December 2003 - cypherpunks-legacy

Re: Anonymous Auth Certificates [was: Re: Blinded Identities]
by Hal Finney 17 Dec '03

17 Dec '03

From: azur(a)netcom.com (Steve Schear) > It seems that one crux of the problem revolves around the CA and its method > of certificate issuance. A CA which uses biometric data to > reduce/eliminate the chance that an applicant could get several, unrelated, > certificates issued would provide a basis for negative authentication > (similar to a negative credit file). Yes, biometric data is another way of preventing multiple credentials. However it will not work well in electronic form. What you'd need would be a network of stations to take fingerprints and give credentials, ("is a person" credentials) which would then be used for getting access to other services where you're supposed to only use them once (voting for example). This requires a fairly elaborate infrastructure and social commitment to this solution to the problem. Somehow too it is hard to see how to sell a system as a privacy enhancement when its first step is to take fingerprints of the whole country. "But we're not saving your names, honest!" I don't know if it would fly. Tim May argues that alternative solutions which are more local will be better. In the case of the abuse situation, maybe you could just have people put down a deposit of $100 or so. Then they get an anonymous credential which they can use for access. If they abuse their access, their credential gets disabled. As long as their abuse is worth less than the deposit you'll be OK. And at any point they can turn in their valid credential and get their money back. No identities are needed at any point in the scheme. > A one-way function performed, by the client, on their certificate from this > CA would yield a token which unambiguously binds it to a valid certificate > of the CA (and therefore uniquely identifies them) w/o revealing the > certificate itself. Actually I think you need to use a blinding protocol when you acquire the certificate, rather than trying to run a one-way function on the unblinded cert. The output of a one-way function looks random and meaningless unless you supply the input. And if the input identifies the user then you've lost the anonymity. Hal

2 2

Re: GET ME OUT OF HERE
by Timothy C. May 17 Dec '03

17 Dec '03

At 7:24 AM -0700 10/18/96, crumrig(a)us-state.gov wrote: >UNSUBSCIBE You have been unsubscibed. For good measure, you have also been unscribed, unsubsribed, and unsuscribed. In the event that you wished to be _unsubscribed_, only you can do that. Directions follow at the end of this message. --Unsubsciber To subscribe to the Cypherpunks mailing list: -send a message to: majordomo(a)toad.com -body message of: subscribe cypherpunks To unsubscribe from the Cypherpunks mailing list: -send a message to: majordomo(a)toad.com -body message of: unsubscribe cypherpunks

1 0

No Subject
by Alexander.Kvache 17 Dec '03

17 Dec '03

unsibscribe

1 0

Re: is there no end to AP & Creative Wiretap Arguments?
by Hallam-Baker 17 Dec '03

17 Dec '03

Steve Schear wrote: > How about as a means of coercing war criminals ethnic purgers, as those in > Bosnia/Serbia, to turn themselves in to proper tribunals for judging. > Having AP bettors wager $100,000s on your untimely retirement, unless you > turn yourself in, could induce one to consider conventional justice. On the other hand it would provide said war criminals with a convenient mechanism for carrying out their crimes. It does not work for Bell and his appologists to wave their hands and say "trust me it will be better". There is absolutely no reason to believe that AP markets would be used by anyone but psychopaths. No mechanism is proposed which restricts the purposes to which the AP markets can be put. They would inevitably be used by the KKK and neo-NAZI groups for hate-crimes. > All human rights are Naturally derived as are the 'Laws of the Jungle'. > Governments instituted among men should derive their rights from the > soverignty of its citizens. Unfortunately, many countries choose to ignore > this. AP should serve an occassionally competitive system to keep the > 'duly consistuted' system on its toes lest those in authority reap the law > of the jungle. Rights do not exist outside a legal framework that supports them. Arguments from natural law have been discredited for 300+ years. Such arguments merely reify the prejudices of one society into axiomatic rights without the bother of having to justify them. There is no logical basis to prefer the "rights" of th US constitution over the "rights" recognised by the Islamic Jihad. If you read the US declaration of Independence it is very clear that its authors rejected natural law arguments. The rights that they hold to be "self evident" are extreemly abstract principles which could be justified within almost any ethical system. The removal of the word "God" was deliberate and reflects a concious rejection of the natural law argument. AP is self-contradictory. It claims to uphold "rights" by infringing them massively and disproportionately and in such a way that no rights would remain. It is impossible to justify AP except in extreeme authoritarian terms that could be used to justify any system of government. Phill

