December 2003 - cypherpunks-legacy

Re: You know it's getting late when... (fwd)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:24 AM 7/31/96, Jim Choate wrote: >Consider (to some) a trivial example. There are 20 million cats and dogs >killed each year because somebody was irresponsible. The vast majority of >these are or were pets (not feral or wild animals as some would claim) which >persons simply didn't want anymore. Now there is somewhere around 250 >million people in the US. This means that 1 out of 10 (roughly) are costing >the rest of us about $50 ea. to take care of their pet 'problem'. > >I see no difference in having my money taken via taxes (where most of it >comes from) for this than having somebody come and take $50 for whatever >reason by kicking my front door in. Why am I being forced to pay this money >to pay for somebody elses lack of discipline and simple human empathy? I agree, and this is one reason I am opposed to State-sponsored canine and feline genocide. And historically the lack of canine eradication programs has been a major way to control the "homeless problem," so the State is making the homeless problem worse by removing natural pest control mechanisms. --Klaus

2 1

Re: Paranoid Musings
by frantz＠netcom.com 17 Dec '03

17 Dec '03

I'm really feeling much better now :-). At 6:48 PM 7/30/96 -0400, Mark M. wrote: >On Tue, 30 Jul 1996, Bill Frantz wrote: >> The paranoid conclusion is that there is a significant weakness in RC4. > >An FPGA can break RC4 in a few hours. With several thousand of these, RC4 >could be broken in about a second. Besides, RC4 has been around for 9 years >and has not been successfully cryptanalyzed. The RC4 algorithm is extremely >simple and doesn't have any obvious weaknesses. IMHO, NSA's cryptanalysis is second to none. I have been assuming a weakness based on a classified cryptanalysis technique. They have certainly been thinking about "S-Box" cyphers since at least Lucifer and DES. But let's approach the question from a different angle. Consider the number of messages that need to be broken and the costs of machines to do it. How many encrypted messages do you think NSA wants to read? I have no idea either, but in the spirit of never depend on expert opinion when simple arithmetic will do, let's assume a world where major email packages use encryption as a matter of course. If we assume that the 30 million net users send one email/day, then that results in about 350/second. If I assume your "several thousand" is 2000, then we need a machine with 700,000 FPGA's. Given Matt Blaze et. al.'s estimate of $10/chip complete, that is $7 million. However if you take the NSA's estimate (in their response to Blaze et al) of $1000/chip, then you get $700 million. If we assume a machine designed to break *every* message, NSA's response makes more sense. From their response (reordered): >The factors not accounted for are: > > o Memory costs are not included. It needs to store all the messages it is attacking. > o When get [sic] to the very fast processing speed estimates, > machines can become Input/Output bound; so [sic] it cannot achieve > the estimated speed. It needs to get all those messages into the machine, the plaintext out, and distribute the data to the FPGAs. > o As more and more chips are added to a machine, two effects occur: > > o Interconnections increase and increase running time; > o Heat from the chips eventually limit [sic] the size of a > machine. Fast machines produce a lot of heat. > o R&D costs for the first machine, typically on the order of $10 > million. R&D costs for high-speed I/O, large memories, and efficient heat removal might be significant. > o Assuming every algorithm can be tested in same amount of time and > key length is the only difference. This is one of Blase et. al.'s simplifying assumptions. RC4 has a simple key setup and runs faster than DES. Brute forcing 40 bit Blowfish would be considerably harder. Probably about equal to 9 additional key bits harder. Now I have no problem with believing NSA would invest $7 million. However, $700 million makes me wonder. With FPGAs, there is a significant risk that people will change the crypto system and make the investment worthless. (Which, I guess, is why they prefer general purpose computers.) However, if they can get the equivalent of a few bits of key back by cryptanalysis, then they knock the costs down to entirely reasonable (for them) levels. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

2 1

Aspol=ego
by nobody＠vegas.gateway.com 17 Dec '03

17 Dec '03

Jim Bell raved: <snip> >If anyone out there still doubts that the time for my "Assassination ^^ >Politics" idea will never come, I claim that it's later than you think. If anyone thinks _YOU_ thought of it first, they don't know history...

