December 2003 - cypherpunks-legacy

RE: Microsoft Authenticode key security
by Bob Atkinson (Exchange) 17 Dec '03

17 Dec '03

Actually, and sort of to the point, no, the keys never actually ever the BBN box, except as part of a backup procedure in which they are extracted in a doubly-encrypted form for which for security reasons you need the manufacturer's help in restoring. To this day, no human or computer other than the box itself knows the key. Bob > -----Original Message----- > From: Toto [SMTP:toto@sk.sympatico.ca] > Sent: Wednesday, March 05, 1997 9:18 AM > To: gbroiles-nospam(a)netbox.com > Cc: cypherpunks(a)toad.com; Bob Atkinson (Exchange) > Subject: Re: Microsoft Authenticode key security > > Greg Broiles wrote: > > >From: "Bob Atkinson (Exchange)" <bobatk(a)EXCHANGE.MICROSOFT.com> > > >Subject: Comments and corrections regarding Authenticode > > > > > >For those curious: at the present time, the private keys with which > > >Microsoft signs code that it publishes are managed inside BBN > SafeKeyper > > >boxes housed in a guarded steel and concrete bunker. Even were a > SafeKeyper > > >to somehow be physically stolen, these cool little boxes have > several > > >elaborate internal defenses designed to have the box destroy itself > rather > > >than compromise its keys. > > Bob fails to mention, however, that, as a backup system, the keys > are > also written on pieces of masking tape attached to the underside of > his keyboard. > -- > Toto > http://bureau42.base.org/public/xenix/xenbody.html

4 3

Re: Having the smarts to retire early
by Sean Roach 17 Dec '03

17 Dec '03

At 11:47 AM 3/5/97 -0700, Graham-John Bullers wrote: > >On Wed, 5 Mar 1997, Dr.Dimitri Vulis KOTM wrote: ... >> I feel sorry for Tim May. He's so bored, he reads 'bot fodder. >> I suppose he studies the bounce messages from mailer deamons too. >> >> WARNING: COCKSUCKER JOHN GILMORE IS FORBIDDEN TO REDISTRIBUTE MY E-MAIL FROM >> ANY MAILING LIST ON HIS TOAD.COM COMPUTER. > >Vulis keep your pervert voice off the list. I don't know which person I dispise more. The person unjustly slandering another for any reason. Or the person telling him that he has no right to an open forum. No, I take that back. I'd rather have ten foulmouthed text wizards dragging my name through the mud, with my self to defend my name as opposed to even one person declaring that they leave "for the public good". As for argument, I have no problem with arguing, so long as neither tells the other to "get lost" so everyone else can have some peace and quiet.

1 0

Ming-Ching Tiew's crypto programs
by Bill Stewart 17 Dec '03

17 Dec '03

Ming-Ching Tiew <mctiew(a)csi.po.my> posted the following article to sci.crypt. Aside from its content being interesting, it poses an interesting set of problems for ITAR proponents (:-) - he's Malaysian, working from Malaysia, but his web page is on a US-located free-web-page server. Some of the code on it is marked US-only; other code is world-readable and on a machine in Germany. ======================================================================= Subject: Cryptlib-based Win32 File Encryptor Date: Tue, 04 Mar 1997 21:01:28 -0800 From: Ming-Ching Tiew <mctiew(a)csi.po.my> Organization: Unconfigured Newsgroups: alt.security.pgp, sci.crypt, comp.security.pgp.discuss Here at which you look for my Win32 File Encryptor which uses "Cryptlib" :- http://www.geocities.com/SiliconValley/Heights/8298 The program is provided in source and binary. Non-US people should follow the re-direct and get it from the non-US site. Some of the highlites ( all crypto-features derived from Cryptlib, credit to Peter Gutmann ), (1) You don't use PGP for encryption and decryption. PGP is only used for Key Management. (2) This is not a shell. (3) Configure encryption options thru' GUI and save to registry. For example, if you don't like IDEA, use something else, like Blowfish. Find out for yourself "Cryptlib", the most comprehensive and yet freely available crypto library. Ming-Ching ======================================================== # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1

