December 2003 - cypherpunks-legacy

Re: PERRY METZGER: YOUR MOMMY IS CALLING YOU HOME
by bshantz＠nwlink.com 17 Dec '03

17 Dec '03

>I'm tired of Perry. <REST DELETED> I think that any Perry bashing can be taken offline. I don't think that 700 people subscribed to the "I Hate Perry Metzger" list; they subscribed to cypherpunks. If you have anything to say to Perry, tell him in private e-mail. Don't post a milion lines of shit to the list. Get a clue folks... Brad

1 0

It may be time to electrify the floor...
by rah＠shipwright.com 17 Dec '03

17 Dec '03

... because we seem to be in the throes of a listwide piss-fight. Unless we're the victim of duelling rant generators -- but I don't think this is the case, as they all happened too fast. It's a nice night. Maybe I'll go sit on the back porch and smoke the base-ball-bat Macanudo (cigar) I bought at Erlich's today... See you all in the morning. Don't forget to insulate yourselves, everyone... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

"Protect the children" as passphrase to Constitution
by tcmay＠got.net 17 Dec '03

17 Dec '03

I was reminded the other night by someone of the "'National security' is the root passphrase of the Constitution." The idea being that the normal Constitutional protections are bypassed by invocation of "national security." But it occurs to me that we are seeing a new variant of this: "Protect the children." Some recent examples: - Clinton's Executive Order today which limits advertising of cigarettes, limits the display of tobacco-related symbols and words on t-shirts, baseball caps, billboards, and publically-visible signs at sports events. (There were all kinds of details, most of them blatantly in violation of the First Amendment. I half-watched the Clinton announcement, but didn't take notes...consult your newspaper or the Web.) The critical phrase: "We have to protect the children." (Oh, and one amazing detail: the possible issuance of I.D. cards to all of those under the age of 18. Besides being useful for things like curfews, video tape rental prohibitions, and the cigarette ban, it would lead to I.D. cards for those over 18. naturally (if those over 18 don't have to carry them, then all a child less than 18 has to do is to claim not to have to carry one because he's 18!) - The whole Exon and V-chip debates, now likely to be passed by Congress, are about "protecting children." - and the Oklahoma City bombing, not that I supported it in any way, was seen as especially horrific because of the children that were killed. This means that restrictive legislation, such as bans on explosives information, guns, etc., can be justified as measures to "protect children." And so on. Now clearly this strategy will be welcomed by many. It's hard to argue against children and against the "protection of children." Arguing the Constitutional side is tough when "the children" are at issue. More speculatively, I think Clinton has hit on this strategy as a way to line up support from the Republican majority in Congress on many key issues. There may even be repercussions for welfare and health care issues (which Clinton can also cast as "protect the children" issues). The potential crypto relevance? Look for arguments about limiting access to strong crypto to be more heavily focussed on "pedophiles" and "pornographers." Look for calls to have a national I.D. card--which serves many State-needed purposes (and I don't mean in terms of Revelations). A national I.D. card could then be tied in to GAK/escrow systems. "We have to protect the children." --Tim May Special note: My ISP has changed its domain name from "sensemedia.net" to "got.net" (as in "got milk?"), so I have to again ask you all to bear with me and use my new e-mail address, "tcmay(a)got.net". ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

SSL bruting progress (was: Crypto-relevant flame interruption)
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Fred <admin(a)dcwill.com> wrote on cpunks: > Would someone be so kind as to provide a status report on the > planned SSL attack? Last word was that codework was still underway, > but I might have missed something relevant to this project amidst > all of the noise about excessive list noise. There has been no public announce. This is due to a desire to make real sure it's going to work before announcing. So, we're working on it. Software is basically all there, but we're experiencing difficulties, like during a trial run no key for Hal's challenge seems to be being found, even though the same software finds test keys. We've not managed to isolate the cause of it, as (two people) have nearly swept the entire keyspace (heh they had a bit of spare compute) and no key has been forthcoming so far. Give it a few more days - until monday - and if no key is found we've got problems, 3 possible outcomes looming: a) we find the key to Hal's challenge and go whoopee! Request a 2nd challenge from Hal? and announce a public sweep to see how fast it can be done. b) something is wrong with the interpretation or the gathering of the SSL session data Hal based his challenge on (difficult to see as there are numerous fixed fields which tally with the SSL spec.) c) software problems (also difficult to see, the software in all cases (3 separate versions) finds the keys of examples provided by Andrew Roos (ie he generated a key manually, so we know where to start for testing purposes)). The likelihood of a) happening is receding, as the last key space gets ticked off. More news next week. Adam

