December 2003 - cypherpunks-legacy

crypto in the NY Times
by Duncan Frissell 17 Dec '03

17 Dec '03

The New York Times Magazine Sunday 12 June 1994 Whitfield Diffie on the cover. Cover text: "Whitfield Diffie's Amazing breakthrough could guarrantee computer privacy. But the Government, fearing crime and terror, wants to co-opt his magic key and listen in. Now it's crypto-war on the electronic frontier. THE CYPHERPUNKS VS. UNCLE SAM by Steven Levy Inside title: Battle of the Clipper Chip Photos: Phil Zimmermann vs Jim Kallstrom D. James Bidzos vs F. Lynn McNulty John Gilmore, Eric Hughes vs Dorothy E. Denning Vice Adm. John M. McConnell vs Whitfield Diffie Good read. DCF --- WinQwk 2.0b#1165

1 0

crypto in the NY Times
by Duncan Frissell 17 Dec '03

17 Dec '03

Once and for all we have to squaush the stupid question that leads the last paragraph of the NYT Magazine article: "What if the [VoicePGP] static shielded the murderous plans of a terrorist or kidnapper? Phil Zimmermann would feel terrible." Presumably because he is "of the Left". Phil goes on to talk about tradeoffs. The real answer is: That's a real stupid question. Right now in my head I could be a psycho killer planning all sorts of terrible stuff, does that mean that you should use the techniques of the Inquisition to fight crime by peeling back the layers of my mind? Computers and communications are just extensions of the minds of individuals. If I can keep my mind private, I can keep my computer private. DCF --- WinQwk 2.0b#1165

1 0

Re: Protocol Wanted!!
by mpd＠netcom.com 17 Dec '03

17 Dec '03

greg(a)ideath.goldenbear.com (Greg Broiles) writes: > If Alice wants proof that Bob can factor large numbers, > Alice should generate many of them - say, 1,000,000 of them. > She sends them to Bob and says "Hey, factor one and send me > the results as soon as you're done." The chances are 1 in > 1,000,000 that Bob is giving away a useful service for free Bob is now doing at least twice as much work as before. He is factoring a random key and a real one for each customer he does business with. Since the existance of a breakthrough in factorization is certainly of interest to people who do not want keys factored, Bob will get lots of requests from the curious, who have no interest in buying his services. Should he prove to someone in the academic community that he can indeed factor keys, people would simply stop using RSA and Bob's economic future would be bleak indeed. Bob needs to charge a lot for his services, and not give free demos. The protocol needs to require that the customers commit to the fee before Bob demonstrates his talent. This will discourage enquiries by the frivilous. > What they both need are trusted friends, attorneys, or > agents - Bob puts an ad in the newspaper, saying "I can > factor big numbers. Contact me through my attorney - her > name is [...]." Gaaak! All these people. You are making Bob paranoid. Bob is definitely not going to put an ad in the paper. His customers are foreign and domestic law enforcement and intelligence services and corporate security folks. Bob wants to keep an extremely low profile with the Great Unwashed. Isn't there some way for Bob to conduct business using the remailer at Hacktic and anonymous DigiCash(TM)? Bob does not wish to find himself at the bottom of a large body of water wearing concrete galoshes. Bob wishes to factor a few numbers, transfer the money offshore, and retire without the general public being aware that RSA has been compromised. > I don't have a damn thing to do with either law enforcement > or the intelligence community, but I bet that folks would > be willing, upon occasion, to pay between $100K and $1M for > factorizations of other folks' RSA private keys. The trend > towards civil forfeiture of "drug money" will probably lead > to higher prices for key factoring - folks who could factor > big numbers might even be able to negotiate for "points" of > the gross take, rather like big-name actors/directors or > sports figures. I agree. I think that $100 a bit would be an extremely reasonable price for factoring a 1024 bit modulus. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

crypto in the NY Times
by Duncan Frissell 17 Dec '03

17 Dec '03

And yet again: Attention - Steven Levy - The most common use of crypto from the dawn of time to the present has been to protect commercial information. There were always more traders than governors and they had more need to read or count. Writing was a commercial invention and coding is just another form of writing. How much are we paying these guys department: Attention - Jim Kallstrom, Fibbie - who argues (correctly) that strong crypto is just the same thing as if a criminal gang could build an unbreakable fortress in the Bronx and stash Polly Klass inside and the government could do nothing... If the bad guys have an unbreakable wall, the *victims* have an unbreakable wall too. The criminals gain nothing. They are, in fact, worse off since it becomes *harder* to 'break the close.' DCF There'll be more I'm sure. --- WinQwk 2.0b#1165

2 1

crypto in the NY Times
by Duncan Frissell 17 Dec '03

17 Dec '03

Control freaks - yah gotta love 'em. DD in today's Times - "I was exposed to cases where wiretaps had actually stopped crimes in the making...If they didn't have this tool, some of these things might have happened." I have been exposed to cases where torture actually stopped crimes in the making... I have been exposed to cases in which locking the entire population of a nation into a totalitarian control regime with internal passports and everything has actually stopped crimes in the making... I have been exposed to cases in which decimating the inhabitants of a village actually stopped crimes in the making. Guess what control freaks: The guy next door may have strong crypto, a gun, and a car with a tank full of gasoline with enough energy in it to blow up your house. There's not a goddamned thing on this good green earth that you can do about it. Get used to it. Learn to trust people until proven otherwise. DCF --- WinQwk 2.0b#1165

1 0

Re: Protocol Wanted!!
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

I'm surprised nobody's mentioned yet that Bruce Schneier solves this problem in chapters five and six of _Applied Cryptography._ See especially page 90, "Noninteractive Zer-Knowledge Proofs." b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): Protect your privacy; oppose Clipper. Voice concern over proposed Internet pricing schemes. Stamp out spamming. Finger ben(a)tux.music.asu.edu for PGP 2.3a public key.

