December 2003 - cypherpunks-legacy

Re: V-chip?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:33 AM 1/25/96, Mike Duvos wrote: >As I understand it, the basic concept behind the V-Chip is to >allow selective blocking of material a particular viewer might >find offensive based on content information transmitted along >with the program. As long as the program material itself is >transmitted unaltered, and there are multiple non-governmental >providers of content descriptions catering to the spectrum of >human likes and dislikes, this sounds like ideal Cypherpunk >technology. > >Concerned Parent can set the V-Chip to read from the Children's >Television Workshop content service, available for a small >monthly fee, and be certain that graphic violence and sex are >pixelated on screen, and that bleep words that the child might >practice in front of Grandma are garbled. > >Mr. Islamic Fanatic can filter out all blasphemy against Allah >and his one and only prophet, pork commercials, and women showing The V-chip described heretofore is considerably less nuanced than this, having only a few states (roughly corresponding to MPAA movie ratings). No switch settings to block Democrat programs, or Feminist programs, or Mormon programs. Just your basic "indecency," with "violence" as lagniappe. And most Cypherpunks would tend to reject it because it is not voluntary (unless you think "so don't buy a television" is a viable voluntary choice). It will add to the cost of t.v.s and VCRs, and possibly interfere with the computer-based options to come. And it's easily defeatable. For one thing, most households have multiple t.v.s or VCRs, any one of which without the V-chip will defeat the system. Also, it is likely that the households "most in need" of this chip--using the logic about unattended children watching violent programs while their parents are away--will be the least likely to buy the brand-new sets and VCRs that have this chip. (I would guess that most families will have existing sets and VCRs for at least the next decade or more.) >What are the dangers of this new technology? > >First, the government might want only one description of content, >which it controls. My notion of what is offensive probably >differs greatly from that of Jesse Helms, for instance. This is mostly the case. My objection to ratings systems imposed by government is a general one. If video and music is to be rated, why not articles and Usenet posts? The principle is the same. Anyone telling me I have to rate my work, or submit it to a ratings agency, is aggressing against me. Now, if others rate my work (which is already happening with digest services such as "CP-Lite"), this is their business, not mine. But the V-Chip precedent is a precedent for the government to insist that all sorts of content be rated. This should be fought in a free society. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: German home banking (fromn RISKS)
by jim bell 17 Dec '03

17 Dec '03

At 07:34 PM 1/24/96 -0600, Andrew Loewenstern wrote: >> Don't high speed modems transmit and receive on the same frequencies, >> using echo cancelation to decode the receive signals? Does that >> make it impossible to eavesdrop on high-speed (i.e. V32bis) modems? > >No, and a lot of crackers and phone phreaks found out the hard way. You can >buy protocol analysers off-the-shelf that will give a dump of the entire >communication by just passively listening in (or possibly playing back a >recording). Assuming it were possible, it would have to have a rather good quality, although DAT should be adequate, I should think. > I have seen units that could decode all of the popular Blue Book >protocols for consumer equipment such as faxes and high-speed modems as well >as ISDN, T1, DS3, ATM, Hey! Justa sec! ISDN is basically digital (broadband), so (obviously) is T1, likewise DS3 and ATM. Except for ISDN, unidirectional signals (at least at one time...), I think. This is NOTHING compared to the difficulty of doing simultaneous bidirectional analysis in a 3 khz bandwidth of 28 kbps each way! Maybe you're far more familiar with what equipment is available for telephone analysis than I am, but I have serious doubts that the capacities you list above are even close to what the other guy asked about. etc... Most are programmable and some are full-blown >computers running stripped down versions of Unix and can also be controlled >over the network from RealComputers. With multiple analysers and a little >custom software you could easily perform MITM attacks. The hardest part is >getting in the middle. > >Modulation, comm-protocols, and compression techniques are not a replacement >for honest to goodness crypto. Agreed, but let's not underestimate the amount of effort involved. This is important, because of that "Digital Telephony" bill crapola they're trying to foist on us. Their argument will be, we presume, that "we've gotta be able to bug all these lines because of all the drug dealers talking on the phone. Well, unless the government is proposing installing the capability of bugging data the vast majority of data calls (including those that, hypothetically, use Clipper) then they're NOT going to get any traffic they claim to want to hear. We should ask, "How much will it cost to even UNDERSTAND a data phone call, let alone decrypt it, and if it's too high let's give up while we're behind."

