December 2003 - cypherpunks-legacy

Bruce Schneier appearance
by Brian D Williams 17 Dec '03

17 Dec '03

MEETING NOTICE ============== UniForum Chicago holds its monthly general meeting on Tuesday, August 16, 1994 at the College of DuPage and everyone is welcome. This month's speaker is Bruce Schneier, author of APPLIED CRYPTOGRAPHY, (B. Schneier, Wiley Inc., 1993). Quoting the back cover of Bruce's book: "The explosive growth of public and private computer networks has resulted in a tremendous increase in the colume of sensitive and valuable data that is routinely stored and transmitted digitally. From computer messages speeding through global networks to vast sums of money transferred electronically, the greatest challenge in this new digital world is keeping this formation out of the hands of unauthorized users who prey on vulnerable computer systems. "In APPLIED CRYPTOGRAPHY, data security expert Bruce Schneier details how programmers can use cryptography--the technique of enciphering and deciphering messages--to maintain the privacy of computer data. Covering the latest developments in practical cryptographic techniques, the book shows programmers who design computer applications, networks, and storage systems how security can be built into the computer software and systems we use every day. The meeting will be held at: College of DuPage Building M, Room 150 22nd & Lambert Glen Ellyn, IL 60137 Take 355 to Butterfield Rd. Butterfield West to Lambert Rd. Lambert Rd. North to 22nd St. West on 22nd Street to Lot 10 entrance South into Lot 10 Park in Lot 10 and walk to Building M Meeting Room is 150 For further information, call Mike Potter at 708 960-0133 x15.

1 0

Re: RemailerNet
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <199408110212.TAA17672(a)ucsd.edu> Lance Cottrell writes: > >If anyone cared enough, what they would do is (a) put up enough remailers > >so that they were, say, a steady 80% of those announcing in the alt.x > >group; (b) provide a good, reliable service nearly all of the time; and > >(c) drive the other 20% out of business with a steady disinformation > >campaign (rumors, complaints, etc) and other more aggressive tactics. > >The FBI types running (a) and (b) would be well funded and they would > >be the sort of steady, unimaginative people who run small businesses > >well. The CIA field agents masterminding (c) would be very well > >funded network freaks, some of them ex-hackers. They could operate > >outside the USA and pay little or no attention to US laws. Pity the > >poor 20% in the face of such attacks. > > > >Any traffic sent through this remailer network would have only a tiny > >chance of getting through without being compromised. If you picked > >5 remailers, the chances of all being non-FBI would be about .2^5, > >3 in 10,000. The other 9,997 messages would be copied immediately > >to Langley. > > I fear that you have the math wrong. The odds that the path would be compromised > (that is all five nodes are FBI) is 1-(.8^5) = .67 Actually, the odds are better than this, .8^5, about 0.33. You will be compromised "only" 1/3 of the time. But if you are sending regular messages to another party, then traffic analysis will quickly show that you are communicating, because even if the boys at Langley are really dumb, you won't make send more than two or three messages without having all the cherries lining up. You will be protected if you have encrypted your messages, but using a remailer network offers little additional protection. > If I understand your system one compromised node is a total loss for that > message. No, as I have said elsewhere, I think that an 'empowered user' of RN0.2 can communicate with another empowered user through a completely compromised network with little risk, so long as there are many other such users. This is because the compromised gateways will not be able to tell when and whether either of the users is actually communicating. -- Jim Dixon

1 0

Re: Are Remailers Liable for What They Remail?
by Patrick Juola 17 Dec '03

17 Dec '03

Perry sez: UUNET, among others, considers itself to be a common carrier. My understanding is that, legally speaking, "considering [oneself] to be a common carrier" amounts to exactly nil -- that it requires a special act of some governing body to declare you to be a common carrier. One might just as well consider oneself to be an accredited diplomat and therefore to have diplomatic immunity. Any of the real lawyers on the net care to comment? kitten

2 1

Re: Are Remailers Liable for What They Remail?
by L. Todd Masco 17 Dec '03

17 Dec '03

According to a discussion I had with Dave Lawrence (postmaster at UUNET, as well as moderator of news.admin.newgroups), UUNET is registered with the FCC as an "Enhanced Service Provider," which, according to Dave, amounts to similar protection as "Common Carrier." ("Common Carrier" seems to not be appropriate yet, since Congress is so behind the tech curve) -- L. Todd Masco | Bibliobytes books on computer, on any UNIX host with e-mail cactus(a)bb.com | "Information wants to be free, but authors want to be paid."

