December 2003 - cypherpunks-legacy

NSA technology transfer (fwd)
by Dan Harmon 17 Dec '03

17 Dec '03

I'm reposting this in response to a few recent posts inquiring about the NSA flyer. ---------- Forwarded message ---------- Date: Tue, 14 Jun 1994 00:21:30 -0500 (CDT) From: Dan Harmon <harmon(a)tenet.edu> To: cypherpunks(a)toad.com Subject: NSA technology transfer The following was posted on the list in the middle of May. Being curious I called the number list at Ft. Meade. The person on who answered was real shaken, for lack of a better term, that I called, it seems that this was the second inquiry that day. He wanted to know various things, like where did I get the information, was my name Bruce.... After a few minutes he finally took my name and said, to call him in a week to 10 days if I did not here from him. A few day later he called and said I needed to send a letter to expressing my interest in the technology. About 10 ten days after that I called to inquire if he received my letter and what was the next step. It seems that there had been quite a few requests and that they were trying to determine whether or not they were going to allow the technology to be transferred to individuals. The person said to call back in 4 or 5 days. I called today and they said in essence that they were not going to let individuals have a shot at it. They said that they were going to charge stiff license fees, that you would need to show a plan of how you were going to develop the product..... You get the point. It is obvious that they really don't want to transfer the technology. And if they do it will be to someone with deep pockets and who they like. I wonder where the fees that they want to charge will go, to the general treasury or to their own budget? More later. Dan Harmon On Thu, 19 May 1994, Anonymous wrote: > > > Newsgroups: sci.crypt,alt.security,alt.privacy > From: schneier(a)chinet.chinet.com (Bruce Schneier) > Subject: "Interesting Stuff" Checkers at the NSA > Message-ID: <Cq2934.q0(a)chinet.chinet.com> > Organization: Chinet - Public Access UNIX > Date: Thu, 19 May 1994 17:40:15 GMT > > This is from a flyer that NSA people have been distributing: > > NATIONAL SECURITY AGENCY -- TECHNOLOGY TRANSFER > > Information Sorting and Retrieval by Language or Topic > rest elided

3 3

sci.crypt archive ftp site
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

There's one at ftp://rpub.cl.msu.edu/pub/crypt/sci.crypt But I just looked and it only has up to April 94. By the way, everybody should check out http://www.quadralay.com/www/Crypt/Crypt.html ftp://furmint.nectar.cs.cmu.edu/security/README.html These are two budding cypherpunks WWW sites. Somebody's been busy. "Cypherpunks weave Webs!" Jim_Miller(a)suite.com

1 0

Re: Security for under a buck fifty
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

At 9:42 AM 7/12/94, Mike Johnson second login wrote: >>[Ben.Goren(a)asu.edu [me] wrote about generating pass phrases from >>true random numbers, mapping into a character set, creating mnemonics.] > >I already do this -- except that I use a keystroke- timing program for >the true random source, and I do the mnomonic generation with my brain >instead of the program. My program just converts the random numbers to >uniformly distributed printable ASCII (values between space and del), for >a little more entropy than 6 bits per character. The tradeoff is between number of characters needed (length of passphrase) and diversity of character set. I'd probably have better luck with the mnemonic if I didn't have to fit in a whole string of %*$@!, but that should probably be a user setting. >A more automated way to generate a pass phrase might be to convert every >16 bits of random numbers to one of 65536 words and names in your >favorite languages. That way, you would have real words to memorize, but >in a strange order. For example, a 128 bit key might be: >tree elephant action roof xymurgy eight top slash. > >You could try to think of some story to link the 8 originally unrelated >words together and help you to remember it. Another possibility: have a dictionary of different parts of speech and assemble them in order. For a short example, each passphrase could be in an order such as: Article adjective modifier noun verb article adjective modifier noun. Our favorite would fit: The quick brown fox jumps over the very lazy dog. This looses entropy (Mallet knows the order, and probably the dictionaries) and so you would want either a longer sentence or some other modification, like random--not decided by the person--capitalization or character substitution. Or have two sentences: The quick brown fox jumps over the very lazy dog; a lovely ermine glove fits into the hazy slumping bucket. Figure thirteen bits each with dictionaries of ten thousand each adjectives, modifiers, nouns, and verbs--your final dictionary would be 40 thousand words, total; you'd need about ten words to get 128 bits. Make that two shorter--eight word--sentences, restricted to easy-to-remember orderings, and you've more than made up for whatever entropy was lost in having a known structure. Umph. I think I need to start making time to write code, if I want to see this work. b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): Protect your privacy; oppose Clipper. Voice concern over proposed Internet pricing schemes. Stamp out spamming. Finger ben(a)tux.music.asu.edu for PGP 2.3a public key.