1 0

FPGAs and Heat (Re: Paranoid Musings)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:05 AM 7/31/96, Bill Frantz wrote: >I'm really feeling much better now :-). I guess Ritalin really does work. >How many encrypted messages do you think NSA wants to read? I have no idea >either, but in the spirit of never depend on expert opinion when simple >arithmetic will do, let's assume a world where major email packages use >encryption as a matter of course. If we assume that the 30 million net >users send one email/day, then that results in about 350/second. If I >assume your "several thousand" is 2000, then we need a machine with 700,000 >FPGA's. Given Matt Blaze et. al.'s estimate of $10/chip complete, that is >$7 million. However if you take the NSA's estimate (in their response to >Blaze et al) of $1000/chip, then you get $700 million. I for one don't have any way of estimating how many messages they might want to read. But note some figures we've discussed here before: * NSA spent upwards of $100 M to build the "Harvest" machine in the late 50s and early 60s (you worked with Norm Hardy, Bill, so you undoubtedly know about this). Some of this machine's capacity was for cryptanalysis, some for voice analysis, and no doubt a lot for other things. But it says something about the kinds of money that will be spent. * Spysats routinely cost a billion dollars or more. (A single launch of the space shuttle costs at least $500 M, as I recall. Some shuttle launches have been to deploy SIGINT sats.) * The NSA was one of the main investors in several high tech companies, including Control Data Corporation and Cray Research. I conclude, roughly speaking, that spending $100 M on a specialized machine to break RC4 or any other modern cipher (that is breakable at the key lengths used) would not even give them pause. >If we assume a machine designed to break *every* message, NSA's response >makes more sense. From their response (reordered): I don't believe that even _they_ would plan for something like this, unless RC4 is a lot weaker than experts seem to think it is. [stuff elided] >> o As more and more chips are added to a machine, two effects occur: >> >> o Interconnections increase and increase running time; >> o Heat from the chips eventually limit [sic] the size of a >> machine. >Fast machines produce a lot of heat. But, as many have pointed out, this is not a realistic limit. The pieces of the solution could be scattered from one end of Fort Meade to another, and still not be affected much by communications costs and delays. Power density is thus not going to be a problem. (A calculation can be done on how long it will take before electricity costs exceed chip costs...I haven't done this for the crypto FPGAs, as so many things are unclear about what they might be, but for the 200 MHz Pentium (CPU alone, not a system) I get: 40 kilowatt-hours per year x $0.10 per KWH = $4 per year in electricity costs. Heat removal costs are comparable.) FPGAs and custom chips will not be much different. I conclude that the costs of building the chips and system will be orders of magnitude more expensive than the costs of running the chips with power, and that removing the heat is not an issue. (Spread out enough, simple heat removal a la office computers is fine. Leaving windows open is even cheaper ;-)) >Now I have no problem with believing NSA would invest $7 million. However, >$700 million makes me wonder. With FPGAs, there is a significant risk that >people will change the crypto system and make the investment worthless. >(Which, I guess, is why they prefer general purpose computers.) However, >if they can get the equivalent of a few bits of key back by cryptanalysis, >then they knock the costs down to entirely reasonable (for them) levels. An FPGA is field-programmable. (FPGA = Field Programmable Gate Arrays) The Xilynx and Altera lines of FPGAs could be reconfigured for other algorithms, surely. (I recall several preliminary designs discussed in various places.) This doesn't mean they've done it, only that they could buy millions of FPGAs for the cost of a single spysat or shuttle launch. So, it seems likely. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

trust management workshop
by Matt Blaze 17 Dec '03

17 Dec '03

-------------------------------------------------------------------------- | DIMACS: Center for Discrete Mathematics & Theoretical Computer Science | | A National Science Foundation Science and Technology Center | -------------------------------------------------------------------------- DIMACS Workshop on Trust Management in Networks Dates: Sept. 30 - Oct. 2, 1996 Location: CORE Bldg., Rutgers University Busch Campus, Piscataway NJ Co-Chairs: Ernie Brickell, Bankers Trust, brickell(a)btec.com Joan Feigenbaum, AT&T Research, jf(a)research.att.com Dave Maher, AT&T Research, dpm(a)research.att.com Theme: The use of public-key cryptography on a mass-market scale requires sophisticated mechanisms for managing trust. For example, any application that receives a signed request for action is forced to answer the central question ``Is the key used to sign this request authorized to take this action?'' In certain applications, this question reduces to ``Does this key belong to this person?'' In others, the authorization question is considerably more complicated, and resolving it requires techniques for formulating security policies and security credentials, determining whether particular sets of credentials satisfy the relevant policies, and deferring trust to third parties. This workshop covers all aspects of the trust management problem. Relevant topics include but are not limited to: General approaches to trust management Languages, systems, and tools Certificates and public-key infrastructure Formal models and analysis Trust management in specific application domains, including but not limited to: Banking E-mail Internet commerce Licensing Medical information systems Mobile programs and ``code signing'' Revocation of cryptographic keys Confirmed speakers include: Butler Lampson, Microsoft Matt Blaze, AT&T Research Steve Kent, BBN Carl Ellison, Cybercash Contributed talks: If you would like to attend and give a talk, please email a one-page abstract (NOT A FULL PAPER) in ascii format to Joan Feigenbaum at jf(a)research.att.com by September 1, 1996. The Trust Management workshop will be informal, and there are currently no plans to publish proceedings. For more information: If you would like to attend but not give a talk, contact Joan Feigenbaum at jf(a)research.att.com any time before the beginning of the workshop. There is a small amount of support available for people who do not have other sources of travel funds. Information about local arrangements, travel, lodging and registration can be found at http://dimacs.rutgers.edu/Workshops/Management. Those without WWW access can contact Pat Pravato at 908-445-5929 or pravato(a)dimacs.rutgers.edu. This workshop is part of DIMACS Special Year on Networks. Information about the Special Year on Networks can be found at DIMACS WWW site: http://dimacs.rutgers.edu or by contacting the center. --------------------------------------------------------------------- The Special Year program is made possible by long term funding from the National Science Foundation, the New Jersey Commission on Science and Technology and DIMACS university and industry partners. DIMACS Center; Rutgers University; P.O. Box 1179; Piscataway, NJ 08855-1179 TEL: 908-445-5928 FAX: 908-445-5932 ** EMAIL: center(a)dimacs.rutgers.edu WWW: http://dimacs.rutgers.edu **TELNET: telnet info.rutgers.edu 90 DIMACS is a partnership of Rutgers University, Princeton University, AT&T Research, Bellcore, and Lucent - Bell Laboratories.