1 0

Re: Are Remailers Liable for What They Remail?
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 10:45 AM 8/11/94 -0600, Patrick Juola wrote: > >My understanding is that, legally speaking, "considering [oneself] >to be a common carrier" amounts to exactly nil -- that it requires >a special act of some governing body to declare you to be a common >carrier. One might just as well consider oneself to be an >accredited diplomat and therefore to have diplomatic immunity. > >Any of the real lawyers on the net care to comment? > > kitten > Ah, the eternal Common Carrier debate. The answer is the same as the last few times. "Common Carrier" status has little to do with exemption from liability. It has most to do with being unable to reject passengers, goods, or phone calls. The EFF would like the NII to be a common carrier so that 'the poor' could get 'free' connections, most of the libertarians here would not. Plenty of non-common carrier entities are immune from prosecution for ideas that they unkowingly communicate -- bookstores for example (unless they are *knowingly* porno bookstores in the wrong jurisdiction). Compuserve was held not liable for an (alleged) libel by one of its sysops. Not because of coomon carrier but because they had no knowledge or control. Remailers have no knowledge or control hence no scienter (guilty knowledge) hence no liability as a matter of law -- not a jury question BTW. DCF "Where is telecoms regulation when anyone can be a phone company? Where is banking regulation when anyone can be a bank?"

2 1

Re: Crime Bill FAILED to pass
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 06:13 PM 8/11/94 -0500, Jim_Miller(a)suite.com wrote: > > >Hurray!!! > > In celebration, everyone should go out and buy a MAC-11 this weekend. DCF

1 0

Crime Bill FAILED to pass
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Hurray!!!

1 0

Re: Problem in draft FIPS `CRYPTOGRAPHIC SERVICE CALLS'
by p.v.mcmahon.rea0803＠oasis.icl.co.uk 17 Dec '03

17 Dec '03

> Have you been following the IETF's GSS-API work? Yes - and implemented a GSS-API mechanism. The relationship between GSS-API and a general crypto interface is contentious - as the interfaces to "export" a key for a remote principal (cf ExportKey and PubExportKey in the draft FIPS) resemble the GSS-API context initiation interface (cf gss_init_sec_context in RFC 1509), but have more assumptions about the possible KM (key management) protocols than GSS-API - or at least only make explicit provision for X9.17, D-H, and RSA. GSS-API has been implemented over Kerberos, DASS, KryptoKnight, DCE1.1, SESAME, and possibly others I haven't heard of. Also, discussions for an extension of GSS-API to layer over PEM/PGP were kicked off at the last IETF to enable mail-enabled applications to be linked in to easily consume authentication and key management services. Hence GSS-API is somewhat proven to be KM-mechanism-independent. There is a potential relationship between this export/import class of interface and the IPSEC packet format (now - or soon to be? - documented), and ongoing IETF IPSEC WG discussions re KM. Specifically, it would be helpful for fast implementations (in both senses) if as much of the processing of IP security could potentially be handed off to hardware-implemented routines via common KM-mechanism-independent and algorithm-independent interfaces (which, based on the NIST proposal primitives, would be [Pub]ExportKey/[Pub]ImportKey, Encipher/Decipher, and GenerateDAC/VerifyDAC). If the right interfaces are standardised in h/w crypto, perhaps little other than negotiation and SAID handling need usually be in software. Piers

