December 2003 - cypherpunks-legacy

Congressional subcommittee hearings on computer security
by Omegaman 17 Dec '03

17 Dec '03

Computer crimes rife, unreported By Reuters February 13, 1997, 9:45 a.m. PT WASHINGTON--Security experts say hackers are finding it easier to break into computer networks and steal money, partly because companies are reluctant to admit that they are vulnerable. "If I want to steal money, a computer is a much better tool than a handgun," Daniel Geer, director of engineering for Open Market, told a House of Representatives technology subcommittee hearing on computer security. " Has anyone been following this debate more closely? Nothing in any of the articles I've seen on this story have mentioned the role of strong encryption. <rhetorical question mode on> Why can't banks better protect themselves? Why can't banks better authenticate electronic transactions to prevent theft & break-ins? Why is the such a dearth of protective measures available to the institutions? The public has a right to know! <rhetorical question mode off> Seriously, though, has anyone been following these hearings in more detail? me --------------------------------------------------------------------- Omegaman <mailto:omegam@cmq.com>|"When they kick out your front door, PGP Key fingerprint = | How are you gonna come? 6D 31 C3 00 77 8C D1 C2 | With your hands upon your head, 59 0A 01 E3 AF 81 94 63 | Or on the trigger of your gun?" Send email with "get key" as the| -- The Clash, "Guns of Brixton" "Subject:"to get my public key | _London_Calling_ , 1980 ---------------------------------------------------------------------

1 0

e$
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Timmy Maya has been a source of endless embarassments to his sympathizers on and off the net. /_/\/\ \_\ / Timmy Maya /_/ \ \_\/\ \ \_\/

1 0

Re: Moderation experiment almost over; "put up or shut up"
by Dave Hayes 17 Dec '03

17 Dec '03

Against Moderation writes: > If you want to fight censorship effectively, going around telling > people "You're a shit-eating faggot you fucking cock-sucking homo > censor" in public forums is not going to win you many points. On the contrary. John Grubor is Usenet's most effective probe as to the mindset of people who really want free speech. The precise litmus test of free speech is vehemently offensive things that are spoken. > Instead, it will quickly land you in many people's killfiles, and will > eventually lead some people with bad client software to wonder if it > wouldn't be worth giving up some freedom of speech for the benefit of > not having to see your rants any more. Then they don't want free speech. They want the illusion of free speech, "free speech as long as you don't say THOSE things". > Unfortunately, it sort of makes life harder for those who actually > fight the censorship when you pretend to be one of them. Your > argument seems to run something like, "To protect freedom of speech, > bad all faggots from the net, and especially don't let them run any > mailing lists." If this offensive and highly noticeable argument > eclipses many of the important, fundamental ones as the censors would > like it too (why do you think your articles make it to cypherpunks- > flames while mine only get as far as -unedited), you will end up not > only inducing censorship but also seriously hampering the efforts of > those who are legitimately fighting that censorship. Don't you get it? Real censorship issues do not arise until someone rocks the boat. It takes someone to rock the boat to make you aware of your own prejudices of that nature. If it takes attacking homosexuals and pissing them off enough to make them show their true colors and begin censorship...so be it. Why be civil when that civility serves to hide that which is ultimately against free speech? You'll find those of us who -truly- want free speech are extremely good at ignoring what we don't like. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet Don't teach the blind until you have practiced living with closed eyes

1 0

Re: Moderation experiment almost over; "put up or shut up"
by Dave Hayes 17 Dec '03

17 Dec '03

Ok. I'll "put up". If the cypherpunks will have me, -I'll- run the cypherpunks list. Those that know me know that I will *not* censor, moderate, or otherwise alter the content (other than the stuff majordomo does with "resend") of any messages to the list. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet Advice is priceless; when it becomes interference it is preposterous.

4 7

Re: Moderation experiment almost over; "put up or shut up"
by Dave Hayes 17 Dec '03

17 Dec '03

Against Moderation writes: > If you want to fight censorship effectively, going around telling > people "You're a shit-eating faggot you fucking cock-sucking homo > censor" in public forums is not going to win you many points. On the contrary. John Grubor is Usenet's most effective probe as to the mindset of people who really want free speech. The precise litmus test of free speech is vehemently offensive things that are spoken. > Instead, it will quickly land you in many people's killfiles, and will > eventually lead some people with bad client software to wonder if it > wouldn't be worth giving up some freedom of speech for the benefit of > not having to see your rants any more. Then they don't want free speech. They want the illusion of free speech, "free speech as long as you don't say THOSE things". > Unfortunately, it sort of makes life harder for those who actually > fight the censorship when you pretend to be one of them. Your > argument seems to run something like, "To protect freedom of speech, > bad all faggots from the net, and especially don't let them run any > mailing lists." If this offensive and highly noticeable argument > eclipses many of the important, fundamental ones as the censors would > like it too (why do you think your articles make it to cypherpunks- > flames while mine only get as far as -unedited), you will end up not > only inducing censorship but also seriously hampering the efforts of > those who are legitimately fighting that censorship. Don't you get it? Real censorship issues do not arise until someone rocks the boat. It takes someone to rock the boat to make you aware of your own prejudices of that nature. If it takes attacking homosexuals and pissing them off enough to make them show their true colors and begin censorship...so be it. Why be civil when that civility serves to hide that which is ultimately against free speech? You'll find those of us who -truly- want free speech are extremely good at ignoring what we don't like. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet Don't teach the blind until you have practiced living with closed eyes