Re: The Pro-CODE Bill could make things worse!
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"gbroiles(a)netbox.com" "Greg Broiles" 5-MAR-1997 10:04:19.81 >I don't think that Pro-CODE can be used to control the dissemination of >remailers. The bit of Pro-CODE at issue here (section 5(c)(3)(B) "The >Secretary shall prohibit the export or reexport of particular computer >software and hardware *described in this subsection* to an identified >individual or organization . . if the Secretary determines that there is >substantial evidence that such software and computer hardware will be . . >(iv) intentionally used to evade enforcement of US law or taxation by the >US or by any State or local government." (emphasis added) >I read "described in this subsection" to refer to Section 5(c), and the >best description I can find in 5(c) of computer hardware and software is >"computer hardware, computer software, and technology with encryption >capabilities, except computer hardware, computer software, and technology >that is specifically designed or modified for military use, including >command, control, and intelligence applications", in section 5(c)(1). >So I don't think that this creates a new ability to control the >dissemination of non-crypto hardware or software. (The Mixmaster remailer >software, which does include crypto, would still be controlled.) Umm... non-encrypting remailers aren't much use. While something could be worked out (as for most current Type 1 remailers) allowing hooking in PGP or whatever, I would wonder whether that would make the remailer program itself have "encryption capabilities" - a la the "crypto hooks" restrictions in current export regulations. This would be even more of a problem for remailers using socket links and DH superencryption to prevent remailer operators from being pressured to decrypt intercepted messages. These prohibitions would also prohibit or at least restrict export of technologies such as decense and the anonymizer in versions (as is preferable) using encryption, except _possibly_ (see above) those hooking in encryption from outside. Circumstances in which such could be used to defeat US laws include a decense server being used to prevent the tracing of an in-US pornographic site, if (heaven forbid) the CDA (or a lesser version, such as one requiring labeling or going by a "harmful to minors" standard) is found constitutional. >The prohibitions on export to named individuals and organizations will be >effectively useless with respect to those parties getting strong crypto - >the only utility I can see in such a clause is to be used as a club against >domestic sympathizers/allies of unpopular groups/people abroad. It also >seems likely to lead to yet another round of worrying about whether the >format of a particular distribution site on the Internet is sufficiently >configured - if ProCODE passes, instead of asking "Are you a US citizen?", >distribution sites will ask "Are you on the list of forbidden people?" Same >difference. It is rather reminiscent, yes. If, for instance, all it requires is a check on whether the domain name indicates the _certainty_ of being from such a country, then it won't be extremely onerous... but I'm certain that the government will try to interpret it in the most restrictive way possible. -Allen

