December 2003 - cypherpunks-legacy

[NOISE] Re: Firewall Penetration
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:29 PM 7/19/96 +0800, Jerome Tan wrote: >Is it possible to penetrate a firewall? Yes, but it requires alot of time and money. (As well as a nice car and a six figure income.) I recommend taking the firewall out to a nice restaurant, feeding it dinner, taking it out for drinks and then back to your house or apartment. If everything works, you should be able to penetrate said firewall. But she will not return your calls in the morning... --- |"Computers are Voodoo -- You just have to know where to stick the pins."| |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: Responding to Pre-dawn Unannounced Ninja Raids
by Arun Mehta 17 Dec '03

17 Dec '03

At 01:10 20/07/96 -0700, Timothy C. May wrote: >By "you," I have to presume you mean "me." No, I am not at likely to use >this weapon in a rage against a loved one. Trust me. This was not intended to suggest how "you" might behave, I don't know you that well, it would have been less confusing for me to have used the pronoun "one." >It may sound "stupid" to you...I suggest you read up on evolutionary game >theory. Sometimes one has no choice but to respond to an arms buildup. >Unilateral disarmament rarely works. There are surely alternatives to the extremes of unilateral disarmament and an arms race? For instance, slowing down the race? More often than not, it is the US that has upped the ante. They consistently had more nuclear warheads than the Soviet Union, new technologies that disrupted the status quo came generally from the West. Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://www.cerfnet.com/~amehta/ finger amehta(a)cerfnet.com for public key

3 2

Curfews again
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:37 PM 7/20/96, Alan Olsen wrote: >I bet the "National Curfew" crap that Clinton is trying to push is not going >down well either. He seems to think that the problems of a small fraction >of the country apply to the whole country... (But it makes for good sound >bites.) Yes, I have written about the local "curfew" in my local newsgroup (scruz.general), and I forwarded at least one of these articles to this list, as you may recall. Consistent with my views on gun control, mandatory doping of children, the outlawing of certain dietary items, and on and on, I would be mighty pissed if a kid of mine was picked up the cops and hauled off to a processing center for eventual disposition for the thought crime of being on the street without an excuse acceptable to the local gendarmes. (In fact, I think I'd be tempted to just not answer any phone calls from the reeducation center staffers; getting through to me on the phone can often be difficult, of course, and I doubt they know about e-mail.) I told someone in scruz.general who argued strongly for the need for curfews on kids that her points had convinced me, that I now understood her position, that I now agreed with it, and that I would be doing my part by making a citizen's arrest of any curfew violators I found in my area...especially cute 16-year-old girls. (I never heard from her again...after she stopped foaming at the mouth she probably contacted the Thought Crimes Task Force of the Sheriff's Department.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: PGP Keyserver at jpunix.com
by John A. Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The problem with the PGP keyserver at jpunix.com has been corrected. It turned out to be a corrupted keyring. The keyserver is once again available via email at pgp-public-keys(a)jpunix.com as well as by WWW from www.jpunix.com. The WWW interface uses Bal's PGP WWW interface. I apologize for the downtime and the inconvenience. On the up side, I didn't lose any key requests during the downtime. John Perry - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMfFE6lOTpEThrthvAQE3cQP/cy7x/LnmfC/31AcIgom3X2Cc/YMR01Jw 95kPt7W0JAz154DZezXLyR79Q7fJ4DYSkHRO6HFGwd5QiCkHrUjv/xweECPf9Q4s x41VnTFxrXGr3+YTm47vL+gBnuVmSTP4ujMC9s6r2zcGOCE3jQXKBLEhGNB6kPxg ab37bM4iGHo= =oONb -----END PGP SIGNATURE-----

