December 2003 - cypherpunks-legacy

spam on this list
by Jason William RENNIE 17 Dec '03

17 Dec '03

NO i dont wish to post any, i just want to know if this list has spam sent to it ?? I started reciveing various pieces in the last couple of days and i'm trying to identify the source. thanx in advance, jason =8-]

2 1

Washington Post says McCain-Kerrey bill "raises red flags"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sun, 22 Jun 1997 20:52:08 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Washington Post says McCain-Kerrey bill "raises red flags" The Washington Post has a long history of endorsing the Clinton administration's position on export controls of encryption products. On June 10, 1996 the paper editorialized that "national security and law enforcement questions remain too important to be sacrificed lightly." On July 27, 1996: "Congress should be exceedingly cautious about getting out ahead of administration concerns on controls." "Unbreakable codes on the loose strike us as a real danger, a legitimate reason for tight export controls," the Post said on October 4, 1996 -- worrying the White House wasn't strict enough -- and again last month. But even the Post couldn't quite stomach the McCain-Kerrey bill that the Senate Commerce committee approved last week. In an editorial today, the Post said: ...the McCain-Kerrey legislation goes the other way, seeking to expand such restrictions to cover most of the uses of encryption software in the United States. That proposal raises red flags even if you believe, as we do, that there are legitimate national security and law enforcement reasons for controlling the diffusion of such `robust' coding software overseas. Below I've attached five Washington Post editorials on encryption. Thanks to Alan Olsen, Peter Trei, and especially John Young for holding on to these editorials and sending them to me. -Declan --- Senate Commerce committee and McCain-Kerrey bill: http://www.jya.com/declan3.txt http://www.jya.com/declan2.txt Problems with SAFE and ProCODE: http://cgi.pathfinder.com/netly/editorial/0,1012,1022,00.html Kerrey crypto-bill: http://cgi.pathfinder.com/netly/editorial/0,1012,931,00.html ------ Net Tangle on Privacy Sunday, June 22, 1997; Page C06 The Washington Post PITY THE senator or representative who still hasn't quite mastered the details of how the Internet works, or the difference between the World Wide Web and e-mail. On the Net-related issues that, by all indications, draw the most urgent public interest -- those relating to privacy protection -- there are now multiple clumps of competing bills, whose differences are both highly important and highly technical. Three of these involve different strategies to curb junk e-mail; two, diametrically opposed, concern encryption. All these bills are tangential, strictly speaking, to the basic concern expressed at hearings before the Federal Trade Commission: how to safeguard personal and sensitive data about yourself once it gets into the hands of institutions and third parties. (The commission itself is weighing whether to recommend such legislation based on what it heard.) But any of them could powerfully affect future privacy protection. A striking example is the newest bill on encryption, sponsored by Sens. Robert Kerrey and John McCain, which the Senate Commerce Committee on Thursday voted to adopt as a replacement for a long-standing proposal by Sen. Conrad Burns, dubbed Pro-CODE. Where the Burns bill would have lifted restrictions on the export of "uncrackable" encryption software abroad -- restrictions that the administration has fought to maintain for national security reasons -- the McCain-Kerrey legislation goes the other way, seeking to expand such restrictions to cover most of the uses of encryption software in the United States. That proposal raises red flags even if you believe, as we do, that there are legitimate national security and law enforcement reasons for controlling the diffusion of such `robust' coding software overseas. The bill, offered as a compromise between the administration's priorities and those of Congress, shows how difficult it is to square this particular circle. It would require users of domestic networks with any government funding (such as universities, many hospitals and government contractors) to deposit an extra "key" to their codes with a licensed "key management" authority -- with the licensing to be done by the government. Like the administration's international policy, this bill envisions the development of whole new government-regulated industries for key management, retrieval and authentication. This meets the needs of domestic law enforcement agencies, which could get the keys with an ordinary subpoena, but at a considerable cost to the consumer confidence that would be expected to drive a market in encryption software to begin with. What you think of these bills has a good deal to do with how you think the worlds of electronic commerce and networked communal life will develop -- and, of course, no one knows. Even the most enthusiastic boosters of the right to encryption concede that very few people actually use it yet. Electronic commerce itself has yet to take real shape. The main force shaping the Internet for now continues to be the perception -- not to mention fear -- of the all-too-likely prospect that anyone who wants to can snoop around in the stacks of your most private data, which are constantly accumulating in unknown files. ---------- The Washington Post, June 10, 1996, p. A18. Global Village Cops? What will be the long-term effect of Internet technologies on global law enforcement? The amazing story of Bill and Anna Young, a k a Leslie Rogge and Judy Kay Wilson, offers one possible scenario. The pseudonymous Youngs, residents of Guatemala who the FBI says have been on a decade-long run from U.S. justice since Mr. Rogge was convicted of a string of bank robberies and other offenses, turned themselves in to authorities after a neighbor recognized Mr. Rogge's face on the FBI home page's Most Wanted list. According to a story first told in the Guatemala Weekly, the person who recognized him was a newly Internet-wired 14-year-old. The vision of the future evoked by this story, of a world in which the familiar "global village" becomes a place not just of instant communication but of neighborly nosiness and where no one can just melt into the crowd, is reassuring and unnerving in about equal proportions. (What if it were a network of hit men or an authoritarian government seeking a dissident, rather than the FBI, making use of this powerful technology?) But it's also worth keeping in mind that, other than the romance of the technology, it doesn't represent that great an advance on current global media that have made celebrities or fugitives' faces familiar to a vast public -- just ask Salman Rushdie. The Rogge nabbing is the first that the FBI credits to its home page specifically, but TV's "America's Most Wanted" has scored similar coups. The impossibility of predicting the exact shape of these extensions of policing is relevant as well to a report that the National Research Council recently issued on another computer technology issue -- the vexed matter of whether to ease export controls on encryption software, which encodes information sent electronically so that only a user with a key can decipher it. The government until now has resisted lifting controls on "uncrackable" encryption software -- that is, codes that are too complex to be broken by brute force -- unless the industry agrees to deposit keys in an escrow arrangement with a third party so the government can seek and obtain a warrant to read encoded communications if necessary. Software makers, meanwhile, are pushing hard to have these restrictions eased. The research council, an arm of the generally neutral National Academy of Sciences, sought to bridge the gap between industry interests and such government agencies as the FBI and national security agencies, whose case, they say, is based largely on classified matter that can't be publicly discussed. Part of the report's conclusion, which favors the easing though not the abolition of current restrictions, is that wider use of encryption technology will actually *help* national security and law enforcement because more data, economic and otherwise, will be secure to begin with. But if the news of the changing terrain tells anything, it is that it is far too soon to base arguments on such a premise. Our own sense on encryption is that the national security and law enforcement questions remain too important to be sacrificed lightly, despite the considerable economic interests of the parties on the other side. But the world of Internet law enforcement is still taking shape. Whatever the public conclusion on encryption, the debate should not rest on any assumptions about what that shape will be. ----------- > The Washington Post, July 27, 1996, p. A22. > > > Speaking in Code on the Internet ... [Editorial] > > > The decibel level has been rising in the argument over how > much control the federal government should have over the > export of encryption technology. The Senate Commerce > Committee held hearings Thursday on a proposal dubbed > Pro-CODE (Promotion of Commerce On-line in the Digital Era) > that would lift current restrictions on exporting > encryption software above a certain level of complexity. > The move is opposed strongly by law enforcement and > national security authorities, who fear the consequences to > their tracking of terrorism or crime if uncrackable > cryptography becomes the global standard. > > > But encryption software -- which scrambles a person's > computer messages so no one can read them without a key -- > also is thought by many in the computer industry to be the > missing piece that's preventing customers from a full-scale > move to the Internet for banking and other confidential > transactions, rather than, as now, worrying about the > security of their data. They also see it as a market in > which the United States maintains a comfortable lead, one > that is threatened if domestic encryption makers can't sell > their products elsewhere. The makers argue that foreign > encryption software will rush in to fill the gap, doing > nothing about the uncrackability problem -- indeed, making > it worse. The administration in turn is pursuing a wider > international agreement to maintain controls on cryptology > export by all the industrialized nations and has been > putting pressure on its colleagues in the Organization for > Economic Cooperation and Development, which will rule on > the matter in a Paris meeting in September. > > > Administration officials, including FBI chief Louis Freeh, > have been pushing for an alternative policy of "voluntary > key escrow" -- encryption makers would deposit a key to the > code with a neutral third body before exporting the > products and could then have access to the codes only by > court order, as happens now with wiretapping. Mr. Freeh, > testifying at Thursday's hearing in favor of an optional > key escrow plan, noted that the point is not to prevent all > copies of uncrackable code from going abroad -- that's > clearly impossible -- but to prevent such high-level code > from becoming the international standard, with architecture > and transmission channels all unreadable to world > authorities. To software companies and Internet users who > have been clamoring for the right to encrypt as securely as > possible, Mr. Freeh and others argue, "the genie is not yet > out of the bottle" on "robust," meaning uncrackable, > encryption. > > > It's far from obvious to anyone that an optional escrow > plan really can prevent the growth of inaccessible > transmissions by international terrorists or criminals. > Encryption, if widely used, could conceivably ease some > privacy problems concerning who gets to see personal and > financial data on individuals -- though such data usually > are vulnerable to being dug out of storage rather than > intercepted in transmission. But neither is it clear that > the encryption enthusiasts' desire for free development > should take precedence over the tracking of terrorism. At > the very least, Congress should be exceedingly cautious > about getting out ahead of administration concerns on > controls that, once lifted, are hardly reversible. ---- The Washington Post, October 4, 1996, p. A22. Crypto Politics [Editorial] The Clinton administration once had a coherent, if unpopular, position on encryption software, the stuff that allows you to encode your email messages or other data so that no one can read it en route without a key. Now, in the wake of word that the president will sign an executive order, the position is no longer coherent, nor discernibly more popular with the high-tech audience it attempts to mollify. People and companies doing international financial business are highly interested in this kind of software, the more powerfully "uncrackable" the better. The U.S. software industry thinks there's a lot of money in it, especially if encryption becomes routine. The administration position till recently was that, much as U.S. software companies might profit from being able to market "uncrackable" encryption software freely, national security and law enforcement considerations dictated that such exports be controlled by license. Powerful encryption, like arms, could be dangerous in the hands of terrorists, rogue governments or international criminals. The software was classed as a munition; software above a certain uncrackability level could not be exported unless law enforcement authorities could get access somehow to the "key" after obtaining the proper warrants. Unbreakable codes on the loose strike us as a real danger, a legitimate reason for tight export controls. But if the administration really believes this, you'd think it would stick with steps that can plausibly meet the goal of control. Instead, trying to please, it has been splitting and splitting the difference between itself and the largely unmoved industry, which argues that no one will buy an encryption product that a government can decrypt at will. As with arms sales, the companies also argue that if they don't sell it, somebody else will, and that anyway it's far too late to fence off rogues. The national security people respond that there is still a "window," perhaps two years, in which they can prevent, if not all leaks of unauthorized crypto technology, at least its off-the-shelf use and wide adoption as the international standard. The administration initially proposed, then repeatedly refined, the concept of key "escrow" -- depositing a copy of the code with trusted third parties -- but never came up with a version the industry would accept. It commissioned a National Research Council report, which recommended a significant easing of restrictions. Now the president appears to have embraced a yet looser form of licensure upon declaration by a company that it will develop a plan within two years for key recovery. Also, the technology no longer will be considered munitions. What kind of plan? Nobody can quite say. What if the plans aren't acceptable? Licensing will revert to the old rule in two years. Will the security issue be moot by then? Probably. Barring some burst of clarity, one is left wondering whether the administration has compromised or caved, and what it now believes about the dangers of exporting uncrackable software. ---------- Showdown on Encryption Sunday, May 25 1997; Page C06 The Washington Post AFTER A YEAR'S rumbling, Congress seems ready to mount a direct challenge to the administration's position on encryption, the sticky issue of how to handle software that creates, for commercial use, codes too strong to break. The House Judiciary Committee the other day passed a bill dubbed Security and Freedom Through Encryption, or SAFE, which would undo existing curbs on the export of "uncrackable" encryption technology abroad without a license. The administration has fought to maintain those curbs against increasing pressure from the manufacturers of such software and from a loose but growing coalition of privacy and civil liberties groups. A similar bill is pending in the Senate. The administration maintains that the sellers of software capable of encrypting electronic messages to a complexity beyond ready cracking shouldn't sell it abroad -- or, if they do, should be prepared to deposit keys to the codes with trusted commercial third parties at home. Police or national security authorities could get these keys with a search warrant or court order, as in normal investigations, and a market would develop to provide the third-party service of holding them. This vision of a worldwide "key management" structure is a clever way to reconcile two otherwise contradictory desires: the desire of Internet users for absolute security and privacy in electronic transactions and the government's desire to prevent criminals and terrorists from making themselves impregnable to a degree never before seen. "Key management" does not, however, exist. And the administration has gone so far toward undercutting its own position -- saying key escrow should be voluntary, trying to accommodate industry with numerous exemptions, licensing uncrackable software separately for banks -- that it's not clear it ever will exist. Meanwhile, the once-obscure drive to make unlimited-strength cryptography available to all has picked up momentum -- and some odd allies. Phyllis Schlafly was among those who testified in favor of the SAFE bill, saying it would protect Americans from unprecedented government intrusion and the FBI reading their mail. Libertarian groups such as Americans for Tax Freedom are enthusiastic about the vision of a world where powerful, widely available encryption renders communications totally safe. The odd part is that there currently are no restrictions on use of uncrackable encryption software within this country. The software industry has argued that the export control makes for a de facto domestic curb, because it's too complicated to market a full-strength version for the domestic market and a weaker one for the foreign market. But this isn't a very persuasive argument, since most popular software programs exist in dozens of versions for different markets and in different languages. The real question is whether you believe this stuff poses a significant national security threat in the wrong hands. If you do -- and we think it irresponsible to assume otherwise -- then it's not enough to declare uncrackable privacy a civil right. You have to at least address the question of how to minimize intrusion into that right while preserving some ability to grapple with the potential danger. Neither the SAFE advocates in Congress nor the administration's voluntary escrow enthusiasts up to now have laid out that vision in a convincing way. ###

