December 2003 - cypherpunks-legacy

Re: Shot 'Round the World
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

At 6:21 AM 4/9/94 -0700, Jeff Davis wrote: >*** Here's the follow up *** > >To whom it may concern, > >You have been emailed an authentic National Security Agency Employee's >Manual. I as an Electronic Frontier Foundation member, acting purely >on my own initiative, and solely accountable for my actions, have emailed >this information, as well as John Gilmore's FOIA attack on the current >Clipper Chip proposal for key escrowed encryption, to every media source >with an email adress listed in EFF's _Big_Dummies_Guide_to_the_Internet_ >on the entire planet. > >You may authenicate the NSA manual via confirmation by the phone numbers >listed in it. Consider this the shot heard round the world in the >Electronic Revolution. Well, this certainly helped the "cause." If I were a media person recieving this mail, I'd get a good laugh, then hit delete. I don't see anything nifty, wonderful, or unusual in the manual. I've held a Secret clearance doing work as a Defense contractor, and the requirements aren't abnormal. They're stricter, but given that the clearance level is higher and it's in the intelligence community, it's not unusual. I would seriously doubt the manual is of much interest to the media. If you want to help, mail the media about privacy, and what Clipper is going to do to it. This kind of mail just makes the online community look like fanatical crackpots. Bob (I'm an EFF member as well. What does that have to do with your message?) -- Bob Snyder N2KGO MIME, RIPEM mail accepted snyderra(a)dunx1.ocs.drexel.edu finger for RIPEM public key When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

