December 2003 - cypherpunks-legacy

REMAIL: policy
by catalyst＠netcom.com 17 Dec '03

17 Dec '03

What follows is the policy for the remailer running at catalyst(a)netcom.com as of 21 Sept 1993: - 1 - I don't normally keep logs because (a) I lack the time to examine them; (b) I lack the space to keep them; and (c) frankly, I would rather _not_ know. If some exceptional situation requires it, I will temporarily log to resolve that situation. - 2 - I will block remailing to a given address on request and proof of identity by the owner. I run a remailer because I believe privacy is an inaliable human right. However, "Your right to swing your fist ends where my nose begins!". I will not condone, promote or aid the violation of other human rights in the name of privacy. Because I don't keep logs, I can do no more than block (nor would I wish to), although, see - 1 -. - 3 - I do not own the machine my remailer is running on. In fact it is a commercial system. Be nice. If they ask me to stop running my remailer on their system... I will. Additionally, you implicitly accept all the risks associated with trusting somebody elses machine. - 4 - I don't read mail that goes through my remailer _BUT_ it is my personal account, and personal mail addressed to me passes through it, therefore, if a message doesn't look like it contains remailer commands, the remailer assumes it must be to me and I get it. I read all mail that is addressed to me. The consequence is that poorly addressed messages intended to be remailed will be read by me. I will throw these messages away without responding, correcting, or forwarding them, as soon as I realize they were to have been remailed. Be aware that this can happen. I'm sure there is some threshold beyond which the content would force me to action in some way. What the content, threshold and possible actions are, I do not know. Protect yourself from this result by using multiple remailers and encrypting at each stage. - 5 - I am an engineer. I like to play. I probably cannot stop myself from constantly tweaking and growing the remailer code. It is, after all, an expermental system. The remailer you use today may not be the same one you get tomorrow. - 6 - I am a human being and suffer from all the associated frailties. When someone points a gun (actually or metaphorically) at me or my family, I must almost certainly comply with that entities wishes. I do NOT advocate law breaking and will comply with the law to the extent required and enforced; e.g., if the FBI comes to my door and says: "start logging your remailer, or shut it down" ("shut it down" might only be inferred <and, _no_, I didn't mean 'implied'>), then it is likely that I will comply to the extent required and enforced. - 7 - As with my kids: I reserve the right to change the rules at any time and for any reason; though I seldom exercise this right to explicitly revoke previously explicitly granted freedoms. - 8 - I run this remailer as a personal activity. It is in no way associated with my place of employment, my employer or the activities I engage in on the behalf of my employer. I run it out of a personal account on a commercial system that I pay for with my own money. If you have problems with the remailer, please talk to me first. If we can't resolve it, of course you can always report it to NetCom. - 9 - Finally, be aware that I am not _providing_ privacy. I am allowing it. That is, _you_ are the caretaker of your rights and must actively seek to protect them. I will help, but that is all I can do. If you wish to protect your privacy, I urge you to learn how and why these remailers (and other associated tools) work so that you can use them to the best advantage. Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

Re: Why RSA?
by derek＠cs.wisc.edu 17 Dec '03

17 Dec '03

First, the ViaCrypt version: I realize that it is legal. It's also very expensive when compared to the price of email readers/composers that people normally use (often weighing in at about $50 / seat). A $200 add-on is not likely to be universally accepted. It's as if somebody had patented car door locks and claimed that $40,000 was a reasonable price to have them included on a $10,000 car. I'm not complaining about the price; people can charge whatever they want for their products. However it does seem kind of high, creating market pressure... that market pressure surfaces in messages like this one and hopefully someday competing products from somebody. Perry Metzger: > All are patented in so far as one of the patents covers ALL public key > schemes. Some, like Rabin's scheme, have possible technical advantages > over RSA. I am just beginning to study the mathematics behind public key crypto (got Simmons's _Contemporary Cryptology_ from the library this morning), but I haven't seen anything about what exactly this means (that is, I haven't been able to "look it up"). I was under the impression that many people participated in the development of P.K.Crypto... how can somebody patent all of their work? Don't these kind of patents apply only to specific algorithms? Begging the indulgence of this list, two more questions: * is there a reference I can read that covers the scope of public key crypto patents? * in broad terms, what would I have to do to develop an algorithm that works from a user's perspective like p.k.c. (ie public/private keys, the central functional point of all the wonderful schemes based on pkc) but doesn't violate patents? Thanks! derek

