December 2003 - cypherpunks-legacy

Re: Export laws don't just affect crypto
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Tue, 1 Oct 1996 00:05:16 -0700 (PDT), Lucky Green wrote: >The recent posts about GPS made me research the state of the art of GPS >receivers. Seems they are getting pretty good. Two pounds, sub-meter >accuracy, attitude determination, all at altitudes up to 60,000 feet and >speeds up to 1,000 nmph. But what really caught my eye was the fine print >at the bottom of the spec sheet: > >"Higher altitude and velocities up to 25,000 nautical miles-per-hour >options are available in the U.S." > >I gather from this that as long as you are in the US, you are welcome to >use this technology for applications that require larger than 1,000 nmph >speeds. > >Seems the software industry is not the only industry that's suffering >from silly export control laws. Possibly - certainly there are plenty of legislators who'd do it. I'd heard, however, that the precision of your signal could be increased by getting a fix on more than 3 satellites at a time - and that the GPS network had been designed to 'blanket' the Northern Hemisphere. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: How might new GAK be enforced?
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Tue, 1 Oct 1996 20:55:40 -0800, Timothy C. May wrote: >And just what would you call PGP? >Long before the MIT deal, people in the U.S. were using their "OK in >America" (not counting RSADSI's issues) software to communicate with >"illegally exported" copies in foreign lands. Just informally, how many of the people on this list do you think have bypassed any cooperation with the USG on general principles and are using International PGP? ("Well this one uses non-banned math") Unfortunately, we've already demonstrated that hackers (real ones) and/or cpunks will use Underground Crypto. What's missing is evidence that business (and thus Joe Sixpack - either directly or indirectly) will. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Majordomo results: mailto:pr-news@pa.dec.com
by majordomo＠dws008.ako.dec.com 17 Dec '03

17 Dec '03

-- >>>> What is DEC's official position regarding the new Clipper III proposal? **** @_ **** No valid commands found. **** Commands must be in message BODY, not in HEADER. **** Help for majordomo(a)dws008.ako.dec.com: This is Brent Chapman's "Majordomo" mailing list manager, version 1.93. In the description below items contained in []'s are optional. When providing the item, do not include the []'s around it. It understands the following commands: subscribe <list> [<address>] Subscribe yourself (or <address> if specified) to the named <list>. unsubscribe <list> [<address>] Unsubscribe yourself (or <address> if specified) from the named <list>. get <list> <filename> Get a file related to <list>. index <list> Return an index of files you can "get" for <list>. which [<address>] Find out which lists you (or <address> if specified) are on. who <list> Find out who is on the named <list>. info <list> Retrieve the general introductory information for the named <list>. lists Show the lists served by this Majordomo server. help Retrieve this message. end Stop processing commands (useful if your mailer adds a signature). Commands should be sent in the body of an email message to "majordomo(a)dws008.ako.dec.com". Commands in the "Subject:" line NOT processed. If you have any questions or problems, please contact "majordomo-Owner(a)dws008.ako.dec.com".

1 0

Re: The Right to Keep and Bear Crypto
by azur＠netcom.com 17 Dec '03

17 Dec '03

>No. And No. This argument will never fly in any court. > >If you want to see why, go to my homepage > >http://www.law.miami.edu/~froomkin > Thanks, the material was indeed informative. Some great work! However, I found much disturbing. The inference that the Exec branch could on the one hand classify crypto as a munition ('arms' by any other name), while for constitutional purposes the Courts may not exposes a deep-seated legal duplicity. Constitutional interpretations over the past century not withstanding, it is clear (to me) that a substantial number of the Framers would abhor what has become of the Second Amendment's ... right to keep and bear arms. One of the primary reasons put forth by the Framers for such a right was in order to resist the an oppressive state. The strongest reason for the people to retain the right to keep and bear arms is, as a last resort, to protect themselves against tyranny in government. --Thomas Jefferson When firearms go, all goes. We need them every hour. --George Washington It is ludacrous to expect citizens armed with no more than side arms, bolt-actions and shot guns to resist the actions of a modern military or law enforcement which citizens may find in violation of their inaliable natural rights (whether mistaken or not). In my opinion, all citizens should be be able to keep and bear any arms (without registration) which the state might use against them. To do so now is a criminal action. So be it. Unfortunately, it is common for groups especially governmental to be come statist, mean spirited and eventually malevolent. I hope jim bell or his ilk are soon successful at putting up functional, anonymous and active AP sites. I can't wait to wager! -- Steve

6 5

Re: ITAR satellite provision
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Wed, 02 Oct 1996 09:28:22 -0800, jim bell wrote: >> "Export means, for purposes of this subchapter: >[snip] >>* A launch vehicle or payload shall not, by reason of the launching >>* of such vehicle, be considered an export for purposes of this >>* subchapter. Most of the requirements of this subchapter relate >> only to exports, as defined above. However, for certain limited >> purposes, the controls of this subchapter apply to sales and other >> transfers of defense articles and defense services (see, e.g., Sec. >> 126.1) of this subchapter." > > >Okay, everybody, call Estes! We've got some crypto to export...er...launch! For some reason I'm getting a very comical picture here of a Crypto-CD inside one of those cylindrical oatmeal boxes with about 50 F model-rocket engines strapped to it.... Now, if you could just hit Airforce 1 on the way over - call it sending a message. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: "Macintosh -- the Surveillance System for the Rest of Us
by jim bell 17 Dec '03

17 Dec '03

At 08:48 PM 10/3/96 -0400, Robert Hettinga wrote: >At 7:13 pm -0400 10/3/96, Timothy C. May wrote: >> "Macintosh, the Surveillance System for the Rest of Us." >> >> (Why Apple would go along with this, while Microsoft and Netscape are >> apparently not playing ball, is incomprehensible to me. Apple risks >> alienating its remaining core user base, who often characterize Microsoft >> as "the Borg." So, Apple capitulates, while MS does not. I guess the >> "Macintosh Crypto Forum" didn't do a lot of good, did it?) > >Ouch. > >My first reaction to the above was to say, "Oh, Yeah??? Well, you're ugly, >buddy, and your mother dresses you funny, too!" But, I won't upset the >decorum of so august a forum with such eggregious classlessness. Not here >on cypherpunks. :-). > > >If one were to be completely uncharitable in the interpretation of Tim's >most recent outbreak of vitriol here, it would seem that he's offended that >he wasn't asked first to be the keynote at MacCrypto, the conference a >bunch of us had at Apple a month ago, which, I might add, was a >considerable success. I know what probably happened. A new high-level manager at Apple picked up some old dusty videotape off the shelf, labelled "Super Bowl 1984", played it and said, "Yah know, that guy on the screen was making a hell of a lot of sense until that trouble-makin' bitch smashed it!" Jim Bell jimbell(a)pacifier.com

1 0

Re: Can we kill single DES?
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Tue, 1 Oct 1996 16:27:18 -6, Peter Trei wrote: >1. Is this a good idea? What will happen if DES becomes perceived > as insecure? That's Declan's department (and other non-clueless journalists - declan is just the most visible). If it get's widespread and the target is something like Digicash, it'd get picked up by the Crime/Snoozeweek crowd. >2. What is the probability of success required to make it worth doing? Judging by the people on the list, about 50%.... <g> >3. What would be the consequences of failure? Depends on the type of failure - ranging from dreadful to minor. >4. What other platforms than NT/Win95/Pentium should be considered? > I could write a Unix demon version, but unless it's tailored for the > cpu, a lot of efficency is lost > (The aggregate number of idle cycles available for testing is the > crucial number). A Linux port (Pentium) would be *very* good - lots of Linux people tend to by pro-cpunk. Ditto for OS/2. And who knows, if you hyped the business aspects enough you might even find IBM or some other large corp willing to donate some time on large system. >5. What's a good target? Ideally, we need a plaintext/ciphertext pair, ecash, ecash, ecash! Given all the attention anything that 'will give your VISA number to evil hackers' gets, this is an important target. It's serious and newsworthy. >6. What other incentives can be used to recruit machines? Maybe give away a Pentium to the person who finds it? (Assuming donations from list members, of course) # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

5 4

Re: Can we kill single DES?
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Tue, 01 Oct 1996 19:01:08 -0800, jim bell wrote: >Maybe Microsoft would be willing to help? After all, it is THEY who are >going to be limited to DES-strength exports if things continue as they've >been going. How about Intel? Netscape would be a great choice as well - the Internet security market is *very* important. Microsoft has publically said that their cash flow model will work if they make NOTHING off of internet software of any sort. Compare this with the fortunes being spent on "Netscape Enterprise Server" or the like. They could issue press releases talking about how they have the software to keep your VISA secure but the USG isn't allowing them to use it! Microsoft would probably do anything the USG asked if, say, immunity from the DOJ was granted under the table. NTT is also a great choice, as you mentioned above. IBM, Sun, DG, Cray (a Silicon Graphics subsidiary?), etc. might go for some free publicity - I've seen a LOT of press releases out of IBM that talk about "blue-sky" research being done. Given that IBM lives because of big business, they also have a demonstratable interest. I'm sure they'd love to be able to advertise that the data you trust to DB2 (for instance) is entirely secure. The same argument works for DG. Also, IBM has a lot invested in chip fabrication facilities - there's got to be some extra capacity there! Sun has always seemed to be big on tech-demo type things. Cray - well that's obvious. The supercomputer market is heading toward massive parallelism. Leaching time looks interesting! # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: Timmy May the buffoon
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I'm glad that you agreed with my assessment of Timmy May. >From remailer(a)flame.alias.net Fri Oct 4 08:00:56 1996 >Date: Fri, 4 Oct 1996 14:00:48 +0200 (MET DST) >Message-Id: <199610041200.OAA11852(a)basement.replay.com> >To: dlv(a)bwalk.dm.com >From: nobody(a)flame.alias.net (Anonymous) >Organization: Flame International Inc. >Comments: Please report misuse of this automated remailing service to <remailer-admin(a)flame.alias.net> >Subject: your idea > > >>Tim is an ignorant asshole who knows nothing about cryptography and floods >>this mailing list with inane rants and personal attacks. I recommend that >>he be massively killfiled. > >Gosh, we have never heard this from you before! A new idea. > >

1 0

Jon Katz retracts...thanx Jon
by Omegaman 17 Dec '03

17 Dec '03

"And a final note, on another topic entirely. In Threads and in my recent columns, I've tried repeatedly to make the distinction between the original Cypherpunk mailing list - designed to ensure anonymous access to information on the Web and, in other contexts, a techno-anarchist movement - and the adolescent pinheads using the name Cypherpunk to successfully block open and free speech on The Netizen's public forums. They are not the same thing. The movement to protect anonymity is an important part of the Web and the Net. The use of the name to anonymously attack people is not an embodiment of that movement, but a perversion of it. I didn't make this distinction clear in my columns this week. Many thanks to the people who pointed it out." -------------------------------------------------------------- Omegaman <mailto:omega@bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send a message with the text "get key" in the "Subject:" field to get a copy of my public key. --------------------------------------------------------------

