December 2003 - cypherpunks-legacy

[NOISE] More From Rumor-central
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [This has nothing to do with cryptography, but it is related to other posts seen here recently.] Miami Herald reports today on page 3A that the National Transportation Safety Bureaucrats are "investigating an American Airlines pilot's report that a missile zoomed by his 757 on Aug. 29 as it flew near NASA and Navy facilities in Virginia on its way to Boston." An NTSB spokesman has confirmed an investigation (termed a 'preliminary probe') is ongoing. Not to be outdone, the FAA is investigating as well. All this is according to the Herald, and I offer no opinions about veracity or trustworthiness of this particular media organ or what caused the crash of flight 800. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy Thursday, September 5 is the day when, in 1698, Russian Czar Peter the Great imposed a tax on...beards. Please, don't tell Congress. [Source: The Advocates for Self-Government.] "As govt.s grow arithmetically, corruption grows exponentially." -- Ray's Law of official corruption. Defeat the Duopoly! Stop the Browne out. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ http://www.twr.com/stbo ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMjLU4m1lp8bpvW01AQHB3AP/ROTTRCtg4LBrDwVSml2isdcm2GmFd01I 63dQg3o+ixBFldjXC3oHkQDUWSTyrpj/QXvUy43EGIdJMQ8MRI1+NCIu2R1ikF63 LasufEIvbCIzTcX1s+/n6vxciU6CYj2e5akbw4qBIK+eOr2roOoFADAKyQQbDdxx JvOvUzMVj/M= =WQHz -----END PGP SIGNATURE-----

1 0

ANNOUNCEMENT AND CALL FOR PAPERS - 1998 USENIX Security Conference
by Aviel Rubin 17 Dec '03

17 Dec '03

************************************************************************* ANNOUNCEMENT AND CALL FOR PAPERS 7th USENIX Security Symposium January 26-29, 1998 Marriott Hotel-- San Antonio, Texas Sponsored by the USENIX Association, the UNIX and Advanced Computing Systems Professional and Technical Association In cooperation with: The CERT Coordination Center. Important Dates for Refereed Papers Papers due: September 9, 1997 Author notification: October 8, 1997 Camera-ready final papers due: December 9, 1997 Registration Materials Available: End October, 1997 (Authors, see "How to Submit a Refereed Paper" below.) Program Chair Avi Rubin, Bellcore Program Committee Carlisle Adams, Nortel Dave Balenson, Trusted Information Systems Steve Bellovin, AT&T Research Dan Boneh, Princeton University Diane Coe, Mitre Ed Felten, Princeton University Li Gong, JavaSoft Peter Honeyman, CITI, University of Michigan Hugo Krawczyk, IBM Watson Labs Jack Lacy, AT&T Research Hilarie Orman, DARPA/ITO Mike Reiter, AT&T Research David Wagner, University of California, Berkeley Readers Katherine T. Fithen, CERT Trent Jaeger, IBM Watson Labs Invited talks coordinator: Greg Rose, Qualcomm Conference home page: <http://www.usenix.org/sec/sec98.html> OVERVIEW The goal of this symposium is to bring together researchers, practitioners, system programmers, and others interested in the latest advances in security and applications of cryptography. This will be a four day symposium with two days of tutorials, followed by two days of refereed paper presentations, invited talks, works-in-progress presentations, and panel discussions. TUTORIALS Monday and Tuesday, January 26-27 Tutorials for both technical staff and managers will provide immediately useful, practical information on topics such as local and network security precautions, what cryptography can and cannot do, security mechanisms and policies, firewalls and monitoring systems. If you are interested in proposing a tutorial, contact the tutorial coordinator, Dan Klein: phone (412)421-2332 email <dvk(a)usenix.org>. TECHNICAL SESSIONS Wednesday and Thursday, January 28-29 In addition to the keynote presentation, the technical program includes refereed papers, invited talks, a work in progress session, and panel sessions. There will be Birds-of-a-Feather sessions the last two evenings. You are invited to make suggestions to the program committee via email to <security(a)usenix.org>. Papers that have been formally reviewed and accepted will be presented during the symposium and published in the symposium proceedings, published by USENIX and provided free to technical session attendees. Additional copies will be available for purchase from USENIX. SYMPOSIUM TOPICS Refereed paper submissions are being solicited in areas including but not limited to: * Adaptive security and system management * Analysis of malicious code * Applications of cryptographic techniques * Attacks against networks/machines * Computer misuse and anomaly detection * Copyright protection (technical solutions) * Cryptographic & other security tools * File and file system security * Network security * New firewall technologies * Security in heterogeneous environments * Security incident investigation and response * Security of Mobile Code * User/system authentication * World Wide Web security Note that this symposium is not about new codes, ciphers, nor cryptanalysis for its own sake. Papers must represent novel scientific contributions in computer security with direct relevance to the engineering of secure systems for the commercial sector. HOW TO SUBMIT A REFEREED PAPER (Please read carefully.) The guidelines for submission are a bit different from previous years. Authors must submit a mature paper in postscript format. Any incomplete sections (there shouldn't be many) should be outlined in enough detail to make it clear that they could be finished easily. Full papers are encouraged, and should be about 8 to 15 typeset pages. Submissions must be received by September 9, 1997. Along with your paper, please submit a separate email message containing the title, all authors, and their complete contact information (phone, fax, postal address, email), including an indication of which author is the contact author. Authors will be notified of acceptance on October 8, 1997. All submissions will be judged on originality, relevance, and correctness. Each accepted submission may be assigned a member of the program committee to act as its shepherd through the preparation of the final paper. The assigned member will act as a conduit for feedback from the committee to the authors. Camera-ready final papers are due on December 9, 1997. If you would like to receive detailed guidelines for submission and examples of extended abstracts, you may send email to: <securityauthors(a)usenix.org> or telephone the USENIX Association office at (510) 528-8649. The Security Symposium, like most conferences and journals, requires that papers not be submitted simultaneously to another conference or publication and that submitted papers not be previously or subsequently published elsewhere. Papers accompanied by non-disclosure agreement forms are not acceptable and will be returned to the author(s) unread. All submissions are held in the highest confidentiality prior to publication in the Proceedings, both as a matter of policy and in accord with the U.S. Copyright Act of 1976. There will be one or two prizes awarded for best paper(s). WHERE TO SUBMIT For reliability, please send one copy of your paper to the program committee via each of two of the following methods. All submissions will be acknowledged. o Preferred Method: email (Postscript) to: <securitypapers(a)usenix.org> o Alternate Method: postal delivery to Security Symposium USENIX 2560 Ninth St., Ste. #215 Berkeley CA 94710 U.S.A. Phone: (510) 528-8649 o Fax: (510) 548-5738 Vendor Exhibits Demonstrate your security product to our technically astute attendees responsible for security at their sites. We invite you to take part in the Vendor Display. The informal, table-top display allows you to meet with attendees informally and demonstrate in detail your security solutions. Contact CynthiaDeno Email: cynthia(a)usenix.org Phone: 408.335.9445 Fax 408.335.5327 Works-in-Progress Session (WIPs) The last session of the symposium will be a Works-in-Progress session consisting of five minute presentations. Speakers should provide a one or two paragraph abstract to the program chair by 6:00 pm on January 28, 1998 at the conference. These should be provided in person, not via email. The chair will post the schedule of presentations by noon on the 29th. Experience at other conferences has shown that usually, all of them are accepted. The five minute time limit will be strictly enforced. INVITED TALKS There will be several invited talks at the conference in parallel with the refereed papers. If you have suggestions for possible speakers, please send them to <security(a)usenix.org>. REGISTRATION MATERIALS Materials containing all details of the technical and tutorial programs, registration fees and forms, and hotel information will be available at the end of October 1997. To receive the registration materials, please contact: USENIX Conference Office 22672 Lambert Street, Suite 613 Lake Forest, CA USA 92630 Phone: (714) 588-8649 Fax: (714) 588-9706 Email: <conference(a)usenix.org> Information can also be found under the Conference home page: <http://www.usenix.org/sec/sec98.html>.