1 0

Re: Remailer Chaining Security
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- :: Request-Remailing-To: rperkins(a)nyx.cs.du.edu :: Request-Remailing-To: nowhere(a)bsu-cs.bsu.edu :: Request-Remailing-To: vaccinia(a)uncvx1.oit.unc.edu The preceding remailer message path was generated using Hal's Chain utility. One can find this program at soda.berkeley.edu pub/cypherpunks/remailer, get Chain.zip. It automates alot of the drudge in chaining remailers. It will even encode messages using PGP if you have the remailers public key on your ring and your PGP directory in your path statement. For instance, to get the above remailer path I typed the following: chain vaccinia(a)uncvx1.oit.unc.edu vox rperkins nowhere <foo.let> foo.vox Thus my address will be the final destination, the message file (foo.let) is converted to the remail ready file, foo.vox. The remail ready file must then be manually sent to the first remailer in the chain, in this case remail(a)vox.hacktic.nl. It will then go to rperkins(a)nyx.cs.du.edu and then to nowhere(a)bsu-cs.bsu.edu, finally being sent to vaccinia(a)uncvx1.oit.unc.edu. The Chain.ini file (from the chain.zip file) contains the remailer addresses and whether a PGP public key for the remailer is available on your public key ring. Remailers for which you have keys will automatically be encoded and begin thusly: :: Encrypted: PGP N.B., It may be neccesary to edit the chain.ini file (it is merely an ASCII file) to update the list of remailers. I recommend this utility for chaining to most remailers. Remember that remailer(a)soda.berkeley.edu does not support the format, :: Request-Remailing-To: Even so it is a handy program to have if you want to avail yourself of the cypherpunks remailer system. Scott G. Morham !The First, Vaccinia(a)uncvx1.oit.unc.edu! Second PGP Public Keys by Request ! and Third Levels ! of Information Storage and Retrieval !DNA, ! Biological Neural Nets, ! Cyberspace -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLfoGvz2paOMjHHAhAQFSoQP+IELwswIrLk6B0W1nXDQJysqjYl7GGQg8 6gO38xSI7CzbqFFneM8YMNQG7U/PKIjs5Kw89lFZNHAYk6NzDGvVUbOepvIjQ9F3 xIO/TsTYASFAz5WcGNHKVR2ceq4juubDkBd9O5r+mEcj9c34Nhsbs9QxWC1T1l64 +YSyP9DBxHE= =hDW4 -----END PGP SIGNATURE-----

1 0

test... please ignore.
by Robert Lau 17 Dec '03

17 Dec '03

this is only a test. if this had been a real emergency, this message would have been crypted. Robert Lau - Systems Programmer, Unix Systems 213-740-2866 -- University Computing Services Internet: rslau(a)usc.edu -- University of Southern California Bitnet: rslau@uscvm -- 1020 W Jefferson, LA, CA USA, 90089-0251 UUCP: ...!uunet!usc!rslau

1 0

test 2... please ignore.
by Robert Lau 17 Dec '03

17 Dec '03

<test 2> this is only a test. if this had been a real emergency, this message would have been crypted. Robert Lau - Systems Programmer, Unix Systems 213-740-2866 -- University Computing Services Internet: rslau(a)usc.edu -- University of Southern California Bitnet: rslau@uscvm -- 1020 W Jefferson, LA, CA USA, 90089-0251 UUCP: ...!uunet!usc!rslau

1 0

Re: Protocol Wanted!!
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

Oh, am I stupid. Someone mentioned having lent his Schneier to someone. Hmmm. I wondered what book that would be, maybe I would want to buy a copy. So I charged off to look in the bibliography in Applied Cryptography. Strange, there are some articles listed by him, but nothing seems to fit, yet this book is so new... In any event, I really am enjoying Applied Cryptography, by Bruce Schneier. You could have lent your copy of it... -kb, the Kent who can be so slow -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 28:15 hours of TV viewing so far in 1994!