1 0

Re: The New GAK-Clipper Thing will Fail
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:07 PM 10/3/96 -0800, jim bell <jimbell(a)pacifier.com> wrote: >The point, of course, is NOT to encourage these companies to support Clipper >IV. Rather, goal is to suggest to them a "poison pill" which would make >their cooperation meaningless in the end, while at the same time giving them >a 2-year free 56-bit export. Think of it as a monkey-wrench they can throw >into the works. A really _fine_ post! I'm also impressed by the way they announced it just _after_ Congress ended its session, while they're busy losing the export level in court. On the other hand, boycotts aren't particularly useful, when RSA (who is or is not joining the Bad Guys) owns half the public key patents and Cylink (who definitely is) owns the other half. If you're selling public key, you've got to pay the Bad Guys, until the DH patents expire in 97 (later for RSA.) Or you've got to buy from somebody who's paying the Bad Guys. And the Bad Guys Unindicted Co-Conspirators' announcements haven't even _mentioned_ permitting export of public key technology (since 56-bit RSA doesn't quite make it.) But they _could_ export Kerberos, with only minor hacks needed to implement Key Ripoff. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com America's Open Presidential Debate - Beyond Dole and Clinton! <A href="http://gate.net/~bdcollar/bbe/debate.htm">Tuesday, Oct. 8th 8:00 PM EDT</a>

1 0

Re: WINDOWS NT ????
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:47 PM 10/3/96 +1030, you wrote: >hi, > is Windows NT secured system ? Windows NT 3.51 is a real operating system. It is not as secure as I would like, but it is much better than Windows 3.1, which was totally insecure. It has some good security techniques, but I don't know how secure the networking is, and networking is the big technical insecurity on most machines today. (Well, bad administration is the biggest insecurity on almost all machines for almost all time. And physical security is also big.) Windows 4.x moves the graphics/windowing system into Ring 0, where the "secure" parts of the kernel are. Bad. This means graphics bugs can make the kernel insecure or crash. I don't trust it, especially because Windows 3.1 crashes all the time for me, and stupid bugs make Windows 3.1 behave badly for me. So if they put the window system in the kernel, I don't trust it. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com America's Open Presidential Debate - Beyond Dole and Clinton! <A href="http://gate.net/~bdcollar/bbe/debate.htm">Tuesday, Oct. 8th 8:00 PM EDT</a>

1 0

Re: Fighting Clipper III
by jim bell 17 Dec '03

17 Dec '03

At 08:37 PM 10/3/96 -0700, Declan McCullagh wrote: >IBM truly does deserve to be criticized, soundly. When I get a chance I'll >write up the report of what happened at yesterday's IBM "let's recruit >industry to join our alliance" confab session that took place in the >afternoon at their DC lobby-office. It was supposedly closed to the >press. :) > >-Declan If those "Big Brother Inside" stickers are re-printed, in fine print should be included a web-page at which more information could be obtained. See, I anticipate actually visiting local hardware/software sellers and placing those labels. Including an address would allow people to get far more information, and get involved. Jim Bell jimbell(a)pacifier.com

1 0

RSA's Official Permission
by The Deviant 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- RSA Optimistic on User Benefits of Administration's Recent Key Recovery Initiative Announcement Further policy change required for US vendors to be competitive worldwide REDWOOD CITY, Calif.---Oct. 2nd, 1996--RSA Data Security, Inc., a wholly-owned subsidiary of Security Dynamics Technologies, Inc. (NASDAQ: SDTI), issued the following comments on the administration's recent announcement of a Key Recovery Initiative: The administration's proposed Key Recovery Initiative is a positive step towards meeting the needs of individuals and organizations that buy and use products which utilize encryption. However, the proposal leaves significant competitive issues unresolved for suppliers who compete overseas. Modern encryption and authentication technologies are crucial to the growth of electronic commerce and the health of the future global electronic economy. The continued leadership of American computer and software firms in the world market depends on their ability to provide competitive solutions for consumers and business around the world. These consumers and businesses depend increasingly on encryption and authentication technologies -- such as those developed at RSA -- to provide solutions that protect the privacy of consumer purchases, personal medical information, sensitive corporate data, and electronic commerce and funds transfers as they travel over the global Internet. US government agencies, however, have long insisted that they must have potential access to all encrypted information for law enforcement purposes, and have advanced several proposals towards those ends. To date, these proposals have met with little support from the user and vendor communities due to concerns about privacy and competitiveness. This new proposal from the administration, however, is a move in the right direction for users. One positive step is that the administration has indicated, for the first time in over six years of discussion, that it will lift all key size restrictions on the export of products which utilize cryptography, provided that manufacturers provide a viable means of key recovery for legitimate government access. In addition, under the administrations proposal, industry, not government, will develop and propose the actual key recovery mechanisms. This will to result in more effective solutions to managing and recovering keys. Finally, the proposal addresses the concerns of users that any third party designated to hold user keys might improperly disclose those keys, thereby compromising a user's right to privacy. The administration has agreed that under certain circumstances, organizations would be allowed to "self-escrow" their own encryption keys. RSA is confident that industry can develop and gain approval for several excellent key recovery mechanisms that would be acceptable to government concerns. In fact, RSA has been a pioneer in this field with our RSA Emergency Access technology in its award-winning RSA SecurPC product. In the case of SecurPC, companies using the product can use Emergency Access keys with RSA's unique secret-splitting technology to gain access to critical information in the event of an emergency. The recently announced Key Recovery Alliance, of which RSA is a part, is chartered to provide a flexible, workable solution for users working within the government's proposed key recovery framework. Members of the group are working on technology which will allow users to maintain the privacy of their keys while allowing legitimate business or law enforcement authorities to recover keys when appropriate. It will also address challenges that arise when a user must comply with the differing encryption policies in countries around the world. The technology could allow products to provide the flexibility a user needs to take full advantage of the maximum privacy allowed in their locality, while maintaining interoperability and information exchange with other users regardless of location. It is not clear, however, to what extent the administration's proposal provides relief to US software and hardware companies who must compete with foreign suppliers. These foreign suppliers, not subject to US law, can provide strong, non-key-recovery encryption in their products. Today, most major computer and software solutions firms derive significant revenues from outside the United States. The government's proposal, while satisfying the US government's needs, does little to enhance the competitiveness of American products overseas. Robust encryption products are already available from many overseas suppliers, and U.S. market share in encryption-enabled products is under siege. Under this proposal, it appears that U.S. companies will still be prohibited from selling non-key-recovery encryption solutions in overseas markets, creating a significant barrier to their competitiveness. RSA looks forward to additional announcements by the administration that specifically address this issue and provide competitive relief for the US computer software and hardware industries. RSA Data Security, Inc. RSA Data Security, Inc., a wholly-owned subsidiary of Security Dynamics Technologies, Inc. (NASDAQ: SDTI), is the world's brand name for cryptography, with more than 75 million copies of RSA encryption and authentication technologies installed and in use worldwide. RSA technologies are part of existing and proposed standards for the Internet and World Wide Web, ITU, ISO, ANSI, IEEE, and business, financial and electronic commerce networks around the globe. The company develops and markets platform-independent developer's kits and end-user products and provides comprehensive cryptographic consulting services. Founded in 1982 by the inventors of the RSA Public Key Cryptosystem, the company is headquartered in Redwood City, Calif. -0- Note to Editors: BSAFE and TIPEM are trademarks of RSA Data Security, Inc. All other product and brand names are trademarks or registered trademarks of their respective companies. | [1]Al Gore's Statement | [2]Jim's Testimony | [3]IBM's Alliance | CONTACT: Corman/Croel Marketing & Communications (for RSA) Patrick Corman, 415/326-9648 [4]corman(a)cerfnet.com ---------- End Forwarded message ---------- This is definatly bad... If you want to look it up yourselves, its at http://www.rsa.com/PRESSBOX/releases/keyrecov.htm --Deviant They seem to have learned the habit of cowering before authority even when not actually threatened. How very nice for authority. I decided not to learn this particular lesson. -- Richard Stallman

1 0

NYT Nix GAK
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The New York Times, October 4, 1996, p. A32. A Flawed Encryption Policy [Editorial] The new White House proposal to keep high-powered encryption software out of the hands of foreign terrorists and criminals is needlessly restrictive and probably unworkable. Though the new plan is better than previous Administration proposals, it risks doing more harm than good. The Administration is rightly worried that foreign terrorists or criminals will get hold of encryption software that will make it impossible for the Government to eavesdrop on their telephone and computer messages. The technology is legal in this country, but the Administration wants to keep the powerful new software out of foreign hands. However, the Administration downplays the fact that encryption is also a good way for honest citizens to prevent crime. At a time when banks and other private companies send vast amounts of confidential information over the electronic highway, it would seem sensible to make high-quality encryption widely available so that the private sector can protect itself from criminal or malicious eavesdropping. For that reason, the Government ought to promote wide-scale dissemination of encryption, both here and abroad. Trying to block dissemination is probably useless and almost certainly harmful to American exports. Powerful encryption systems made by foreign companies are already available in Europe and Asia, and American exporters will need to sell state-of-the-art software to keep competitive. The Clinton Administration previously proposed that the computer industry adopt a single type of encryption, known as key-escrow, which would scramble messages with mathematical passwords. Under the plan, private companies and individuals would turn over these passwords to the Government, which, with court authorization, could use them to unscramble the phone and computer traffic. The purpose of key-escrow, then, would be to preserve the Government's existing ability to tap phone calls. But that Clinton plan was firmly rejected by industry and privacy-rights advocates who feared that a government that held passwords would abuse First Amendment prohibitions against listening in on private communications. The latest White House plan addresses many of these concerns. It would impose restrictions only on the software that exporters sell abroad. Privacy advocates have less to fear from the latest plan because it would allow individuals to deposit their passwords with private organizations, rather than the Government. Yet the Administration has not explained why foreigners would buy American software that would allow the F.B.I. to eavesdrop when they could buy equally powerful software from non-American manufacturers that omits any such trap door. Critics assume that foreign governments -- few of which pay attention to American constitutional protections against invasion of privacy -- would demand access to passwords, making such software unattractive for anyone to use. There is room to improve the plan. A panel of the National Research Council recently concluded that there is no good reason to restrict exports of currently available encryption because foreigners already have access to equally powerful software. There is time to work out restrictions, in cooperation with the industry and privacy advocates, for the next generation of encryption software. In the meantime the Administration might push forward on the panel's other sensible recommendations -- such as developing better encryption expertise within the F.B.I. and helping the private sector develop the encryption software it needs to stop illegal eavesdropping. [End] The National Research Council report is available at: http://pwp.usa.pipeline.com/~jya/nrcindex.htm

3 3

Re: Key recovery/RSA/Bidzos/WTF?!?
by Rich Burroughs 17 Dec '03

17 Dec '03

At 08:38 PM 10/3/96 -0700, Declan wrote: >PC World (at www.pcworld.com) has a radio interview with Bidzos, I'm >told, probably in the same story for which they interviewed me. RSA's "position statement" is at: http://www.rsa.com/PRESSBOX/releases/keyrecov.htm ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon U.S. State Censorship Page at - http://www.teleport.com/~richieb/state New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

RE: DESCrack keyspace partitioning
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

"geeman(a)best.com" <geeman(a)best.com> wrote: >(P)RNG's just aren't that likely to produce a key of 010101010..... nor 001100110011... etc etc and I have been thinking about how one might formalize and exploit this randomness property to increase the probability of finding the key sooner. ... >Any thoughts here? Suppose we have a function f() that randomly chooses an integer between 1 and 100 such that each integer in the range is equally likely to be selected on each call. If we call f() 6 times, each time noting whether the result is even or odd, which of the following sequences is more likely? Even Even Even Even Even Even Even Odd Odd Even Even Odd If you picked the second sequence as more likely, you are like most people who responded to similar questions in a classic study of cognitive biases [1]. The two sequences actually have an identical probability of occuring, and, in fact, all sequences of six outcome are EQUALLY probable. This example illustrates the representativeness bias, in which we mistakenly suspect the global characteristics of a process to be represented locally in a specific sequence[2]. Ciao, James 1. Kahnman, D., and Tversky, A. Subjective probability: A judgement or representativeness. Cognit. Psych. 3 (1972) 430-454 2. Stacy, Webb and MacMillian, Jean, Cognitive Bias in Software Development. Communications of the ACM June 1995, 57-63

1 0

RE: DESCrack keyspace partitioning
by geeman＠best.com 17 Dec '03

17 Dec '03

Sorry, but you are ASSUMING that which I dispute. The point I am making is that keys in the real world are not uniformly distributed. Some results forthcoming. Suppose we have a function f() that randomly chooses an integer between 1 and 100 such that each integer in the range is equally likely to be selected on each call. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ If we call f() 6 times, each time noting whether the result is even or odd, which of the following sequences is more likely?