1 0

Excerpts from New York and Georgia court decisions
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sun, 22 Jun 1997 21:46:12 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: Excerpts from New York and Georgia court decisions ---------- http://www.aclu.org/court/nycdadec.html ALA v. Pataki Decision Thus, as will be discussed in more detail below, the New York Act is concerned with interstate commerce and contravenes the Commerce Clause for three reasons. First, the Act represents an unconstitutional projection of New York law into conduct that occurs wholly outside New York. Second, the Act is invalid because although protecting children from indecent material is a legitimate and indisputably worthy subject of state legislation, the burdens on interstate commerce resulting from the Act clearly exceed any local benefit derived from it. Finally, the Internet is one of those areas of commerce that must be marked off as a national preserve to protect users from inconsistent 'legislation that, taken to its most extreme, could paralyze development of the Internet altogether. Thus, the Commerce Clause ordains that only Congress can legislate in this area, subject, of course, to whatever limitations other provisions of the Constitution (such as the First Amendment) may require. [...] The inescapable conclusion is that the Internet represents an instrument of interstate commerce, albeit an innovative one; the novelty of the technology should not obscure the fact that regulation of the Internet impels traditional Commerce Clause considerations. The New York Act is therefore closely concerned with interstate commerce, and scrutiny of the Act under the Commerce Clause is entirely appropriate. As discussed in the following sections, the Act cannot survive such scrutiny, because it places an undue burden on interstate traffic, whether that traffic be in goods, services, or ideas. [...] The State vigorously argues that its low was designed to avoid the constitutional pitfalls presented by the CDA; however, the New York Act was clearly modelled on the CDA, and numerous provisions of the New York Act mirror their federal counterparts. [...] I believe any determination of plaintiffs' First Amendment challenge should therefore await the guidance to be provided by the Supreme Court's forthcoming opinion. ----------- http://www.efga.org/hb1630/preliminary_injunction.html AMERICAN CIVIL LIBERTIES UNION OF GEORGIA v. ZELL MILLER, et al., Defendants allege that the statute's purpose is fraud prevention, which the Court agrees is a compelling state interest. However, the statute is not narrowly tailored to achieve that end and instead sweeps innocent, protected speech within its scope. Specifically, by its plain language the criminal prohibition applies regardless of whether a speaker has any intent to deceive or whether deception actually occurs. Therefore, it could apply to a wide range of transmissions which "falsely identify" the sender, but are not "fraudulent" within the specific meaning of the criminal code. [...] The Court concludes that the statute was not drafted with the precision necessary for laws regulating speech. On its face, the act prohibits such protected speech as the use of false identification to avoid social ostracism, to prevent discrimination and harassment, and to protect privacy, as well as the use of trade names or logos in non-commercial educational speech, news, and commentary--a prohibition with well-recognized first amendment problems. [...]

