December 2003 - cypherpunks-legacy

RE: personal manifesto (comments appreciated)
by Blanc Weber 17 Dec '03

17 Dec '03

Extended Commentary: 1) While the most likely possibility is that the Net will simply mirror current society, a Net of this [mirror] structure would fail to realize its potential as an agent of social change. COMMENT: That is, supposing that the net was designed to be an "agent for social change". I have not read where it was designed to exist for that specific purpose. A social effect which is not intentioned is simply a by-product of the fact that many people have found an avenue or tool useful for the satisfaction of their own particular purposes. Since communication itself is a medium for the accomplishment of most purposes which involve others; it is not exceptional, therefore, that the net should have become such a popular tool, it being so easy to use compared to the other means available. The important thing which I see about the net is not that it serves "social purposes", but that it helps individuals to achieve their *own* purposes. This sounds like only a difference in wording, but the difference is in what is judged as a 'good' purpose, or which end of the telescope you are using to view the situation: why is the end of having a collective 'good' better than the activity of simply achieving one's own ideal (of goodness, happiness, propriety, etc.). What is so unsubstantial about the uncounted individual that only a large number of them can be considered worthy of consideration. 3) Current arguments for regulation of cryptography by government agencies depend on the argument [that] they are maintaining their current abilities in the brave new world of cyberspace. I argue that even if this were the case, we have a responsibility to do more than simply maintain the status quo. . . . . COMMENT: What responsibility? (Irresponsible Unit wants to know) If the government centralizes responsibility, there will be none for the rest of us to comprehend. 4) It is the responsibility of the information haves to spread their knowledge to the information have-nots. ......... Knowledge which is not of a personal nature should be freely accessible. COMMENT: The library is full of information which many people do not take advantage of, and it's "free". Many wise people have written much that they wished to share with others, yet many 'havenots' do not avail themselves of it (at least, not the ones who seem to need it). 1) how much intellectual support does everyone need, anyway; 2) access to information does not replace having the incentive to appreciate it or the ability to understand it; 3) where does all this information come from, anyway? How did it become "information"; what was it before it was converted into an abstract form (carbon-based or electronic)? If it is moral to have information, and immoral *not* to have it, then many people are guilty of criminal negligence for not using their faculties of observation & thought in regard of all the data which exists all around them in an immediately accessible form. 6) ... People cannot participate in a democratic society if they are not educated to a minimal level required for functioning in that society. This is the crux of our societal problems, as well as the crux of possible problems with the Net. COMMENT: They should all understand the purpose of "society". Is it to be social, or to be free to be themselves, or what. If the purpose is more clearly stated and understood (and communicated to its members) then they each can decide whether, or how much, they wish to participate in its "goals". Societies are complex mixtures of people with all sorts of motives. At least on the net, it is easy to leave when your motives are in conflict, especially if your subscription is up. 7) ... one human has an enormous capacity to injure and exploit another human. We must decide which ability we wish to empower, and judge which we actually do. COMMENT: If everyone were equally able to injure & exploit others, people would become sensitive to what kind of effect they intended to achieve (upon others), and become more acutely attuned to the possible consequences. But if everyone was much more respectable & honorable than they presently are, there would be fewer reasons to attempt to bring harm to them; admiration itself would serve to prevent thoughts of evil deeds against those whose qualities one valued. You could as easily say that those who wish to be treated kindly should cultivate noble qualities and character, so that others will not be easily inspired to hit them over the head. 8) . . . My hope is that this restructuring will create a better society than the one I know. COMMENT: It would be possible to make society better, if people were not always changing their mind, developing new ideas, learning new things about themselves and the world, attempting to adjust to changing circumstances, and generally getting in each other's way as they accomplish all of these things. Pehaps if there were more space between people (like on the net), where they could engage in these activities without easily affecting others, this in itself could "improve" "society". But they always seem to want to grow up in each other's company, instead of doing their homework in private. 9) My beliefs are [hopelessly] utopian. . This faith must not be confused with [certainty]. . We must be satisfied with [approximations]. . I have faith in democratic principles to [shape society] . . . . . It is impossible to [predict the shape] of the society . . . . A few risks are of the [tyranny of the majority], ...... . The will of the people is [impossible to define], ..... COMMENT: I re-arranged your paragraphs to associate the meanings which I saw in them, and they do appear to be in conflict. 10) All actions have moral implications. Ignoring these implications is irresponsible and, yes... immoral. COMMENT: Se la vie'. Therefore what. Final comment: "Society" is in the quality of the contact. Blanc