1 0

A Snake-Oil FAQ
by Deranged Mutant 17 Dec '03

17 Dec '03

I've written a short "Snake Oil FAQ" below. It's incomplete and needs some work (adding a few definitions, rewording, aesthetic formatting, etc.), so think of it as a 'beta' FAQ (please don't post it on web pages, though I don't mind if it's distributed among anyone interested in criticizing or contributing). Comments and suggestions would be appreciated. Note that the aim is to write something accessible to 'newbies'. (Jeremy Barrett contributed to this, BTW) Snake-Oil Warning Signs Encryption Software to Avoid (Revision 0.1) Introduction ====================================================================== Good cryptography is an excellent and necessary tool for almost anyone. However, there are a multitude of choices for what products to use. Many good cryptographic products are available, both commercial and free. However there are also some extremely bad cryptographic products (known in the field as "Snake Oil"), which not only fail do their job of providing security, but are based on, and add to, the many misconceptions and misunderstandings surrounding cryptogra phy and security. It is extremely important that users of cryptography actively question the product they are considering using, to insure the security and integrity of their data-- be it personal or business informat ion. In order to make a more informed decision, it is necessary to understand some of the "red flags" to watch out for, and what they mean. For a variety of reasons, this document is general in scope and does not mention specific products or algorithms as being "good" or "Snake Oil". Some Common Snake-Oil Warning Signs ====================================================================== The following are some of the "red flags" one should watch for when looking at an encryption product: Technobabble ------------ The vendor's descrption of the product may contain a lot of hard-to-follow use of technical terms to describe how the product works. If this appears to be confusing nonsesense, it may very well be (even to someone familiar with the terminology). Technobabble is a good means of confusing a potential user and masking the fact that the vendor doesn't understand anything either. A sign of technobabble is a descrption which drops a lot of technical terms for how the system works without actually explaining how it works. New Type of Cryptography? ------------------------- Beware of any vendor who claims to have invented a "new type of cryptography". Avoid software which claims to use 'new paradigms' of computing such as cellular automata, neural nets, genetic algorithms, chaos theory, etc. Just because software uses to different mehtod of computation doesn't make it more secure. Anything that claims to have invented a new public key cryptosystem without publishing the details or underlying mathematical principles is highly suspect. Proprietary Algorithms ---------------------- Avoid software which uses "proprietary" or "secret" algorithms. Security through obscurity is not considered a safe means of protecting your data. If the vendor does not feel confident that the method used can withstand years of scrutiny by the academic community, neither should you. Beware of specially modified versions of well-known algorithms. This may unintentionally weaken the cipher. The use of a trusted algorithm, along with technical notes explaining the implementation (if not availablity of the source code for the product) are a sign of good faith on the part of the vendor that you can take apart and test the implementation yourself. Old Ciphers Never Die... ------------------------ Beware of something that sounds like a sophisticated nineteenth- century or even World War II scheme, or something based on a mechanical system. If the product's authors sound like they are entirely unfamiliar with the state of the art, that's a good warning sign. Experienced Security Experts ---------------------------- Beware of any product claiming that "experienced security experts" have analyzed it, but it won't say who (especially if the scheme has not been published in a reputable journal). Unbreakability -------------- Some vendors will claim their software is "unbreakable". This is marketing hype, and a common sign of snake-oil. Avoid any vendor that makes unrealistic claims. No algorithm is unbreakable. Even the best algorithms are breakable using "brute force" (trying every possible key), but if the key size is large enough, this is impractical even with vast amounts of computing power. Be wary of marketing gimmicks related to "if you can crack our software" contests. One-Time-Pads ------------- A snake-oil vendor may claim the system uses a one-time-pad (OTP), which is theoretically unbreakable. A OTP system is not an algorithm. It involves generating a random key at least the size of the message and garbling the message with it. When the message is decrypted, the key is destroyed. Only one message is encrypted with a OTP, and it is used only once. They key is random: generated using a real random source, such as specialized hardware, radioctive decay timings, etc., and not from an algorithm or cipher. Anything else is not a one-time-pad. The vendor may confuse random session keys or initialization vectors with OTPs. Algorithm or product XXX is insecure ------------------------------------ Avoid anything that makes claims that particular algorithms or other products are insecure without backing up those claims (or at least siting references to them). Avoid anything that misrepresents 'weaknesses' of other algorithms. (For example, if the product claims it doesn't use public key crypto, citing timing attacks or factoring as reasons.) Keys and Passwords ------------------ The "key" and the "password" are often not the same thing. The "key" generally refers to the actual data used by the cipher algorithm. The "password" refers to the word or phrase the user types in, which the software converts into the key (usually through a process called "hashing" or "key initialization"). The reason this is done is because the characters a user is likely to type in do not cover the full range of possible characters. (Such keys would be more redundant and easier for an attacker to gues s.) By hashing a key can be made from an arbitrary password that covers the full range of possible keys. It also allows one to use longer words, or phrases and whole sentences as a "passphrase", wh ich is more secure. Anything that restricts users passwords to something like 10 or 16 or even 32 characters is foolish. If the actual "password" is the cipher's key (rather than hashing it into a key, as explained abo ve), avoid it. Anything that claims to solve the "key management problem" is also be to avoided. (Key management is an inherent problem with crypto.) Convenience is nice, but be wary of anything that sounds too easy to use. Avoid anything that lets anyone with your copy of the software to access files, data, etc. without having to use some sort of key or passphrase. Avoid anything that doesn't let you generate your own keys (ie, the vendor sends you a key in the mail). Avoid anything by a vendor who does not seem to understand the difference between public-key cryptography and private-key cryptography. Lost keys and passwords ----------------------- If there's a third-party utility that can crack the software, avoid it. If the vendor claims it can recover lost passwords (without using a key-backup or escrow feature), avoid it. Exported from the USA --------------------- If the software is made in North America, can it be exported? If the answer is yes, chances are it's not very strong. Strong cryptography is considered munitions in terms of export from the United States, and requires approval from the State Department. Chances are if the software is exportable, the algorithm is weak or it is crackable (hence it was approved for export). If the vendor is unaware of export restrictions, avoid the software: the vendor is not familiar with the state of the art. Because of export restrictions, some legitimate (not-Snake Oil) products may have a freely exportable version for outside of the USA, which is different from a separate US/Canada-only distribution. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