1 0

Re: Bomb-making instructions....
by Ross Wright 17 Dec '03

17 Dec '03

On or About 22 Jun 97 at 20:32, Tim May wrote: >The latest crime for which Senator Diane Swinestein has earned the >[CENSORED] is her "bomb-making instructions on the Internet are illegal" >bill. > We need to hold a trial for this bitch. Then a quick trip to the > firewall. Tim: That's "Murderous, Boss Killing Bitch", please. Spam is free speech. Ross =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: (408) 259-2795

1 0

PGP 5.0 doesn't tell me Which key a message is signed by! [SEVERITY 1]
by Bill Stewart 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Yow! I'm using PGP 5.0, with the PGPtray and the Eudora Plugin, in a version that appears to be b14c3 for Win95. When I receive a signed email message, or check with PGPtray, it tells me the message is from "User <email(a)foo.com>", but doesn't tell me it's from KeyID 0x12345678 or the fingerprint of the key or anything even vaguely difficult to fake. Thus, I've signed this message as Phil Zimmermann FAKE <prz(a)acm.org>, and if I'd left out the FAKE it would be difficult to tell it from a real Phil key. The GUI happily gives me a message box saying "Good signature from Phil Zimmermann FAKE <prz(a)acm.org>". We've been discussing 0xDEADBEEF attacks on Cypherpunks and Coderpunks, but this appears to be far worse - I hope it's been fixed for the production version? -----BEGIN PGP SIGNATURE----- Version: 5.0 beta Charset: noconv iQBVAwUBM5u51kEvGqT1DvpRAQHnwgIAzF7uBmgsk9+c4IZObsnXBJBHuCFEUsMr 3V64azY6Wp156SFgDPGODQvQxzDiQCb96hUz2RK2j7DxfekOZ7rzjw== =u93K -----END PGP SIGNATURE----- # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list or news, please Cc: me on replies. Thanks.)

1 0

Re: Thoughtcrime (Re: My War) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Forwarded message: > Date: Mon, 09 Jun 1997 18:35:34 -0700 > From: Lucky Green <shamrock(a)netcom.com> > Subject: Re: Thoughtcrime (Re: My War) > Let us assume that it is unethical to force children to participate in the > production of child pornography. (For the benefit of Kent and the more > ignorant people on this list, I will state that I firmly believe this to be > true, despite the fact that doing so should be irrelevant for the argument.) > Furthermore, let us assume that there are a number of individuals who enjoy > looking at hard core child pornography. > The question then is: does going after the distributors provide a benefit > to the children being (potentially) used for such pictures? > The answer is clearly no. Assuming, tacitly of course, that the supply of distributors is unlimited. If the resource is limited, as it actualy is, by getting the distribution node you in effect cut many people off. Thus forcing either total denial or else direct intervention, thus raising the chance of getting caught because more persons would be involved than would normaly be the case. This in effect clearly indicates a benefit to going after the distributors. This argument can be extended to the film-maker as well. Now some will say that it doesn't matter, somebody else will always pop up. The problem with this is that we have a limited population and there are only a statistical percentage going to be interested in the activity. This implies that there is some set of persons who will not participate. The trick is to get the non-participants to be the larger of the two. > By limiting the distribution of an individual > picture, you increase the total number of pictures required to satisfy > market demand. That means more children will be required to meet demand. By extension then full and complete public distribution would minimize it completely. So, you are seriously stating that we should put such pictures on the daily television, say during childrens hour? Now if we follow this further we are left with the image of our government hiring children to pose for said images because the supply of 'actual' images had diminished. That is truly a case of the pot calling the kettle black. Plus the sicko's get free, danger free, thrills at the public expence. Wooo, just what I want my tax dollars spent on. We are clearly dealing with a cusp-shaped function here. The implication being that some form of regulation is beneficial if we want to actualy reduce child abuse. > Thus, by going after the distributors, Se7en causes more children to be > violated by child pornographers. Or just possibly making the supply even more scarce because fewer and fewer are willing to take the chance of making a few bucks. > The only question that remains is: how can he live with this? > > Logic != base emotions, Ahmen brother! Otherwise, feldercarb. _______________________________________________________________________ | | | Moderation in all things, including moderation. | | | | -I wish I could remember- | | | | Jim Choate ravage(a)ssz.com | | The Armadillo Group www.ssz.com | | Austin, Texas, USA 512-451-7087 | |_______________________________________________________________________|

1 0

Re: FCPUNX:McVeigh
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 12:42 PM 6/4/97 -0400, Hallam-Baker wrote: > Bell's Murder Politics scheme was a censorship scheme. Surely people would be more inclined to kill politicians for what they do, rather than what they say. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

12 15

Julf ordered to reveal anon IDs
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

> Julf Johan Helsingius (Julf) has been ordered to release the identity of the poster of one of the Scamizdat series of confidential materials. "The Court of Appeals of Helsinki (Helsingin hovioikeus) has upheld the decision of the local court of Helsinki, in which Johan 'Julf' Helsingius was ordered to reveal the user id of the person who used the anon.penet.fi server to repost parts of Scamizdat, a collection of secret Scientology scriptures. "In its decision dated 4th of June 1997, the Court of Appeals orders Helsingius to reveal the names in 30 days after the decision becomes final. If he doesn't try to appeal the decision it will mean that he has to reveal the user id within three months. He might appeal the decision to the Supreme Court within 60 days, in which case the whole thing will take longer, regardless of whether the Supreme Court chooses to consider the case or not. "The following ID's were used to send material through anon.penet.fi: an498608(a)anon.penet.fi, an545430(a)anon.penet.fi "The material was a repost of Scamizdat #11, in several parts. The original repost was done on 15.2.1996, and partly repeated 12.3.1996." Message-ID: <5n7g0v$h75(a)reimari.uwasa.fi>

2 1

Call for Papers: Jurimetrics Special Edition on PKI
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Authentication-Warning: blacklodge.c2.net: majordom set sender to owner-spki(a)c2.org using -f X-Sender: baum(a)world.std.com Date: Sun, 08 Jun 1997 09:46:14 -0400 To: spki(a)c2.net From: "Michael S. Baum" <michael(a)verisign.com> Subject: Call for Papers: Jurimetrics Special Edition on PKI Mime-Version: 1.0 Sender: owner-spki(a)c2.net Precedence: bulk *** Announcement *** JURIMETRICS Winter 1998 Special Issue on Public Key Infrastructure (Security in Electronic Commerce: Technology, Infrastructure and Practices for Certification Authorities and Digital Signatures) I. Contents of this Solicitation · General Information · Call for Papers · Criteria for Papers · Submission Information · Important Dates · Virtual Conference · Organization · Inquiries II. General Information We are pleased to announce the planned publication of a special issue of the Jurimetrics Journal of Law, Science and Technology that will exclusively address public key infrastructure (PKI) -- the law and technology of certificate-based digital signatures and secure electronic commerce. This announcement solicits articles for consideration for this special Winter 1998 issue, which is intended as a forum for attorneys, technologists, developers, and users interested in the legal aspects and implications of PKI. Jurimetrics Journal of Law, Science and Technology, published quarterly, is the journal of the American Bar Association Section of Science and Technology and the Center for the Study of Law, Science and Technology of the Arizona State University College of Law. The Information Security Committee, Electronic Commerce Division, Section of Science and Technology of the American Bar Association (ISC) explores and develops legal policy and foundation to support PKI and secure electronic commerce. The ICSs current endeavors include research and work product concerning: accreditation of certification authorities, commercial key escrow guidelines, PKI evidentiary issues, digital signature legislative initiatives, CA and user liability, and other legal issues relating to secure electronic commerce. The discussions are moderated by the relevant Work Groups of the ISC, and the ISC is open to professionals of all disciplines with similar interests. In August l996, the ISC published the Digital Signature Guidelines. See Tutorial, Table of Contents, and List of Contributors of the Digital Signature Guidelines at http://www.abanet.org/scitech/ec/isc/dsg-tutorial.html. III. Call for Papers Papers are invited on all subjects related to applications of PKI and their corresponding legal issues. The special edition is structured as follows: · Preface · Introduction · Tutorial, Architecture and Technology · International Issues · Liability, Contractual, Intellectual Property, and other Substantive Legal Issues · Government Legislative, Regulatory, Policy, Enforcement · Accreditation of Certification Authorities (including licensure and other quality issues) · Miscellaneous Papers submitted should be concise and focused on the kernel rather than exhaustive detail of new ideas intended to be communicated. Papers should not restate basic PKI technology but instead refer to the common tutorial located in the introductory materials. We thank you in advance for your submissions to this special issue of Jurimetrics on PKI. IV. Criteria for Papers Preference will be given to papers that comply with the following criteria: · are no longer than 8,000 words (under 10 pages, 12 point type, single spaced) · provide appropriate annotation · include URLs in annotations, where available · consider both legal and technical issues/implications · involve joint authorship between a lawyer and technologist · are original works not previously published elsewhere · conformance to the instructions for prospective Jurimetrics authors posted at http://www.asu.edu/law/jurimetrics/author.htm V. Submission Information Send brief but informative abstract of one or two pages as an email attachment to jurimetrics(a)cnidr.org. If possible, please use Word 6.0 (Office 95) to facilitate handling. A one paragraph bio is also requested but not required. VI. Important Dates · Abstracts must be submitted by: 25 June 1997 · Deadline for submission of drafts: 15 October 1997 · Final version ready, after all cite checks and editorial changes: 31 December 1997 · Publication of Jurimetrics special issue on PKI: February 1998 VII. Virtual Conference All papers accepted to Jurimetrics Winter 1998 special issue on PKI will appear in full or abstract form in a Virtual Conference Center hosted by the ISC. The PKI community will have the opportunity to participate in discussions with the authors using e-mail and the World Wide Web. The Virtual Conference Center will feature a variety of electronic for a moderated by leading PKI experts for the facilitation of communication within the virtual PKI/law & technology community. VIII. Organization for the Jurimetrics Special Issue on PKI Guest Editor-in-Chief: Michael S. Baum, Esq., VP, Practices and External Affairs, VeriSign, Inc. Associate Guest Editors: Joseph H. Alhadeff, Esq., Director, Electronic Commerce, U.S. Council for Intl Business (USCIB) Warwick Ford, Ph.D., Director, Advanced Technology, Verisign, Inc. Theodore Ling, Esq., Baker & McKenzie, Toronto, Ontario. Charles R. Merrill, Esq., McCarter & English, Newark, NJ. Arthur F. Purcell, J.D., International Project Specialist, US Patent & Trademark Office Ruven Schwartz, Esq., Info. Security, West Group Business Manager XI. Inquiries If you need help or have questions which are not answered in the above information, please e-mail: jurimetrics(a)cnidr.org *** --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: FC97 in July Wired
by Robert Hettinga 17 Dec '03