1 0

RE: A Libertine Question
by j ubois 17 Dec '03

17 Dec '03

Alan Horowitz wrote: I am a strong libertarian...{deletia}...damn well maintain public order and decorum. ***Or I will scream to my councilman for the cops to adjust your attitude with their billy club.*** Sounds consistent and rational to me.

2 1

FW: ANNOUNCEMENT: nym.alias.net enters beta testing (fwd)
by Mr. Brandon W. Wheaton 17 Dec '03

17 Dec '03

---------- From: William Knowles[SMTP:erehwon@c2.org] Sent: Tuesday, July 30, 1996 5:54 PM To: dc-stuff Subject: ANNOUNCEMENT: nym.alias.net enters beta testing (fwd) ---------- Forwarded message ---------- Date: Tue, 30 Jul 1996 19:40:36 -0400 (EDT) From: lcs Remailer Administrator <mix-admin(a)nym.alias.net> To: cypherpunks(a)toad.com, coderpunks(a)toad.com, remailer-operators(a)c2.org, mail2news(a)anon.lcs.mit.edu Subject: ANNOUNCEMENT: nym.alias.net enters beta testing Newsgroups: alt.privacy.anon-server -----BEGIN PGP SIGNED MESSAGE----- I'm pleased to announce that the nym.alias.net pseudonym server has now entered the beta-testing phase, and seems quite stable. Nym.alias.net offers several interesting features: * Public-Key encryption of all received mail. Once mail has gone through nym.alias.net, no one can read it except you--even if you have been sending your mail to a newsgroup and your reply-block and remailers become compromised. * Support for multiple, probabilistically-weighted, reply blocks. These can be used for redundancy or to foil traffic analysis with decoys. * Replay detection. This foils replay attacks, but can also be used for higher reliability if you send redundant copies of a message through different remailer chains. * An option to receive only fixed-length messages (by splitting up large messages and padding small ones with garbage). * An option to sign mail you send with the remailer's public key, so as to give some assurance of authenticity without having to publish your own PGP public key. * Support for finger [pending DNS approval]. You can choose to make your nym's PGP public key available to all who finger its E-mail address. Right now you can test this by fingering at 18.26.0.252. In addition, experimental nym.alias.net support for Premail is now available (in the form of a patch to premail 0.44). With this patch, premail will store your nym's PGP key on encrypted keyrings. This allows you to publish a PGP key for your pseudonym without the danger of your identity being revealed to someone with access to your main PGP keyrings (or a backup copy of them). To obtain more information about nym.alias.net, finger <nymhelp(a)anon.lcs.mit.edu> or send mail to <help(a)nym.alias.net>. To get information about using premail with nym.alias.net, finger <premail-info(a)anon.lcs.mit.edu> or send mail to <premail-info(a)nym.alias.net>. These documents are also available on the new nym.alias.net web page: http://www.cs.berkeley.edu/~raph/n.a.n.html Please report all bugs to <admin(a)nym.alias.net>. I'll also be glad to consider feature requests, particularly from anyone interested in developing any more client software. Enjoy! mix-admin(a)anon.lcs.mit.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMf6dcUTBtHVi58fRAQE4NgP/SoKSqHxobEHuyWl6lXVAHgk9yqNS/WAD jUfKYGodThr93kJZkmreyIHrWgbromJJlXo6MPq9KpZzIh85uHRzBPRSh293hfUo ta8/sdZsW1+uoEkAs8JUWlwAEGo+bfmgRnFswf80pAPClpbGo52DAKyLKfdCaFps kQ+4hoouUvo= =qEWa -----END PGP SIGNATURE-----

1 0

FW: Securing 5% of the Internet against Wiretapping by Christmas (fwd)
by Mr. Brandon W. Wheaton 17 Dec '03