2 1

Re: Gov't eyes public-key infrastructure
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>>The U.S. government intends to operate a public-key certification >>system for government users that will also serve the private sector, >>as well. But a report just completed by Mitre Corp. for the National >>Institute of Standards and Technology (NIST) puts the price tag at >>$1 billion for the start-up of the government alone, with a possible >>$2 billion annual operational cost for managing certificate-revocation >>lists. > >All in all, I'd say this is a pretty good argument for PGP's web of trust >model... Especially given that urban folklore about everyone being only 5 hops away on the network of life. I.e. Everyone is a friend of a friend of a friend of a friend of a friend of anyone else. This was sort of troped upon in "6 degrees of Separation", the John Guare movie/play. If anyone had any concrete data about this, then it might be interesting to calculate the optimum number of people you should get to cosign your public key. Anyone remember enough about Ramsey numbers and Graph Theory? -Peter > >Phil

3 2

Re: Idle question...
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tcmay(a)netcom.com (Timothy C. May) on Tue, 12 Jul 12:14 PM >I used to know the ftp site that had archives of all >sci.crypt articles. If it's still active, anybody know >what it is? >From Cyptography FAQ of July 7, quote: Sci.crypt has been archived since October, 1991 on: ripem.msu.edu:pub/crypt/sci.crypt/ (available only to US and Canadian users) Another site is rpub.cl.msu.edu:/pub/crypt/sci.crypt/ from Jan 1992. End quote.

1 0

space contractors must use only "approved" encryption devices?
by Stanton McCandlish 17 Dec '03

17 Dec '03

[The person that forwarded to us noted: "It is relevant to the current efforts regarding encryption systems, specifically, it is the first instance that I have seen where the Federal Government will require non-government entities to use only government approved encryption...So much for the contention that no one would be forced to use Clipper."] Please note that the included article was NOT written by the person who actually posted it to the network. The author currently does not have Internet access, and has had to have a friend-of-a-friend post it for him. See the note from Bill Higgins just after the headers below. From: higgins(a)fnalv.fnal.gov (Bill Higgins-- Beam Jockey) Newsgroups: sci.space.policy Date: 28 Jun 94 19:49:02 -0600 Organization: Fermi National Accelerator Laboratory [Wales Larrison has been off the Net for a while and still can't post. But, through a friend's account, he has managed to send me a fresh installment of his commercial-space newsletter. Glad to help post it. This is part 1 of three parts. --Bill Higgins] SPACE TECHNOLOGY INVESTOR/COMMERCIAL SPACE NEWS -- No. 24 [edited for brevity] 3- US COMMERCIAL REMOTE SENSING POLICY FINALLY SET On 9 March, the Clinton administration finally released the official administration policy on commercial collection and sale of high- resolution satellite images. This policy allows the US Department of Commerce to license U.S. companies to operate private remote sensing space systems and sell images from those systems to domestic and foreign customers. Notably, it sets no limits on the resolution of imagery that can be sold. Under this policy, US firms desiring to operate such space systems must apply for a license from the Department of Commerce, in accordance with the Land Remote Sensing Policy Act of 1992. To get a license, each firm must: - maintain a record of all satellite tasking for the previous year and to allow the US government access to this record. - operate the satellite in accord with the characteristics submitted in the license application (although changes can be submitted for approval) - obtain appropriate export licenses for foreign sales of data or hardware. This specifically includes transfer of export sensitive components, subsystems, and information concerning remote sensing space capabilities which are on the US Munitions Control List. Transfer of such sensitive technology can be made available to foreign entities only on the basis of a government-to-government agreement. [*****************************************************************] - use only approved encryption devices, since the US government retains the right to deny unauthorized access to this data to others during periods when national security, international obligations and/or foreign policies may be compromised (as provided for under the LRS Policy Act). [*****************************************************************] - use a data downlink format that allows the US Government access and use of the data during periods when national security, international obligations and/or foreign policies may be compromised (also as as provided for in the Act). - allow the US government to limit data collection and/or distribution when national security or international obligations and/or foreign policies may be compromised. Such a limitation may only be imposed when the Secretary of Defense or the Secretary of State, and the Secretary of Commerce agree to this. Any such decision can be appealed directly to the President. - Pursuant to the Land Remote Sensing Policy Act of 1992, licensees must notify the government of intentions to enter to significant agreements with foreign customers. Under these policy guidelines, a license to Lockheed for a high- resolution space remote sensing satellite was granted on 22 March. [Commentary: I was starting to wonder if any more of the commercial remote sensing licenses would make it through the licensing system. Lockheed originally submitted their license application back in June of 1993, and under the statues which govern the licensing process, they were supposed to have had a ruling on their license within 120 days. The policy apparently hung up until the National Security Council (in particular the State Department, DoD, and CIA) could come to an agreement about how to handle such data in times of crisis. The concern expressed was legitimate -- similar data could have compromised US and allied forces during another situation like Saddam's War in Kuwait/Iraq. During that crisis, SPOT and Landsat voluntarily limited access to data from the Middle East -- but everyone involved recognized some procedure needed to be agreed upon and put in place rather having to work the situation on an ad-hoc basis. The commercial firms planning for high-resolution commercial remote sensing systems seem to fairly pleased with the new policy, and other announcements of license filings are rumored to be in the works. (See below.)]