2 1

Re: PERRY METZGER: YOUR MOMMY IS CALLING YOU HOME
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Brad Shantz writes: > >I'm tired of Perry. > > <REST DELETED> > > I think that any Perry bashing can be taken offline. I don't think that 700 > people subscribed to the "I Hate Perry Metzger" list; Nah, that list is way bigger than cypherpunks.

1 0

Re: "Protect the children" as passphrase to Constitution
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Every time I hear some porker say, "Protect the children," the BS translator that resides in my brain replaces the word "Protect" with the words, "Treat adults like." Probably a mental defect. JMR PS RIP Jerry G. Let's cease the flamewar for 24 hours, in memory. - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMCq1/m1lp8bpvW01AQGg8gQAiq+kzyQopCLFQtzPhr4WIN42I41ZDPyh 1qH1/DBHAS8BaNqK8f9jObEvG4a5dlpbzp5c0FdJ2cbcZtG/GZIG3clUPNd0cqtf hR1abL8pTgoj7WMclOMF6iclzRn/fcHY9VawZHT10At3I11eyjOq3hBsfIU1c1IG 9pjlPeEW/IE= =Ci1C - -----END PGP SIGNATURE----- Regards, Jim Ray PGPsign all your cleartext messages! [Makes the statists nervous.] - ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 - ------------------------------------------------------------------------ Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! email: zldf(a)clark.net or visit http://www.netresponse.com/zldf ________________________________________________________________________ - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMCq3ESoZzwIn1bdtAQGfFQF9FL9ptx5QVfg6nGL+NePHg6cuq3B2fa/U 9Ir2SmI6NZQPgjvFtCPO9ZmepaLBkEqs =+nDm -----END PGP SIGNATURE-----

1 0

UHS encoding
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

has anyone heard of UHS ? ? its universal hint system . . its for game hints . . its data files are encrypted and a decoder decodes only the hints you need . . anyone know what encryption is used ? ? its probably very weak but a good idea . . i wonder if this is export - restricted too ! ! --

1 0

PRZ encrypted voice software release imminent
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

as if PRZ is not already enough of a folk hero.... BTW, he has been beat by Nautilus, right? Nautilus is public domain, right? (I'm thinking of that public domain voice encryption released a few mos ago). I wonder if he is going to try to put a "spin" on this one to differentiate it from the other one. on the other hand, just having his name on it is plenty of "spin"... ------- Forwarded Message - ------- Forwarded Message Date: Thu, 10 Aug 1995 06:47:31 -0400 (EDT) From: Brad Dolan <bdolan(a)use.usit.net> Subject: Washington Whisper from U.S. News (fwd) - - ---------- Forwarded message ---------- Date: Wed, 9 Aug 1995 21:26:42 -0700 Subject: Washington Whisper from U.S. News From: Vic Sussman <vic(a)clark.net> U.S.NEWS & WORLD REPORT, AUGUST 14, 1995 TAPS FOR THE CODE BREAKERS The cryptographer who riled the federal government over his popular encryption software, PGP (``Pretty Good Privacy''), claims he is only a few weeks away from launching yet another dazzling piece of software: PGPfone. Philip Zimmermann's latest product permits virtually untappable telephone conversations through personal computers. But the launch of the software, which uses military-grade encryption to scramble transmissions, is likely to sharpen the debate among those who worry about such technology falling into criminal or enemy hands and those who consider it essential for secure communications, especially on the Internet. In a test of the new software last week, a U.S. NEWS writer, using a microphone-equipped laptop in Washington, found the encrypted conversation with Zimmermann in Boulder, Colo., to be remarkably clear. Zimmermann, who ran afoul of the government over charges--strongly denied--that he illegally ``exported'' the PGP software on the Internet, says he plans to give away his new software for free. Why? ``I can't simply stop doing what I do because I'm afraid of angering the government,'' he says. ``Americans have a right to private conversations.'' Copyright, 1995, U.S. News & World Report All rights reserved. ............................................................................. Vic Sussman : "Lines of light ranged in the nonspace U.S. News & World Report : of the mind, clusters and constellations vic(a)clark.net : of data. Like city lights, receding..." http://www.clark.net/pub/ journalism/vic.html : _Neuromancer_ William Gibson .............................................................................. - ------- End of Forwarded Message ------- End of Forwarded Message