17 Dec '03

Something I picked up from a mailing list called dc-stuff. <dc-stuff(a)fc.net> It's mostly having to do with security and hacking, thought not typically the "bad" sort. Thought it might not only be of interest the cypherpunks, but perhaps you could offer some hints, tips, advice?? Cheers, Bdog Date: Sat, 27 Jul 1996 16:24:52 -0700 From: John Gilmore <gnu(a)toad.com> Subject: FW: Securing 5% of the Internet against Wiretapping by Christmas I've been working on a project in secret for a few months, and now am talking about it with everyone so that we can all help it along. Want all the Internet traffic between you and every other privacy-conscious site on the net, worldwide, to automatically be encrypted using Triple-DES, RSA, and Diffie-Hellman? Without changing your hardware or software, except to stick a Linux PC on your network, or install a new version of Linux on your laptop? Want it all by Christmas? Then check out http://www.cygnus.com/~gnu/swan.html [...] -- John Gilmore An equal opportunistic encryptor

1 0

Re:FPGAs and Heat (Re: Paranoid Musings)
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Oddly enough, I just left a talk at the '96 Genetic Programming conference on developing adaptable hardware and silicon evolution. One of the speakers at this particular session was the Product Line Manager from Xilinx and one of the goodies he handed out was pre-release data sheets for the new XC6200 series of FPGAs they are producing (the chips are already out in limited quantities) so here is a little update on the state of the art in this area. Tim May writes: > Bill Frantz wrote: > >> o As more and more chips are added to a machine, two effects occur: > >> > >> o Interconnections increase and increase running time; > >> o Heat from the chips eventually limit [sic] the size of a > >> machine. > >Fast machines produce a lot of heat. > > But, as many have pointed out, this is not a realistic limit. One can also use reversible logic to get arond the heat problem if mechanical means are not enough. This is a necessity for molecular-scale computing and during the post-session BS at another talk we speced out a system that could probably evolve a reversible logic compiler. Heat will not be a "wall" at any scale, it may add to the cost a little bit but the problem is solvable. The interconnection problem has also been solved in this chip series. [A long-standing problem with FPGAs is that there were generally a limited amount of "wires" running between the logic elements and thus a lot of cells were wasted because there were no interconnections left, I/O to the outside world was also a problem.] The chip has a really cool interconnection method which allows a much more efficient use of the chip real estate and which makes the entire chip directly addresable (like regular RAM) through an on-chip interface module. Given the relatively compact design in Ian and Dave's paper and the new chips one might even fit two or four cracking engines on a single FPGA. Either the NSA did not do thier homework in this area or they are lying. > >Now I have no problem with believing NSA would invest $7 million. However, > >$700 million makes me wonder. With FPGAs, there is a significant risk that > >people will change the crypto system and make the investment worthless. > >(Which, I guess, is why they prefer general purpose computers.) However, > >if they can get the equivalent of a few bits of key back by cryptanalysis, > >then they knock the costs down to entirely reasonable (for them) levels. > > An FPGA is field-programmable. (FPGA = Field Programmable Gate Arrays) The > Xilynx and Altera lines of FPGAs could be reconfigured for other > algorithms, surely. (I recall several preliminary designs discussed in > various places.) There are two types of FPGAs, one is based on anti-fuse technology which is essentially a big complicated PROM, but the Xilinx FPGAs use SRAM to configure the interconnections between logic elements. The newest line from Xilinx, the XC6000 series has the capability to be reconfigured either partially or completely from an on-chip cache in 5 ns. That is five nanoseconds and you have a completely different piece of virtual hardware. If the configuration is loaded through the slowest I/O port on the chip it only takes 200 microseconds. Even if the encryption algorithm is secret these chips open up interesting posiblities for developing general-purpose cryptanalysis machines. [Hmm, there may be a paper in there... "Evolving A General-Purpose Cryptanalysis Engine"...] What is even better from the perspective of the NSA accountants is that they only need to build the machine _once_, after that they just load up a new set of interconnections and now the DES cracker is an IDEA cracker. Add to this the fact that the XC6000 series were designed to be built cheaply in large quantities (the Xilinx rep figures the price will get down to $29/chip in 5K lots for the samples he was passing around and he is a wafer guy and not marketting droid so this may be reasonably accurate.) If anything, the Blaze, et many als. paper _underestimated_ the cost of a FPGA hardware cracking engine, particularly if you amortize the savings FPGAs give over the long term with thier almost limitless flexibility. jim

1 0

Re: G7 Anti-Terrorism Reports [BRIEF]
by Deranged Mutant 17 Dec '03

17 Dec '03

On 30 Jul 96 at 18:47, Jonathan M Summers wrote: > Cypherpunks: > > At 1735 CDT on Tuesday, July 30, 1996, CNN Atlanta during World News > Tonight reported (in a _very_ brief flash) several "resolutions" adopted > by the Group of Seven (G7) trade meeting in Paris. > > At the bottom of the list of resolutions was to "prevent terrorist from > using the Internet" (quote from CNN anchorwoman). The Pacifica Report noted 'more controls on the Internet' and controlling the use of encryption, but didn't discuss this at length. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Paranoid Musings
by Deranged Mutant 17 Dec '03