1 0

Administration Buys Off EES Patent Holder (fwd)
by Stanton McCandlish 17 Dec '03

17 Dec '03

Date: Mon, 11 Jul 1994 14:53:56 -0700 From: "Brock N. Meeks" <brock(a)well.sf.ca.us To: com-priv(a)psi.com Subject: White House Pays CyberWire Dispatch // Copyright (c) 1994 // July 11 // Jacking in from the "Blank Check" Port: Washington, DC -- The Administration will today announce it has sidestepped the threat of patent infringement lawsuit involving its Escrow Encryption System, commonly known as Clipper. The solution: Toss the original patent holder a blank check and buy him off. The National Institute of Standards and Technology (NIST), the agency walking point for the White House on its proposed encryption Clipper encryption standard, has agreed in principle to license two key patents relating to the technical workings of the key escrow system from patent holder Silvio Macali, an MIT professor. The government's key escrow system depends on the capturing of digital "keys" that allow authorized law enforcement officials to unscramble Clipper encoded speech or Capstone encoded data, including electronic mail. Macali, as it now turns out, thought up the idea and had the moxy to patent his scheme. Macali's inventions detail the process whereby a digital key is divided into pieces. Those pieces are then held by separate "key escrow agents" which now turn out to be hand picked government agencies; one is NIST the other a division of the Treasury Department. Those keys must be combined to successfully unlock the code that allows law enforcement officials to listen in. The license agreement effectively eliminates "concerns Macali raised about possible infringement of his patents," said NIST spokeswoman, Anne Enright Shepherd. It also sidesteps a potentially ugly lawsuit in which Macali lawyers could have uncovered all sorts of currently unknown information about the Clipper program. According to sources familiar with the negotiations, the government's agreement with Macali grants the Administration a nonexclusive license to the patents for use in current implementations of Clipper and Capstone and for future implementations, Shepherd said. It's not known whether the government will make a single payment to Macali or pay royalties. "The procurement phase of the agreement is still continuing," Shepherd said. Disclosure of the amount paid to Macali and details of the license agreement are expected to be made public sometime early next month, she said. That agreement, however, wont result in any user fees, Shepherd said. Questions Raised ================ Although the government's action today nullifies a pesky problem, it also continues to raise serious questions about the Administration's -- and more pointedly -- about the National Security Agency's ability to ramrod an encryption policy that has been elevated to the status of a national security issue. Surely the NSA or NIST can dial up the U.S. Patent Office and query its database, looking for patent conflicts. Apparently the clock and dagger crowd was too busy with other matters. Arrogance or oversight? "Macali made the existence of his patents known during the public comment period," Shepherd said. "He let the government know he had some patents that he felt were similar to some technology used by the key escrow system. So the discussions kind of began at that point," she said. Unfortunately, the "public comment" period was launched only after the White House trotted out its Clipper policy as set in stone. Nobody expected Macali to piss the parade. Privacy and civil liberties groups have roundly criticized the government for developing Clipper in secrecy, not allowing public debate on the issue. If that debate had taken place, Macali would have come forward years ago. Despite the Administration's continued efforts to push Clipper into the deep waters of the mass market, there are rumblings that it may not be christened after all. At very least, it may not be the only encryption standard blessed by the government. Several groups are now floating their own alternatives to the Clipper program. And although the National Security Agency is working behind the scenes to sink such efforts, NIST, at least, is making the appearance of listening. Earlier this year, NIST put out a call for the Cooperative Research and Development Agreement (CREDA), which was an effort to draw publicly interested parties into a cooperative venture to develop a key escrow alternative. Those that came forward have now thrown off working formally with CREDA, but have instead formed their own working group, government sources said. Those efforts are being heard and taken seriously, according to several government sources familiar with the discussions. "Encryption isn't a front page issue, but those [inside the Administration] working on this issue are tired of being beat up over it," said a White House official. Discussions on Clipper alternatives "are continuing," Shepherd said. "And we're still open to other alternative ideas and we're working with the people who have presented their own ideas at this point." Meeks out...

