December 2003 - cypherpunks-legacy

CRADA robber
by Peter Wayner 17 Dec '03

17 Dec '03

I spoke with Dennis Branstad at length a couple of days ago about just what it means to get involved with NIST in the Software Key Escrow CRADA. It was a nice conversation and he told me that he personally didn't seem to think that a workable system would emerge, but that others felt differently. Plus the push for a software solution meant that the agency felt that it should at least explore the topic before dismissing it. The system seems to be quite commercial. A group of people and companies petition NIST to get involved with the project and then a group forms out of a subset of these applications. Usually this is the team that is most likely to get the job done. For that reason, people need to bring something to the project be it expertise, capital or whatever. At the end, the group owns the intellectual property rights to what is discovered. This may be something patentable and it could be worth some money. I don't know how likely this is, but it seems possible. In fact, it is probably the reason many of the participants are willing to enter into the project. The role of NIST is both gatekeeper and fascilitator. They get everyone together and occasionally push things along. In this case, they'll also offer some technical assistance which will include feedback from the NSA. Dennis Branstad said that this would most likely take the form of Siskel and Ebert-like ratings of the systems proposed. The NSA would suggest, "Yes" or "No" but they probably wouldn't go into details. This is because the procedure would be unclassified and the NSA usually won't relate technical details without classifying them. I've read the Federal Register announcement and it really isn't that interesting. There are only two columns of text and most of it is devoted to the formatting and standard operating procedures. This note contains much more information than the announcement itself. This leaves me with several questions: * Is this process intended to fail? Will NIST just keep saying that software isn't good enough and that way they'll be able to answer the criticism that hardware is too expensive? * How selective is the group formation process? Are people really out for money? * There are supposedly several other groups interested in participating. Who are they? Is it RSA and PKP? * Is a software process really that much more insecure than a hardware based approach? Sure, it is easier to tamper with software, but given that we can always tamper with the software shell around the Clipper hardware, it shouldn't be _that_ much different. -Peter

1 0

gopher site
by Karl Lui Barrus 17 Dec '03

17 Dec '03

I forgot to mention I will take suggestions for what to place at the gopher site - for example, what 10 or so Clipper articles from the archives at soda.berkeley.edu MUST be available? I haven't read them all and won't have the time for the forseeable future to do so. Pointers and suggestions to other docs and files are welcome. Should I put stuff like appropriate rfc's and documentation (pgp and ripem, etc.) or not? All of this is subject to disk space and it may be I'll give preference to shorter items. I am leaning towards including the rfc's for PEM and the two for Rivest's MD4/MD5 hash algorithms. -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

2 1

Re: anon.penet.fi
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

>Solution: if you send to na12345(a)anon.penet.fi, then your mail won't >be pseudonymized; if you send to an12345(a)anon.penet.fi, then your mail >will be pseudonymized. Good. Therefore, remailers should translate 'Request-Remailing-To:' addresses like this: if ( /an(\d+(a)anon.penet.fi)/ ) { s//na$1/; } That is unless there are fifty other ways to say @anon.penet.fi. In which case, I would need to know the fifty ways. Is this reasonable? Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 1 Infinite Loop, MS 301-2C Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

NIST proposes software key escrow development
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