1 0

Re: talker
by Wayne H. Allen 17 Dec '03

17 Dec '03

At 03:03 AM 9/8/96 +0000, attila wrote: >=Dear Whoever, > > cypherpunks are *not* crackers; this is a crytographic > and political issues relating to cryptography mailing list. > > Well maybe, political issues galore certainly, but very very little to do with cryptography. I mean what does TWA 800 have to do with this list. I mean lets be completely honest here, whatever the original purpose of the list was for its been allowed to shift away from its intended purpose considerably. Wayne H.Allen whallen(a)capitalnet.com Pgp key at www.capitalnet.com/~whallen

2 1

Re: Clipper III on the table
by jim bell 17 Dec '03

17 Dec '03

At 06:31 PM 10/1/96 -0700, Lucky Green wrote: > > > >On Tue, 1 Oct 1996, Robert Hettinga wrote: >[as to why HP and others support GAK in exchange for DES export] > >> I agree with Lucky's earlier hypothesis that HP's doing this to curry >favor >> for government contracts in lieu of an actual marketing strategy, and I >> leave TIS's motives up to the list as an exercise. ;-). > >This not a hypothesis. A policy person from HP told me that > >1. HP as well as TIS and other companies sell single DES products that >they would like to be able to export. >2. He was directed by HP's marketing department to find a way to make >that happen. >3. He therefore supports a GAK for export "compromise". HP, then, might be a good company to approach as a potential donor on a DES-cracker. While they want to be able to portray their products as reasonably secure, at the same time they want to be able to de-fuse any export limits. Showing that, say, $25,000 of hardware could crack DES in a year (and thus, presumably, $25 million could crack DES in 1/3 of a day, a budget available to the NSA et al.) would demonstrate that there's no strong reason to keep it restricted in any way. Jim Bell jimbell(a)pacifier.com

1 0

Re: Can we kill single DES?
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Peter Trei writes: > Since it looks like the US government will be allowing the export of > 56 bit espionage-enabled software, it's time to kill single DES. Yes. It's an obsolete cipher with a woefully small key. Only a catastrophic failure will cause the ABA to undergo religious enlightenment. > As some of you will recall, a while back I wondered aloud about the > feasibility of brute-forcing DES on general purpose machines, ala the > RC4-40 crack last year. I'm a firm believer in "work smart, not hard." It might be interesting to run a wiring diagram of DES through a superoptimizer and see how many algebraic identities fall out. An analytical crack that could be published on the Net would be far more impressive than harnassing gigacycles on every available machine, which might very well awe the gullible into thinking DES was difficult to break. > On this type of processor, it would still take 9133 years to exhaust > a 56 bit key space. On the other hand, on 20,000 processors of this > power it would take less than 6 months. If the target is encrypted > in a chaining mode with an unknown 8 byte IV, the time more than > doubles. I can see the headlines now. "Cypherpunks show DES can withstand up to 9,000 Pentium-years of torture and keep on ticking." Remember the Law of Unintended Consequences. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Re: Clipper III on the table
by Omegaman 17 Dec '03