1 0

Re: cfp '94 transcript
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

>Also note that the Fifth Circuit recently discarded the "exculpatory no" >defense to Sec. 1001. See _United States v. Rodriguez-Rios_, No. 92- >8257 (5th Cir. 2/11/94) (Smith, J.). Reported at 54 CrimLRptr 1528. > >Now, in the Fifth Circuit, you can't even say "No, I never did/say/thought >that" without committing a crime! I think this needs more explanation. I am not sure I understand what you are saying. What exactly is it illegal for you to say? -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.3 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

1 0

test
by Foetus 17 Dec '03

17 Dec '03

im verrry soorry to waste this message but I have reason to suspect some recent system changes have bungled my mail kinda harsh, so I'm testing this list.

1 0

Unrelated
by Robert A. Hayden 17 Dec '03

17 Dec '03

Sorry that this isn't on topic, but I figure with all the net surfers here, it couldn't hurt to ask. Anyone happen to know of a site where I can get the most recent Jargon file in either postscript or dvi formats? I know I could a2ps the text version, but if there is already a nicely formatted version, I'd hate to duplicate efforts. thanks. ____ Robert A. Hayden <=> hayden(a)krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> Political Correctness is \/ Finger for PGP 2.3a Public Key <=> P.C. for "Thought Police" -=-=-=-=-=-=-=- (GEEK CODE 1.0.1) GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++ n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

1 0

Re: cfp '94 transcript
by ag588＠cleveland.Freenet.Edu 17 Dec '03

17 Dec '03

> > >SINCLAIR DOUGLAS writes: > >> I'm not sure what the NSA policy is on this. However, at >> that same conference Jim Settle from the FBI told us >> plainly that he is allowed to lie, and that the courts have >> confirmed this right. I doubt Baker would have confessed >> to a back door even if one existed and the question was >> complete. > But wait! How do we know he's telling us the truth when he says he's allowed to lie? I mean, if he's telling the truth, then he might be lying, and if he's lying then either he's not allowed to lie or the courts have not confirmed this "right." On the other hand, if he's lying, then he might be telling the truth --- Aw, shit. You can't even trust the FBI anymore! ;) -- ------------------------------------------------------------------------- I am an attorney, seeking a position in the area of Computer Law. If you know of such a position available, or of someone who may know of such a position, please send e-mail! Thanks.

1 0

Re: cfp '94 transcript
by Jack King 17 Dec '03

17 Dec '03

In Texas, Louisiana and Mississippi, it is now a federal crime to state orally or in writing to any federal administrative or law enforcement officer, during the course of an official investigation that you don't know what they are talking about if in fact you do. So if, for instance, you are a user on an anonymous bulletin board and you are asked if you are "X" when in fact you *are* X and you deny it, you can get a couple of years for that, even if you are not the subject of the investigation or guilty of any criminal activity--in theory, at least. This also pertains to any other kind of investigation: tax, environmental, drugs, antitrust, armed carjacking, international weapons trafficking, or anything else coming under federal jurisdiction. Mike Godwin stated that the FBI agent said something like " "we can lie to you, but you can't lie to us." That has always been true under 18 U.S.C. 1001. But now you can't even answer one of their questions with a "no" if the truthful answer would be "yes." You should read up on this, it's scarier than Clipper and the digital telephony proposal combined.