9 13

Game Theory and its Relevance to Cypherpunks
by tcmay＠got.net 17 Dec '03

17 Dec '03

Game theory is terribly important to Cypherpunks. At 8:11 PM 7/20/96, Perry E. Metzger wrote: >Arun Mehta writes: >> >It may sound "stupid" to you...I suggest you read up on evolutionary game >> >theory. Sometimes one has no choice but to respond to an arms buildup. >> >Unilateral disarmament rarely works. >> >> There are surely alternatives to the extremes of unilateral >> disarmament and an arms race? For instance, slowing down the >> race? > >Don't ask the question as though it is theoretical. Don't try >answering it as though your personal values have any bearing, because >there is indeed an objective answer here. Try doing some game theory >simulations and see how well unilateral disarmament works. > >Oh, and don't give us stuff about how humans are above evolutionary >pressures or nonsense like that, because we aren't any more above such >pressures than we are above the laws of physics. Moreover, folks should pay careful attention to the way the _appearance_ of strength is critical. I don't mean bluffing, thought that sometimes has a place, I mean the "scaring off" of would-be challengers/attackers/intruders. For example, one well-known variant in evolutionary game theory is the "game of chicken," immortalized in the race-to-the-cliff in "Rebel Without a Clue^H^H^H^H^HCause." While such games sound foolish to many--and such a cliff race is not something I'd ever partake in--they are quite common and confer evolutionary advantages to the winners. To put it simply, the leader of a pack, whether dogs, humans, whatever, may face challenges from other pack members. If he can convince them that he'll win, that he's the craziest motherfucker on the planet, the challenges are reduced. A weak-appearing leader is of course attacked more quickly. (These are separate issues from the actual strength of skill of the participants, but it's a basic fact that a leader who can avoid as many challenges as possible will likely last longer.) Seen another way, there is considerable game-theoretic advantage in being seen as "crazy." If the other guy veers off long before impact or going over the cliff, because he think his opponent is crazy enough to ignore "rationality," much is gained by the victor. Avoiding fighting is often the most important consideration, and arms races often accomplish this goal! Even the "MAD" policy of "mutually assured destruction" has game-theoretic justification. (Indeed, this is virtually a truism, given the role game theory and the RAND Corporation played in the devising of the MAD strategy.) While humanists and liberals may cluck at the admittedly horrible consequences of MAD, were it ever implemented, it is solidly grounded in these "games." Fortunately, the goal of MAD was to not have to be used, and it appears now to have worked quite well (albeit at high cost). The application of these ideas to gun ownership is pretty clear, even to those who have not studied or thought much about these topics: a person contemplating a crime will be more likely to do so with an unarmed person. Duh. And less likely against someone he suspects is armed. Still less likely againt a "gun nut." Seeing an "NRA" sticker in the window of a car parked outside is likely to make him think twice, fearing a "gun nut" is inside. Being perceived as a gun nut does have some advantages. Hence the availabilty of signs saying: "Trespassers will be Shot," and, my favorite: "I have a .45 and a shovel; I doubt you'll be missed." (5 points to whomever first identifies the movie this was in) (One of the interesting speculations is what role this thinking played in the development of U.S. paramilitary S.W.A.T. teams, the "black-clad ninjas" we have been talking about recently. Creating a terrifying image, an image of crazed indifference, is a useful thing. Certainly the S.S. understood the power of their frightening uniforms and the "myth" of their bloodthirstiness. (Note: I am not saying their bloodthirstiness was a myth, but that they deliberately cultivated this image. Intimidation works, game-theoretically.) Game theory is at the confluence of economics (costs), psychology (motivations, rewards), evolution (who survives to reproduce), sociobiology (essentially another name for evolutionary game theory), and other fields. All educated persons should know the basics of a bunch of related things: -- "the prisoner's dilemma" (another famous example) -- the iterated forms of this and other games -- the concept of payoff matrices -- the game of chicken -- the nature of arms races -- random reinforcement -- the concept of "defection" -- the ideas of positive-, zero-, and negative-sum games. More advanced stuff, e.g, Nash equilibria, is real useful to know about, but is not part of any ordinary conversations I have seen on the Net in many years of participating. In particular, game theory has a lot of usefullness to crypto and Cypherpunk themes. "All security is economics." Lots of obvious connections. Most Alice-Bob situations are essentially multi-party games, with all the related stuff about spoofing, expectations, reputations, cheating, etc. (Granted, many of these situations are far beyond the formal games that have been analyzed in detail to date. That is, it is not clear how crytpographic protocols affect such games; or at least this is a fertile area for further study.) A good understanding of game theory can be gotten in a few weeks by reading some of the main introductory texts. This will not qualify oneself as an expert, but will provide one with insight into why many of us make the points we make about economics, self-reliance, payoff outcomes, and so on. Useful sources: Axelrod, "The Evolution of Cooperation" --> the best place to start, IMO Hofstadter, various chapters in "Metamagical Themas" Poundstone, "The Prisoner's Dilemma" Kahn, "On Thermonuclear War" And of course various textbooks on game theory. (But read the popular accounts first, else the mathematical rigor will be meaningless and confusing.) The usefullness to cryptography, especially to the more outre stuff we are most interested in, has largely remained unexplored. I get the impression that few academic cryptographers know much about it. I predict that important insights will come as these fields come into more contact. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: lambda 2.09 - French Telco Act Censored?
by jt＠freenix.fr 17 Dec '03

17 Dec '03

>At 09:41 PM 7/19/96 +0100, Jerome Thorel wrote: > >>OECD FAILS TO ACT ON KEY-ESCROW ENCRYPTION; THE US ACCUSED OF "POLICY >>LAUNDERING" [deleted] Jim Bell jimbell(a)pacifier.com wrote: >Lemme see... The Europeans are now complaining about the US government >pushing key escrow on them? So where did that "emerging consensus" go?!? That was not a complaint -- but a modest report <g>. Anyway, the major countries which are to complaint about the US pressure are Japanese, Australians, and Scandinavian countries, which are less keen to let intelligence agencies controling individuals or industry secrets. France and the UK, however, are sitting side by side with the US. But I can add that my source is from the US :-) And that US business circles around OECD discussions think no international guidelines could emerge after any OECD meeting. Jerome Thorel ==-== Journaliste / Free-lance Reporter ==-== Paris, France ==-== ID Press Card +++ Carte de Presse No 72052 ==-==

1 0

Re: Netscape download requirements
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

>If they disagree with what Congress and the administration have done, there >are well-established ways to petition Congress to change it. If they fail, >t.s.--that's the way our system works. YOU don't get to force your will on >the wider population, nor do YOU get to tell them that they are poor >benighted fools who should agree with YOUR views on civil liberties. To >assert otherwise is fascism, authoritarianism, dictatorship, pick one. I don't think that demanding more liberty can in any way fall into any of those three categories. What happened to protecting a minorities Rights from the Majority? Simply because a majority decided they should take away my Rights (in this case to encryption, and for the sake of argument, I will concede for the moment that a majority actually did decide this) doesn't mean they should be taken away. This is what the Constitution and other founding documents are designed to protect us against. Saying "I have the Right to give encryption to anyone I want" is not forcing my will on the wider population, it is an attempt to keep the wider population from forcing their un-Constitutional will on me. //cerridwyn//

