December 2003 - cypherpunks-legacy

Re: Censorship on cypherpunks [RANT]
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Mon, 04 Nov 1996 07:20:15 -0800, Dale Thorn wrote: >> > I'm quite upset about this. Up to now I was able to tell >> >people that "there is at least one mailing list on the net that >> >functions in a completely open manner". No more. >> This has been taken far too seriously. Cypherpunks is a *PRIVATE* list. >> There is no obligation to accept anyone. >Isn't this the same argument used by the state whenever they want to differentiate >between your "rights" and your "privileges"? Can they reject one of your privileges >whenever they want to, at their discretion? No. >So if c-punks is really "private", how does it decide (arbitrarily?) who to include >and who to reject? It's a big difference. Can you set up your own mailing list? Yes. Can you go elsewhere? Yes. Can Mr. Vulis send email directly to list-members anyway? Yes. Can you do the same if the government runs it? No. Can you set up your own list/printing press* if the state won't publish your ideas? No. One could apply a similar rationale to socialism - after all, it may seem like an extension of "love your neighbor" to take care of their needs, which is certainly a laudable goal. That's not the problem. The problem is when it becomes mandated *with no alternatives*. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: Dr. Vulis
by Hallam-Baker 17 Dec '03

17 Dec '03

Bill Frantz wrote: > > As I put on my flame resistant suit... > > IMHO, most of the posts about John Gilmore's action re: Dr. Vulis are > seriously miss-analyzing what has happened. As far as I can tell, John > instructed his Majordomo to refuse subscription requests to cypherpunks > from Dr. Vulis. That is all that John has done. What John has not done > is: Of course John was right to give Vilus the boot. Cypherpunks is a club and like many private clubs occasionaly finds it necessary to give some oik the boot. And of course this is not an action that can be strictly justified in terms of absolute rights which many are fond of prating on about. Rights are limited, as Mills observes they are a product of law. Society finds it necessary to enact laws to protect rights. Dmitri's posts were affecting other people's right to speak. There is thus the traditional liberal conflict, that of having to infringe rights to protect them. If libertarians would read "on Liberty" rather than using it like a magic charm they would know that the main theory it advances is of the *balance* between the rights of communities and the rights of individuals. The genius of Mills is that he shows that the "rights" of government stem from its duty to protect the "rights" of the citizens. Its an imperfect answer because the notiopn of "citizenship" it advances fails to take any account of foreign relations. Mill's rationale for obeying laws breaks down when one crosses national borders for example. > The best paradigm I can come up with to analyze John's action is my quite > imperfect understanding of communitarian theory. In essence, > communitarians say that there should be a level of social control between > individual rights and the forceful coercion of the state. What John has > done is step forward and excommunicate Dr. Vulis. He has said to Dr. > Vulis, "You are no longer a member of the cypherpunks community." Rather than "should", try the word "is". One of the things the Web demonstrates is that there are such communities. I would not state the action in terms of "excommunication", rather consider that John took the action on behalf of the community for the good of the community as a whole. > I would love to hear how people feel this action fits in to the > cryptoanarchy, libertarian utopias we frequently discuss. E.g. Why is it > not a perfectly reasonable action for some one to take in an anarchy? If we could get away from the bleating denials of the need for government and instead consider them as a positive force, preventing a power vacum that others would fill a synthesis can be reached. The founders of the US realised that to pervent tyranny it was necessary to have different branches and levels of government. The essential point being however to prevent power being used. When a community of people get together they can exercise far more power than individuals acting alone. Sometimes this power can be for the common good, other times it can be the sectarian persuit of one minorities interests against another. Phill