1 0

Kantor Mischaracterizes
by John Young 17 Dec '03

17 Dec '03

The Washington Post, October 18, 1996, p. A26. The Administration's Encryption Plan I write in response to The Post's Oct. 4 editorial [below] that mischaracterizes the administration's recent encryption plan. The administration's encryption plan is reasonable, workable, fair and coherent. It addresses the critical issues of promoting the export of encryption products and protecting the public safety and our national security. The administration's objective is to put forth a balanced plan that promotes commerce and protects people. And that's exactly what we've done. The proof that our plan will work is with the critical mass of industry that has announced its intention to work with the administration to develop a key recovery system, which will allow law enforcement, under proper court order, to have access to encrypted data. In fact, many of these companies have products they will soon market that both safeguard information and protect society, and more are expected to follow. The National Research Council (NRC) report to which the editorial referred recommended allowing the export of encryption up to the strength of 56 bits. Contrary to the editorial, the president has not "embraced a looser form of licensure" than this report. Instead, this administration's plan allows the export of encryption up to 56 bits so long as industry commits to build and market products that support a key recovery system. This is, in fact, a stronger form of licensure not called for by the NRC report. The Post's editorial conveniently ignores the critical role encrypted products play in protecting businesses against illegal activity and the privacy rights of individuals. This is a disturbing omission that avoids critical concerns that can only be advanced by the administration's plan. Finally, this administration takes seriously its responsibility to protect its citizens and our national security. That's why we are not lifting all restrictions on the export of encryption products, and why there is a two-year deadline on the export of 56-bit encryption products. The administration's plan will accelerate the development of a market-driven, global key management system. That will provide the best security of all. Michael Kantor Secretary of Commerce Washington [End] ---------- The Washington Post, October 4, 1996, p. A22. Crypto Politics [Editorial] The Clinton administration once had a coherent, if unpopular, position on encryption software, the stuff that allows you to encode your email messages or other data so that no one can read it en route without a key. Now, in the wake of word that the president will sign an executive order, the position is no longer coherent, nor discernibly more popular with the high-tech audience it attempts to mollify. People and companies doing international financial business are highly interested in this kind of software, the more powerfully "uncrackable" the better. The U.S. software industry thinks there's a lot of money in it, especially if encryption becomes routine. The administration position till recently was that, much as U.S. software companies might profit from being able to market "uncrackable" encryption software freely, national security and law enforcement considerations dictated that such exports be controlled by license. Powerful encryption, like arms, could be dangerous in the hands of terrorists, rogue governments or international criminals. The software was classed as a munition; software above a certain uncrackability level could not be exported unless law enforcement authorities could get access somehow to the "key" after obtaining the proper warrants. Unbreakable codes on the loose strike us as a real danger, a legitimate reason for tight export controls. But if the administration really believes this, you'd think it would stick with steps that can plausibly meet the goal of control. Instead, trying to please, it has been splitting and splitting the difference between itself and the largely unmoved industry, which argues that no one will buy an encryption product that a government can decrypt at will. As with arms sales, the companies also argue that if they don't sell it, somebody else will, and that anyway it's far too late to fence off rogues. The national security people respond that there is still a "window," perhaps two years, in which they can prevent, if not all leaks of unauthorized crypto technology, at least its off-the-shelf use and wide adoption as the international standard. The administration initially proposed, then repeatedly refined, the concept of key "escrow" -- depositing a copy of the code with trusted third parties -- but never came up with a version the industry would accept. It commissioned a National Research Council report, which recommended a significant easing of restrictions. Now the president appears to have embraced a yet looser form of licensure upon declaration by a company that it will develop a plan within two years for key recovery. Also, the technology no longer will be considered munitions. What kind of plan? Nobody can quite say. What if the plans aren't acceptable? Licensing will revert to the old rule in two years. Will the security issue be moot by then? Probably. Barring some burst of clarity, one is left wondering whether the administration has compromised or caved, and what it now believes about the dangers of exporting uncrackable software. [End] See the National Research Council report: http://jya.com/nrcindex.htm