1 0

No Subject
by Ford Prefect 17 Dec '03

17 Dec '03

I think we ought to just throw TIM MAY out of the list. let's EXCOMMUNICATE HIM. its becoming increasingly clear that he is the source of all our problems. I mean, isn't it obvious that our progress has stalled? who has written any code within the last 3 days? if we got rid of him, it would be EVOLUTION IN ACTION. this is ERIC HUGHES' mailing list, and eric hughes knows how to write some decent code. I mean, TCM's signature doesn't even have any geek code, and he hasn't changed it in 4 years or so, at least since my last grandparent died (and she was considerably more skillful at programming than TCM by knowing how to make toast). get rid of all the pricks who continually spout and spew conspiracy theories. let TCM go and find himself a new mailing list. that would be a fair comeuppance if he found that he couldn't learn to do squish because he doesn't have the slightest clue. he's a leech, a parasite, sucking on the work of others, pretending that he is at the forefront of our cause when he is only at the forefront of maniacal egomania. what has he contributed to the cause? SQUAT. just a lot of ranting about conspiracy theories and his Stock Pick of the Week crap. "the web is really growing. people should focus on it". well, THANK YOU VERY MUCH, MR. BRILLIANT COMMENTATOR AND VISIONARY, T.C.MAY, I would have never have THOUGHT of that in a zillion years, but now that you point it out, I GUESS YOU'RE RIGHT.

4 3

No Subject
by David L. Garrard 17 Dec '03

17 Dec '03

---------- From: Ford Prefect[SMTP:remailer@bi-node.zerberus.de] Sent: Friday, 11 August 1995 2:31 To: cypherpunks(a)toad.com I think we ought to just throw TIM MAY out of the list. let's EXCOMMUNICATE HIM. its becoming increasingly clear that he is the source of all our problems. I mean, isn't it obvious that our progress has stalled? who has written any code within the last 3 days? if we got rid of him, it would be EVOLUTION IN ACTION. More drivel deleted. Personal attacks in this mailing list is highly inappropriate but doing through a Remailer is downright pathetic. Dr David L. Garrard

1 0

Re: PRZ encrypted voice software release imminent
by Richard.Johnson＠Colorado.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >BTW, he has been beat by Nautilus, right? Nautilus >is public domain, right? (I'm thinking of that public >domain voice encryption released a few mos ago). >I wonder if he is going to try to put a "spin" on this >one to differentiate it from the other one. on the >other hand, just having his name on it is plenty of >"spin"... When I originally volunteered to help with coding on the PGP voice stuff, the author (I think) of Nautilus sent me, and the rest of the PGP voice mailing list participants, version 0.2 for review. The initial plan was to take the Nautilus code, rewrite it in a more modular fashion, and add encryption to create voice PGP. However, the incarnation of the PGP voice mailing list we were using for the project just died, and I heard nothing more about Nautilus after I submitted my comments and suggestions -- until the release of Nautilus 0.9. So if Nautilus code was not used in PGPfone, I suspect licensing or other such issues got in the way, and Will Price and crew started from a different base. Then again, perhaps Nautilus and PGPfone have much in common. We'll have to wait for the PGPfone release for the answer. Richard -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMCrPhfobez3wRbTBAQHM8AP6AjrIg3j2FjRW1vXSLJQ201cTbOic9Tms 3e6TtCdKu4m9OfOyJDIa+RuW+gRIpF8uBmhDAT8d50rhWa9RdEqAgxRSS6mLtzho ExxjSaX3JPdbZjW5G6kMamN9czMFd1hfkxfBMTMVLFdnYzUhG/MQZCyJzLHqcy0c idV9OPHTrck= =bGwv -----END PGP SIGNATURE-----