2 1

Re: cfp '94 transcript
by werner＠mc.ab.com 17 Dec '03

17 Dec '03

>Date: Tue, 29 Mar 1994 05:52:22 -0800 >From: Jack King <gjk(a)well.sf.ca.us> > >In Texas, Louisiana and Mississippi, it is now a federal crime to state >orally or in writing to any federal administrative or law enforcement >officer, during the course of an official investigation that you don't know >what they are talking about if in fact you do. How can something be a federal crime in only 3 states?

3 2

Re: Very funny, Polyanna [this one's deliberately encrypted]
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

1 0

Re: federal crime
by moormajb＠vuse.vanderbilt.edu 17 Dec '03

17 Dec '03

>>Date: Tue, 29 Mar 1994 05:52:22 -0800 >>From: Jack King <gjk(a)well.sf.ca.us> >> >>In Texas, Louisiana and Mississippi, it is now a federal crime to state >>orally or in writing to any federal administrative or law enforcement >>officer, during the course of an official investigation that you don't know >>what they are talking about if in fact you do. >How can something be a federal crime in only 3 states? I think he probably meant "felony" not "federal crime."

2 1

Keyserver addresses?
by Matt Thomlinson 17 Dec '03

17 Dec '03

I haven't seen mention of the keyservers by name for a long while -- the one I used to use (toxicwaste) is long gone. Perhaps we should add the keyservers' addresses to the active remailer list posted here periodically? Could someone send me a keyserver address, in any case? mt Matt Thomlinson University of Washington, Seattle, Washington. phone: (206) 548-9804 Check my home page -- ftp://ftp.u.washington.edu/public/phantom/home.html PGP 2.2 key available via email, or finger phantom(a)hardy.u.washington.edu

3 2

questions for review committee.
by sommerfeld＠orchard.medford.ma.us 17 Dec '03

17 Dec '03

Question: How many bits of true "hardware randomness" go into the generation of each set of unit keys? Question: Exactly how are these random numbers generated? Which entity or entities provide the hardware and/or software to generate them? Are they generated inside the "vault" at the time of programming or "off-line"? Question: Are any of the random inputs to the key generation algorithm held constant during the generation of a "batch" of chips? If so, what is the justification for this practice? Question: What is the current batch size? What will the batch size be if production reaches ~1 million units per year, or ~4000 per work day? Question: What assurances are there that the key generation algorithm documented and examined by the review committee is the one actually used in production? Question: What assurances are there that the encryption algorithm studied by the review committee is the same as the one implemented by the chip? More specifically, have several members of the review committee each coded their own SKIPJACK implementations, including the escrow protocols, "from scratch" on computer systems not owned or provided by the U.S. government, and compared their outputs to that of the chips under study? If this is not feasible, please explain why. Question: What assurances are there that the actual physical chip(s) implementing the EES implements exactly and only the skipjack algorithm, the documented escrow procedures, and other publicly documented features? Are there any VLSI experts on the review committee? If so, what chips have they designed, and what chips have they "reverse engineered"? ---- By "assurances" I mean that there is an active process in place for validating compliance to a particular requirement such that no single *organization*, or single model of hardware can "fail" in a way such that violation of the requirement goes undetected. I consider the set of current and former employees of the Executive Branch of the U.S. Government to be a single organization for purposes of assurance. Addendum to all of these: If this information is classified, please justify this classification etc., etc., Steve, I hope you don't consider any of these "have you stopped beating your spouse".. - Bill

1 0

Re: cfp '94 transcript
by ag588＠cleveland.Freenet.Edu 17 Dec '03

17 Dec '03

> > > >On Tue, 29 Mar 1994, Jack King wrote: > >> Mike Godwin stated that the FBI agent said something like " >> "we can lie to you, but you can't lie to us." That has always been true >> under 18 U.S.C. 1001. But now you can't even answer one of their questions >> with a "no" if the truthful answer would be "yes." You should read up on >> this, it's scarier than Clipper and the digital telephony proposal combined. > >Of course you can still refuse to say anything which is what you should >have always done in any case. > >I wonder that if you tell the agents that you reserve the right to lie -- >in other words disclaim an oath. Swear to lie. If you can beat such a rap. > >DCF > > > > Don't try to be clever when you're talking with the Feds. Your best bet is simply to demand a lawyer and then shut up. -- ------------------------------------------------------------------------- I am an attorney, seeking a position in the area of Computer Law. If you know of such a position available, or of someone who may know of such a position, please send e-mail! Thanks.

