December 2003 - cypherpunks-legacy

Re: Court proceedings under new SAFE act]
by Omegaman 17 Dec '03

17 Dec '03

On Thu, Sep 11, 1997 at 06:12:15PM -0700, Declan McCullagh wrote: > I'm reading the bill more closely. This is incredibly slick work. > > 1. When it appears that any person is selling, importing, or distributing > non-backdoor'd crypto or "about" to do so, the Atty General can sue to > stop them. "Upon the filing of the complaint seeking injunctive relief by > the Attorney General, the court shall automatically issue a temporary > restraining order against the party being sued." "distributing" Does that include paper copies of source code? How about slowly and carefully reciting source code to an audience? Writing it on a blackboard, perhaps? What if I respond to Adam Back and accidently forget to snip his .sig? (if that's not prior restraint, I don't know what is!) > 2. There are provisions for closing the proceedings -- at the request of > the "party against whom injunction is being sought." "Public disclosure of > the proceedings shall be treated as contempt of court." Can also be closed > if judge makes finding. This, of course, is what remailers are for. More prior restraint, of course. > You get notified not later than 90 days afterwards. There are a lot of > other "checks and balances" here that will be touted as safeguards. Who's being saved? Fuck 'em. -- --------------------------------------------------------------------- Omegaman <mailto:omegam@cmq.com>|"When they kick out your front door, PGP Key fingerprint = | How are you gonna come? 6D 31 C3 00 77 8C D1 C2 | With your hands upon your head, 59 0A 01 E3 AF 81 94 63 | Or on the trigger of your gun?" Send email with "get key" as the| -- The Clash, "Guns of Brixton" "Subject:" to get my public key | _London_Calling_ , 1979 ---------------------------------------------------------------------

5 4

Need Pathfinder "Cypherpunks" password
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- What is the Cypherpunks password to be used with Pathfinder, Time-Warner's web site? TIA, - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMGSROioZzwIn1bdtAQHi2AGAi18zy9bn/EvI65yoyqAPcQonmp3gaB7y Di2Jqq0KLUZFR4fzvwxoM4ZVWNfafQ7r =wBeD -----END PGP SIGNATURE-----

1 0

Important Announcement from Money & Investing Update
by Money & Investing Update 17 Dec '03

17 Dec '03

The Wall Street Journal's Money & Investing Update (http://update.wsj.com) has now introduced Company Briefing Books, a major product enhancement that enables Update readers to get a rich, up-to-the-minute background report on any company in the news. Briefing Books are highly graphical compilations of recent news, stock charts, and financial data, available on more than 6,500 U.S. and international companies. They include news from The Wall Street Journal and Dow Jones newswires, as well as background reports and performance data from other leading information sources. Money & Investing Update editors now include direct hyperlinks to Briefing Books from nearly every significant mention of a company in Update stories and tables. In addition, readers can ask for a Briefing Book on a company of their choosing at any time simply by entering a company name or stock symbol. The Money & Investing Update is at http://update.wsj.com. If you haven't read the Update in a while, please try this important new feature. You can go directly to a Briefing Book request form at this URL: http://update.wsj.com/briefingbook/inap/search.html. Best wishes, The Editors and Staff of Money & Investing Update ---------------------- For further information, contact us at info(a)update.wsj.com or call customer support at 1-800-369-2834. If you would prefer not to receive any future email from the Money & Investing Update please send email to "LISTSERV(a)PEACH.EASE.LSOFT.COM" In the body of your message please type "UNSUBSCRIBE WSJ-ANNOUNCE"

1 0

Re: Taxless society concerns]
by Omegaman 17 Dec '03

17 Dec '03

On Thu, Sep 11, 1997 at 12:10:41AM -0600, Warpy wrote: > First off. In such a society, who cares for the old, the sick, and the > infirm? How is such care going to be payed for? How will basic services be > maintained without the necessary taxes required to pay for them? Family. Friends. What basic services are you referring to? > Now before you start yelling at me and calling me a government > sympathiser, let me say that i am disgusted at the amount of money spent > by governments around the world on military equipment and personnel. If > such a taxless society were to eventuate there would be *hopefully* that > much more money floating around to help those who need it most. The money won't be "floating around," it will be in the pockets of individuals instead of being paid out as taxes. > But the question remains. In such a taxless society, and little or no > government, how are those less fortunate than us going to be cared for? You should do more examining of Libertarian resources on the net. And do some thinking on your own. Start with the presumption that individuals and private organizations can operate more efficiently than the government. -- --------------------------------------------------------------------- Omegaman <mailto:omegam@cmq.com>|"When they kick out your front door, PGP Key fingerprint = | How are you gonna come? 6D 31 C3 00 77 8C D1 C2 | With your hands upon your head, 59 0A 01 E3 AF 81 94 63 | Or on the trigger of your gun?" Send email with "get key" as the| -- The Clash, "Guns of Brixton" "Subject:" to get my public key | _London_Calling_ , 1979 ---------------------------------------------------------------------

1 0

Re: "random" number seeds vs. Netscape
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:29 PM 9/23/95 -0400, you wrote: >Can you take the time between two effectively async events, and use the >low order bits of same? >For example, time between a netverk pack arriving and the next tick of >the TOD clock? And/or the system's disk IO or such? You might get some entropy there, but you can get more (though perhaps not measurably more) by using the values of both instead. For instance rand = MD5(rand, lowbits(T(clock) - T(packet))) vs rand = MD5(rand, T(clock), T(packet)) As long as you're not overoptimistic about how many real bits you've gotten, might as well actually use the version that keeps more low-quality bits than try to improve them. Also, do watch out for things that aren't really asynchronous, e.g. the next clock tick will probably happen at some even multiple of 1000000/Hz microseconds. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Hello
by Xavier Naveira 17 Dec '03

17 Dec '03

Hello!!!!

1 0

Re: The problem of playing politics with our constitutional rights]
by Omegaman 17 Dec '03

17 Dec '03

On Fri, Sep 12, 1997 at 12:06:35AM -0800, John Smith wrote: > > Why do you say that? Clipper was defeated. People all over the net > united and opposed it. Now there is this new threat, but at least > defeating Clipper bought some time. There is no reason the same > thing can't happen again. > > Sometimes I think cypherpunks *want* crypto to be outlawed. No. Cypherpunks *expect* it will be outlawed. And it will be yet another largely uneforceable restriction. Sure you can run around and trumpet about how bad it is that your government is going to outlaw cryptography. You can rant at the fundamental unconstitutionality of it. You can try to convince legislators who don't even know what a mouse is that outlawing crypto is a bad idea. If it makes you feel good and you think its a valuable effort, knock yourself out. Personally, I'd like to see more disposable remailers, more stego,continued development of the eternity server and similar ideas, and an implementation of untraceable anonymous digital cash. (We have until Jan. 1, 1999) Phil Z. didn't release PGP to show how much he disliked Clipper or join in some unified opposition. He released it to beat the government's efforts to the punch and get unrestricted strong crypto into the hands of anyone who wanted it -- --------------------------------------------------------------------- Omegaman <mailto:omegam@cmq.com>|"When they kick out your front door, PGP Key fingerprint = | How are you gonna come? 6D 31 C3 00 77 8C D1 C2 | With your hands upon your head, 59 0A 01 E3 AF 81 94 63 | Or on the trigger of your gun?" Send email with "get key" as the| -- The Clash, "Guns of Brixton" "Subject:" to get my public key | _London_Calling_ , 1979 ---------------------------------------------------------------------

1 0

Cypherpunks Lite
by hshubs＠BIX.com 17 Dec '03

17 Dec '03

Would the person who does this, or someone who can point me at him, contact me via e-mail please?