1 0

If only Vxxxx Fxxxxx had used encryption....
by monty.harder＠famend.com 17 Dec '03

17 Dec '03

C'punks: [Wait! This =is= crypto-related! I promise!] Heard on the news today that Bernard Nussbaum said he had done "nothing irregular" in going through Vince Foster's effects immediately after his demise, in order to secure "sensitive information". Presumably, Nussbaum's contention is that some of the information in Foster's possession was covered by attorney-client privelege, and therefore the Authorities had no right to take it into possession. (IANAL-Comments from those who are?) Anyway, this case got me to thinking: If Vince had kept all his "sensitive" things encrypted, and never written down the passphrase, then the data would effectively have died with him. In this case, lack of key escrow is not a bug, but a feature! Then I thought some more - that the whole Key Escrow thing needs to be rethought: Instead of escrowing the private key, we need to develop better key management techniques for multiple recipients. For example, if Alice is an attorney representing Carol Client, Bob and Ray are partners in Alice's firm, which uses escrow agent E; and A, B, C, R and E are the public keys (and A'... are the private keys) of our dramatis personae: Carol sends her message to Alice as usual, generating the session key S, and encrypting it S'=A(S). Whenever Alice recieves a message, after decrypting the session key [S= A'(S')] she adds to it an additional S"= E( B(S) ) and S"'= E( R(S) ) or some other construct which involving Shamir Sharing or whatever. The details of the protocol(s) can be worked out after the basic premise: There is no reason for anyone to give up the "master key" to all of their business, when the minimal overhead in storage space for adding an escrowed =session= key will suffice. PGP needs a mechanism to handle "detatched session keys", so that our escrow agent can, upon notification by Bob and Ray that Alice has [died | left the firm], process the whole package of S" and S"' back into B(S) and R(S), so that Bob and Ray can carry on their work. Just as with a detatched signature certificate going to a notary, the detatched session key does not give the escrow agent any knowledge of the content of the message itself. Another option is to put the whole creation of S" and S"' on to Carol, which requires a public key that specifies E and {B, R}, as well as the particular escrow protocol involved. This could be tricky to implement. Also, Carol needs to be able to specify to Alice that she is retaining a copy of the communication, encrypted to self, and therefore Alice need not escrow the session key for this particular message. Comments? * "All authority belongs to the people" -Thomas Jefferson --- * Monster(a)FAmend.Com *

2 1

Re: PERRY METZGER: YOUR MOMMY IS CALLING YOU HOME
by blancw＠accessone.com 17 Dec '03

17 Dec '03

Hell hath no fury like a martyr scorned. . .

1 0

Re: More "S-1" foolishness (fwd)
by Michael Froomkin 17 Dec '03

17 Dec '03

How about this? A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | mfroomki(a)umiami.ir.miami.edu U. Miami School of Law | P.O. Box 248087 | It's hot here. And humid. Coral Gables, FL 33124 USA | See http://www-swiss.ai.mit.edu/6095/articles/froomkin-metaphor/text.html and http://www.law.cornell.edu/jol/froomkin.htm ---------- Forwarded message ---------- Date: Thu, 10 Aug 1995 23:34:42 -0400 (EDT) From: Dorothy Denning <denning(a)cs.cosc.georgetown.edu> To: mfroomki(a)umiami.ir.miami.edu Cc: denning(a)cs.cosc.georgetown.edu Subject: Re: More "S-1" foolishness (fwd) Thanks for sending all this stuff. The algorithm is definitely not Skipjack. Feel free to pass this along if you'd like. Cheers, Dorothy

1 0

Crypto-relevant flame interruption
by SysAdmin 17 Dec '03

17 Dec '03

Would someone be so kind as to provide a status report on the planned SSL attack? Last word was that codework was still underway, but I might have missed something relevant to this project amidst all of the noise about excessive list noise. Fred <admin(a)dcwill.com>

1 0

Clinton to resign?
by Brad Dolan 17 Dec '03

17 Dec '03

Associated Press reported on August 10, 1995: President Won't Resign But... (WASHINGTON) President Clinton wasn't about to give a serious answer when he was asked Thursday if he might resign. The question came from veteran columnist Sarah McClendon, who asserted that some legislators from the left and right were trying to push him out of office. [...] "Well, if you promise to run off with me I might," Clinton responded, ... "But otherwise, I can't think of any reason." - - - - - - - - - - Repeat after me: There's nothing to those crazy conspiracy theories. There's nothing to those crazy conspiracy theories.....