1 0

RE: DESCrack keyspace partitioning
by geeman＠best.com 17 Dec '03

17 Dec '03

Re: DESCrack keyspace partitioning geeman(a)best.com wrote: > > What about the heuristics of partitioning the keyspace? > > Seems to me that a _subset_ of all possible keys is much more likely > to appear than a random selection from an equidistributed population 0..2^56. > > (P)RNG's just aren't that likely to produce a key of 010101010..... > nor 001100110011... Why? They seem just as likely as any other sequence. I left out a piece: again heuristically speaking, most DES keys are derived from pasword hash, or similar technique. In such a case the statistics of the generated keys are (it looks like) _highly_ skewed. etc etc and I have been thinking about how one might formalize > and exploit this randomness property to increase the probability of finding the key sooner. Again, which randomness property? The property that essentially _no_ predictability is found in a hash-derived key. Gary -- "Of course the US Constitution isn't perfect; but it's a lot better than what we have now." -- Unknown. pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

1 0

[IMPORTANT] GAK
by dustman＠athensnet.com 17 Dec '03

17 Dec '03

Timmy May is a convicted child molester.

1 1

Re: boycott GAKkers (was Re: NYT on IBM GAK)
by Scott J. Schryvers 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 08:39 PM 10/3/96 -0400, you wrote: GAKked DES! Talk about redundant. >-----BEGIN PGP SIGNED MESSAGE----- > >On Thu, 3 Oct 1996, Adam Back wrote: > >> (I've seen HP, Sun, RSADSI, TIS, Apple, Atalla, DEC, Groupe Bull, IBM, >> NCR Corp., and UPS mentioned). Any confirmations? Denials? > >IBM and TIS are definitely pro-GAK. TIS is selling a firewall that uses >GAKked DES. IBM has been working on developing the "key recovery" technology. >The article posted here a while ago that told of IBM's plans to support GAK >also said that they were planning to license the technology to Sun and >Netscape. I don't know about the accuracy of that last statement. > >Mark >- -- >PGP encrypted mail prefered. >Key fingerprint = d61734f2800486ae6f79bfeb70f95348 >http://www.voicenet.com/~markm/ > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.3 >Charset: noconv > >iQEVAwUBMlRcsCzIPc7jvyFpAQEiIwf/btvAiIVHF3alGh+Vivr3MoHnSSciFjGX >qhqdS+SEsM4cTxE+y8vvfpHFs/faQPmWLgT70lyf1pJ+Avei7brieb/qWoC5q9MJ >gBlSa1f2yVMY7ax+KPTwU+Yk63A7oi964d+ebCp51BLOtzKammRlIw/nBFuDMq/5 >ss2a4w4PuOEOP35WQIy0i8NBoJxEi5gHx5J/+gGzWK9iw/yZa0xyoT25ci6uh7mJ >sPgNmedr/Pq+D5gk5GduGgGni/jrDeADH0K7R0M8Jqlh0Xc82NPkau8xwZAXDMJV >947PF56souwrx3BHmj7fXPXIVBJEjWy/Ymv2N8LBm+BHS09CN0ns5Q== >=URZJ >-----END PGP SIGNATURE----- > > -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMlUoaf+hzPlzwZAdAQGopQgAvlREZb8S6SPQs/WQvZzkoR9ETJy1byEK xGO/ymOpkivpGCZBXGcdOLnnDJbH26x8eh7iHi+Mzv6iVrbt11YkbZ9h7z7UTkdq jtUMVN9MvOaKPxcLqTvcYgTOyKgLPYpIa27xKlP5Y7NqovacTHHA6TgSz5HjC8fQ Jg+xCPDYsJTLEDmmdJVykJx/SU4ovIFP2o/8eF+LMIW7M3L7w5bHUO14HYkuMrUy hpNp4NCycGbwia1GYkwfOYnx5YuQFSjBeubIm8sqC2Zs3A7B9OoTyOmec12JyvGz G4kJe5vKhF+q8MktOSzazqMvdJ8PgQX0ecrhrurLVdVnwu1H1QB1ZQ== =HViK -----END PGP SIGNATURE-----

1 0

Secret Swedish GAK and ITAR
by Asgaard 17 Dec '03

17 Dec '03

Gunnar Klein, a Swedish MD, is chairing a EU committee dealing with standardization of security measures in medical information systems. Recently, in a full-page anti-GAK debating article in a national Swedish evening newspaper (Aftonbladet 9/25/96), he chose to reveal some secret information he's gotten hold of: Sweden's representatives in the OECD GAK proceedings have declared that Sweden is willing to sign bilateral or multilateral GAK treaties, if other countries so demand. This declaration, along with the OECD records per se, has been classified. He also discloses that Sweden in late 1994, effectively in total secrecy, issued a completely new law against export of 'stretegic products', principally including all cryptography, without permission from the 'Inspection for Strategic Products'. In theory this law would cover export of a crypto program on a notebook. Gunnar Klein suspects US strong-arming behind all this. Obviously, Denmark has taken a different, anti-GAK, position in the OECD proceedings. Denmark is less susceptible to US blackmail than Sweden - they don't build fighter-planes with lots of US high tech parts inside (like the JAS/Gripen). Asgaard

1 0

RE: DESCrack keyspace partitioning
by geeman＠best.com 17 Dec '03

17 Dec '03

Another thinking step: most real-world DES keys are derived from hashes. Not (P)RNGs. The distributions are **not** uniform. I am talking about FAMILIES of predictable bit patterns in keys, not any specific pattern. I'm doing the stats. The goal is to search the most likely keys first, and not all keys are created equally. Your reasoning is thin. ---------- From: Mike McNally[SMTP:m5@tivoli.com] Sent: Friday, October 04, 1996 6:10 AM To: geeman(a)best.com Cc: 'cypherpunks(a)toad.com' Subject: Re: DESCrack keyspace partitioning geeman(a)best.com wrote: > > (P)RNG's just aren't that likely to produce a key of 010101010..... > nor 001100110011... etc etc Right. A good CSPRNG is ulikely to produce the pattern 010101010101. It's also unlikely to produce the pattern 0011001100110011. Oh, and it's also unlikely to produce 01100100101001011. In fact, a good 32-bit CSPRNG has only a 1/2^32 chance of producing any particular bit pattern. Of course, another way of saying that is that it's just as likely to get an "obvious" bit pattern as it is to get any other one. You can't just throw away part of the keyspace based on such bogus reasoning. (There may be other reasons to throw away part of the keyspace, of course.) ______c_________________________________________________________________ Mike M Nally * IBM % Tivoli * Austin TX * How quickly we forget that mailto:m5@tivoli.com mailto:m101@io.com * "deer processing" and "data http://www.io.com/~m101/ * processing" are different!

1 0

The attitude of US peoples toward govt WAS: [AP stuff] (fwd)
by snow 17 Dec '03

17 Dec '03

Jean-Francois Avon asked me to forward this to the list. It is part of a conversation that He and I had last week. The Crypto Relevance if any is in the attitudes we are discussing, and in the the last couple paragraphs of Mr. Avon's writing. Forwarded message: > From jf_avon(a)citenet.net Fri Sep 27 23:59:05 1996 > Message-Id: <9609280545.AB01676(a)cti02.citenet.net> > Comments: Authenticated sender is <jf_avon(a)pop.citenet.net> > From: "Jean-Francois Avon" <jf_avon(a)citenet.net> > Organization: JFA Technologies, Montreal, QC, Canada > To: snow <snow(a)smoke.suba.com> > Date: Sat, 28 Sep 1996 01:45:30 -0500 > Subject: The attitude of US peoples toward govt WAS: [AP stuff] > Priority: normal > X-Mailer: Pegasus Mail for Windows (v2.32) > > On 27 Sep 96 at 20:01, snow wrote: > > When I talked about driving for 48 hours straight, I was trying to > > impart an idea that many midwestern people are rasied with, the > > total VASTNESS of the world. We (midwesterners, and some of the > > westerners, and a lot of older people (in their 60's & 70's) > > honestly believe deep down inside that this country is too vast to > > effectively control that the government simply CAN'T do it. They > > can't enforce any control they wish to have with the army, because > > WE have guns, and a lot of us are ex-army (a little older, a > > little slower, a HELL of a lot more devious and a lot less > > impetuious<sp>). We simply don't accept the fact that any one CAN > > control us. > > This might be why I liked NM, and AZ and TX. I can understand the > feeling you describe as you can barely escape it while visiting the > place. I suppose our canadian politicians also understood that: c.f. > Bill C-68 :( > > > Anyway, [the person's] point was that [some type of software] took > > control and decesions out of peoples hands, and that is why it was > > a market sucess. This I see as a European disease, the looking to > > government & the church for the solutions to every day problems. > > That is the feudalist attitude and philosophy. Absolutely > disgusting. Although we have, here in Quebec, french roots and > civil laws based on the Napoleon Code (Common Law everywhere in > Canada except in QC), the population have a very american way of > seeing life. Every time I have political discussion with French from > France, the feudal mentality always surfaces up and I always have > problems with them. They have a hierarchy-worshiping attitude, > coupled with an abdication of the power of their own reason (at the > individual level). In short, they are brought-up to become yes-men. > It litterally gives me an uncomfortable feeling in my guts. > Disgusting. > > > The original Colonists didn't have that attitude (well, they did to > > some degree, but not the people on the edges) In fact the attitude > > really didn't develop fully in this country until the 1920's, and > > still hasn't caught on everywhere. > > Roosevelt and his New Deal... I got the chance to find a magazine > who explained how the Federal Reserve was created. Politicians > sneaking into trains as "duck hunters", grand political socialistic > schemes sprung on peoples in secret, etc. The magazine did not say > that but I am leaning on the Objectivist side and I tend to read > what *is* written... > > > politicians started paying for votes with government largess > > As a 70 years old englishmen, ex-company managing president & very > friend of mine once said: Everyday, they buy us with our own money... > > > These two attitudes are pretty diametrically opposed, but coupled > > it with a school system that doesn't encourage extra-curriculer > > thought, and you have some pretty incosistent people. > > Unfortunately, you are absolutely right. > > > [slight topic drift...] I was wondering lately... Words have a lot > of power. They are the building blocks we use to materialize > concepts. Think about the word "Government". You would think of it > as a body that governs. But the american peoples think the > government ought to be a body that acts under a mandate to > administrate and oversee certain things. > > The very word "govt" seems to (conceptually) almost "justify" the > actions of present govts, while any other word (like, for example, > "overseers", "Mandated", etc) would stress out that they are under > *our* orders (and nowadays, exceeding their mandate). > > Maybe we should start using a new word to describe *exactly" what it > is that they ought to be doing. Doing so would also stress out > *exactly* what they are pulling on us... > > Comments? > > jfa > > Please e-mail me directly since I am not on cypherpunks anymore. > Thanks. > Jean-Francois Avon, Pierrefonds (Montreal) QC Canada > DePompadour, Societe d'Importation Ltee > Finest Limoges porcelain and crystal > JFA Technologies, R&D consultants > physicists and engineers, LabView programing > PGP keys at: http://w3.citenet.net/users/jf_avon > ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 > ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C Petro, Christopher C. petro(a)suba.com <prefered for any non-list stuff> snow(a)smoke.suba.com

1 0

Re: DESCrack keyspace partitioning
by Mike McNally 17 Dec '03

17 Dec '03

geeman(a)best.com wrote: > > Another thinking step: most real-world DES keys are derived from > hashes. Not (P)RNGs. Hashes? Hashes of what? > The distributions are **not** uniform. Then that's a wonderful weakness in the cryptosystem. Let's fix it. > The goal is to search the most likely keys first, and > not all keys are created equally. Any cryptosystem for which one can compute likely vs. unlikely keys has already been partially compromised. ______c_________________________________________________________________ Mike M Nally * IBM % Tivoli * Austin TX * How quickly we forget that mailto:m5@tivoli.com mailto:m101@io.com * "deer processing" and "data http://www.io.com/~m101/ * processing" are different!

