December 2003 - cypherpunks-legacy

Re: USPS
by Peter Trei 17 Dec '03

17 Dec '03

> At 5:14 PM 8/22/96, Bruce M. wrote: > > >Web Week, July 8, 1996, p3 > > > The Postal Service's attorneys have told the USPS that the tampering > >part of the current federal law would transfer to the electronic space, > >and that the mail fraud portion might also apply... > > > > "We're a trusted third party," Saunders said. "We don't have any > >interest in learning your trade secrets... Back in June I attended a presentation on this from Paul Raines, who is running the program. As I recall, there were three services they were planning to offer. 1. A time-stamping service. This is basically a remailer - you would send email to the USPS site, which would add a digital timestamp and signature, then forward the message to it's ultimate recipient. Customers wishing to use the service would deposit a sum of money with the USPS, which would be debited for each use of the service (suggested cost was on the order of 25 cents/message) 2. A CA service. Keys would be signed at various levels of assurance. At least at the start, business strength keys would be issued only at Postal Business centers, which are in about 100 cities in the US. 3. An archival service. For a fee, the USPS would store copies of all of the email you send though it's remailer. Only the sender could retrieve it, short of a court order. In answer to a direct question, Raines said that user-encrypted data was OK. Raines claimed the following advantages: * The contents would be subject to the postal fraud statutes. * People would trust a message received through the remailer more than one which was not. * IRS tax filings sent through the Postal system can arrive after April 15, provided they are postmarked before that time. Tax filings sent by other methods must be received at the IRS before midnight on the 15th. * Approximate quote: "When business negotiate a deal, they do it over the phone, in person, etc. But when the deal is closed, what do they do? They write a letter, and send it via registered mail through the USPS." * As a CA, the USPS was a known and trusted entity overseas, unlike commercial CA services. Some specific counter arguments: Fraud protection: If a person was intending to commit fraud, why would he or she send the message through the USPS remailer? Since the service is costly, most email will never be sent through it, and there will not develop a tendency to regard non-USPS email as untrustworthy. IRS filings: If I send a tax filing to the USPS remailer at 23:45 on April 15th, it gets a pre-midnight timestamp and is accepted by the IRS as being on time. If I send an email tax filing directly to the IRS at 23:45, it is also accepted (and if I was that desparate, I could also bounce the message through Hawaii, or US Samoa, and get several more hours of grace) Also, I was under the impression that the IRS now accepted FedEx timestamps for tax filings. Finally, the amount of business which this represents is miniscule. Closing deals: Ever hear of faxes or FedEx? My personal impression was that Raines had been listening to his own propaganda for too long, and was rather out of touch with the way things are done outside of the Beltway. I got the feeling that the USPS was desperately trying to find a role in a time where it was becoming merely the cheapest and slowest player in the package delivery business. Peter Trei ptrei(a)acm.org [Disclaimer: I am not representing my employer.]

4 4

(fwd) ANNOUNCE: Free Little PGP Credit Card App
by frogfarm＠yakko.cs.wmich.edu 17 Dec '03

17 Dec '03

>From: "David j. Sopuch" <djs(a)iwinpak.com> Newsgroups: comp.infosystems.www.misc Subject: ANNOUNCE: Free Little PGP Credit Card App Date: Thu, 22 Aug 1996 12:00:24 -0400 Organization: Datamax Research corp. Lines: 10 Message-ID: <321C8418.2647(a)iwinpak.com> v2.08 of the iWinpak Internet Payment System is now available in both freeware and shareware versions at http://www.iwinpak.com Dave -- http://www.iwinpak.com Try the iWinpak Internet Payment System - the Free little PGP Credit Card app *** PageCommerce (tm) - the $99 No Server PGP Commerce Solution *** -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information EmmaGoldmanCamillePagliaMarieCurieAynRandSapphoDianaToriAmosPJHarvey&Demona Living in dread with your fragile brain and the executioner's got your number I feel a groove comin' on -:- Freedom...yeah, right.