1 0

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 13:06 1/24/96, Andrew Loewenstern wrote: >Why not just print out all of the source code to Navigator (crypto and all) >in a nice OCR font? Paper is exportable. Then you would 'only' have to scan >it back in and debug it. That would be giving away the store to the competition. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 2

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 16:07 1/24/96, Peter D. Junger wrote: >The ITAR are regulations, not a law passed by >Congress. The ITAR regulations relating to the export of cryptography >are probably not authorized by any law (as well as being >unconstitutional). The reason for all the silly twists and turns >under the ITAR is that the censors never succeeded in getting any law >forbidding the use of cryptography, and it is not at all certain that >they could get such a law passed. They couldn't get a law passed _then_. Nor did they need to. They also don't need one now, because they have rubber regulations at their disposal. They will be able to get a law passed, should their interpretation of the regulations be thrown out by a court. Passing such a law will be *trivial*. Just put in the exceptions for the powerful special interest groups, such as banks. The vote will be near unanimous, as it always is in similar cases. See Digital Telephony. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 22:11 1/24/96, sameer wrote: >> example, CyberCash has a development office there. >> > "has a development office" is a bit of an understatement. Would you like to share? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Hack Java
by Rich Salz 17 Dec '03

17 Dec '03

This illustrates the difference between a language with no dangerous constructs, and one where you must trust the implementation. >From some internal OSF email: ---------- Begin Forwarded Message ---------- class Data { // an object storing 16 bytes byte word[16]; } class Trick { Data data; long tricky_pointer; } Now suppose, I fake a compiler (or I have a malicious compiler) and I generate by hand malicious byte code such that in the symbol tables, tricky_pointer and data have the same offset. Then if I have the code tricky_pointer = 10000; for (; tricky_pointer < 50000 ;) { dumptofile(trick.data) tricky_pointer += 16; } what I am doing with this code is that I am actually setting the data object reference to point to address 10000, then I am core dumping the contents of memory upto address 50000, 16 bytes at a time! The byte code is completely legal, I have cheated with the field offsets so that I can access to the same memory as two different types. In order to detect that the byte code verifier must verify that all the fields of an object do not overlap in their memory layout. That's what has to be checked. ----------- End Forwarded Message -----------

6 5

(FWD) UUNET Offers Web Security Services 01/22/96
by an146908＠anon.penet.fi 17 Dec '03

17 Dec '03

FAIRFAX, VIRGINIA, U.S.A., 1996 JAN 22 (NB) -- UUNET Technologies (Nasdaq:UUNT) is offering a World Wide Web hosting service that includes a full range of security services for commercial and private applications, including use of PGP (pretty good privacy) encryption. The company says the introduction of secure Web services supports served-based SSL (secure socket level) encryption that works with Netscape browsers to transmit sensitive data such as credit card numbers. The inclusion of PGP also allows companies to encrypt and forward data they have received on the Web, which can then be redistributed to other system, such as credit bard billing systems, via e-mail or FTP (File Transfer Protocol). UUNET says the combination of security measures is available for UUNET's standard, premium, and new dedicated Web hosting services. Alan Taffel, UUNET vice president of marketing, said the new measures are "a significant step toward the goal of making Web-based electronic commerce a reality. Previously, companies wishing to take advantage of available secure server technology had to undertake a challenging and lengthy process. UUNET's secure Web service alleviates the hassle associated with deploying a secure server." Customers choosing the secure service will get the same Internet service as regular customers, says UUNET. Also, UUNET will take care of details such as applying to Verisign for a company digital identification. UUNET is also now offering a dedicated server option for high volume and high value customers. This service includes a dedicated 130 megahertz (MHz) Pentium machine, a gigabyte (GB) of storage and up to 5GB of traffic per month. The price involves a $3,500 startup fee, and monthly fees beginning at $2,000 per month. UUNET's standard service starts at $300 a month and includes T1 bandwidth. Premium service (10 megabits-per-second connectivity) starts at $900 per month. For standard service, the security service cost an additional $200 in startup fees and $200 per month above the normal fee. There is no startup fee for premium service, but the monthly surcharge remains. FTP hosting service is available for $100 per month for up to 2.5GB per month in traffic. (Kennedy Maize/19960122/Press Contact: Alan Taffell, 703-206-5600) --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