8 10

NRC crypto breifing
by Decius 17 Dec '03

17 Dec '03

"Did the NRC discuss the State Department's GROSS FAILURE to prosecute Phil Zimmermann? (PGP) is military strength, and it's out there!" -- Audience member at NRC crypto briefing Dr. Herb Lin <hlin(a)nas.edu> of the National Research Council's Computer Science and Tecommunications Board gave a briefing this afternoon to address the Council's recent report, Cryptography's Role in Securing the Information Society. The briefing was sponsored by the Georgia Institute of Technology in Atlanta. One of the most striking aspects of the briefing was the diversity of perspectives on the issue. Most of our discussions on cryptography have been with people in the cypherpunk community; this was the first time we had ever come face to face with people on the other side of the fence. It is quite obvious that there is much emotional intensity here and we do not feel that this issue is going to go away soon. However, the NRC seems to be a voice of reason. We are faced a policy problem: the developing information society is vulnerable to security threats. Cryptography can be a powerful tool to thwart these threats, but it is also a dangerous weapon in the hands of criminals. As a result of concentration on the above issues, the cryptography debate has often been framed as a conflict between privacy rights and law enforcement. The NRC feels that the current policy on cryptography discourages its use by the private sector. Lin states that cryptography is a very valuable tool for crime prevention and thus benefits Law Enforcement. Policy makers should promote cryptography because it can help legitimate businesses better secure themselves against would-be attackers. However, cryptography also assists criminals in circumventing surveillance. So there are both positive and negative impacts for Law Enforcement, but Dr. Lin notes an important statement made in the NRC report: "The benefits of the widespread use of cryptography far outweigh the risks." Dr. Lin and the NRC believe that there will be an explosion of interest in computer security in the coming years, and that government should provide guidance and technical input, both to industry and law enforcement. The upcoming debate can (and should) be carried out on an unclassified basis. He said that open standards should be promoted in an effort to reach consensus between government and industry interests. Interested parties should be encouraged to study and understand the algorithms employed by their cryptosystems so that market forces may drive crypto policy to that which best fulfills the needs of US industry. NRC promotes the growth and leadership in the private sector and encourages all organizations to invest in information security. In addition, the NRC supports the use of link-level encryption in public networks, especially the cellular network. In this mode, LEOs can still access plaintext, but it is much more difficult for unauthorized listeners to get it. It should be noted that Cryptography is just one part of a comprehensive information security program. While it is useful to prevent eavesdropping, provide user authentication, and ensure data integrity, it is not particularly effective in overcoming the problems of insecure operating systems, and corruptible employees. One of the more controversial points in the report is the recommendation for domestic cryptography policy. The NRC recommends that no restrictions be placed on the use of domestic cryptography, and that the market should be allowed to choose the best systems. This was met with incredulty by many members of the audience, particularly those representing the government. They seemed to feel that "the people" should not be allowed to make this decision and that many important aspects of cryptography policy are not necessarily reflected in market interests. While NRC recognizes Law Enforcement's growing problem in adapting to new technologies, Dr. Lin said that the FBI could provide not one example of a class three wiretap that had been thwarted by means of encryption. Access to encrypted files seemed to be a bigger issue for LEOs. This takes us naturally to the topic of key escrow. NRC cautions that key escrow is an unproven technology. Of particular concern is the integrity of escrow agents: how it is to be evaluated, and what level of integrity is sufficient in any particular instance? Who is liable if keys are incorrectly disclosed? What are the liability issues if the key escrow system fails to provide LEOs with access? There just isn't enough information at this time to make these judgments. Many audience members commented that the administration had rushed into key escrow without forethought or open discourse. The NRC discourages the hurried passage of new legislation without clear, thorough discussion of the issues involved by those who will be most directly affected by the law. Furthermore, any government supported cryptography system must provide additional value to the end users. The Clipper system does not do this. Dr. Lin mentioned that data recovery might be of significant value to most users. If encryption systems are too strong then users will have a bigger problem with lost keys than they ever had with stolen intellectual property. The NRC recommends that the US government act as a test market for key recovery rather than pushing it out to the public before it is fully developed. The NRC also recommends that Congress consider criminalizing the criminal use of cryptography. This issue has already been discussed at length in academic fora, and the general consensus is that this concept is much easier said than done. We feel that such a policy is not likely to be a serious deterrent unless the additional penalty outweighs the benefits of secure crypto. It is also worth noting that if crypto is the default in system people shouldn't be charged with additional crimes for not turning it off. As for export issues, the NRC recommends that the government allow export of 56-bit DES without special approval, effective immediately. The recommendation also suggested that the allowable key length should be increased over time in order to keep up with improvements in cryptanalysis and computing power. They feel that export controls should be lessened but not fully removed. Law Enforcement needs time to develop the skills and technology necessary to deal with new situations. We would take issue with the NRC's assertion that 56 bit DES is "good enough for most commercial applications," and that algorithms be designed to preclude multiple encryption. It certainly depends on the threat model involved. DES would be an improvement over plaintext networks, but it is certainly not strong enough to defend against industrial espionage efforts. We feel that strong cryptography should be exportable now to defend against such attacks. We feel that legitimate law enforcement interests can get access to the information they require in most cases without even having to employ cryptanalysis, especially if systems are secured at the link level as the NRC recommends. We would also point to the reality that wiretapping is not often used by Law Enforcement, and we don't feel that they have justified any increase in it's use. The NRC briefing was very helpful in understanding the meaning of the report and highlighted many important issues. NRC will have a number of briefings in major cities all over the US, in hopes that this will spark more debate over these issues. Attendance at this briefing was much smaller than we had expected. We would encourage anyone who is interested in cryptography to attend a future briefing. It is a very good opportunity to hear and meet people on all sides of this issue. We would also encourage the cyber-rights crowd to seriously consider the NRC's recommendations. It seems to be a realistic look at these issues, and there is plenty of room here to defend fundamental civil liberties. Tom Cross and Jeremy Mineweaser Electronic Frontiers Georgia