1 0

Re: USPS
by Ross Wright 17 Dec '03

17 Dec '03

On Or About 22 Aug 96, 8:37, Timothy C. May wrote: > (Though I made up this last part, it represents reality. Postal > inspectors frequently collaborate with various national and > international authorities on matters involving pornography, fraud, > pyramid schemes, and the sending of various sorts of contraband. > While FedEx, UPS, Airborne, etc., may occasionally cooperate when a I'm afraid that Fed-X would drop their drawers if presented with a federal warrant. I guess you could call that co-operation. > crime is called to their attention, I know of no cases where Federal > Express, for example, has become a willing and leading partner in > setting up stings. No, I don't think they would do something like that. The Post Office IS just like an arm of the federal government, even though you would need a federal warrant in order to search packages. > > "Postal anarchy" is already the accepted norm for e-mail. > > --Tim May > Can I quote you on that? Ross =========== Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

Cypherpunks the video
by steven ryan 17 Dec '03

17 Dec '03

There was talk earlier about someone putting together a Cypherpunks video. What ever came of that? I now have access to an Avid nonlinear digital editor and would be interested in pursueing this. Steven ------------------------------------ Steven Ryan - Reading Access - sryan(a)reading.com PGP Fingerprint: E8 A2 C5 A2 7A C4 77 93 0A 1B 1D C6 B9 2F 36 9B Finger me for my PGP public key

2 1

Re: Spamming (Good or Bad?)
by Ross Wright 17 Dec '03

17 Dec '03

On Or About 22 Aug 96, 18:27, Paul S. Penrod wrote: On Wed, 21 Aug 1996, Jim Gillogly wrote: > "Paul S. Penrod" <furballs(a)netcom.com> writes: > > find them using one of the search engines. Market droids (get > > over it, dude) are >> > Nothing to get over. That's Ross who has the problem with the term. I'm over it. Hell, I can't even remember which side of this issue I'm on. ;-) Oh, yeah... I'm a sales-droid, looking for customers like a shark... Never stop moving..... Feed on the weak.... Yeah, that's where I'm at, yeah... Anyway, the consensus is that what I'm doing (that I thought WAS spam) is about as harmless as a cold call, so I'm personally vindicated. I like this next part: > The issue is convenience, not technology. The majority of US > consumers couldn't give a rat's ass about the Internet or the Web. > They want their product or service and they want it now. When the > Web becomes more convenient to use than the telephone, then you will > see nirvana for Cybershopping. Right now that isn't happening. I'm doing O.K., but I've go a product everyone still needs... And the consumers I want have been on the Internet for a long, long time. So all you geeky programmers (I mean that in the nicest way) buy your stuff from ME!!!! Hey!!! Was that SPAM!!!! HEY!!!!! Ross (Sales Droid) Wright =========== Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

Racists Speak Up For Crypto
by qut＠netcom.com 17 Dec '03

17 Dec '03

Date: Thu, 22 Aug 1996 15:28:48 -0700 From: ezundel(a)cts.com (E. Zndel) Good Morning from the Zundelsite: I have a sweet friend in Santa Barbara, California who grew up with me in the rain forests of South America. Elvira and I share many things, including an "encryption language" of sorts. We used it with relish as teenagers when the Mennonite Elders were spying on us, trying to ferret out secrets. The key was really very simple, but our "government" just never managed to catch on. It used to drive them wild. Yet it was so ridiculously simple - ". . . repeat a vowel with a 'b'". Prebesibidebent Clibintobon? Kapish? Just practice it a bit - no one will understands it! It is hilarious. It gave us a tremendous edge on wickedness - mostly romantic wickedness but now and then legitimate revolt against authority peddling a dogma we didn't always like. This story often comes to mind as I peruse the arguments regarding censorship, particularly as I was reading a recent Phyllis Schlafly's essay on "Clinton Is Trying to be Big Brother": ". . . We hope the appropriate government agencies will soon solve the recent terrorist crimes and punish the criminals. But all Americans who care about civil liberties should vigorously resist President Clinton's attempt to use the terrorist attacks as an excuse to carry on his all-out war against the personal privacy of law-abiding Americans. Now the Clinton Administration is trying to make it illegal for individual Americans to have private conversations with one another. That's the real meaning of its effort to control encryption technology, and it's a direct assault on the First Amendment. It would be downright ridiculous to assert that the First Amendment guarantees our right to speak in public but not in private. It would be just as ridiculous to say that we have freedom to speak in words that the government can understand, but not in words the government can't decipher. Americans have the right to speak to one another in private, behind closed doors, and we should likewise have the right to speak to one another in code and to put our coded messages on computer in a process called encryption. Americans would not tolerate the government opening and reading the letters we send through the mails, and we should not tolerate the government opening and reading our encrypted, or coded, messages sent via computer. Yet, Attorney General Janet Reno, FBI Director Louis Freeh, and Vice President Al Gore are all demanding the authority to read our encrypted messages. In a speech to the Commonwealth Club of California, Reno bluntly stated her demand for "ensuring law enforcement access to encrypted data.'' Reno boasted that there is "a consensus'' that the government should create a system known as "Key Escrow'' (i.e., a supposedly "neutral third party''), to which all Americans should be forced to "entrust'' the keys to their encrypted messages, and to which the government would have access. On the contrary, there is no such consensus. Do you trust Janet Reno with access to your private messages? Do you trust the FBI to keep your files confidential? On July 12, Al Gore announced that the Administration will continue to push for the adoption of a massive public key infrastructure to give the government access to all encrypted communications. In a blatant bid for a police-state surveillance society, Gore warned about "the dangers of unregulated encryption technology." A neutral panel of the National Research Council was set up to make policy recommendations about encryption. The panel called on the government to abandon its efforts to restrict encryption. The NSC panel concluded that increased use of encryption would enhance our national security, not diminish it. Thirteen out of its 16 members had security clearances with access to secret information, and they saw no national security reason to justify the Clinton policy. The Clinton Administration bases its campaign to control private encryption on the alleged need to fight crime through wiretapping. However, the NSC panel concluded that the ability of the private sector to transfer confidential financial and other data over the information highway without interception is far more important. Encryption is a First Amendment issue, not a crime issue. If the Clinton Administration is allowed to control encryption, it would be the biggest expansion of federal power since the passage of the Income Tax Amendment in 1913 . . ." And come to think of it, still after all these years: the Elders had no business whatsoever spying on some teenagers. They made the laws, and they enforced the laws, and it was pretty much authoritarian business, but even as young teenagers we knew that what they did was Trespass! They had their reasons - but we had ours! It was called privacy. Nebeveber lebet aba foobool kibiss youbou obor aba kibiss foobool youbou! Advice to the wise in these perilous times. Ingrid Thought for the Day: "All the fun's in how you say a thing." (Robert Frost)