1 0

The Myth of the "Balanced" Middle Ground (Was: Re: gack vs. key recovery)
by Ernest Hua 17 Dec '03

17 Dec '03

> From: "Vladimir Z. Nuri" <vznuri(a)netcom.com> > > ... I feel > that cpunks are equally guilty, by branding anything that emanates > out of the government as inherently orwellian. do you always have > to have an enemy? is the government always going to be your > enemy, no matter what they do? Actually, the government encourages this view by lying. We can get into the many examples on encryption and wire taps, but if the TLAs keep using lies and PR instead of honesty and facts, then no one will accept anything they propose as-is. There will always be some suspicion of hidden agendas. And really, the agenda is obvious, but they have always refused to acknowledge the full extent of it, probably because it would forever damage their credibility. At least right now, Freeh has done enough PR (paid by your generous tax dollars) to make him look like a good guy. Janet Reno already looks innocent enough (hey, who could criticize someone who might look like your grandmother?) ... The PR concepts are all there, deliberately or accidentally. > I have posted here before that many companies find the concept > of "key recovery" highly acceptable and even desirable. Let them buy it. There are companies already making products with key recovery. But remember that key recovery are mostly useful to corporations, so it will be billed as the "professional" version (in off-the-shelf PC-class software) and also be pushed through the IS consulting channels. None of that really addresses E-Mail, I-phone, etc for the rest of us. > 2. those who feel that there is such a thing as a legal warrant > or subpoena for information protected by cryptography keys, and > would agree that this logically means that governments will be > getting access to "key recovery" infrastructures. I agree that there is a legitimate interest by legitimate law enforcement and national security interests. But ... 1. If it's so darn easy to get non-GAK encryption, why dumb it down for the rest of us? (Really, I just don't buy the "no plans for domestic regulations" bit. Plenty of current and ex-executive branchies have admitted as much in private.) 2. The Orwellian possibilities are definitely there. I simply will not let the government have drift-net-fishing rights on the NII. Sorry. I'll let them tap one-sie two-sie's, and I want the process to guarantee by functional design (not legal constraints) that it's expensive to tap more than a few at a time. > personally I am leaning toward 2, because I feel that we already > live in such a society, and that it is not orwellian. That was true because it was too darn expensive. Hey, at $50K per tap, I would be really selective about spending my hard-lobbied wire tap budget. If I can just push a button, I will be far less selective. (oh ... and make sure I ask real nicely later in front of the judge ... maybe ... if I have time ... too busy catching terrorists and child molesters, y'know) I'm not as worried about the indiscriminant tapping ordered by "good" FBI directors; I'm worried about the tapping by the bad ones. There is ZERO detectability if the FBI gets everything they want. There is not a chance of being accidentally discovered by a phone company employee or a wandering by-stander. That lack of check-and-balance is what I am completely against. I don't mind letting them have the technology if I can be sure it will 1) work and 2) minimize abuse. > the recipe for 200+ years has always been > and remains "eternal vigilance". in other words, I am in favor > of some kind of mechanism by which the government can obtain > keys via subpoenas/warrants. Ok. So every corporation (big and small) now must have a Chief Law Enforcement Relations Officer (CLERO) if they build encryption into their products? Every software engineering consultant has to jump through hoops to export their product? Sorry. If the software engineering industry were just big mammoth corporations, I wouldn't care. But it could just be me and my home office. I cannot afford to fly to D.C. to amuse some panel at the D.o.C. with my stupid key-recovery tricks. No. This plan completely discriminates against small players, and there are a lot of them. Finally, writing software is an art. It is not purely art, but it certainly is an art, which I believe falls fully under free expression and the First Amendment. The work of art is not functional until someone compiles it and run it on a machine. So regulating anything before the actual execution is definitely a violation of the First Amendment. I don't have time to deal with privacy but as soon as it starts executing, it becomes an instrument of privacy so regulating that is also against my basic beliefs, not to mention my engineering sense of practicality. > those who continue to pursue (1) are going to be perceived as > more and more radical and extremist, because arguably it is not > even a system we have today or one that was ever devised. Good point. If we are not careful, we could get bad PR. But then, I've been trying to argue that use of words like "anarchy" is against good PR principles anyway. I don't think cypherpunks have such pristine reputations that we must tread carefully for fear of damaging our "reputation". In fact, I don't think we even have one. That is, in some ways, worse than having one at all. > regarding (2): the government may actually help bring crypto > to the masses via the post office and other routes. are > cpunks going to continue to hold the simplistic, reactionary, > knee-jerk, black-and-white opinion that "anything with the > word 'government' in it is evil"? "if the government is doing > something, then we must sabotage it"? I think you are making the obvious mistake that many people make about similar groups, such as Libertarians. When someone says you should be able to freely choose, that is all that they are saying. They are not saying that someone else may not make a system that is not ideal, but does provide many other value-added benefits. Ern

1 0

TWP: Tighten ITAR
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The Washington Post, October 4, 1996, p. A22. Crypto Politics [Editorial] The Clinton administration once had a coherent, if unpopular, position on encryption software, the stuff that allows you to encode your email messages or other data so that no one can read it en route without a key. Now, in the wake of word that the president will sign an executive order, the position is no longer coherent, nor discernibly more popular with the high-tech audience it attempts to mollify. People and companies doing international financial business are highly interested in this kind of software, the more powerfully "uncrackable" the better. The U.S. software industry thinks there's a lot of money in it, especially if encryption becomes routine. The administration position till recently was that, much as U.S. software companies might profit from being able to market "uncrackable" encryption software freely, national security and law enforcement considerations dictated that such exports be controlled by license. Powerful encryption, like arms, could be dangerous in the hands of terrorists, rogue governments or international criminals. The software was classed as a munition; software above a certain uncrackability level could not be exported unless law enforcement authorities could get access somehow to the "key" after obtaining the proper warrants. Unbreakable codes on the loose strike us as a real danger, a legitimate reason for tight export controls. But if the administration really believes this, you'd think it would stick with steps that can plausibly meet the goal of control. Instead, trying to please, it has been splitting and splitting the difference between itself and the largely unmoved industry, which argues that no one will buy an encryption product that a government can decrypt at will. As with arms sales, the companies also argue that if they don't sell it, somebody else will, and that anyway it's far too late to fence off rogues. The national security people respond that there is still a "window," perhaps two years, in which they can prevent, if not all leaks of unauthorized crypto technology, at least its off-the-shelf use and wide adoption as the international standard. The administration initially proposed, then repeatedly refined, the concept of key "escrow" -- depositing a copy of the code with trusted third parties -- but never came up with a version the industry would accept. It commissioned a National Research Council report, which recommended a significant easing of restrictions. Now the president appears to have embraced a yet looser form of licensure upon declaration by a company that it will develop a plan within two years for key recovery. Also, the technology no longer will be considered munitions. What kind of plan? Nobody can quite say. What if the plans aren't acceptable? Licensing will revert to the old rule in two years. Will the security issue be moot by then? Probably. Barring some burst of clarity, one is left wondering whether the administration has compromised or caved, and what it now believes about the dangers of exporting uncrackable software. [End] Ditto, see the National Research Council report: http://pwp.usa.pipeline.com/~jya/nrcindex.htm