4 3

Re: Bidzos on PGP and ITAR verbatim
by doug＠netcom.com 17 Dec '03

17 Dec '03

>Similarly, it was taught in an advanced discrete math course at the Since no one else has mentioned it...the NSA tried to head off the original publication of public key cryptography, threatening star chambers, national security directives, and jail terms. This was thwarted by profs at a hundred colleges across the U.S. immediately assigning the algorithm as homework to every software class they were teaching at the same time, thus rather letting the cat out of the bag. The NSA then backed off, and publications followed. The material has been a natural part of certain courses ever since, depending on tastes of the prof. Part of the above story I experienced directly, since I was at Berkeley at the time, and other parts I heard from Ralph Merkle, who was either still there or had just gone to Stanford...I can't recall which. So if someone is collecting stories about the commonality of teaching such things, I imagine there must be some hundreds of thousands of eye witness reports. I implemented a 512 bit pubkey algorithm for kicks on a Z80 CPM system around 1982 based on a paper in the open literature that aimed at non-mathematicians and gave details such as efficient GCD algorithms. There cannot be any question about how widely known these techniques are. Doug

1 0

Re: Master Key: A Clipper Story
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

>Message-Id: <9309212027.AA09946(a)dun-dun-noodles.aktis.com> >Date: Tue, 21 Sep 1993 16:27:24 -0400 >From: Marc Horowitz <marc(a)GZA.COM> >>> Well done! > >I agree! Yes -- only -- I wish there were more than 1/2 sentence on breaking into the escrow agencies. That's clearly where the first break would be.

1 0

(1) PRZ excluded (2) PM vs. LD (3) grand jury procedure
by L. Detweiler 17 Dec '03

17 Dec '03

I was thinking. What is the significance that PRZ was not actually cited in any subpoena so far? This is very puzzling. It seems to contradict the theory that the investigation is primarily PGP oriented. On one hand, we might attribute it to the idea that the grand jury & the Attorneys don't have a very clear idea of what exactly is going on with PGP anyway, which would fit in with some of the tidbits I've posted. The president of ViaCrypt *was* subpoenaed -- but he has only been in associated with PGP for a few weeks, since the commercial announcement. But, still, how could they *not* query PRZ if they are inquiring on PGP? This is what I call a `conspicuous omission'. Also, the targeting of ViaCrypt and not PRZ directly is very interesting to contemplate. It definitely suggests that the move of PGP to a commercial company was critical in the timing of the subpoenas. Was it critical in convening a grand jury in the first place? what is it about the situation that caused action after a company was involved? are relevant laws only applicable to companies, not individuals? surely not, but there is very likely something going on here beneath the surface. (BTW, let the record show I have only replied directly to PM's voluminous onslaught of public flames [to say nothing of my vast, superb private collection] in one message on the list, which I think is sufficient [or more precisely, nothing could be sufficient, but it is the minimum]. If there is any `bickering' going on beyond this, it is only the reader's fertile imagination that I was *engaged* [*targeted*? definitely]. Or, feel free to cite the messages to contradict me, in email. I say all this only because I fear I am becoming a symbol in everyone's psyche of any message that challenges PM, no matter who wrote it, quite to the contrary of actual developments.) Here's a bit more which is helpful in describing a grand jury investigation (although I'd like to see more) from someone who gives me too much credit :) ===cut=here=== Date: Tue, 21 Sep 1993 11:49:33 -0400 From: [...] To: ld231782(a)longs.lance.colostate.edu Subject: Re: more musings You are absolutely right about the Grand Jury proceedings. They are simply a fact finding venture. They are secret hearings and I doubt that Phil Zimmerman will even be able to talk about the proceedings after they are done. In addition to this, you are also correct that attorneys are not permitted inside the grand jury hearing (although the witness may leave the room to confer with the attorney). Once inside the room, you will only have the Grand Jury (of 23 people I believe) and the D.A. While it may seem nice to believe that Phil Zimmerman will be able to make a grand Perry Mason like speech in front of the Grand Jury. In reality, he will be under the control of the D.A. and will probably not have much of a chance to say much of anything except to answer the questions of the D.A. On the last point, yes you are also right, since the Grand Jury is NOT a criminal trial. Any evidence that would normally be held as illegally obtained, or just generally inadmissable in court (ie. hearsay) is perfectly acceptable for a Grand Jury, and I'm sure that it will be used. The grand jury's only purpose is to pass either an indictment (called a True Bill ) or no indictment, they are not there to determine guilt.