4 3

(fwd) IRS Modernization
by Damaged Justice 17 Dec '03

17 Dec '03

-- forwarded message -- Path: wmich-news!gumby!newspump.wustl.edu!news.starnet.net!news.starnet.net!spool.mu.edu!uwm.edu!computer-privacy-request From: Monty Solomon <monty(a)roscom.COM> Newsgroups: comp.society.privacy Subject: IRS Modernization Date: 12 Sep 1997 19:33:17 GMT Organization: Computer Privacy Digest Lines: 170 Sender: comp-privacy(a)uwm.edu Approved: comp-privacy(a)uwm.edu Message-ID: <comp-privacy11.11.10(a)cs.uwm.edu> NNTP-Posting-Host: 129.89.2.6 X-Original-Submission-Date: 11 Sep 1997 22:08:16 -0400 X-Submissions-To: comp-privacy(a)uwm.edu X-Administrivia-To: comp-privacy-request(a)uwm.edu X-Computer-Privacy-Digest: Volume 11, Issue 011, Message 10 of 12 X-Auth: PGPMoose V1.1 PGP comp.society.privacy iQBFAwUBNBl8mTNf3+97dK2NAQGjTQF+IShsF6F0xmyCQi25Bh5+nlwfIOHLPVXm Aes89JHkrNTHPkuow8lQY/VJGKH4V/nY =pEpf Originator: levine(a)blatz.cs.uwm.edu Xref: wmich-news comp.society.privacy:527 Begin forwarded message: Date: 23 Aug 1997 21:21:31 -0700 From: Michael Dodas <miked(a)NOSPAM!.utw.com> Subject: IRS Modernization - Request for Information Newsgroups: comp.software.year-2000 I just recently read IRS's "Request for Comments (RFC)", which solicits comments for modernizing the IRS's tax systems. This document is the first information I've seen that shows just how desperate the IRS is and how complex the IRS tax systems are. Their systems are literally incomprehensible. I won't even attempt to describe this document in any type of detail. My comments are merely those taken from the document that "caught my eye" upon my first reading of this document (RFC). To truly appreciate the gravity of what the IRS wants to accomplish, you'll need to read the entire document. Keep in mind, also, that the Modernization effort is intended to proceed as a separate project from the Year 2000 correction effort. The document, which I will refer to as the RFC, begins with a cover letter from Arthur A. Gross, Associate Commissioner/Chief Information Officer at the IRS. Mr. Gross acknowledges that "the IRS assumed primary responsibility for managing both systems development and integration with less than acceptable results". This statement sets the tone for the IRS's direction of creating a "partnership" with the private sector "stakeholders" to modernize the IRS. Mr. Gross further indicates that it is "myth" to believe that the private sector alone could modernize the IRS, since IRS possesses the necessary "knowledge of tax administration" to build a new system. For all intents and purposes, IRS wants to turn over all of the project management, re-engineering, systems engineer, design and development and integration expertise to the private sector. I always knew the IRS was extraordinarily complex, but it is more complex than I could have ever imagined. The RFC indicated that the complete Modernization Blueprint consists of seven volumes--count them--seven volumes. It may be a simpler system, but it will inevitably end up being yet another complex monster. The RFC continues to say that "during the 1980's and early 1990's, effort focused on delivering taxpayer services and compliance functionality together with limited on-line development of stand along "stovepiped" systems with stand along data bases utilizing the principles of distributed computer processing, an approach to computing en vogue during the late 1980's and 1990's. Overall, the IRS computing environment evolved into an extraordinarily complex array of legacy and stand alone modernized systems with respect to both connectivity and interoperability between the mainframe platforms and the plethora of distributed systems." In other words, the IRS succumbed to "fashion technology" solutions which did nothing but complicate their previous efforts to modernize. To give you an idea of how large the IRS's information system are, consider these statistics from the RFC: There are three computing centers, with sixty (60) mainframes in ten regional service centers. NONE OF THE MAINFRAMES ARE CENTURY DATE COMPLIANT. There are 62 million lines of code in the IRS core business systems. Duplicate distributed networks have interoperability and connectivity problems and are largely not century date compliant. IRS mentions "risk" many times in the RFC. "While the risks inherent in Phase III may be nearly incalculable given the aged systems, the absence of critical documentation, dependency on Assembler Language Code (ALC) and the inevitable turnover of the IRS workforce supporting these systems, it is essential to plan and execute the conversion of the Master Files and its related suite of applications". IRS seems to know that it will not be able to retain its technical expertise, who will probably bail for better paying jobs. The IRS's goal is to canvas "any reasonable strategy to move forward on modernization" while, at the same time, managing the immediate crisis (Y2K) to "stay in business". Given the complexity of IRS, its past modernization failures and the Year 2000 problem facing them, you would have to be insane to believe these goals were obtainable. The Next Eighteen Months: Staying In Business And Preparing For Modernization: While searching for executive and senior information technology managers, the IRS received in excess of 800 applications from the "not faint of heart". IRS has an interesting way of describing what kind of job is in store for these people. They'll be luck to keep any of them around long-term. Rebuild Product Assurance. IRS indicates that staffing levels have sunk to less than 30 percent of the minimum industry standards, and is one of the highest priorities with IRS. The RFC indicated that today, major tax systems changes are not subjected to comprehensive testing prior to being migrated to production. Moreover, the Century Date conversion will place an extraordinary additional burden on the Product Assurance Program. I think what IRS is saying here is that they don't have the staff for a Y2K remediation effort and have obviously only partially completed the inventory phase. The IRS indicates that "it must undertake and complete major infrastructure initiatives no later than June 1999 to minimally ensure century date compliance for each of its existing mainframes and/or their successor platforms. At the same time, the IRS must complete the inventory of its field infrastructures as well as develop and execute a century date compliance plan for the conversion replacement and/or elimination of those infrastructures." How in god's name is this possible by June 1999 when they haven't even started. Notice how they used the words "minimally ensure century date compliance". What is that going to accomplish. Either you're compliant or you're not. Basically, the IRS admits it was "wrong-headed" to modernize the legacy systems instead of creating a brand new system. Considering the spaghetti code and systems in place, I would have to agree. On the other had, the IRS is indicating that contractual agreements may be extended for up to fifteen (15) years for the modernization effort. The new system will probably be obsolete before it ever gets off the ground. The last thing I will point out in the document stood out to me as the most profound of all, for obvious reasons. This is the way IRS describes themself: "The Information Systems (IS) organization of the Internal Revenue Service (IRS) is a huge enterprise--employing in excess of 7,500 personnel across the United States, budgeted in excess of $1 billion annually and responsible for the design development and ongoing support of a highly complex and vast array of technologies which, taken together, comprise the technology-based engine that powers the IRS. A $1.4 trillion Financial Services Program, IRS business enterprises are unprecedented in size and scope - a Fortune One company - with service centers, district office and regional office operations, staffed by more than 100,000 employees, largely dependent on highly automated process as well as the currency, comprehensiveness and availability of vast storehouses of computerized data. The latter half of the last decade of the twentieth century presents IS management and staff with unprecedented challenges: fraught with risks and potential for failure; yet filled with opportunity to serve the nation's taxpayers, while contributing to the creation of the largest and most sophisticated technology-based program in business or government". The above two paragraphs may well be the IRS's epitaph. In my opinion, the only way the Federal Government can secure its tax revenue collection system is to completely repeal the current United States Tax Code and replace it with a VERY simple one like a flat tax. Any attempt to fix (Y2K and Modernize) is impossible. The IRS is a classic example and sets the standard for systems which are too complex to automate. This level of complexity should be limited to scientific endeavors. I truly believe that it will be easier for NASA to put a man on Mars more easily and quickly than to continue on with the current IRS and tax code currently in place. This amazing document can be found at: http://www.ustreas.gov/treasury/bureaus/irs/prime/primerfc.htm Then select Request For Comment No. TIRNO-97-H-0010 It is a 116 page Adobe Acrobat document. I had great difficulty printing the document because of the complex diagrams. I have a HP Laserjet/4 with 4 megs of memory. The only way I could print it was to use a Laserjet/III driver. It worked at the high resolution, but not as well as the Laserjet/4. Leave it to the government to create a document that you can't even print easily! Happy Reading, -- Mike Dodas -- end of forwarded message --