17 Dec '03

> Allow me to say here that I do not belive that Netscape will be amongst > those fooled so easily. But IBM, HP, TIS, and others have already been > fooled. The USG does not need to get every software company to agree with > their proposal. Divide and conquer. Seems that the USG has done a > marvelous job of D&C so far. > If anything, it would not be in their best _marketing_ interests to support GAK. Rejecting GAK in favor of promoting strong crypto will make them look like "good guys". This is also true of Micro$oft. And contrary to an earlier opinion, I think Bill & Co. have been soured by their experiences with DoJ. While their are far larger motivations involve, I certainly don't think Micro$oft will skip at the chance to thumb their noses at the government if it's to their advantage. Both of these companies may be willing to support a DES-crack effort me -------------------------------------------------------------- Omegaman <mailto:omega@bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send a message with the text "get key" in the "Subject:" field to get a copy of my public key. --------------------------------------------------------------

1 0

Re: How might new GAK be enforced?
by jim bell 17 Dec '03

17 Dec '03

At 09:39 AM 10/1/96 -0800, Timothy C. May wrote: > >Now that the shoe is dropping on "Clipper III" (or "Clipper IV"), the >"voluntary, for export, key escrow system," how might it be enforced? > >Some possibilities: [snip] >(Else what's to stop Giant Corporation from using Non-GAKked software >within the U.S., which is perfectly legal (under the "voluntary" system), >but then "happening" to have their foreign branches and customers obtain >"bootleg" versions at their end? All it takes is a single copy to get out, >and be duplicated a zillion times. Voila, interoperability, with the only >"crime" being the first export...which is essentially impossible to stop, >for so many reasons we mention so often. Conclusion: Government must make >this very mode illegal, perhaps by making it a conspiracy to thwart the >export laws....) If this solution were really practical, it would have been tried already. One of the biggest problems with enforcing anti-export laws is that there is no guarantee that anybody currently within the jurisdiction of the country involved (for concreteness, the US) is actually responsible for a given export. Let alone KNOWN to be responsible. And it's even less likely that it be "provable" within the standards of court cases. Worse, doing the prosecution does nothing about returning the copies of the program to the country of origin, making the whole exercise pretty damn futile! >Any other ideas on how the government plans to enforce GAK, to make GAK the >overwhelmingly-preferred solution? Clipper I was, I think, their best hope for promoting GAK. It would have engineered distorted-market pressure by making it artificially easy to use GAK, hard to use non-GAK. Subsequent proposals have all been weaker, less effective, less practical, and less encompassing. And the "worst" part, from the point of view of the USG, is that it's now 3.5 years after the announcement of Clipper I, and they're no closer to foisting this turkey onto us. Nobody in Congress is under the illusion that the public likes this stuff, unlike 1993 where they could at least imagine that there were no emotions running high on the subject. In 1993, they were under the impression that they could implement their fondest desires with legislation; now the only likely legislation is either anti-GAK or non-GAK. Jim Bell jimbell(a)pacifier.com