1 0

[SPAM] "Childish fool" Timmy May abuses mor(m)ons, spawns flame threads
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Timmy May has no life. >Date: Sat, 5 Oct 1996 07:19:22 -0700 (PDT) >From: Sandy Sandfort <sandfort(a)crl.com> >To: "Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> >Subject: Re: [SPAM] More "fuckhead" e-mail from Timmy May and his young friends >In-Reply-To: <uk5aVD10w165w(a)bwalk.dm.com> >Message-Id: <Pine.SUN.3.91.961005071820.9224A-100000(a)crl5.crl.com> >Mime-Version: 1.0 >Content-Type: TEXT/PLAIN; charset=US-ASCII > >Please stop spamming the list. It is rude and disrespectful to >all list members. It makes you look like a childish fool. > >On Fri, 4 Oct 1996, Dr.Dimitri Vulis KOTM wrote: > >> Timmy May has no life. >> >> >From: Troy Varange <varange(a)crl.com> >> >Message-Id: <199610050215.AA00807(a)crl5.crl.com> >> >Subject: Re: [VULIS] >> >To: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) >> >Date: Fri, 4 Oct 1996 19:15:36 -0700 (PDT) >> >In-Reply-To: <FV67uD8w165w(a)bwalk.dm.com> from "Dr.Dimitri Vulis KOTM" at Oct 2, 96 08:29:14 pm >> >X-Mailer: ELM [version 2.4 PL23] >> >Mime-Version: 1.0 >> >Content-Type: text/plain; charset=US-ASCII >> >Content-Transfer-Encoding: 7bit >> >Content-Length: 7527 >> > >> >> >> >> I have no dog, nor any other pets. Timmy May (fart) reportedly has two cats. >> >> If you suspect that Timmy May (fart) sexually abuses his cats, or any other >> >> animals, you should promptly contact the ASPCA and also alert rec.pets.cats. >> >> >> >> (Frankly, I doubt that the old fart can get his dick up to sexually abuse >> >> anything, including his cats. Senility puts an end to sexual molestation.) >> >> >> >> >From: Troy Varange <varange(a)crl.com> >> >> >Message-Id: <199610021931.AA24883(a)crl11.crl.com> >> >> >Subject: Important >> >> >To: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) >> >> >Date: Wed, 2 Oct 1996 12:31:21 -0700 (PDT) >> >> >In-Reply-To: <gqH3uD93w165w(a)bwalk.dm.com> from "Dr.Dimitri Vulis KOTM" at Sep 30, 96 07:57:27 am >> >> >X-Mailer: ELM [version 2.4 PL23] >> >> >Mime-Version: 1.0 >> >> >Content-Type: text/plain; charset=US-ASCII >> >> >Content-Transfer-Encoding: 7bit >> >> >Content-Length: 6226 >> >> > >> >> >Dr. Vulis sucks his dog's butt. >> >> > >> >> >> Timmy May has no life. >> >> >> >> >> >> >From: Troy Varange <varange(a)crl.com> >> >> >> >Message-Id: <199609300441.AA10704(a)crl12.crl.com> >> >> >> >Subject: Re: Vulis FUCKHEAD sucks Timmy's Cock >> >> >> >To: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) >> >> >> >Date: Sun, 29 Sep 1996 21:41:42 -0700 (PDT) >> >> >> >In-Reply-To: <LJV2uD91w165w(a)bwalk.dm.com> from "Dr.Dimitri Vulis KOTM" at Sep 29, 96 11:58:09 pm >> >> >> >X-Mailer: ELM [version 2.4 PL23] >> >> >> >Mime-Version: 1.0 >> >> >> >Content-Type: text/plain; charset=US-ASCII >> >> >> >Content-Transfer-Encoding: 7bit >> >> >> >Content-Length: 5298 >> >> >> > >> >> >> >Vulis sucks Timmy's boyfriend's cock. >> >> >> >> >> >> >> >> Timmy May has no life. >> >> >> >> >> >> >> >> >From: Troy Varange <varange(a)crl.com> >> >> >> >> >Message-Id: <199609300332.AA09870(a)crl12.crl.com> >> >> >> >> >Subject: Re: [SPAM] More "fuckhead" fan mail from Timmy "peteur" May >> >> >> >> >To: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) >> >> >> >> >Date: Sun, 29 Sep 1996 20:32:58 -0700 (PDT) >> >> >> >> >In-Reply-To: <ueP2uD86w165w(a)bwalk.dm.com> from "Dr.Dimitri Vulis KOTM" at Sep 29, 96 09:45:41 pm >> >> >> >> >X-Mailer: ELM [version 2.4 PL23] >> >> >> >> >Mime-Version: 1.0 >> >> >> >> >Content-Type: text/plain; charset=US-ASCII >> >> >> >> >Content-Transfer-Encoding: 7bit >> >> >> >> >Content-Length: 4378 >> >> >> >> > >> >> >> >> >> berserk >> >> >> >> >> Timmy May has gone . Has he been eating speed? >> >> >> >> >> bananas >> >> >> >> >> >> >> >> >> >> >From: Troy Varange <varange(a)crl.com> >> >> >> >> >> >Message-Id: <199609300138.AA08482(a)crl12.crl.com> >> >> >> >> >> >Subject: Re: [SPAM] More fan mail from Timmy "peteur" May >> >> >> >> >> >To: dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) >> >> >> >> >> >Date: Sun, 29 Sep 1996 18:38:05 -0700 (PDT) >> >> >> >> >> >In-Reply-To: <FFi2uD82w165w(a)bwalk.dm.com> from "Dr.Dimitri Vulis KOTM" at Sep 29, 96 07:14:50 pm >> >> >> >> >> >X-Mailer: ELM [version 2.4 PL23] >> >> >> >> >> >Mime-Version: 1.0 >> >> >> >> >> >Content-Type: text/plain; charset=US-ASCII >> >> >> >> >> >Content-Transfer-Encoding: 7bit >> >> >> >> >> >Content-Length: 3442 >> >> >> >> >> > >> >> >> >> >> >> >> >> >> >> >> >> What has Timmy been smoking? >> >> >> >> >> >> >> >> >> >> >> >> ]From paul(a)fatmans.demon.co.uk Sun Sep 29 19:03:40 1996 >> >> >> >> >> >> ]Received: by bwalk.dm.com (1.65/waf) >> >> >> >> >> >> ] via UUCP; Sun, 29 Sep 96 19:14:06 EDT >> >> >> >> >> >> ] for dlv >> >> >> >> >> >> ]Received: from disperse.demon.co.uk by uu.psi.com (5.65b/4.0.061193-PSI/PSINet) via SMTP; >> >> >> >> >> >> ] id AA25790 for dlv(a)bwalk.dm.com; Sun, 29 Sep 96 19:03:40 -0400 >> >> >> >> >> >> ]Received: from post.demon.co.uk ([(null)]) by relay-2.mail.demon.net id ac16129; >> >> >> >> >> >> ] 29 Sep 96 15:59 BST >> >> >> >> >> >> ]Received: from fatmans.demon.co.uk ([158.152.120.223]) by relay-3.mail.demon.net >> >> >> >> >> >> ] id aa09441; 29 Sep 96 15:54 BST >> >> >> >> >> >> ]Received: from fatmans.demon.co.uk by fatmans.demon.co.uk with SMTP >> >> >> >> >> >> ] id AA843903697 ; Sat, 28 Sep 96 09:41:37 +0000 >> >> >> >> >> >> ]Comments: Authenticated sender is <paul(a)fatmans.demon.co.uk> >> >> >> >> >> >> ]From: paul(a)fatmans.demon.co.uk >> >> >> >> >> >> ]To: "Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> >> >> >> >> >> >> ]Date: Sat, 28 Sep 1996 09:21:37 +0000 >> >> >> >> >> >> ]Mime-Version: 1.0 >> >> >> >> >> >> ]Content-Type: text/plain; charset=US-ASCII >> >> >> >> >> >> ]Content-Transfer-Encoding: 7BIT >> >> >> >> >> >> ]Subject: Re: Possible subs attack???? >> >> >> >> >> >> ]Priority: normal >> >> >> >> >> >> ]X-Pm-Encryptor: JN-PGP-P, 4 >> >> >> >> >> >> ]X-Mailer: Pegasus Mail for Windows (v2.31) >> >> >> >> >> >> ]Message-Id: <844008901.9441.0(a)fatmans.demon.co.uk> >> >> >> >> >> >> ] >> >> >> >> >> >> ]-----BEGIN PGP SIGNED MESSAGE----- >> >> >> >> >> >> ] >> >> >> >> >> >> ] >> >> >> >> >> >> ]> The lying sack of shit Timmy May <paul(a)fatmans.demon.co.uk> writes: >> >> >> >> >> >> ] >> >> >> >> >> >> ]> The lying sack of shit Timmy May lies again, as usual. >> >> >> >> >> >> ] >> >> >> >> >> >> ]Fuck you, >> >> >> >> >> >> ] >> >> >> >> >> >> ]I am not Tim May, Check out the return path if you don`t believe me, >> >> >> >> >> >> ]if you still don`t here`s my PGP public key signed by the EFF, they >> >> >> >> >> >> ]don`t sign keys here and there without checking ID`s... >> >> >> >> >> >> ] >> >> >> >> >> >> ]Type Bits/KeyID Date User ID >> >> >> >> >> >> ]pub 1024/5BBFAEB1 1996/07/30 Paul Bradley <paul(a)fatmans.demon.co.uk> >> >> >> >> >> >> ] >> >> >> >> >> >> ]- -----BEGIN PGP PUBLIC KEY BLOCK----- >> >> >> >> >> >> ]Version: 2.6.3ia >> >> >> >> >> >> ] >> >> >> >> >> >> ]mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 >> >> >> >> >> >> ]6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 >> >> >> >> >> >> ]sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR >> >> >> >> >> >> ]tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az6JAJUDBRAy >> >> >> >> >> >> ]NwfvNkCBjDT0xHEBATQPA/9TORmN/UjNecj03q4anpvdyCLiez5sKuNbnYK50RiP >> >> >> >> >> >> ]Jj4QpWWvST3smyQ0A86DrZY/re056MXwQmARESx0rFZxdnD0oORICl5r8dJLIy3b >> >> >> >> >> >> ]j8rbA5olXwZwKz73/X5s13v/pvHYX4cIsbVK8NHXqh5llSKt6TBAuGgkIGF29z5k >> >> >> >> >> >> ]C4kAlQMFEDI3B9mdtf/umVkv7QEBcRYD/1FBteLqsUmr81euxqqnnrpLlyHb58B/ >> >> >> >> >> >> ]9sdATuua4uSjX46hXDZ264YozspNrzSB4NEdrmXOWVX3fiE0ga6XkSSkIeF23V90 >> >> >> >> >> >> ]En37Z0BdbFzgF00FRYTFyTq8eezQrdg/+rBPUsZUmG5wpq3e12FKHQsX01i+1mB2 >> >> >> >> >> >> ]YmqqwCV5e95eiQCVAgUQMh8uSb5OPIRbv66xAQEqJwP/fxQyiCasjFcbDpsFfsYp >> >> >> >> >> >> ]put5cCC/9pOx6X3DlbKShPMpUOS+A9HsTEmJQN8Iawv1nSwPdtc2cR/GhW6ilVjW >> >> >> >> >> >> ]LSloGdMVLabm9pGpZZMkRaZlXFUkOv7VhfgsUiL+vIDryBCAwUZCzQiWycjt/cPi >> >> >> >> >> >> ]mUqFH41Z7NkyO8ZFdi5GGX0= >> >> >> >> >> >> ]=CMZA >> >> >> >> >> >> ]- -----END PGP PUBLIC KEY BLOCK----- >> >> >> >> >> >> ] >> >> >> >> >> >> ] >> >> >> >> >> >> ] >> >> >> >> >> >> ]-----BEGIN PGP SIGNATURE----- >> >> >> >> >> >> ]Version: 2.6.3ia >> >> >> >> >> >> ]Charset: cp850 >> >> >> >> >> >> ] >> >> >> >> >> >> ]iQCVAwUBMkzuH75OPIRbv66xAQHSmQQAqw0F/lIsCcQwOpiSQDx4hMqOVVUVXbyR >> >> >> >> >> >> ]3RMWY20ECE0TpAtJ6hkAiqphsWUSBqiFj2kGHMh+jHSHXIMPF+m1qtwVbgutJC7B >> >> >> >> >> >> ]8VYWj0VP+bGu5dEUisLrVHDNj5ucEIDyK2GnqObiCiKARFUbOuZnMQOp9TDJqibh >> >> >> >> >> >> ]2Wqa5+h8R7g= >> >> >> >> >> >> ]=/M2U >> >> >> >> >> >> ]-----END PGP SIGNATURE----- >> >> >> >> >> >> ] >> >> >> >> >> >> ] Datacomms Technologies web authoring and data security >> >> >> >> >> >> ] Paul Bradley, Paul(a)fatmans.demon.co.uk >> >> >> >> >> >> ] Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org >> >> >> >> >> >> ] Http://www.cryptography.home.ml.org/ >> >> >> >> >> >> ] Email for PGP public key, ID: 5BBFAEB1 >> >> >> >> >> >> ] "Don`t forget to mount a scratch monkey" >> >> >> >> >> >> >> >> >> >> >> >Fuckhead. >> >> >> >> >> >> >> >> >> >Fuckhead. We know your behind Vulis, Cock-sucker >> >> >> >> >> >> >> >and he swallows >> >> >> >> >> > >> >> >> >Fuckhead. >>

2 1

CNET Digital Dispatch Vol. 2 No. 40
by Alan Olsen 17 Dec '03

17 Dec '03

This was in the latest version of CNET's e-mail list. Anyone want to add a few good sound bytes? > >7. "YOUR TURN": ARE ENCRYPTION LAWS TOO STRICT? > >The White House has finally loosened up the export restrictions on >powerful encryption software: > > http://www.news.com/News/Item/0%2C4%2C4003%2C00.html > >But the software industry and the Web community generally agree >it's too little, too late. How do you feel about the export of >encryption technology? What about the government's continued >insistence that law enforcement be availed of a method to decode >any encrypted message if granted a court order? > >To contribute your opinion, phone CNET at 415/395-7805, enter >extension 5400, and leave a message. We'll listen to the responses >and broadcast some of the best on CNET Radio. > >Each week Digital Dispatch brings you the new "your turn" >question, and each Wednesday you can hear the responses to the >previous week's question on CNET Radio: > > http://www.cnet.com/Content/Radio/ --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

"Mormon Asshole?" re: GAK
by John C. Randolph 17 Dec '03

17 Dec '03

Attilla Says: >but what inflames the anti-mormon passions the most is the >paid clergy of other organized religions whose employment is >the paid ministry to their flock. Mormons threaten their jobs; >the mormons have no paid ministry; it is all part of our >"callings" to do the Lord's work. Well, speaking as one who has occasionally been called anti-mormon (although, I'm *really* not that specific!) The only time I feel any anti-mormon "passion" is when I want to throttle one of your missionaries. I like sleeping in, and being awakened by a kid who wants me to join a religion is really offensive. If the LDS church would just give up this damnable proselytizing, I'd find you no more objectionable than the Tibetan Buddhists (whom I actually hold in rather high regard, although they're never going to convert me either!) -jcr PS: I do think it's a Good Thing that mormons don't pay the clergy. One positive for LDS. Did you pick up that idea from the Ba'ha'i?