Re: Crippled Notes export encryption
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:25 AM 1/25/96, Lucky Green wrote: >The big companies are fighting? Where did you get that idea? IBM/Lotus just >gave the feds the keys. Not a single one of the major players has >challenged the government in any meaningful way. Sure, they make a lot of >noise as to how they dislike the regulations, but they certainly aren't >making a sincere effort of trying to change them. I have several pieces of evidence which suggest to me that the government is leaning on companies in ways which are not always apparent. (I can't share all of the evidence I have...I know this is unsatisfying. I'm not asking you to "trust me," just noting that this is what I have either heard from usually reliable sources or from direct participants.) I am reluctant to ascribe malice to any of the players in this drama, just differing goals (in the Great Game). --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

[noise] Re: Crippled Notes export encryption
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:24 PM 1/24/96 -0500, you wrote: >In article <9601242357.AA02688@alpha>, Mike McNally <m5(a)dev.tivoli.com> wrote: >>This sounds fishy to me. I don't recall reading anything to suggest >>that export of cryptographic software (or any other munition) requires >>that the stuff be *used* outside the US for an offense to be >>committed; why should export of a cryptographer's wetware be any >>different? Either the expertise leaves the country or it doesn't, I'd >>think. > >Here's section 120.17 of ITAR: > >@ 120.17 -- Export. > > Export means: > > (6) A launch vehicle or payload shall not, by reason of the launching of such >vehicle, be considered an export for purposes of this subchapter. However, for >certain limited purposes (see @ 126.1 of this subchapter), the controls of this >subchapter may apply to any sale, transfer or proposal to sell or transfer >defense articles or defense services. So we could launch Jeff Wienstien in a rocket without violating ITAR as long as we do not sell him. "Hey Jeff... Want a ride?" ];> Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ National Security uber alles!

2 1

Re: Hack Lotus?
by Alan Olsen 17 Dec '03

17 Dec '03

At 01:38 AM 1/25/96 +0000, you wrote: >I have no doubt that enterprising hackers will be able to hack >the international version of lotus Notes to make it as secure >as the domestic version. It is probably just a matter of NOPing >some code. > >The real problem is the 64 bit key in the domestic version. This >conforms to the NIST "standard" for an exportable system. In other >words to allow the international people to have almost non-existant >40 bit security, they have limited domestic users to 64 bit secuity. >The 64 bits keys must be breakable at least in some sense or the limitation >would not be in the NIST "standard". {stuff deleted] Something just came to mind... What if there is not difference between the exportable and non-exportable versions? Could it be that they are *both* GAKed? Maybe I am just being paranoid (or thinking that IBM might just be lazy enough to push out a single version under two versions), but it is something that needs to be determined. Does anyone out there have access to both versions for a comparison? Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

SMTP mail warning
by postmaster＠ncr-sd.SanDiegoCA.ATTGIS.COM 17 Dec '03

17 Dec '03

message

1 0

Pssst......Wanna buy a mailing list?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A wonderful little annoucement for a new WWW site appeared in my anon mail this evening, It was for a site offering Privacy Tools and Offshore Activities, Poor guy who sent the message, sent it without BCCing it and hence, Everyone who requested his autoresponder file on Anonymous Banking is listed. (At least 100+ addresses!) Highlighs of the domains in the mailing: nea.org Gotta keep some money stashed for education! uspto.gov Nym's requesting infomation for hiding patent $$$ mot.com Good year for Motorola stocks! fmr.com Fidelity Investments....Hmmmmm I'll bet my last E-Ca$h coin that there will be alot of these people learning about anonymous remailers the hard way. Malthus -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQclaQJo+wOswDgJAQGUJgP+Jf2XnmRf9EHtVUI18cd1ipAme9KyyOfO MBrsDsRKBCFdT7HbTshqjULXQTd5kvI62PmnDEbVQ52L30tSs/Dp9tTbg8HYVIbS Vpcs/RvB0KeiMy+x6RniVljvGPRgRzefidTqtiKADQc76xl/gNW1JK6rySFQLMRO kHRP4btnqkM= =GL1y -----END PGP SIGNATURE----- L. Malthus <an266153(a)anon.penet.fi> PGP key listed at MIT --