2 1

Re: This summer's special delivery?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <ac4eb0c9030210046e6c(a)[205.199.118.202]>, tcmay(a)got.net (Timothy C. May) wrote: >I have nothing further to add on this. But recall that it was just about >this time last year--just before Crypto--that the "alleged RC4 code" was >posted anonymously to the list. Do I recall correctly that that RC4 proved to interoperate with the "real" RC4? - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMCr2PCoZzwIn1bdtAQEUPAF/S1arfdr01B+/o5MlEX6F60NHUL6vgEPQ sv3264ZCsJAl7TBqqyi1a6baBF7uuTh+ =jhLU -----END PGP SIGNATURE-----

2 1

Re: "Protect the children" as passphrase to Constitution
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:35 PM 8/10/95 -0700, Tim wrote: >- Clinton's Executive Order today which limits advertising of cigarettes, .... >(Oh, and one amazing detail: the possible issuance of I.D. cards to all of >those under the age of 18. Besides being useful for things like curfews, What!?!?!?! I guess I'm not totally surprised - registration of all children has been high on Clinton's agenda ever since he's been in the White House. One of the more blatant examples was the child vaccination proposals - which first started out as "take over the vaccination system and register all kids so we can remind their parents to get their shots", and gradually included less and less control and funding of vaccination while retaining the registration. Sigh. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- Storyteller makes no choice - soon you will not hear his voice. His job was to shed light, and not to master. RIP, Jerry

2 1

Re: "S1" encryption system (was: this looked like it might
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:13 AM 8/10/95 -6, you wrote: As with Peter and Nathan, I'm also a former tool of the military-industrial complex (:-), and Peter's right that the probably source of this assertion is that there's seldom any "vanilla" TOP SECRET data - anything that's sensitive enough to get TOP SECRET handling rules is usually part of some compartmented project (compartmentalization is a formalized version of Need to Know, where you need to be read into PROJECT X to get PROJECT X data.) Sensitive Compartmented Information is one well-known class of stuff. Codeword projects are identified by words picked off a list of content-free names; some codewords that have been outed in the past are ULTRA and UMBER. In addition to project-specific classifications, some of the kinds of labels on material include variants on INTEL, CNWDI (Critical Nuclear Weapons Design Information), RESTRICTED DATA (less critical nuclear weapons data), FORMERLY RESTRICTED DATA ( a weird classification for material that isn't RESTRICTED DATA any more but they still don't want to let folks see.) And then there's the sort of data that's SECRET by the time the people doing the grunt-work see it, but it's various extracts of REALLY SPOOKY DATA, that only a few people back in some agency know the whole picture, and it's parcelled out so one group of people gets asked to build a laser-scanner like this, and another gets asked to build a computer system like that, or a mirror adjuster like that, and none of the grunts know whether the whole deal is personal teleportation system (the cover project) or a space-based assassination system, much less how they decided on the targets.... #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- Storyteller makes no choice - soon you will not hear his voice. His job was to shed light, and not to master. RIP, Jerry