5 5

Industry Blasts U.S. Encryption Policy
by John Young 17 Dec '03

17 Dec '03

2-14-97. National Business Review, NZ (http://www.nbr.co.nz/) USA: Industry Groups Blast U.S. Encryption Policy. Washington, Feb 13 (Reuter) - An array of private-sector trade groups charged Thursday the Clinton administration's new export policy on computer encoding technology was a failure. Encryption products, which scramble information and render it unreadable without a password or software "key," are subject to strict export limits, although the administration recently relaxed the rules a bit. The new policy "does not adequately address the needs of either the American business community or the general public," the 13 groups said in a letter to Clinton dated Wednesday and released Thursday. Among the groups signing the letter were the U.S. Chamber of Commerce, the National Association of Manufacturers and the National Retail Federation, along with a host of high-tech industry groups such as the Business Software Alliance and the Information Technology Association of America. The Centre for Democracy and Technology, an advocacy group for civil liberties in cyberspace, and the Association of Research Libraries also signed the letter. An administration spokeswoman said that, despite the complaints, the current policy would be maintained. "The administration is moving ahead with our encryption export liberalisation policy," spokeswoman Heidi Kukis said. The policy balances diverse interests by "allowing us to develop exports while protecting our national security," she said. The administration has repeatedly said it opposes allowing unfettered powerful encryption programmes out of the country where they could be used by international criminals and terrorists. Under current policy, U.S. companies cannot export products containing so-called strong encryption, used to protect everything from a business' electronic mail to a consumer's credit card number sent over the Internet, unless the products also allow the government to crack the code by recovering the software keys. Companies can get a license to export medium-strength encryption lacking so-called key recovery features if the companies agree to incorporate key recovery in future products within two years. The Commerce Department has issued three licenses so far under the two-year provision. Digital Equipment Corp., Trusted Information Systems Inc., and Cylink Corp. won approval by promising to offer key recovery products by 1999. International Business Machines Corp. and Hewlett Packard Co. have said they are also seeking licenses. But companies and privacy advocates rejected the administration's key recovery-based approach. "It fails to accommodate the competitiveness concerns of sellers of encryption products, the security concerns of the buyers of such products, or important privacy rights," the groups said in their letter. "We believe a fundamental rethinking of this policy is necessary," they added. "We remain interested in working with you to achieve a constructive solution to this very difficult problem." Congress is already considering proposals to dramatically relax the export restrictions without requiring key recovery. -----

1 0

Re: Letter Re: Kahn Supporting GAK
by jim bell 17 Dec '03

17 Dec '03

At 09:35 PM 2/5/97 +0000, Robert Rothenburg 'Walking-Owl' wrote: >Good point: but I've seen a few refs from LEAs about "Drug Dealer X >who we can't talk about" or "Child Pornographer Y who we can't talk >about" (in lieu of cases being digested by the court system) so I >didn't harp on that point. > >A point I did leave out was that if they already knew these people >were criminals and were building cases against them, monitoring them >enough to know they used crypto, then do they really need to bother >with listening in to the exact message? I think it would be appropriate to insist that these guys (the LEAs) document their need for decryption, by providing "us" (the public) with an encrypted version of the data that they have accessed but cannot understand, as well as its source and what case it's associated with. The LEAs would encrypt it and publicize it (not openly identifying the details) but with the promise that the key to unlock the information would be released within, say, a year or even earlier once a case is brought. Included within the encrypted identification would be references sufficient to identify the case involved. If they have any doubts as to why they should do this, we should point out that we see no reason to believe their claims, but we want to give them the maximum opportunity to prove them without requiring that they spill the beans, completely, now. Jim Bell jimbell(a)pacifier.com

1 0

Re: Moderation experiment almost over; "put up or shut up"
by Dave Hayes 17 Dec '03

17 Dec '03

> Dave Hayes wrote: > > You'll find those of us who -truly- want free speech are extremely > > good at ignoring what we don't like. > Not all of you freedom-knights are good at it at all. The "us" I mentioned did not refer to the freedom knights, but "those of us who -truly- want free speech"...a slight english parsing problem. The freedom knights are a subset of those who want free speech. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet It is our ability to act as ourselves, freely and of our own choosing, that is the greatest gift to mankind; my Creator, the sole being in the universe who legitimately had power over me, gave me that power freely in order to enable me to become what I am. -- Russ Allbery