1 0

another thought about random numbers
by Gary Howland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Decius writes: > hmmm... probably just a cheapo pseudo-rng.... I'm sure you're right. > With a copy of their squematics and a whole lot of analysis you could > probably make some serious money!! :) Perhaps, but only to the extent that you could win what others have lost. These machines only ever pay out a percentage of what is put in - it is not possible to beat the machine (long gone are the days when the designers calculated all the probablities and relied on "the law of averages" in order for the machine to win). Gary - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQdhoioZzwIn1bdtAQHk6AF/foseD0Wg3ezlf7XIHPkkwYcYz7OuQdQH mxyFFcFYxU6TLxjdn/FG8s1ehtegfqQD =LtQC -----END PGP SIGNATURE-----

1 0

Crypto Exports, Europe, and Conspiracy Theories
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:49 PM 1/24/96, Alex Strasheim wrote: (quoting me) >> The usual issue: That if a foreign-originated product even appears to be a >> standard (so far, none have been), and includes strong crypto, then the NSA >> and other agencies will simply change the rules. Thus, if extremely strong >> crypto from "Netscape-Zurich" starts to have a significant market presense >> in the U.S., then some law will be passed to restrict it. > >But what would they restrict? The use of strong crypto between two >domestic points, or strong crypto where one end is within the US and the >other without? We already have the former -- wouldn't it be hard for them >to take it away? Especially if the software already has a large installed >base, which is your premise? Specifically, I believe--though obviously cannot prove, given the nature of time--that a cryptographically strong version of Netscape developed outside the borders of the U.S. would not be freely importable into the U.S. I don't know what form such a law would take, to answer the point raised in another post by Peter Junger. Nor am I saying either State or NSA passes the laws...the ITARs have worked largely because they have never been challenged; if they were to be successfully challenged and stricken, as even some folks inside the NSA think is likely if tested in a proper case, then a Four Horseman-scared Congress will likely step in with some restrictions. >I'm not denying that there are people in the NSA who would want to react >that way, but I don't think they'd be able to pull it off. > >It is true that the National Security establishment has a lot of power >and influence here. But there are other groups with power as well, and >the security types don't have the ability to do whatever they want >without regard to the opinions and interests of those other groups. And now here's where I will speculate openly, although my speculation is informed by having followed these debates (and even contributing to them) for many years. You have to ask yourself this question: "Why are there no cryptographically strong products--finished products, not specific ciphers or chunks of code--developed in Europe and freely imported into the U.S.?" More specifically, given that the situation with crypto exports being limited (the so-called $60 billion a year problem...even if inflated, still a lot of money) has been known about for a long time, and given that Europe, and to a lesser extent Japan, India, etc., has a strong software infrastructure, you have to ask why "Netscape-Zurich" is not now being imported into the U.S., as a core module that then (for example) the American developers could add additional stuff to. Or why Lotus Notes-Tel Aviv is not being imported, with at least an 80-bit work factor. Or why Digicash is not taking the relatively trivial step of offering extremely strong ciphers (maybe something like Haval?) and blitzing the U.S. market? ("Only Digicash is offering _all_ of our customers the same level of communications security.") (I'll get to some of the practical issues, that the culture of Europe is not quite as conducive as the culture of the U.S. to startups, such as Netscape, Spry, Intuit, etc., but I don't think this gets at the main point of why strong crypt is not being _imported_ into the U.S.) If the business losses are anything really close to $60 billion a year, then companies wishing to have strong crypto should be *screaming* for Europe-developed products to be brought back in to the U.S. There are of course two components to the alleged $60 B a year losses, broadly speaking: * the losses of companies not in the crypt tools business who are losing out because the crypto they are allowed to export weakens their product's attractiveness. * the losses of crypto tool makers who are losing out because their products are not attractive to non-U.S. buyers (Does anyone else out there see a disconnect in the logic here? If Company A is losing business to a non-U.S. Company B, then why is whatever Company B is providing (such as stronger crypto) not being imported into the U.S. For example, if Netscape is losing out to "CERNScape," the hypothetical browser company out of the CERN WWW groups, then why is CERNScape not selling here? In fact, where _are_ the products that are winning out over the crippled American products?) (Understand that I'm not claiming there are no losses, that the $60 B a year figure is not accurate (though I think it inflated a bit), I'm just trying to figure out what's really going on here.) Let's review some points that may be relevant to why "offshore development" has not become a reality, even though one might think it would (given the $60 B figure...that pays for an awful lot of overseas programmers!). First, the "crypto hooks" point we discuss so often. Merely having hooks that link to offshore crypto is a problem, as the ITARs