1 0

Protecting Your Data With Crypto
by John Young 17 Dec '03

17 Dec '03

We have put the November UNIX Review article Peter cited in his letter to the editor, "Protecting Your Data With Cryptography," at: http://jya.com/protect.htm ---------- Peter Allan wrote: > >[ I refer to the article starting on p55 > of the Nov 1996 Unix Review. ] > >-----letter to Ed start here------ > >Andrew, > >Congratulations on a welcome crypto article in UR. > >This is an important topic for security, networks, >web-based commerce etc and is only going to increase in >importance as people realise data is money. > >The article did raise my eyebrows a few times though >with some wild statements - about the speed of brute-force >attacks on DES, and about USG 'key escrow' proposals, >patents and key certification. > >Also there are absolutely crucial issues not touched on, >probably for lack of space. Details matter, and if you're >contemplating another article on the subject I'd be happy >to write it [subject to my boss' approval] or review it >before publication. The field moves fast at times, and >it would be good to keep an eye on the subject in a fairly >regular column. > >Strangely, your author didn't mention ftp.ox.ac.uk, >an ftp site for many good crypto tools, which >(as a UK site) is not subject to US export restrictions. > > > -- Peter Allan peter.allan(a)aeat.co.uk

1 0

Re: [crypto-philo]OTP or DES?
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:45 AM 10/20/95 -0500, walrus <walrus(a)tcgcs.com> wrote: >I would argue that the security of an OTP is >derived not from the fact that it really is secure, but from the fact that >it is claimed to be an OTP. The meaning of "Security" depends on your threat model. Are you worried about - having your message noticed? - having your message decoded? - being able to deny a possible decoding of your message? Whether your message noticed or not depends a lot on the environment; in some places "pure noise" is not noticeable, while in others it really stands out (posting it to a text newsgroup, for instance.) If you simply remove the "----- BEGIN PGP" etc. headers/trailers from a PGP message, it's still got a well-defined format, including magic numbers indicating what kind of data is in each block, block length indicators, etc. They're both noticeable to someone who's trying to find them and strong evidence that something is a PGP message. That's why there's a Stealth-PGP, though even it's not perfect. As far as "Secure" meaning "They can't decode the message", if you use a One-Time-Pad more than once, you can lose (viz. VENONA.) If you use a pad that's not true random numbers, but is some simple LFSR or LCM PRNG, or some random English-language book, it's pretty easy for skilled cryptanalysts to decode it. If you use something that has a well-defined structure as a pad, and the Bad Guys notice your message and decode it, it's not credible to say "oh, no, it's just a one-time pad, the fact that there's one chance in 2**168 of that particular series of random numbers matching the output of triple-DES shouldn't influence you any, Judge".... You're gonna go to jail. What gives you deniability with OTPs is that they _can't_ produce a meaningful message that's any more probable than any other meaningful message of the same length, so you can argue that it really says "BUY MORE" instead of "RUN AWAY" or "ATTACK!!" and even if they guess you're lying, they can't tell what the true message was. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