1 0

Massive ITAR Violation.
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN ROT13 SIGNED MESSAGE----- Fellow citizens of the United States of America, I wish to inform you of a great and ongoing catastrophe of most serious consequence. It is organized crime, by definition. Below is the header for the MacPGP2.2 file on sumex-aim.stanford.edu, archived with dozens of other utilities, as /info-mac/util/pgp.hqx, which has been there for *over a year*, many times a week being *exported* onto info-mac mirrors around the world. This is the most massive and organized absolute violation of the USA's ITAR munitions export laws (regulations) we have ever witnessed. For an entire year, weekly if not daily, the notorious encryptor PGP, right under our eyes, exported! I hope this is cleared up as soon as humanly possible, but we are all of us left with the guilt of not having noticed this before. All this talk of ITAR and there you are, your largest communal Mac ftp site pumping out PGP across the border like a huge demonic machine bent on destroying our beloved society. If the moderators cannot be contacted immediately, I suggest military force be used. Or cooperative shutdown of the US internet connections. Please begin this at once, as it *must* be stressed that PGP is classified as a MUNITION, right along with rocket launchers and tanks!!!!!!!! This is as serious as it gets. I didn't even know what the internet *was* back in April of '93, and I am but one in a million (literally) who has access to sumex-aim.stanford.edu and all its mirror sites. It must have been my destiny to save the world, for none of *you* seem interested in doing so. It has only been an hour since I discovered this NATIONAL SECURITY DISASTER, and I immediately set myself in action to save my country from destruction. *I*YoU*mE*We*OiwIE*wE*yOU*Me*I* P.S. Here is the evidence: >From: macmod(a)SUMEX-AIM.Stanford.EDU (Info-Mac Moderator) >Date: Sun, 25 Apr 1993 23:22:58 PDT > >PGP (Pretty Good Privacy) ver 2.2 - RSA public-key encryption freeware >for MSDOS, protects E-mail. Lets you communicate securely with people >you've never met, with no secure channels needed for prior exchange of >keys. Well featured and fast! Excellent user documentation. > >PGP has sophisticated key management, an RSA/conventional hybrid >encryption scheme, message digests for digital signatures, data >compression before encryption, and good ergonomic design. Source >code is free. > >Keywords: PGP, Pretty Good Privacy, RSA, public key, encryption, > privacy, authentication, signatures, email > >(This file must be converted with BinHex 4.0) > >:$8eKBe"(8$)Z-LjcC@%!39"36'&eFh3J!!!$@3X!!%DFIea6593K!!%!!eN,FNa .... And upon downloading it and starting it up, the console window faithfully displays: >Pretty Good Privacy 2.2 - Public-key encryption for the masses. >(c) 1990-1993 Philip Zimmermann, Phil's Pretty Good Software. 6 Mar 93 >Date: 1994/06/12 16:10 GMT I further suggest that all of the following sites (but a sample) immediately remove this file from their archives and stop mirroring sumex-aim till they too remove the file. To keep this from happening again, I suggest *all of us* in the USA delete our copies of PGP from our hard disks, lest our children export it into the hands of such enemy nations as these. It is time we put an end to this scourge, for look what will happen if we do not. Pornographers and terrorists are coming for our children if we do not act. Death to PGP users!!!!!!!!!!!!!!! Where is our government in all of this? Our tax dollars are not being used to protect us from the EXPORT OF MUNITIONS TO ENEMY NATIONS!!!!! I suggest full prosecution of all users and maintainers of sumex-aim, as they have all obviously conspired to maintain this treachery. I suggest they all be searched for other weapons as well including land mines, automatic machine guns, poison gases, biological weaponry and mind control devices of all sorts, as it is my firm belief that the only reason they are interested in PGP is to forward their agenda to export other munitions, drugs pushed on *our* children to pay for them!!! This will culminate in the obvious acquisition of *nuclear bombs* by every Tom Dick and Harry gangster. Little boys and girls in the getto with *neutron bombs* and *poison gas missiles*! I shutter to think we could have stopped it but, alas, we may have failed ourselves. Here are the target sites. I suggest immediate offensive attacks to destroy these evil ports of death and destruction.... Australia (Melbourne): archie.au//micros/mac/info-mac/util/pgp.hqx Austria (Vienna): ftp.univie.ac.at//mac/info-mac/util/pgp.hqx Canada (Vancouver): ftp.ucs.ubc.ca//pub/mac/info-mac/util/pgp.hqx Finland (Espoo): ftp.funet.fi// pub/mac/info-mac/util/pgp.hqx Finland (Jyvaskyla): ftp.jyu.fi//info-mac/util/MacPGP2.2.sea Germany (Hannover): ftp.rrzn.uni-hannover.de//pub/info-mac/util/pgp.hqx Japan (Tokyo): ftp.center.osaka-u.ac.jp//info-mac/util/pgp.hqx Japan (Tokyo): ftp.iij.ad.jp//pub/info-mac/util/pgp.hqx Japan (Tokyo): ftp.u-tokyo.ac.jp//pub/info-mac/util/pgp.hqx Netherlands (Wageningen): ftp.fenk.wau.nl//pub/mac/info-mac/util/pgp.hqx Republic of Singapore (Singapore): ftp.nus.sg//pub/mac/util/pgp.hqx Sweden (Lund): ftp.lth.se//mac/info-mac/util/pgp.hqx.Z Sweden (Uppsala): ftp.sunet.se//pub/mac/info-mac/util/pgp.hqx Switzerland (Zurich): nic.switch.ch//mirror/info-mac/util/pgp.hqx Taiwan (Hsinchu): ftp.edu.tw//Macintosh/info-mac/util/pgp.hqx UK (London): src.doc.ic.ac.uk//packages/info-mac/util/pgp.hqx.gz -----END ROT13 SIGNED MESSAGE----- -----BEGIN ROT13 SIGNATURE----- Whar fvkgu avargrra uhaqerq avargl sbhe. Sbhegubhfnaqgra punenpgref va frirauhaqerqrvtuglrvtug jbeqf bs baruhaqerq yvarf. -----END ROT13 SIGNATURE-----