1 0

DES and RSA crypto hardware from the free world
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

I've just got the details on two new crypto chips produced by the Dutch company Pijnenburg Custom Chips B.V. These are the PCC 201 bignum coprocessor and the PCC 101 DES-with-everything processor (the official names are slightly different :-). The PCC 101 sells for approximately US$27, the PCC 201 sells for approximately US$50 (for people who aren't familiar with the market for these things, these are very good prices, especially for the 201). The PCC 201 is officially a "Large number modular arithmetic coprocessor" which is designed to perform the operations: A^x mod N AB mod N C mod n very quickly for quantities of up to 1024 bits. Typical procesing times for 1K-bit operands is 40ms, for 512 bits it's 12ms when clocked at 25 MHz. Unfortunately you can't directly chain them for larger operands, although it's possible to use two 201's and some software tricks for CRT decrypts to stretch the operand size to > 1024 bits. The way the 201 works is that you load the fixed components (exponent and modulus for A^x mod N, modulus only for AB mod N and C mod N) into one of three sets of on-chip registers, and then use them to perform arbitrary numbers of operations on data. This means that for something like a micropayment application you would load the necessary private key components once and then generate signatures at the (theoretical) rate of 25 a second. To date the cost of this kind of hardware has been such that the most viable solution was to run racks full of cheap P5 boards booting a bare-bones RSA-processing application through a network card, but with the PCC 201 you could populate a board with 201's and a few microcontrollers a la a Wiener machine and use these as a payment transaction processing engine. They'd also make fairly cool SSL co-processors for web servers. The PCC 101, officially a "DES encryption device", does DES, 3DES (EDE with 2 or 3 keys), and DESX in ECB, CBC, CFB, OFB, and MAC modes at a maximum rate of 132 Mbits/s (16.5 Mbytes/sec) for single DES, or 1/3 that for 3DES, when clocked at 33 MHz. It's possible to load either single or triple-DES encrypted keys which are then decrypted using onboard key encryption keys (KEKs). The chip contains onboard storage for 24 keys, 3 KEKs, 4 IV's, and 2 DESX keys (pre/post-whitener). Processing is done in a 3-stage pipeline, so once you feed in 3 64-bit blocks it churns out a new result every 16 clocks (this also allows overlapped I/O operation). You can add an external battery to save the internal state when power is removed, so you could keep your keys permanently stored onboard (although given that these keys can be recovered given enough money and effort I'm not sure if this is a good thing). The PCC 101 is available in 44-pin PLCC/TQFP packages, the PCC 201 is available in 68-pin PLCC and 80-pin TQFP packages. The PCC 201 contains a multiplexed address/data bus and a few control signals (most of the pins are unused), the PCC 101 contains data and address ports and a few control signals. They look fairly easy to interface. There's an ISA evaluation board available which contains the PCC 201 and the slightly older PCC 100 (predecessor of the 101) and some test software. Note that this is an evaluation board only, Pijnenburg make the chips but don't sell general encryption cards. A fast PCI card containing these chips and drivers for various common operating systems and MSDOS is currently being designed by an international cabal. This will be a PCI 2.1-compliant card containing a PCC101, an optional PCC201, and possibly a few other things (we're still arguing about the design). I'll be writing DOS and Win16 drivers for it, and someone else will do an NT and possibly Linux driver (again, it's still at the design stage). cryptlib (http://www.cs.auckland.ac.nz/~pgut001/cryptlib.html) will probably end up having native support for it when it's ready. Pijnenburg don't have a web page yet but are working on it, I'll post the details here when it becomes available. Until then you can contact them at asic(a)pijnenburg.nl. The only slight problem is that they're subject to the Dutch governments export rules (the usual Wassenaar stuff) which means that if you're not using it for an authentication/integrity-only application or a financial application, you'll probably need to go through some paperwork to show that it's for your use only and you won't be passing it on to your friend Jose from Columbia. Pijnenburg have a standard Statement of Application which people can use as to write their own statement for export approval. These chips look *very* promising. Who needs Clipper, or HP's Clipper-under-another-name, when you can get triple DES from the free world at prices like this? Peter.

3 2

Re: [Declan McCullagh: "A List Goes Down In Flames," from Netly]
by Mike Duvos 17 Dec '03

17 Dec '03

John Gilmore <gnu(a)toad.com> writes: [Fluffy Gilmore apologia by Declan expunged] Two small points. 1. The rift between Gilmore/EFF and Cypherpunks is hardly of recent origin, and dates back to when the EFF first demonstrated to horrified Cypherpunks that its policy would be one of appeasement and capitulation towards clearly unacceptable legislation. This is all in the archives, including Tim May's essay on why he chose not to renew his EFF membership. 2. The article fails to mention Gilmore's new nickname. :) -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0