17 Dec '03

About the third thing I imagined, after imagining the world's first financial cryptography conference, and, better yet, having it on Anguilla in February; and, after imagining it as Wired's featured 'Deductible Junket'; was imagining a nice feature article in Wired on the conference after it was all over. Thanks to Charles Platt, I now figure I can die and go to heaven, as all three have happened. :-). Out of Town Newspapers in Harvard Square says they'll have the July Wired next Friday. It appears that Vince gets a subscription down in Anguilla, which got there yesterday, and probably everywhere else, I reckon. So, the checks may take 90 days to clear in Anguilla, but at least the mail gets there on time... Stay tuned for details (as we imagine them :-)) about FC98, and about the FC97 conference proceedings, which should be published by Springer-Verlag this summer. Cheers, Bob Hettinga, General Chairman, Financial Cryptography, 1997/98, Anguilla, BVI P.S. if you, or anyone you know, is interested in FC98 sponsorship or exhibition space opportunities, please contact me. --- begin forwarded text Resent-Date: Sun, 8 Jun 1997 08:57:10 -0400 X-Authentication-Warning: online.offshore.com.ai: list set sender to fc97-request(a)offshore.com.ai using -f Date: Sun, 8 Jun 1997 08:57:04 -0400 (AST) From: Vincent Cate <vince(a)offshore.com.ai> To: fc97(a)online.offshore.com.ai cc: ois-news(a)online.offshore.com.ai Subject: FC97 in July Wired MIME-Version: 1.0 Resent-From: fc97(a)offshore.com.ai X-Mailing-List: <fc97(a)offshore.com.ai> archive/latest/57 X-Loop: fc97(a)offshore.com.ai Precedence: list Resent-Sender: fc97-request(a)offshore.com.ai The July issue of Wired magazine has an article about the Financial Cryptography 97 conference held in Anguilla. -- Vince ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vincent Cate Offshore Information Services Vince(a)Offshore.com.ai http://www.offshore.com.ai/ Anguilla, BWI http://www.offshore.com.ai/vince ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