2 1

FUCK!!!!!!;-)
by Robert Hettinga 17 Dec '03

17 Dec '03

It seems to be worse than we thought? Apple and *Sun*? Doesn't *Whit Diffie* work for Sun? Curioser and curioser... Cheers, Bob Hettinga --- begin forwarded text From: sombody... Date: Wed, 2 Oct 1996 15:41:38 -0400 To: rah(a)shipwright.com Subject: FUCK!!!!!!;-) NEW YORK AND PARIS--(BUSINESS WIRE)--Oct. 2, 1996--Eleven major information technology vendors and user organizations today announced the formation of an alliance to develop an exportable, worldwide approach to strong encryption. The goal of the alliance is to enable companies to conduct secure international electronic commerce. The alliance was formed in response to demand from customers who are conducting more and more of their business processes electronically. Internationally available strong encryption would enable these firms to send sensitive information securely over the Internet and other international networks. The companies forming the alliance will achieve this by developing modern, high-level cryptographic "key-recovery" solutions that meet the requirements of business and could allow easing of restrictions of cryptographic import/export around the world. Members of the alliance are Apple Computer, Inc., Atalla, Digital Equipment Corporation, Groupe Bull, Hewlett-Packard Company, IBM, NCR Corp., RSA, Sun Microsystems, Inc., Trusted Information Systems and UPS. The alliance is also open to other companies with an interest in key recovery. "Keys" are strings of computer code that lock and unlock data. Key recovery is an approach that permits the recovery of lost or damaged keys without the need to store or "escrow" them with a third party. This approach could also meet the needs of law enforcement to act under the authority of a court order without risking the confidentiality of business data. Modern, high-level cryptography works to ensure four critical elements of security -- Confidentiality: prevents against unauthorized parties from seeing information; Integrity: determines that information has not been changed during transit; Authentication: verifies the identity of the user and the user's eligibility to access and use information; Non-Repudiation: provides evidence that a transaction took place, for example, that a customer actually placed an order. "Apple recognizes and supports the need for key recovery, and we are pleased to be a part of the alliance," said Ellen Hancock, chief technology officer and executive vice president of R&D for Apple Computer, Inc. "We believe that this alliance will help industry lead in developing solutions for secure transactions while prompting the evolution of the Internet as a business environment." "Securing commerce over the Internet using strong encryption technologies will require a common set of standards and approaches to fundamental security issues such as key recovery and key management," said Robert Gargus, Atalla president and general manager. "Once these standards are accepted and globally deployed, public networks such as the Internet will provide a secure, multi-national commercial trading environment for worldwide electronic commerce." "The alliance has struck a balance between government and business needs," said CommerceNet Chairman Marty Tenenbaum. "Allowing encryption to this degree opens the door to the proliferation of electronic commerce." "Strong encryption is a necessary element in delivering secure network business solutions to our customers worldwide. Key recovery is a mechanism that addresses government policy concerns about the export of strong encryption while at the same time meeting growing commercial needs," said Sam Fuller, vice president and chief scientist for Digital Equipment Corporation. "Digital sees this alliance as an effective means to develop open and interoperable key recovery standards." "Electronic Commerce is planned to be $1T by the year 2010 according to experts. The capability to have secured transactions is a prerequisite for the market," said Alain Couder, senior executive vice president of Groupe Bull. "Groupe Bull had been actively involved in the search for a solution to provide a balance between the legitimate need for users to have privacy, for corporations to protect their trade secrets and relationships and for governments to maintain national security. Bull has the ambition to be a leading provider of this capability with key encryption technology, smart cards and its Internet products and services." "HP is pleased to be a founding member of the alliance," said Richard W. Sevcik, HP vice-president and general manager of the Systems Technology Group. "Exportable strong encryption is a key enabler for international electronic commerce and provides businesses with the ability to perform secure transactions and other communications regardless of geography. Key recovery is one of several technologies that will be important." "Key recovery will truly open the Internet for serious business," said Irving Wladawsky-Berger, general manager, IBM Internet Division. "Once businesses are confident that their electronic transactions are safe and they control the recovery of keys, a flood of new market opportunities will open. The Internet is rapidly shifting from a place to browse for information to an environment for conducting real business." "Export controls are a fact of life," said Jim Bidzos, president of RSA Data Security. "The key recovery alliance's approach will allow companies to use cryptography with differing levels of security in an interoperable way. When the alliance implements this technology it will give the user a new level of flexibility that did not exist before. In an imperfect world this technique will at least allow you to take advantage of what governments around the world will allow." "We're delighted to be part of the alliance because we believe the adoption of a worldwide standard for key recovery is essential to solving current network security problems," said Stephen T. Walker, president and CEO of TIS. "User-controlled key recovery systems including our own products have already demonstrated that user privacy concerns and exportability requirements can be successfully addressed. But there must be worldwide interoperability. And it is our hope that the alliance will be able to accomplish that." "The work of the alliance could have a profound impact on conducting international business over the Internet," said Joe Pyne, UPS vice president of marketing. "UPS is committed to improving the movement of both information and packages in secure and time sensitive manners. The alliance allows us to combine our expertise, energies and financial strength to quickly develop standards that will open the door for rapid development of products and services." CONTACT: Apple Computer, Inc. Maureen O'Connell 408-862-6689 or Atalla Gary Lefkowitz 408-435-5715 or Digital Equipment Corp. Patrick Ward 508-493-9441 or Groupe Bull Jean-Jacques Roulmann 33-1-39-66-3970 or Hewlett-Packard Kimberly Daniel 408-447-4587 or IBM Mike Corrado 914-766-1162 or NCR Bob Farkus 513-445-2078 or RSA Data Communications Ginny Kirkley 415-595-8782 or Sun Microsystems Inc. Ray Nasser 415-786-4395 or Trusted Information Systems Homayoon Tajalli 301-854-6889 or UPS Pat Stephen 201-828-6103 KEYWORD: NEW YORK INDUSTRY KEYWORD: COMPUTERS/ELECTRONICS COMED BW0153 OCT 02,1996 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

2 2

[SPAM] Timmy May's tentacle thinks I'm Timmy May's tentacle?
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Timmy May lies, rants, posts off-topic, and pollutes the cypherpunks mailing list with his kinky sexual phantasies. Why is this cocksucking limey faggot dying from the combination of AIDS and the mad cow disease accusing me of being Timmy's tentacle? How could Timmy create a tentacle that knows something about crypto when Timmy doesn't? >Comments: Authenticated sender is <paul(a)fatmans.demon.co.uk> >From: paul(a)fatmans.demon.co.uk >To: "Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> >Date: Mon, 30 Sep 1996 17:40:49 +0000 >Mime-Version: 1.0 >Content-Type: text/plain; charset=US-ASCII >Content-Transfer-Encoding: 7BIT >Subject: Re: [AP] Afghanistan >Priority: normal >X-Mailer: Pegasus Mail for Windows (v2.31) >Message-Id: <844193561.12763.0(a)fatmans.demon.co.uk> > > >> > And this would accomplish???? And this has what to do with cryptography?? >> >> Nothing, of course - neither do Timmy May's stupid rants, lies, and personal >> attacks. >> >> By the way, your abuse of your native language suggests that you're probably >> a product of U.S. public education. > >Then it would appear that you are ranting here, your post is off >topic, you are lying, and in addition you have posted a personal >attack.. Haha! - I`ve found Tim`s secret pseudonym!!!! > > > > Datacomms Technologies web authoring and data security > Paul Bradley, Paul(a)fatmans.demon.co.uk > Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org > Http://www.cryptography.home.ml.org/ > Email for PGP public key, ID: 5BBFAEB1 > "Don`t forget to mount a scratch monkey"