2 1

Re: Husband/Wife jailed for saying Clinton Sucks
by jim bell 17 Dec '03

17 Dec '03

At 02:26 PM 8/22/96 -0400, pjb(a)ny.ubs.com wrote: >perhaps we should all add a line to our sigs to the effect that we hope >he dies, and soon, natural causes, of course. Hmmm, what exactly does >'natural death' include? > -paul A friend of mine who's an occasional hunter, and I were watching one of those nature-shows, and as I recall they showed a deer escaping from some sort of predator. The show's voice-over said that with the coming winter, the deer escaped "and would die a natural death." My friend indignantly pointed out that in NATURE, getting eaten by a predator IS A NATURAL DEATH! In a sense, for example, being in an airplane crash is "a natural death," because gravity is entirely natural! Jim Bell jimbell(a)pacifier.com

1 0

Antiautomobile devices
by Marc Barnett 17 Dec '03

17 Dec '03

This was recently posted to ba.motorcycle (WHY, I dunno), and since there has already been the topic regarding EMP disabling of cars.... From: keethie(a)iguanabbs.com (Keith P. Keber) Subject: Wussy EMP Devices... Date: 21 Aug 1996 14:27:14 GMT So, LEOs in the US of A will disable fleeing autos with electricity, eh? They ought to get a clue from those icons of enforcement in Finland. Finnish police agencies have been beta-testing a new device that fits on the front of their police cars. It's a harpoon. That's right, a harpoon. During a high-speed chase, the cops ram the sharpened, front-mounted device through the body, into the trunk of the car they are chasing. Barbs spring out, preventing dislodgement. The police car then uses its own brakes to bring both cars to a halt. The kicker is that the harpoon is really a giant hypodermic needle; tear gas can be injected through it into the vehicle ahead. (I can just hear some lawn order types now: "Whoa! Cool, man!") This story comes from the 8/20/96 broadcast of Public Radio International's program, "The World", which claimed the device was being demonstrated at some airport in Finland. They didn't say what would happen if the suspects decided to lock up their brakes just as the pursuing vehicle rammed them, but they *did* advise listeners to obey all speed limits while visiting the country....:-) ---------------- This is why I like my new bike... -- Marc I'M A FREAK, TOUCH ME marc(a)mtjeff.com A mind is a wonderful thing to taste

1 0

128 bit MS Internet Explorer
by bart＠netcom.com 17 Dec '03

17 Dec '03

MS got their site, www.microsoft.com, straightened out. I was able to download with about the same form filling as required for Netscape 3.0. b

1 0

Re: Cypherpunks the movie
by nobody＠replay.com 17 Dec '03

17 Dec '03

why stop at a video why not a musical.... "Cypherpunk The Musical" Broadway here we come... Featuring Songs: "PGP why is it so hard to break" "We write code" "Why were we called shitopunks?"