lambda 2.11 - Short-circuits in Burma
by -Jerome Thorel- 17 Dec '03

17 Dec '03

netizen's --> Lambda Bulletin 2.11 <-- contents + Short-circuits in Burma + Medical privacy and PGP + New York's CDA on tracks * * * * * SHORT-CIRCUITS IN BURMA The military regime in Burma decided last month to ban information technology use and possession, in order to sustain its new iron fist on dissidents and members of the National League for Democracy. Among other news here's a message sent through the mailing list of the US organisation CyberPOLIS. ---fwd message--- >>From: George Sadowsky <George.Sadowsky(a)nyu.edu> >>Subject: Re: Burma Bans modems >>RANGOON, BURMA, 1996 SEP 27 (NB) -- Burma has made owning, using, >>importing or borrowing a modem or fax machine without government >>permission a crime, punishable by up to 15 years in jail, according to a >>report by United Press International. >>Burma's military government has imposed what's called "The Computer >>Science Development Law" which empowers the Ministry of Communications, >>Posts and Telegraphs to specify what exactly can be restricted, UPI >>reports. >>UPI quotes the government-run newspaper New Light of Myanmar as saying >>the same punishment is prescribed for anyone who sets up a link with a >>computer network without the prior permission of the ministry, or who >>uses computer network and information technology "for undermining state >>security, law and order, national unity, national economy and national >>culture, or who obtains or transmits state secrets." >>UPI reports that in July a diplomat, Leo Nichols, died in prison after he >>was sentenced to a lengthy term for illegal possession of fax machines. >>It's clear from this action that the SLORC, i.e. the "State Law and Order >>Restoration Committee" (sic!) understands full well the benefits and >>importance of the Internet and other forms of electronic communication to >>open societies, and is determined to deny these benefits to its citizens. >>Given its recent history and the quasi-imprisonment of Daw Aung San Suu >>Kyi, this new action is perfectly consistent with the government's >>previous abysmal record. >>Countries who would deny open Internet access to its citizens might well >>pause to consider if they wish to be associated with the current >>government of Myanmar in doing so. ... c y b e r P O L I S ----------------------------------------------- C o m m u n i c a t e T h i s C u l t u r e ( Christopher D. Frankonis -- baby-x(a)cyberpolis.org ) ---end of fwd message--- ------------------- FURTHER INFOS According to other sources--international press reports and electronic forums like Usenet's *soc.culture.burma*--it turns out that Ms Aung San Suu Kyi, 1991 Nobel Peace Prize and NLD leader, saw her telephone line cut on Friday, Sept. 28 on the evening. That was the beginning on a widespread crackdown on dissidents and a ban of NLD meetings. University Street, where Ms Suu Kyi lives, was blocked to avoid demonstrations. Hundred of citizens and NLD supporters were detained, some were released by mid-October. The Web site http://freeburma.org is a well known relay for the Burmese diaspora, especially the daily newsletter BurmaNet, which offers a rich compilation of dissidents' communiqués and Western newspapers articles and editorials. Ms Suu Kyi writes a daily letter from her home in Rangoon which is published in the Japanese newspaper Mainichi Shimbun (in japanese, http://www.mainichi.co.jp) - a translation appears daily in soc.culture.burma. It seems that the letter (surely copied on an audio tape) continues to be shipped ouside the country to be published in the Tokyo-based newspaper. Furthermore, other reports claimed that Burma doesn't have any official connection to the Internet. It seems to be true, but a Burmese and US resident found that the domain name "mmnic.net" (mm for Myanmar) was reserved by the Burmese governement in February, 1994. The operation was made possible with the help of the Internet provider Asia Pacific NIC based in Tokyo, Japan. A spokesman confirmed he reserved the domain on the behalf of Burma's State, and that it was dedicated to a future Internet connection. * * * * * MEDICAL PRIVACY AND PGP ---fwd message--- >Sender: dfickeisen(a)cpsr.org (Duane Fickeisen) > Subject: cr> Health Info Database Misused > >An AP story from Tampa Bay appearing in the Palo Alto Daily News asserts >that a public health worker took a laptop and disks with confidential >lists of people with AIDS and HIV home and to a gay bar to check out the >HIV status of potential dates and offered to look up names of people his >friends were interested in dating. One person asserted that he had warned >friends away from potential dates, telling them that their names were "on >the list." Another claimed that people interested in dating him backed >away after the health worker talked to them. The County Health Department >has fired him, although he claims he did nothing wrong. The former health >worker also owns and lives in a funeral home. The state had permitted such >databases to be removed from offices and taken home until they changed >their internal rules two weeks ago. > >Raises anew questions about privacy and confidentiality of records, >security, and misuse/abuse of information for personal and private gain. >This ought to be raised up as an example of abuse in response to the >announced plans for a national health information database. > >Duane H. Fickeisen, Interim Director >Computer Professionals for Social Responsibility ---end of fwd message--- As far as I can remember, Phil Zimmermann, speaking during the international encryption conference in Paris on Sept. 25, mentioned this story to explain how easy it was to have his privacy on personal medical records beached. And that to encrypt this sensitive information may be the ultimate solution. Zimmermann is president of PGP Inc., which develops computer security software based on his popular program Pretty Good Privacy (http://www.pgp.com) * * * * * NEW YORK's CDA ON TRACKS ---fwd message--- >============== >VTW BillWatch #61 > >VTW BillWatch: A newsletter tracking US Federal legislation >affecting civil liberties. BillWatch is published about every >week as long as Congress is in session. (Congress is in session) > >BillWatch is produced and published by the >Voters Telecommunications Watch (vtw(a)vtw.org) > >Issue #61, Date: Thu Oct 17 01:17:52 EDT 1996 > ... > >FREE NOV. 3RD SEMINAR ON NY STATE INTERNET CENSORSHIP BILL > >To learn more about this free cybercast seminar see http://www.vtw.org/speech/ > >New York state recently passed a bill that criminalizes expression >online that is currently legal in print. When it goes into effect on >November 1, World Wide Web pages, Usenet postings, and email lists that >fall under the law may become subject to criminal prosecution, as might the >Internet providers that host them. > >But don't panic! VTW and the Netly News (http://www.pathfinder.com/Netly/) >are putting on a seminar to educate you on the history of the bill, the ins >and outs of it and what you should ask your own lawyer, as well as the >status of any pending legal challenges. > >Who should attend? >------------------ >Anyone who publishes information on the Internet, including through >World Wide Web pages, Usenet, Email lists, or interactive chats. >Attorneys whose clientele include any of the above. >Journalists whose beat include the Internet or online services. >....and you! ... >Who will be there? >------------------------------- >Speakers marked as "invited" have told us they intend to come, but have >informed us of potential conflicts that same day that might interfere with >their attendance. > >Live speakers . Rep. Jerrold Nadler (D-NY) invited: Opening remarks . >Shabbir J. Safdar, President (VTW Center for Internet Education) . >Steve Barber, Legislative Counsel (VTW): How will this bill affect you, and >what you should ask your own attorney . >Ann Beeson, Litigation Staff (ACLU) invited > >Speakers available online through interactive chat >Diana Jarvis, Staff Counsel (VTW Center for Internet Eduation) >Stephen Filler, Law Offices of Stephen C. Filler invited ... >Where and when is this seminar? >------------------------------- > >The seminar will be held at Outernet, Inc, home of bway.net at, > >Outernet, Inc. >626 Broadway, Suite 3-A >(Very close to the Broadway/Lafayette stop on the F train) ... ---end of fwd message--- -------------------------------- the lambda bulletin, 2.11 http://www.freenix.fr/netizen =+= the lambda bulletin -> www.freenix.fr/netizen =+= =-= Jerome Thorel, Journalist, Paris (Planete Internet Editor) =-=