1 0

Re: Weaknesses in Smart Cards? (Re: FLA_wed)
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 10:04 PM 10/1/96, Lucky Green wrote: >There is no way to know for sure, since Mondex won't release the specs, >but just about everybody I talk with that knows at least something about >their system agrees that if you crack a Mondex card, you will likely be >able to mint money. Since Mondex allows transfers from card to card to >card, it may be a long time indeed before the breech is disovered. If I >were a Mondex issuer, I would be worried. Very worried. > >--Lucky I can imagine a protocol that would allow the Mondex card to issue several brands of card that would normally appear to be one uniform brand until fraud was suspected or proven. Then only money passed thru the compromised brand would be suspect. News of the counterfeit brand would be spread among cards by a contagion algorithm. One morning your card would greet you saying that $38 of your cash is counterfeit, or worse, that your card could issue no money to other cards, but could be returned to the issuer for a partial refund. I would not want to hide my Mondex card under the matress for my old age. I recall hearing something about Mondex that suggested to me that the card rembered recent large receits and that money had fingerprints so as to remember, to a degree, where it had been recently. When questioned about the privacy issues they responded that of course only the authorities would be able to retrieve such information.

1 0

Public Apology (this list is a joke)
by Dave Temple 17 Dec '03

17 Dec '03

I just wanted to apologize to the list for "whining like a 4 year old". I was upset that I was not "adult" enough to save the welcome message I received when I joined the list. I thought that if I acted like a jerk someone would get upset and either kick me off the list or at least give me instructions to do so myself. I was right. I joined this list knowing next to nothing about cryptography. I have learned quite a bit from those who have actually posted worthwhile mail and would like to thank them. I realize that a public list is very hard to maintain, we have just begun offering listservs to our faculty and we are already having problems. So thanks to those of you who have sent me messages on how to unsubscribe. Once again, I am sorry for the whining.

3 2

Re: ITAR satellite provision
by Greg Broiles 17 Dec '03

17 Dec '03

At 09:31 PM 10/1/96 -0700, Steve Schear wrote: >Does anyone on the list have the exact ITAR reg. text relating to the >exemption for space-launched crypto? I think you're talking about the definition of "export", located at 22 CFR 120.10: "Export means, for purposes of this subchapter: (a) Sending or taking defense articles out of the United States in any manner; or (b) Transferring registration or control to a foreign person of any aircraft, vessel, or satellite on the United States Munitions List, whether in the United States or abroad; or (c) Sending or taking technical data outside of the United States in any manner except by mere travel outside of the United States by a person whose personal knowledge includes technical data; or (d) Disclosing or transferring technical data to a foreign person, whether in the United States or abroad; or (e) The performance of a defense service on behalf of, or for the benefit of, a foreign person, whether in the United States or abroad. * A launch vehicle or payload shall not, by reason of the launching * of such vehicle, be considered an export for purposes of this * subchapter. Most of the requirements of this subchapter relate only to exports, as defined above. However, for certain limited purposes, the controls of this subchapter apply to sales and other transfers of defense articles and defense services (see, e.g., Sec. 126.1) of this subchapter." -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

RE: LivePGP (fwd)
by Black Unicorn 17 Dec '03

17 Dec '03

In response to my point that refusing to release the source code of his software will have the effect of discouraging its use by anyone with a clue, On Wed, 2 Oct 1996, Ming-Ching Tiew wrote: > > While most certainly you are entitled to express whatsoever > idea of yours and certainly the same applies to me. > This goes without saying. > I am most certainly not a crypto implementor, the entire > cryptographic part of LivePGP relies on PGP. It is taken > without a single line of change from the compiled executable, > which source is available in full. So, the peer review and > stuff are fully applicable. Incorrect. You have incorporated PGP in a new piece of software. How are we to know you took the code line for line unless we are able to verify this claim? Obviously, we cannot. Your software is, therefore, untrustworthy. This is not a matter simply of my opinion. This is basic doctrine in the development of crypto software. Ask anyone who knows what they are talking about. Joe Average may be interested in your product, but no expert, or even fairly knowledgeable individual, will ever take it seriously while the source code remains private. > I am also most certain that you will have a response to this > view of mine. For whatever it is, I forsee that we will remain > holding on to our own views. So, we should not carried on > with this "discussion", for it will not be a productive work. Your attitude distresses me and your ignorance of the importance of peer review gives me pause when considering your potential skill as a crypto programmer. > Anyway thank you for a brief moment of interest in LivePGP > which you have demonstrated. I really appreciate that. Many of us would appreciate it if your, seemingly very useful software, was also trustworthy enough to be used. > Regards, > Ming-Ching > > ---------- -- I hate lightning - finger for public key - Vote Monarchist unicorn(a)schloss.li