17 Dec '03

On 30 Jul 96 at 11:13, Bill Frantz wrote: [..] > (1) Now everyone knows that 40 bit RC4 is weak, but just how weak is it? Differentiate between the cipher and the key-initialization. There may be a flaw in how the key is set up that can make brute-force searches easier. Known plaintext of a few headers may also help in guessing the s-box state, even if partially: combined with flaws in the key, this could be exploited, especially if one has a lot of experience and computing power handy. [..] > (2) What did Microsoft give up to export its crypto API? > > Well, if you were a TLA, what would you want. I think I would want an > agreement to be able to insert my own code in that vendor's products. Then > I would be able to have widely distributed Trojan horses signed by the > vendor. I would have the opportunity to significantly weaken standardized > crypto systems installed world wide. Risky. Code can always be reverse engineered. If a flaw is exploited in too-strong an algorithm (3DES and 4k-bit RSA keys, for instance) to prosecute various people, somebody might notice. If US companies seem to magically have proprietary info from foreign companies, this would also be a sign of suspicion. I think the C[r]API will be used as a form of mandating GAK instead. Rob > > > Conspiracy theorists, start your mailers. > > > ------------------------------------------------------------------------- > Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting > (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. > frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA > > > > --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Blaming the Internet for Terrorism
by Deranged Mutant 17 Dec '03

17 Dec '03

This comes from today's (Wed. July 31) LI Newsday, though the byline is the AP: "Bombing Becoming All Too Popular" The Associated Press Washington - The number of Americans attacking and attempting to attack each other with bombs each year has nearly doubled this decade. For every Olympic park or Oklahamo City tragedy, police report dozens of foiled attempts where death and destruction are narrowly averted. [..] The rapid escalation poses a vexing problem for law enforcement. Unlike international terrorists with recognized agendas, these culprits are most often low-profile operators plotting in the privacy of back yards, garages and basements with easily obtained materials and simple instructions straight off the Internet. [..] In 1989, there were 1,699 criminal bombings attemted or carried out nationwide. By 1994, the last year with complete figures, the number has risen to 3,163, according to the Bureau of Alcohol, Tobacco, and Firearms. Local cases, which seldom make national headlines, demonstrate the breadth of the threat. [Examples follow...only one names the Internet:] In Baton-Rouge, La., an 18-year-ooold dropout and two friends were indicted this month for stealing bomb-making materials from two high-school chemistry labs, Court records allege the three plotted to blow up a train returning the young woman's parents from vacation to get insurance money, and had followed a terrorist handbook published on the Internet. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: crypto CD source
by Alex de Joode 17 Dec '03

17 Dec '03

In article <16689.9607301944(a)exe.dcs.exeter.ac.uk> you wrote: : Some time ago on the list there was some discussion of putting : together a CD full of cryptographic software and reference material. : Nothing came of it, but I think several people expressed an interest, : for those of you who were interested, take a look at: : http://www.sevenlocks.com/ [..] : They have a large supply of crypto software available on-line as well. : (No mention of ITAR on their software down load pages (78 Mb of : security related software they claim), and it looks you could download : the lot even if you weren't in the US). ftp.replay.com has 220 Mb of crypto software available for download at no charge .... bEST Regards, -- Alex de Joode | Replay IP Service & Web DZign -- The Netherlands usura(a)replay.com | http://www.replay.com mailto:info@replay.com

2 1

Crypto Law and Veincheck
by jya＠pipeline.com 17 Dec '03

17 Dec '03

http://www.ispo.cec.be:81/ispo/lists/ispo/0464.html ---------- European Crypto Law information sources Robert Horvitz (horvitzr(a)omri.cz) Tue, 21 May 1996 13:22:59 +1GMT Reply to aadamski(a)cc.uni.torun.pl (Andrzej Adamski) who said: My name is Andrzej Adamski, I'm from Poland, Nicolas Copernicus University . I would be very grateful for getting hints where to find information on the current EU encryption policy/ legislation. What about present developments in the area of the European infrastructure of pubic (sic) key look like? ------------------------------------------------------------ Adam, the best place to start your research is at the "Cryptography in Europe" website: http://www.modeemi.cs.tut.fi/~avs/eu-crypto.html To see the wider context, visit the "Crypto Law Survey" website created by Bert-Jaap Koops in the Netherlands, at: http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm The EU and EC seem likely to cave in to pressure (blackmail?) from the American spy agencies and impose "back doors" on any strong encryption package. Unless Europeans stand up and insist that privacy of communication is an essential human right. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Robert Horvitz, International Coordinator, OSI Internet Program Motokov Building - Room 518, Na Strzi 63, 140 62 Praha 4, Czech Rep., tel 42 2 6114-2751, fax 6114-2750, email horvitzr(a)omri.cz ---------- For more on cryptography and encryption, see the IPO search page at: http://www.ispo.cec.be/topic/simple.html As an example, for artful use of crypto, see the "veincheck" proposal at: http://www.ispo.cec.be:81/ispo/lists/ispo/0252.html Social Applications of Biometrics Joe Rice (joerice(a)innotts.co.uk) Tue, 26 Mar 1996 21:28:20 -0800 I would welcome some input to shape the following IT technology. The technology is a physiological biometric based upon the detection and comparison of subcutaneous blood vessels, essentially bar-code reading of people.