1 0

Test
by Duncan Frissell 17 Dec '03

17 Dec '03

Dead or alive? --- WinQwk 2.0b#1165

1 0

MacPGP 2.6 (fwd)
by Dan Harmon 17 Dec '03

17 Dec '03

Just food for thought! ---------- Forwarded message ---------- Date: Sun, 12 Jun 1994 12:44:52 -0700 From: Eric Bear Albrecht <ebear(a)presto.com> To: Dan Harmon <harmon(a)tenet.edu> Subject: MacPGP 2.6 That signature block in your message seemed awfully short -- does that indicate a wimpy system? Read the following excerpt and cogitate on it: ------ Computer underground Digest Sun June 5, 1994 Volume 6 : Issue 49 ISSN 1004-042X ... CONTENTS, #6.49 (June 5, 1994) File 1--AT&T Lab Scientist Discovers Flaw in Clipper Chip File 2--Jacking in from the SNAFU Port (Clipper Snafu update) File 3--Jacking in from the "We Knew It All Along" Port (Clipper) File 4--Crackdown on Italian BBSes Continues File 5--Norwegian BBS Busts / BitPeace File 6--BSA: Software Piracy Problem Shows no Sign of Easing File 7--Re: "Problems at TCOE" (CuD 6.47) File 8--Is there an MIT/NSA link-up for PGP 2.6? Some Info ... ------------------------------ Date: Mon, 30 May 1994 18:04:50 -0500 (CDT) From: tlawless(a)WHALE.ST.USM.EDU(Timothy Mark Lawless) Subject: File 8--Is there an MIT/NSA link-up for PGP 2.6? Some Info For the past week our Unix machine has been down (Might have gotten some mail bounces) because of a security violation. Durring that week i re-discovered bbs's. One peice of info i found (And also got the authors's permission to reprint (At the end) relevent to pgp I thought i would pass on. D Area: CypherMail DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD Msg#: 19 Date: 05-24-94 19:47 From: Leland Ray Read: Yes Replied: No To: All Mark: Subj: More on PGP 2.5 & 2.6 DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD -----BEGIN PGP SIGNED MESSAGE----- The following is the complete, unedited plaintext of a message I received via CompuServe from Christopher W. Geib, a software developer who spent several years as a military intelligence officer. Chris has written a very fine Windows interface for PGP which I'll be uploading as soon as I get the newest release (with Chris's permission, of course). I trust his judgment on this one. ~~~ =====(Begin plaintext)===== Leland, I sent this to Mich Kabay of the NCSA Forum. Thought you might find it of interest. Note that 2.5 is also a MIT/NSA concoction. Chris ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Mich, As I reflected on more and more on this posting, it occurred to me that I was smelling a rat. The NCSA Forum members and others who visit here should give thought to this issue. A puzzle of sorts seems to be developing regarding PGP in general, and private possession of crypto in particular. Let me provide some pieces to this puzzle, and perhaps you and others may begin to see the bigger picture that seems to be unfolding. Piece #1: As you may already know, MIT is the single largest ($'s) outside contractor to the NSA. Piece #2: MIT is frustrated they feel that they have been somehow cheated financially by the proliferation of PGP 2.3a as freeware. (I still think that is insane as RSA was developed using public funding) Piece #3: NSA is frustrated because of the apparent strength of the imported Idea(tm) cipher. Piece #4: NSA is pushing the Clipper crypto technology so that Big Brother can have a free and easy backdoor to violate the privacy of Americans. Note too, that Clipper technology was assisted along by MIT. Piece #5: PGP 2.6 will *not* be compatible with 2.3a after Sept 1994 for 2-way encryption. This accomplishes reduced international secure traffic by private individuals and businesses. This is exactly the same problem that Clipper has. Have you begun to see the big Puzzle Palace picture yet? Unless my eyes deceive me, I would say this, MIT and NSA have teamed up together on PGP 2.6! This version, until proven otherwise (through examination of the source code, etc.), is likely to contain a backdoor big enough to drive a Mack truck through it. The back door is likely similar to Clipper and for the same intent. Given how much flak NSA has gotten over Clipper, NSA will very likely stay very mum about the whole issue. The big winners are NSA and MIT. They both get exactly what each has wanted all along. MIT gets royalties they think they deserve, NSA gets what they intend to have anyway, a means to continue listening into citizens private conversations. NSA also wins on the international front by reducing it's workload of analyzing international encrypted traffic. Business and the citizens lose because it isolates the US from Europe and the international marketplace. I strongly recommend that anyone who acquires PGP 2.6 do so with a jaundiced eye. Until the private sector can review, and analyze this new MIT/NSA system, one *must* assume that it is as if it contained a virus, one you may never know it has. I for one will continue with the present version as it's inventors have no reason to capture private communications. If you think appropriate, please upload to Internet Risks with my blessings. Respectfully, Christopher W. Geib ~~~ =====(End of plaintext)===== So you decide, guys. Is it worth the risk? Again, just some thoughts, but remember this: if you go to either ver. 2.5 or 2.6, you'll probably have to revoke your ver. 2.3 keys and start afresh with new ones, which might not be secure in the first place. LR ... If the Pope's phones weren't secure, PGP would be a sacrament. ((Post obtaining reprint permission deleted)) ... ** The wonderful thing about standards ** ** is that there are so many to choose from. ** Eric Bear Albrecht ebear(a)presto.com W5VZB Box 6040 505-758-0579 fax 505-758-5079 Taos, NM 87571

1 0

Patent Numbers
by norm＠netcom.com 17 Dec '03

17 Dec '03

Does anyone have the US Patents numbers for Chaum's DigiCash scheme?