1 0

Re: Blue Box Plans & hacker bbs's
by Pyros Everflame 17 Dec '03

17 Dec '03

Check out these sites: L0pht heavy industries <a href="http://www.softaid.net/nuke/marks.html">Mad Dingo's Bookmarks</a>

1 0

RE: Goodbye
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Blanc Weber <blancw(a)microsoft.com> wrote: >It all depends, as usual, on the individuals involved - on the quality >they bring to the subject, to the list, to the enterprise. >Interesting question: what do elite sophisticates *do*, once they've >reached their pinnacle? Harlan Ellison suggests one possibility in his 1967 story titled: The Prowler in the City at the Edge of the World. James

2 1

RE: Q.E.D. reply to petty MESSger
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Deadwood <ipgsales(a)cyberstation.net> wrote: >To paraphrase John Dean, the truth will always come out and your >ass braying will never stop that truth. >Don Wood Be careful of what you wish for. You may just get it. James

1 0

Crypto Raid
by John Young 17 Dec '03

17 Dec '03

In a coincidence with the Biham/Shamir smart card attack, AP reports October 20 on an Israeli raid of News Datacom Research for $150 million tax fraud, allegedly because locally developed crypto products were smuggled out of the country. News Datacom develops and markets encryption systems for pay-TV based on Shamir's work, and he is a part-owner. Recall that Markoff's story on DFA cited Bahim's experience with pirate-TV and smart-card tampering. FiTi ran stories last May about the company's financial derring-do, which we've placed with the AP report at: http://jya.com/keylok.txt We've also put the Biham/Shamir DFA post and NYT article at: http://jya.com/dfa.htm

1 0