1 0

Cypherpunks change bytes!
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I ought to be studying, but goofing off is more fun. I generated a test key with the binary distribution of PGP 2.3a for DOS. I then changed the byte at offset 2F688 in PGP.EXE from 0x33 (ASCII "3") to 0x34 (ASCII "4"), and the byte at offset 2F689 from 0x61 (ASCII "a") to 0x00 (null). The patched PGP.EXE identifies itself as "Version 2.4" in ASCII armor blocks and otherwise; the key generated with the "2.3a" version extracts as a "2.4" key after the patch. ViaCrypt PGP 2.4 for DOS can successfully read files encrypted with the patched PGP.EXE, and add keys generated under "2.3a" but labelled as "2.4" keys. I haven't done a lot of testing, but spot checks make it look like everything's fine. I don't see the point in forcing everyone to patch their binaries or recompile from source - does anyone else? Bidzos & Co. are certainly smart enough to anticipate this step. What's the catch? -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLclzd33YhjZY3fMNAQGiDwP9HjSYfNfn4q/9L/BOqXluH06015x3YmDM gNPfg5T2lWcsYJyyx/tMnVWdtAnFENAFUB7zK5vNq+Y/tquKaE6kEuZeUzZz1o+k sOofUAR1Y+sUii4Fu8R2J7scNCDL2pjl/hIqAAfT0voHiexxOTR9uxCDeiWxz9w0 xpyuvJBLQq8= =G5Oq -----END PGP SIGNATURE-----

3 2

What the IRS is up to
by johnl＠iecc.com 17 Dec '03

17 Dec '03

Here's some excerpts from a speech by Coleta Brueck, Project Manager, Document Processing system, at the Internal Revenue Service, that she gave at the Computer Press Association Awards luncheon in New York on April 15th. I was at the lunch, but the transcript of the speech just arrived today. The ellipses are mine, but I think I'm not distorting what she said. She started by explaining that their current systems are functionally based on punch card systems from the 1950s, and they want to get more stuff on-line so that when you call with a question, the person at the IRS can retrieve a copy of your records while you're still on the phone. But then: "We should be able to provide you on-line access to that information. ... You will have the availability to know what your current account information is, very much like if most of us who have an American Express Card, you can call -- you don't really know where that 800 number goes, but what you do know is when that person answers your call, they have your complete account information. ... They can give you information on your account, they can update your account, or they can provide you futuristic looks into your account as to where you might be next year, even, for filing tax returns. We've often talked about, and this is the terminology that I used when I was in on a task group, we've talked about the "golden eagle" return. This is the golden -- or gold American Express Card return. At the end of each year, if you have an American Express Card, you get a gold account summary of what you've done for the year. ... Basically, what I say is that if I know what you've made during the year, if I know what your withholding is, if I know what your spending pattern is, I should be able to generate for you a tax return so that I only come to you and tell you, 'This is what I think you should file for the next year, and if you agree to that, then don't bother sending me a piece of paper.' ... But I am an excellent advocate of return-free filing. We know everything about you that we need to know. Your employer tells us everything about you that we need to know. Your activity records on your credit cards tell us everything about you that we need to know. Through interface with Social Security, with the DMV, with your banking institutions, we really have a lot of information, so why would you, at the end of the year or on April 15th, today, do we ask the post office to encumber themselves with massive numbers of people out there, picking up pieves of paper that you are required to file? ... We could literally file a return for you. This is the future that we'd like to go to." Lest there be any doubt, she was entirely serious, and she clearly expected that that we'd all think this is as wonderful as she does. Regards, John Levine, johnl(a)iecc.com, jlevine(a)delphi.com, 1037498(a)mcimail.com