1 0

Re: MIT harassed over publication of PGP book
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:06 AM 7/10/96 EDT, Hal Abelson wrote: > >Now, we learn of a back channel communication from State to DOE to >Sandia, which has prompted Sandia to want to act as a policeman for >MIT vis a vis export controls. > >This is troubling for what it says about how the State Department is >dealing with export issues surrounding information about cryptography, >and about the extent to which policies are being administered in a >clear and above-board manner. A blue ribbon panel of Ivy League administrators warned in the mid 1950s that Universities which accepted public funds would lose their independence and become mere functionaries of the federal government. They were right and you all had fair warning. DCF

2 1

RE: ABC news on Internet Telephony
by Remo Pini 17 Dec '03

17 Dec '03

At 01:54 PM 7/18/96 -0700, you wrote: --- all the following points are based on swiss circumstances, they may not apply to US --- >point to point circuits are more efficiently handled by circuit >switching rather than packet switching networks. Nicholas >Negroponte wrote an interesting piece about asynchronous vs >synchronous, I believe it is in his book "Being Digital." Well, from a users point of view, sending packet data over a packet mode bearer service is more efficient (and cheaper). An interesting developement in this direction is the PMBS-A/B modes of ISDN (packet switching to the public switch). The existance of this service suggests its usability. >ADSL is an interesting attempt at digital telephony but expensive >and basically would mean replacing existing central office >switches. (backbone bandwidth) We have a well developed DQDB-MAN and ATM net around, and bandwidth is available (and getting cheaper by the minute). Currently, a onetime investment of around $2500 per client is necessary to provide >5MBit/s transfer volume (via the cable TV networks or the existing broadband networks) >In a packet network you have to either dedicate a portion of the >bandwidth for a synchronous circuit, or you have to have a very >fast network and use very small packets (ATM), expensive either >way. Not if you have a dedicated packet switching network for asynchronous packet transfer only. If you use it for both you don't have to have a very fast network, you have to have a network with predictable and constant packet delay. (that's not the same as fast!) >A single central office has many times the bandwidth of the widest >part of the internet, and the average state has hundreds of CO's. >If even a small portion of the Internets current users tried >placing a call things would grind to a halt. A huge increase in the >number of backbones and their bandwidth would solve this, but who >will pay the bill? I guess Internet-telephony is one of the bandwidth killers. >TANSTAAFL > >Sometime ago the discussion was on the cost of laying new fiber, >may I suggest the realworld heuristic of "a million dollars a >mile." There are of course a lot of alternatives: - Existing wiring (5 MBit/s over 6 copper wires is possible) - Usage of the cable networks - Radio transmissions (RITL - radio in the loop) - Satellite transmissions >Please note I am not trying to make fun of anyone personnally, I am >in the words of Jubal Harshaw "heaping scorn upon an inexcuseably >silly idea, a practice I shall always follow." Neither am I, but isn't anyone? ----------< fate favors the prepared mind >---------- Remo Pini Fon 1: +41 1 350 28 82 mailto:rp@rpini.com Fon 2: +41 1 465 31 90 http://www.rpini.com/remopini/ Fax: +41 1 350 28 84 soon:PGP: http://www.rpini.com/remopini/rpcrypto.html --------< words are what reality is made of >--------

1 0

Info War
by EVERHART＠Arisia.GCE.Com 17 Dec '03

17 Dec '03

If the government should happen to be serious about wanting to prevent some possible info war scenarios, one might expect a number of things to be seen. * I'd expect that there would be at least some statements about the unwisdom of standardizing on MS operating systems or unix versions which have little or no security, building an infrastructure with security holes one can drive a truck through. * I'd also expect that the anti-crypto campaign to be at least scaled WAY down, so as to encourage more open use of crypto components in security solutions. (Crypto won't help if your OS comes with a backdoor that allows anyone on the Internet to get r/w access to your disks...this has been reported to me in all Microsoft OSs they currently have, though with NT it's under certain common but not completely ubiquitous circumstances. The others are wide WIDE open. Other bugs doubtless exist. * I'd expect some comments on the automatic running of downloaded images and how to secure them. Java? Reported at Princeton to be totally unsecurable....no models exist. I believe you can run the thing securely, but by having some security in its environment., I'd expect a lot more about what is needed, and where it can be found, encouraging development of such features. If on the other hand this is a ploy to justify violating people's privacy and in fact is not concerned with improving our posture, I would expect more Clipper chips, etc., and nothing seriously beneficial. (I consider that freedom of speech & the press means that I can choose not only what to say, but how to say it. If I use a language (crypto) that is hard for some not spoken to to understand, I regard this as an essential part of the freedom. Last I looked, this is still written. (BTW, if you think that the Supreme Court is supposed to be the arbiter of constitutionality, your reading of Marbury vs. Madison is seriously flawed. Congress and the President (& other federal employees) take an oath of office and are supposed to be deciding that what they do is Constitutional before doing it. Alas that they generally don't take this seriously...) We'll see what actually happens. I'd like to hope for the real effort to avoid problems. I fear we will get the bogus one, suitable for control freaks but not useful ultimately in dealing with the threats. Glenn Everhart

1 0

INFO: Submit your testimony to Congress for hearings on July 25!
by Voters Telecommunications Watch 17 Dec '03