2 2

PGP key fingerprint spoofing
by Adam Back 17 Dec '03

17 Dec '03

Well we're all aware of the 0xDEADBEEF attack, right? (PGP keyids, are the 8 hex digit number which PGP recognizes a key by. The 0xDEADBEEF attack (so christened by Greg Rose one of the people who independently rediscovered this attack) is where you generate a PGP key which has the same key id as someone else's key. This could confuse a keyserver, or a user into using the wrong key. This attack is fairly easy to do, just choose p ending in 0xDEADBEEF (or whatever the desired key id is), then start with q ending in 0x00000001, and add some value larger than 0xFFFFFFFF at each iteration doing your primality test, the p and q will then multiply to have the desired least significant bits of n). You may also have noticed that Gary Howland has a keyid of 0xc001d00d ("cool dude", get it). Anyway it seems that you can spoof the finger print also indirectly, which is much less obvious, as the fingerprint is the MD5 hash of the RSA modulus concatenated with the RSA public exponent. This was described recently on coderpunks. (I was forced to eat my words on coderpunks after declaring this was impossible without an exploitable flaw in MD5 or brute force of 2**128 bit search space, when someone explained the concatenation weakness). I'm not sure who it was that discovered this attack, or which list/newsgroup this was announced on, but this was the first I had seen it discussed. The concatenation is the weakness, as if you have an RSA key of: n = 0x1234567 e = 0x11 Then you can try n = 0x12345, and e = 0x6711. So you try factoring each n of this form, and if it has two factors p and q, then you can construct a key with the same fingerprint, but with different key. Anyone who bothers to would be able to factor 0x1234567 also, so it is not secure, but if you can fool someone into using this key in place of the real one, you can get their communications. It will be much easier to fool someone to use this key as the fingerprint is the same! Here's an example... Say we have a 1024 bit key, say e is small ( < 256). That means n || e is 129 bytes long. The e value must be represented by a whole byte. n can't be smaller than 384 bits (or PGP will reject it as too small to hold the required idea message key and padding), so that will give us 80 possible values for e and n. Lets use my 1024 bit key for an example. n = 0x99d61071378ee2c0c8c9c4b7786b203dedf2d6e526f24f7e83f3e0f960fb66b9 cb81c04e89d70689a4866f21ad1bb5ba6aee51469e5b59b121ba6f3f8d776b62 7253ba5dc9fca8155a565b9893f695d83a0496eb977ee4659ee20e0f2eb49b25 93c11487b377cc5d767c79fb985b464d4ae94a5f45e42e3b29c8b89d556a4a67 e = 0x13 So we could try: e = 0x6713 e = 0x4a6713 e = 0x6a4a6713 ... n = 0x99d61071378ee2c0c8c9c4b7786b203dedf2d6e526f24f7e83f3e0f960fb66b9 cb81c04e89d70689a4866f21ad1bb5ba e = 0x6aee51469e5b59b121ba6f3f8d776b627253ba5dc9fca8155a565b9893f695d8 3a0496eb977ee4659ee20e0f2eb49b2593c11487b377cc5d767c79fb985b464d 4ae94a5f45e42e3b29c8b89d556a4a6713 Here's the first candidate I found with only two factors starting from the smallest n value (384 bit n) so that it would be quicker to factorize (anything that took a long time to factor I moved on to next value). n = 0x99D61071378EE2C0C8C9C4B7786B203DEDF2D6E526F24F7E83F3E0F960FB66B9 CB81C04E89D70689A4866F21AD1BB5BA6AEE51469E5B59B121BA6F3F8D776B62 7253BA5DC9FCA8155A565B9893F695D83A0496EB977EE465 e = 0x9EE20E0F2EB49B2593C11487B377CC5D767C79FB985B464D4AE94A5F45E42E3B 29C8B89D556A4A6713 p = 0x6D q = 0x1694DA7CA7DC9B69CD9ECAAC8BCDF6A41988A31132573CFD6EF72CC44FFF5330 69074D8CB3F0974586892A25D2F3A08C19173D406266A82CCA3C3F4D705CAF78 23922972C20D99D8DBF07E2DE20CB5B3B3F747797B3A8D9 n = 0x99D61071378EE2C0C8C9C4B7786B203DEDF2D6E526F24F7E83F3E0F960FB66B9 CB81C04E89D70689A4866F21AD1BB5BA6AEE51469E5B59B121BA6F3F8D776B62 7253BA5DC9FCA8155A565B9893F695D83A0496EB977EE465 d = 0x0455419C3B8CCE54710EC04F9FA61F83A5E2363BE0D2E361886080716E7B8886 EA62B748F20B9E9E7F93F768616D3AF5F8785D514A82EE41CB1FF251FFB053FA 173D0B239D7BD1995B4F7DE3B2B112F911BE1304453EAC53 u = 0x0162AC862E1D88F2ACC3230A4AED13AEC3EA4A978387684ADA099644FF9FAA3D D51F6BA831347C5D12AD1CDC72F5FE40F66228E54573373C4A0F255A091879BC F2EA9509D46B673CB7C4EB8EDA0D6754DC373EA911653504 (Factorization courtesy of pollard rho / trial division code in the factorization code which comes in ssh-1.2.20, which includes a modified gmp-2.0.2 which has the code in the demos directory.) I checked RSA operation (with my .sig rsa program which works with hex numbers rather than formatted pgp keys) -- it works!! % echo hello world | rsa -k=9EE20E0F2EB49B2593C11487B377CC5D767C79FB985B464D4AE94A5F45E42E3B29C8B89D556A4A6713 -n=99D61071378EE2C0C8C9C4B7786B203DEDF2D6E526F24F7E83F3E0F960FB66B9CB81C04E89D70689A4866F21AD1BB5BA6AEE51469E5B59B121BA6F3F8D776B627253BA5DC9FCA8155A565B9893F695D83A0496EB977EE465 > out % % rsa -k=0455419C3B8CCE54710EC04F9FA61F83A5E2363BE0D2E361886080716E7B8886EA62B748F20B9E9E7F93F768616D3AF5F8785D514A82EE41CB1FF251FFB053FA173D0B239D7BD1995B4F7DE3B2B112F911BE1304453EAC53 -n=99D61071378EE2C0C8C9C4B7786B203DEDF2D6E526F24F7E83F3E0F960FB66B9CB81C04E89D70689A4866F21AD1BB5BA6AEE51469E5B59B121BA6F3F8D776B627253BA5DC9FCA8155A565B9893F695D83A0496EB977EE465 < out hello world % I'm off to pack this up as a PGP key, to see if PGP likes it! Well here's that key as a pgp key. Under no circumstances use it to encrypt a message you care about. Here's the public key. Type Bits/KeyID Date User ID pub 704/977EE465 1997/06/08 Adam Back <spoofed fingerprint DO NOT USE> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQCNAzObE60AAAECwJnWEHE3juLAyMnEt3hrID3t8tblJvJPfoPz4Plg+2a5y4HA TonXBomkhm8hrRu1umruUUaeW1mxIbpvP413a2JyU7pdyfyoFVpWW5iT9pXYOgSW 65d+5GUBSJ7iDg8utJslk8EUh7N3zF12fHn7mFtGTUrpSl9F5C47Kci4nVVqSmcT tCpBZGFtIEJhY2sgPHNwb29mZWQgZmluZ2VycHJpbnQgRE8gTk9UIFVTRT6JAG0D BRAzmxOtOgSW65d+5GUBAQ27ArwOTveQTs0kjzBEMa09yWFs5+jNjv5tzSCngzXO bRzvwhTwWz4voR3ov2o0bGTYZF1biKRKeKqZzHb4Oq4XhD4TADdlmsxA5gQgbYFN 5K+tbgWEDQD53KFv =rlth -----END PGP PUBLIC KEY BLOCK----- Here's the secret half: -----BEGIN PGP SECRET KEY BLOCK----- Version: 2.6.3i lQGhAzObE60AAAECwJnWEHE3juLAyMnEt3hrID3t8tblJvJPfoPz4Plg+2a5y4HA TonXBomkhm8hrRu1umruUUaeW1mxIbpvP413a2JyU7pdyfyoFVpWW5iT9pXYOgSW 65d+5GUBSJ7iDg8utJslk8EUh7N3zF12fHn7mFtGTUrpSl9F5C47Kci4nVVqSmcT AAK7BFVBnDuMzlRxDsBPn6Yfg6XiNjvg0uNhiGCAcW57iIbqYrdI8guenn+T92hh bTr1+HhdUUqC7kHLH/JR/7BT+hc9CyOde9GZW09947KxEvkRvhMERT6sUwAHbQK5 AWlNp8p9ybac2eyqyLzfakGYijETJXPP1u9yzET/9TMGkHTYyz8JdFhokqJdLzoI wZFz1AYmaoLMo8P01wXK94I5IpcsINmdjb8H4t4gy1s7P3R3l7Oo2QK5AWKshi4d iPKswyMKSu0TrsPqSpeDh2hK2gmWRP+fqj3VH2uoMTR8XRKtHNxy9f5A9mIo5UVz NzxKDyVaCRh5vPLqlQnUa2c8t8TrjtoNZ1TcNz6pEWU1BIRbtCpBZGFtIEJhY2sg PHNwb29mZWQgZmluZ2VycHJpbnQgRE8gTk9UIFVTRT4= =lE9S -----END PGP SECRET KEY BLOCK----- Here are the fingerprints of spoofed key as compared to real key. Type Bits/KeyID Date User ID pub 704/977EE465 1997/06/08 Adam Back <spoofed fingerprint DO NOT USE> Key fingerprint = 18 B8 A0 65 9D 38 14 83 61 5A E6 AC 91 8B 9E 57 pub 1024/556A4A67 1993/06/08 Adam Back <aba(a)dcs.ex.ac.uk> Key fingerprint = 18 B8 A0 65 9D 38 14 83 61 5A E6 AC 91 8B 9E 57 Note the identical fingerprints! (Awesome). Key id of course is different. Also note that you can't decrypt directly with PGP, as I suspected, because the chinese remainder theorem used in decrypt to speed up the works barfs on small p. You can hack around that if you're bothered. It might be possible to find a spoofed fingerprint key with large p and q, so that this was not a problem. Below this post is my real key. This is a major security flaw, and I take my hat off to the guy who discovered it. As others noted (who were aware of this flaw) the solution is to consider the keyid as part of the fingerprint. That reduces by a factor of 2^32 the likelihood of the attack succeeding. I suspect that rules out the attack working for most keys. Also be suspicous of odd sized keys. Now if someones 2048 bit key has a 1024 bit spoof, you're in trouble. I'd be interested in estimates of the likelihood of this being possible for a randomly selected key. You could construct a key where the keyid matched, and the fingerprint matched for two different keys, using a combination of dead beef attack, and brute force to find a key with the keyid appearing two places in the key, and then trying to factor the n value at that point. Shouldn't take long. As far as PGP format goes, adding the length field into the digest would go along way towards fixing it. (Length fields for pgp big int representation is big endian 16 bit word representing length of following big int in bits). There might still be a small chance of doing the fingerprint spoof where the length fields both happened to be right. As you require a specific length field it would seem this attack would be 2^32 times less likely to succeed. This would make most keys safe. I wonder if there exists a key out there which would fall to this attack. (btw for people playing with this stuff, a useful program is pgpacket.pl by Mark Shoulsen, which displays pgp packets as hex numbers, see ftp.ox.ac.uk/pgp somewhere under utils). Adam My real key, so you can compare fingerprints. Type Bits/KeyID Date User ID pub 1024/556A4A67 1993/06/08 Adam Back <aba(a)dcs.ex.ac.uk> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQCNAiwUXUEAAAEEAJnWEHE3juLAyMnEt3hrID3t8tblJvJPfoPz4Plg+2a5y4HA TonXBomkhm8hrRu1umruUUaeW1mxIbpvP413a2JyU7pdyfyoFVpWW5iT9pXYOgSW 65d+5GWe4g4PLrSbJZPBFIezd8xddnx5+5hbRk1K6UpfReQuOynIuJ1VakpnAAUT tBxBZGFtIEJhY2sgPGFiYUBkY3MuZXguYWMudWs+iQCVAwUQMiDfwUZRiTErSPb1 AQF/yAP8D1X2eAhXSc0P/X7lCHyBhWCl3pxa6oyGxFBOmUeOGfYna8CpJeMiTmZm akRWDYmJUiXscQUfd9qRv8eAeOtbvM87olSjm56Dlh4gYJFZRxZ6IhHlFJx3mPmp q9PnL+pSC41IIheRBJFzpKGD3LW9+VQwRAx9bXFJYyOFpx7vGJqJAJUCBRAwLhaV fjuD7tLfgD0BAYnfA/0XByiiqDX/cxgWt9syiobJ0TrTKloJcEgzxnKmqHH7rhqn wWGQA2pbWPGW1AwLtkeE+JYyk21YQZZxYWerK3JUi8a/ye4EaaJSs8mcw9YCwdPC Xa0nlalh09/FBEt83l5auNbw+zl9AcrOIGsTQcAr0Vy5nnV9IEfi6WZ3/aQ734kB FQMFEC/gRoaxVzBJFqEkZQEBEXcIAI6z9nUinIomouzB/3v1Fu9+kLOLiva+7Mp1 8UT40FXvHSabXe/cSV1//lnlYHJnfpJCPFSEjGox1pVBp9pLmiJBmubLfUrojIAn FDB081n6kB0B4BKb2rUiNghvT4CzpBZ149g/2NGscRIeQOCYkA2cBxT44v2luuqN 3Ahg9bWu+kjnxUKIK9Da/8D0ur5HiinBDevPiVf3/uoOdZ8F7alxqitBcC5ctIYR tr8fgdQq8is6dbeNxDMraV5vEpEN27AU4xOetymdFUufbU1K6Riw5TVZni9qXAgU ZS3zyFw7wqJ/SWILMWp+99ss921b+GpL+/m6S4j7LTXvFvcfy9aJAJUDBRAv2A0p Kci4nVVqSmcBAcfoA/9Pt3BeJ3TdTtQzb9DNT7LoXiQesYG68lzIl7BZsRvXoi2Q yeCPNc/juTGBnKBHgxZezJCW8TaKdJjNEncv7p+1o+9fwmy9UKWXskh6N+Y0ZlhJ bD0T+8+L+Wxpr6k3dao/GfOnCvw8vpvzDV9lnjtqe2B1mU5eAY76FFtZXvM9xw== =xN9o -----END PGP PUBLIC KEY BLOCK-----