1 0

Warning: Don't run MacPGP 2.6 on a 68000 based Macintosh
by Jeffrey I. Schiller 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Warning. MacPGP 2.6 (1.1.1) will *not* work on a 68000 based Macintosh. It will bomb. I was unaware of the nasty hack you have to do when compiling MacPGP in order to get it to be 68000 aware. People who have the source distribution can compile it for either machine. -Jeff -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAgUBLfupN1UFZvpNDE7hAQHY7QH5AWxYbjgSGhV45R6MTWQ43HytC7ZdlPdQ E9dCNnmKK2NvPdJOOq/ZLEbSE0jjmcMzKDT3crL5yulYTAAcgfojFQ== =IVv2 -----END PGP SIGNATURE-----

1 0

URGENT Action required (NJ folks only)
by Shabbir J. Safdar 17 Dec '03

17 Dec '03

Estimated time for this good deed: Two minutes Do you live in one of the following zip codes in New Jersey? 07010 07014(part) 07020 07022 07024 07026 07029(part) 07031 07032(part) 07047(part) 07057 07070 07071 07072 07073 07074 07075 07087(part) 07094 07096 07306(part) 07307 07308 07310(part) 07407 07410(part) 07452(part) 07601 07602 07603 07604 07605 07606 07607 07608 07631 07632 07643 07644 07646 07649(part) 07650 07657 07660 07661 07662(part) 07666 07670(part) If your zip code is listed above then you are one of Rep. Torricelli's constitutents. "part" means your zip code is split between two districts, one of them Rep. Torricelli's. Rep. Torricelli is on the House Intelligence Committee and needs to hear from you about HR 3627, which would permit cryptography exports. The attached file explains all about the bill and why you should support it. Call Rep. Torricelli today and ask him to send Rep. Maria Cantwell's bill, HR 3627, to the House Floor! Dist ST Name, Address, and Party Phone Fax ==== == ======================== ============== ============== 9 NJ Torricelli, Robert (D) 1-202-224-5061 1-202-225-0843 2159 RHOB Here is a sample communique you might use: Dear Representative Torricelli, Please report Maria Cantwell's Cryptography export bill (HR 3627) out of committee. Its passage will both assist American industries competing globally, as well as allow American consumers to purchase products to enhance their privacy. Sincerely, ______________ Table of contents: Introduction & Alert Status of the bill What you can do right now List of legislators supporting HR 3627 List of legislators wavering on HR 3627 List of legislators opposing HR 3627 What is the Cantwell bill? ------------------------------------------------------------------------------- INTRODUCTION & ALERT The Cantwell cryptography export bill has entered a critical stage in its travels through Congress. The bill, which would loosen controls on the export of encryption software, has been referred to the House Select Committee on Intelligence, and must be be reported back from committee by June 16th or it will die. This alert details the provisions of the bill, its history, and what you can do to show your support. Voters Telecomm Watch keeps scorecards on legislators' positions on legislation that affects telecommunications and civil liberties. If you have updates to a legislator's positions, from either: -public testimony, -reply letters from the legislator, -stated positions from their office, please send them to vtw(a)panix.com so they can be added to this list. General questions: vtw(a)panix.com Mailing List Requests: vtw-list-request(a)panix.com Press Contact: stc(a)panix.com Gopher URL: gopher://gopher.panix.com:70/1/1/vtw WWW URL: Be patient; we're working on it. :-) ------------------------------------------------------------------------------- STATUS OF THE BILL (updated 6/3/94) The office of the House Select Committee on Intelligence reports that HR 3627 has been referred to the the committee and must be reported out by June 16th or it will die in committee for the year. May 20, 94 Referred to the House Select Committee on Intelligence May 18, 94 Passed out of the House Foreign Affairs Committee on May 18 Dec 6, 93 Referred to the Subcommittee on Economic Policy, Trade and Nov 22, 93 Referred to the House Committee on Foreign Affairs. ------------------------------------------------------------------------------- WHAT YOU CAN DO RIGHT NOW Estimated time to do this good deed: Two minutes Show your support for HR 3627 by contacting a member of the House Select Committee on Intelligence, especially if your one of your state's representatives is on the committee. The end of this alert contains a sample message on which you can base your contact. The following list, sorted by state, shows the full membership of the committee and how to reach them. Remember, the deadline for the bill to pass out of committee is June 16th, so it is important to act quickly! If you live in one of the states listed below call your legislator. Otherwise, call Rep. Glickman. Here's a sample communication: Dear Representative ___________, Please report Maria Cantwell's Cryptography export bill (HR 3627) out of committee. Its passage will both assist American industries competing globally, as well as allow American consumers to purchase products to enhance their privacy. Sincerely, ______________ All addresses are Washington, D.C. 20515 Dist ST Name, Address, and Party Phone Fax ==== == ======================== ============== ============== 5 AL Cramer Jr, Robert E. (D) 1-202-225-4801 1-202-225-4392 1318 LHOB 8 CA Pelosi, Nancy (D) 1-202-225-4965 1-202-225-8259 240 Cannon 32 CA Dixon, Julian C. (D) 1-202-225-7084 1-202-225-4091 2400 RHOB 40 CA Lewis, Jerry (R) 1-202-225-5861 1-202-225-6498 2312 RHOB 46 CA Dornan, Robert K. (R) 1-202-225-2965 1-202-225-3694 2402 RHOB 2 CO Skaggs, David E. (D) 1-202-225-2161 1-202-225-9127 1124 LHOB 10 FL Young, C. W. (R) 1-202-225-5961 1-202-225-9764 2407 RHOB 4 KS Glickman, Daniel (D) 1-202-225-6216 1-202-225-5398 2371 RHOB 1 NE Bereuter, Douglas (R) 1-202-225-4806 1-202-226-1148 2348 RHOB 9 NJ Torricelli, Robert (D) 1-202-224-5061 1-202-225-0843 2159 RHOB 3 NM Richardson, William (D) 1-202-225-6190 1-202-225-1950 2349 RHOB 1 NV Bilbray, James H. (D) 1-202-225-5965 1-202-225-8808 2431 RHOB 17 PA Gekas, George W. (R) 1-202-225-4315 1-202-225-8440 2410 RHOB 2 RI Reed, John F. (D) 1-202-225-2735 1-202-225-9580 1510 LHOB 14 TX Laughlin, Gregory H. (D) 1-202-225-2831 1-202-225-1108 236 Cannon 16 TX Coleman, Ronald D. (D) 1-202-225-4831 None 440 Cannon 19 TX Combest, Larry (R) 1-202-225-4005 1-202-225-9615 1511 LHOB 1 UT Hansen, James V. (R) 1-202-225-0453 1-202-225-5857 2466 RHOB 6 WA Dicks, Norman D. (D) 1-202-225-5916 1-202-226-1176 2467 RHOB ------------------------------------------------------------------------- LIST OF LEGISLATORS SUPPORTING HR 3627 The following legislators have formally registered support for