1 0

Reailers: To Log or Not to Log?
by nobody＠kaiwan.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May pondered: > And even that last remailer may be able to claim ignorance (and win in > court) if he can show that what he mailed was unreadable to him, i.e., > encrypted to the recipient. (This is another reason I favor a goal of > "everyone a remailer.") The only problem I see with the "everyone a remailer" concept is that, in the presence of traffic analysis, a locally generated message will show up as an imbalance between incoming and outgoing messages, will it not? > With canonical remailers, and no logging, earlier remailers should be > safe. That brings up an interesting point -- does the very act of logging remailing activity, specifically the recording of sources and destinations of forwarded messages perhaps open the operator up to INCREASED liability? IOW, if the remailer is being used in the furtherance of a "crime", the presence of a log which records the details of such traffic might be used as an argument that the operator "should have known" that suspicious, possibly illegal, activity was going on and possibly being considerd CRIMINALLY NEGLIGENT for not stopping it. Has he/she torpedoed any possibility of a "Sgt. Schultz" ("I know nuuuuthing!") defense by gathering detailed evidence and then not acting on it? Perhaps "Don't ask, don't tell" is a better policy... Also, I suspect that if increased activity on a remailer is useful in thwarting traffic analysis, then foreswearing the keeping of logs should serve to INCREASE the throughput as users gain confidence that any "footprints" they might leave behind are promptly erased. -- Diogenes -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLkmVwORsd2rRFQ1JAQF8OAQAlQW2ft75QMkxxWR1FMBaz7ja7C+o1uuH aK4yEBfJ3uHIuzIPyfNbtat6hWF1JV8Ip1uAgVae/MSe/Eeu54uMnh9CgdtK+NW3 3LdO9qMH+4YazACh+VnFCdqJmenOxjRnqHlqcQlVrGW/oqiiWIyF3cLUPGYvsvMd SOysxBS3SDU= =u3TC -----END PGP SIGNATURE-----

2 1

MAIL: future free remailers
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jonathon Rochkind wrote: > People often like to postulate on the list that eventually there > won't be any more of these philantropic free remailers, and people > will be charging small amounts for every remailed message, to make > some money off it. > I've thought of a pretty good reason why this might not ever happen. > [...] one's primary reason might be to ensure oneself anonymity. Interesting point... I guess that is a good reason why free anonymous remailers might not ever die out, but pay remailers may be able to offer enhanced features and services that would tend to attract the vast majority of customers (assuming such a service would be considered as valuable by enough people ;) I mean, it is easy enough to run a remailer from a school account or something like that, except you have little control: it may be forbidden (here at Rice for example), you may be told to shut it down (Netcom, U of Buffalo, U of Washington), you may have a disk quota (previous remailer I ran which stored messages, mixed and sent them at midnight) which would limit certain features, you may not be able to use "cron" or "at", you may not be able to turn off sendmail logging, you may not have the account for very long... you may want to offer usenet posting but can't, you may be subject to various denial of service attacks, you may want to name your remailer "nobody" but can't, you may want to alter sendmail config files, etc. And then maybe you'd like to experiment with something really different, like running an fsp daemon and letting people fsp files to you to be remailed. Or something of this nature, which may require leaving a program running all the time, listening to a port for connections. But maybe you can't do this either. On the other hand, if you owned your own machine and net connection, you are in a position to address all these concerns, and the people who are concerned enough to seriously use anonymous remailers may be willing to pay a postage fee. Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLkrT9MSF/V8IjI8hAQFACgP/VrZDA5uSq3yHKqUeca8YVsFIkbesoCiF OQAnUWBMRFpgLK1azYZSJBkfdxllk1SPIsryM87jofQ0U7RAIqF/u9j9Cf9Me5DF v0oPFdmBYFAPICevsXJDgFed9ZD9i9Vee/OWJYM+XQlZCBeCXu4xNrKG8IjUFPo3 vwV99N/MpBI= =Y3r6 -----END PGP SIGNATURE----- -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu 2.3: 5AD633; D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 2.6: 088C8F21; 97 73 9E 8B 98 3E DD B5 E8 97 64 7E 20 95 60 D9 "One man's mnemonic is another man's cryptography" - K. Cooper

1 0