5 4

Dems Critique Crypto Policy
by John Young 17 Dec '03

17 Dec '03

These views from Democratic legislators on the SAFE crypto bill is excerpted from House Report 105-108, dated May 22, 1997, which reports on the recent hearing testimony, DoJ's critique, and Goodlatte's responses to administration criticism. It cites the Blaze et al report on the risks of key recovery, Sun's alliance with Elvis, current litigation and non-US commercial exploitation of the crypto stalemate. http://jya.com/hr105-108.htm (94K) ----- ADDITIONAL MINORITY VIEWS John Conyers, Jr. Rick Boucher. Zoe Lofgren. Maxine Waters. William Delahunt. Martin T. Meehan. We offer these additional views not to foment dissent but to encourage dialogue with the Administration on the issues related to encryption. We would like to work with federal law enforcement and national security agencies to address their concerns. We sympathize with the difficulties faced by investigative and security agencies in combating crime, terrorism, and espionage. We believe it is quite legitimate for the Administration to be concerned about the uncertain impact that strong and ubiquitous encryption products may have on law enforcement and national security agencies. We realize that it may ultimately become impossible for government agencies to decipher intercepted or retrieved data and communications that have, by encryption, been transformed into a seemingly unintelligible form. We recognize the days of cracking strong codes are nearly gone. Unbreakable codes (256-bit key algorithms can generate more possible solutions than there are particles in the known universe) are already widely known. Private security experts and sophisticated hackers have already realized this and are beginning to develop ways of attacking the vulnerable points before and after the information is encrypted (i.e., on the sender's hard drive or at a ``good-guy'' recipient such as a bank). We suspect that law enforcement and national security experts within the government are acquiring similar capabilities. But these alternative (and more subtle) approaches are not reflected in the Administration's current public policy toward encryption. The Administration's current encryption policy, a policy that runs back at least to the Bush Administration, creates more problems than it resolves. The policy is a combination of encryption export controls and a key escrow system by which the key to the code encrypting the information is to be held by a third party (so it may be made available to the government). We need to be honest about this situation. We don't expect most narcotics traffickers, terrorists, or criminals to respect export restrictions on encryption when they don't respect our underlying drugs or weapons laws. And we don't generally expect anyone who employs encryption in furtherance of a crime to readily give their keys to some third party so they may be made available to the government. The Administration maintains that there is a commercial need for key recovery. While that may be true to some extent, there appears to be little or no demand for the all- encompassing system they want to mandate. Experts have uniformly concluded the government's proposed system is either excessively costly and complex or insecure. In part, this is true because the government seeks access to real-time communications and data transmissions, rather than the ability to recover stored data. The Administration insists it doesn't want domestic restrictions on encryption. We are concerned, however, that the Administration policy does have this effect. Development of software programs, including those utilizing encryption, occurs at an amazingly rapid pace, so it is not feasible for computer software and hardware companies to develop separate products for export and for domestic use. As a result, as a practical matter, only products that are exportable, with weaker encryption or with government-approved key recovery-escrow, can be marketed at present. We fear that current encryption policy, encouraging as it does weaker encryption, makes every American more vulnerable to illicit or surreptitious access to our computer files, our phone conversations, and personal information, and thus exposes our citizens to hackers, terrorists, and thieves. It is ironic that what is trumpeted as an aid to law enforcement may instead compromise individual and corporate security. What we have here is not only a combination of export controls and a key recovery system that does not work, we have a system that compromises the competitiveness and security of this nation's software and hardware industry, as well as our privacy rights. As conceded by Administration witnesses, the proposed key recovery system can succeed only as long as there is no non-conforming encryption software readily available in the market. But there is already an abundance of such software, some of it freeware, that is readily available over the Internet. The proposed key recovery system can not work unless the United States persuades every other nation to adopt key recovery. We can safely say we are unlikely to obtain the agreement of Libya, Iran, Iraq, or North Korea. In addition, the efforts to date of David Aaron, U.S. Ambassador to the Organization for Economic Cooperation and Development (OECD), to obtain a consensus in support of key recovery resulted instead in a consensus opposing it. The Administration's policy has therefore been a strong market incentive: (a) for non-participants (in the Administration's key escrow program) to make non-standard, secure encryption available, and (b) for U.S. companies to set up abroad in "encryption havens'' so they may legally market strong, secure encryption products to customers who decline to make their "international key'' available to diverse governments around the world. There are already U.S. companies establishing ties with foreign companies in Japan, Russia, and elsewhere. Nor is this policy without its cost. It is estimated that, if the U.S. persists in its current policy through the year 2000, we shall lose 200,000 jobs and $60 billion each year. This is what it will cost this nation to lose the cryptography lead we enjoy and the competitive expertise necessary to maintain our market position. Unfortunately, our discussions to date with law enforcement and intelligence agencies have not admitted of the possibility of any further relaxation of export restrictions as part of the broader process essential to resolving this complex question. Nor has the Administration offered to consider alternatives to its key escrow or key recovery system. H.R. 695 need not be the end of the process but the beginning of a real dialogue. This is what we would like to happen. We continue to remain hopeful that the Administration will acknowledge the shortcomings of its current policy and sincerely hope that this will happen soon lest more serious damage be done to our industry, to our security and to our privacy. [End exceprt]

1 0

No Subject
by erict＠iconmedialab.se 17 Dec '03

17 Dec '03

UNSUBSCRIBE cypherpunks _____________ ännu en sån där trevlig signatur rad _____________

1 0

Re: [ADMINISTRATIVIUM] Quadratic residues
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

`A pen is mightier than a sword', not to mention Timmy C. May's pea-sized penis. He would be better served by a safety razor, possibly applied in a bathtub filled with warm water (something he has surely never been into). o /\O/ O Timmy C. May 0 \\ | 0-# // | / \

2 1

subscribe
by Dinesh Mahtani (Dino) 17 Dec '03

17 Dec '03

subscribe mahtani(a)vaxvmsx.babson.edu _______________________________________________________________ | | | TEMPORARY EMAIL ADDRESS: mahtani(a)vaxvmsx.babson.edu | |_______________________________________________________________| _______________________________________________________________ | | | Please note that our company will be changing our Internet | | Service Provider in the very near future. I may be unable | | to view messages sent to mahtani(a)mozart.inet.co.th. To | | avoid any possible problems please update your address | | books and/or send carbon copies of all correspondance to my | | old school address during this transition. | |_______________________________________________________________| _______________________________________________________________ | | | TEMPORARY EMAIL ADDRESS: mahtani(a)vaxvmsx.babson.edu | |_______________________________________________________________|

1 0

Re: Dems Critique Crypto Policy
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

John Young wrote: ADDITIONAL MINORITY VIEWS > > John Conyers, Jr. > Rick Boucher. > Zoe Lofgren. > Maxine Waters. > William Delahunt. > Martin T. Meehan. > We need to be honest about this situation. We don't expect > most narcotics traffickers, terrorists, or criminals to respect > export restrictions on encryption when they don't respect our > underlying drugs or weapons laws. And we don't generally expect > anyone who employs encryption in furtherance of a crime to > readily give their keys to some third party so they may be made > available to the government. The government doesn't expect it, either. As a matter of fact, they are probably sitting back laughing their asses off over your eloquent statements of logic which any rational person could reproduce if they weren't programmed to feed unthinkingly off of government media sound bytes. All of your points are well-taken and they will make no more difference than similar ones have made in the past. You will speak your mind politely while the government goes about usurping the few remaining privacies and freedoms we have. In the meantime, the nation is keeping busy bemoaning the fact that not everyone is going to be so polite in their protest of the government assault on the liberty and freedom of the citizens. The nation is busy venting their rage on a government mandated monster, as always, instead of admitting that there is a much greater monster in our midst which is slaying more of our citizens in a variety of ways than McVeigh could ever dream of. TruthMonger