2 1

Re: Any talk of limiting _existing_ crypto? (fwd)]
by Omegaman 17 Dec '03

17 Dec '03

On Fri, Sep 12, 1997 at 12:00:43AM -0500, Jim Choate wrote: > > How about the system file i/o level? Sort of like TCFS (Transparent Crytpographic File System) for Linux? Is there such a thing for Windows? NT? Mac? If so I've heard of none. -- --------------------------------------------------------------------- Omegaman <mailto:omegam@cmq.com>|"When they kick out your front door, PGP Key fingerprint = | How are you gonna come? 6D 31 C3 00 77 8C D1 C2 | With your hands upon your head, 59 0A 01 E3 AF 81 94 63 | Or on the trigger of your gun?" Send email with "get key" as the| -- The Clash, "Guns of Brixton" "Subject:" to get my public key | _London_Calling_ , 1979 ---------------------------------------------------------------------

1 0

Re: Let sleeping dogs lay]
by Omegaman 17 Dec '03

17 Dec '03

On Thu, Sep 11, 1997 at 05:04:52PM -0700, Tim May wrote: > > "Nothing good can come out of crypto legislation." > > --said by several of us over the past year > > > The big mistake was ever introducing the SAFE and Pro-CODE bills, as it > brought the NSA and FBI out of their warrens and into the warrens of > Congress. Without any crypto bills at all, it is possible (though by no > means certain) that no legislation at all would have been introduced this > year. And the longer the wait the better. Some have complained that the status quo situation of export restrictions was unacceptable. Yet the spread of crypto has largely been unrestrained -- a stay of execution so to speak. The longer the status quo remains, the more ubiquitous crypto becomes and future legislative efforts are undermined. That said, I think these organizations made a strategic error. Had a draconian bill been introduced first, opposition probably would have played out differently in the press. We saw this with Clipper. I believe commercial interests played a large part in the push for legislation. Just another player in the game, I suppose. > But once SAFE and Pro-CODE were out there, on the table, the forces in > favor of a surveillance state began their lobbying in earnest, giving the > infamous "if you only knew what we knew" scare tactic pitches. Last minute > amendments and even complete bill replacements are easier to slip in than a > Big Brother bill from the gitgo. Sure enough, the tide is now moving > swiftly toward a future far, far, far worse than the mere annoyance of > export controls. You almost sound surprised. Did they really think Congressman would understand crypto? Congressmen _do_ understand law and order and protecting poor defenseless children from porn. They understand preventing "another Oklahoma. And it's an easy sell to their constituencies, too. The average schmoe may indeed *want* more freedom, but he also he wants to be protected. And he also has a limited understanding of the equation. The easiest explanation wins, of course. > to prison." The current language is of course a full-blown disaster. > Pandora's box was opened by SAFE and Pro-CODE. > > And so here we are. Multiple committees in both houses jockeying to see who > can clamp down the hardest on crypto. > > CDT, EPIC, and all the other Beltway insiders ought to think about this > mess. Sometimes it's better just to let sleeping dogs lay. Or lie. Or > whatever. Some people just don't get it. You'll never gain more freedom through more legislation. -- --------------------------------------------------------------------- Omegaman <mailto:omegam@cmq.com>|"When they kick out your front door, PGP Key fingerprint = | How are you gonna come? 6D 31 C3 00 77 8C D1 C2 | With your hands upon your head, 59 0A 01 E3 AF 81 94 63 | Or on the trigger of your gun?" Send email with "get key" as the| -- The Clash, "Guns of Brixton" "Subject:" to get my public key | _London_Calling_ , 1979 ---------------------------------------------------------------------

1 0

Apology to Netscape.
by carolann＠censored.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jeff Weintstein corrected me with: > This is what our press release said: > > An updated version of Netscape Navigator 1.1 for Mac OS > and Unix and Netscape Navigator 1.2 for Windows 3.1 and > Windows 95 will be available for downloading by existing > customers on the Internet next week. My apologies for the misquote. It only then makes the trading facts worse. Love Always, Carol Anne ps On the asides kind of things, do you realize the Netscape stock base of 5,000,000 shares is not a big sharebase? Coca-Cola's is 1,300,000,000. And by standards, your stock is really unstable. If Coca-Cola moves 3 points there'll be a trading halt, for the buying/selling imbalance will be too much. Even if only for 1 min. The trading halt gets the good or bad news onto "The Street". -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMGUCaYrpjEWs1wBlAQF9ZAP6AkMCsveSU/E8KFDi84urnAR2KlXT42rS l+9tHh33ZWbM6VmHUMkqelM11vc7zU1eWLhXlYHaoOqwGuTef9irQigbnr+HwYKL Px9480/Chm59RWCG6j4pp4d0xUQO9Pj0lbpIecn72eDYReRIgh5+MU0jOCNdUNLe RvP7XvYI570= =Nb9y -----END PGP SIGNATURE----- -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Amazon.com Books -- personal notification service
by eyes＠amazon.com 17 Dec '03

17 Dec '03

Hi, as per your request, we at Amazon.com Books are notifying you of new books matching the following criteria: subjects include "Cryptography" The new books are listed at the end of this message. If you're interested in any of these books you can order them online at http://www.amazon.com/ Your most humble automated search agent, Eyes Amazon.com Books http://www.amazon.com/ P.S. Please don't forget that Amazon.com Books has over one million titles for you to choose from, many discounted 10 to 40 percent off the list price. If you have any online friends who might enjoy Amazon.com Books, we'd really appreciate you spreading the word! Thank you! ------------------------------------------------------------------------ "Advances in Cryptology--Eurocrypt-94 : Workshop on the Theory and Application of Cryptographic Techniques, Perugia, Italy, May 1994 : Proceedings)" by Alfredo De Santis List Price: currently unknown Subjects: Computer security, Cryptography Publisher: Binding: Hardcover Expected publication date: September 1995 ISBN: 3540601767 ------------------------------------------------------------------------ "Enigma : A Novel" by Robert Harris, David Rosenthal(Editor) List: $23.00 -- Amazon.com Price: $20.70 -- You Save: $2.30 (10%) Subjects: World War, 1939-1945, Secret service, Great Britain, Fiction, Cryptography Publisher: Random House Binding: Hardcover Expected publication date: October 1995 ISBN: 0679428879 ------------------------------------------------------------------------ "Pass It On! : All About Notes, from Secret Codes and Special Inks to Fancy Folds and Dead Man's Drops" by Sharon Bailly, Anne Canevari Green(Illustrator) List: $18.90 -- Amazon.com Price: $18.90 Subjects: Cryptography, Juvenile literature, Writing Publisher: Millbrook Pr Binding: Library Binding Expected publication date: September 1995 ISBN: 1562945882 ----- End of forwarded message from eyes(a)amazon.com -----