1 0

Re: New Clinton (anti-) Encryption Policy nnn
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

> CLINTON ADMINISTRATION FACT SHEET: U.S. CRYPTOGRAPHY POLICY (Industry, > international cooperation urged) > Following is the text of the fact sheet: kersnip > Militia groups advise their members to use encryption to hide illicit > weapons, financial, and other criminal activities. Using encryption to hide illicit weapons? I think somebodys been watching too much TV. VR Troopers Transform!!

1 0

Re: fbi, crypto, and defcon
by TQDB 17 Dec '03

17 Dec '03

> Date: Tue, 30 Jul 1996 17:31:25 -0400 > From: Stephen Cobb <stephen(a)iu.net> > To: cypherpunks(a)feist.com > Subject: Re: fbi, crypto, and defcon > Okay, so their boss is part of the law making process, subject to the checks > and balances that exist between the three branches of US government. They > are in a position to supply their boss with data and I am personally > impressed with their grasp of some of that data (it sounds to me like they > are telling their boss that hackers like the ones at Defcon are not the > problem). I think what they are really saying is that they would love to bust most hackers, but since they can't they might as well use some of them to catch the bigger fish. If they truly did believe in the laws they are supposed to uphold they wouldn't associate with hackers (who commit computer crimes) at all. > All of us who have some understanding of these issues need to do our best to > educate the public and the politicians, even if we have to start from the > "See Jane hack" level (pun intended). Otherwise dumb laws will be passed and > then we will have to engage in mass civil disobedience (which I have > personally done in the past). Stopping bad laws from becoming law is a lot > easier than overturning them later. This is exactly one good reason for having additional support for our Hack The Lies (HTL) project. Besides spreading truthful and factual information to the public, we recognize that the government definately could use its share of help from people who know what they are talking about. .TQDB

1 0

Re: Smart cards "a giant leap backwards" - Canadian Privacy Commissioner
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:23 PM 7/30/96 -0400, Richard Martin wrote: >Very little that might be new or enlightening to the world; attendees >of CFP '96 will remember [fuzzily, in my case] the closest thing to >Bruce's counterpart in the states admitting that the USA doesn't actually >have much of a counterpart to the privacy commissioner. Most Central European countries have both privacy commissioners and legal requirements that everyone register their addresses with the police. I'll do without the former if I can also avoid the latter. DCF

1 0

G7T_err
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Excerpts of four reports on the G7+1 antiterrorism meet in Paris: WSJ: + Mass Transport: The International Civil Aviation Organization will implement new standards for bomb detection at domestic and international airports. The eight nations will jointly develop standards for more detailed and accurate passenger and cargo lists, as well as new vehicle-identification tagging methods to make car-bombing investigations easier, U.S. officials said. + Information Sharing: The U.S Federal Bureau of Investigation will lead an effort to develop an international forensic database. The FBI offered to share certain computer records with the other seven countries. + Wiretapping and Internet: The eight countries said they would develop new lawful means to intercept communications among terrorists. They agreed to study how to prevent the Internet from becoming a tool for planning and executing terrorist events. + Explosives Tracing: The U.S. will share its research on new technologies to trace the origin of explosive devices U.S. officials said, and will push for international use of such technologies if they are found to be workable. + Other Measures: Controlling trade in certain weapons and chemicals financing of terrorist organizations and forgery of travel documents also will be studied. WaPo: The 25-point plan calls for close cooperation in formulating a range of security measures, including tightened controls on firearms and explosives; prevention of terrorist communications on the Internet; improved bomb detection methods at airports; and interdiction of terrorist groups' financial resources. They also called for the expediting of extradition procedures and faster exchanges of information on terrorist activities, including any use of chemical, biological or nuclear materials. Details on all 25 points were left for law enforcement and forensic experts to work out, with deadlines for finalization of specific measures set for 90 days to six months. FiTi: Among the measures agreed in Paris were an accelerated programme of research designed to find ways to mark explosives so their origin could be identified after a blast; the development of ways to prevent terrorists using electronic or wire communication systems, including the Internet and tougher sentences. The ministers also called for investigations into organisations with social, charitable and cultural goals which were abused by terrorists; restrictions on asylum- seeking by those who had committed attacks or were suspected of planning or funding them; and more effective border controls and extradition procedures. NYP: The details were not all made public today, but the measures the officials agreed to draft included devising methods to monitor terrorist attempts to communicate over the Internet; developing standards to make it easier to trace the origin of explosives used in terrorist bombs and cracking down domestically on the manufacture, sale, transport and export of explosives and firearms. ---------- For extensive background, links to related sites and latest information on the G7 series of meetings see: http://www.diplomatie.fr/actual/g7lyon/index.gb.html ---------- For today's four full reports: http://jya.com/g7terr.txt (20 kb for 4) G7T_err