3 2

Re: ADJ_ust
by azur＠netcom.com 17 Dec '03

17 Dec '03

Ya' know, I keep seeing government references to all this terrorist technology and know-how on the Net, but when I do some pretty exhaustive searches I come up pretty-much empty handed. Are their claims just rhetoric or am I incompetent at using Web search tools? For example, where can one find on the Net: the means to anonymously purchase CBW precursors or strains, manufacuting and know-how? Where can one find practical EMP designs and components? Where can one find practical Fuel/air explosives device construction info? I'm sure you can think of other significant items I've left out. Hope you get the picture. >On Wed, 2 Oct 1996, Adamsc wrote: > >> I have strong >> doubts that someone would come up with a non-nuke that could destroy stuff >> indiscriminately within a useably large area. > >Fuel/air bombs. > >--Lucky

1 0

picture encryption
by scottb＠aca.ca 17 Dec '03

17 Dec '03

Sometime back someone mentioned a program that would hide messages inside a picture, by replacing the LSB of the color with the message. Does anyone know where I can get this?? I was thinking that if they outlawed high strength encryption (non GAK approved), not letting them realize that you were sending encrypted information would be an excellent alternative. Of course the message hidden in the image would be encrypted as well. You could spend many months on trying to break the key, only to find out that it was really only a picture. /sb

1 0

Speaker Wanted
by se7en 17 Dec '03

17 Dec '03

I need someone who can give a speech on Contingency Disaster Planning from November 4-6 in Northern California to the computer security group at NASA AMES. Female speakers are encouraged as well. All expenses would be paid as well as a speaker fee for each individual day. While this is a *one time* event, it may be possible that it would lead to other engagements on a periodic basis both across the US, and infrequently in Japan and Europe. Email me if interested or if you need more information. se7en

1 0

Re: Cybertax
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text MIME-Version: 1.0 Date: Fri, 4 Oct 1996 10:17:00 -0500 Reply-To: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> Sender: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> From: Evelyn Brody <ebrody(a)KENTLAW.EDU> Organization: Chicago-Kent College of Law Subject: Re: Cybertax Comments: To: loukidej(a)tor.gpv.com To: CYBERIA-L(a)LISTSERV.AOL.COM The U.S. Treasury Department and other agencies are quite interested in these issues. In September, at a 2-day conference in Washington, DC, on electronic money and banking, Internal Revenue Commissioner Margaret Richardson described the concerns of tax commissioners world-wide about digital currency. Treasury will be issuing a White Paper in the next month or two that will request comments from the public on a range of tax and policy legal issues relating to electronic commerce. These issues will include, among others, permanent establishment, U.S. trade or business, and compliance and enforcement. See the news story in _Tax Notes_ magazine, Sept. 23, 1996, at 1588, by Ryan Donmoyer, "Tax Principles Must Be Applied to Wired Economy, Richardson Says." (A version of this story is also available electronically in LEXIS, Fedtax Library, TNT file (as a new search).) EB --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

legality of wiretapping: a "key" distinction
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

reponses to my last post were very illuminating and interesting, and one key point by someone-or-other caught my attention. he made the distinction of "search and seizure" made with the knowledge of the person involved, and "search and seizure" such as wiretapping done without the knowledge of the person surveilled. if one were to try to say that wiretapping was unconstitutional, it seems one would have to define why it is an *unreasonable* kind of search and seizure. and this distinction might be a great, prime candidate: because the participant is *unaware* of the "seizure," there is too great a potential for abuse. it seems to me many people's fears here boil down to this fear of the government surveilling them without their knowledge, of them being denied the right to choose to be in contempt of court and reject handing over information when presented with a warrant/subpoena. (is this a right? is it being broken by surreptitious surveillance?) == I am really amazed that there isn't much case law on wiretaps, which have been around a long time. at least it is rarely quoted here. what exactly is a legal wiretap? has anyone challenged the fundamental authority of the government in making wiretaps in which subjects are unaware of the metaphorical "search and seizure" going on? recent Bernstein and Junger cases are going to be fantastic milestones in our legal system for challenging the cryptographic status quo. I wonder if cpunks might be interested in challenging the wiretap status quo!! it would seem like the first logical step. the FBI has often said they don't want to expand their powers in wiretapping areas. but are those powers they have right now legitimate? if they are not, as many here seem to argue, then they ought to be challenged in court ala the one-man-guerilla attacks like Bernstein and Junger. (any takers? <g>) anyway, I propose that cpunks try to collect all the minutia in the case law about wiretaps and try to make the case that wiretapping that the FBI has enjoyed is itself not legitimate, and therefore any extension of it (such as Clipper) is also illegitimate. == more and more I wonder if this is one of the key differences between libertarian and spook bureacrat's views on GAK, key escrow, key recovery (let us put it all under the heading "key access"). the spooks seem to emphasize that they should be able to get access to communications without giving anyone the opportunity to refuse or possibly even know about such access. libertarians seem to insist that this is a violation of privacy and due process etc. I think there may be a legitimate argument here that might have legal merit that a reasonable "search and seizure" ought to involve the knowledge of the participant, and that unreasonable searches and seizures often do not. hence, wiretapping without suspect agreement may be illegal? (in all the other ways that evidence is obtained through warrants/subpoenas, one needs the cooperation of the suspect?) obviously the government would argue that the cooperation of the suspect is irrelevant and impossible. what exactly does it mean to "present a warrant" or subpoena? is there a right to refuse such a subpoena similar to the way one is guaranteed freedom from self-incrimination?

4 5

Re: DESCrack keyspace partitioning
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Seems to me that a _subset_ of all possible keys is much more likely > to appear than a random selection from an equidistributed population 0..2^56. No, this is not true of a good PRNG > (P)RNG's just aren't that likely to produce a key of 010101010..... > nor 001100110011... etc etc and I have been thinking about how one might formalize > and exploit this randomness property to increase the probability of finding the key sooner. Good PRNGs are as likely to produce these key values as anything else. the reason random looking patterns occur more often is because there are more of them. > Is not the lack of predictability a predictable, and therefore exploitable, attribute? The fact is a PRNG may *LOOK* predictable, ie. 111000111000 but the next bit will have an equal probability of being a 0 as a 1. > Any thoughts here? None whatsoever. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: The Right to Keep and Bear Crypto
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Crypto relevancy? Well, the so-called "gun nuts" have already tolerated far > more regulation and restriction of guns than we should ever accept. But if > we use their tactics, can we expect any better results? I don`t know so much about the US law, but here in the UK the problem with the gun lobby and the campaigns against internet controls are purely volume and not technique, there has not been enough done. In the UK now we are looking at a total ban on handguns, within 5 or 10 years all guns will probably be banned, the shit has seriously hit the fan over here, all because of the Dunblane murders (15 or so schoolchildren killed by a nutter with a legally owned (licenced) handgun) The fact is the police fucked up, he was known to be a loner and a child molester and they granted him a firearms licence. In addition the media have played a big part too, I don`t know if the US mainstream paper media is as bad as the UK`s but we have about 5 papers which I wouldn`t wipe my ass on, such as the sun, the mail, the mirror etc. all of which have, at sometime during the ordeal used the exact words below: Gun owners are big children who like to play with dangerous toys All gun owners are dangerous psychopaths They have also described gun lobby activists as "gun toting" and "obsessed with firearms" More has got to be done before the USA goes the same way, I sure as hell won`t be living in the UK much longer if the law continues to change like it has. Fuck them all, that is really all I can say, don`t let it happen to you kids... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

KRF_eat
by jya＠pipeline.com 17 Dec '03

17 Dec '03

A roundup of press reports on GAK: "IBM, other firms, in data encryption alliance" The consortium was initiated by IBM. "Export controls are a fact of life," said Jim Bidzos. "U.S. To Loosen Computer Code Restrictions" "It's wrongheaded, and it's going backward," Peter Harter, at Netscape, said. "U.S. Export of High-Tech Devices Planned" CDT's Danny Weitzner said U.S. companies' and citizens' encrypted communications sent over the Internet could be vulnerable to "improper foreign government access." The administration doesn't want that to happen and is working with major trading partners and other countries to adopt plans that are consistent with the U.S. plan and to expedite electronic key recovery by law enforcement, the CIA's Deutch said. "IT Execs, Lawmakers Reactions Mixed on Encryption Plan" Rick Cardona, a security technology engineer at security software maker TradeWave Corp., said the law doesn't go far enough. "I think this is part of a trend. It's only a matter of time before the government will allow exports of 128-bit key software." "NCR Corp. Joins Alliance To Develop Exportable, Worldwide Strong Encryption " "We also look forward to the rapid movement of the work of the alliance into an established standards- based consortium body." "TradeWave meets new government data encryption requirements" Although other Internet software security companies have announced their intention to support this new key-recovery requirement, no other Internet Web security software company currently offers this service to its customers besides TradeWave. TradeWave's current customers, which include over 350 electric power companies representing over 70% of the electric power industry, are using the TradeVPI software and services which include this key recovery feature. ----- http://jya.com/krfeat.txt (22 kb for 6) ftp://jya.com/pub/incoming/krfeat.txt KRF_eat

1 0

Re: Fw: Re: ITAR satellite provision
by jim bell 17 Dec '03

17 Dec '03

At 08:09 PM 10/4/96 +0000, The Deviant wrote: >On Thu, 3 Oct 1996, Black Unicorn wrote: >[...] >> "A launch vehicle or payload shall not, by reason of the launching of such >> vehicle, be considered an export for purposes of this subchapter." >> >> Focus on "by reason of launching of such vehicle," >> >> Launching a vehicle alone is not export. It takes more than launch to >> make it an export. More than the launching is not much. >[...] >> -- >> I hate lightning - finger for public key - Vote Monarchist >> unicorn(a)schloss.li >> > >So.. if I were to take PGP, put it on a floppy disk, tape it to a model >rocket, and launch it across the mexican border, that's not exporting it >(although the FAA might complain)? That's _my_ interpretation. I look at it this way: Missile launches can 1. Return to the country of origin. 2. Splash down in International waters. 3. land on foreign soil. 4. Orbit for awhile and land "somewhere." 5. Orbit essentially forever. 6. Go somewhere in space other than an earth orbit. All this stuff is obvious to the people who wrote the regulation. In addition, it is not necessarily certain which of these outcomes will occur in any given launch. The terminology in the rule above does not distinguish any of these outcomes. In the absense of further clarification, it is logical to conclude that which particular route the missile subsequently takes is irrelevant to the applicability of the exception. This is particularly true, since the writers of that regulation were free to add clarification should they have chosen to do so. Further, that they DIDN'T "clarify" is logical, because if the outcome of any given missile may be uncertain, and assuming that this regulation was written as a mutual-suck-up maneuver between government and industry, it is reasonable to assume that the regulation would be interpretated to immunize the launcher regardless of the launch's outcome. One can reasonably suppose that Rockwell wouldn't want to be declared in violation of ITAR simply because the second stage of a rocket failed and dropped a crypto-carrying satellite onto China. Jim Bell jimbell(a)pacifier.com