1 0

Civil rights and double jeopardy
by Greg Broiles 17 Dec '03

17 Dec '03

At 08:51 PM 10/1/96 -0700, Dale Thorn wrote: >Once they could no longer look the other way, those higher-level >authorities should have proceeded against the local governments as I >specified, rather than undermining the Constitutional enumerations. The protection against double jeopardy is constitutionally based and cannot be modified by statute, e.g., the Civil Rights Act of 1964. The various civil rights acts, movements, and statutes did not make Congress nor the executive adopt a loophole around the double jeopardy protections; the loophole existed considerably prior to then. The double jeopardy clause is interpreted (and has been since at least 1922) so that it only bars multiple prosecutions (or punishments) by the same sovereign. In _US v. Lanza_ 260 U.S. 377 (1922), the Supreme Court wrote: ". . an act denounced by both national and state sovereignties is an offense against the peace and dignity of both and may be prosecuted and punished by each." Where an act violates both federal and state law, both the federal and state governments think they get an opportunity to prosecute. Thus, racial violence or murder which violates state assault or homicide laws gets a state prosecution; and where it also violates federal civil rights laws (18 USC 241 or 242) it is also prosecutable federally. Ditto for many drug crimes. An act which does not violate federal law (say, jaywalking) cannot be prosecuted federally; this limits the situations where multiple sovereigns can lead to multiple prosecutions. (but with Congress expanding federal criminal law ...) (There's an exception to the dual sovereignty exception to the double jeopardy clause, the "Bartkus exception", where the second prosecution is a sham or a fake undertaken to serve the interests of the first sovereign; but it's very hard to win a _Bartkus_ argument. Stacy Koon (one of the cops convicted for the beating of Rodney King) tried to argue Bartkus and lost.) Sorry for wandering off into legalpunks land but it's simply not the case that the civil rights movement caused the erosion of the double jeopardy clause, or that there's a magic "civil rights exception". Dual-sovereign double jeopardy is alive & well in drug prosecutions today. Civil rights just gets all of the press. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

Re: active practice in America [RANT]
by Dale Thorn 17 Dec '03

17 Dec '03

Mark M. wrote: > On Mon, 30 Sep 1996, Dale Thorn wrote: > > Re: Below text. One of the most fascinating aspects of the Simpson > > case (to me, anyway) is how persons who know about conspiracies, > > mafia hits, etc., are still willing to believe OJ is guilty (fer > > sure), looking only at the "evidence" presented by the same folks > > who (send for list). > Information about the evidence, crime and trial are not classified for > the reason of "national security" in this case. True, but what's reported is a joke, just like other media scams. > There's a motive and there is nothing outlandishly unbelievable about > the possibility that Simpson did do it. I didn't say no possibility, just very little probability. And what motive did this wealthy man have to savagely (inhumanly, yet) murder those two people? There are people who have plausible motives, though. > OJ never was in the military and there is nothing that even remotely > suggests that he had anything to do with the CIA. CIA, remotely? I guess Colby, Jr. living next to Nicole is outside the boundary of remote? I guess A.C.'s boss Ippolito, *close* friend of George Aronow, *close* friend of George Bush, etc. is also out of bounds? Ever hear of international coke rings? OJ was up to his neck in Mob, and looks like Denise Brown likewise. Too remote for you? > The Simpson case and the JFK assassination are not even remotely > comparable. Lessee, an apple and a banana are "not even remotely comparable", due to so many differences, etc. But, I can eat both of them, and get nutrition from both, so, they *do* have quite a bit in common. The Warren Commission, and all "official" treatments of the JFK assassination were not based on the real evidence, nor was the OJ trial. If you're one of those people who saw Ruby do it, and you said "gee, musta been just another wacko", then you could look at the OJ trial the same way and say "gee, just another crazy black man", etc.

1 0

Re: White House crypto proposal -- too little, too late
by jim bell 17 Dec '03

17 Dec '03

At 08:50 PM 10/1/96 -0700, John Anonymous MacDonald wrote: >> Date: Tue, 1 Oct 1996 14:56:21 -0700 (PDT) >> From: Declan McCullagh <declan(a)well.com> >> >> "What?" I asked. "Unless you're talking about import restrictions." >> >> "Exactly," he said. >> >> -Declan > >I don't doubt that they can do this if they really want to, but I >wonder what legal basis they will use for import restrictions. > >Are there any current import restrictions for products on can legally >manufacture, sell, and use in the United States? "Sugar" Jim Bell jimbell(a)pacifier.com

1 0

unsubsribe
by GOULDING CP 17 Dec '03

17 Dec '03

unsubsribe

1 0

Re: This list is a joke
by Dave Temple 17 Dec '03

17 Dec '03

Actually, I am not adult enough to save the welcome message I received when I joined the list. Thanks to the many people who have since sent me the instructions. I am sorry I had to whine to get them. > > I guess you are not adult enough to take yourself off the list. > > > andrew >

