementation. My suggestion is that you put out a request for correspondence so that people could talk to you about your new work privately, in e-mail. That's because this list periodically gets unsolicited code like yours, and most of it isn't worth the time to read, much less do a proper vetting. So it tends to get trashed upon receipt. Getting together with a bunch of people in your own shoes may be the best way to start, and I'm sure there are one or two others on this list who are plinking around implementing stuff just to see what it looks like. Nonetheless, the trick, it seems to me, (and I'm a poor person to ask, because I couldn't code my way out of a paper bag) is to keep plugging away at stuff like your application, because cryptography is the principal technology of internet commerce, among other things. You also might want to look at the cypherpunks archives, read Tim May's "cyphernomicon" FAQ, and read some good crypto books, not the least of which is "Applied Cryptography" by Bruce Schneier. If you've done all of that, and have written your code afterwards, then you probably have made a nice start. If you haven't looked at the above resouces, you might want to, and check your new code in light of that new information, and give yourself a head start on what others might say. If they looked at your code, I mean. ;-). Anyway, welcome to cypherpunks. It's great to have someone of the next generation on board! Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

LIST OF SHAME VOLUNTEERS
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, As promised, below is the list of folks who have asked to be put on Mr/Ms Anonymous' LIST OF SHAME. In addition, I am including one volunteer who supports Mr/Ms Anonymous...sort of. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ LIST OF SHAME VOLUNTEERS Dan Harmon Jim Ray Robby Havasy Perry Metzger (didn't volunteer, exactly, but wrote: "Perry, Who is disappointed that he didn't make the "LIST OF SHAME", but understands that perhaps he hasn't done enough to oppose controls on cryptography. I'll work harder, and hopefully you will denounce me soon." Damaged Justice <frogfarm(a)yakko.cs.wmich.edu> brianh(a)u163.wi.vp.com Rich Graves Brad Shantz Kevin L Prigge Jim Gillogly Robert Hettinga David Macfarlane Brad Shantz Mark Aldrich Charles Gimon Jamie Lawrence Doug Hughes David K. Merriman Lucky Green Raph Levien Bill Frantz Paul E Robichaux Glenn Powers Brian D Williams "Vladimir Z. Nuri" !!!!! SUPPORTERS OF MR/MS ANONYMOUS E. Clark, who wrote: Subject: A vote for ANON's position [with reservations] Supporters of the Leahy Bill are, to me, well-intentioned dupes. I've lurked on this list under this and a previous usename since the list was a couple months old. I came here to learn crypto, not debate politics. And, while the urge has often been all but overwhelming, I've for most part kept my silence, prefering back channels to posting on the list. The Politics of the Absurd has in the last year or three found me in agreement with figures on the national scene whose pockets I would decline to piss were their balls on fire. Nor am I quite comfy siding with anonymous in regard to the Leahy Bill, but... I neither like nor trust the bill and, after the Digital Telephony Bill and its manner of passage, my trust in the good senator is zero. I am still a little puzzled why there was so little discussion on the list of what Freeh might have told the congresscritters that long summer when he seems to have visited them all. Sort of makes this leftie wonder if, just maybe, the rightwing conspiracy boys who claim the unusual number of congressional dropouts was the result of FINCIN findings might not have stumbled upon a quarter-grain of truth. While I applaud the efforts of those working for the cause in the political sphere, I have scant faith. Business will be on the side of privacy until it gets what it wants, then walk away from individual concerns for privacy, etc. I've always enjoyed your posts and sense of humor. Apologies for going on at length. e. clark --- Comments, Anonymous?