the Cantwell cryptography export bill, HR 3627. Call them with your cheers. All addresses are Washington, D.C. 20515 Dist ST Name, Address, and Party Phone Fax ==== == ======================== ============== ============== 1 WA Cantwell, Maria (D) 1-202-225-6311 1-202-225-2286 1520 LHOB HR 3627's sponsor; thank her for her work! 16 IL Manzullo, Donald (R) 1-202-225-5676 1-202-225-5284 506 Cannon Cosponsored on 11/22/93 3 UT Orton, William H. (D) 1-202-225-7751 1-202-226-1223 1122 LHOB Cosponsored on 03/22/94 3 OR Wyden, Ronald (D) 1-202-225-4811 1-202-225-8941 1111 LHOB Cosponsored on 03/22/94 16 CA Edwards, Donald (D) 1-202-225-3072 1-202-225-9460 2307 RHOB Cosponsored on 03/22/94 19 OH Fingerhut, Eric D. (D) 1-202-225-5731 1-202-225-9114 431 Cannon Cosponsored on 03/22/94 4 MA Frank, Barney (D) 1-202-225-5931 1-202-225-0182 2404 RHOB Cosponsored on 03/22/94 2 UT Shepherd, Karen (D) 1-202-225-3011 1-202-226-0354 414 Cannon Cosponsored on 03/22/94 3 WA Unsoeld, Jolene (D) 1-202-225-3536 1-202-225-9095 1527 LHOB Cosponsored on 03/22/94 19 FL Johnston II, Harry (D) 1-202-225-3001 1-202-225-8791 204 Cannon Cosponsored on 03/22/94 9 WA Kreidler, Mike (D) 1-202-225-8901 1-202-226-2361 1535 LHOB Cosponsored on 03/22/94 4 WA Inslee, Jay (D) 1-202-225-5816 1-202-226-1137 1431 LHOB Cosponsored on 03/22/94 7 WA McDermott, James A. (D) 1-202-225-3106 1-202-225-9212 1707 LHOB Cosponsored on 03/22/94 8 IN McCloskey, Frank (D) 1-202-225-4636 1-202-225-4688 306 Cannon Cosponsored on 03/22/94 14 CA Eshoo, Anna G. (D) 1-202-225-8104 1-202-225-8890 1505 LHOB Cosponsored on 03/22/94 10 NC Ballenger, Thomas C. (R) 1-202-225-2576 1-202-225-0316 2238 RHOB Cosponsored on 05/04/94 2 WA Swift, Al (D) 1-202-225-2605 1-202-225-2608 1502 LHOB Cosponsored on 05/04/94 ------------------------------------------------------------------------------- LIST OF LEGISLATORS WAVERING ON HR 3627 [Feel free to use the sample communique at the end of the FAQ when calling or writing a legislator.] 26 NY Hinchey, Maurice D. (D) 1-202-225-6335 1-202-226-0774 1313 LHOB Recently told a constituent that he is taking the Cantwell bill under consideration, but has "national security concerns" about allowing encryption to be exported outside the United States. 1 IA Leach, James (R) 1-202-225-6576 1-202-226-1278 2186 RHOB Has yet to answer a constituent letter with a stated position. 13 NY Molinari, Susan (D) 1-202-225-3371 1-202-226-1272 123 Cannon Has yet to answer a constituent letter with a stated position. (has taken inordinately long) 8 NY Nadler, Jerrold (D) 1-202-225-5635 1-202-225-6923 424 Cannon Met with lobbying constituent in April '94; no position taken yet 25 CA McKeon, Howard P. (R) 1-202-225-1956 1-202-226-0683 307 Cannon Responded to a constituent with a "non-position", May '94 ------------------------------------------------------------------------------- LIST OF LEGISLATORS OPPOSING HR 3627 [Feel free to use the sample communique at the end of the FAQ when calling or writing a legislator.] None on file yet. ------------------------------------------------------------------------------- What is the Cantwell bill? The Cantwell bill would permit companies to export products with encryption technology in them. US companies are currently not permitted to export products (hardware or software) with this technology in them. What is encryption technology? Encryption technology, or cryptography, is the art of scrambling a conversation so that only the people communicating can decode it. Other people (such as eavesdroppers) cannot learn about the conversation. Where is cryptography being used? Cryptography is used to encrypt electronic mail to protect its confidentiality in transit. It's used by bank automatic teller machines to protect sensitive data (such as your account number, your Personal Identification Number, and your bank balance). It can be implemented into software (such as electronic mail programs and word processors) as well as hardware (such as telephones and "walkie-talkies") to ensure your privacy. Why is there a restriction on exporting products with technology in them? For many years the United States was a leading researcher in cryptography. High quality cryptographic technology was available only within the United States. The US government thought that if they did not let this technology be exported, foreign individuals would not be able to obtain it and use it against us (by keeping US intelligence agencies from eavesdropping on their communications) Since then, cryptography research has been published in international journals. Companies have been created throughout the world who export cryptographic technology from countries that do not have these restrictions. You can now buy the same, high-quality cryptographic technology from many international firms. Although the marketplace has changed, the regulations have not. Why should the regulations be changed? US companies compete in a global marketplace. Because of the export regulations, they often compete alongside products with superior cryptographic capabilities built into them. The result is that US companies build their products with an inferior encryption technology. The result of this is that you, as an American consumer, have great difficulty obtaining products with strong encryption in them. Because US products cannot compete against products with better privacy features, and because the laws are outdated, the regulations should be changed. The Cantwell bill fixes these regulations to more accurately resemble the current situation of the world marketplace. How can I help encourage more privacy-enhanced products and pass the Cantwell bill? Call or write your representative and ask them to support or cosponsor the Cantwell bill, HR 3627. You can base your letter on the sample communication below. SAMPLE LETTER OR PHONE CALL The Honorable ____________ address Washington DC, 20515 Dear Congressman or Congresswoman, As a citizen concerned for my privacy, as well as a supporter of American business, I urge you to cosponsor the Cantwell cryptographic export bill, HR 3627. The bill would allow US companies to produce and export products with cryptographic privacy-enhancing technology in them. These products are already available from firms throughout the world. US companies lose nearly $100 million per year in exports to them. By encouraging this industry, ordinary citizens like you and me would be able to purchase products with better privacy features. Please support or co-sponsor HR 3627. Sincerely, ___________________________________ [updated May 28, 1994, shabbir(a)panix.com] -------------------------------------------------------------------------------