1 0

Re: Idle question...
by John Young 17 Dec '03

17 Dec '03

Responding to msg by berzerk(a)xmission.xmission.com (Berzerk) on Tue, 12 Jul 10:8 AM >On Tue, 12 Jul 1994, Graham Toal wrote: >> Subject: Didn't anyone note the A5 posting? > Does anyone have a copy of this posting? I would appreciate getting a copy of this posting also. John Young

1 0

The Detweiler Files
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

jamiel(a)sybase.com (Jamie Lawrence): > I have a writing assignment coming up (nothing to do > with much that is talked about on this list), and some > example posts by Detweiler could be really handy as > references. I have one from a long time ago, but could > use some others- anybody save any for posterity? If so, > could you forward me a couple of juicy ones? I have about 580k of 'Detweiler files'. These are sorted by mail from his presumed identities, mail to them and relevant mail about him. Separately stored are some of his gems, including his roman torture piece and S Boxx's poetry. You can't ftp _in_ to my SLIP node, but I can ftp it to some place convenient. Compressed, it should be about 200k (ZIP). ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

New National ID Card Proposal
by David Banisar 17 Dec '03

17 Dec '03

CBS Evening News just reported that Clinton has "tenatively signed off" on a National ID card recommended to him by a commission on immigration reform. The obstensive reason for the card is for employment and immigration. Each card will contain a name, photo, mag stripe with info and a "verified SSN." It was supported by Senator Alan Simpson of Wyoming, a long-time supporter of id cards. Gov. Pete Wilson of California has apparently offered to make California a test-bed for the proposal. The proposal was opposed by Xavier Beccera, a Congressman from California. A previous effort to impose a national id card was rejected by Congress in 1986. EPIC is working with Privacy International to investigate this report. PI has led successful campaigns aginst national id cards in Australia, New Zealand, and the Phillipines. In Australia, the PI-led campaign led to the dissolution of both houses of the federal Parliament in 1987 after hundrends of thousands marched in protest. The Australian campaign brought together groups from all parts of the political spectrum from the Communist Party to the Libertarian Alliance, farmers and conservation groups, rock stars, academics, large businesses such as banks and mining corporations, but the overwhelming support came from the public who created the biggest civil protest in Australian history. David Banisar (banisar(a)epic.org) Electronic Privacy Information Center 666 Penn. Ave, SE #301, Washington, DC 20003 202-544-9240 (v) 202-547-5482 (f)

1 0

NATIONAL SECURITY PORN RISK
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, Does anyone on the Cypherpunks Channel have any inside information about the "computer porn ring" that was busted at Lawrence Livermore Labs? Is there a crypto tie-in? S a n d y