1 0

Extra Income
by friend＠Summers.com 17 Dec '03

17 Dec '03

*********************************************************************** Our Research Has Indicated That The Following Message Will Be Of Interest To You. *********************************************************************** Imagine what you can do with... UP TO $800.00 A WEEK EXTRA INCOME! Here's How To Get Started Let me tell you which companies to contact so you can start to receive your checks. They can be $200.00, $400.00, even $800.00 per week, depending on what you do. You can earn this excellent income right at home. And you work only when you want to. My name is Henry Summers. I investigate income opportunities that are advertised in magazines or by mail or are listed in home work directories and other sources. Then I talk to people who are actually using these opportunities. I ask how much money they make... and whether they enjoy the work. This helps me direct you to the best opportunities that are available today. Ones that people are using right now to earn all the money they want. Get Paid For Stuffing Envelopes. No Fees. Nothing To Buy. This easy work is very appealing, but most people do not know how to get it. That's because so many of the envelope stuffing programs being advertised are not what you expect. And you don't find that out until after you send in your money. Let me tell you the real facts. With true envelope stuffing... * You do not need to pay any fee or buy any materials to get started. * You do not do any advertising or handle any orders. * All printing, postage, and mailing lists are supplied free by the companies that pay you. * Your pay is based entirely on how many envelopes you complete. Rosie Martinez is an example of someone who earns money stuffing envelopes. The company delivers all the materials right to her door. She stuffs the envelopes, seals them, and applies the mailing labels and postage stamps that are supplied. Then she gets paid for every envelope completed. Rosie says, "I'm retired, and I enjoy having something to do. I usually watch television while I work. The home shopping shows are much more fun now that I have money to spend." If you'd like to do this kind of work, just follow the directions in Chapter 3 of my book "Real Home Income". Or try any of the other opportunities covered. Hundreds of companies are ready to help you make money. I'll tell you what each one has available now. Choose the kind of work you like and write to the companies who offer it. Pick any you want. You can work as an independent contractor for as many companies as you have time for. There are no qualifications to meet, so you will not be turned down. I guarantee it. If you don't like one company or you want to make more money, there are plenty of others you can try. Get Paid For Assembling Miniatures Gina Walker of Texas likes to assemble miniature furniture for doll houses. All the necessary materials are supplied by the company that pays her. She puts them together and sends them back to the company. Everything is conveniently handled by mail and UPS. The company sends her a nice pay check for each batch she completes. Gina says: "I really like the work, and the extra money helps pay my bills. I'm glad I found out about these companies." You can get paid the same way. And you don't have to make miniatures. You can choose from many other types of work. You can sew baby bonnets, assemble beaded jewelry, crochet doll clothes, make wooden items, assemble stuffed animals, paint figurines, weave rattan reed, and many more. You get the names and addresses of over 50 companies that will pay for things you make or assemble at home. No experience is required, and it makes no difference where you live. Almost all the companies supply the needed materials. Just do the work and get paid for each batch you send back. Wouldn't you like to get those pay checks? I'll show you how to get started fast. How I Made $800.00 Per Week After Losing My Job I became interested in home income opportunities several years ago when I lost my job. I sent for dozens of money making offers. Most were totally worthless. Others did not appeal to me. But circular mailing caught my interest... and it actually worked. In just six weeks, I was making over $800.00 a week working part time at home. It was better than my previous job. I soon paid off my bills and bought a new car. Yet that was only the beginning. As I learned more about it and tried different things, the money poured in even faster. It made a huge difference when I applied certain secrets that are used by the experts. I was amazed at how profitable it could be. In "Real Home Income" you'll learn how to use those secrets yourself. I'll tell you which companies to contact to get started. I'll show you some simple steps you can take to double your income without doing any more work. If you want, you can do all of this without handling any orders. Your name and address does not have to appear on anything you mail. You just mail circulars for companies and receive nice fat checks from them. With my proven methods, you can soon be earning more money than you ever imagined. Just follow my directions, and you can start receiving checks from the same companies I do. Receive One Dollar For Each Envelope You Stuff. Envelopes Come To You Already Stamped And Addressed. This easy work is advertised by over thirty- five companies. But they require that you pay $25.00 to $45.00 to register in their program. And then the program seldom turns out to be what you'd expect. That's where my book can help out. I describe the three kinds of mail programs that pay one dollar per envelope. But there is only ONE that I recommend. Not only is it more profitable overall, but you don't have to pay any fee to do it. Not even a dollar. Read about "The World's Best Dollar- Per- Envelope Program" in Chapter 4. How To Avoid Disappointment So many worthless offers are commonly advertised that many people give up before they come across a good one. That won't happen to you when you have my book. It tells you exactly how to recognize and avoid worthless offers. The most common ripoffs are covered in detail. This knowledge can save you a great deal of time and money. You can then take advantage of the many practical, down- to- earth opportunities that are described. Ones that enable you to start making money fast. Even just one extra source of income can make a big difference in your standard of living. Start To Earn Money In 48 Hours When you get the book, look over the many excellent opportunities. Each listing includes a brief description of what is offered. Write to the companies you like and request an application form. They have openings right now, and they'll be happy to get you started. You can begin to make money even faster if you choose one of the programs or plans that the book describes in detail. I'll tell you everything you need to know to get started. By taking a few simple steps, you can already be making money just 48 hours after you receive the book. Unlimited No Nonsense Guarantee "Real Home Income" costs just $29.95 plus $3.00 for postage and handling. I'm so confident you can make the money I've talked about that I back it with a lifetime, money- back guarantee. If at any time you feel the book has not helped you make all the money you want, just send it back. I'll promptly send you a full refund of everything you paid, including postage and tax. Start to enjoy more income and a better life as soon as possible. Please complete the order form and mail it today. Everything will be rushed to you by first class mail. Sincerely, Henry Summers P.S. I've recently discovered an amazingly profitable opportunity. One person I talked to made $20,000 in his first six weeks... working right at home in his spare time. It is not multi- level marketing. I've never seen anything like it before. I'l give you a toll free number to call so you can get started. Please Print and Mail This Order Form ----------------------------------------------------------------------------------------------- SUMMERS PUBLICATIONS # 30516 1010 Calle Cordillera, P.O. Box 3127 San Clemente, CA 92672 ( ) Yes, I would like to get started. Please rush me "Real Home Income" under your lifetime money- back guarantee. Enclosed is $29.95 plus $3.00 for postage and handling. $32.95 total. (If you live in California, please send $34.95) Name____________________________________________ Address___________________________________________ City, State, Zip_____________________________________ -------------------------------------------------------------------------------------------------