17 Dec '03

============================================================================= ____ _ _ _ / ___|_ __ _ _ _ __ | |_ ___ | \ | | _____ _____ | | | '__| | | | '_ \| __/ _ \ _____| \| |/ _ \ \ /\ / / __| | |___| | | |_| | |_) | || (_) |_____| |\ | __/\ V V /\__ \ \____|_| \__, | .__/ \__\___/ |_| \_|\___| \_/\_/ |___/ |___/|_| Virtually attend the upcoming hearings on July 25, 1996 Submit your own testimony Listen to the RealAudio cybercast Ask Louis Freeh a question (FBI) Date: July 20, 1996 URL:http://www.crypto.com/ crypto-news(a)panix.com If you redistribute this, please do so in its entirety, with the banner intact. ----------------------------------------------------------------------------- Table of Contents Upcoming hearing information How to receive crypto-news Press contacts ----------------------------------------------------------------------------- UPCOMING HEARING INFORMATION The Senate Commerce committee will be holding hearings on the Burns/Leahy Pro-CODE bill (S.1726) this Thursday July 25, 1996 in Washington D.C. Like most everyone that doesn't live in Washington, you can't be there in the flesh. But you can be there virtually through www.crypto.com! A RealAudio cybercast of the hearing is being coordinated by Jonah Seiger (CDT). If you have the RealAudio software (it's free from www.realaudio.com) you can listen to the hearing live. You can also telnet into the chat room and pose questions to the staffers who will be online. If you wish to make your voice heard, take a moment and submit your own written testimony through the web page at http://www.crypto.com. When you submit your testimony, you can also submit a question for FBI Director Louis Freeh who is scheduled to testify. We'll provide a copy of the questions to the committee members, and urge them to pin down Director Freeh on some of the finer points of the issue. This is an amazing time for democracy. Never before have American citizens been able to have so much representation in the halls of Congress without actually being physically there. Don't let this debate go on without your input! A complete profile of the cybercast and the net-presence effort is available at http://www.crypto.com/ until the hearing, and at http://www.crypto.com/events/ after that. ----------------------------------------------------------------------------- HOW TO RECEIVE CRYPTO-NEWS To subscribe to crypto-news, sign up from our WWW page (http://www.crypto.com) or send mail to majordomo(a)panix.com with "subscribe crypto-news" in the body of the message. To unsubscribe, send a letter to majordomo(a)panix.com with "unsubscribe crypto-news" in the body. ----------------------------------------------------------------------------- PRESS CONTACT INFORMATION Press inquiries on Crypto-News should be directed to Shabbir J. Safdar (VTW) at +1.718.596.2851 or shabbir(a)vtw.org Jonah Seiger (CDT) at +1.202.637.9800 or jseiger(a)cdt.org ----------------------------------------------------------------------------- End crypto-news =============================================================================

1 0

Re: Viacrypt PGP version 4.0
by Erle Greer 17 Dec '03

17 Dec '03

At 12:46 PM 7/20/96 -0700, you wrote: >On Fri, 19 Jul 1996, Erle Greer wrote: > >> Is there a free/trial/steal/shareware version of Viacrypt PGP Personal >> version 4.0, rather than forking over $129.00? >> >My company sells it for $100, if you want the full version with the book >and everything. > >Joseph Seanor > That sounds like an excellent deal when I plan to purchase it, but I would like to see if there is a crippleware demo first. I already have had 2.6.2 configured with a Windows clipboard utility. I just want to see if the full Win/integrated clipboard feature is more efficient. Thanks Joseph! P.S. I am also erleg(a)sdinter.net, but Majordomo won't unsubscribe me because I don't seem to be on the 'who cypherpunks' list, but my old address is still mysteriously reeiving the list. Any hints? Yes, I wrote owner-cypherpunks with no reply. TIA! /---\ |=================================================| / /\/ \ |If a train station is where a train stops | \ \ / |then what is a workstation? | \ \ / |-------------------------------------------------| /\ |/| /\ |I am not saying that there are no gods; | / \ |\| / \ |just that I haven't had the pleasure to meet one.| / \|/|/ \ |-------------------------------------------------| --------\-------- |Disclaimer: My opinions never reflect that of my | / |employer. | \ |=================================================| v |Please CC: responses via E-Mail; I seldom check | |the newsgroups for responses. | |=================================================| | mailto:vagab0nd@sd.cybernex.net | | http://ww2.sd.cybernex.net/~vagab0nd/index.html | | If you think my Sig is big... | |=================================================|