1 0

Chill out.... was Re: Keyserver service outRAGE
by Pat Farrell 17 Dec '03

17 Dec '03

"Perry E. Metzger" <perry(a)snark.imsi.com> writes: > Rather than everyone freaking out about 2.5, why not just wait a few > hours until the FTP site is announced and look at the thing for > ourselves? > > Myself, I'm running on the assumption that this is a good thing, > because now PGP is completely legal in the U.S., and doubtless a PGP > thats legal overseas using a library compatible with RSAREF will > appear within days of release. Amen to this! Wait a week, and this might be a great thing. If not, keep using 2.3a. I know that Jim Bidzos was interested in having a "pgp compatible" program that started with rsaref and was legal and free. I know because I asked him about liscensing last spring. He pointed me to an effort that professor Jeffery Schiller (pgp key 0C4EE1 (jis@mit) on the usual servers) was coordinating. I exchanged a few messages with a student up there, then got lost in GMU work and lost track. I think the student did something else, like crack RSA-129. But there are lots of students at schools like MIT and GMU. I sure hope this can provide a cloud free PGP for broke students. Lets drop this thread for while, ok? Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

2 1

MIT keyserver: don't panic...
by Mike Ingle 17 Dec '03

17 Dec '03

Take a look at pgformat.doc, which is included in the source or doc releases of pgp23a. Both the public key and signature packets have only a single-byte version number, which is always equal to 2. So there is no way to tell by looking at your key which minor version (2.xx) it was created by. You can tell which version was used to extract it to ascii armor by looking at the "Version: 2.xx" line in the ascii armored message. So get a text editor. Big deal. You will not have to regenerate your keys and get new signatures on them. If we have a no-doubts legal PGP, with source code, and free, that's good! If something sucks about it, PGP23a is not going to disappear. This can only be a positive development. As for why the keyserver crippling was imposed, RSA can lose its patent rights if it can't show in court that it made an effort to prevent its patents from being infringed. --- Mike

1 0

DefenseServices
by Peter Murphy 17 Dec '03

17 Dec '03

From: "Perry E. Metzger" <perry(a)snark.imsi.com> Sender: owner-cypherpunks(a)toad.com Precedence: bulk Status: R _______ MESSAGE BEGINS ___________ Jim Miller says: > Section #120.9 of the ITAR defines "Defense Service" as: > > (1) The furnishing of assistance (including training) to foreign > persons, whether in the United States or abroad in the design, > development, engineering, manufacture, production, assembly, testing, > repair, maintenance, modification, operation, demilitarization, > destruction, processing, or use of defense articles; or > (2) The furnishing to foreign persons of any technical data > controlled under this subchapter (see #120.10), whether in the United > States or abroad. This is sick. According to this, I cannot teach foreigners about cryptography in the U.S. -- even about the open literature. This is a grotesque denial of my first amendment rights. I wonder if I should hold an open enrollment cryptography class for the sake of civil disobediance. Perry ______ MESSAGE ENDS _________________________________________ That's interesting..... My cryptology lecturer seems to have an American Mid-West accent (not Canadian - I can generally tell), and seems to be commiting the "heinous" crime of teaching such matters to mainly Australian people. He seems to be on conference somewhere overseas. Well, I hope he doesn't get arrested if he crosses any U.S. border posts. It would certainly piss me off. (For one thing, it would fuck up my syllabus :-[.) Seriously, I don't think it is an offense to teach cryptology to non-NAFTA nationals. All of the stuff is non-classified, and he seems pretty aware of the legal issue of cryptology. That is, he wouldn't do anything that he could be nabbed for (discounting any warped interprepation of the legal statutes...;-( .) ======================================================= | Peter Murphy. <pkm(a)maths.uq.oz.au>. Department of | | Mathematics - University of Queensland, Australia. | ------------------------------------------------------- | "What will you do? What will you do? When a hundred | | thousand Morriseys come rushing over the hill?" | | - Mr. Floppy. | =======================================================