1 0

Intro to Cyptosystems talk 6/23 7pm
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: net-thinkers(a)thumper.vmeng.com Reply-To: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> Mime-Version: 1.0 Precedence: Bulk Date: Mon, 9 Jun 1997 14:32:34 -0700 From: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> To: Multiple recipients of <net-thinkers(a)thumper.vmeng.com> Subject: Intro to Cyptosystems talk 6/23 7pm ever wondered what the buzz about cryptography is all about.. You are all welcome to attend my "Introduction to Cyptosystems" tutorial at the BMUG South meeting.. It's open to the public. When: Monday, Jun 23 Time: 7:00 PM Where: Town Hall, Apple R&D Campus (blding 5) How long: 60 mins or so? --------------- Q: Why should you care about this stuff..? A: The internet is not a secure channel, It's easy intercept your email or files or even know what webpages youve been looking at. Cryptography is a tool that provides you privacy and protection from competitors and the news media scum. How much do you trust to the internet? Cryptography is also the best protector of the most cherished civil liberty: "the freedom of speech" Q: But I have no secrets to keep? A: Cryptography is not just about secrets, In addition to providing confidentiality, modern cryptography holds the building blocks necessary for successful electronic commerce. Authentication: The receiver of a message can ascertain it's origin; an intruder should not be able to masquerade as someone else. Integrity The receiver of a message can ensure that the data has not been modifed in transit; an intruder should not be able to substitute a false message for a legitimate one. Nonrepudiation A sender should not be able to falsely deny that he sent a message Q:Why should I care about electronic commerce. Apple hasnt done anything with it? A: That the point of this talk. E-Commerce will be a bigger market than anything we have ever been in before. Ask yourself, What is the biz proposition for anyone publishing on the NET and the answer will be net commerce. Q: what will you talk about What is Cryptography What it's used for How Cryptosystems work secret/public key encyption, digital signitures, modern crypto systems key management, e-commerce, Governement Issues This talk is NOT about Theoretical Mathematics Programming APIs Specific Products Who this talk is for Marketing Evangelist Engineer Anyone who needs to be Crypto competent There is a PDF of the slides at http://www.vmeng.com/vinnie/papers.html Vinnie Moscaritolo That Crypto Guy at Apple... http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: Fraud and free speech
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tim May wrote: > > At 5:51 AM -0700 6/8/97, William H. Geiger III wrote: > >Well I think that there are some that would confuse the issue between 1st > >Amendment free speech and the issues surrounding fraud. Especially those > >in government who write the laws that regulate commercial speech. > > The mistake has been to extend "fraud" laws to non-contract situations, > e.g., ordinary speech (as distinguished from contracts). Any time that you see a thread in which Kent Crispin accuses someone of trying to "muddy the waters" you can pretty much guarantee he is trying to throw a logical curveball of his own. Kent added some tripe to the thread supporting his favorite theme, which is that it is the job of government to "enforce" contractual agreements. Naturally, he also extends the format of these contracts to include government authority to enforce criminal penalties for statements made by the great grandfather of the second cousin of the spouse of one of the person making the contract. Follow any thread after a Crispin post and you will find people arguing over issues he raises which have little basis in reality. > Contracts, with clearly stated conditions and with judgeable or > falsifiable/testable conditionals, are a matter for the courts (private > courts, in fact), but vague promises, advertisements, propaganda, etc. are > not. Dimitri wrote a couple of posts which dealt well with the original concept of two parties agreeing on an arbitrator/judge to settle contractual disputes (e.g. the court of Prince X) and the following usurpment of these free-will agreements by people in power who decree that _they_ are now the only valid arbitrator/judge in contractual matters. We now have a system where if someone breaks agreement with you the government locks them in a cage where there is no possibility of them paying you what they are contractually obligated to. The government doesn't give a fat rat's ass what your desires are for resolution of the dispute. They are always busy protecting the nebulous "other" rather than someone real, with a real interest in the situation. The government mandates that contractual agreements must be settled in a forum where the corporation with an army of lawyers can bury the attorney that Joe Average picked out of the yellow pages. When you enter into a contractual agreement with someone who has a guy named "Big Louie" as arbitrator, however, the government calls it organized crime. Pardon me if I fail to see the distinction. TruthMonger

3 2

AES Comments to NIST
by John Young 17 Dec '03

17 Dec '03

NIST has published the 33 comments received on the proposed Advanced Encryption Standard (AES) intended to replace DES. Several are quite extensive. In addition to those exemplars we've seen here by Bill Stewart and Bruce Schneier, there are remarks by several crypto luminaries, such as Ron Rivest and Clifford Adams (author of CAST), by NSA, by Canada's CSE, and by Certicom, 3Com, TIS, MasterCard, the ANSI X9 Standards Committee, the ABA and so on. http://jya.com/aes-comments.txt (103K)

1 0

My War
by se7en 17 Dec '03

17 Dec '03

Way back when in 1995 when I stopped lurking on this list and became a regular poster, one of the things I quickly became known for was my on-line harrassment of those who had stepped over the line in one manner or another in a way that would ultimately hurt us as a group overall. Many old-timers here will remember my harrassment of Curtis Sliwa and Colin Hatcher of the Cyberangels (a.k.a. Guardian Angels). These were the fools who organized a worldwide volunteer police-wannabe force that searched out indecency (in the generic and ill-defined sense of the term) on the net, which when one dug further into their agenda, found it was just a ploy for funding and political power. My incessant harrassment led to the revelation of many things, most importantly that their leader had never ever been on the WWW, stating that he didn't have time to do so. This despite the fact he had time to organize a police force to patrol it. There have been many others since then, most not as evil as the Cyberangels. They each had their own reasons for harrassment. Among some of them have been Carolyn Meinel, O.J. Simpson, Captain Crunch, and Gambit. As many of you know, I make a living as a professional speaker, with federal government, military and intelligence communities as my core audience. Let me put any fears anyone may have to rest: my work concentrates in Information Technology more than anything else, and if I get into hackers and hacking, it is more pro-hacker than anything else. I am working to improve our image as a community of talented individuals. I recently went off on a serious rant with three different audiences on a topic I felt was seriously exaggerated/over-hyped/fearmongered/bullshit. That topic was child pornography on the Internet. If you believed the press, child pornography was all over the Internet and easy to get. This brought about even more press and some action by our legislators to crack down on the Internet. I conducted an eight-week long search for child pornography late last year in the middle of this hype. I searched for, followed literally tens of thousands of links and hacked into pay/private porno servers all over the world. My opinion based on my results, which were not having found a single picture of child pornography anywhere, was that this whole topic was a bunch of bullshit. Well, that all changed a few days ago. I had asked for a software crack in a public USENET forum to override the NT4.0 Server 120 day time limit. While never receiving the crack, some idiot from an anonymous address sent me a child porn .jpg file. Trust me when I say it was child porn; the girl was no older than four years old and was very graphic. I immediately deleted all trace of the message/attachment. I was also very pissed to say the least that some asshole sent me this. I looked around on IRC on #teensex, and by whois'ing several operators, found more insidious channels. Among them are: #preteensexpics #littlegirlsex #100%preteensexpics #100%preteensexfuckpics #!!!!!!preteensexpics There are many others. I joined several of these channels and found that upon entering each one, I was auto messaged about special kiddie porn servers dedicated to trading, e.g., PreTeenSexPics - FTP at 130.67.80.230 l/p ncc/ncc [|] I logged onto several of these servers, and upon doing an ls-la found directories dedicated, among others, to child pornography. CD'ing into these directories listed several hundreds of files such as: 9yoshowr.jpg 8&dad.jpg 4yrfuck.jpg 6thgrade.jpg 6yoanal.jpg These are some of over several hundreds of files in a single directory on a single server. There were dozens of servers. I learned the protocol to download on these servers was to uplaod pictures you owned and then the operator would give you "credits" of various ratios for downloading, i.e., upload two pictures, you get credit to download one picture. I uploaded generic garbage pics off of a commercial adult web site, and recived credit to download three pics. What I saw wanted to make me physically vomit (yes, these pics are long since overwritten with 1's and 0's and destroyed). To put any doubts at rest, the material was real and fit the names of the files mentioned above. I was also actively sent private messages by those looking to trade. I asked what they had, and the usual response was "anything and everything." Some of the more common messages were: "I have 4-12 year old girls both action or pose." "I have little boys and girls alone or together." "I specialize in adults with 4-8 year old girls." I started logging the channels. I wanted to silently gather IP addresses and email addresses. These people needed some genuine hacker terror. Among some of the more active and persistent traders were: (*denotes server in operation) * SylphFox has a ftp at 206.246.162.183 1:2 ratio, anon login * <hehe(a)ts33.dac.pace.edu> * <kiddie(a)t2o15p13.telia.com> <suicide(a)mail1.arnan.com> <alexis(a)broken.dartmouth.edu> <guinness(a)broken.dartmouth.edu> <nexgen(a)philly158.voicenet.com> <tuvak(a)ppp-5200-0403.mtl.total.net> <Triad(a)an108.tir.com> <seeme(a)star090165.galstar.com> <domain(a)port182-tnt-ak-2.ihug.co.nz> <lewisJ(a)user-37kb329.dialup.mindspring.com> name: Lewis Johnson <fungus(a)infounik.com> <tk(a)conc0-a03.conc.tds.net> <pyro(a)user-37kb97d.dialup.mindspring.com> <hat(a)dialin9001.slip.uci.edu> name: Tuyen Ha <phostis(a)har-ct5-03.ix.netcom.com> <polls(a)175-203-179.ipt.aol.com> This log was generated in thirty minutes on #100%preteensexpics. If their email address appears above, it indicates they were actively offering trades or had servers in operation. These people listed above *were not* passive participants in the rooms. This represents only a small sampling of the overall people in the room at the time. Average number of people in each room varies, but seems to number about 40 people per room. I logged out of IRC, and then went to USENET, in such rooms as: alt.binaries.erotica.children.pre-teen There I found several hundreds upon hundreds of .jpg files of real child pornography. Several messages also pointed to some WWW sites, such as: http://www.nudebooks.com For someone who took a virtual tour of the kiddie porn world for only one day, I had the opportunity to download enough files to fully max out an IOmega 100MB ZIP disc. **This is not an exaggeration.** Imagine how much could be, and has, been downloaded by those who are regular participants in this activity. Well, this whole situation is unacceptable. First, I would like to apologize to all those who have hired me in the past, and were subject to my emotional rants about how the whole subject was bullshit and not real. It is very real. It is disgustingly real. It is so real it will make you want to throw up, and I actually, physically did throw up last night. Second, in reference to previous conversation over the years on this list, and in the hacking community in general, I know this type of activity is not tolerated by us. I have given you enough information above to start identifying the players in this and the places they congregate. It would be my sincere hope that hackers of all abilities would spend a few moments each day and put their talents to use against these people. Yes, I am advocating malicious, destructive hacking activity against these people. Who are they going to run to? The police? "They hacked my kiddie porn server and rm -rf'd my computer!" Right...the police will be so anxious to lock us up left and right. These people need to be eradicated from the Internet. While that may never happen completely, enough harrassment will send a message that engaging in this type of activity in very dangerous, and can result in serious harrassment, public embarrassment and computer destruction. This is my war. It will be a public war. I don't care what happens to me by their community or by law enforcement. I feel secure enough that no jury in the world will convict me for taking these people out. I feel secure enough that no law enforcement agency will ever take action that would place me in front of a jury. And if by some chance I do end up being prosecuted, I know what I did was right. So, now start the logs of the channels and the actions of those in it. Now starts the public postings of these logs in various places on the Internet. Now starts the harrassment. Now starts the malicious hacking. Now starts the war. I don't expect people to join me here on this. If you do, you have enough information to start. I caution you to log what is going on, and to make sure you are hitting the guilty, so no innocent people get annihilated in the process. Make damn sure you know who you are hitting and why, and be able to back it up with the idea of having to justify your actions in front of a jury. And make *REALLY SURE* that if you do come across files of child pornography, that you *OVERWRITE AND DESTROY* these files immediately! You wouldn't want to be the one who ends up being prosecuted for being in possession of this type of material. I would also recommend getting an anonymous email account, such as juno.com, mailmasher.com, hacked, etc., so that you can conduct your activities without fear of the inevitable retribution of those who actively trade this shit when the heat starts getting applied to them. Of all the people who can help stop this, it is us...hackers. Not law enforcement, not the government, not the media. Not anyone. Just us, hackers who have the talent to do what no one else can. Please forward this message freely around the Internet. It is not copyrighted in any way, shape, or form. se7en