make clear. Thus, Lotus cannot simply say to its non-U.S. customers, "We are shipping a version overseas that contains only 40-bit crypto; you are advised to download 80-bit crypto from http://defeat-itars.lotus-geneva...." I don't know precisely how the NSA and State would react, and what law would be cited (beyond a reading of the ITARs), but pretty clearly this would not fly in the current climate. Lotus might get visits from the NSA, might be threatened with conspiracy to violate the Munitions Act charges, might have its shipments seized, etc. Second, folks at RSADSI told me several years ago that it even violates the ITARs to send cryptographic knowledge out of the country (especially, in this context, with the intention of the folks with the knowledge being the "Geneva" operation of RSADSI, for example). [Note: This is really where all the stuff about exporting code comes from, and why the debate about exporting the RSA-in-Perl t-shirt is not really hitting the main point. The NSA and State have no real concern about copies of Schneier's book going out, given that they know they can't stop it anyway and the stuff in it has already been published worldwide. No, their real concern is ensuring that Lotus does not skirt the whole crypto exports issue by sending a team to an overseas location to develop a core module _there_. Before someone like Duncan protests that this strategy is ultimately--and maybe even soon--doomed to fail, for the many reasons we discuss often, I agree. But for the nonce, NSA and State are trying to fight a holding action, and keeping U.S. companies from distributing strong crypto is currently within their powers in a way that domestic control of crypto is not.] Third, even _interoperability_ is disliked by the NSA. Thus, if Lotus Notes says that it will support an open standard such that its package can communicate easily with Europe-developed crypto modules, the NSA will consider this to be a means of skirting the ITARs. (This was actually the main strength of PGP, as I saw it, that a "standard" could be supported on many platforms, and once the program was proliferated to many countries, all could interoperate. Note that there are very few other such interoperable crypto programs---Lotus Notes talks to other Lotus Notes sites (a chokepoint in controlling distribution), MicrosoftMail and other products talk to other MS products, RSADSI's own standalone crypto program, Mailsafe, talks to other Mailsafe users (again, a chokepoint for distribution), and so on. [Side note: this situation is changing as standards are adopted, as the Web takes on a more prominent role. But I believe it to still be true that strong crypto in the U.S. cannot easily talk to strong crypto in Europe and Asian, except via things like PGP. If I'm wrong, I'd appreciate hearing about some examples.] Fourth, bizarre as it may sound, _imported_ strong crypto may face the same restrictions if attempts are made to _export_ it! Even if the code is unchanged. (The only justification for this position is that the U.S. is trying to create a chokepoint for control...there is no logical reason for a product imported from Israel to then not be allowed for export back to Israel, except that NSA and State hope to interfere with markets and thus have more control over things.) The effect of this restriction is that companies planning to import crypto from, say, Switzerland, and integrate it into their products will still face the ITARs when they try to export the product. And even having _two_ versions, one developed in the U.S. and one developed in Switzerland, will then run into the issues already cited: skirting the law by having hooks, (maybe) engaging in a conspiracy to export cryptographic talent for the purposes of skirting the ITARs, and having interoperable versions. Fifth, there are cryptographically-competent companies and programmers in Europe. Companies such as Crypto AG, companies in Israel, programmers in the U.K., Slovenia, Romania, and all over. (Many on this list, in fact.) And programmers and very competent crypto folks in Australia, New Zealand, etc. Given the relatively small teams that built capable browsers, and given the capable programmers, and given the (alleged) huge losses American companies are suffering for lack of secure products, why are there no Europe-developed browsers with strong crypto? I promised conspiracies. My points above implicitly involve some behind-the-scenes pressuring (and I know this to be the case from first-hand accounts), but here are some more: -- maybe even the European companies have been threatened, perhaps by their own crypto-fearful intelligence agencies (recall the many reports of key escrow talk in Germany, France, Sweden, etc.) -- maybe, as some have claimed, the European crypto companies, such as Zug-based Crypto AG, are actually controlled or influenced by the NSA. (This was a recent thread here, dismissed by the list.censors as "off-topic," but, I think, in actuality a terribly important topic to consider.) -- maybe the Europeans just don't want a piece of the Web browser market, maybe the prospect of a software company reaching a capitalization of $5 billion in less than two years doesn't excite them. (Maybe Clinton didn't inhale.) In a kind of variant of the Fermi Paradox ("Why aren't they here?," referrring to alien visitors), my question is this: "Why aren't we able to solve this pressing problem of not being able to export strong crypto by _importing_ it?" I don't think it's an accident, or laziness on the part of European and Asian companies, that we haven't gotten around the U.S.'s laws about exporting crypto by getting our crypto from competent programmers and companies outside the U.S. Comments? --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