5 4

Mailing List
by kevin＠beach.com 17 Dec '03

17 Dec '03

Please put me on your mailing list. Thanks Sincerely, Kevin T. Smith, President TeleSource A Division of SonRise Corp. (408) 247-4782 voice (408) 247-1070 fax ksmith(a)beach.com *************************************NeXTMail Preferred***********************************

1 0

ID card from hell
by Brad Dolan 17 Dec '03

17 Dec '03

Yeah, I know it's not about crypto but it sure is about privacy ... 1984 COMES ONE DECADE LATE July 12, 1994 On CBS News tonight, the lead story announced a government plan to require all of us to carry a national identity card. This card will contain your picture, a fingerprint, your social security number, and other "electronically encoded" information. You will be required to present this card to obtain employment or "receive government services." CA Governor Pete Wilson and Sen. Alan Simpson were featured explaining how this was a really great idea, necessary to "stop illegal immigration." Prediction If Americans accept this, as I expect they will, we will see the following: Cops doing card-scan roadblocks, ostensibly to find drunks and immigrants. A requirement to present your card and have a computer record kept after every financial transaction over, say, $100. A requirement to present your card to get medical care. Adoption of these cards as drivers' licenses. Just a magnetic / electronic data entry to indicate if you are authorized to drive. Same thing for professional licenses. Card-scan to buy guns or ammunition - if you are allowed to buy them at all. Card-scan to buy potentially subversive tools, chemicals, books. Card-scan on entry to or exit from the U.S. Instant database check to see if you are authorized to enter or leave the U.S. Card-scan on entry to or exit from "special" areas: an extra little security check before you enter places the government is taking an extra interest in. Mandatory presentation of card to get access to an internet- attached computer account. Card-scan at your kids' school. Linked databases of parents and kids, to correlate child support payments, vaccination histories, academic performance, truancy, antisocial attitudes, you name it. I could go on, but why bother? As an exercise for the reader: The federal government currently is encouraging states to revoke drivers licenses and professional licenses of "bad" people who use drugs, drive drunk, don't pay child support, etc. What will happen to you in the future if you displease the state? Brad bdolan(a)well.sf.ca.us

1 0

A Plea for Meaningful Message Titles
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

I don't often make requests for netiquette changes here on this list, but I will now. I have no power to enforce anything, so these are only suggestions. 1. Could we people make an effort to pick reasonably meaningful thread titles? A lot of "Re: your mail" and "(None)" titles are cluttering up the list. Not to mention the overly broad titles like "PGP" and "Question." In sorting through my list archives recently I found several hundred messages that contained variations on the simple phrase "PGP," most discussing points only loosely related to PGP. 2. People should feel free to edit the subject line to better reflect the topic of their post. This may "destroy the continuity of the thread," a concern raised by some, but that's a small price to pay for having new threads more accurately labelled. 3. Forwards are really getting out of hand. It seems that the "Four Letter Acronyms" of CPSR, EPIC, ACLU, and EFF (an honorary FLA) routinely copy us on everything they put out, even though their stuff is widely distributed in other forums available to us all, and none of them seems to be reading Cypherpunks and actually participating in followup discussions. (If Banisar, Godwin, Kapor, McLandish, et. al. are actually reading this, I invite them to prove me wrong.) 4. While I'm at it, could newcomers to the world of crypto please take the time to read up on some of the basic crypto isues? The lateness of my FAQ is not the issue, as the needed knowledge is contained in any of the basic FAQs that are already out there, such as the oft-republished sci.crypt FAQ and the RSA FAQ. And basic articles and books are readily available. This list is not a place to ask 500-600 people "What's so bad about Clipper?" or "Can't the NSA break any cipher with enough effort?" Thank you for your time. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