1 0

Re: Pseudonyms and Reputations
by Hal 17 Dec '03

17 Dec '03

From: tmp(a)netcom.com > these identification systems ultimately fall back on `real world' > identification systems such as birth certificates, social security > numbers etc. which all can be readily subverted by a determined > adversary. I believe RSA requires a notarized statement, where you have presented the notaries with three forms of ID. I would imagine that notaries have some experience with false ID, but no doubt they can be fooled with sufficient effort. Still, for the kinds of applications we are talking about here (chatting on the net) this is probably adequate. For more security you could require a thumbprint which is compared with others on file. > what, specifically, is problematic about these? does chaum just ignore > them? does he describe them in greater detail? Chaum was writing more about financial relationships with creditors, businesses, etc. My translation of his ideas into the cyberspace author- ship arena was not something he discussed directly. > as for `endorsements for unknown endorsers', it seems to me the reputation > system you refer to is a sort of `reputation web' not unlike the pgp > `web of trust' model. a pseudonymous credential has as much weight as > the pseudonym originating the certification. i.e., if `a' signs `b's > pseudonym, that `edge' in the `reputation graph' has as much weight as > `a' has reputation. that is, it should not be possible to create a whole > bunch of new pseudonyms, have them all sign each other, and then increase > your reputation. In one way it is easier than with pgp. With pgp we are trying to guess whether a person is really who he says he is. This has all sorts of real- world implications, and as tmp points out these are hard to verify. With reputation systems what you really want to know is whether a person's endorsements are valuable. Over time you can basically decide this for yourself, by judging whether those authors recommended by a given person are ones which you consider good. Those endorsers whose opinions match your own would be the ones you pay the most attention to. > this brings up an interesting idea. future cyberspatial citizens may > develop an elaborate netiquette that describes how to maximize one's > advantage through the use of pseudonyms. all kinds of strategies will > ensue. is it better to have a few good pseudonyms, without diluting > reputation, or a whole bunch of pseudonyms but a bit more diluted > reputation? With Chaum's system it should not necessarily dilute your reputation to use a lot of pseudonyms. OTOH, you are right that informal reputations will not carry over, and in practice these will be important. > one of the problems with a positive reputation system is that it would > workd for `d-type people' <g> whose reputation is primarily negative. > a whole lot of people would like to put a negative credential on `d' > so that they would limit his influence in all forums he visits, similar > to the way that one could globally encourage someone else through > `accreditation'. `d' would simply not propagate any negative signatures > to his pseudonyms. Negative endorsements, and negative credentials in general, are difficult to achieve. Chaum's paper has some discussion of these but it is hard to follow. The simple blinded signature model provides a pretty simple way to allow only one pseudonym per True Name in a given forum, if you assume there is some way to distinguish people in the real world. Suppose Cypherwonks wanted only one person per nym. And suppose there was an agency which was able to distinguish people, that is, it could tell when it had seen the same person twice. Now, Cypherwonks asks this agency to give a single blinded signature of a type (exponent) which is unique to that list, to anyone who wants it, but such that nobody gets more than one. To be accepted on the Cypherwonks list, then, somebody would have to show a signature of this particular type, different from everyone else's. Each person could only get one such token, which Chaum has called an is-a-person credential (again, this is a simplification of his idea, I think). Now tmp has what he wants, the ability for a list to have only one nym per person. And in such a situation, negative reputations are important, because you only get one chance and can't start over with a new nym. > could such a negative signature system be constructed? it seems possible > with a centralized `trusted' server, but this is not an ideal solution; > ideally one would like the system to be possible from the independent > interactions of people who trust only themselves. this of course is the > ideal cryptographic model, and the very best and finest algorithms > (e.g. rsa) conform to it. Well, you have to trust that the agency which is verifying uniqueness of identity doesn't cheat. But note that the agency does not get any great privacy-infringing power, as they don't have to know the True Names or identities of the people they are endorsing, and they don't know their pseudonyms (since those are blinded when they are signed). > the problem is similar to preventing double > spending in a cash system. how do you enforce that a person `spends' > a certain amount of information? there are no `laws of the conservation > of information' as their are of e.g. mass as with a paper currency. in > fact maybe the double-spending preventative techniques for cash systems > could be translated to get a negative reputation and prevent people from > not displaying credentials, even negative ones, they have accrued (just > in the way people are forced to reveal if they are `printing money', i.e. > spending spent money) Chaum did, as I said, have some concept about revealing negative credentials, perhaps along the lines you are suggesting. As I followed his ideas (which wasn't very well), you would have to submit an "I'm not a jerk" credential with each posting, and the only way to get another such token would be to get back a response from your posting saying, "OK, you're still not a jerk." But if you posted some trash ("Death to BlackNet") then you wouldn't get back that "OK" token and you'd have lost your "not a jerk" token for good. This would work best in a situation where there was one nym per person, otherwise he could use his other nyms to endorse his worthless trash. (I posted a variation on this idea a couple of weeks ago as a way of handling anonymous remailer complaints without breaking the anonymity of the remailer user. A similar token-and-response system was used, also based closely on the blinded signature system in Magic Money.) > personally i like chaum's emphasis (or recognition) that forums exist > such that restricting pseudonymity in them is natural, fair, > and rational, i.e. a desirable design goal. it seems to me that even > beyond this, people should be able to construct forums where they demand > (or comply, or agree, or whatever) that identity be known, or that it > be totally ignored. given all this inquisitional witchhunting of my > `true identity' (whatever the !@#$%^&* that is), obviously this forum > is in the former category <g> Well, Larry, you have to realize that you caused us enormous hassle several months ago, so it's natural that people will be somewhat hostile. Other pseudonymous posters have not stirred nearly so much interest (with the possible exception of Xenon, who had some of your own tendencies to rant at length). However, in your new incarnation I find your postings much more interesting. > what do you think, cpunks, should you have the right to ignore people > regardless of the pseudonyms they use? again, i ask if it is possible > to construct a system that protects anonymity but at the same time allows > someone to filter all pseudonyms associated with another person. it seems > that we have reached an impasse -- these are two very useful design > criteria but they appear to be contradictory. on one hand we would like > to censor all the `d-type' pseudonyms, but on the other hand we would > want a `clean slate' for all of our own. Chaum has some discussion about how you can go to library A and borrow a book, proving that you have no overdue books at libraries B, C, D, ..., without compromising your anonymity. This sounds analogous to proving that you have no negative credentials from other cyberspace forums. Unfortunately, this is a part of his paper I need to read more times to understand. Hal

2 1

CPSR petition to oppose Clipper
by Senator Bedfellow 17 Dec '03

17 Dec '03

Does anyone know how many signatures this eventually got? Thanks Ben. ____ Renegade academician. They're a dangerous breed when they go feral. -James P. Blaylock in "Lord Kelvin's Machine"