1 0

Distribute a key, go to prison.
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:tcmay@got.net to Harka <=- In> "Distribute a key, go to prison." In> Simple, by declaring that public keys themselves are crypto In> material, as the Brits did in their Trusted Third Parties In> draft proposal, and hence declaring that distribution of keys In> after the effective date of the legislation constitutes a In> violation. Give someone your key, either by placing it on In> keyservers or even by mailing it to them, and one has just In> "distributed" crypto. In> This will make the public key infrastructure essentially In> useless, as the public key servers go down, as corporations In> yank any directories they may have, and (possibly) as In> individuals stop putting PGP or S/MIME fingerprints or In> pointers in their messages. But then the same thing will happen as with "censored" web pages. Mirrors of key servers will be all over the world and render such laws kinda useless. You do have a point, however. I was thinking about a possible nightmare-scenario similar to that: Remailers (as crypto-providers and distributors) will be taken down in a syncronized effort in at least the western world. Non-government-approved crypto outlawed simultaneously. A few highly publicized cases of "violators" who use crypto anyway. Enough to scare the other 95 percent into complying. Once that happens it will be too late...at least for a few decades. Therefore crypto needs to be distributed and _used_ on a wide scale. Maybe spamming the Net (once :)) with PGP will at least make a nice publicity-stunt. Instead of "Adopt your legislator"-stuff it should be "Adopt your local computer-fellows" to use PGP, Remailers etc.. Those who have the resources should implement new remailers, key servers etc.. Cypherpunks don't whine! Cypherpunks have no need to be defensive! Cypherpunks write code! Ciao Harka ... "Use a Cipher - Be Free!" -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNBsDNzltEBIEF0MBAQGxTAf/WkPXY3Or4Ces2N0PGfmrdQL7G7lqqjyw AVZVJv4/gsSXuiIoRIOh7GjVBWRMX4xli1835cvXrwwnQnw1YmOcaMBHLNvQ6kVT FVv3BVc8rcP5l5uaqJsByWHjXDa7kmuRGrmzP6mv7ZBQRbaiqGZp0E2vDZpxjhND he3HLCSR2TIzyR/o1pzdwFQzvfOSZh42yU5ssFLEcF5C0L/1KYMUJxyYYQ7aZoJN vFBwO5rx+nk+csRRNGVoUTDZ3NcZWf46h21+Gc8BF2L4zQN/3p4FJUswBHEFO87Q hqhA10lSrHdH2Lfb3ypFPlee7L1oaAx0T8dgBds/51R8geMp7NwI8Q== =It/0 -----END PGP SIGNATURE-----

1 0

Re: macworld crypto articles
by dmandl＠panix.com 17 Dec '03

17 Dec '03

At 3:49 PM 9/23/95, steven ryan wrote: >They searched for an applications programmer *UN*skilled at cryptography to >try and crack the password protection of the 8 best selling Mac programs. >Quicken 5.0 was cracked in 5 minutes. Adobe Acrobat in 2 hours. Yup, pretty amazing. I only skimmed the article, but I believe that out of all the programs he tried, there was only one whose crypto he couldn't crack. I found it all a little hard to believe. I mean, even if they used the most obsolete algorithm, wouldn't you have to know _something_ about cryptanalysis to crack it? Are these vendors just putting a "this file is locked with this such and such a password" string at the front of the file, or what? Interesting historical note: In my old APL days (early 80's), IBM used to lock their VSAPL workspaces with just such a scheme--a "locked bit" at some fixed position in the file. But there were enough other reasons not to use that horrible product... --Dave. -- Dave Mandl dmandl(a)panix.com http://wfmu.org/~davem

3 2

Amazon.com Books -- personal notification service (fwd)
by Adam Shostack 17 Dec '03

17 Dec '03

Amazon.com books (which someone mentioned here a few days ago) has a free personal notification service for new books of interest. They also claim not to sell your preferences if you so request. They have Springer-Verlag conference proceedings, and books by Hakim Bey. I spent a while telling them all about whose new books I'd like to hear about, and this came to me today. Adam ----- Forwarded message from eyes(a)amazon.com -----

1 0

Re: Real issue of crypto controls: security or taxation loss?
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

On 13 Sep 97 at 20:53, iang(a)systemics.com wrote: > > Any comments about why we should *not* put most emphasis on the > > financial aspect of crypto? > > You answered it yourself. There are more palefaces than bright-eyed > injuns. > > Sun Tsu (from memory): select the battleground where you are strongest and > the enemy is weakest. > > A battle on the field of taxation is a wipeout. At least, on the field of > privacy, 4th amendment and so forth provides a few weapons for the Freedom > Fighters. Sorry to say, but I don't completely get you idiosyncratic language. My perception of it is that when you explain thoses things to productive individuals, i.e. individuals that get a lot of their money confiscated, most of them get quite interested while if you talk about the capability of talking dirty to your lover without your mother in law being able to know, they yawn faster than you can say "bit". Thus, IMO, brigning the discussion on the ground of taxation would be an attention getter. At least concerning the "guerilla" spreading of crypto, as Tim mentionned. Ciao jfa -- Jean-Francois Avon, Pierrefonds(Montreal) QC Canada JFA Technologies, R&D physicists & engineers Instrumentation & control, LabView programming. PGP keys: http://w3.citenet.net/users/jf_avon and: http://bs.mit.edu:8001/pks-toplev.html PGP ID:C58ADD0D:529645E8205A8A5E F87CC86FAEFEF891 PGP ID:5B51964D:152ACCBCD4A481B0 254011193237822C

1 0

Found on usenet: ACLU -- "Big Brother and the power of the Net"
by stevenw＠iglou.com 17 Dec '03

17 Dec '03

The Midpeninsula Chapter of American Civil Liberties Union of Northern California presents a free program, open to the public Speaker: Jim Warren, MicroTimes correspondent, originator of the West Coast Computer Faire, PBS Computer Chronicles and numerous other enterprises Topic: Big Brother and the power of the Net Time: Tuesday, October 17, 1995 at 8:00 pm Place: Mandarin Classic Restaurant; First & Main Streets, Los Altos There is no fee and no reservation is required for those coming just for the program, but this is the annual meeting of the Midpeninsula Chapter and is preceded by a reception and dinner that are open to the public, but for which a reservation is required (see below). 6:00 pm Reception and no-host bar 7:00 pm Dinner 8:00 pm Jim Warren speaks ------------------------------------------------------------------------- Dinner Reservation Please return by Friday, October 6, 1995 Dinner reservation for ____ person(s) Check for $ _____ ($25 per person) is enclosed. Please make check payable to ACLU Mid-peninsula. Mail to: Iris Barrie If you have questions, call: 4250 El Camino, D-138 Iris Barrie at 415-856-0193 Palo Alto, CA 94306 -- Les Earnest (les(a)cs.stanford.edu) Phone: 415 941-3984 Computer Science Dept.; Stanford, CA 94305 Fax: 415 941-3934 ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more +1 415 390 9732 | than just a place to find pictures | of people having sex with dogs." stevenw(a)iglou.com | -- Time Magazine, 3 July 1995