8 15

Re: protection on IoMega ZIP drives
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Death rays from Mars made alano(a)teleport.com (Alan Olsen) write: >At 05:08 AM 3/23/96 +0000, Deranged Mutant wrote: >>On 23 Mar 96 at 3:00, Ed Carp wrote: >> >>> Has anyone tried SFS? It should work on the zip drive, though I've not >>> tried it (yet)... >> >>If I recall some recent threads on alt.security.pgp (or sci.crypt?), >>SFS doesn't work on ZIP drives (since ZIPs use the parallel port...). >> >>[Or do ZIPs use Scuzzies and the people who had problems were just >>too lame to figure out that they had to load the driver before SFS?] > >There are two versions of the Zip drive. One is SCSI and one is Parallel >faking scsi. > >The big problem is with the zip drivers. There is some sort of >incompatibility between SFS and the zip drivers. (I hacked on it for a >couple of hours with no luck.) The Zip drives have a firmware bug in that they don't do anything if the (appropriately-named) FUA bit is set in SCSI requests, and then return a command complete status. SFS 1.20 has a workaround for this problem. It works with both SCSI and parallel-port versions. Before anyone asks when it's due out, its the end of February, probably about the 60th of the month. Peter.

1 0

RISKS: Princeton discovers another Netscape security flaw
by stevenw＠best.com 17 Dec '03

17 Dec '03

Posted on RISKS: ---------------------------------------------------------------------- Date: Fri, 22 Mar 1996 17:27:56 -0500 From: Ed Felten <felten(a)CS.Princeton.EDU> Subject: Java/Netscape security flaw We have discovered another serious security flaw in the Java programming language, which allows a malicious Java applet running under Netscape Navigator (version 2.0 or 2.01) to execute arbitrary machine code. We have implemented an applet that exploits the flaw to remove a file. Until a fix is issued, Netscape users can protect themselves by disabling Java in the Security Preferences dialog. At present we are not releasing technical details about the flaw. We will announce the full details later; some of the details will also appear in our upcoming paper in the proceedings of the IEEE Symposium on Security and Privacy, to be published in May. Our paper also contains an overall analysis of Java's security. For an advance copy of the paper, send mail to felten(a)cs.princeton.edu. The paper will be available in about a week. [Note that the "security enhancements" announced by Netscape in version 2.01 of Netscape Navigator do not fix this flaw. They fix two separate flaws found last month, one found by us (RISKS-17.77) and independently by Steve Gibbons, and the other found by David Hopwood (RISKS-17.83).] For more information, see http://www.cs.princeton.edu/~ddean/java, or contact Ed Felten at (609) 258-5906 or felten(a)cs.princeton.edu. Drew Dean, Ed Felten, Dan Wallach, Dept of Computer Science, Princeton Univ. [See the CIAC item at the end of this issue for some background on the earlier problems. PGN] ------------------------------ ------------------------------------------------------------------------- Steven Weller | Weller's three steps to Greatness: | 1. See what others cannot | 2. Think what others cannot stevenw(a)best.com | 3. Express what others cannot

3 2

Re: RISKS: Princeton discovers another Netscape security flaw
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:48 3/24/96, Perry E. Metzger wrote: > When you build something large and complex, and >you require that the entire thing work for you to be secure, there are >just too many failure modes. That just about sums it up. Chisel these in granite: o Thou shall not execute untrusted code. Java or no Java. o Privileges that an user doesn't have can't be abused. o The only safe firewall is a non-networked computer. o A feature that doesn't exist won't introduce security holes. Yes, I know that there is a balance between functionality and security. Where to draw the line depends on the application. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Mailing lists down for 48hrs, now coming back up.
by Alan B. Clegg 17 Dec '03

17 Dec '03

The bsdi-isps, bsdi-users, bsdi-users-d, xconq, humor, cheapnet, and cypherpunks-d mailing lists have been down since Saturday night at about 8:00pm Eastern. The systems handling these mailing lists are now trying to get out from under the load, and normal operation should resume within 24 hours (I hope). (The primary mail machine for gateway.com is currently running at a load average of 19.8 and still puffing) -abc \ Alan B. Clegg Just because I can \ Network Technologist does not mean I will. \ gateway.com, inc. \ <http://www.gateway.com/>