1 0

Australia, EU crypto ill news, crypto wars
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Just read this on comp.risks, by Ross Anderson (via a couple of people). A crypto relevant forward if any is relavent IMO, especially this bit: Ross Anderson <rja14(a)cl.cam.ac.uk> writes: > ... While at the conference, I found out that a classified meeting > took place this March in Germany between the signals intelligence > agencies of the developed countries, plus Australia and South Africa, > at which the assembled spooks agreed to press their governments to > bring in escrow and/or weak crypto. You realise, of course, that this means war, Tatical replies? a) Lobbying - hopeless IMO, they aren't interested in listening, the politicos are just too easy to manipulate and the "masses" aren't clueful enough of what crypto means to understand the implications, or even notice. b) pretty good stego - possible technical solution c) independant states of cyberspace :-) declaration of independence c) enforced or "enabled" by b) looks good to me. Perhaps some literary skilled cpunk would care to compose a suitable reply for PGN to add to risks. Adam ---------------------------------------------------------------------- Date: Tue, 1 Aug 1995 20:36:29 -0400 (EDT) From: "Lance J. Hoffman" <hoffman(a)seas.gwu.edu> Subject: Australia next to ban PGP Date: Tue, 01 Aug 1995 15:29:05 -0400 From: Dave Farber <farber(a)cis.upenn.edu> Subject: Australia next to ban PGP [unverified info ...] From: rja14(a)cl.cam.ac.uk (Ross Anderson) Australia's proposed crypto policy: (1) Banks will get key escrow (2) Other Australian residents will be forced to use weak crypto Source: talk by Steve Orlowski, Assistant Director, Australian attorney general's department, given at the Cryptography Policy and Algorithms Conference, Queensland University of Technology, last month. p 34: `the needs of the majority of users of the infrastructure for privacy and smaller financial transactions can be met by lower level encryption which could withstand a normal but not sophisticated attack against it. Law enforcement agencies could develop the capability to mount such sophisticated attacks. Criminals who purchased the higher level encryption products would immediately attract attention to themselves.' He mentioned that his department considered itself a suitable repository for the government central decrypting unit, which would decrypt traffic for local police forces. He also wants to escrowed keys for banks and other organisations allowed to use strong crypto. Centralising the wiretap capability with the AG is represented as a useful safeguard against abuse of power by local police forces. It would be presented as a `data recovery' facility in order to reassure the voters. Centralisation will enable the AG to acquire the capability to use ``more sophisticated techniques in circumstances where the key cannot, for whatever reason, be recovered from escrow''. So the technical parameters would appear to be: 40 bit keys for the masses, 56-bit escrowed keys for the banks, and a Wiener machine sitting in Orlowski's office. Belt, braces and string. Curiously enough, he quotes a `Review of long Term Cost Effectiveness of Telecommunications Interception' as saying that ``Encryption by targets of their communications (both voice and data) is not considered as a problem for TI at present in Australia'' and goes on to say that ``there has been comparatively little market for voice encryption products, although they have been readily available''. He even produces some good arguments for the EFF, such as that much of the intelligence comes from the call log data and from calls to third parties such as airlines and hotels which are not encrypted. He also says that the OECD countries will hold a meeting on National Cryptography Policies later this year. While at the conference, I found out that a classified meeting took place this March in Germany between the signals intelligence agencies of the developed countries, plus Australia and South Africa, at which the assembled spooks agreed to press their governments to bring in escrow and/or weak crypto. Australia seems rather eager to lick Uncle Sam's boots on this issue. I wonder what the payoff was?

3 2

Re: More "S-1" foolishness
by Hal 17 Dec '03

17 Dec '03

The other thing I noticed that really makes me question this is that G1 only uses 4 of its 8 input bits. As I wrote, it is equivalent to parity(i&0x17). A bit is a terrible thing to waste, and it is hard to imagine why it would do this intentionally. G1 may not be that important an element of the cipher but why throw away four bits? It is possible I suppose that the F and G boxes are not the ones used in the "real" version of whatever cipher this is, so this apparent weakness and the ones which Matt has pointed out may not be that significant. Hal