1 0

Nuke 'em 'till they glow (8)
by Adam Back 17 Dec '03

17 Dec '03

My contribution to the collaborative future fiction: "The True Story of the InterNet" by Bubba Rom Dos, et al. Enjoy, Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc` The True Story of the InterNet Part III Chapter 8 Nuke 'em 'till they glow Jonathan decadently lounged on the worn sofa swigging Bubbas special reserve straight out of the bottle. He burped and tossed the empty bottle to join the pile of kipple heaped in the corner -- an antique pentium-II 400 with it's case off, a huge heap of hydrocubes, a couple of busted flatscreen monitors, some empty pizza boxes. Leaning against the wall lay Bubba Rom Dos, snoring quietly, and clutching a half empty bottle of his special reserve. Jonathan lay back trying to brainstorm a direction to explore to find an exploitable bug in the Hewlett-Packard Fabasoft faba-code verifier. He was fast running out of ideas. The desire to find an exploit had arisen earlier that day when Bubba Rom Dos had tossed him a hydrocube which contained a particularly interesting deskfab 6 file. The file was named "nuke.fab". He couldn't rightly see where Bubba could have come into possession of the file, but Bubba wasn't too forthcoming on the subject, so Jonathan had contented himself with examining the contents of the 'cube. He had quickly become engrossed with the contents. Jonathan had a selection of bootleg PICS fabrication policy files, ranging from `under 18 months' (for construction of soft cudly toys with no easily swallowable parts) up to `military grade IV' (good for things like Forestry Commision SWAT team issue rocket launchers, and stealth helicopters etc, if you had a 10m3 volume fabricator and a few GigaWatts on your electricity meter). A good indication that the file was the _real thing_ was that it failed the faba-code verifier with even military grade IV PICS fabrication rating policy file -- the verifier refused to 'fab the file because it rightly diagnosed that it would result in the formation of fissionable material! (How Jonathan came to be in possession of a military grade IV PICS fabrication policy file is a story for another time). Now Jonathan also had a hacked fabber -- it was hacked to completely by-pass the PICS policy file rating system. This in itself was supposed to be impossible, but Jonathan had found that you could replace the FAPI module signature verifying key embedded in the flipper policy chip by placing a piece of sticky tape over pin 5 of the smart card contact and brute forcing the LEAF field which for some reason seemed to only use a measily 16 bit checksum, which took all of half an hour to brute force. You'd have thought they would have learned and increased the checksum size after Matt Blaze brute forced the clipper chip LEAF in the tessera cards. But in fairness, Jonathan's attack had one extra wrinkle: the sticky tape. Normally the flipper chip wrote a count of how many smart cards with failed checksums were inserted, and alerted the forces of darkness after 3 false tries, but the sticky tape took care of that. Jonathan supposed the designers had not considered that someone might place sticky tape over pin 5, the pin which was used to signal an insertion of the smart card. With that hack completed and the flipper policy chip instruction code manual which the cypherpunks had obtained dumpster diving in the Mykotronics dumpster, he was in business. He had then blown a new EPROM with a `customized' firmware, the policy chip accepted the `Circle of Eunuchs' FAPI module signature on the hacked EPROM, because there was now nestling comfortably at the heart of the NSA designed `tamper-proof' fabber flipper chip a DSS key which read: Circle of Eunuchs <coe(a)dev.null> The original key had read: NSA FAPI signature key <dirnsa(a)nsa.mil> So much for NSA security, Jonathan chuckled at the rememberance of that exploit. Anyway, for amusement value, and 1.3 MegaWatts of electricity later (the cowboy had given him a hacked power board account -- phree electricity, wheee!), Jonathan's industrial grade Hewlett-Packard deskfab 9GSII fabber had produced a nice matt black suitcase. Jonathan watched the instructional 3d-mpeg file included on the hydrocube, and spent a good hour in awe playing with the controls on the suitcase. Satiated with knowledge now that he knew how to operate all of it's modes, he was lying comatose on the sofa wracking his brains trying to overcome the next hurdle -- how to construct the perfect way to nuke washington DC. His plan so far was to spam each of the `targets' with a word99 macro virus (thanks Bill Gates) in a document describing his `SFr 10,000,000 campaign contribution' which automatically spooled a mildly modified "nuke.fab" for fabrication, and turned off the fabbers status leds through a Hewlett-Packard firmware bug. Jonathan had all this down pat. (The modification to "nuke.fab" in case you were wondering was to put the suitcase in detonate with no bypass mode, with an initial count down of 30 seconds). The problem was -- all those congress-critters were bound to be running on a PICS fabrication rating below `national-security-emergency', and so the faba-code verifier would refuse to load the code. Worse still the non-hacked HP deskfab models after mandatory GAF (Goverment Access to Fabbers) was introduced would narc out the owner to the Feds within minutes, thereby alerting the dark forces as to what the plan was. The wall clock now read 3.30am. Jonathan dozed off to sleep dreaming of glow-in-the-dark congress-critters. ... "fifty-eight ... fifty-seven ... " Jonathan woke grogily to see a group of people huddled over a suitcase. In the middle of the group was Bubba Rom Dos grandiosely counting down, in between swigging from his bottle of special reserve and pressing buttons randomly on the suitcases control panel. Priscilla and Alexis were peering closely at the pretty flatscreen status display, making sage comments as to what the buttons might do, for all the world as if they were playing a video game. Jonathan came to his senses and screamed at the top of his lungs: "Nooooo!" and sprang to his feet. He almost fell over again as the effect of moving that quickly so soon after waking up hit him, his head swimming. All heads turned to face him. "Yaieeeeeeee!" yelled Jonathan, as he rudely barged his way to the suitcase control pannel, and began franticallly pushing buttons. After a short panic attack, he calmed down sufficiently to notice that the display read "no override". Having absorbed the entire instruction 3d-mpeg, Jonathan knew what that meant. The LCD display read 50 seconds. Bubba swigged another gulp of his special reserve, and said innocently "What's the problem?" Jonathan looked fit to explode, his pulse was racing and his head hurt horribly, "It's a nuke!" he screamed hoarsely, "and you've just armed it, and I can't disarm it, and you've got ..." his eyes tore to the display "45 seconds until you're vapourised." Priscilla was already running for the door screaming. Bubba belched loudly, and looked slightly ill. Alexis gulped and said "What now?". Bubba tosssed the empty bottle of special reserve on to the growing pile of kipple in the corner, and pulled a fresh bottle from inside his rain mac. "Lets think rationally here" said Bubba, calmly, pouring himself a shot of special reserve, "can't you um disable it, or um, un-fabricate it or something". A flash of inspiration hit Jonathan, seeping through his slowly waking brain (he was not a morning person). He flashed a grin to Bubba and walloped him hard between the shoulder-blades shouting, "You're a genius!" Jonathan then hugged Alexis lifting her off the ground. Bubba looked puzzled but pleased. Alexis looked a little worried. Jonathan looked at the display pannel on the suitcase "35 seconds". `No problem' he thought. He slammed the suitcase shut and practically threw it in to the HP deskfab 9GSII fabrication bay, and slammed the door shut. Then he grabbed the keyboard, and began typing at around 100 wpm. After a deathly long pause where the terabyte hydro drive light flickered intermittently, the fab drive hummed to life. The lights dimmed with the sudden increase in power consumption. A few seconds later the drive light blinked out, and the deskfab fell silent. "That," said Jonathan, stabbing the screen -rw-r--r-- 1 jon users 7516192768 Oct 4 10:12 tmp00001.fab where the words `tmp00001.fab' were emblazoned in green writing on a black background, "is an armed nuke". "Now, where was I?" mused Jonathan, and then remembering, rounded on Bubba, "Uh yeah, just where exactly did you find nuke.fab?" Bubba made an expansive gesture with his hands, and poured himself another shot. Throwing back the shot, Bubba