Peter Wayner <pcw(a)access.digex.net> writes of the NIST announcements to develop software-based key escrow. I think it would be utmost folly for software developers to work with the NIST and NSA on this or invest any time or capital. The fundamental requirement for NSA approval is the implementation of Skipjack in *software* in such a way that the algorithm is *protected* like it is in the booby trapped Clipper chips-- that is, impossible to deduce. But this appears to be complete *fantasy*. Any such system must rely on some kind of a hardware approach. But then we're back to where we've started -- Clipper and Capstone. Only the NSA has enough inbred, insular self-delusion to propose that 'secure' software is even a *possibility*. These companies could better spend their time proving that Fermat's Last Theorem is FALSE. (Hey Cypherpunks! I KNOW! what we need is a Secure Clipper Encryption Server that handles encryption via Email! Let's get the NSA to run it! Then it would *really* be secure! <SMIRK>) Furthermore, anyone who submits to this development is giving the NSA valuable (free?) development time for the purpose of, fundamentally, a KEY ESCROW SYSTEM. Now, perhaps someone can explain to me why a software system for depriving us of our rights is superior to one in hardware? Doesn't anyone have the faint glimmer of the idea that NSA, the *premier* cryptographic agency in the *world*, with unsurpassed technological and engineering prowess in the area, would have already *figured out* how to do this if it was *at all* feasible? Personally, I think this stinks putridly of an NSA decoy to simply claim or suggest that they're responsive to alternative solutions. This is nothing but a *cruel mirage* in a *barren desert*. >At the end, the group owns the intellectual property rights to >what is discovered. This may be something patentable and it could >be worth some money. I don't know how likely this is, but it >seems possible. In fact, it is probably the reason many of the >participants are willing to enter into the project. yes, that's *exactly* what we need -- another software patent. But this is just a meaningless dangling carrot. (They damn well *better* have rights to whatever they develop under private capital.) >The role of NIST is both gatekeeper and fascilitator. They get >everyone together and occasionally push things along. In this >case, they'll also offer some technical assistance which will >include feedback from the NSA. Dennis Branstad said that this would >most likely take the form of Siskel and Ebert-like ratings of the >systems proposed. The NSA would suggest, "Yes" or "No" but they >probably wouldn't go into details. This is because the procedure >would be unclassified and the NSA usually won't relate technical >details without classifying them. Take a LOOK at what you've written, and ask if this project has ANY CHANCE of succeeding. The NIST is proposing that a lot of companies put in work into a key escrow system in software, that the NSA has ultimate overruling veto power with *no explanation* of negative answers. This all to come up with something that the NSA ultimately must *accept* under the whole point of the proposal. What's the POINT?! Yes, sign me up today to do DEVELOPMENT WORK for the NSA on a KEY ESCROW SYSTEM. Let's put in thousands of man-hours to come up with something as fundamentally feasible in principle as perpetual motion! All for the sheer joy of the thought the NSA *might* pat us on the back! how could this be anything but the most PRODUCTIVE and REWARDING experience?! A company would have to be INSANE to go with this as presented! >* Is this process intended to fail? Will NIST just keep saying that >software isn't good enough and that way they'll be able to answer >the criticism that hardware is too expensive? you mean the NSA -- and does that answer your question? >* How selective is the group formation process? Are people really >out for money? I think NIST would be overjoyed to hear that anyone outside of NSA consultants is interested. >* There are supposedly several other groups interested in participating. >Who are they? Is it RSA and PKP? RSA, PKP, RSADSI, Bidzos -- that makes at least four, right? the KGB would also like a secure software system. Sternlight & Denning would surely sign up. Just another dangling carrot -- or rather, an apple with a razor blade inside. >* Is a software process really that much more insecure than a hardware >based approach? Sure, it is easier to tamper with software, but given >that we can always tamper with the software shell around the Clipper >hardware, it shouldn't be _that_ much different. is an ASCII text file really that much more pliable than a silicon computer chip?! I'm trying to be gentle, but you simply don't seem to get it! the NSA wants a software implementation of Clipper that is TAMPERPROOF and INVISIBLE. This is like asking for a way to send locked lead safes through phone lines! it's based on a fundamentally *bizarre* premise! We *cannot* tamper with Skipjack in its present forms of use -- Clipper and Capstone -- they would not exist unless the NSA had the tamperproof technology. And the first rule of software is that it is 'TAMPERLADEN'! ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: NIST proposes software key escrow development
by doug＠netcom.com 17 Dec '03

17 Dec '03

an12070(a)anon.penet.fi said: >I think it would be utmost folly for software developers to work with the NIST >and NSA on this or invest any time or capital. Clearly this is true for cypherpunk sw developers, but others see an opportunity to make some bucks. >The fundamental >requirement for NSA approval is the implementation of Skipjack in >*software* in such a way that the algorithm is *protected* like it is in >the booby trapped Clipper chips-- that is, impossible to deduce. > >But this appears to be complete *fantasy*. Any such system must rely on >some kind of a hardware approach. Not necessarily. Zero knowledge proof techniques, for instance, can be applied to make source code as impenetrable as one wishes. This tends to carry a heavy runtime overhead, of course. And even hardware solutions can be reverse engineered. In fact, it's guaranteed to happen eventually. Triple layer metal interconnect chips can be selectively peeled via ion beam etching to reveal them to scanning tunneling electron microscope probing. Camouflage in the form of unnecessary functional units that mask actual operation can be uncovered by data flow analysis. Such a project would be extremely expensive...but someone will eventually do it. The Mafia or the KGB, for instance, if no one else. >Doesn't anyone have the faint glimmer of the idea that NSA, the *premier* >cryptographic agency in the *world*, with unsurpassed technological and >engineering prowess in the area, would have already *figured out* how to do >this if it was *at all* feasible? I think everyone assumes that the NSA is technologically several steps ahead of the game at all times, and clearly they have their own agenda. Some people just don't see their hidden agendas as threatening. C'est la vie. I think it makes for a very interesting chess game, myself. The NSA is attempting checkmate, but they're not strongly enough positioned to do so. In chess parlance, it's a bluff, but one with enough steel behind it to force a response, which gives them a minor but real tactical advantage. The obvious counter-response is to advance a pawn towards queening...which is already in progress. I'm reasonably happy with what the NSA appears to be doing in regard to foreign intelligence gathering; it's their domestic agenda that threatens the constitution. But that's in the nature of spook organizations. "Eternal vigilance is the price of liberty." Doug

3 3

Re: gopher links
by doug＠netcom.com 17 Dec '03

17 Dec '03

henry strickland <strick(a)versant.com> said: >(p.s. I have no idea why they call them "cool" links) "cool" links are the opposite of "hot links". The latter are active; nontrivial computation is done when the link is followed. The former are passive and merely point to information. Hypertext jargon. Then again, the man page you quoted implies that the author just thinks that such things are cool. Doug