1 0

Re: LIST OF SHAME VOLUNTEERS
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 06:51 PM 3/24/96 -0800, Sandy Sandfort wrote: >As promised, below is the list of folks who have asked to be put >on Mr/Ms Anonymous' LIST OF SHAME. In addition, I am including >one volunteer who supports Mr/Ms Anonymous...sort of. [List deleted] Add me to the list as well. As someone put it, you do not abandon those you admire just becuase you do not agree with them. (Or something like that...) The people who anon are ranting about have done real work for the cause of free crypto. I have not seen any such "good works" from Mr. Anon. I think that the Leahy bill is very flawed. It has some strong room for abuse by the government. it will also bring the issues into the public eye and maybe even get them to think about some of the issues revolving around the sillyness of ITAR. (Or at least one can hope.) But then, I think we are about to move into a new dark ages of the net anyways... The net has become an officially government recognised buzzword, thus ensuring its doom. (But I am a pessimist... So there!) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMVZIxOQCP3v30CeZAQEVYgf/RWTsRTVikFXHhTUiRxxmoj8yoIitPeOu 7O7q9VkrZ2S6Jc9IBffGxa53N/gtXDKvUkdLN8VE2lx1DjYsGI1eMcVTZ/mRS269 ceRuEWZ1hikJlak221mEbw5jgpSsvx7Ib72LLGaOtKx8UitEymdkFQ2nQHH1jGZr 1aldARW2yH9YtgUdHWplVMJaxrcArzKCMPMYyJyU4hrI6HB2RIMDMSj6vivjhm8U prey01OJxJiR0+6ZFjPmTVPFTXBdenubVS/OGHsaIe+ex5ogJLNMe5uIsiVKaReC t+K0o3T3PQj2R9ytOjnIT/6Cq22Ye7kfkmOS3Oovk6skkF2pB/z7Hw== =n7km -----END PGP SIGNATURE----- --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

Re: firewalls and CKE
by Marcus J. Ranum 17 Dec '03

17 Dec '03

Brian W. McKenney writes: >I missed the jist of the original message The gist of the first message was that software key escrow is here, and it is the greatest thing since the discovery of fire. :) Granted, it's nice that someone has found a way of convincing the government to let them export good crypto, but in this particular application it makes no sense. >For the firewall-to-firewall encryption >scenario, the data recovery component (DRC) may be a machine that >intercepts (in real-time) the traffic and then decrypts the data (recovers >the data). The interception of encrypted data makes sense for this type of >communication since the data is not really stored on the firewall (it is >wrapped/unwrapped quickly). [the intercepted packet may be copied and then >decrypted] That's completely brain-damaged if you think about it for a second. Let's suppose I have a file and it is unencrypted. I FTP it through my SKE-equipped firewall to the Paris office. My file gets transparently encrypted as it is broken into packets and sent across the 'net. Then - what - someday I need the file back so I get the escrowed key and reassemble the file from raw packets? That's dumb! I dunno about you but I'd just recover the clear file from a backup tape. :) Firewall-to-firewall encryption is a link-layer security technology. It encrypts data in transit: before it leaves and after it arrives you *already* have a clear-text un-escrowed version of the data. If I have a corporate requirement to "escrow" my telnet sessions then I'll use a version of telnet that logs keystrokes. But I can't see any reason (unless I'm a spook) to de-archive, de-escrow, and reassemble a telnet session for archival purposes. It gets worse since all the "escrowed" packets will be mishmoshed in with DNS queries (all "escrowed") and NFS packets and lordy knows what else. If it came to having packet records, why not simply log all packets *before* they get encrypted at the firewall, while they are still in the clear? Easier, no? At least LOTUS' "key escrow" approach is openly designed for the spooks and doesn't pretend to add value to the end user. I appreciate that TIS has made a successful deal with the devil to export some strong encryption, but it's unfortunate that they're showcasing it in a way which makes absolutely no sense at all. It's a shame, because basically we're seeing smart people doing technically goofy things in order to comply with some ridiculous laws. mjr. ----- End of forwarded message from Marcus J. Ranum -----

1 0