1 0

Re: Husband/Wife jailed for saying Clinton Sucks
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

true, then there are those who are brain dead, and continue to participate, notice that i did not say serve, in public office for years. -paul > From zachb(a)netcom.com Thu Aug 22 19:18:40 1996 > Date: Thu, 22 Aug 1996 16:18:23 -0700 (PDT) > From: "Z.B." <zachb(a)netcom.com> > Subject: Re: Husband/Wife jailed for saying Clinton Sucks > To: pjb(a)ny.ubs.com > Cc: cypherpunks(a)toad.com > Mime-Version: 1.0 > Content-Type> : > TEXT/PLAIN> ; > charset=US-ASCII> > Content-Length: 487 > > On Thu, 22 Aug 1996 pjb(a)ny.ubs.com wrote: > > > perhaps we should all add a line to our sigs to the effect that we hope > > he dies, and soon, natural causes, of course. Hmmm, what exactly does > > 'natural death' include? > > > > -paul > > When I read this, a quote from a certain famous sci-fi writer came to mind: > "All forms of death are ultimately due to heart failure." > > > --- > > Zach Babayco > > zachb(a)netcom.com <----- finger for PGP public key > http://www.geocities.com/SiliconValley/Park/4127 > > >

1 0

Re: U.S. Army Private Faces Spying Charges
by Peter Trei 17 Dec '03

17 Dec '03

> > Thomas C. Allard wrote: > > > > His father said an Army major at Fort Bragg, whom he declined to name, > > had urged him to persuade his son to sign a confession, so prosecutors > > would not seek the death penalty. > > Isn't plea bargaining wonderful? > > Gary Iff this guy is guilty (and I have no particular reason to doubt it), I was still under the impression that treason carried the death penalty only in wartime. Peter Trei trei(a)process.com

2 1

Middleman has a new name!
by John A. Perry 17 Dec '03

17 Dec '03

It has been brought to my attention that the name "middleman" is too long for the DOS-based remailer programs. In lieu of this I'm changing the listed name middleman(a)jpunix.com to middle(a)jpunix.com. The change will be effective for both the type-I and type-II remailers. I will also make this change to the type2.list/pubring.mix files shortly. The remailers will continue to also answer to middleman(a)jpunix.com. John Perry - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers.

1 0

ctcp.0.9
by Damien Lucifer 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This is a program i found on unimi that offers secure socket connections, utilitizing a simple server/client. It can be installed without root priveledges and uses d/h for key transfers. Anyone looked this package over, and if so what is your oppinion about it? Included below is the THEORY file that describes the key exchange: The encryption negotiation is performed using a protocol similar to FTP/SMTP/NNTP. The client sends commands to the server and the server returns a four-digit response code. Unless stated otherwise, all numbers in this document are hexadecimal with the most significant byte first. When a connection is initiated, the server should send a 2000 response indicating that it is ready to accept commands. Commands: DH3DES - Diffie-Hellman Key exchange followed by Triple-DES encryption If supported, 3001 is returned. The following commands are then expected: MOD - If an argument is supplied, it is the number, in hexadecimal, to use as the modulus. Responses: 2210 - okay 4031 - invalid number 4032 - too small 4033 - too large If no argument is given, the server should supply the modulus, sending 2211 followed by the modulus. If the server is unable to supply a modulus, 4034 should be returned. GEN - this should follow MOD. The generator to use. The format is the same as that of the MOD command. The response codes are 2210, 2211, 4031 or 4034 EXCH - Key exchange Client sends exch followed by gen raised to hir secret exponent. Server sends 4030 if a gen/mod has not been agreed upon. otherwise 2212 followed by gen raised to its exponent ENCR - Begin encrypted Session 4020 - No key selected for encryption 2300 - Encrypted session begin LPORT xxxx - this command takes a 16-bit hexadecimal port number argument, and connects to the specified TCP port on the local host. Responses: 2400 - connected 4010 - Unable to connect 4011 - Access denied RPORT xxxxxxxxxxxx - Connect to remote port The argument to this command is a 48-bit hexadecimal number representing the IP address and port number to connect to. The response should be first 2500, then when the connection has been attempted: 2400 - connected 4010 - Unable to connect 4011 - Access denied QUIT - quit Response: 2100 - Goodbye Summary of error codes: 1xxx - informational messages 10xx - server is supplying additional information that the client may ignore. 11xx - server is responding to a client's request for information 2xxx - okay 20xx - Server is ready 21xx - Disconnect, goodbye 22xx - Command okay 23xx - Encrypted session begins now 24xx - Session with another service begins now 25xx - Command ok, operation in progress, please wait 3xxx - ok so far, send the rest 4xxx - command was okay but could not be processed 5xxx - command not understood or not implemented Triple-DES The triple DES encryption uses output feedback exclusive-ored with a non-sequential counter. There are three counters, each of which is exclusive-ored with the data block before encryption with the corresponding key. The counters are incremented in each round by a shared, secret value which is part of the total key. The result of each round of encryption is exclusive-ored with the data stream. I0 ------ ----- | | | I1 ----- | ---A1------- | ---> \ | | \ | --XOR | --XOR | | | E1 | E1 | | | I2 ----- | ---A2------- | ---> \ | | \ | --XOR | --XOR | | | E2 | E2 | | | I3 ----- | ---A3------- | ---> \ | | \ | --XOR | --XOR | | | E3-------^ E3-------^ | | v v XOR with data stream I0 - Initialization Vector I1 - Initialization of counter 1 I2 - Initialization of counter 2 I3 - Initialization of counter 3 E1 - Encryption with Key 1 E2 - Encryption with Key 2 E3 - Encryption with Key 3 A1 - Add increment value 1 A2 - Add increment value 2 A3 - Add increment value 3 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMh219rGlo8DEMb2JAQEzWgP/VpcWiL8+UN+7l7wCtUr6N5Bk4iqG5fYq Jb9ImvVA3h2k8cGz/ETBQW/3H9GA9jCsqzLrgcUewAa8CgdmhPoVE04e2scAxp4l y2peJlQmakCl2RCKHJZPTTaOLnsBU4NCZxwW8Q4xeUb0KBYfiW9XeULleyhhfsO2 n7XYpc4XhaY= =vGhK -----END PGP SIGNATURE-----