1 0

'mostly for crypto and stuff'
by bart＠netcom.com 17 Dec '03

17 Dec '03

I know c'punks strays, on occasion but hows this: From: nick.konidaris(a)accbbs.com (Nick Konidaris) Newsgroups: sci.crypt Subject: Hydrogen Fuel Cells Date: 3 Apr 94 23:14:00 GMT Distribution: world Organization: Advanced Computer Concepts BBS, New Rochelle, NY 914-654-1981 I know this conference is mostly for cryptography & stuff but I want to know if there is anyone out there who knows about the Hydrogen Fuel Cell. I think that I understand how the Cell works yet, I find that something does not make sense. My basic question is: 1. Is a salt/ion bridge required? 2. If so what crosses the salt bridge? [ie. H2 and O2 protons, electrons, what?] 3. What is the best way to make a working fuel cell? Thanx -Nicholas Konidaris II

1 0

keywords
by Erich von Hollander 17 Dec '03

17 Dec '03

yes, my remailer does insert keywords, and you can expect that i will continue refinining the keyword insertion system so that it will be harder to automatically filter out. some people have said that keywords should be an option, not a default. i rejected this idea, because keywords are useless unless they are widely used. there is safety in large numbers. from the cypherpunk perspective, ideally, all or most net communications would consist of encrypted text, with the only plaintext being keywords, i think. if the keywords really do bother you, you can use some other remailer. also, if you have good keywords lists, please send them to me. i might have missed something. e

1 0

Key Servers
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

Could someone send me a list of the keyservers or which ever one is the largest. Thanks, Reuben Halper -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCPAi16KosAAAEEAMUwRni4a9+GbuAhHDLcBWK60hCJUYxhr2hYokpELAhx0ejp 2fq61Tu9Hjn051CN8Xy5nu6sv2ODfG/t59l4DJSb5pirQaII3zaX0rMX0ydwGDoW YakL4ow1lNY+d/k14KpIuUW404+fNuNhIGSkdVLQIfbOgh0preK7/P44AKvdABEB AAG0JlJldWJlbiBIYWxwZXIgPGZoYWxwZXJAcGlsb3Qubmppbi5uZXQ+iQCVAgUQ LXorceK7/P44AKvdAQEUxwQAoffTibRlwE5tNQVGvrulh1OQgXNhTRec9vUaUwPy U64FIZ+KnmdfYgiJYXtcItA90EB9MDexazKeqJzMOPShVNOfyiwy2yUlnQs425f8 DxBvM//zuvj6s4/mXDTPUZtG9PP0HVaEGTJY15JdfRqtj/w+HHnsHlgCnj0NnIhX TW8= =D9UX -----END PGP PUBLIC KEY BLOCK-----

1 0

ILF: Encryption Plan Gets Gov't Nod
by Anonymous 17 Dec '03

17 Dec '03

Brought to you by the Information Liberation Front Reproduced without permission from Communications Week Encryption Plan Gets Gov't Nod By Sharon Fisher WASHINGTON Encryption users and industry observers have said they are unhappy with the Clinton administration's endorsement of a comprehensive interagency review of cryptographic technology. The review was initiated last April and overseen by the Na- tional Security Council. It was scheduled to have been complet- ed by mid-October of last year. As part of the Feb. 4 release of the report, the administration said it has approved the Escrowed Encryption Standard (EES) as a voluntary Federal In- formation Processing Standard. The EES, known as both the Clipper proposal and Skipjack, was announced last April. The administration also said that the National Institute of Stan- dards and Technology and the Automated Services Division of the Treasury Department would be charged with storing the escrowed keys. The procedures for gaining access to the keys were also announced. The ESS proposal has been heavily citicized because of the escrow proposal, which gives law enforcement agencies access to the encryption keys via a warrantmuch like a wiretap. Industry observers have said an algoithm with such keys is inherently insecure. They voiced concern at the government's plans to keep the algorithm classified (Comm Week, Jan. 3). Critics said the ESS is a first step toward outlawing other forms of cryptog raphy, but the administration reiterated at the announcement that it had no such intention. Industry groups such as the Computer Professionals for Social Responsibility and the Electronic Frontier Foundation, both based here, immediately launched grassroots protests against the announcements. Both groups have citicized the proposal since it was first announced. -

1 0

ILF: What 4th Amendment? Here Comes the Clipper Encryption Plan
by Anonymous 17 Dec '03