1 0

software key escrow ruse
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

Isn't it obvious? 1. People try to do key escrow in S/W (rather than refuse to play along with key registration) 2. By doing so, they lend apparent approval to the idea of registration. 3. The S/W effort fails, of course. 4. Conclusion: S/W encryption is no good and must be abandoned because you can't do key registration that way. It is important not to entertain the notion of registration, even as an academic exercise, lest the effort be used to claim that some reasonable person believes key registration is OK. - Carl

1 0

Re: gopher links
by strick -- henry strickland 17 Dec '03

17 Dec '03

<root> writes to me: # strick wrote: # > (Just for the halibut I tried "gopher gopher.uu.net" and # > "gopher ftp.uu.net" but no dice. If you were using WWW instead # > of gopher, you could link "ftp://ftp.uu.net/inet/rfc/rfc1321".) # # Gopher can link to ftp directly without the destination being served by a # gopher server. RT*M: (p.s. I have no idea why they call them "cool" links) Actually, I have RT*Protocols, but the original protocols, not the one you describe here. Come to think of it, it looks like this is executed by the gopher server, since it also has a "exec" option. Not so efficient for ftp, but the old client-server protocol would still work. Karl, if this works with your gopherd, you should abuse it ... strick # GOPHERD(8) # # # ADDING COOL LINKS # One cool thing you can do with .Links is to add neato ser- # vices to your gopher server. Adding a link like this: # # Name=Cool ftp directory # Type=1 # Path=ftp:hostname@path/ # Host=+ # Port=+ # # Name=Cool ftp file # Type=0 # Path=ftp:hostname@file # Host=+ # Port=+ # # Will allow you to link in any ftp site into your gopher. # Make sure that there is a /tmp directory to store the # files for the gateway. Note that if you're running with- # out the -c option, you must create a "tmp" directory at # the top level of the gopher-data directory. # # Another neat thing you can do is to execute shell scripts: # # Name=Execed command name # Type={a type} # Path=exec:"args":/scriptname # Host=+ # Port=+ # # This is usually used by other types of gateway scripts. # For instance, The first script might take a search and get # a few hits. It could then generate "exec" scripts that # would retrieve the actual document the hit referred to. # # Note that the scriptname *must* begin with the magic char- # acter "#!/". It also must be executable. #

1 0

So. Calif. Cypherpunks Outreach
by jkhastings＠aol.com 17 Dec '03

17 Dec '03

"State Evader" comes out of the Green Dragon Tavern BBS (213) 365-1132 pseudonym closet to shamelessly promote his upcoming speeches at the H.L. Mencken Forum and the Libertarian Party of CA Region 62 Los Angeles Westside: ------------------------------------------------------------ State Evader = J. Kent Hastings Assistant Director of the Agorist Institute, "Techtics" columnist for the Tactics of the Movement of the Libertarian Left newsletter, internet cypherpunk, and ham radio operator WA6ZFY. Both speeches will be on the topic: "Cyber Cash: Free Market Money Comes of Age" I will talk about untraceable digital cash, public-key cryptography, spread-spectrum radio, un manned vehicles, and the latest government actions that threaten everyone's privacy: The Clipper/ Skipjack key escrow agents and the subpoenas served to the Austin Code Works and ViaCrypt for all PGP, RSA export info. -------------------------------------------------------------- Mencken info: (310) 289-3234 (reserve now!) L.P. info: (310) 477-6491 -------------------------- Mencken location: The Old Spaghetti Factory 5939 Sunset Blvd near Hollywood Freeway in L.A. Wednesday September 22, 1993 6:30 Libatio ns, 7:00 Dinner, 8:00 Speaker, 10:00 Adjournment First time "virgins" reserved: $3 -------------------------------------------------- L.P. of CA Region 62 L.A. Westside: Chris's Italian Restaurant 10105 Venice Blvd. at Clarington Ave Thursday, September 23, 1993 Cocktails 6:30, Dinner 7:00, Talk 8:30 Not sure if admission is charged. ---------------------------------------------- Kent - <jkhastings(a)aol.com>