12 18

Access to Storage and Communication Keys
by Bill Stewart 17 Dec '03

17 Dec '03

The government and its friends have tried for a while to convince the public that there's a great business market for access to keys by the Proper Authorities, whether bosses or cops. A number of us on the Pro-Privacy side have contended that this is wrong - the business need is for later access to stored files, not to encrypted communications keys and of course not to signature keys. Having argued that point vociferously in the past, I'm now going to waffle on the issue - while the business need is for access to stored data, this may often include stored messages received from a communication system in encrypted form. Either the User Interface needs to make it convenient to store the decrypted message, or else the user will store the message in encrypted form - which means there may be a business need for Proper Authority Access later. This means, as {cypher,coder,ranter}punks, we need to address this problem when building crypto tools, to avoid building systems that create or sustain a business need for access to communication keys. Some email systems really encourage you to save messages in one big hulking undocumented monolithic email box, with subfolders and databases and attachments and pointers, and some are a bit more friendly but still leave bits and pieces of MIME splattered on your disk. Some of the nicer tools I've used for encrypted file/mail handling make it convenient to take encrypted incoming mail, decrypt it, and either view it or save it to a file or clipboard. I've been using PGP Inc.'s PGP5.0 Eudora Plug-In, and it decrypts the mail into the mail message buffer itself. When you finish with that particular message (e.g. go to the next, or just close it), you get asked it you want to save the modified message, and if you say "yes" you'll have the decrypted message in your mailbox. However, there's a negative about this - if you receive mail that's signed and encrypted, and save the modified version, it loses the signature information - so it may be more valuable to save the encrypted version... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list or news, please Cc: me on replies. Thanks.)

3 2

[Noise, California only] Good deal on ISDN access
by Lucky Green 17 Dec '03

17 Dec '03

[I have been sick at home all day, when I just couldn't sleep anymore I hit the web. I hope this makes sense...] Given that a good number of people on this list live in CA, this might be of interest to you. It certainly was to me. PacBell is selling flat rate 2B ISDN Internet access at $50/month. Plus the regular home ISDN fees, but this is still much cheaper than what I paid before. You might want to think hard before you buy at new 56k modem that in all likelihood won't be able to give you 56k anyway. And no analog modem will ever give you 128kbps. Analog lines aren't made for data. They aren't particularly good for data. That's why ISDN was designed. It didn't take off until recently, since it was priced for business and business decided they didn't need it for various reasons. But at these prices, you'd have to be a starving student or nuts not to get it at home. http://dialup.pacbell.net/ISDN/ Disclaimer: I have no financial interest in PacBell. It would be nice, though. :-) --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. Put a stake through the heart of DES! Join the quest at http://www.frii.com/~rcv/deschall.htm

3 3

Who is an encrypted message for? [PGPtray/Eudora]
by Bill Stewart 17 Dec '03

17 Dec '03

[Fred, could you forward this to pgp-users? Thanks.] PGP 5.0 GUI on Win95 does this for both PGPtray and the Eudora plug-in. When you want to decrypt a message, it doesn't tell you who the message is TO when asking you for the passphrase. Therefore, if you have more than one user id with different passphrases, you don't know which one to type in. Also, from a security perspective, this is bad, because what you do with the contents of a message may be different depending on who it came to or from - was that mail asking for the Secret Plans addressed to your individual Work key, your department key, your home key, or your Illuminati Conspiracy key? This appears to be Versionb b14c3, though it's not easy to find out, and I'm not sure if that's the version of PGPtray, PGPkeys, or both... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list or news, please Cc: me on replies. Thanks.)

1 0

Re: Access to Storage and Communication Keys
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In <3.0.1.32.19970609000938.00756910(a)popd.ix.netcom.com>, on 06/09/97 at 12:09 AM, Bill Stewart <stewarts(a)ix.netcom.com> said: >I've been using PGP Inc.'s PGP5.0 Eudora Plug-In, >and it decrypts the mail into the mail message buffer itself. When you >finish with that particular message (e.g. go to the next, or just close >it), you get asked it you want to save the modified message, and if you >say "yes" you'll have the decrypted message in your mailbox. However, >there's a negative about this - if you receive mail that's signed and >encrypted, and save the modified version, it loses the signature >information - so it may be more valuable to save the encrypted >version... Well this is why I tell everyone to clear sign the message first and then encrypt it. In my PGP GUI/E-Mail integration E-Secure this is the default behavior. IMHO encrypting & signing (-sea) is a PITA (for the reciever). I also verify signatures of all signed inbound messages and append the output from PGP to the bottom of the message so that you can see the results when the message is opened without having to re-run PGP. The user also has the option to either decrypt messages as they are retreived or to store them encrypted. I just released the first beta of my auto-encrypt code. That was quite fun to write. Myself am rather disturbed by how many PGP/E-Mail implmentations handle signing/encrypting of messages. One of my biggest pet peeves is when only the plain text of a message is signed/encrypted. I have seen this with more than 1 implementation and I see it as a serrious security flaw. Another issue that is usally missed is Bcc's. The whole purpose of using Bcc's is that you don't want the rest of your distribution to know that you have sent a copy to the addresses on the Bcc line. If you encrypt a message with multiple keys including keys for your Bcc's then your Bcc's will be known to everyone who recieves a copy of the message. What I have done to address this is to send seperate copies of the message to each address on the Bcc list each encrypted with only the one key for the address. You can have the strongest algorithms in the world but they do you no good if they are poorly implemented. - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBM5u7uo9Co1n+aLhhAQH/sgP/V/ulJSLuNEV+sBW1hAnRsbYizxUb3tbc eJtG6YZnhszgjmj0ybgA/yfIC3i9uXjvuZeRdyrD9YSTf0a0gWOkcAzhhB/A5XBj Kf80HEXiJhd9dLSxYUGD55QFQNtz1QGbEGCURLyCchuWa0KrpLUofvUZ0cfatk+3 VKbfYn0KMTA= =vvGI -----END PGP SIGNATURE-----

1 0

Get your site Noticed!
by wgrip＠arcturus.net 17 Dec '03

17 Dec '03

Hello, Do you have a webpage that's just sitting there? Need more hits and visibility? Now you can promote your pages like the pros! The WebSeek Promotion Spider puts your pages on the TOP of the Search Engines! Get your FREE Shareware Version today and see what this powerful program can do for your site!! For more info please respond to our Autoresponder at: netnow(a)arcturus.net and say "Promo-Now" Resellers Needed! thanks, Web Promotions! ~~~~~~~~~~~~~~~~~~~~~~~ Note: You will not receive another message BUT we do utilize the Remove List at: remove(a)cyberpromo.com

1 0