said: "I got it off the web,", and began searching through the pockets to his rain mac, eventually pulling a scrumpled scrap of paper from his pocket, and handing it to Jonathan. "A kindly elderly gentleman with a 9mm uzi gave me this address," he explained. Jonathan looked at the badly scrumpled scrap of paper, and was just able to make out: http://jya.eternity/cryptome/nuke.fab Jonathan looked puzzled, the initials "jya" looked vaguely familiar to him from his reading of old cypherpunks posts. Ah, yes, it was that Architect guy, John Young, who kept getting into trouble over hosting materials that the feds didn't like. So he was using the eternity service now. Now the panic was over Jonathan resumed his position on the couch, allowing himself to recover from the previous nights hacking session. "Say Bubba," Jonathan said with his eyes closed, "do you have any ideas of how to by-pass the Fabasoft faba-code verifier on an HP deskfab?" Bubba finished his mouthful of strong spirits, "Huh? Wassat you say?" Jonathan explained to Bubba and Alexis the events of the night before and of the plan to nuke washington DC, and party-way through Priscilla returned, looking a bit sheepish for deserting them at such a crucial time. "So," said Alexis, "You used the deskfab to copy the armed nuke, hence disabling it?" "Sure, that's a standard function", said Jonathan, "it's a bit like a 3d photocopier, only you can set it to unfabricate the object being copied at the same time." "Well," pressed Alexis, miles ahead of Jonathan, and not needing the mini-lecture on deskfab functionality, "couldn't you copy a deskfab?" Jonathan opened his eyes from his inert position on the couch. "Uh, I dunno, yeah I suppose so...." Then Jonathan saw the light, a second time that day: "Heh, yeah, okay!" he enthused, "that's a cool idea Alexis." Alexis and Jonathan excitedly started unplugging the deskfab from the unix box. "Carry these," said Jonathan and thrust upon Bubba a laptop, the hydrocube containing tmp00001.fab, and a bundle of interface leads. Jonathan and Alexis proceeded to lug the desk fab out back, and down into the basement. Bubba and Priscilla followed puzzled as to what the excitement was. In the basement was an ancient looking Sun unix box. The screen was one of those huge glass tube affairs. Beside it sat what looked like a refridgerator with clunky looking dials on it. Jonathan powered up the Sun box. Suprisingly enough it actually booted, and 10 minutes later, after an agonisingly slow process where it went through checking (fscking) all it's ancient hard drives, which wirred and clicked noisly, it came up, and the prompt said: Welcome to toad.com login: Without hesitation, Jonathan logged in as `gnu', and immediately typed in a password. He was in. Bubba and Priscilla exchanged glances. Jonathan explained, "I shoulder surfed the password when John logged in when I was at the physical cypherpunks meet in my grandpas study all those years ago." "This," he said patting the minifridge sized machine humming noisily in front of them, "is his old machine, `toad.com', old home to the cypherpunks list." Next Jonathan lugged his deskfab into the refrigerator affair, which apparently was an antique deskfab, sat the lap top on top of it, and hooked the laptop up to the deskfab, and inserted the tmp00001.fab hydrocube into the laptops hyro drive. Then he wandered off in search of a portable power source. He came back lugging an emergency power module `liberated' from the electric company at some point in the past. He hooked-up the power module to the HP deskfab. "Now," said Jonathan, "the timing on this is a bit delicate", I think there's only around 20 seconds left on the nuke. Jonathan set the laptop on time delay to instruct the deskfab to refabricate the primed nuke with 20 seconds left to pop time, but not to start doing that for around 1 minute. Then he slammed the refrigerator sized fabricator door shut, and began typing in earnest on toad.com. The refrigerator started humming, and toad.com's drive started buzzing frantically. "Gee I hope the transfer rate on these mechanical drives is good enough to copy it before it fabricates the nuke", opined Jonathan. Jonathan started typing again. "Shit! we're gonna run out of space!" he said. And started typing frantically rm -rf'ing anything that could be rm -rf'ed without stopping the machine. He rm -rf'ed /usr/src, and /usr/spool/ and a bunch of other stuff. He made it with half a gig or so spare, and who knows how few seconds to spare. The refrigerator-sized deskfab stopped humming, and the hum of the contained HP fabber had stopped too as it had been rudely unfabricated by the antique fabber. Jonathan was pleased with himself now. "That," said Jonathan, with a stabbing motion -rw-r--r-- 1 gnu users 8589934592 Oct 4 10:42 donation.fab where the words `donation.fab' were emblazoned on the clunky glass screen, "is a freshly fabricated top of the range HP deskfab 9GSII, which is just about to fabricate a suitcase nuke, which will pop a few seconds after being fabricated". "But will it pass the faba-whatsit verifier?" asked Alexis. "Er are you sure this is a good idea?" asked Priscilla. "Of course it is," said Bubba. "That's a good question Alexis," Jonathan said ignoring the other chatter, "I'm not real sure. I think it should pass because, well, the faba-code verifier isn't _that_ smart, right. I mean to realise that it will build a HP deskfab, which just happens to have freshly downloaded instructions to build fissionable material patterned into it's memory modules, I mean that's like solving the halting problem right?" Bubba cleared his throat, "If I might make a suggestion here", he said, "now that the high falutin' theoretical stuff is out of the way, the obvious thing to do is try it and see." "A splendid suggestion", said Jonathan, begining to type once more, "very good Bubba, the empirical hackers approach." So Jonathan tried it, and saw. He typed: To: cypherpunks(a)cyberpass.net Bcc: president(a)whitehouse.gov Bcc: freeh(a)fbi.gov Bcc: feinstein(a)congress.gov ... Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_01BCB88F.57968E50" Content-Transfer-Encoding: 7bit This is a multi-part message in MIME format. ------=_NextPart_000_01BCB88F.57968E50 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Hello, Please accept our campaign donation of SFr 10,000,000 in used swiss francs. Just double click on the enclosed attachment in your mail reader, and it'll print out the donation file attached in an HP compatible fabber. You'll need quite a large fabber, as SFr 10,000,000 is quite bulky. Kind regards, The Circle of Eunuchs ------=_NextPart_000_01BCB88F.57968E50 Content-Type: application/octet-stream; name="donation.fab" Content-Transfer-Encoding: base64 Content-Description: donation.fab (DeskFab 6 Document) Content-Disposition: attachment; filename="donation.fab" AasdfAAzxcvAAA1234AA0M8R4KGxGudfghAApoiuAAASDFAertyAPgADAP7/CQAGAsdfgAwrtfAA zxcvAAA1234AA0M8R4KGxGudfghAApoiuAAASDFAertyAPgADAP7/CQAGAsdfgAwrtfAAdfAAzef [snipped to save space] 4AA0M8R4KGxGudfghAApoiuAAASDFAertyAPgADAP7/CQAGAsdfgAwrtfAAdfAAzefzxcvAAA123 ------=_NextPart_000_01BCB88F.57968E50 Bubba, Alexis and Priscilla wandered back up stairs to wait and see, whilst Jonathan sat working on a strategy of how to edit the donation.fab file to get back his laptop, and the top of the range HP deskfab 9GSII without also nuking himself. He reckoned all he'd got to do was edit out the memory module from the deskfab, by editing donation.fab, and then he'd have it all back with out the nuke. Jonathan become engrossed in the task at hand. ... In a splendidly appointed, luxurious penthouse suite, rich in the trappings of wealth and power, in the heart of Washington DC, a bloated congress critter was eating well at the trough. His whores were attentive, dressing him for breakfast, and he had just been bribed $1,000,000 by a telephone company special interest group to throw a few billions in corporate welfare their way. And that was just before breakfast, before he had even got out of bed! Now it appeared he had something he should attend to urgently something that had come on his `email address' what-ever one of those was. A minor aide bustled in. The aide seemed quite excited, and explained in fawning tones that a special interest group had mailed him lots of Swiss Francs, SFr 9,000,000 in fact, but that there was something strange... there was no request for favors. He said it was just being printed out now, and perhaps there would be a note with the money. The congress critter, puffed contentedly on the hookah which one of the whores had lit for him, hmm, yes he could see that this was going to be a good day. <Fade to blinding white light>