1 0

Real Meaning of "Key Recovery" (was Re: DES cracker...)
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Peter Trei, whilst talking about a key cracking effort, said: > For the Key Recovery effort (please call it Key Recovery - > this has important psychological implications in the US) Yes yes! What a great way to "reclaim" this term... CC'ed to cypherpunks for all to see. No longer is it "Key Cracking" it is now "Key Recovery" ... andrew

1 0

Re: "Stopping Crime" Necessarily Means Invasiveness
by jim bell 17 Dec '03

17 Dec '03

At 10:20 AM 10/18/96 MET, Bert-Jaap Koops wrote: >At present, I worry more about the threat of (organized) crime than >about the threat of government abuse, call it Dutch naivete if you >want. > >So much for politics. Can we get back to crypto? >Bert-Jaap Ah! So you want to discuss the ARCHITECTURE of those concentration camps, rather than the messy details about how they are to be filled, huh? Jim Bell jimbell(a)pacifier.com

1 0

Judge rules "harmless flame" is harassment
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Fri, 18 Oct 1996 20:42:26 -0400 From: oldbear(a)arctos.com (The Old Bear) (by way of rah(a)shipwright.com (Robert A. Hettinga)) To: rah(a)shipwright.com Subject: Judge rules "harmless flame" is harassment Organization: The Arctos Group - http://www.arctos.com/arctos Mime-Version: 1.0 Path: news-central.tiac.net!news-in.tiac.net!posterchild!arctos.com!oldbear Newsgroups: tiac Lines: 23 NNTP-Posting-Host: arctos.com X-Newsreader: Trumpet for Windows [Version 1.0 Rev B final beta #4] X-Newsreader: Yet Another NewsWatcher 2.3.0 Status: RO hmmm.... there is something strangely familiar about the premise behind this story, but I can't seem to figure out what it might be... JUDGE ORDERS DALLAS MAN TO CEASE HARASSMENT ON NET A district judge in Texas has issued a restraining order against a Dallas man who was using the Internet to post sexually derogatory remarks about the wife of a couple who operate an Internet Service Provider. The man said he had developed "a bad taste in (his) mouth" after trying unsuccessfully to reach the company to price its services; however, he now "wholeheartedly, 100 percent" denies that his messages were threatening and insists that they merely adopted the sarcastic language typically found on the Internet. source: Atlanta Journal-Constitution October 17, 1996 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