1 0

more deranged lunatic ravings -- just delete 'em!
by L. Detweiler 17 Dec '03

17 Dec '03

From: "Perry E. Metzger" <pmetzger(a)lehman.com> >Why all this silly speculation? We will all know the complete answers >soon enough. There is no need for us to reach out and "investigate". ah yes, just like everyone 'soon enough' knew the 'complete answers' behind the Steve Jackson Games investigation. All we have to do is sit around and wait for it to be handed to us by everyone involved, including The Enemy. Look at that E911 investigation -- this was an example of *community* involvement. Laywers on *both* sides were unaware of the fact that E911 documents were publicly available, that they could even be *ordered* from Mountain Bell with no restriction, until someone 'out there' made the link and pointed it out -- and this was a *very* significant aspect of the defense case. >"We" need no information. We are not the attorneys. EFF and the rest >are involved and have fine lawyers and investigators. Anything "We" >uncover will be useful only for personal amusement. the situation *directly affects* us *now*. what is the scope of the grand jury investigation? could it potentially be *expanded* beyond this initial inquiry? what about sites that are currently distributing PGP outside the U.S.? what about the fact that cypherpunks have *always* been closely involved with PGP and its international distribution? >"We" don't even >have our facts right -- the "NSA" has not been directly harassing >ANYONE. say *what*?! Grady Ward has been posting for over a week on a bazillion Usenet groups that Agent X from the NSA has contacted him, with a phone number, fax, and identification standard for NSA employees (I forwarded one of his early messages here). A representative from Austin Code Works informed a Cypherpunk (who wasn't afraid to do a little poking around himself) they have been prodded by the NSA months prior over DES export. And "the NSA has not been directly harassing ANYONE." well, yes, I guess they haven't stuck anybody on the rack, if that's what you mean. >I'd calm down, Mr. Detweiler. Write some code -- its a productive >persuit. ah yes, I'm 'persuing' the sequels to PGP and Moby Crypt right now <g> you seem to be fundamentally averse to excitement. this is the Cryptographic Case of a decade, and we're all to just wait patiently for the bleached official reports prior to a proper, dainty discussion? not I. but in deference to you, Mr. Metzger, and others, I will not post any more speculation ... without some new juicy articles to speculate on :)

4 6

GOPHER: misc
by Karl Lui Barrus 17 Dec '03

17 Dec '03

Thanks for the feedback about links - I didn't read that far in the server.doc! It looks like I could point to the EFF gopher for legislation and stuff, if they wouldn't mind...? But, stuff I link to has to be available from another gopher, right? I mean, I just can't point to a directory on some machine and have gopher retrieve the file for viewing? Or can I? Because I definitely would like to have the RFC's and message digest stuff viewable, or pointed to. Also, will gopher uncompress a file before displaying? I think I should read the gopher FAQ :-) And look at WWW when I have some time. Also, where is the "Digital Silk Road" paper? I'd like to put the text version in the "Digital Cash" section. I'd also like to put the two reports at cwi up, but those are postscript... gopher.wustl.edu has a TANTALIZING menu item for the ftp site, but I got a connection refused message. I need to talk to Chael to see exactly what kind of disk space we have to work with - it looks like to me an ftp option retrieves files to the gopher site (chaos). I put up some more stuff, including remailer public keys, but not much more on anonymous mail and still nothing on clipper. -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

3 2

Re: Does this seem illegal to you?
by George A. Gleason 17 Dec '03

17 Dec '03

Sprint TeleMap: You've been after this woman who gives you the ultimate hard-on, but she won't play. Every night you write her another letter, pouring out your heart, begging for her hand, telling her all the lucious things you'll do with her once she comes to her senses and lets you into her life. Lately you've been getting your letters back,"return to sender, no such addressee" in purple Post Office ink. But no matter, you call her number, and get the recording with her new number. You've been getting angrier lately, as she's changed her number three times now. If only she would let you into her life, you'd make wonderful music together by the moonlight- but No!, she just won't play. The anger has been building, and lately you've been taking to leaving more and more desperate messages on her answering machine. She's really getting to you now, you want to teach her a lesson, a lesson she'll never forget. You've been trying to follow her car home from work, but for some reason she's not driving the same car or taking the same route; she might even have changed jobs. Boy oh boy, you'll teach *her* a lesson, teach *her* to say No to you! You feel inside your jacket, where your .38 is carefully tucked. Yeah, teach her a lesson for sure! And lo, a Sprint payphone! You dial the 1-800 number and ask for directions... give them her last known phone number... the seconds tick by, your head whirling with the things you're going to tell her and make her plead with you.... a second or two later, the operator comes back on the line. Go right at Harbor... left at Main... two blocks down to Third, second house on the left. Aha, there we go. Thank you, operator. A warm bulge rises in your pants as you contemplate your next move. Boy are you going to teach her a lesson! This special moment brought to you by Sprint TeleMap. ,

3 2

Attn: P. Metzger and an36440, please delete this immediately
by L. Detweiler 17 Dec '03

17 Dec '03

Forwarded from J. Bidzos. this actually *strengthens* the NSA theories. (go ahead, flame me some more. I've been called, culling from all the best, a ``screaming, ranting, hysterical, yammering lunatic running about like a headless barnyard fowl just adding noise and confusion'' -- can anyone top that?) I'm leaving out Bidzos' email address so he is not harassed any further than I've already done :) ------- Forwarded Message Date: Sun, 19 Sep 93 11:17:18 PDT Message-Id: <9309191817.AA10201(a)RSA.COM> To: ld231782(a)longs.lance.colostate.edu In-Reply-To: "L. Detweiler"'s message of Sat, 18 Sep 93 17:24:41 -0600 <9309182324.AA10638(a)longs.lance.colostate.edu> Subject: PGP & Moby Crypto investigation PKP, RSA, nor I have anything to do with this subpoena business. No complaint has been filed. This looks to be an investigation into violation of export laws, but I don't know. ------- End of Forwarded Message