1 0

Re: Nightmare Scenario: Public Key Distribution Controlled
by Antonomasia 17 Dec '03

17 Dec '03

Tim wrote: > "Distribute a key, go to prison." > How does the New World Order limit the use of strong crypto without "key > recovery" when so many copies of older, pre-ban crypto are already out > there? > Simple, by declaring that public keys themselves are crypto material, as > the Brits did in their Trusted Third Parties draft proposal, and hence > declaring that distribution of keys after the effective date of the > legislation constitutes a violation. Give someone your key, either by > placing it on keyservers or even by mailing it to them, and one has just > "distributed" crypto. > This will make the public key infrastructure essentially useless, as the > public key servers go down, as corporations yank any directories they may > have, and (possibly) as individuals stop putting PGP or S/MIME fingerprints > or pointers in their messages. > How possible is this? Recall that the British proposal formally classified > key material, the keys themselves, as cryptographic products. The language > of the current unSAFE and Procto-CODE draconian bills, still changing of > course as committees rewrite them to be more Big Brotherish, is vague on > what constitutes crypto. I agree with the gist of this nightmare view, but don't think it describes the British TTP proposal very well. 140 These proposals - aimed at facilitating the provision of secure 141 electronic commerce - are being brought forward against a background ha ha ha 1122 Encryption services_ is meant to encompass any service, whether 1123 provided free or not, which involves any or all of the following 1124 cryptographic functionality - key management, key recovery, key 1125 certification, key storage, message integrity (through the use of 1126 digital signatures) key generation, time stamping, or key 1127 revocation services (whether for integrity or confidentiality), 1128 which are offered in a manner which allows a client to determine a 1129 choice of cryptographic key or allows the client a choice of 1130 recipient/s. My giving you my key does not provide you with 'choice of cryptographic key or ... recipient/s' as I read it. But if I signed your key and distributed it, that would probably be a certification service (to you) in which you had chosen the key to be signed. Also if I gave you 2 keys of mine I think that would be banned, because you'd have a choice. This certainly does discourage effective use, but I don't think the current wording is quite so dire as to outlaw distribution of a single key. I'd also say that when an ISP carries my emailed key to someone they are providing a transport service, and not a cryptographic one. The 'or allows the client a choice of recipient/s' looks to me like a direct reference to remailers. As to signing non-key material; a service would be if someone I know brought something (a photo for me to certify true likeness, a will for me to witness their signature ...) and I signed it for him to indicate something to others. Signing my outgoing letters is not normally considered a service. My checking the signatures on my incoming mail is probably not a service, even if it forms part of the decision on whether to reply. As to self-signing a key; it may be permitted following the model of the above paragraph, or not. I believe the proposal is deliberately vague for FUD - and is bad law, regardless of the bad content. I mentioned the difficulty of deciding exactly what would be banned by this proposed law in my article: "Ruritania Discovers Motor Transport". Check the ar...BANG -- ############################################################## # Antonomasia ant(a)notatla.demon.co.uk # # See http://www.notatla.demon.co.uk/ # ##############################################################

1 0

Kerberos
by beckman＠cs.hope.edu 17 Dec '03

17 Dec '03

We are studying kerberos, the security system implemented by MIT's Athena network. Has anyone started, considered, imagined or completed any similar security systems, preferably using public key cryptography (as opposed to a single 56-bit DES key)? Please mail any responses to beckman(a)cs.hope.edu. -- Peter Beckman Hope College beckman(a)cs.hope.edu http://www.cs.hope.edu/~beckman/

2 1

Real issue of crypto controls: security or taxation loss?
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi. I've been lazily following the crypto-control issue through e$pam list. Somebody posted a question asking how many peoples would eventually be victims of crypto-enhanced crime. Then, TM came to say that this is irrelevant. TM was right in the context of the post, but it led me to ask myself this (vague) question: What is the real issue here, what makes the govt so insistent about wanting to ban crypto? What is such a threat to them that it makes them pass laws that are profoundly against the US constitution? What causes their panic? To this, all I can find of enough magnitude to put them in such state is that they just recently *truly* realized that crypto will, infinitely more than to threaten the security of the state, threaten their very existence by putting them outside of the money loop. To paraphrase somebody, "individuals recognize taxation as damage and routes their e$ around" I think that *this* debate should be injected in the population and the *bogus* "national security" debate should be dismissed as, just that : bogus. *Everybody* not living on govt taxated money gets a sparkle in their eyes when I introduce them to crypto via the e-$ topic. And all of the others gets pale... ;-) For most peoples, privacy in itself is worth something only if if they have some *value* they want to preserve. Most of the time, this value concretizes itself as "money". So if we talk to them in terms *they* understand, we run a much better chance to make them understand why spreading crypto is a tool we believe will greatly enhance human's life quality. Any comments about why we should *not* put most emphasis on the financial aspect of crypto? Ciao jfa -- Jean-Francois Avon, Pierrefonds(Montreal) QC Canada JFA Technologies, R&D physicists & engineers Instrumentation & control, LabView programming. PGP keys: http://w3.citenet.net/users/jf_avon and: http://bs.mit.edu:8001/pks-toplev.html PGP ID:C58ADD0D:529645E8205A8A5E F87CC86FAEFEF891 PGP ID:5B51964D:152ACCBCD4A481B0 254011193237822C

6 8

Entropy VI: "Shannon's Choice" (with apologies to Wm. Styron)
by adwestro＠ouray.cudenver.edu 17 Dec '03