9 11

Re: Crippled Notes export encryption
by olbon＠dynetics.com 17 Dec '03

17 Dec '03

At 10:49 PM 1/24/96, Lucky Green wrote: >At 19:34 1/24/96, Derek Atkins wrote: >>If I have a function that does something like this: >> >>authenticate (args) >>{ >> ... >> >> des_encrypt (); >> ... >>} >> >>I would have to remove the des_encrypt() call from the authenticate() >>routine before it can be exported... > >What if you replaced it by rot_13 () ? Surely, they can't ban that. And >someone later could just swap all rot_13 () for des_encrypt () > > >-- Lucky Green <mailto:shamrock@netcom.com> > PGP encrypted mail preferred. Better idea: replace des_encrypt() with fuck_the_itar(). Seriously, this just illustrates the idiocy of banning "hooks" in software. How does one define a "hook"? Just providing source code could be defined as providing a hook, since a good programmer could then modify it to do crypto. Also, how about the various kits and tools used to integrate pgp with pine, eudora, etc -- are these not "hooks"? Clay --------------------------------------------------------------------------- Clay Olbon II | olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: finger olbon(a)mgr.dynetics.com Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 "To escape the evil curse, you must quote a bible verse; thou shalt not ... Doooh" - Homer (Simpson, not the other one) ---------------------------------------------------------------------------

1 0

Bernie S. Sentencing
by dan＠milliways.org 17 Dec '03

17 Dec '03

I believe that Ed was the first person to be sentenced under PA's new anti-toll fraud law which makes it illegal to build, distribute, or distribute plans for, or use "toll-fraud" devices which include EEPROM burners, cellular diagnostic equipment, etc. The Man couldn't put him away for any length of time for that, so they're trying another angle. ObCrypto: When they pass laws against "info-laundering"/"electronic identity hiding" tools, it'll probably go something like this. =========BEGIN FORWARDED MESSAGE========= Date: Mon, 22 Jan 1996 06:48:44 -0500 (EST) From: Emmanuel Goldstein <emmanuel(a)2600.COM> Subject: Bernie S. Sentencing Friday I just found out that Bernie S. will be sentenced this Friday morning at 9 am in Easton, PA for the crime of removing batteries from a tone dialer several years ago. This is defined as a victimless misdemeanor for which the judge in this small town (under considerable influence from the Secret Service) set bail at $250,000. He could get two years in prison at sentencing. Press attention could be very helpful in avoiding a sentence as irrational as the bail setting - right now the only influence these people are getting is from the Secret Service and they want to put Bernie S away for as long as they can. If you're not entirely up to date on this story, finger bernies(a)2600.com for all of the details. If you know of anyone who will cover this story, please get ahold of them right away so they can plan on being there. If anyone is interested in going, let me know so we can hopefully fill some cars from NYC. Sentencing is scheduled for Friday, January 26 at 9 am Courtroom 5 Northampton County Government Center 7th and Washington Street Easton, PA 18042-7492 (610) 559-3020 (district attorney) case # 2173-1993 The Commonwealth of Pennsylvania vs. Edward E. Cummings Misdemeanor 2 - tampering with physical evidence Please help spread the word. emmanuel(a)2600.com =========END FORWARDED MESSAGE=========