1 0

ITAR's 40 bit limit
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Sat Jul 20 19:41:41 1996 Another paradox of the US export regulations. The NSA is allowing 40 bit crypto exports. So as a hypothetical example assume that I write a crypto program that uses 40 bit RC4 to encode data (licensing from RSA). I then get an export license using the accelerated process for 40 bit RC4. I then export my program to Alice who wants to use it to transmit messages to Bob. If she uses my program to encrypt messages to Bob, any reasonably powerful attacker can decrypt her messages. However, what if she runs the program three times with three different passwords. (Ignore the problems of Inner-CBC and Outer-CBC for now.) Now the file is triple RC4 encoded with the equivalent of 80 bit security. Alice and Bob now have strong crypto. And if they run the program five times they have 120 bits of effective protection. The problem of using Inner-CBC is a little tricky, but if we assume that I can export in a DLL format, a Windows program could be written that calls the DLL repeatedly to layer it into triple or pentuple CBC RC4. The entire above discussion is entirely theoretical. I realize that it's a moot point since strong crypto is already perfectly accessible outside of the US. And that strong crypto algorithms can be exported in non-machine readable format (another paradox). (And that running 5-layer RC4 is a really inefficient block cipher.) I just wanted to point out yet another reason why ITAR regulations over crypto are not effectively preventing strong crypto. They are merely making it difficult for American business. - -- David F. Ogren | ogren(a)concentric.net | "A man without religion is like a fish PGP Key ID: 0x6458EB29 | without a bicycle" - ------------------------------|---------------------------------------- Don't know what PGP is? | Need my public key? It's available Send a message to me with the | by server or by sending me a message subject GETPGPINFO | with the subject GETPGPKEY -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMfFutuSLhCBkWOspAQFH7gf9GDjh1tcktyx3Lo4iSxDFTFoB7fuuJO0l SNlkYH1Akchl02b/CWc6CDSAZ8hxoUfoZpqTD7U0xTs1QqOM7y45r1/RvAet870s mkWL7gS5RmiiGN1bgtm844RPAtAhaE0uzT6wJsPQSfAv94CvZGNJEtF2p5lASs2F fK50gmlSbjhhHoh85s/7Ugl7XzTmRGoZzdKQCGpkc6yTJu/aKDyWU3HVSEY9F4Y3 AaHkardJehv/9xqoxks5eqnwjTSJ8+cAptT1iBo6hW+CKv89wQKK/F8RbQb2FWL2 z4GqFfQHdbxVbnspDNtIRUP5qhJuFRhmuS/ARfTYgTN50Gm5g/Cz2w== =2k+F -----END PGP SIGNATURE-----

2 1

Crypto '96 reminder -- register if you haven't!
by John Gilmore 17 Dec '03

17 Dec '03

If you haven't already registered for Crypto '96, you're late! But there's probably still time. They no longer guarantee that they will have space for you, but if they do, you'll get in. See http://www.iacr.org for details. It costs about $640 plus plane fare to attend ($420 conference registration, $220 for dorm space and meals). Plus transportation there and back. It's in a beautiful location at UC Santa Barbara, right next to the beach. The weather, food, and discussions are always good, and it's a great way to meet good cryptographers and discuss the future privacy and security of the world. If the papers look too complicated for you, relax; they're cryptic for academic bureacratic reasons. The actual presentations by their authors are quite well explained, and are often lively and entertaining. If you're doing something interesting with crypto, submit a note for the "rump session", short informal talks about work in progress, which will happen on Tuesday evening during the conference. I hope to be speaking there about my latest crypto projects. John Gilmore

1 0

Re: Netscape
by jim bell 17 Dec '03

17 Dec '03

At 03:27 PM 7/20/96 -0700, Tom Weinstein wrote: >> Do you Seriously Believe that Netscape would prefer foreigners >> to develop and use competing products? Of course not. They are >> probably secretly applauding the brave exporters. > >You are wrong. We are worried that our permission to provide these >products will be withdrawn. As far as I can tell, you need no "permission" to "provide these products", at least domestically. The only restrictions that have been implied have been over the delivery of encryption over the 'net, and even that is questionable. Jim Bell jimbell(a)pacifier.com

3 2

Re: [Noise] was Re: Giving 6 year old kids [guns]
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- After a conversation with a well-respected cypherpunk in private email, I have been convinced to reveal publicly that at age 6 [first grade] I had access to a .22 semiautomatic rifle and a 12GA shotgun, with good safety instruction and accuracy in each (though the 12GA's kick took a bit of getting-used-to). I was instructed to shoot any burglar, and I feel lucky that we never had any. The thought of taking these (or any!) guns to school _never_ entered my mind. I drove a car (on private land) when I was only a bit older. There are certain 6 year olds who are quite capable of taking proper responsibility with firearms, and there are also certain 26 year olds who probably should reconsider gun ownership. That's life. The reason I posted this non-cryptography stuff (sorry, Perry!) here is that many non-US citizens may not understand the strong "gun culture," (which is actually more a gun-safety culture, IMO) in this country. Gun-grabber-hypocrites like syndicated columnist Carl Rowan are provably the *least* safe gun owners, and the evidence also proves beyond any doubt the good old bumper-sticker saying: "Ted Kennedy's car has killed more people than my gun." [Any replies to private e-mail, please.] JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "It is long past time to end the laughable presumption that voters who can easily cope with the choices offered at Burger King are somehow 'confused' by more than two choices at the voting booth." -- me, in the Miami Herald, June 24, 1996, p. 10A. Defeat the Duopoly! Vote "NOTA," not Slick/Dull in November. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray Coming soon, the "Pennies For Perot" page. Keep billionaires off welfare! ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMfGbIm1lp8bpvW01AQG0fgP+LWV9lprYEWahaIhsyLHvMSnc6fjbpDF+ eeTac9Wb1+j78KzT8zxpmnw7I5/nuVZqJRFkZCSjKIclWf2/uzxbi+vRLwf7HWgn iIrnZgv3ozmYZUfCoYx31PbpjT0JYUTxsDvPO+TGwQYuLeYwBH865V3JAXGc7FDO KFB49zbWvnE= =GHZ8 -----END PGP SIGNATURE-----

1 0

Re: Snake Oil FAQ
by Jean-Paul Kroepfli 17 Dec '03

17 Dec '03

Very good idea, and nice implemantation of the idea. Please, let us know of the new version. Would be a minimal information about cyphering vs scrambling, secret vs public key system, useful for the newbies and not redondant with the large classical FAQ. Best regards, Jean-Paul ~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~- Jean-Paul et Micheline Kroepfli (our son: Nicolas and daughter: Celine) eMail: JeanPaul.Kroepfli(a)utopia.fnet.fr Also Compuserve and MSNetwork Phone: +33 81 55 52 59 (F) PostMail: F-25640 Breconchaux (France) or: +41 21 843 27 36 (CH) or: CP 138, CH-1337 Vallorbe Fax: +33 81 55 52 62 (Switzerland) Zephyr(r) : InterNet Communication and Commerce, Security and Cryptography consulting PGP Fingerprint : 19 FB 67 EA 20 70 53 89 AF B2 5C 7F 02 1F CA 8F "The InterNet is the most open standard since air for breathing"