2 1

IE Security Flaw
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Markoff reports today on the MS IE security flaw discovered by the Princeton team and posted here recently. See: http://www.nytimes.com/yr/mo/day/news/financial/web-browser-flaw.html

1 0

Re: Lesson 2 in cracking (cryptoanalysis 001)
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-08-21 20:43:50 EDT, you write: >The point is that if you took two novels by the same author and >completely sorted them alphabetically they'd be almost the same. The examples cited did this by word, not by message as your stating. >So a block of PGP encrypted ascii-armored (i.e. 8=>7-bit encoding) >wouldn't affect the frequency counts? Tell me, how long have you been on >your current medications? I was talking about the algorithm as given, not PGP. > That's the point!! IT'S A JOKE!!! You know, "hahaha - very funny"? Not a > serious proposal? I know! But at least it is relevent to the group! How many points of attack have you seen on here? How many techniques have shown up here? P.S. My apologies to the fella I called a troll. It was uncalled for - lacking in social skills.

1 0

Re: Spamming (Good or Bad?)
by James C. Sewell 17 Dec '03

17 Dec '03

At 03:35 AM 8/23/96 +0000, Vipul Ved Prakash wrote: > >This is peculiar. Nobody seems to mind ads in Newspapers, printed >magazines, TV, and for that matter web sites. That is unwanted stuff I'd suggest that most/all of us 'mind' ads in papers, tv, etc. The difference is that while we can do nothing about commercials on TV (short of breaking federal law and jamming the signal) we can do something about spam. If there is enough concensus we can develop/distribute/encourage the use of new mailers that will help defeat spam. For example: If mail comes into a server that has more than 25 recipients then it is only forwarded to those who have "signed up" for that sender. When we subscribe to Cypherpunks we also have to register that with our network of mail servers. Then if Mr. Spam sends stuff out it's not been "signed up" for so it gets trashed. I don't really like mail servers redirecting my mail, but perhaps we could arrive at a reasonable criteria for filtering if we tried real hard. Jim Jim Sewell - jims(a)tansoft.com Tantalus Incorporated - Key West, FL

2 1

Verdict in "MTV" Case
by tcmay＠got.net 17 Dec '03

17 Dec '03

Indiannapolis, IN (A.P.) -- A jury has awarded the State of Indiana $25 million in damages in the case of "Indiana v. Music Television." Music Television, also known as MTV, was accused of costing the state of Indiana more than $100 million in additional educational expenses due to students watching MTV when they should have been doing their homework. The jury foreman in the case was quoted as saying, "Like, like the kids are, like, goofin' off. Besides, MTV doesn't like play enough old stuff, like Zeppelin and Floyd." Following the various court decisions to award damages to states for medical costs associated with smoking by state residents, a barrage of similar lawsuits is happening across the country. School systems are suing book publishers, movie makers, television broadcasters, shopping malls, and miniature golf arcades. Makers of sports equipment are facing crippling lawsuits by insurers. The last remaining American bicycle maker, Trek, announced that it is withdrawing from the U.S. market, following the $37 million judgement against it in "Oregon v. Trek." --Klaus! von Future Prime