2 1

Re: Definition of "Zero Knowledge"
by doug＠netcom.com 17 Dec '03

17 Dec '03

From: khijol!erc(a)apple.com (Ed Carp) >Thanks for the definition (but I knew that, anyway). Sorru I wasn't clear - >what I was looking for was examples of how zero-knowledge proof techniques >could make source code impenetrable. An arbitrary algorithm can be translated into a zero proof theory model that is intractable to functionally analyze. Its operations on inputs and outputs can take place within the realm of the intractable model, with the inputs and outputs being transformed from the encoding of the outside realm into an encoding useful to the realm of the model. The inputs and outputs are the queries and answers of zero proof theory. With such a thing, knowing every detail of the registers and instructions being executed at all times still wouldn't tell you what you really wanted to know. I'm unsure whether this has been published, let alone implemented; I just thought it was an obvious corollary back when ZPT itself was first published. It might have been discussed in the literature at the time, but if so, I've forgotten. I'm also not claiming this is necessarily a useful approach in practice, because the obvious ways of implementing such a thing would be more than a little slow. I suspect that it could be done efficiently with a little algorithmic cleverness, but I don't have evidence of that this instant. I'm currently designing something with very much the same flavor, but with somewhat different goals, and computational expense of the operators in the model is precisely the difficulty with that, too, so far. Doug -- Doug Merritt doug(a)netcom.com Professional Wild-eyed Visionary Member, Crusaders for a Better Tomorrow Unicode Novis Cypherpunks Gutenberg Wavelets Conlang Logli Alife HC_III Computational linguistics Fundamental physics Cogsci SF GA VR CASE TLAs

2 1

Re: NIST proposes software key escrow development
by doug＠netcom.com 17 Dec '03

17 Dec '03

Brad Huntting <huntting(a)glarp.com> said: >> And even hardware solutions can be reverse engineered. In fact, it's > >Why? The easiest way to foil SlipJack is to simply run another >encryption mechanism on top of it. Because we weren't (just then) talking about foiling it, we were talking about whether it could be figured out. Unless I misunderstood the discussion from careless reading, the point seemed to be that they wanted to make the workings of the chip secret. I was furthmore assuming that there would be motivation for people to figure out such secrets because it would help them do their own illicit decryptions, but that's getting slightly off subject. >> I'm reasonably happy with what the NSA appears to be doing in regard to >> foreign intelligence gathering; it's their domestic agenda that threatens >> the constitution. But that's in the nature of spook organizations. > >I dont know about you, but many of my best friends are "foreigners", >and many of them live in riskier situations than I do (both in the >US and abroad). Their need for privacy is at least as pressing as >mine. The argument that "we" can abuse the rights of "foreigners" >is nationallistic at best and jingoistic at its worst. That's not what I said. The charter of the NSA isn't to abuse the rights of your foreign friends. Now that you've raised the subject, I wouldn't be happy with the NSA doing so, either. I have friends outside the U.S. too. I just meant that countries do intelligence gathering on each other all the time as a matter of course, and most of that isn't abusive in nature, it's just the usual game of politics and defense etc. But I suppose it's silly of me to say something like that on a list with so many rabid paranoids; how could I possibly imagine that not *every* act of the NSA is inherently ***EVIL***!? Sigh. Doug

1 0

GOPHER: cpsr
by Karl Lui Barrus 17 Dec '03

17 Dec '03

I just discovered the CPSR gopher (gopher.cpsr.org) mirrors the cypherpunk soda archive, including the clipper directory there. So I'll figure out how to create a link to it. I don't know about cool links though; the only gopher sever and client I could compile on chaos (net BSD some.version) was gopher1.12S, and I don't think is has that functionality. Later, I'll give the gopher2.06 a try again. Plus, I've noticed that sometimes the name resolver can find chaos.bsu.edu, sometimes not, for whatever reason. So maybe I'll talk to Chael and see if we can't make a gopher login for telnet access. -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

1 0

Delete Me
by rwalters＠gtech.com 17 Dec '03

17 Dec '03

Hi, there... Please delete me from the cypherpunks mailing list. It's a little greater traffic than I expected... Sorry about the hassle, and thanks. R.