1 0

Re: A Libertine Question
by Duncan Frissell 17 Dec '03

17 Dec '03

At 06:01 AM 7/31/96 -0700, Greg Broiles wrote: >Which is a long way to say that street cops >don't usually torment people with nice cars and/or houses, so those folks >don't need to be so concerned about making sure their "papers" are "in >order". Most demands for ID and conformations with police involve the operation of motor vehicles. I have never been "IDed" except at border crossings and when I was operating motor vehicles. Clean and dressed up people are rarely IDed on foot. Maybe you should mention some of the specific practices in Seattle that disturb you. >So the unconstitutional and oppressive character of the various laws >Mike Duvos refers to is mitigated by their lack of evenhanded enforcement. >If a cop can demand ID from someone who "looks like he doesn't belong here" >he can demand it from you. (modulo driving, this isn't legal. But give >Justice [sic] Rehnquist and Clinton and random congressional maniacs a few >more years and see where things stand.) Or flying on a commercial flight. So far, prosecutions for "failure to possess ID" have not succeeded. You *can* be prosecuted for failure to identify yourself (which is *not* the same thing). The Philadelphia airport was allegedly requiring *two* pieces of ID for flights. If they are talking about two pieces of photo -- government-issued ID, I wonder where the 80% of Americans without a Passport (x the 90% of Americans who are not government employees) get the second piece of ID. [Is it a violation of something if you Heil Hitler od Sieg Heil the airline clerk when they ask to see your ID. It's not a threat, it's an expression of honor.] >with guns or other weapons. And just as some people "don't have a right to >live in Seattle" if they won't toe the line, other people may find they >"don't have a right to live in the United States." * The Supremes outlawed exile as a punishment in a case during the 1950s. Said it was cruel and unusual punishment. Guess it's OK to execute people but not deprive them of having a government. DCF "If the security guard did it in Atlanta, that will be the second US Olympics in which the only 'terrorist incident' was perpetrated by a security person. I guess we should outlaw security at such gatherings to prevent terrorism."

3 2

****Tacoma, Washington Starts Taxing Internet Access 07/30/96
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

>WASHINGTON, DC, U.S.A., 1996 JUL 30 (NB) -- By Bill Pietrucha. >Tacoma, Washington, has just gained the distinction of being the >only municipality in the United States to tax Internet Access >providers (IAPs) like telephone service providers. > >The city of Tacoma has extended its six percent gross receipts tax on >telecommunications services to include Internet services, Information >Technology Association of America (ITAA) spokesperson Bob Cohen >told Newsbytes. > >"IAPs use telephone lines to provide consumers with the `on-ramp' >access to the Internet," Cohen told Newsbytes. "Since consumers and >providers already pay taxes on basic telephone service," Cohen said, >"the new Tacoma tax would amount to double taxation, applying to >both the telephone service and the content transmitted over the >telephone line." > >Cohen said ITAA has called on Tacoma Mayor Brian Ebersole to rescind >the new tax, saying that "excessive regulation and taxation will >change the fundamental nature of this new medium (the Internet)." > >In urging the mayor to stop the city's attempt to impose a tax on >the IAPs, ITAA President Harris N. Miler said that "Tacoma will be >hurting both the Internet and its own economic future." > >Miller told Newsbytes that the tax will mean "a loss of profits >to Tacoma-based IAPs, as well as a paperwork nightmare which may >drive companies out of business. IAPs doing business in Tacoma will >be at a competitive disadvantage to their competitors in other >municipalities." > >Miller noted that the tax regime could cause Tacoma-based IAPs to >move to other jurisdictions, "taking the jobs they provide, and the >taxes they currently pay, with them. They (IAPs) may also decide not >to provide service to Tacoma residents rather than deal with the >administrative nightmare of complying with the new tax regulations," >Miller said. > >If other cities attempted to follow Tacoma's lead in taxing IAPs, >Miler said, it could cause the "Balkanization of the Internet, a >hodgepodge of confusing, conflicting, and difficult to administer >Internet tax rules and regulations. > >Miller also hinted that the tax could inadvertently be in violation >of international tax treaties. > >"To begin taxing at the local level before it is clear what the >impact will be on industry and the public in general is bad public >policy," Miller said. > >(19960730/Press Contact: Bob Cohen, Information Technology >Association of America, 703-284-5333, Internet e-mail bcohen(a)itaa.org) > > > _______________________ Regards, There are no facts, only interpretations. -Friedrich Nietzsche Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