1 0

PGP.....
by lile＠netcom.com 17 Dec '03

17 Dec '03

The MBone session "Cyberstation:audio feed" is going to have Jeffrey Schiller talk about the new public PGP V2.5 release.... Cygnus has a mbone connection.... -lile ps. You can also see info at http://www.media.org/pgp.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lile Elam | "Remember... No matter where you go, there you are." lile(a)netcom.com | Un*x Admin / Artist | Buckaroo Banzai ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Marked_Money
by remailer＠merde.dis.org 17 Dec '03

17 Dec '03

Is there a way of marking digital coins, so the depositor can be identified?

3 2

MBone - where to get the software...
by lile＠netcom.com 17 Dec '03

17 Dec '03

Hi folks, You need to get software to see the MBone encapsulated packets. You will also need a tunnel to your site (and you might already have one). So where to get the software... I am looking for it on a ftp site but have not found it. Some of the program names are sd (for session director) vat wb ( for whiteboarding) nv Hey! I just heard from van Jacobson. He wrote alot of this software... >From van(a)ee.lbl.gov Thu May 5 18:12 PDT 1994 To: Lile.Elam@Eng (Lile Elam) Subject: Re: mbone software... Date: Thu, 05 May 94 18:13:30 PDT From: Van Jacobson <van(a)ee.lbl.gov> Content-Type: text Content-Length: 218 The audio (vat), whiteboard (wb) & session directory (sd) tools are on ftp.ee.lbl.gov in conferencing/{vat,wb,sd}/*. The most widely used video tool (nv) is available on parcftp.xerox.com in pub/net-research. - Van Cygnus has a tunnel and so does Sun. I wish I could help more. I am still awaiting the PGP - Jeff broadcast. -lile ps. If you do get it up, the session is "Cyberstation: audio feed" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lile Elam | "Remember... No matter where you go, there you are." lile(a)netcom.com | Un*x Admin / Artist | Buckaroo Banzai ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

The MBone talk....
by lile＠netcom.com 17 Dec '03

17 Dec '03

You are not going to beleave this, but I missed it!!!! Argh!!!!!!! I had run down the hall to tell someone about it and once we got it up (which was only a few minutes) Jeff had already spoken... I heard from Van that Jeff Schiller just read the text that the MIT legal gave him and that is the same text that is on the www.media.org web server... So, wonder why there is so much darkness about this release... Why can't they just be up front with what it is and what's goin on? hum......... -lile ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lile Elam | "Remember... No matter where you go, there you are." lile(a)netcom.com | Un*x Admin / Artist | Buckaroo Banzai ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