SPA & FBI after Pornographic traitors
by Brad Dolan 17 Dec '03

17 Dec '03

Sandy asked.... Associated Press reports today: Officials at one the nation's three nuclear weapons laboratories discovered their computers were used to store pornography, the Los Angeles Times reported Tuesday. Computers at the Lawrence Livermore National Laboratory contained more than 1,000 pornographic images, said Chuck Cole, deputy associate director of computing at the lab. [...] The computers were shut down after an investigation uncovered software piracy on the Internet, a network of thousands of computer networks originally designed to connect computers at universities and government research labs. It is now used by millions of people. "We are currently tracking over 1,600 pirate sites on the Internet in a joint investigation with the FBI," said Peter Beruk of the Software Publishers Association, which represents major software manufacturers. "It is a very serious and costly problem." [...] ----------------------------------------------------------------- Some people might consider the second paragraph a nonsequitur to the first. However, if one doesn't think too clearly about things, one might get the general message that we need Daddy to help protect us from the pornographers and pirates lurking out there on that internet thing. Brad bdolan(a)well.sf.ca.us

1 0

"True Names," chat with Vinge, and Cypherpunks
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Some random comments that may interest some of you. Someone asked me for some novels he could read that might cover some cypherpunkish topics. These are some titles I gave him: * Brunner, The Shockwave Rider * Vinge, True Names * Card, Ender's Game * Gibson, Neuromancer (He's currently reading Orwell's "1984," which is of Required Reading to remain on our list! I read '1984" when I was in the 7th grade, in 1966, probably before many of you were born.) Vernor Vinge's "True Names" comes up in another context: I spent all of Sunday talking to Vernor and several other bright folks in the aftermath of a great party in the hills of Marin County, right next to Skywalker Ranch. My mad scientist/entrepreneur friends Bob Fleming and Cherie Kushner, in whose startup company I've invested some money, had a party to celebrate something or other. As it turned out, noted author--and winner of the Hugo Award fpr Best Novel last summer for "A Fire Upon the Deep"--Vernor Vinger was giving a talk on cyberspace and whatnot at Interval Research on Friday, so they invited him to stay at their place. (Interval is doing futuristic work in a lot of areas, and is funded by billionaire Paul Allen, co-founder of Microsoft.) I don't plan to recap the party; that's just a party. But the discussions on Sunday (some of stayed over, due to the long distances back to our homes, or as with Vernor, in lieu of a night in a hotel) touched on point of interest to our list. Also there were Eric Hughes, who you all know, and Alan Huang, who built one of the world's first optical computers for Bell Labs. (Alan's project, which included work on optical switchers, terabit per second Sagnac fibers, optical cellular automata, and even crypto, was cancelled by AT&T because they decided to concentrate on other things....Alan chose to leave AT&T and is now planning a move to the Bay Area to set up something here.) In my years of being able to worm my way into high-power discussions, at universities, at Intel, and at too many conferences to remember, I can't recall being in such a conversation as this, with everyone of the highest possible caliber. (I'm just calling it as I see it.) Wormholes, reversible computation, the 7,000-Cray NSA computer, the problems with nanotech, the problems with AI, the Tines and the Powers, the Extropians group (Vernor was curious), the Singularity, and the implications of the OJ Simpson case were a few of the topics. (Yes, several of us had "wasted" our time watching this case. Me, I think it's drama of truly Shakespearean proportions, and should not be "dissed" just becuase it's getting more attention than the Rhwandans and Haitians are getting...not to mention the boring Bosnians.) I'd met Vinge a few times before, notably at the 1989 Hackers Conference, but this time I got to spend enough time to really get some information exchanged. We all left Bob and Cherie's place at 7 p.m., as they took Vernor down to the SF airport, and as the rest of us scattered. With all the telecommunications we have, nothing beats an intensive face-to-face session. Which is why I still live within driving distance of the Silicon Valley and the Bay Area in general. Sorry if this message seems too personal, but I felt the urge to "share." And at least it's not a forward. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway." -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

6 6

Re: NATIONAL SECURITY PORN RISK
by Blanc Weber 17 Dec '03

17 Dec '03

-- Excerpt -- One computer expert, who requested anonymity, said there might be more to the incident than meets the eye. The expert suggested that the hard-core pornography may be a cover for an ultra-sophisticated espionage program, in which a "sniffer" program combs through other Livermore computers, encodes the passwords and accounts it finds, and then hides them within the pornographic images, perhaps to be downloaded by foreign agents. -- End excerpt -- Maybe this is all just an excuse to examine the evidence (1,000 GIFs). Blanc