1 0

Restrictions on crypto exports
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Like L. Detweiler, I can't resist the temptation to speculate a little bit on the apparent legal crackdown on export of crypto. The relevant section of the law is the Arms Export Control Act of 1968, codified in sections 2751 and following of Title 22 of the U.S. Code. Section 2778 deals with control of arms exports and imports. In that section, the President is authorized to determine what are "defense articles"; the articles so designated constitute the "Munitions List". "Any person who willfully violates any provision of this section... shall upon conviction be fined for each violation not more than $1,000,000 or imprisoned not more than ten years, or both." So there are potentially very serious sanctions for violations of this Act. One interesting point is the use of the word "willfully". This has been held in several court cases to mean that the government must show that an accused not only exported munitions, but that he did so knowing that it was illegal. Legally, this means that there must be a showing of "specific intent". For example, in U.S. v Lizarraga-Lizarraga, the appellate court wrote (in 541 F2d 826), "At trial and on appeal, the defendant admits that he purchased the ammunition and that he intended to export it to Mexico. His defense is bsed on the contention that he had no knowledge that his conduct violated the law. Hence, the appellant claims that to be found guilty under 22 U.S.C. 1934 [the predecessor to 22 U.S.C. 2778], the government must prove that he intended to violate the statute.... We agree, and hold that he was entitled to a specific intent instruction. Accordingly, we reverse his conviction and remand for a new trial." The justice discusses several reasons for concluding that "willfully" implies a need to show specific intent, among them that the articles on the Munitions List are not obviously illegal to export, finally concluding: "Accordingly, we hold that in order for a defendant to be found guilty of exporting under 22 U.S.C. 1934, the government must prove that the defendant voluntarily and intentionally violated a known legal duty not to export the proscribed articles, and the jury should be so instructed." There are several other court cases which agree with this conclusion. Therefore, the government will have to show not only that PGP was exported, but that whoever did it knew that the export was illegal. For example, the headnotes to U.S. v Malsom state, "Conviction for violation of 22 USC 2778 requires showing of criminal intent; use of circuitous shipment route to ship replacement parts for military airplanes supports finding of criminal intent." Apparently in that case the parts were shipped in a circuitous manner designed to prevent detection, and this fact itself was evidence that the defendants knew they were breaking the law. If PGP were exported overseas in some straightforward manner, such as being made available for FTP in the U.S., it would be much harder for the government to show criminal intent than if it had been written onto a floppy hidden in a crate of frozen vegetables or something. So it will be interesting to see how the government approaches the intent issue. Other interesting points come from the ITARs themselves, which implement this section of the U.S. Code. Subchapter M of Title 22 of the Code of Federal Regulations is the International Traffic in Arms Regulations. This subchapter encompasses sections 120 and following of that Title. Section 120 has mostly definitions, section 121 has the Munitions List itself, and the remaining sections deal mostly with regulations and reporting requirements. Category XIII of the Munitions List, Auxiliary Military Equipment, includes: "Cryptographic (including key management) systems, equipment, assemblies, modules, integrated circuits, components or software with the capability of maintaining secrecy or confidentiality of information or information systems". It is followed by a long list of exceptions, and exceptions to the exceptions, none of which appear to apply to PGP or RSA. So on the face of it, this appears to be a fairly broad prohibition on the export of cryptographic software. However, there is an interesting sentence in part 125 of this subchapter. In 125.1(a), it says, "Information which is in the 'public domain' (see section 120.18) is not subject to the controls of this subchapter." Note that by "this subchapter" it must mean Subchapter M, the entire ITAR. "Public domain" is defined in 120.18: "Public domain means information which is published and which is generally accessible to the public: (a) Through sales at newsstands and bookstores; (b) Through subscriptions which are available without restriction to any individual who desires to obtain or purchase the published information; (c) Through second class mailing privileges granted by the U.S. Government; or, (d) At libraries open to the public." So, this is a possible defense against a charge that exporting PGP or other RSA software violates the ITARs. If one could argue that the software was public domain, and that the software could be considered "information" (hard to argue against if it was exported electronically), then it is not covered by the ITARs. The public domain issue is not completely clear, but one could certainly make a case that software available on BBS sites or by FTP fell into categories (b) or (d) of the public domain definition, or at a minimum that the degree of public availability in these situations is very similar to that envisioned by the authors of this definition. Alternatively, the defense could argue that irrespective of whether a particular implementation was public domain, that the main cryptographic algorithm involved, the RSA cryptosystem, was certainly public domain by the letter of the definition. So, if there is a court case, I'd expect that this might be one of the main issues of contention between defense and prosecution. The last issue I'll mention is the meaning of "Export". This is defined in 120.10. "Export means, for purposes of this subchapter: (a) Sending or taking defense articles out of the United States in any manner, or... (d) Disclosing or transferring technical data to a foreign person, whether in the United states or abroad..." I've just listed the most relevant parts here. Several months ago, Jim Bidzos of RSADSI published a document attacking the legality of PGP, and in that document he claimed that making PGP available for FTP constituted export, and in fact that posting it to your neighborhood BBS also constituted export. (Ironically, a few weeks later there was a flap when RSADSI made its own RSA software available for FTP, and some foreign nationals downloaded it.) The presumed justification for this reasoning would be that making the information publically available in this way could "disclose" it to a foreign person. A similar argument was described in a very interesting post Dan Bernstein made to sci.crypt a few months ago. Dan was trying to get permission to export information about a cryptographic technique he had developed: Excerpts from a State Department conversation Daniel J. Bernstein 22 July 1993 Here are some excerpts, edited for legibility, from a conversation I had with Charles Ray of the Office of Defense Trade Controls on 26 March 1993. These excerpts are now in the public record. Please do not assume that the comments below reflect any official State Department position, although my notes list Charles Ray as a ``special assistant'' to DTC Director William B. Robinson. Dots represent omissions, not pauses. DJB means me. CR means Ray. DJB: What I'm trying to understand is: Suppose somebody makes some technical data which is a defense article, it's on the Munitions List, and goes to a library. The library agrees, and puts it on their shelves. Then ... doesn't that make it public domain, assuming that there are no contractual problems or anything? CR: Actually, that could be argued a number of ways. But it could also be argued that if the person made something that was a Munitions List item, and particularly if they did it knowingly and they put it in a public library where anyone has access to it, that it could be considered a violation of the Arms Export Control Act. It would I think depend a lot on their motives for doing it. [Material elided] CR: ... Hypothetically, if a person deliberately created a Munitions List item, and deliberately placed it in a public library so as to evade the restrictions ... I think that person might still find himself or herself subject to certain sanctions should there be an incident of this information falling into the hands of a foreign entity. So, here Ray is basically making that same argument, that putting something into the public domain by putting it into a library could itself be considered "export" if it resulted in a foreign entity getting access. So, the government may be trying to set up a "Catch 22" situation here, where any attempt to make information "public domain" will be automatically considered an attempt to export it. I would think that the defense could come up with some good replies to any attempt by the prosecution to make this argument. The ITARs are intended to control foreign export, and it appears to be a large extension of their power to attempt to control what things American citizens may take to their own domestic libraries. Of course, people should remember that the investigation is still at an early stage now. The grand jury may or may not decide to issue criminal charges; if they do, the accused may choose to plead guilty to a lesser charge rather than take the risk of a court battle; even if the matter goes to court, the accused will of course choose his defense based on his own considerations of advantage. It's not clear that even a favorable court decision will free the flow of cryptographic software. Hal Finney hfinney(a)shell.portal.com