2 1

BOD_ies
by jya＠pipeline.com 17 Dec '03

17 Dec '03

8-23-96. FiTi: "The race is on for global groups to develop 'electronic purses' using smart cards." "We are moving into the electronic age where money will just be information about the wealth you have," says Visa. Some companies believe that parts of the body, rather than paper or coins, can be used to establish the amount of money somebody has available to spend. WaPo: "Group Plans Challenge To Net Address Monopoly." The end may be at hand for the virtual monopoly that Network Solutions holds over the registration of Internet addresses. The Internet Assigned Numbers Authority, the Internet Society and IETF will organize a competition for the right to operate new registries. The group's aim is to create alternatives to the established categories of Internet addresses. NYP: "Flaw Said to Be Found in Microsoft's Browser." Markoff's report on the Princeton group's discovery. ----- http://jya.com/bodies.txt (17 kb for 3) BOD_ies

1 0

"Regulation of Commerce" and the Crypto Issue
by tcmay＠got.net 17 Dec '03

17 Dec '03

It seems to me that in recent years nearly any type of sweeping legislation is justifed, constitutionally, by the clause in the U.S. Constitution which says Congress shall have the power to regulate commerce. (More precisely, the clause says: "To regulate commerce with foreign nations, and among the several states, and with the Indian tribes;" This is usually interpreted to mean _interstate_ commerce, and not sales/commerce/etc. that do not centrally involved more than one state....obviously nearly all things sold in one state are sold in other states, so there is lattitude for applying the commerce clause, albeit wrongly.) Today's news is the sweeping new restrictions on tobacco and cigarettes, including restriction on advertising and even on the placement of tobacco and cigarette logos and names on sports jerseys and shirts. (The much-publicized press event is not for another hour, as I write, so I don't know all the details. I'll be watching.) Note that similar restrictions on alchohol advertising were recently struck down by the Supreme Court as being unconstitutional infringements on free speech. Many expect the same outcome with these latest proposed restrictions. (The issue of advertisements of hard liquor, cigarettes, condoms, and other "unhealthful" [sic] products on television and radio is of course complicated by the role of the Federal Communications Commission and by "gentlemen's agreements" not to carry advertisements for some products.) Personally, I have never smoked, nor chewed, nor mainlined nicotine. Personally, I dislike cigarette smoke. But this is all _personally_. If a restaurant, bookstore, airline, bar, antique store, gym, or whatever wishes to allow smoking (or not), this is there choice. As many of us see things, it is not for the government to take a kind of "poll" of what people like and dislike and then to impose rules on property owners as to what smoking or nonsmoking policies they may set. Likewise, if I want to silk-screen a "Joe Camel" image, or a "Bud Frogs" image, on a t-shirt, this is between me and the putative owner of these images. Free speech and all. Or, to remove any confusion with the issue of owned logos, to silk-screen a fictitious cigarette brand on a shirt and then wear it, or sell it. It seems likely that individual wearers of such shirts will not be busted (think of how many already exist, and there is no plan for confiscating them), but that the burden will be placed, as it is so often conveniently placed, on the shirt makers. The catch-all for these laws seems to be the "regulate commerce" language in the Constitution. Cigarettes are sold in multiple states, the logic goes, so the commerce clause gives the government the power/authority to regulate it. (Well, Steven King novels are sold in all 50 states, too. Does this "regulate commerce" clause give the government the power/authority to regulate what King puts in his novels? Or to ban advertising for Steven King novels? Or to require that stores only sell such novels to adults?) This language is already being cited for some as a justification for regulating encryption (hey, some businesses use it!), digital signatures (ditto), and other forms of crypto. In fact, since nearly everything involves "commerce" in some way, whether interstate or not, the "regulate commerce" clause can presumably be used as a jusitification for interfering in all sorts of areas. The several legal experts out there on this list can clarify any errors of interpretation I have made. I certainly know that the commerce clause cannot be used to suppress certain kinds of speech, though the boundaries of where it may be applied seem unclear. I do expect it to be used for crypto, though, and this might even be upheld by the Supremes, especially in any areas directly involving "digital commerce." We should watch for this, and think about ways to deflect or derail such interpretations. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

The Future Of Cyber Terrorism
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