2 1

ABA Likes GAK
by jya＠pipeline.com 17 Dec '03

17 Dec '03

10-03-96 at 19:09 EDT, American Banker Banks Like Export Plan for High-Power Encryption By Drew Clark ----- "Banks have really taken a leadership role in the responsible management of cryptography," said a senior Clinton administration official who asked not to be named. "Banks are already doing what we want other organizations to do: safeguarding their keys and providing them, when necessary, to law enforcement." "Providing 56-bit encryption with key recovery doesn't help us," said Netscape spokeswoman Chris Holton. "The government is saying that you can export it but you have to provide us with the keys. We feel that is extortion on the part of the government." "We are making the best of a bad situation," said Scott Schnell, vice president of marketing for RSA Data Security. ----- Bank technology experts have reacted favorably to the Clinton administration's proposal to liberalize the development and sale of strong data security tools. This week, the government said it would lift export restrictions on certain kinds of cryptography, provided U.S. companies agree to cooperate with a procedure that would give law enforcement officials access to the "keys" of such codes, upon presentation of a warrant. Banks were heartened by the announcement because many view the widely used Data Encryption Standard - a low-level form of data scrambling - as inadequate protection against the rising computer power of so-called hackers. Though banks can use a complex 56-bit data encryption key for financial transactions, sensitive communications with overseas branches are limited to a less powerful 40-bit standard. Banks hope that a loosening of restrictions in general will benefit them, too. "This policy announcement is better than anyone expected," said Kawika M. Daguio, federal representative at the American Bankers Association in Washington. "It is gravy for us, but it's the meat and potatoes for the hardware and software industries." "Banks probably won't be adversely affected," said Stewart A. Baker, a partner at Steptoe & Johnson, a Washington law firm, "and they will be left pretty much where they were before." The announcement by Vice President Al Gore said that controls over powerful encryption technology would be lifted as the government and private sector develop a "key recovery" system. (International Business Machines Corp. already has stepped forward to head a consortium dedicated to creating such a system.) Current law forbids the export of computer hardware or software that uses cryptographic codes with digital "keys" - randomly generated combinations of 0's and 1's - longer than 40 bits. The longer the key length, the more impenetrable the code. For three years, the government has said it would permit the general use of more complex cryptography only if the companies using it placed their keys in the hands of the government or a third party. "Key escrow," as it is known in the technical community, is needed in order to prosecute people who have stored evidence of illegal activity on the hard drive of a computer, officials argued. But the private sector - banks included - have balked at handing over such access to any third party. The disagreement gave rise to a compromise system known as "key recovery" in which companies would hold their own keys but could be required to divulge certain information about specific transactions when presented with a court order or warrant. "What is novel is that it doesn't escrow any keys," said Homayoon Tajalli, executive vice president of Trusted Information Systems, Glenwood, Md., one of IBM's consortium partners. "If the government comes and gets this data with a court order," explained Mr. Tajalli, "then they take a digital lockbox from the third party or parties that hold it, and they read the message." Kathy Kincaid, director of information technology for IBM, said the difference between key escrow and key recovery is analogous to the following approach to securing a house when its owner goes on vacation: Instead of giving a key to two neighbors, the owner gives each neighbor half the combination to a lockbox that holds the key. "You must have both halves and put them together in exactly the right sequence," said Ms. Kincaid. "This provides protection against a single point of attack." Companies participating in development of key recovery systems include: Apple Computer Inc., Digital Equipment Corp., Groupe Bull, Hewlett-Packard Co., NCR Corp., RSA Data Security, Sun Microsystems Inc., Trusted Information Systems, and United Parcel Service. And a government official said banks may even play a role. "Banks have really taken a leadership role in the responsible management of cryptography," said a senior Clinton administration official who asked not to be named. "Banks are already doing what we want other organizations to do: safeguarding their keys and providing them, when necessary, to law enforcement." Heidi Kukis, a spokeswoman for Vice President Gore, said: "This key recovery system is the proper balance between commercial interests and national security." But not all agree. Some argue that the key recovery system still gives the government too much control over information flow. "Providing 56-bit encryption with key recovery doesn't help us," said Netscape spokeswoman Chris Holton. "The government is saying that you can export it but you have to provide us with the keys. We feel that is extortion on the part of the government." "We are making the best of a bad situation," said Scott Schnell, vice president of marketing for RSA Data Security. "The bottom line is that the standard proposed by the government is an insubstantial step in the right direction," he said. "We want to make sure it is usable and prepare for the day that products will be available that do not have this key recovery situation." The government's announcement came three months after a National Research Council report on the role of cryptography in an information-oriented society. The report encouraged liberalization of government standards and questioned the feasibility of the key escrow system then favored by government. "We raised the issue about the security of key escrow systems," said law professor Kenneth W. Dam, chairman of the body that prepared the report, "and we said the government should work on it." "I take it this is an attempt to move in the way of key escrow, with the help of industry," said Mr. Dam. [End]

1 0

[COMMENT][GAK] "GAK from KRAP"
by Brian D Williams 17 Dec '03

17 Dec '03

1) Thanks to Phil Zimmerman the world already has "Pretty Good Privacy." 2) Only an idiot, much less one of the 4 Horsemen would get caught using GAK from KRAP. 3) As the FOIA obtained documents from the Clipper I era indicated, the gubmint knows the only way to make this work is to ban other forms of encryption. 4) That and that alone would be "The Shot Heard 'Round the Net." Brian

1 0

Re: MacGAK: Tim has a snit. Again.
by jim bell 17 Dec '03

17 Dec '03

At 11:30 AM 10/4/96 -0400, Robert Hettinga wrote: >It's interesting to note that the only person who is supposed to be in your >killfile is Perry Metzger, even though you respond to him anyway, >especially when he says something which offends your vanity. So, such a >killfiling claim is probably dubious. Since such luminaries as VZNuri, Dr. >Vulis, and Jim Bell are *not* in your killfile, evidenced by your >voluminous replies to them, Aw, C'mon Bob! I resent being placed in the same short list as Nuri and Vulis. While some people may consider my ideas to be similarly wacky, I try to not be NEARLY as rude as those other guys (singular?). Jim Bell jimbell(a)pacifier.com

2 1

Re: (Firewalls) Where is that Snake Oil FAQ again?
by Lou Zirko 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: adam(a)homeport.org, cypherpunks(a)toad.com Date: Fri Oct 04 18:15:25 1996 This is the same company that made the claim earlier on this list to "break our code and own the company for $1". It definately generated a lot of comments then, I think about six months ago. They changed their name to IPG midway through the process. This should be in the archives. Sorry about the late response to this but I have been unavailable for the last four days working on a project and am just beginning to catch up on sleep and mail. Lou Zirko Lou Zirko (502)383-2175 Zystems lzirko(a)c2.org "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 iQEVAwUBMlWamctPRTNbb5z9AQGoAggAngPrYPYCOp+53BZ3Ns0XJtsI6O/PqUzQ sbxzpROa/blx9O3e1zIxbxPk1+aQcEwUXsnfFbDnciAjouaSnRzIfKG9XJ+cOy5y XRaLzBgZ3lQr3fIp7mHv5n+nsdtrj8mdgmUxYXpO9q+MwTuGL54n12Qw23rJ4KMq TSkBSgJWeqr7Mf1X2bI8ejaIbgImv9dCNFXIF+mUpKea2rarGej7lM1NOFd5FuyT umaFeOcH05pcmC8sYmaabe5i9kmDXztCiGaCD3O101a7JoIh8GOCNjg7blo7q/lZ rw77jyYpsI+3Ra67jWOMRK3p3WeBq9K8XqpP0b0Wo02R5nU1w5UnjQ== =eT3d -----END PGP SIGNATURE-----

1 0

Did HP get a sweetheart deal, too?
by Ernest Hua 17 Dec '03

17 Dec '03

Ditto ... I expect Apple and the rest of the "gang" to announce something soon. Ern -------- From: San Jose Mercury (Breaking News) Hewlett-Packard wins $100 million NASA deals PALO ALTO, Calif. (Reuter) - Hewlett-Packard Co. said Friday that it won several contracts with a potential value of $100 million from the National Aeronautics & Space Administration (NASA). The contracts cover scientific and engineering workstation procurement contracts for mechanical computer-aided design and geographic information systems. The contracts cover a four year period. Hewlett-Packard will provide workstations, as well as peripherals, software, training and support services.

1 0

Sun's GAK position
by Frank Stuart 17 Dec '03

17 Dec '03

I haven't been able to find a position statemnet from Sun Microsystems about the new GAK plan, but it looks like I did find a position. This is from "http://www.sun.com/corporateoverview/CorporateEmployment/LISTINGDIR/JobDeta…": >Created on Oct 01 1996 06:01. To return to: Employment Opportunities Home >Page. >---------------------------------------------------------------------------- > >Sun Employment Req#: AUF971004 > >SUMMARY > >Descriptive Title: System Engineer >Skills: Security & Cryptography Exp. >Functional Area: Engineering: Engineering >Location: Vienna, VA > >DESCRIPTION > >Extensive Security and Cryptography knowledge and skills, ability to >authoratatively present and advocatae security technologies at technical and >public policy levels, confidence and skill at writing and presenting >security documents and presentations. specific knowledge of government >security requirements. A US Government Top Secret SCI and potentially other >clearances will be necessary for this position. >The position of Principal Architect for Security and Networks requires an >individual with the following levels of education, experience and >specialized knowledge. A masters degree in a computer related field or a >bachelors degree in a computer technology and a masters degree in a business >oriented discipline is required. A minimum of twelve years of directly >related experience in computers, computer security and mission critical >systems design, and deployment is also required. Credit for four years >experience may be granted for a candidate with a masters degree in computer >science or computer security. Up to six years experience can be credited for >a PHD in somputer security. The condidate needs experience and >specializedknowledge in the areas of: >Government Security Requirementes, NSA MISSI and DoD DMS programs, Public >policy issues of cryptography and Key Escrow, Current workstation and server >hardware, Trends in network and systems security, Analysis of competing >security products and technologies. Hands-on experience with installing and >configuring computer hardward, Sun's product offerings in the security >arena, NCSC and Common Criteria evaluaations of trusted systems. Export >controls as they apply to encryption and security products. >To be successful in the position the candidatae must be able and willing to >write short analytical papers and long research documents. The position also >requires short notice or extemporaneous presentations on security, >technology and Sun specific subjects to groups of one to two hundred >customers or industry professionals. >A successful candidate must be capable of presenting themselves in an >authoritative fashion on many aspects of security in order to influence >product development in directions advantageous to Sun Federal. the candidate >must also be comfortable and confident when representing Sun and Sun Federal >in government and industry standards bodies and technology forums. >To be successful the candidate must be able to develop, define and >articulate a security vision and to develop support both within and external >to Sun for necessary technological and procedural changes necessary to >accomplish that vision. The condidate must either hold or be capable of >receiving US Government Security Clearances for Top Secret and Special >Compartmented Information. These clearances may require a CI Polygraph test. >This position will be locate in Vienna, VA and report to the Sun Federal >Director of Systems Engineering. >---------------------------------------------------------------------------- >CONTACT: >Employment Agency resumes referred to this posting are considered >unsolicited; Sun does not accept unsolicted resumes. >To apply, please reference the requisition number of AUF971004 and email, >fax or mail your resume, attention Recruiter: Staffing45/OWSMI96, using: > > * Resume Submittal Form > * Email alias: Staffing45(a)bruin.corp.Sun.COM [ASCII ONLY, PLEASE] > * Fax number: 630-285-8177 > * Mail Address: > Sun Microsystems, Inc. > 2550 Garcia Avenue > Mountain View, CA 94043-1100 > Mail Stop: UITA01 > >---------------------------------------------------------------------------- > >Employment Opportunities at Sun > >---------------------------------------------------------------------------- | (Douglas) Hofstadter's Law: | It always takes longer than you expect, even Frank Stuart | when you take into account Hofstadter's Law.