1 0

Congrats to STANTON MCCANDLISH - EFF Online Activist
by L. Detweiler 17 Dec '03

17 Dec '03

Congratulations to S. McCandlish, a longtime BBS operator, cypherpunk loyalist and PGP promoter, who, if nobody else noticed, just won the coveted Online Activist position advertised by EFF some weeks ago. He has plans to put together an EFF BBS and archive on a fast machine with Internet connectivity. He'll be moving to Washington D.C. by October and running his previous BBS from there. Hope to hear more from him here on his progress! Maybe he can sneak a few subversive cypherpunk rants onto the archive! :)

1 0

Re: more deranged lunatic ravings -- just delete 'em!
by an36440＠anon.penet.fi 17 Dec '03

17 Dec '03

>Look at the process here. The Grand Jury investigation gets followed, Finally, a voice of reason. The justice system must be followed by all sides, not just the defendant. While this is an important case, it's important to see it in perspective. The EFF and others have set themselves up to provide defense in just such situations. If you want to help them by gathering "evidence", good for you. But you aren't doing ANY good by ranting on a Internet mail list. We can all read the non-hysterical informational postings to see what's happening. Mr. Detweiler, you are just adding noise and confusion. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Bobby Ray Inman wants ciphers restricted!
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Here's another one of those apparent "trial balloons," this time from an influential former Director of the NSA. As DIRNSA, Admiral Inman was the one who in the late 1970s proposed restrictions on the use of public key cryptography, at least according to Bamford in "The Puzzle Palace." Inman later was in the CIA, then MCC in Austin, and is now involved in venture capital in various ways. I believe his VC firm invested in Cylink, one of the four partners in Public Key Partners (the others being RSADSI, Stanford, and MIT). (Paranoids like us might look for links to Mykotronx....) Enough speculation for now. Here's the item: From: howard(a)hal.com (Howard Gayle) Newsgroups: talk.politics.crypto,alt.politics.libertarian,comp.org.eff.talk,alt.privacy.clipper Subject: von Mises Inst. Free Market article on Clipper Date: 19 Sep 1993 16:29:34 GMT Message-ID: <27i1de$edv(a)hal.com> Reply-To: howard(a)hal.com (Howard Gayle) Summary: Government subsidies imply government control. Keywords: Bobby Ray Inman, NSA, registration, EFF The September 1993 issue of "The Free Market" has an article by Gary McGath about Clipper. "The Free Market" is a monthly non-technical newsletter from the Ludwig von Mises Institute. Gary McGath is the publisher of the "Thomas Paine Review." Here's a quote: "Bobby Ray Inman, former director of the NSA, has even proposed `a registry of institutions which can legally use ciphers,' as he explained in his recent book. `If you get somebody using one who isn't registered, then you go after him.'" McGath also mentions the EFF: "The Electronic Frontier Foundation, which opposes the Clipper, still applauds legislation to subsidize network access. But by inviting the government to build their `highway,' EFF is inviting in the traffic cops. "The only way to keep our communications free of governmental intrusion is to keep them free of governmental involvement." -- Howard Gayle HAL Computer Systems, Inc. 1315 Dell Avenue Campbell, California 95008 USA howard(a)hal.com Phone: +1 408 379 7000 extension 1080 FAX : +1 408 379 5022 --