17 Dec '03

I'm always glad to see stuff here about entropy: it's a topic that comes up in PGP 101 when locals ask, "How long should my passphrase be?" and, as we've seen recently, failure to generate adequate entropy for pseudo-random numbers is often the Achilles' Heel of otherwise solid cryptosystems. I found some info about Shannon's choice of the word "entropy" in an unexpected source lately. I had some free time this week due to the surprise snowstorm here, and used it to type in a few paragraphs. This is intended less for immediate discussion than for the list's archives, so that I can point folks to it in the future. And I'm not going to cite the source, to avoid copyright infringement nastygrams...if you know who the author is, keep it to yourself: you'll only suffer public ridicule and loss of "reputation capital" for Not Watching Enough TV!!! :-) N.B. -- some of this impresses me as pompous bullshit, and I'm not in agreement with it. But the story about von Neumann made it a worthwhile read, as least to me. ================================================================== I want now to turn to another juncture in the cascading bifurcations that mark interpretations of Maxwell's Demon. The juncture occurs when Leon Brillouin and Claude Shannon diverge in their opinions about what the relationship between information and entropy should be. In Brillouin's analysis of Maxwell's Demon, the Demon's information allowed him to sort molecules, thus decreasing the system's entropy; but this information had to be paid for by an even greater increase in entropy elsewhere in the system. For Brillouin, then, information and entropy are opposites and should have opposite signs. He emphasized the inverse connection between information and entropy by coining "negentropy" (from negative entropy) as a synonym for information. To Shannon, an engineer at Bell Laboratories who published a two-part paper that was to form the basis of modern information theory (1948), information and entropy were not opposites. They were identical. When Shannon devised a probability function that he identified with information, he chose to call the quantity calculated by the function the "entropy" of the message. Why he made this choice is unclear. Rumor has it that von Neumann told Shannon to use the word because "no one knows what entropy is, so in a debate you will always have the advantage." One could argue that von Neumann's comment was only one element and that the choice of "entropy" was overdetermined, with multiple factors leading to its conflation with "information." On a conceptual level, an important consideration was the similarity between Shannon's equation for infor- mation and Boltzmann's equation for entropy. Because the two equations had similar forms, it was tempting to regard the entities they defined as the same. On the level of language, entropy was compelling because it was a term of recognized legitimacy to the concept of information. On a cultural level, Shannon's choice anticipated the contemporary insight that proliferating information is associated with the production of entropy. [...] Whatever the reasons for Shannon's choice, it is regarded by many commentators within our scientific tradition as a scandal, for it led to the (metaphoric) knotting together of concepts that are partly similar and partly dissimilar. Typical is K. G. and J. S. Denbigh's reaction in their careful study of the way the quantity defined by Shannon's equation differs from thermodynamic entropy. Recounting the story about von Neumann's advice, they write that thus, "confusion entered in and von Neumann had done science a disservice!" Jeffrey S. Wicken is even more explicit, calling Shannon's choice "loose language" that served "the dark god of obfuscation." "As a result of its independent lines of development in thermodynamics and information theory, there are in science today two 'entropies,'" Wicken writes. "This is one too many. It is not science's habit to affix the same name to different concepts. Shared names suggest shared meanings, and the connotative field of the old tends inevitably to intrude on the denotative terrain of the new." Clearly Wicken's concern is to restore scientific univocality by closing off the ability of the information-entropy connection to act as a metaphor rather than a congruence. Yet at the same time he admits that shared language creates an inevitable "intrusion" into the "denotative terrain" of one term by the "connotative field" of another. The problem is more scandalous than he recognizes, for whenever a heuristic is proposed, it necessarily uses "shared names" that cause scientific denotation to be interpenetrated by cultural connotations. For what else is language but "shared names"? As Wittgenstein has observed, there are no private languages. Moreover, the distinction between denotative and connotative language is itself part of the distinction between language-as-vehicle and language-as-concept which metaphors, and particularly self-reflexive metaphors, bring into question. To turn Wicken's argument on its head, we might say he recognizes that metaphors in general, and the information-entropy connection in particular, directly threaten science's ability to separate ideas from the language it uses to express them. In his anxiety to suppress the metaphoric potential of Shannon's choice, Wicken misses the richly complex and suggestive connections that were instrumental in enabling a new view of chaos to emerge. By the simple device of using "information" and "entropy" as if they were interchan- geable terms, Shannon's choice gave rise to decades of interpretative commentary that sought to explain why information should be identified with disorder rather than order. For the alliance between entropy and information to be effective, information first had to be divorced from meaning (a premise made explicit in Shannon's 1948 papers) and had to be associated instead with novelty. Recall the random number generator, mentioned earlier, that produces a tape we can read. No matter how long we watch the tape, numbers keep appearing in unpredictable sequence. >From one point of view this situation represents chaos; from another, maximum information. Once randomness was understood as maximum information, it was possible to envision chaos (as Robert Shaw does) as the source of all that is new in the world. Wicken is correct in noting that denotative and connotative fields overlap; in the case of information, the connotation that "intruded" upon the denotative field of chaos was complexity. Whereas chaos had traditionally meant simply disorder, complexity implied a mingling of symmetry with asymmetry, predictable periodicity with unpredictable variation. As we have seen, chaotic or complex systems are disordered in the sense that they are unpredictable, but they are ordered in the sense that they possess recursive symmetries that almost, but not quite, replicate themselves over time. The metaphoric joining of entropy and information was instrumental in bringing about these developments, for it allowed complexity to be seen as rich in information rather than deficient in order. Sources cited: K. G. Denbigh and J. S. Denbigh, _Entropy in Relation to Incomplete Knowledge_ (Cambridge University Press, 1985) Jeffrey S. Wicken, "Entropy and Information: Suggestions for a Common Language." Philosophy of Science 54:176-193 (1987) ================================================================== Alan Westrope <awestrop(a)nyx10.cs.du.edu> __________/|-, <adwestro(a)ouray.cudenver.edu> (_) \|-' 2.6.2 public key: finger / servers PGP 0xB8359639: D6 89 74 03 77 C8 2D 43 7C CA 6D 57 29 25 69 23

1 0

Re: Nightmare Scenario: Public Key Distribution Controlled
by John Young 17 Dec '03

17 Dec '03

Does the following provision of the amendment lighten Tim's dim glim? "§ 2804. Encryption products manufactured and intended for use in the United States ... (d) USE OF PRIOR PRODUCTS LAWFUL.-- After January 31, 2000, it shall not be unlawful to use any encryption product purchased or in use prior to such date. [Bottom page 13] That gives about 450 days to widespread stego, surrept onions and backchannels to prepositioned stashes. Max use prior to. Or, say to hell with it, coders will forever evade USCoders.

8 7

Piggybacking
by lethin＠ai.mit.edu 17 Dec '03

17 Dec '03

In article <444bp8$sd4(a)life.ai.mit.edu> Adam writes: > Naturally, this works with programs other than Quicken. By leveraging on the popularity of Quicken and people's insecurities about their financial data cypherpunks might be able to spread PGP and SecureDrive technology more rapidly. If I were a marketing manager at a startup selling SecureDrive, for example, I'd suggest trying to exploit the above by selling my product as "QuickxxSecure" which would install after Quicken, make the secure drive, move quicken there, etc. It would then sell in a box with a graphical design (e.g. white stripe on red box, to blend nicely with Intuit's red on white) that Egghead would want to put it on the shelf right next to Quicken. Cypherpunks with a crypto-anarchic agenda might "package" shareware in a way that would exploit the same principles. Surely, a bigger market than people using EMACS RMAIL. --- Concurrent VLSI Arch. Group 545 Technology Sq., Rm. 610 MIT AI Lab Cambridge, MA 02139 (617)-253-0972

1 0