1 0

Re: ECPA/1997: the other shoe?
by jim bell 17 Dec '03

17 Dec '03

At 07:51 AM 3/5/97 -0800, Greg Broiles wrote: >I've seen discussion on various lists and in the media about the reissue of >Sen. Burns' Pro-CODE bill (S. 377); I was poking around thomas.loc.gov for >information about S. 377 and ran across S. 376, introduced by Sen. Leahy, >the "Encrypted Communications Privacy Act of 1997", which implements a lot >of legislation that cypherpunks types have been speculating about for >several years now. [snip] >I haven't had a chance to go over it in detail, but it purports to do these >things: >Makes the use of any cryptosystem in the US, or by US persons on foreign >soil, legal; Which is somewhat illogical, because if we assume that things are legal until made illegal, and there is no illegal cryptosystem, that means that no bill can "make the use of any cryptosystem legal." (I understand, of course, that you may simply be saying that the bill pretends to do it...) >Prohibits the implementation of mandatory key escrow Again, somewhat of a non-issue, wouldn't you say? What with the 1st amendment, the government would have an enormous uphill battle to make key escrow mandatory anyway. >Establishes standards and procedures under which key escrow agents may >release escrowed keys (including criminalizing wrongful release and >wrongful failure to release pursuant to court order/other authorization) Key escrow agents (to the extent they currently exist and will exist in the future) are presumably entitled to contract with their customers whatever conditions and terms their customers desire. If that DOESN'T include sharing the key with the government, as far as I know that's entirely legitimate. ("impairment of contracts.") Also, I see no reason to believe that those agents will necessarily have copies of the keys in unencrypted form, useable by the government. >Criminalizes the willful use of encryption to obstruct justice Which, as Tim May points out, could imply practically any useage of crypto with the "appropriate" misinterpretation on the part of government, particularly encrypted remailers. Just what the Leahy bill last year appeared to be intended to do. >Confirms that it is legal to sell any cryptosystem within the US Again, that's unnecessary and redundant. >Sets standards for the release of keys to foreign governments > >I'll post a more detailed summary later when I've had a chance to go over >the bill more carefully. What we should be particularly suspicious of is any differnces between last year's bill and this year's. Somehow I doubt we'll see any desireable change; all the changes will be bad. Jim Bell jimbell(a)pacifier.com

1 0

Re: This list
by Dale Thorn 17 Dec '03

17 Dec '03

Chris Melancon wrote: > I joined this list several weeks ago to learn more about encryption and > related topics. To the few posters who have passed on something useful, > thanks. To the 99.44% of you who are more interested in talking about > who is performing fellatio on who or slamming Timothy May from as many [snippo] > Consider me unsubscribed, and may those of you who work so hard to make > this list the useless crap it has turned out to be continue to suck as > much as you deserve. Ooh, poor baby. Don't let the door hit you in the ass on the way out.

1 0

Secrecy Report
by John Young 17 Dec '03

17 Dec '03

The "Report of the Commission on Protecting and Reducing Government Secrecy," boosted in the NY Times today is available in PDF format at: http://www.access.gpo.gov/congress/commissions/secrecy/index.html It criticizes government's unwarranted use of secrecy as a means of control. The main report is 155 pages long with appendices of 120 pages, including a history of the abuse of secrecy in the NatSec era. It also has a section on "Information Insecurity" which addresses impending moves by the gov to deal with threats to the Racketeer-Influenced "if you knew what we know" Criminal Org. The NYT report and editorial is at: http://jya.com/newsec.htm