3 2

Re: EU Data Protection
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:13 PM 8/11/95, Derek Bell wrote: > I think you miss an important point; your opinion is subjective, but >data can relate to objective facts (e.g. credit records). Would you take the >same stance if a credit bureau claimed that you couldn't pay back half the >loans you took out? Any entity which purports to hold or provide "true" information but which hold flaky or incorrect information will suffer. This is true of credit agencies, advice columns, restaurant reviews, movie ratings, book reviewers, doctor rating agencies, and so on. I won't get into all of the aspects of reputations, but this is what we're talking about. And I'll concede that not all of these examples are equally important, or use the same objective quality of data. A credit rating agency is no doubt more important than a movie review agency--though arguably the damaging effects of Siskel and Ebert trashing "Waterworld" can be many orders of magnitude more than TRW Credit having an incorrect bad debt recorded. The point is that we do not have government to maintain the accuracy of movie reviews, of lawyer ratings, and so forth. Even if one accepts the "Fair Credit Reporting Act" (a U.S. law which I think is unconstitutional, as it tells me I cannot report certain kinds of facts), the European-style data privacy laws are a further step in a wrong direction. Think about it: the name "data privacy" sounds good, at first blush, but what it really means is that my records are not private, that my records are inspectable by government agents to see if I have stored any illegal facts or correlations. > What worries me about the *lack* of some form of data protection >legislation is that is allows someone to build up a database of information >which is a mishmash of truth, misunderstandings and lies. How would you feel if >"Concerned Citizens against Cryptography" compiled a list of all members >of this list, branding them as `dangerous, possibily criminal subversives'? Things like this happen all the time. This is just an opinion they happen to have. Would you make it a crime for "Concerned Citizens against Cryptography" to do a "who cypherpunks" of this list and to think we are "dangerous, possibly criminal subversives"? In the U.S. such judgements are made all the time. Doesn't make the judgements right, but rightness is not the basis of the freedom to hold and express these beliefs. >What if that opinion was spread to other databases? How about the police >investigating you because of this kind of database? "Spreading" the opinion to other databases is no big deal. The police investigating is a separate issue. Many of us think the police should be very careful about investigating for beliefs and opinions, but, in fact, it happens all the time. (It's happened to me, for example.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Re: IPSEC goes to RFC
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> sdw(a)lig.net (Stephen D. Williams) wrote: > > > I really like the idea of using DNS for (public I assume) keys... ghio(a)cmu.edu (Matthew Ghio) wrote: > I don't. > > Public keys in the DNS is a bad idea because it makes it difficult to > update the database, especially in large organizations. When a host's > key is issued or changed then they would have to get the nameserver > admin to change it for them. This could become a major problem/ > inconvenience for many, many people. The host should be able to give > its own key in response to a query. That key could, of course, be > signed by any number of trusted signators to guarentee authenticity. I also like the idea of DNS-based public key distribution, but what Matthew said is true. What about this: Let the DNS-Server export the address of a machine which runs the public-key-database for this domain, similar to the MX record for the mailserver. If you need the public key for a person identified by the email address or for a host identified by hostname or IP address, you could ask the DNS server where to get the public key. The database host could run any program suitable to local requirements and export public keys with a certain protocol... Hadmut

1 0

TIM MAY IS A CYPHERWEENIE
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

I think we ought to just throw TIM MAY out of the list. let's EXCOMMUNICATE HIM. its becoming increasingly clear that he is the source of all our problems. I mean, isn't it obvious that our progress has stalled? who has written any code within the last 3 days? if we got rid of him, it would be EVOLUTION IN ACTION. this is ERIC HUGHES' mailing list, and eric hughes knows how to write some decent code. I mean, TCM's signature doesn't even have any geek code, and he hasn't changed it in 4 years or so, at least since my last grandparent died (and she was considerably more skillful at programming than TCM by knowing how to make toast). get rid of all the pricks who continually spout and spew conspiracy theories. let TCM go and find himself a new mailing list. that would be a fair comeuppance if he found that he couldn't learn to do squish because he doesn't have the slightest clue. he's a leech, a parasite, sucking on the work of others, pretending that he is at the forefront of our cause when he is only at the forefront of maniacal egomania. what has he contributed to the cause? SQUAT. just a lot of ranting about conspiracy theories and his Stock Pick of the Week crap. "the web is really growing. people should focus on it". well, THANK YOU VERY MUCH, MR. BRILLIANT COMMENTATOR AND VISIONARY, T.C.MAY, I would have never have THOUGHT of that in a zillion years, but now that you point it out, I GUESS YOU'RE RIGHT.

1 0

Re: IPSEC goes to RFC
by Peter Trei 17 Dec '03

17 Dec '03

Don Eastlake has actually done a draft RFC on using the DNS for key distribution. It may be found at ftp://ietf.cnri.reston.va.us/internet-drafts/draft-ietf-dnssec-secext-04.txt He briefed the W3C security working group about this recently, and a number of people raised objections, notably * database bloat * zone transfer bloat * increased hits on root servers due to a new class of inquiry. There was some discussion as to whether these were valid objections, and the people running prototype code said they had had no problems. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

2 1