The Future Of Cyber Terrorism The proceedings or a recent conference on the subject of Cyber Terrorism are now available online. The conference looked at terrorism carried out with the tools of today's information age and against the computer and information systems that the world increasingly depends upon. World Wide Web: http://www.acsp.uic.edu/OICJ/CONFS/terror02.htm _______________________ Regards, I hate quotations. -Ralph Waldo Emerson Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

secret message
by JOHN E. HOLT 17 Dec '03

17 Dec '03

Date: 01-Aug-96 14:50 EDT From: JOHN E. HOLT [76473,1732] Subj: puzzle ^%}{{ ZZ VVPAGMIGJEKMCCHIAKKPEHJDDDLOABGAMMJOCDFNOLNOKKKNIADPBGPPOEPIDCEMPGWW VVFCMOPKLKPJOHCNCJBDGOOJKFANCJJBDBMDIFIEKEDPLKDDGMPLHMIIPIJFMKOLENWW VVCAKJGJCKPAEOOMLJPNFJEKEINIHFKHNOLPCAHLEKHHLMHJFCOEKAFAGPHJBCPBHBWW VVOKLAENICAFDHEOEODMHMFGIONMAACAOHEOHDAJDNENGAHABNHGOCCPJNFDMAMKADWW VVMGDHKGPKBEIDBNLOCMLFMEIOKBFBFKJIMIIIFKJDFENCBPAPFBAOFMHEDODBFFPDWW VVOMFFJBNGEJPLGHJLFOBLFOGCBKAACEICLBIKHGILKCLMHPFIAHPDEOOODPPMLGDNWW VVGLDNEBDINMILDJDOJOJNKCLIBBKBCBEJPBJCFHGKMFLLEPGLGOOIIGAKJEGNPFHDWW VVIJBMFLALHPEHHGEGPCLGILBDBMEGMOGOIFBPPONGEDJPNFNMPCJFJPAEMIDOEMBLWW ZZ ZZ Distribution: To: ME > [76473,1732]

1 0

Re: (fwd) ANNOUNCE: Free Little PGP Credit Card App
by Alan Olsen 17 Dec '03

17 Dec '03

At 07:54 PM 8/22/96 -0400, Damaged Justice wrote: >>From: "David j. Sopuch" <djs(a)iwinpak.com> >Newsgroups: comp.infosystems.www.misc >Subject: ANNOUNCE: Free Little PGP Credit Card App >Date: Thu, 22 Aug 1996 12:00:24 -0400 >Organization: Datamax Research corp. >Lines: 10 >Message-ID: <321C8418.2647(a)iwinpak.com> > >v2.08 of the iWinpak Internet Payment System is now available in >both freeware and shareware versions at http://www.iwinpak.com An interesting little piece of CGI code, but the demo leaves a bit to be desired. The demo is for bank checks. The order form has you sending your bank information (including bank number and check info) in the clear. So the hooks into your credit card are not sent in the clear, but the ones to your bank are... Double plus ungood. It is a start... How good of one, I am not certain though... --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