1 0

CERT warning about majordomo
by adwestro＠ouray.Denver.Colorado.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Regarding the list going down again: I was just informed that CERT has issued a warning about a security hole in majordomo. Anyone have any info on this? Alan Westrope <awestrop(a)nyx.cs.du.edu> __________/|-, <adwestro(a)ouray.denver.colorado.edu> (_) \|-' finger for pgp 2.6 public key "Silent, We the Empire Await, Trystero!" -- Pynchon (sorta...) S,W.E.A,T! -- graffito at Moe's Pretty Good Gym -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLfu61lRRFMq4NZY5AQESBQP/fn0lhPeUgVk+abGqQzNSOG+7895AvWFQ oWguun145cEB93NxL4vZyHOg5OgtEod7M33uvOGCVssEj3ux8iv8aW96LJOmc6ph kWIlXieNnvsR9WUXk2mapoYsakwz0VkwL4rsCLQhHcbQbFhlnJbKXOtw9n1h7Q8V Fas0G695ZyE= =C8+V -----END PGP SIGNATURE-----

1 0

Online/offline transactions
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

Don't worry about online vs offline transactions. The credit card companies are moving toward all online transactions. A company down in NJ called RAM Mobile Data is helping them on this. They have base stations in 90% of urban business areas. The radios are fairly cheap (even though they need an appropriate thing to plug them into) and the per-transaction charges are about a dime. So I would say that the important problem to solve is "how do we make accounts anonymous?" rather than "how do we avoid double-spending?" -russ <nelson(a)crynwr.com> ftp.msen.com:pub/vendor/crynwr/crynwr.wav Crynwr Software | Crynwr Software sells packet driver support | ask4 PGP key 11 Grant St. | +1 315 268 1925 (9201 FAX) | Quakers do it in the light Potsdam, NY 13676 | LPF member - ask me about the harm software patents do.

1 0

list of spiffy places to put your money
by Vincent.Cate＠FURMINT.NECTAR.CS.CMU.EDU 17 Dec '03

17 Dec '03

Dan Harmon: >Robert Hettinga wrote: >> [...] But we knew this already, from a list of spiffy places >> to put your money published here a few weeks ago. > >Maybe we could get the list republished? The list is in: ftp://furmint.nectar.cs.cmu.edu/security/banks And for easy access to all sorts of fun stuff, try mosaic on: ftp://alex.sp.cs.cmu.edu/links/security/vac-security.html -- Vince

1 0

Re: list of spiffy places to put your money
by Vincent.Cate＠FURMINT.NECTAR.CS.CMU.EDU 17 Dec '03

17 Dec '03

I wrote: >And for easy access to all sorts of fun stuff, try mosaic on: > > ftp://alex.sp.cs.cmu.edu/links/security/vac-security.html But I really meant to give the following URL (more fun): ftp://furmint.nectar.cs.cmu.edu/security/README.html -- Vince