2 1

re:WaPo on Crypto-Genie Terrorism
by Vinnie Moscaritolo 17 Dec '03

17 Dec '03

here is something my girlfriend sent me the other day, after reading the Klinton-Antifreedom/terror news Setting: Germany in the late 30's. Quote from "Stones from the River", by Ursula Hegi. I think this rings true for our country today. The tragic reality is that the majority of people have simply forgotten the urge to question what they read in the news. "The people of Burgdorf went to parades and speeches--some because they genuinely believed in their leaders; others, because not to go would call attention to themselves. Most practiced the silence they were familiar with, a silence nurtured by fear and complicity that would grow beyond anything they could imagine, mushrooming into the decades after the war which, some began to fear, was about to happen. To justify this silence, they tried to find the good in their government or fled into the mazes of their own lives, turning away from the community. They knew how not to ask questions; they had been prepared for it by government and church. Over the years, they had forgotten that early urge to question." Vinnie Moscaritolo http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A ------------------ "And someone said Hey man did ya see that? His body hit the street with such a beautiful thud.. I wonder if he knew what he was getting into... Or was he just lost in the flood?"

1 0

Re:FPGAs and Heat (Re: Paranoid Musings)
by jim bell 17 Dec '03

17 Dec '03

At 02:14 AM 7/31/96 -0800, Jim McCoy wrote: >The interconnection problem has also been solved in this chip series. [A >long-standing problem with FPGAs is that there were generally a limited >amount of "wires" running between the logic elements and thus a lot of cells >were wasted because there were no interconnections left, I/O to the outside >world was also a problem.] The chip has a really cool interconnection method >which allows a much more efficient use of the chip real estate and which >makes the entire chip directly addresable (like regular RAM) through an >on-chip interface module. Given the relatively compact design in Ian and >Dave's paper and the new chips one might even fit two or four cracking >engines on a single FPGA. However, I think it very unlikely that an organization like the NSA would bother with an FPGA to do a cracking engine. FPGA's have substantial limitations, as you alluded to above, due to the need to make them "general purpose." A non-field programmable Gate Array, a hard-wired chip, would tend to optimize the interconnections on chip including minimizing the delays, but not incur the full-custom costs such as the penalty for low volume. Jim Bell jimbell(a)pacifier.com

1 0

If you have Fortezza experience
by Rich Salz 17 Dec '03

17 Dec '03

Please excuse the interruption. If you have experience building software that uses the Fortezza card, Murray Mazer at OSF would like to chat -- he's trying to scope out what would be involved in adding it to some WWW work for an ARPA project. (Yes, we already have the various Lock-step, etc., documents from the NSA.) Please respond to Murray directly. By way of penance for sending email to a list that I am not on, I offer a short page on exporting crypto software, http://www.osf.org/crypto-export.html, that some might find useful. /r$

2 1

Geo-Politics
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Two articles today in WSJ and FiTi show an unpected link between geo-technology and geo-politics: One reviews the explosives sniffing technology invented by geologist Anthony Barringer for global mineral exploration -- like copper, luxury metals and oil -- but which came to have more practical utility in the antiterrorist market (the company's stock is rocketing). Even so, its best use may prove to be in discovering petroleum and other wealth of the earth. As this tech becomes more widespread, Shell has good reason to encrypt its geological logs and steganographize its governmental bribes. And, a column reviews the tie between nationalist conflicts (markets for cheap explosives) and the invention of modern states (markets for expensive munitions). How the citizenry of modern nations are united by "the need for context-free communication" that was once limited to the members of the "high culture" of pre-modern communities. And how the nationalist citizenry are adopting the cheap versions of expensive munitions of the states' high culture to get their overdue share of the earth's pie. It explores the geopolitical differences among: Ethnic community Ethnic category Nation Nation-state Nationalism ----- http://jya.com/geopol.txt GEO_pol

1 0

"An who shall guard the guardians?"
by tcmay＠got.net 17 Dec '03

17 Dec '03

The Latin maxim "And who shall guard the guardians?" has some relevance to the headlong rush into converting the U.S. into even more of a security state than it is now. The investigation in Atlanta is now focussing on a rent-a-cop who may have planted the pipe bomb and then "discovered" it. Check the usual Web news sources for more details. Whether he is the bomber or not is not the point, which is, "who watches the cops?" A string of arsons up and down the north-south highways of California was finally shown to correlate with the travels up and down those highways (at those same times) by a Glendale arson investigator! And cases where cops have planted evidence, drugs, and guns are almost too much a part of our culture to even notice anymore. My point is not that all cops are corrupt. Indeed, I suspect that they are no more corrupt proportionately than is the general population...which is not too reassuring to me, though. ObClipper: "Who shall guard the guardians?" While the various Clipper proposals have putative safeguards to limit access, think of Craig Livingstone, a rent-a-cop the Clintons hire to work on their Enemies List. And think of the dossiers of J. Edgar Hoover. And think of Nixon. And think of what President Pat Buchanan would do with Government Access to Keys. No thanks, I'll lock my own doors. I have no plans to "voluntarily escrow" my door keys with the local cops. "Secure in one's papers and person" rings a bell, doesn't it? --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3