1 0

Re: The Pro-CODE Bill could make things worse!
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:44 AM 3/5/97 -0800, Greg Broiles wrote: >"Exports. The publisher or manufacturer of computer software or >hardware with encryption capabilities shall disclose (for reporting >purposes only) within 30 days after export to the Secretary such >information regarding a program's or product's encryption capabilities >as would be required for an individual license to export that program >or product." > >The former has no real force, as "findings" aren't enforceable, but are >intended for use by courts who are interpreting or construing a statute. >But I don't see a technical reason why the latter wouldn't be enforceable. >(Modulo the First Amendment, of course.) Can it be construed as a "taking"? (Or was that just an "excise tax", payable in intellectual property rather than in money?) Unless the information required for an individual license is substantially less under the New Regime than under the Ancien' Regime, they're asking for a lot of information - in the past, it's included source code, documentation, etc., as well as customer data. What restrictions are there on government use of this information apply? State governments, e.g. California, have a history of ripping off copyright and refusing to accept lawsuits against themselves - can the Feds do the same? Maybe they can't refuse to let you export any more, but can they threaten to publish your source code on http://www.dockmaster.mil/warez/ if you don't do what they want?.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: EU-FBI Wiretap Pact and CALEA (Digital Telephony)
by Toto 17 Dec '03

17 Dec '03

jim bell wrote: > > At 02:25 AM 3/3/97 -0800, Tim May wrote: > >So, either the reporters here have it wrong, by implying CALEA and the > >joint U.S.-U.K. agreeement applies to _e-mail_, or in fact CALEA is being > >seen as applicable to e-mail. If the latter, then things are in much, much > >worse shape than many of us feared. > > > >If this interpretation is upheld by the courts, we are in a state of war. > >--Tim May > > Indeed, we are. Notice also that there appears to be no illusion that > these kind of bills are being done due to public demand: News on this > subject is essentially nil, particularly in the mainstream news media. When one begins adding up all of the ways in which the country is being regulated and legislated 'outside' of the influence of the voters, then it becomes apparent that we acually live in a demon-mockracy. It makes for great news when some 'little guy' manages to 'slip one by' Big Brother, but the reality is that the court system is ruled by money and power. As in the example stated above, much of the legislation proffered by those elected bears little resemblence to issues that are of genuine concern to the electorate. Any issues that the government can't ramrod through using the methods above become matters of 'National Security'. The 'law of the land' then ceases to apply, as 'Emergecy Measures' and secretive regulatory agencies write the law with no voting and a single stroke of the pen. The government even has the power to negate the ability of the individual or group to act in their own interest simply by making laws and regulations vague and/or complicated enough that it is unfeasible to act simply because of the time, energy, and funds required to do so--not to mention the 'risk' involved. Through use of regulatory approval, or witholding of such, the government has the ability to influence the fast-moving course of various areas of technology. Does anyone here want to make large investments in a product that they 'may or may not' be able to sell? This forum has members in all areas of expertise surrounding crypto issues, but can anyone state, unequivocally, all of the finer points surrounding legislation, regulation, etc., in this area? (Even if you think you 'can' legally do this-or-that, are you going to do so if told by the government that you can't and will be subject to prosecution and/or financial loss?) Do you expect for the laws to apply equally to all in areas of major government interest? Some companies are 'approved' for export, while, on very questionable legal basis, others are 'denied' approval. Do you expect this type of gladhanded regulatory approach to be any different for CypherPunks remailers, versus military Onion Routers? When some remailer operator is 'set-up' by the Right Reverend G. Stooge on a pornography bust, or by G.I.Joe on a terrorism bust, do you expect the target to be a CypherPunk or a Vice-Admiral? The fact of the matter is, the government is fully capable of burying the facts on any area of interest they wish, under cover of defending us from the 'bad guys' lurking in the bushes, and once every four years they step into the limelight to decide who gets to spend the next four years passing another mountain of legislation that, inch by inch, eats away at the rights and freedoms that are theoretically guaranteed by the Constitution. One has to wonder just how many times in history a vote in favor of restricting the privacy and rights of citizens was gained by trading off a vote affecting 'hog futures'. -- Toto http://bureau42.base.org/public/xenix/xenbody.html

1 0