1 0

RE: ABC news on Internet Telephony
by jim bell 17 Dec '03

17 Dec '03

At 12:37 AM 7/21/96 +0200, Remo Pini wrote: >>A single central office has many times the bandwidth of the widest >>part of the internet, and the average state has hundreds of CO's. >>If even a small portion of the Internets current users tried >>placing a call things would grind to a halt. A huge increase in the >>number of backbones and their bandwidth would solve this, but who >>will pay the bill? > >I guess Internet-telephony is one of the bandwidth killers. Potentially. However, there has been some mention of a new standard for voice compression that puts voice into 2400 bits per second, a factor of about 25 lower than the phone company normally uses. (They use 8,000 samples per second at 8 bits per sample, companded.) At that rate, a pair of modern, 2.4 Gb/s fibers could handle 1 million simultaneous phone calls. Since some of the newer fiber systems put 8 or more separate channels down a single fiber, that would work out to 8 million conversations. I have to conclude that we shouldn't even be close to running out of Internet capacity, _IF_ it were driven by state-of-the-art fiber and similar-speed switches. But it probably isn't. At best, Internet probably only gets a fraction of the capacity of a given fiber wherever it flows. This will have to change. >>TANSTAAFL >> >>Sometime ago the discussion was on the cost of laying new fiber, >>may I suggest the realworld heuristic of "a million dollars a >>mile." > >There are of course a lot of alternatives: In most cases, "new fiber" isn't needed, and will probably only be rarely needed on long-distance links. As I understand it, most cableways are laid with extra tubes, into which new fiber cables can be blown in (using compressed air) long after the trench is filled. The specific example I saw, there were three 2" diameter tubes in a larger tube, and according to the contractor (I asked...) only one of the tubes would be filled at that time. In addition, while he wasn't sure, he thought that at least some of the 36-fiber cable in that one tube would remain "dark," or unused until it was later needed. I don't know how expensive it is to add that extra fiber cable into an existing tube, but it would be VASTLY cheaper than the original trenching operation. Further, much of the improved transmission technology can be used on the older fibers to increase their capacity: A fiber now used to transmit a single 2.4 gigabit signal can be upgraded, simply using new channelized transmitters and receivers to increase the data rate to 8 or 16 times the previous rate. Jim Bell jimbell(a)pacifier.com

2 1

Re: Filtering out Queers is OK
by mpd＠netcom.com 17 Dec '03

17 Dec '03

David Sternlight (david(a)SternBot.com) writes: > There are many others who have come to similar conclusions > about the formation of independent judgement in children, > and lots of non-Piaget experiments. Your comments are > diversionary and in fact by the end of your post you come to > agree with my basic point. Every doctrine has its followers, and I will admit "Piaget-Speak" is still quite popular in certain circles, and its buzzwords are often heard in arguments promoting child inferiority and dismissing childrens' concerns. That hardly means I agree with your basic point, which is that parents should be able to do whatever they want in controlling their childrens' information sources without their children having any recourse against them. > That is also false in its implications. Librarians are in > loco parentis, This, of course, varies with local statutes, as does the legal definition of "In Loco Parentis." Generally it applies to teachers, people hired to care for children, and some relatives, such as grandparents. I am not familar with any locale where librarians are specifically mentioned, and most librarians will be more than happy to explain to you that a library is not a free babysitting service, and that they are not caregivers. > and most libraries are VERY careful about what materials > young children are exposed to and what is more, are > responsive to community pressure in the matter since most > libraries are community-based. Most libraries let "young adults" (read anyone who has hit their teenage years) read pretty much anything they want. "Parents on the warpath" have managed to apply pressure in recent years, and libraries are a bit less free than they used to be, but I think the American Library Association has done a pretty good job in standing its ground against agitators and pressure groups. > So after trying to refute my point, you come to agree with > it and want to shift the issue to the question of at what > age.... No - I stated in my original message that young children do need some reasonable constraints to guard them from exposure to material which might cause them emotional pain. This is far different from your assertion that minors (everyone under 18) should have no access to any information that their parents do not pre-approve. > I'm not competent to assess that nor, I assert, are you; I > suggest it varies with the child and it's up to the > individual parent to make those subtle distinctions, issue > by issue, child by child. Nothing subtle about it David. Once young people have passed through early childhood, the burden of proof is on anyone who suggests that they should be insulated from social and political reality to provide a convincing reason why. Parental capriciousness doesn't qualify. > As I parse the above sentence it says limiting is often > justified but it might not be. Parse the sentence again. What it says is that although "protecting children" is often the excuse used to limit older childrens' access to controversial material, the reality is that it is usually an effort to control their thinking on certain issues by making sure they have only one viewpoint, that of their parents. > If so, it's up to the parents to figure ou where THEIR kid > is on the scale--nobody else has as much time, motivation, > or opportunity to observe. As is usual with Statists, the argument is seen as a debate over who should be doing the controlling, the notion that everyone needs to be controlled being a foregone conclusion. Perhaps it's time to take Perry's pledge. :) -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