1 0

Statement from Zimmermann on PGP investigation
by Philip Zimmermann 17 Dec '03

17 Dec '03

Some of you may have received my Internet message of a couple of days ago about the ongoing U.S. Customs investigation of the exportation of PGP, which has now progressed to the level of Federal Grand Jury subpoenas. This earlier message was intended by me for distribution to a very small group of friends who previously communicated their concern about me and the investigation and asked to be kept informed. I did not send the message to anyone outside this group. Unfortunately, I did not adequately assert my desire that the message not be further disseminated. It appears that the message has gone completely public. This was not my intention. My lawyer, Phil Dubois, has been in touch with the Assistant U.S. Attorney (William Keane) assigned to the investigation. We have no reason to believe that Mr. Keane is anything other than a professional and reasonable person. He made it clear that no decision has been made regarding any prosecution of anyone for any offense in this matter. Such decisions will not be made for some time, perhaps several months. Mr. Keane also made clear his willingness to listen to us (me and my lawyer) before making any decision. It appears that both Mr. Keane's mind and the lines of communication are open. My fear is that public dissemination of my message will close the lines of communication and put Mr. Keane into an irretrievably adversarial position. Such a result would not serve any of our interests. My lawyer tells me that nothing irritates a prosecutor more than being the subject of what he perceives to be an orchestrated publicity campaign. He also tells me that his nightmares involve FOAs (Friends Of the Accused), invariably people with good intentions, doing things on their own. I understand that the issues involved in this investigation are of the greatest importance and transcend my personal interests. Even so, I would rather not turn an investigation into a full-scale federal prosecution. I ask that everyone keep in mind that the government's resources are limitless and that mine are not. Speaking of resources, many of you have offered help, and I am grateful. Those wishing to contribute financially or otherwise should contact either me or Philip L. Dubois, Esq., at dubois(a)csn.org or by phone at 303-444-3885 or by mail at 2305 Broadway, Boulder, CO, 80304. Mr. Dubois has just got on the Internet and is still learning how to use it. Donated funds will be kept in a trust account, and all contributions will be accounted for. If this whole thing somehow goes away with money left in the account, the balance will be refunded to contributors in proportion to the amounts of their contributions. This message can be widely circulated on public forums. Philip Zimmermann prz(a)acm.org 303 541-0140

1 0

Re: more deranged lunatic ravings -- just delete 'em!
by an36440＠anon.penet.fi 17 Dec '03

17 Dec '03

>First off, 'we' ARE involved. This case is IMPORTANT, and can have far- >reaching consequences for us. This reminds me of the old story that starts >out 'they came and got the Jews, and I said nothing because I wasn't a Jew...'. Funny thing about some people on this list and alt.conspiracy, the first line of defense to accusations of hysteria is often "Look at what happened to the Jews...". The Jews didn't have professionals employed to fight for their side of the argument, didn't have the justice system to provide a legal framework within which both sides must maneuver, didn't have a lot of what prz, et al., have. >The attorneys and other experts looking at this case apparantly don't share >your lack of enthuasism. Even in the very early stages, the groundwork that You make my case. "The attorneys". What exactly are YOU doing with all your yammering, besides making a loud noise? ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: more deranged lunatic ravings -- just delete 'em!
by doug＠netcom.com 17 Dec '03

17 Dec '03

erc(a)apple.com said: >Nope. That's not the point, and you know it. The point being (and I'm not >even sure why I'm bothering to explain this to you - you're intelligent) >this case has the potential to affect ALL of us, not just the participants >in the case. True. But the question is, specifically what are you suggesting "all of us" do right now? When I say specifically, I mean for instance not just "find out information about XYZ" like you said before, I mean the "and then what?" part as well. Most of us will probably do our best to learn whatever we can rather than ignoring the situation. But *then* what? What's your suggestion? >Well, scratching my crotch and looking important HAD crossed my mind. :) Besides that, I mean. :-) Doug

3 2

What can we do in the next few days?
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Lots of flames lately about "lunatic ravings" and what Cypherpunks can or can't do to help in the next few days. Here's my take on the situation: * Keep current, read all the various groups covering this. * Add articles and comments whenever you have something to say. Your argument might help one of the lawyers make his case. (One of "our" lawyers, one hopes.) Hal Finney's article this morning falls squarely into this category. We may have few lawyers amongst us, but we can contribute comments and background items that the lawyers may find useful. Not much time left before the grand jury convenes on Wednesday, but time to help after that. I agree of course with the sentiment that "Cypherpunks write code," or at least write text on semi-technical topics, and agree with the current focus of our group on stuff like remailers, digital cash, data havens, and the like. The EFF, CPSR, and ACLU are already focussed on issues of legal cases, privacy laws, etc., and are staffed with mostly lawyers and legal-background folks. We fill a niche they cannot fill. * Phil Karn and others have written about DES implementations that are already described, published, etc., both inside and outside the U.S. This may help with the precedent issue, namely, establishing that DES is already widely available (in case this is an important issue). In particular, see the messages a few days back about compiling a list of published DES (and IDEA, too) codings. Add to the list if you can. Cypherpunks can help on this, if they have some experience with DES, IDEA, and the like. Perhaps after the indictment (I'm guessing there'll be one) we can find out from the lawyers if our backgrounds in hacking and crypto can be tapped to help in the defense. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

2 1