7 7

Re: Crippled Notes export encryption
by Rich Salz 17 Dec '03

17 Dec '03

> Seriously, this just illustrates the idiocy of banning "hooks" in software. Yes. That's why an API that supported generic data transforms and that included compression and for non-export encryption would be a useful thing. I have a start toward such an API definition that I will email to anyone who might wanna finish it off. I started doing it around the time that Raph talked about his per-user crypto server. > How does one define a "hook"? Just providing source code could be defined > as providing a hook, since a good programmer could then modify it to do > crypto. Also, how about the various kits and tools used to integrate pgp > with pine, eudora, etc -- are these not "hooks"? They define a hook. They define it on a case-by-case basis. "They" is the Office of Defence Trade Controls, in conjunction with their consulting experts primarily people in the department of Export Control at the NSA. Luckily the ITAR talks about willful violations. /r$

1 0

Secrecy of NSA Affiliation
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:55 PM 1/25/96, Rich Salz wrote: >Up until recently (18-30 months ago) NSA employees were only allowed >to identify themselves as employees of DoD. It was common knowledge, >that unspecific references to Fort Meade meant NSA; and if you saw >a P.O. from Procurement Office, Fort Meade, it meant the NSA was buying >it. When I attended Crypto '88, nearly 8 years ago, at least several of the NSA attendees had "National Security Agency" on their name badges. It may be that run-of-the-mill employees still maintain the fiction for public consumption that they are DOD employees, but such was not the case in 1988 at "Crypto." (Recall the "NSA Employees Manual" which 2600 liberated, and which Grady Ward then redistributed. It had some tips, as I recall, on what employees should tell the curious.) When I visited the D.C. area in early '91 or '92 (I forget which year it was), I stopped by Fort Meade to see the place. The sign out front prominently said "National Security Agency," complete with the NSA seal (an eagle lifting a hacker up in its talons). Also, much other evidence points to the NSA having "gone public" much farther back in time than 18-30 months ago. Former DIRNSAs on the MacNeil-Lehrer Newshour were always introduced as former directors of the NSA. As early as the mid-80s, as I recollect. I think Bamford's book pretty much outed the name, though it was widely known before that, of course. (I attended my freshman year of high school in Langley, VA. Through the woods on one side of the school was CIA headquarters. At that time, 1967, it was still only labelled as something like "Department of Transportation Road Testing Facility." Everyone knew what it really was, of course. Rick Smith, on this list, was a classmate of mine and can attest to this. The CIA "went public" in the early 70s, the NSA in the early 80s, the NRO in the early 90s...I sense a pattern. This means the ultra-secret ERO (Extraterrestrial Research Organization) will be outed in the opening years of the next decade.) --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4

TOP_tap
by John Young 17 Dec '03

17 Dec '03

1-25-96. TWPsst: "Military Men Named to Top Intelligence Posts." AF Gen. Kenneth Minihan to run all US eavesdropping on foreign governments and citizens at NSA, which is responsible for providing US officials with a steady stream of intercepted electronic data on foreign weapons and conversations involving foreign politicians. The NSA's eavesdropping costs an estimated $3.5 billion a year, a large portion of which supports its computer operations at Fort Meade and its world-class experts in mathematics. TOP_tap