17 Dec '03

Brought to you by the Information Liberation Front Reproduced without permission from Communications Week WHAT 4TH AMENDMENT? HERE COMES THE CLIPPER ENCRYPTION PLAN YOU'RE A CRIMINAL. That person sitting next to you is a criminal, too. All of the people you work with are criminals. How do I know this? I get it straight from the federal government. In fact, the federal government is so certain you're a criminal that the executive branch has just announced a new way to pry into your affairs, steal your correspondence, read your electronic mail, and listen in on your most private conversations. Not only that, but the Clinton administration wants you to pay for the privilege of having the government keep tabs on you. The administration claims that it's doing all of this as a way to fight crime, and since you're the one its targeting, apparently the Clinton administration has decided you're a criminal. By now, of course, you probably know what I'm writing about, but in case you've been in a cave for a couple of weeks, here's a summary. Earlier this month, the administration announced that the government was going ahead with its plans to start using the infamous Clipper chip -- that's the one that encrypts information, but includes a government-sponsored backdoor -- for the Justice and Defense departments. You're going to pay about $2,000 for each of the initial 50,000 or so Clipper-encrypted phones and similar terminal devices the government buys. Once the government starts using Clipper equipment, the plan is for these agencies to require anyone dealing with them to use it also. Meanwhile, you must provide a way for the government to listen in to your telephone system. You get to pay for the new or modified equipment. Finally, sources tell us, the adminis- tration plans to outlaw any form of encryption other than that approved by the government. You get to pay for any changes these new systems require, too. No doubt you're thinking that the Fourth Amendment to the U.S. Constitution is supposed to prevent your papers and effects, among other things, from un- reasonable search and seizure. Is it reasonable to be required to hand over materials in a form the government wishes so that it can search you conveniently? It's not unlike being required to carry on your phone conversations in English for the convenience of government listeners who may not understand, say, pig latin. I suppose we shouldn't be surprised. In his debate on the ratifiation of the Constitution, Patrick Henry predicted that the gov- ernment'may, unless the general government be restrained by a Bill of Rights ". . . go into your cellars and rooms, and search, ran sack and measure everything you eat, drink and wear. They ought to be restrained." Of course, Henry didn't know computers would exist, but he knew of their analogue at the time-a person's papers and effects and that's why he fought successfully for an amendment to restrain the government. Now it appears that the government would slip its restraints. Apparently, in this new world of technology and digital communications, prying into one's affairs has become difficult. It's inconvenient to search an office, after all. It requires work. Instead, the government wants to read your electronic papers and effects, and it wants you to pay for it. The Bill of Rights? I guess that's become inconvenient, too. ------------- Wayne Rash Jr. is a Washington-based networking systems integrator. He can be reached on MCI Mail as WRASH on CompuServe at 72205,221 and on the Internet at rash(a)access.digex.com. The opinions expressed are his own.

1 0

ILF: E-Mail Destination - Black Hole, White House
by Anonymous 17 Dec '03

17 Dec '03

Brought to you by the Information Liberation Front Reproduced without permission from Communications Week Editor's View E-MAIL DESTINATION: BLACK HOLE, WHITE HOUSE Is the Clinton adminisration really an ally of the communications and networking community, or are the politicians only jerking our strings? The answer to this imortant question seems to vary day to day. A few weeks ago I received four elecronic-mail communiques from the White House Office of Media Affairs. This caught my attention for several reasons. First, the administration is not in the habit of communicat- ing with the trade press so I was impressed with this outreach. (Cool move, guys.) Next, the messages were targeted at key journalists using the preferred medium du jour: electronic mail. (Very cool!) Finally, all four messages were dispatched the same day. I was most interested in a message detailing the administration's efforts to communicate over electronic networks. The Clinton administration's Electronc Public Access Project has achieved some important milestones during its first year. According to the project's press release: lt has received over 100,000 E-mail messages to the president and the vice president since it started on June 1, 1993; It established Internet addresses and accepts E-mail from the public; It has electronically processed over 220,000 requests for information since September 1, 1993; 1,600 public documents were published electronically last year; It established forums on America Online, CompuServe, GEnie and MCI Mail. The project plans this year to publish the national budget and other public documents on CD-ROM. It also plans to refine existing electronic com munications techniques via the Internet. I applaud the administration for these innovations. But I also have some reservations. For one, it's looks great on the surface that the administration has set up so many channels for communication. Yet this is the key question: Is anyone really listening? E-mail questions do not get electronic replies from administration officials. Questioners (if they are lucky) get back a letter -- via the U.S. Postal Service. This sounds more like a black hoel than a viable communications process. The president did respond at least once via E-mail -- to a group of fifth-graders in Oxford, Ohio, last spring. At best the opinions of communications and networking experts seem to be ignored; at worst they have been rejected by the president. An example is the president's recent adoption of the socalled "Clipper Chip." This encoding/decoding scheme was devloped by the National Security Agency to assist government agencies to evesdrop on digital communications. Virtually every major computer and communications company, opinion maker, and civil rights group opposes the use of this technology. apparently, however, the president doesn't care what we think. This action has jilted our enthusiasm for the administration's avowed embrace of communications technology. It's beginning to look more like a charade to keep techies playing with their toys instead of a mature partnership in molding our technological future. Send reactions to 542-9851(a)mcimail.com on MCI Mail or the Internet, or by fax, 516-562-5055