1 0

NYT on IBM GAK
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The New York Times, October 2, 1996, pp. D1, D8. Compromise Is Offered on Computer Security Codes By John Markoff The Clinton Administration offered a compromise to the computer industry yesterday by holding out the possibility of removing all export restrictions on data-scrambling technology for companies that accept a new approach to allow law enforcement officials to unscramble coded messages. The new system is being recommended by an alliance led by I.B.M.. The approach is to be announced today and has passed muster with the Central Intelligence Agency. It would enable law enforcement officials to unscramble computer communications -- provided they have a warrant -- without having to obtain a mathematical key to the code. Instead, the agents could use the warrant to obtain the cooperation of outside parties to help unscramble portions of code accompanying a message. This information would then allow law enforcement officials to draw mathematical inferences enabling them to decipher the scrambled messages. By making it at least a two-step process to decipher a scrambled, or encrypted, message, and by requiring the cooperation of at least two outside parties designated by the code users themselves, the approach is supposed to address the main criticisms against data-scrambling systems previously endorsed by the Government. But some industry executives and privacy-rights advocates said yesterday that the new approach would not satisfy their objections to a Government-backed eavesdropping system. Critics contend that any such system could compromise the privacy of United States citizens and hinder the ability of American high-technology companies to sell their most sophisticated data-security products overseas. Executives of the International Business Machines Corporation said late yesterday that they were still lining up the final list of companies in the alliance. Those involved will include Digital Equipment and smaller data-security companies including RSA Data Security, Cylink and Trusted Information Systems. The computer industry and the Clinton Administration, as well as factions within the Administration, have been at an impasse for years over export policy for data-scrambling technology. Intelligence and law enforcement agencies, fearing that such technology can be used by terrorists and criminals to conspire with impunity, have insisted on a system for cracking the coded messages under certain circumstances. Seeking to end the deadlock, I.B.M. set in motion the new compromise earlier this year when it demonstrated its experimental approach to the C.I.A. Director, John Deutsch. Mr. Deutsch then took an active role in the internal Administration debate, in which Justice Department and F.B.I. officials had previously taken a hard line against loosening export controls, according to several people familiar with the talks. In a public statement issued yesterday Vice President Al Gore said that if the I.B.M. data-deciphering technology proved workable, there would no longer be export restrictions on the strength of the data-scrambling technology or on the type of software algorithms -- or mathematical formulas -- employed. The Administration is calling the I.B.M. approach a "key recovery" system. The designation is meant to distinguish it from previously proposed "key escrow" systems, like one called Clipper that the Government put forth a few years ago. In an escrow system, one or more Government or private-industry escrow agents would hold keys for unlocking coded messages, which could be used by law-enforcement agents with a warrant. The drawbacks, according to I.B.M., are that the storage of the keys can become a record-keeping nightmare and can also make the system vulnerable to unauthorized use of the keys. The I.B.M. approach is intended to eliminate this vulnerability by giving no third party an actual key to the code. Instead, at least two "trusted agents" would be required to help unscramble encrypted information in the header of each message. Only after this portion of the message is deciphered, I.B.M. said, would law-enforcement agents be able to unscramble the contents of the message itself by recreating the original key to the code. "Our theory is this should work the same way as your filing cabinet," said Kathy Kincaid, an I.B.M. computer security executive. "You wouldn't give law enforcement the keys to your filing cabinet unless they had a search warrant." And yet, even one of the companies that I.B.M. is counting on as an alliance member said yesterday that new approach did not go far enough beyond the old Clipper plan, in terms of privacy protection. "The Government announcement is disastrous," said Jim Bidzos, chief executive of RSA Data Security, one of the country's leading developers of data-scrambling software. "We warned I.B.M. that the National Security Agency would try to twist their technology." The Clinton Administration also angered executives at the software company Netscape Communications, who warned that even the new Government plan would continue to hinder the American industry's ability to compete internationally. Peter Harter, Netscape's public-policy lawyer, contended that the Administration was playing favorites among computer companies, rewarding those willing to go along with its approach by removing export restrictions that might be retained for companies not willing to incorporate the "key recovery" system in their products. "This is tantamount to making public policy by extorting high-tech companies," Mr. Harter said. But some computer hardware makers were more conciliatory. "From my perspective the process has been much better this time," said Eric Schmitt, Sun Microsystem's chief technology officer. "The question is still, 'How will industry implement key recovery?' It's still too early to say." [End]

2 1

REM_ail
by jya＠pipeline.com 17 Dec '03

17 Dec '03

10-8-96. VV: "The Remailer Is Dead, Long Live the Remailer. Life After Penet." By Dave Mandl (Excellent, Dave, yes!) By the strict standards of the cypherpunks, a loosely knit affinity group of the Net's most radical and technoliterate privacy advocates, Penet's security was actually on the flimsy side. Its Achilles' heel was the file -- just begging to be subpoenaed -- that linked users' real names to their Penet pseudonyms. Cypherpunk-run remailers, on the other hand, generally leave no trace of the sender's true identity. In addition, cypherpunk remailers can be "chained" -- messages can be routed through several far-flung remailers before reaching their final destination, making message tracing all but impossible, even for the remailer operators. ----- http://jya.com/remail.txt ftp://jya.com/pub/incoming/remail.txt REM_ail