2 1

Re: V-chip?
by williams＠va.arca.com 17 Dec '03

17 Dec '03

Tim May writes: > Anyone telling me I have to rate my work, or submit it to a ratings agency, > is aggressing against me. Now, if others rate my work (which is already > happening with digest services such as "CP-Lite"), this is their business, > not mine. But the V-Chip precedent is a precedent for the government to > insist that all sorts of content be rated. This should be fought in a free > society. But what if they *ask* you nicely to label your work? "If you think your message is offensive, violent, or racist, would you please consider labelling it?" I don't think I'd mind. In fact, *optional* labels would make me more likely to post such material, because I'd have some confidence that it would only be read by people who want to read it. (And they could even find it more quickly!) There's nothing inherently wrong with labelling information. When messages here are labelled [NOISE], I know to avoid them. This sort of meta-information is helpful and good. The precedent is what's troubling. Someone will probably try to mandate the labels...Someone will try to write a law that says "Anyone who posts what I consider offensive without a label is guilty." This is what should be fought...not labels. --Jeff

4 3

Re: Crypto Exports, Europe, and Conspiracy Theories
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:58 PM 1/25/96 -0500, Michael Froomkin wrote: >It's called "strict liability" -- you are liable when you didn't know. >The economic justification is that you were in the best position to avoid >the harm (either by doing some checking, or, in this case (they, not I, >would say) not offering the service at all. Vague memories of Law School... Doesn't strict liability apply to "inherently dangerous activities." Like using explosives to demolish buildings or something. Is carrying message traffic an inherently dangerous activity? Any strict liability situations today not involving inherently dangerous activity? I suppose having disposed of waste in a "Superfund Site" leads to automatic liability but does not necessarily involve an inherently dangerous activity. Is this a "strict liability" situation? I'm trying to think of other sorts of examples. DCF "If we're so poor these days, why do we have more of everything?"

1 0

Re: Crippled Notes export encryption
by andr0id＠midwest.net 17 Dec '03

17 Dec '03

> >Item (1) allows people to travel abroad if they know crypto. It's unclear >that it allows them to emigrate or return to their country of origin. >Items (3),(4),(5) seem to prevent such a person from using, or even mentioning, >crypto to or "on behalf of" a foreign person. > Okay, question.. Is "crypto" and "defense" the same thing?

1 0

RE: Microsoft's CryptoAPI - thoughts?
by geeman＠best.com 17 Dec '03

17 Dec '03

>What does everyone think about this? Perhaps I already missed the boat, but >I just found out about it. How would international apps work? Would a data >file encrypted with an app compiled with a US-only CSP (cryptographic >service provider) be able to be loaded by a European equivalent app? > >[Info can be found at: http://www.microsoft.com/intdev/inttech/cryptapi.htm] > > >-- >rickt(a)psa.pencom.com >egalitarian, philosopher, unix cowboy, '68 chevy pickup hacker > > To which I would like to generalize: what do you (all those with an opinion on the matter) think/feel/intuit about general crypto API's overall? How would you compare some of the simultaneous threads of development going on now in different orgs? Any strong positions out there?

1 0

The cost of breaking RC4 with a 40 bit key.
by norm＠netcom.com 17 Dec '03

17 Dec '03

I think that special hardware to break RC4 would require 256 bytes of registers and only a few hundred control gates. Lets say 5000 transistors per "module". You can put several hundred modules on a chip. Each module can easily do one step in 5 ns. I havn't figured out what the attack would be (known plain text etc.) and hardware to handle that might be more. In mass production the marginal cost of such a chip might be $100. Perhaps trying one key requires 100 steps. I get the cost per key trial as follows: (100 $/chip)(100 steps/trial)(5 (module*ns)/step)/ ((10^9 ns/sec)(10^8 sec/(economic lifetime))(200 modules / chip)) 10^(2+2+.7 - (9+8+2.3)) $/keytrial= 10^(-15+.4) $/keytrial = 2.5*10^(-15) $/keytrial I compute the cost of breaking a 40 bit key as 2.5*10^(-3) $ or one quarter of a cent.

1 0

QCD_566
by John Young 17 Dec '03

17 Dec '03

Donald Weingarten, IBM TJW Research Center, writes in February SciAm about the center's investigations of quark theory by the "GF11" parallel processing computer dedicated solely to quantum chromodynamics (QCD) -- a computer which uses 566 parallel processors. He describes building the hardware and software of this unique tool and what two years of continuous computations revealed. An aside explains a die-rolling shortcut method called Monte Carlo to circumvent the enormous amount of computation that lattice QCD would otherwise entail. QCD_566

1 0