4 5

Re: pledge status
by Chris Adams 17 Dec '03

17 Dec '03

On 20 Jul 96 23:12:20 -0800, alanh(a)infi.net wrote: >One recalls the Russian novelist (can't think of his name, the one who >wrote _Day in the Life of Ivan Denisovitch_), who stated that if even 1% Solzhenitsyn? (Spelling may be wrong) Very good, BTW. >of all of the Cheka/KGB's arrest-in-the-middle-of-the-night victims had >put up some resistance, and maybe have killed a Chekist before being >gunned down..... the whole damn system of Stalinist terror would have >unraveled, from the lack of police willingness to die for the greater >glory of Mr Stalin. >I think this has > relevance to the >black-ninjas-pretending-that-they're-in-a-Hollywood-script thread about >cops making unanounced search warrant services at 4am. > >I have tremendous admiration for my local LEO's. It's the federales that >are the problem, usually. I'm thinking of Waco, where, I've heard, more experienced SWAT-types tried to talk their bosses out of a certain infamous mistake... // Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! // Automatically receive my resume or PGPKEY by sending email with a subject // of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful!

1 0

Re: Netscape
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:24 PM 7/19/96 -0700, Rich Graves <llurch(a)networking.stanford.edu> wrote: >On Fri, 19 Jul 1996, Anonymous wrote: >[on hacktic] >> netscape-fts2-hp10.tar.gz Fast Track Server 2.0 for HPUX10 >> netscape-fts2-nt.exe Fast Track Server 2.0 for WinNT >> netscape-hpus-30b5.tar.gz Navigator 3.0b5 for HP-UX >> netscape-linux-30b5.tar.gz Navigator 3.0b5 for Linux >> netscape-ssl30-src.tar.gz SSL 3.0 source code >> netscape32us-30b5.exe Navigator 3.0b5 for Win95/NT > >And thus it begins... I think it's a bad idea to provoke the TLAs like this, >but I suppose it's inevitable. (But doesn't anyone use Macs or Suns?) Appears that they don't use Windows 3.1 16-bit versions either. BTW, the executable is _huge_ - over 3MB, and that doesn't seem to include all the plugins from previous versions. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

Re: Netscape
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:10 PM 7/20/96 -0400, "Mark M." <markm(a)voicenet.com> wrote: >On Sat, 20 Jul 1996, Tom Weinstein wrote: >> Why not consider what the consequences will be? Do you seriously >> believe that this will make the government stop enforcing ITAR? > >The government has yet to enforce ITAR. The only thing they have been doing >is threatening companies who make products with strong crypto. If anyone was >ever actually put on trial for a violation of ITAR, it would almost certainly >be found to be unconstitutional. First of all, the goverrnment _has_ enforced ITAR; I've seen references (ummm, on the net...) to a few cases of things like exporting TV decryptors, as well as all the enforcement about illegal trafficking in guns and such. But second, if you're threatened with jail and large fines, and have to pay your lawyers lots of money to avoid being railroaded, that's enforcement even if it's not the full-scale due process type. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

1 0

Re: ITAR's 40 bit limit
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:45 PM 7/20/96 -0400, "David F. Ogren" <ogren(a)cris.com> wrote: >Another paradox of the US export regulations. >The NSA is allowing 40 bit crypto exports. So as a hypothetical example >assume that I write a crypto program that uses 40 bit RC4 to encode data >(licensing from RSA). I then get an export license using the accelerated >process for 40 bit RC4. ....... >However, what if she runs the program three times with three different >passwords. (Ignore the problems of Inner-CBC and Outer-CBC for now.) Now >the file is triple RC4 encoded with the equivalent of 80 bit security. Not always possible. The rule isn't just "40 bit crypto" it's "permission, which you won't get with over 40 bits unless you're very cooperative." Applications like Netscape's SSL don't give you the ability to feed your data through it three times; they process your stream of data and send it. Also, some 40-bit systems put known plaintext at the beginning of their output (e.g. a magic number saying that this file is in FooBar40 format) which means that even if you quintuply encrypt them, you still only have several layers of 40-bit encryption that you can peel one at a time. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

2 1

Re: Game Theory and its Relevance to Cypherpunks
by Arun Mehta 17 Dec '03

17 Dec '03

At 21:57 20/07/96 -0700, Timothy C. May wrote: > >Fortunately, the goal of MAD was to >not have to be used, and it appears now to have worked quite well (albeit >at high cost). My problem with applying game theory to complex situations like the competition between powerful nations is that it is too simplistic. IANAE, of course, though I have done some control theory, and know how complex the modelling of any system becomes if it contains non-linearities, delays, etc. In a closed-loop system, i.e. with feedback, trying to predict behaviour without the foggiest notion of how to quantify the impact of Kennedy's grandstanding on the Kruschev mind (for instance) is questionable. To suggest that MAD worked well on the basis of the limited tryout we gave it has little validity. If it hadn't, we wouldn't be here, would we? We are trying to draw general conclusions based on a biased sample of one. Reminds me of this committee of the British Royal Air Force, trying to find ways to protect its planes better against German anti-aircraft guns. Someone proposed putting an extra layer of armour on those areas that received the most shelling, and most people seemed to like the idea. One upstart suggested the exact opposite: putting extra armour on those areas which had received the least shelling. "Remember," he said, "we can only examine the planes that came back." I also have a problem with the cost you mention. What is "winning" in the context of nations? The arms race wiped out the Soviet Union, and arguably seriously hampered the competitiveness of American industry (which was No.1 at the end of the war), allowing countries like Japan and Germany, with far smaller defence budgets, to overtake industrially. >Useful sources: Thank you for the tips: I will check them out. Game theory is fascinating -- I'm just not sure how applicable it is in formulating policy. Didn't work too well in Vietnam... Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://www.cerfnet.com/~amehta/ finger amehta(a)cerfnet.com for public key

2 1