1 0

Re: The Right to Keep and Bear Crypto
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Why is it "disturbing" that for administrative convenience a regulation >uses a shorthand term (in effect saying "treat crypto as if it was a >munition"), but that the courts say whatever convenient shorthand you use >for regulatory bookkeeping, it has no constitutional effect? > >What would be the advantage of having the government simply re-impose the >ITAR word for word identically for all materials that are not arms in the >constitutional sense? I guess this is the crux of the matter. I believe that most or all of ITAR's munitions should be constitutionally as arms. > >As for your argument that the 2nd Am should be read expansively, rather >than narrowly, personally I doubt strongly that the Framers would have >been unanimous on this. I doubt they were unanimous on most any issue. >Recall that the Articles of Confederation were >abandoned in part due to Shay's rebellion -- and the (majority) >Federalists (of whom the Jefferson you quote WAS NOT a part) managed to >push through a strong centralizing government. Yep, when they saw that some of the principles which help fuel the Revolution could be used to oppose a new order they adopted some of the same tactics and governmental view points of their former oppressors. The original calls for strong states rights and a weak central authority were swept away under Hamilton and early Supreme Court rulings. In some sense, the new government became just different clothing on the same old body. >Recall that the >constitution in its first draft didn't even have a bill of rights! I am >absolutely certain that the Framers recognized that things change over >time, and that they would have intended indeed did intend for us to >interpret the constitution with some degree -- but not too much -- >flexibility. As someone who believes in the importance of fidelity to >legal texts, I think we have a duty to make every word in the Constitution >count. I therefore place weight on the fact that the 2nd amendment is >*unique* in giving the policy reason for the limitation on government >power ("a well-regulated militia" being essential &tc.). This is ample >grounds to read the text as applying only in the context of an organized >militia -- not casual gun ownership -- **whether or not** this complies >with our best (and inevitably fallible) reconstruction of what certain >historical individuals may have thought the text meant, especially if the >historical evidence is mixed. [The Constitution preserves] the advantage of being armed which Americans possess over the people of almost every other nation [where] the governments are afraid to trust the people with arms. --James Madison The Federalist No. 46, 1787 >[PS. Why do you privilege the authors of the bill of rights over the >people who voted for it?] Many of the framers, their mentors (e.g., Machiavelli) and even dyed-in-the-wool pacificists (e.g., Mahatma Gandhi) feared a central authority which, after making arms unavailable to general population would commence to tyranny. If I did I appologize. It was not intentional. > >I might add that I personally find all discussions of plots to kill >people, or to watch gleefully while others seek to do so, so morally >repulsive that I now killfile everyone who takes part in them. I hope that includes all comuniques from our government's Executive branch (although they almost never discuss these things publitically, with the possible exception of our raid on Kadaffi). How about the popular U.S. consensus that the government aught to have killed Saddam? Seems to me that some of the natural rights the people gave the government need to be taken back (such as the perogative for personal actions affecting those outside the U.S.) Though I doubt that the government would ever allow it. Why should the government call all the foreign policy shots and have all the fun? Especially when you see what a poor track record they have. Seems they should step aside for while and let some direct democracy go to work for a change. Thanks for your informative responses. I don't expect a reply as you've undoubtedly placed me in your kill file (as some other may have already). -- Steve

2 1

[Books] Kahn's *The Code Breakers*
by stainles＠bga.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- My room-mate just brought me the latest catalog from Uncle Hugo's Science Fiction Bookstore & Uncle Edgar's Mystery Bookstore. The updated edition of Kahn's *The Code Breakers* is listed as being expected by mid-November, with a cover price of $65. (No publisher listed.) Hugo's can be reached at 612-824-6347, or unclehugo(a)aol.com. No connection except as a satisfied customer. ==Dwight -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBMlW+rYY4AzhdF11FAQEfzwP5AXP/63of9MPefzguLX5n9byRVUPcXOKT cYJNdTGe9ErVb6skDNN7e4PiwlZPSV03OFgntsp9CBFed+2AN/d+EFI3kNyFWQ5p fwEZ2u6VYINaQ0PhYaxneoMrxa+U8gnB5PZ8sa/Pwq4hhf6XxcOk7vUwKsLPQmeX 2KBLVLKeWj8= =f5D5 -----END PGP SIGNATURE-----

1 0

Re: Fw: Re: ITAR satellite provision
by Greg Broiles 17 Dec '03

17 Dec '03

At 08:09 PM 10/4/96 +0000, The Deviant wrote: >So.. if I were to take PGP, put it on a floppy disk, tape it to a model >rocket, and launch it across the mexican border, that's not exporting it >(although the FAA might complain)? As I read the regs, it's not an export at the moment it's launched, but it's almost certainly an export when it reaches Mexican airspace or when it touches Mexican soil. The "rocket exception" is not useful vis-a-vis crypto. Period. I'm very sorry I ever had anything to do with this thread and I'm not posting about it again. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

2 1

Re: legality of wiretapping: a "key" distinction
by jim bell 17 Dec '03

17 Dec '03

At 06:10 PM 10/4/96 -0700, Vladimir Z. Nuri wrote: >>It didn't have to be this way. The SC might simply have said that wiretap >>warrants must follow the same rules all other warrants followed, meaning >>that the target is informed of the tap when it is placed. Sure, the police >>would howl, complaining that they'll never hear anything "useful" if the >>target is informed, but then again, the Constitution cannot guarantee that >>any particular search would achieve its intended results. > >but then again, if "we the people" didn't challenge a usurpation of >our rights when it happened, something's wrong here. I've read references to polls which repeatedly show that well over 60% of the public is opposed to wiretaps, period. But no, I'm under no illusion that even a legal challenge would be respected. > hence my >opinion that wiretapping should be challenged in court. Well, I agree it should be challenged, but if anything my point is that the reason it wasn't challenged was the fact that wiretap targets are never given the opportunity. (Note for the clueless out there: An after-the-fact challenge doesn't count. Apparently, "non-incriminating" wiretaps are essentially never announced to the victim...er...target. And judges are sufficiently biased, gutless, and brainless that they almost never throw out the _incriminating_ results of a wiretap warrant. THis is for the same reason Judge Ito didn't throw out the evidence the four crooked detectives got in OJ's house, after jumping the fence without a warrant, claiming that they were afraid somebody was in danger inside. As I'm fond of saying, "Fuhrman pretended to tell the truth, and Ito pretended to believe him.") >>Are police entitled to use thumbscrews if simply asking a question won't get >>the "right" answer"? I don't think so. > >very poor analogy. a rhetorical loser imho characterisitic of >painting the issue in terms of extremism. wiretapping doesn't involve >any physical pain to the surveilled. also it is barely analogous >to "search and seizure" in that there is nothing physical being >seized. (just playing the devil's advocate here) No, not at all. The point is that acknowledged illegal tactics (remember, wiretaps were illegal before 1968, but they were done!) may be unquestionably "useful," but that doesn't mean that they are acceptable. If anything, the fact that cops would use illegal tactics proves that they aren't very good judges of what tactics are appropriate. Furthermore, the fact that telephone companies ALLOWED cops to do illegal wiretaps before 1968 (and even assisted them) proves that you can't depend on them to limit these tactics to reasonable limits. >>One thing that was very important to those who wrote the US Constitution was >>the sanctity of contracts. > >well, if the person entered in a contract with their phone company >to provide protected communications, maybe you'd have a case there. >in fact such a thing is not such a bad idea. Since up until now people have not had a choice, I think it's appropriate to assume that every telephone customer would have been entitled to insist on an anti-wiretap clause, and got it. >>As I understand it, there is a principle in law that all affected parties to >>a dispute must be included in a proceeding. (To ensure that each can protect >>his own rights.) Obviously, targets of wiretaps have not been informed, and >>thus can't possibly have been included. > >on the other hand, there are clear laws that say you can't withhold >evidence. That's misleading. If a cop wants in your house to collect evidence but he doesn't have a warrant, not letting him in is "withholding evidence." But that's obviously okay. So you need to qualify that claim. >>While I'm sure that I will be corrected if this is wrong, somehow I doubt >>whether there has EVER been a "before-the-fact", full challenge of a wiretap >>order _including_ representation for the target of the wiretap. Further, I >>also doubt whether there is frequently ANY SORT of challenge to a wiretap >>by a telephone company, even when the target was not informed. Quite >>simply, the telephone company does not consider itself to be in the business >>of protecting the rights of its customers! And without real challenges, >>there can be no presumed validity to such warrants. > >no, you have it backwards; without real challenges, there >is no validity to anyone trying to defeat the status quo. That depends on whose burden of proof you think it is. Since: 1. Wiretaps were done illegally before 1968, demonstrating that the people involved (cops, government officials) don't think they have to obey the law anyway. This should destroy any presumption on your part that wiretaps are constitutional, because those people are the main ones pushing wiretaps. 2. 60% of the public opposes wiretaps, period. (I think it's arguable that if most of the public decides that society should do without wiretaps, they are entitled to do this. Otherwise, "Who's country is it?") 3. Wiretaps do not resemble ordinary searches, because the target is not informed, and he's not given a chance to challenge them. 4. Wiretaps have "never" been adequately challenged, precisely because the only outside people who know about them have no motivation to do them. (Primarily telephone companies.) I'd say the bulk of the evidence is that the legal system accepts wiretaps simply as a convenience, without genuinely believing that they are constitutional. > >[bernstein, etc] >>Since it has always been legal to use encryption (in the US), they're really >>not "challenging the cryptographic status quo." > >no, ITAR has been around a long time and they are challenging it. you're >mixing up the issue. No, YOU'RE mixing it up. _DOMESTIC_ wiretaps are being compared with DOMESTIC use of encryption. ITAR says nothing about wiretaps. The government is pushing Clipper et al based primarily on domestic wiretap issues. >>I don't know about you, but somehow I'm past the idea that it's possible to >>reliably get unbiased justice in court. Know what I mean? > >ah yes, we revert to the basic cypherpunk nihilist position oft repeated >by lucky green, tcmay etc-- "essentially, we're screwed" Not really. It's just that when there's enough evidence of dishonesty already in the treatment of this issue in the courts, there is no reason to presume that the right decision will be reached in the future. Jim Bell jimbell(a)pacifier.com

1 0

RE: DESCrack keyspace partitioning
by James A. Tunnicliffe 17 Dec '03

17 Dec '03

>geeman@best.com[SMTP:geeman@best.com] writes: >Another thinking step: most real-world DES keys are derived from hashes. >Not (P)RNGs. >The distributions are **not** uniform. Oh?? >I am talking about FAMILIES of predictable bit patterns in keys, not any >specific pattern. >I'm doing the stats. [...snip...] If you've discovered significant biases in MD5, or some other crypto-strength hash, that could be exploited to speed a keyspace search, that would be newsworthy indeed. I'm skeptical, but please share your results with us. [For context, Mike McNally wrote, in part] >[...] a good >32-bit CSPRNG has only a 1/2^32 chance of producing any particular >bit pattern. Of course, another way of saying that is that it's just >as likely to get an "obvious" bit pattern as it is to get any other >one. You can't just throw away part of the keyspace based on such >bogus reasoning. (There may be other reasons to throw away part of >the keyspace, of course.) Tunny ====================================================================== James A. Tunnicliffe | WWWeb: http://www.inference.com/~tunny Inference Corporation | PGP Fingerprint: CA 23 E2 F3 AC 2D 0C 77 tunny(a)Inference.com | 36 07 D9 33 3D 32 53 9C ======================================================================

1 0