strengthening remailer protocols
by peter.allan＠aeat.co.uk 17 Dec '03

17 Dec '03

This is long enough. I've been brutal and cut sections less likely to promote discussion. (I've also contacted OUP about Ganley's book, and may buy it if I can kid myself I don't need the money.) ============================================================ August 1996 Peter M Allan peter.allan(a)aeat.co.uk Strengthening Remailer Protocols STATUS OF THIS MEMO This memo proposes improvements for the Mixmaster protocol and requests discussion and further suggestions. Distribution of this memo is unlimited. INTRODUCTION Lance Cottrell's documents [1] and [2] describe the current Mixmaster protocol and attacks against it. This memo began as a response to those thoughts, but has developed in discussion with Cottrell. SPAMMING ATTACK [2] describes an active attack where many messages are sent to an honest remailer to separate a message of interest from other traffic. The aim is to clear other messages out of the message pool, wait for the target and finally eject that from the pool. The target message is identified because the attacker can recognise his own messages. Attempts to defeat this attack could well be based on preventing the attacker from recognising his own messages. That is the approach taken here. RE-ENCRYPTION AS A SPAM DEFENCE In this diagram remailer 'A' has received a message addressed to himself. Inside that is one to 'B' - unreadable to A. Further layers are hidden of course. AB????? decrypts to B????? This means that our remailer can only disguise the message by re-encrypting it on the outside. But the message has got to make some net progress toward delivery. The trick is that a remailer can find the outer two headers addressed to him and process both of them. Two headers processed and one rewound is net progress. When the header rewound is addressed to the same recipient as was next on the list anyway the diagram looks like this. Actions at 'A': AB????? decrypts to B????? B????? encrypts to BB????? Actions at 'B': BB????? decrypts to B????? decrypts to C???? encrypts to CC???? The beauty of this is that it is compatible with the existing protocol. If a remailer only knows about removing layers of encryption it still fits into a network where some can do both actions. Whether it sends or receives the message it still works. RE-ENCRYPTION IN THE MIXMASTER ROTATING QUEUE MODEL Instead of layers like an onion, Mixmaster has a queue of headers that get rotated. A used header goes to the back of the queue where it can never again be read. At some point the header at the front of the queue is found to be the last one, and the message is sent on its final hop. For a header queue the above actions look like this: Actions at 'A': AAAB??? -> AAB???a -> AB???aa -> BB???aa In general when the first H headers are addressed to the remailer reading them, (H-1) rotations will be performed, and the top header will be overwritten with another one with a random key and IV to encrypt the rest of the message. The number of headers present remains 20, however many or few of these are still to be read. No valid header block is ever overwritten, only used header blocks that are good for nothing. This is always possible because after a remailer receives a message at least the one header it has just read must be of no further use. This will hide the message content from eavesdroppers, but not from the next remailer in line - 'B'. Assume that remailer B is operated by an attacker, and that he directs spam messages there after host A (which is holding your message in the pool at the time of the attack). B can read all messages sent by the attacker (who knows B's private key). This is also why I think link encryption offers incomplete protection. RE-ENCRYPTION WITH CHEATERS Mixmaster assumes that no particular remailer in the network can be trusted and that the user does not know which remailers cheat. The message passes through a chain of remailers, who aim to hide information from each other so that the compromise of some of them will not disclose the original sender and final destination. Central to the spamming attack is the idea that the attacker can recognise the messages he is trying to trace. This is done by eliminating his own messages. The whole set - not just some of them. It can be arranged that the attacker does not obtain the whole set until it is too late to trace the target message (i.e. after a few hops, when it is likely to have met other legitimate traffic). The partial information the attacker obtains before all the spams are identified will be of some use, but following each of several leads with a new spam attack is unappealing as the number of suspect messages will just grow. The remailer needs the freedom to divert packets to another remailer. This is shown below; where remailer C was chosen at random. Actions at 'A': AAAB??? -> AAB???a -> AB???aa -> CB???aa Each remailer could have three options when sending a packet to its next host. 1) rotate all possible headers, and send the result (current protocol) 2) re-encrypt message with new 3DES key and IV. Do not divert. 3) re-encrypt message with new 3DES key and IV. Divert at random. Good probabilities for these options might be: 1) 20% P(1) = P(3) The number of headers the next host can read should not reveal whether a diversion has just been made. (We care about this because it discourages cheaters deliberately refusing to pass on your mail.) 2) 60% Other outgoing packets are not distinguishable from spams. 3) 20% Should not approach 100%. (To arrive is better than to travel in hope.) A spam attack as described in [2] would use many more packets than those in the message pool (N) on the host under attack. The number of spam packets diverted to honest remailers (a proportion R of the whole) would be about MANY . N . P(3) . R and those diverted twice in succession to honest remailers would be about MANY . N . P(3) . P(3) . R . R and I'd expect a figure above 5 here to thwart the spammer, because of the time taken to collect the 5 spams. This diversion (adding steps to the middle of a chain) seems different from a Middleman scheme [3] where extra hops are added at the end. This scheme does NOT allow a remailer to choose the rest of the chain to be followed. A dishonest remailer cannot bypass any remailer chosen by the original sender (in the hope of following the message to its destination) using only cooperating dishonest remailers) because the message has been encrypted in the public key of each remailer the sender chose before it entered the network. REFERENCES 1 Frequently Asked Questions about Mixmaster Remailers FAQ Version 1.8 July 4 1996 by Lance Cottrell <loki(a)obscura.com.> 2 http://www.obscura.com/~loki/remailer/remailer-essay.html by Lance Cottrell <loki(a)obscura.com.> 3 email "Re: middleman - what is it ?" "John A. Perry" <perry(a)alpha.jpunix.com>

4 3

Re: The Future Of Cyber Terrorism
by jya＠pipeline.com 17 Dec '03

17 Dec '03

http://www.acsp.uic.edu/OICJ/CONFS/terror02.htm This quackery-puffery is truely hilarious. Worth reading for brave attempt to distinguish between our-adorable-intelligent-children qua hackers and terrifying next-door-neighbors so differently-abled-from-us cyber-terrorists. Unsubtly shaded white, off-white, black and blacknet movie-plotting. Thus Sprachen Zarathrustran Klaus: Commerce in ignorant-inner-fear-panderings regulation time.

2 1