1 0

Shot 'Round the World
by Jeff Davis 17 Dec '03

17 Dec '03

Well, my personal secretary compiled every single media email adress in the _Big_Dummies_Guide_ into 6 alias'. Then I emailed it to every one of them. If the FBI comes to the front door, this piece of shit XT clone I use for a UNIX terminal goes out the back door and off the sun deck into the alley. I suppose the fucking phone will ring off the hook in Ft. Meade for a while. By God! It's a good day for the Revolution!!! *** Here's the follow up *** To whom it may concern, You have been emailed an authentic National Security Agency Employee's Manual. I as an Electronic Frontier Foundation member, acting purely on my own initiative, and solely accountable for my actions, have emailed this information, as well as John Gilmore's FOIA attack on the current Clipper Chip proposal for key escrowed encryption, to every media source with an email adress listed in EFF's _Big_Dummies_Guide_to_the_Internet_ on the entire planet. You may authenicate the NSA manual via confirmation by the phone numbers listed in it. Consider this the shot heard round the world in the Electronic Revolution. Sincerely, Jeff Leroy Davis, AKA Eagle EFF Member # 2176 Attached is my PGP public key by which you may verify that I am indeed who I say I am. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAi1yIUsAAAEEANIDU/e6qt77IAX+zDqCLMpj6tjYZBOd7HhAmNlIOapgd926 J029AapszLkDqASgVU/Zzs0QpgQ1GAOerlJj1wDPdSMZ03mEqo94ztPI8uNliJTe /CRKqMrkVpe/zOj13QS3HOk2sH//EM73OrlfftxJucLUf2Y30V/ScHuGXWgVAAUR tCtKZWZmIExlcm95IERhdmlzIDxlYWdsZUBkZWVwdGh0LmFybW9yeS5jb20+iQCV AgUQLY8mOTZAgYw09MRxAQFABgP+NJ0TWTUXL/NSvErHP/9zYe+DU8r7ox4k9upd wQ0DKpBEJIg0UNN1DoztLHLr3V3HehvLACGCP/InJPUXTuEFrKyg08t5AFpYpY2b 1+TF1lne0Q0snASd+D2HrIzJQYw0U5siDUe70l6V/dFNCF/9OclNmeMU66j77nW4 zZ16BjaJAJUCBRAtjyXWmEsctw8gOSUBAc9nBACyTl0EhoakGWLJNHOrL1HO+Rf7 RSR0mmdnAn97hzNkC+/O6pAalL3Lp+7fTooYgE35qjItavvdPCcUz2Q6iATXAH6e JnIY2/Jn/oS6TZgksSDcczcwok1C+H6oXp17IqxVCmlV+6wO5jRv2qNJ1Re0QnYy rdFOHVb5YFmtNUwt34kAlQIFEC2OBTgOhDSHLufvWQEBRdoD+gKDZ/xfrDiL3iUU KCWB4g0jjJT8/0JT+9W+I/P5hH2A8XIlFdXVjBUlCSjEjBiXEEzkYCg7xUiCgARP NqGbEu9uIEOIoU5hlhWs7hvVfDTFqpcyBvJ12HXvZMtPswwyR9mWQ8sSd18Bz+dZ vzX4fV8jB+ZayS55j2ZD1jMymMYt =cyXF -----END PGP PUBLIC KEY BLOCK----- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

2 1