1 0

RE: "True Names," chat with Vinge, and Cypherpunks
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May Sorry if this message seems too personal, but I felt the urge to "share." ............................................ Oh, that's okay - I wasn't doing anything, anyway. Blanc

1 0

Encrypted, Chained Reply Blocks
by nobody＠ds1.wu-wien.ac.at 17 Dec '03

17 Dec '03

I noticed a message posted here, anonymously, with an "encrypted reply block" (ERB) attached to the end of it. Instructions were given that to reply to the message, the block was to be pasted at the very beginning of the reply, which was then to be sent to a certain remailer. The block started with the usual "::", followed by and "Encrypted: PGP" line typically used with chained remailers. While I don't know the specifics of that particular ERB, would it be possible to chain a REPLY through several remailers, such that the body of the reply was sent along in the clear through each link of the chain, but the final destination address was only visible to the operator of the final link in the chain? This would require that after the "Encrypted: PGP" block, any appended plaintext would also be sent along by each remailer and not discarded. Which remailers allow that? Hypothetically, it would seem that one could take an "empty message", using the "CHAIN" utility to chain the "message" through remailers A,B,C,D, encrypting it at each step, placing the resulting block in the message body with instructions that the resultant block must precede any replies, which must then be sent to remailer "A". Alternatively, instead of an empty message, a single, unique, identifying line could be used as the message. This would allow a person to generate multiple ERBs and know which one had been used for any given reply. One weakness I can see in such a scheme is that traffic analysis would be a bit easier, since the plaintext of the reply would be visible at each step. Also, there would be a potential for "hand tracing" the reply to its destination, assuming each remailer operator cooperated, by sending a personal message to operator "A", with the ERB attached, asking him/her to decrypt the next link destination, then forward the message to the operator of the next link with a similar request, and so on, requesting that the last operator in the link report the ultimate recipient's email address to the requestor. This would potentially be easier than tracing a message the other direction, since by the time the message arrived, information necessary to trace it backwards might have been already deleted at one or more of the chained remailer sites. Any thoughts or suggestions? Are there any further obvious weaknesses in this scheme that I may have missed?

1 0

Pseudonymous ID cards?
by analyst＠Onramp.NET 17 Dec '03

17 Dec '03

On the bright side, at least the Clinton administration is trying to stir up interest in privacy issues amongst the general public. Between the administration's support of Clipper, National ID cards, National Health cards and Digital Telephony (have they supported this yet?), there should start to be a lot of public interest in these issues. Personally, rather than _just_ naysay everything that is being proposed (which I will do, strongly), I would like more concrete recommendations and proposals to make on the positive side that use technologies like digital signatures and reputations to *protect* privacy while still allowing many of the familiar sorts of social/economic interactions that we take for granted. Perhaps we can pull an Aikido maneuver on this sudden gov power grab (ok,ok, pretty far-fetched). But, short of tracking down the Scientific American article from a couple of years ago and re-reading it (and I'm sure it's out of date), I'm not really sure what we can do with pseudonymous reputations and whatnot given the current state-of-the-art. So, I'd like suggestions, comments about alternative ways of establishing digital IDs, insurance cards, credit cards, etc. that protect privacy instead of divulge it, while still providing some of the societal controls that we have come to expect (e.g. that drunk drivers will be deprived of a license to drive). Do we have alternative suggestions to make in this dark hour so that we can actually win back some of our privacy? Can these sorts of technologies be implemented in a way that is understandable by the average citizen-unit? -- Benjamin McLemore analyst@onramp,net PS I wonder what exactly Justice and/or the spooks have on Clinton that's so effective? Or are he and Gore actually as stupid as they act?