1 0

Re: back to programming projects...
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > On a related note, should encrypting remailers have the keys changed > > regularly? The RSA-IDEA combination isn't very suspectible to known > > plaintext attacks, right? Right. There are two sets of encryption used in the RSA-IDEA combo: 1) RSA, encrypting a random session key with a public-key algorithm. By definition, RSA-like public key algorithms can easily have known or chosen plaintext generated, since you can encrypt anything you like. RSA isn't susceptible to known-plaintext (except for verifying that a (presumably stolen) private key is correct, or by factoring very large numbers of very large prime numbers and checking them, which is computationally infeasible), and any other public key system that *were* susceptible to known-plaintext attacks wouldn't be very useful. Major breakthroughs in factoring theory could always change this, earning mathematical fame and fortune for the discoverer. Short RSA keys can be factored; you're better off with 1024-bit keys or longer for anything you're real serious about. 2) IDEA, encrypting the message itself using the session key. IDEA is not known to be susceptible to anything better than brute force, so known-plaintext attacks require trying 2**128 keys, which is computationally infeasible. Perhaps someone can find a hole in IDEA, but there's nothing major at present. 3) There's a third component that might use encryption - generating the "random" session key. Obviously, if you use the same session key to send different messages to different people, they might notice. If you use different session keys to send messages to people, but the session keys are easily derived from each other, and one recipient notices the pattern from several messages sent to him, he might try guessing the key for the next messages you send to other people. So use a genuine high-quality random number generator. There is one more special case, which is sending the same message to multiple recipients, with the message encrypted once with the session key, and multiple versions of the session key encrypted with each different recipient's public key. I've forgotten the details, but if there are more than e recipients, it's possible to crack this. (e is the encryption exponent, typically 3 or 17.) That's why PGP and other well-designed systems will pad the session key with random stuff before encrypting with RSA (which is an essentially free operation, since the RSA blocksize is much larger than the session key for IDEA.) Bill

1 0

Re: Protocol Wanted!
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> How does Bob make Alice aware that he can factor RSA keys > and make sure that he and Alice can do business without > either one of them getting ripped off or the NSA catching him. Sounds like a job for Blacknet, or similar anonymous-broadcast systems. He can't easily hide the fact that *somebody* is in the business from the NSA, since he can't easily tell that Alice doesn't work for the NSA and isn't planning to publish his business's existence to the net. But if he and Alice are both remailer-users able to post to the Blacknet broadcast (using whatever mechanism, like alt.waste), Bob can post a note to Alice saying he is able to crack RSA keys for money, and Alice can post replies saying she doesn't believe him and here's a message to crack. There are cut-and-choose protocols described in Schneier that can handle (awkwardly) the mechanics of getting Bob to recode and return the message, and Alice to hand over the digicash, without either of them feeling too ripped off, assuming there's a digicash system in place that gives sufficient anonymity. Bob has a bit of an advantage in convincing Alice, since he can probably read her encrypted posts to the net - he can start teh conversation by posting to her on Blacknet with some keywords from messages she's posted to other people. That doesn't directly tell her that he's cracking RSA rather than IDEA/3DES, but he could also include a note that the first n bits of her private key are ....... Alternatively, he can go on a political rant about Too Many Secrets, but having seen that movie he can announce the details of his decryptor on sci.crypt *before* announcing that he's giving a lecture at Stanford... :-) Somebody, in the discussion about pricing, said that some of the proposed protocols would take too much CPU time, cracking lots of keys just to demonstrate that he can do it, and that he should always charge money to avoid overloading his 486 box. If he's going to go into the business of factoring RSA keys for money, he'll probably make enough to afford a few *new* computers once he hits up a couple of wealthy customers, if he's not spending it all on air travel and bodyguards. "Bob"

1 0

RE: cypherpunks list wiped out again... (duplicate)
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

================ > From: IN%"rslau(a)usc.edu" 12-JUN-1994 17:57:04.72 > To: IN%"cypherpunks(a)usc.edu" > Subj: cypherpunks list wiped out again... (duplicate) > It looks like the cypherpunks list was wiped out again this afternoon... > I think I may have found the bug in majordomo that caused this or maybe > it's just coincidence since the last time this happened was also on a > sunday afternoon, i believe. there must be a timebomb in majordomo ala > pgp 2.6 :) > > Resubscribe by sending the following in the body of the message to > majordomo(a)toad.com: > > subscribe cypherpunks > > Robert Lau - Systems Programmer, Unix Systems 213-740-2866 > -- University Computing Services Internet: rslau(a)usc.edu > -- University of Southern California Bitnet: rslau@uscvm > -- 1020 W Jefferson, LA, CA USA, 90089-0251 UUCP: > ...!uunet!usc!rsla> This may sound like a "dumb" question, but if the list was "wiped out", why did I receive this? ====================

1 0

List Maintenance
by hugh＠ecotone.toad.com 17 Dec '03

17 Dec '03

Today the disk that the cypherpunks list lives on filled up, and then someone try to join the list and the list got zeroed again. I am currently installing a new version of MajorDomo and making changes to prevent this happening (at least we caught it in the act this time). The list will likely be up and down a little bit for the next few hours or day (hey, I have to sleep sometime! :r) but should be fully stable again by Tuesday in any case. This time I do plan to install a recent backup of the list. If you have any questions please email mail, this list it's self does not need any more crud on it. ||ugh Daniel Sometimes Postmaster hugh(a)toad.com

1 0

Re: CERT warning about majordomo
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Regarding the list going down again: I was just informed that CERT has issued a warning about a security hole in majordomo. Anyone have any info on this? Yes. The list owner will if he's on the majordomo list. He's presumably upgraded his copy of majordomo about a week ago. If he hasn't, he should. G PS Was a 22 line message for 3 lines of content really necessary?

1 0