No Subject
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello everyone! This is a preliminary document which I hope will stir discussion. I didn't write it in order to dictate rules to anyone, so please don't flame me. Hopefully the members of the list will supply lots of feedback! -Lady Ada - ---------------------------------------------------------- Introducting The Cypherpunk Standard For Encrypted Phones (CSEP) Purpose: Encryption software is a form of communication tool. Like other communication systems, it is useless without someone to talk to who shares the same protocol. It appears likely that various forms of encrypted phones will spring up in the near future, ranging from PC and SoundBlaster-based software to simple hardware phones. Now is the time for us to agree on protocols, so that all cypherpunk-built phones can talk to each other. Disclaimer: "But," you say, "Phil Z. is already working on VoicePGP. Why not wait until he releases it and let that be the standard?" Well, I'm not trying to undercut Phil, and I certainly hope that we will be incorporating his protocols into a future version. But I don't think we should let a single product drive all future design. Let's think about the future now. Isn't it better to hash out potential problems in a public forum? Basic Standard - -------------- - -- Diffie-Hellman for key exchange - -- Triple DES for data encryption - -- RSA for digital signatures/identity verification Rationale: Unlike encryption protocols designed for email, a phone system will need to exchange public keys bidirectonally at the beginning of every call, and the existance of an insecure two-directional link can be assumed. Diffie-Hellman is perfect for this application. The alternative, RSA, would require either generation of new keypairs at call time, which is very slow, or the long-term association of a keypair with a specific phone, which provides no benefit to the user and opens a possible path of attack (though not a major one) to eavesdroppers. Also, the patent on Diffie-Hellman expires in 1997, well before the 2000 expiration date of RSA. The information available to me appears to indicate that Triple DES is not significantly more vulnerable than IDEA or other popular algorithms, and it has the advantage of not being patented. I would like to see this standard keep possible future commercialization in mind. I suggest that the TDES implementation should use three different independent keys. IDEA might be offered as an option for those who prefer it. Compression - ----------- It's probably wise to standardize on a particular compression scheme. I have no opinions on this subject and welcome input. The most important feature is speed, not efficiency of compression. Other Features Required for Secure Phones - ----------------------------------------- Each phone shall have a button (hard or soft) which can be pressed by the caller at any time. Pressing it will cause a new TDES key to be generated and exchanged. [Should it generate a new n and g for D-H, or just create a new x and demand a new Y?] Paranoid users can press this button every few seconds if they wish. (In my humble opinion, even a single-DES phone is quite secure if it has this feature.) Other possible options - ---------------------- In some cases it may be desirable to confirm that the call recipient is really the person you wish to speak to. This could be implemented by allowing the phone to store RSA private keys (one for each user) and public keys (to test for other users). These signature keys should be independent of the encryption keys. The phone would require the user to enter a code [of what length?] which would act like the passphrase of PGP, preventing anyone from impersonating another user even if the would-be impersonator had access to the victim's key and phone. Control Codes - ------------- A number of control codes are needed for commands passing between the two phones. Not only the definitions of the codes but the values must be agreed upon by all users. Each of these will be associated with a defined packet that contains the appropriate data. GENNEWKEY [send x, request Y] DATA [send actual packet of data, request ACK] DATAACK [acknowledge data packet with checksum] - -------------------------------------------------------- OK, I admit it, this is pretty minimal, but hey, it's a beginning. Please send comments to the list. Phil Z, if you're out there reading this, I'd particularly like your input. -Lady Ada -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLclivqXNQdJx1hMZAQGq2wP/fcq5gp8unZhy/cog3jpdI8wA3hJORzME ul4qdnu5dOP7ON3LmlsWPeymUlagI1oUtJOUxb5LQ9lAlQMWv7u3TJDj3tqftcu3 il8fVmdIxrf8FYDbhs5GppCcfsMaz2/ervsw9cICspFPQJOKTOWzzTMuUYyoqcYa hWH/OJhMmPw= =coxy -----END PGP SIGNATURE-----

1 0

Anybody else see eye-to-eye with Connie Chung tonight?
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

They had a segment on a "digital stalker" on Prodigy. Basically, a guy who kept getting anonymous Prodigy accounts with fake credit cards and then used the accounts to harass people almost like Detweiler. The reporter's attitude was disturbing however. His attitude almost seemed to be that Prodigy should read each and every private message to protect users from harassment. The whole segment is a foreshadow of how society will react when anonymous remailing becomes widespread. One more thing. The narrator seemed to imply that what we know as "flaming" should be controlled. For instance, the phrase "check your thorazine dosage" could be viewed as digital harrasment. It's a brave new world out there. Coming to your local cyberspace soon. -ray

2 1

List Deletion
by broitman＠koala.bu.edu 17 Dec '03

17 Dec '03

How does one get removed from this mailing list? Please respond privately...so not to clutter up the conf. -jZb

1 0

Re: Why Digital Cash is Not Being Used
by Blanc Weber 17 Dec '03

17 Dec '03

Just thinking: since it keeps being repeated that it is a mistake to think of digital cash as currency, rather than a mere transaction mechanism, then it should not be called "cash", as this does not describe what it is. Then it would not be so easy to think in those terms. Digital Exchange Digital Transactions Digital Transfers Digital Fungi (bility) Blanc

1 0