1 0

Re:"True Names," chat with Vinge, and Cypherpunks
by analyst＠Onramp.NET 17 Dec '03

17 Dec '03

Any newer Vinge estimates of arrival time for the Singularity? I saw an article a while back by Vinge and I think he was estimating 2013-2030 timeframe. I've been thinking of starting a Singularity Watch type Web-page/email list, as I am often struck by technological newsbits that seem enough out-of-the-ordinary and potentially status quo shattering that they seem to indicate some sort of potential for breakthrough. Some recent examples: *human genome project *quantum mechanical teleportation *high energy ion bombardment of nuclei in Germany yields something besides quarks, gluons in protons (potential challenge to QCD, is this our photoelectric effect finally?) *quantum computing *etc Despite the romantic appeal of the idea, though, I think it is a bit farther off than Vinge imagines--maybe 2050. -- Benjamin McLemore analyst(a)onramp.net

2 1

cypherpunks email list help?
by Gerald.R.Martinez＠att.com 17 Dec '03

17 Dec '03

Anyone know the phone number of the cypherpunks list owner? I have tried for weeks to remove my duplicate email address entries from the list - probably placed there as a result of the email list scroggings of late... so far I have not gotten any response from: majordomo(a)toad.com (reply indicates request forwarded to cypherpunks-approval(a)toad.com) hughes(a)toad.com hughes(a)ah.com Any advice would be appreciated... thank you. -- gerald.r.martinez(a)att.com / grmartinez(a)attmail.att.com / att!drmail!grm @ AT&T GBCS Bell Labs, Denver (303) 538-1338 @ WWW: http://info.dr.att.com/hypertext/people/grm.html & life is a cabernet ...o&o )))

1 0

Re: NATIONAL SECURITY PORN RISK
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

> "Computer at Nuclear Lab Used for Access to Porn" >[ snip ] >-- Excerpt -- >One computer expert, who requested anonymity, said there might be more >to the incident than meets the eye. The expert suggested that the hard-core >pornography may be a cover for an ultra-sophisticated espionage program, >in which a "sniffer" program combs through other Livermore computers, >encodes the passwords and accounts it finds, and then hides them within >the pornographic images, perhaps to be downloaded by foreign agents. >-- End excerpt -- > > It's a Steganography reference. This sets off my warning bells -- >why would they explicitly mention the Stego technique, unless possibly it >was used in the porn ring there? Granted, Stego makes good journalism >fodder ("Hide your encrypted nuclear bomb plans in porn GIFs from the >Internet!"), but it's definitely not as sexy [sic] as "Taxpayer-funded >computers used in secret porn ring!" Anybody know exactly what was going >on at LLL? We can't get papers easily up here. :( > >-------------------------------------------------------------------------- >Michael Brandt Handler <grendel(a)netaxs.com> >Philadelphia, PA <mh7p+(a)andrew.cmu.edu> >Currently at CMU, Pittsburgh, PA PGP v2.6 public key on request >Boycott Canter & Siegel <<NSA>> 1984: We're Behind Schedule I think that the Steganography is just an excuse to close down the place. It _could_ happen, therefore we should defend against it. Of course, every spy knows that blending in is the most important trick. It would be better to hide the information in something bland. On the other hand, a gif-station is one of the few types of ftp sites that attract enough attention to drown out the one transfer from the spies.

1 0

Re: Pseudonymous ID cards?
by sidney＠taurus.apple.com 17 Dec '03

17 Dec '03

analyst(a)Onramp.NET (Benjamin McLemore) wrote: > digital IDs, insurance cards, credit cards, etc. that protect privacy I've seen articles about that here and/or sci.crypt and places like that. If you think in terms of cryptographic authentication of smaller pieces of information instead of a card that can reveal all about someone, it isn't too difficult. If a traffic cop wants proof that you have a valid driver's license, all they really need access to is the key to verify the authenticity of something that certifies that you have a valid driver's license. Your card can provide that certificate without revealing any other information about you than the fact that you are licensed to drive. The good thing about this kind of setup is that information can be partitioned so that only people with a reason to be authorized to get that information would have access to it. The bad thing about this is that it still makes it easy for the government to require that we all carry around a card that tells everything about us and makes access to all that only a matter of legal authorization. I don't want a society where my cryptographically secured private information is required to be shown at every police seatbelt/alcohol/immigrant/drug/pedophilia/sedition checkpoint. -- sidney <sidney(a)apple.com>

2 1

New version of Digital Telephony Bill?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

In the latest Wired issue (2.08) there is a small blurb about a new version of the Digital Telephony Bill that the FBI has presented. According to the blurb, a couple of Senators has expressed a willingness to sponsor this new version. Anybody have any more info on this? Jim_Miller(a)suite.com

2 1