1 0

Re: NYT on IBM GAK
by Rich Burroughs 17 Dec '03

17 Dec '03

At 11:14 AM 10/2/96 GMT, jya(a)pipeline.com (John Young) wrote: > The New York Times, October 2, 1996, pp. D1, D8. > > > Compromise Is Offered on Computer Security Codes > > By John Markoff [snip] > Executives of the International Business Machines > Corporation said late yesterday that they were still lining > up the final list of companies in the alliance. Those > involved will include Digital Equipment and smaller > data-security companies including RSA Data Security, Cylink ^^^^^^^^^^^^^^^^^ > and Trusted Information Systems. [snip] > "The Government announcement is disastrous," said Jim > Bidzos, chief executive of RSA Data Security, one of the > country's leading developers of data-scrambling software. > "We warned I.B.M. that the National Security Agency would > try to twist their technology." [snip] Isn't there at least a slight contradiction here? Hello, Mr. Markoff? Is RSA really involved in this "alliance" (read "sell out") or did IBM just throw out their name? Inquiring minds want to know... Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon U.S. State Censorship Page at - http://www.teleport.com/~richieb/state New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

Re: LDS 'mountain'
by Dale Thorn 17 Dec '03

17 Dec '03

attila wrote: > Dale: > the 'mountain' contains only original copies of the church > records (actually quite small) and the immense collection of > the genealogy of the world as records are microfilmed whereever > the have been available. these records contain ** only ** birth, > baptismal, marriage, death, and burial records. most European > records come from the churchs. [remaining text deleted] The only reason I would bother to mention this is merely to caution people to think: What could *possibly* happen if the shoe were on the other foot. If the Constitution is about anything at all, it's about balance of power, and when *any* power transfers more to one interest than another, interesting changes can occur. BTW, there have been articles in the L.A. Times about attempts by persons not of the Mormon faith to prevent Mormons from dominating the cultural life in SLC schools, other public venues, etc. This raises the eternal question: Can a group live the way *it* wants to without interference, or is group culture always going to constitute a threat to persons in the vicinity who don't share that culture?

1 0

Thoughtcrime a Reality: U.S. Toughens Child Pornography Law
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

> WASHINGTON (Reuter) - Congress cracked down on child >pornographers in a new law that took effect Tuesday, making it >illegal to appear to depict children in sexual situations, >whether in films, computer images or photographs. > But the American Civil Liberties Union decried the law as >unconstitutional and a waste of prosecutors' resources, since it >expanded a law designed to protect any actual children used to >produce pornography. The ACLU said it also was so broad that >adults portraying children in films could risk prosecution. > Previously, depictions of minors produced by computers >without using children had been outside the scope of federal >law. The new law expands the definition of child pornography to >include any image -- photograph, video or computer-generated >image -- that depicts or appears to depict a minor engaged in >sexually explicit conduct. > Senate Judiciary Committee Chairman Orrin Hatch, a Utah >Republican, said it was designed to protect children from sexual >exploitation and pedophiles. ``This is a tough bill aimed a >child pornographers,'' he said. > ``While federal law has failed to keep pace with technology, >the purveyors of child pornography have been right on line with >it. Passage of this bill will help to correct that problem,'' >Hatch said. > But ACLU legislative counsel Daniel Katz said it had major >ramifications for artists, the film industry and journalism. He >said it included a waiver-of-privacy rule to permit newsroom >searches for information related to investigations of child >pornography. > ``It is much broader, and the ramifications are >extraordinary, both for artists and for people in the cinema,'' >Katz said. Under this expanded definition of child pornography, >it would be illegal to produce or show a film that included an >adult actor or actress portraying a minor in a sexually explicit >scene, he said. > Computers can be used to alter photographs, films and videos >to produce sexually explicit materials virtually >indistinguishable from unretouched photographs. The new >technology has hampered prosecutors in their ability to obtain >convictions because it can be impossible to identify individuals >or to prove that the materials were produced using real >children. > The new law would allow prosecution of pornographers whether >or not the identity of the child could be determined, so long as >the person, even if an adult, appeared to be a minor. Currently, >pornography is protected under free speech laws except when a >minor child is involved. > Hatch said the Judiciary Committee determined that >computer-generated pornography posed many of the same dangers to >children as did pornography made from unretouched photographs in >that it could be used to seduce children into sexual activity or >to encourage a pedophile to prey on them. > The new law sets mandatory prison sentences of 15 years for >production of child pornography, five years for possession of >the materials and life in prison for repeat offenders convicted >of sexual abuse of a minor. > The child pornography law was included in part of a broad >spending bill President Clinton signed into law Monday. It had >passed the Senate Monday just hours before the midnight deadline >for the start of the new financial year. > It does not address new or expanded regulation of the >Internet. The Justice Department has asked the Supreme Court to >overturn a landmark ruling by a Philadelphia appeals court that >blocked as unconstitutional a new federal law barring indecency >on the Internet. > > > _______________________ Regards, You cannot depend on your eyes when your imagination is out of focus. -Mark Twain Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

encrypting pppd?
by VaX#n8 17 Dec '03

17 Dec '03

Anyone worked on, or know of a freely available, one of these beasts?

5 5

send me mail
by spatterson＠juno.com 17 Dec '03

17 Dec '03

Hello, In the happy mutant handbook it said your name on the crypto section so what do you do? And can you send me some cool, info? Thanks, scott **Rember to see scotts page at*** WWW.GEOCITES.COM/HOLLYWOOD/HILLS/3108

2 1