EU: avoid "safe havens", make remailers traceable
by um＠c2.net 17 Dec '03

17 Dec '03

ILLEGAL AND HARMFUL CONTENT ON THE INTERNET Communication to the European Parliament, the Council, the Economic and Social Committee and the Committee of the Regions. Table of Contents with some excerpts (full text at http://www2.echo.lu/legal/en/internet/content/communic.html) 1. The opportunities of the Internet 2. How does the Internet work? 3. Illegal and harmful content on Internet It is crucial to differentiate between content which is illegal and other harmful content: A. Illegal content Protection of the public order (child pornography, racist hatred, terrorism, fraud), and rights of individuals (breach of copyright, libel, invasion of privacy or unlawful comparative advertising) B. Harmful content Material may offend the values and feelings; depends on cultural differences. 4. Identifying and combating illegal content on Internet A. Technical limits to law enforcement Control can really only occur at the entry and exit points to the Network. Thus additional international co-operation is required to avoid "safe havens" for documents contrary to general rules of criminal law. B. The role of Internet access providers and host service providers i) Legal responsibilities ii) Self-regulation iii) Removal of files from the servers iv) Blocking access at the level of access providers Singaporean model is inconceivable for Europe as it would severley interfere with the freedom of the individual. Practical feasibility remains open to question. An approach which involes requiring access providers to block access to illegal content on a case-by-case basis has been followed recently by law enforcement authorities in Germany. A number of anti-blocking tactics were also immediately put in place. At the latest count, the document is mirrored on 43 WWW sites and 2 newsgroups and is available from an e-mail listserver. Upstream blocking of sites may therefore present a number of significant shortcomings. It may not prevent, in particular, criminal users from "hopping" from one Internet mode to the other, i.e. from a Web page, to a Usenet newsgroup, to standard e-mail. C. Anonymous use of the Internet Users of the Internet are normally identified. This is desirable in accordance with the democratic principle that individuals, while free to express their thoughts and beliefs, should nevertheless be accountable for their actions. Law enforcement authorities have expressed concern at various techniques which allow anonymous use of the Internet. This may facilitate sending illegal content by making it difficult or impossible to identify the offender. The legitimate need for anonymity should be reconciled with the principles of legal traceability. The Safety Net proposals take the view that use of truly anonymous accounts is a danger, while use of traceable pseudonyms is not. They propose measures to close known loopholes and improve traceability and that anonymous remailers record details of identity. These details would be subject to data protection legislation. The question of legal traceability needs work both on technical issues and on global co-operation in order for measures to be effective. D. Judicial and police co-operation at EU and international level 5. Dealing with harmful content on Internet A. The principle of freedom of expression The right to freedom of expression, as affirmed by the European Convention on Human Rights, can be subject to some conditions, is not absolute and subject to important qualifications, for instance permitting licensing of broadcasting or cinema enterprises. Any regulatory action intended to protect minors should not take the form of an unconditional prohibition of using the Internet to distribute certain content that is available freely in other media. B. The legal framework of the Internet market The measures must be appropriate to achieve the pursued objective and may not exceed what is necessary to achieve their aim. C. Parental control software: empowering parents to protect minors Useful as a "line of defence" at the end-user level, filtering software can also be applied at various stages in the transmission process, for example by host service providers or access providers. D. PICS: a global industry standard E. The extent to which filtering can be used F. European rating systems G. Educating the public 6. Policy options/conclusions 1. Illegal content a) Co-operation between Member States b) Liability of access providers and host service providers Need for a common European framework to clarify the administrative rules and regulations which apply to access providers. c) Encourage self-regulation 2. Harmful content Encourage the use of filtering software such as PICS. 3. INTERNATIONAL ISSUES a) An International Conference At the Industry Council of 8 October 1996, the invitation by Germany to host an International Conference was accepted. This will involve representatives of law-enforcement authorities, together with representatives of providers and users: Discussion on the possibility of an international convention on illegal and harmful content. b) Extension of the dialogue 4. Support actions a) Transparency mechanism b) Information Web site

1 0

Re: Your editorial in the 10/14 PCWeek
by jim bell 17 Dec '03

17 Dec '03

At 11:55 AM 10/17/96 -0400, Michael Froomkin - U.Miami School of Law wrote: >On Wed, 16 Oct 1996, Marshall Clow wrote: >[...] >> In a paper about privacy and the original Clipper proposal (in 1994) >...Jan '95 actually... >> A. Michael Froomkin of the University of Miami School of Law pointed out >> that since the entire key-escrow infastructure was created by >> presidential decree, and the proposed key holders were part of the >> executive branch, the provisions for release of the keys could be >> changed at a moment's notice by another presidential decree, which need >> not ever be made public. [ Yo, key escrow dude! Email your key database >> to wiretappers(a)fbi.gov, and don't tell anyone! ] > >I still think this is a major issue; it is one, however, that goes away if >they pass a well-drafted statute. Are you sure about that? "If they pass a well-drafted statute," the president couldn't just declare a "national emergency" (similar to all of the other "national emergencies" we are under right now) and send that same message to the key-keepers demanding they send their databases? Given the massive misbehavior of government in general, I'm not at all confident something like this couldn't happen. I'm waiting for the first indication that these GAK systems will include some sort of government-fraud-preventative measures, possibly an irrevocable allowance (or even a requirement?) that any key holder can publicize the fact of any key request at the time it is made, or after a minimal time like a couple of weeks or so. That way, government abuse of the system would be revealed, beyond the control of the government. Jim Bell jimbell(a)pacifier.com

1 0