3 2

Re: crypto import
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>123.2 -- Import jurisdiction. > The Department of State regulates the temporary import of defense articles. > Permanent imports of defense articles into the United States are regulated by > the Department of the Treasury (see 27 CFR parts 47, 178 and 179). Mayhaps this explains why the Treasury is involved with Grady/Zimmerman

1 0

Subjects in anon msgs
by fnerd＠smds.com 17 Dec '03

17 Dec '03

Someone writes: > What do you put in the Subject: line of an encrypted or anonymous > message? > > We need something standard to prevent traffic analysis on this field. ... Isn't it okay to have the subject appear in the last hop, according to a :: field in the second-to-last message? ::Remail-with-Subject: All Right Bugsy Lets Get Down To Brass Tacks With remailers that unencrypt at each hop, this doesn't seem a problem to me. With remailers that accept unencrypted input, this is no more of a steganoweakness than the body of the message already is. -fnerd(a)smds.com

1 0

PGP IN SF CHRONICLE
by Sandy 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, Remind me someday to explain why I think there are only 10-20 million people in the world, max. One "proof" is all the "coincidences" we experience. Anyway, here's another one. Because I have written for MONDO 2000, WIRED and FUTURE SEX, a friend sent me a newspaper clipping about some new culture and technology oriented magazines. She thought I should try to crack them. FAST COMPANY sounded interesting, so I called the column's writer to find out where it is published. We talked for a while and he mentioned he had an article in today's paper about the PGP indictments, Phil Zimmermann, etc. Hey, there are no accidents. If I'm lyin' I'm flyin'. The article was neutral to sympathetic. The factual content was okay-doke except for one misguided reference to "cypherfreaks." Oh well, what's in a name? The article was on the first page of the business section of the 21 September San Francisco Chronicle. "Cypherfreak" John Gilmore got in some good quotes. S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

New York Times: Federal Inquiry on Software...
by Zeek 17 Dec '03

17 Dec '03

---------------------------- The New York Times Tuesday, September 21, 1993 Business Day ---------------------------- Federal Inquiry on Software Examines Privacy Programs By John Markoff SAN FRANCISCO, Sept. 20 - In a Government investigation with implications for free speech and privacy in the information age, a Federal grand jury in San Jose, Calif., has issued subpoenas to two software publishers selling versions of a program that protects the privacy of electronic mail and other computer data. The investigation appears to focus on whether the program has been illegally exported in violation of State Department regulations that control the sale of weapons and other technologies whose export the Government believes may compromise national security. The relevance of such regulations in the post-cold war era is the topic of growing debate in Washington, where communications and computer executives plan to testify before Congress on Wednesday. [Page C3.] The software program, known as Pretty Good Privacy, or P.G.P., was written several years ago by an independent programmer in response to Federal threats to crack down on the distribution of encryption software which is used to protect computer data by converting them into secret code. No one can read the encoded information without access to mathematical keys - one that is publicly known, a second known only to the recipient of the coded message. The program has since been freely distributed around the world, used on thousands of personal computers and work stations. Receiving the Federal subpoenas were Viacrypt, a Phoenix company that plans to sell a licensed version of P.G.P., and Austin Code Works of Austin, Tex., which is selling a version of P.G.P. for other software developers to incorporate their own programs. The grand jury subpoenas, which the companies received Sept. 9, ordered them to supply all correspondence and records related to the international distribution of P.G.P. and other information related to computer cryptography. A Customs Department official refused to comment on the case today. William P. Keane, the assistant United States attorney who signed the subpoenas, confirmed that there was a grand jury investigation, but said he could not comment. Both publishers said they had no plans to sell their products abroad. "I think they're more concerned with our intentions than what we've done," said Leonard Mikus, president of Viacrypt, which is a division of the software company Lemcom Systems Inc. of Phoenix. "They're on a fishing expedition, but this could become a landmark case that sets the limits that distinguish between electronic and conventional publishing." Battling the N.S.A. The investigation is the latest round in a growing battle in recent years between the National Security Agency and a variety of groups in this country, including high-technology companies, computer researchers and civil libertarians, over the role of coding software in protecting computer data. The N.S.A., whose role is to monitor electronic communications around the world, has consistently acted to block the adoption of new technologies that would make its mission more difficult. But the widespread availability of high-speed digital communication links and inexpensive personal computers may make it impossible to enforce technology restrictions in the future - as the widespread international dissemination of P.G.P. has already indicated. President Clinton alluded to the problems of controlling distribution of software technology in a speech last week promoting the North American Free Trade Agreement. "Nothing we do in this great capital can change the fact that factories or information can flash across the world, that people can move money around in the blink of an eye," the President said. "Nothing can change the fact that technology can be adopted, once created, by people all across the world and then rapidly adapted in new and different ways by people who have a little different take on the way that technology works." Question of Legality Government regulations, enforced by the State Department, make it illegal to export cryptographic software without a special munitions export license issued for weapons sales. Those restrictions have angered many computer industry executives who argue that encryption software is the crucial technology underlying a variety of information-age services, ranging from secure electronic mail to computerized payment of bills. Last year, a number of United States software companies, represented by the Software Publishers Association, a trade group, struck a deal with the N.S.A. permitting them to export software that contained coding functions. Those codes, however, are believed to be easily cracked by the N.S.A. The P.G.P. software under investigation is thought to defy most N.S.A. code-cracking efforts. The legitimacy of the export regulations is also disputed by legal scholars who argue that they restrict freedom of speech. "There is a First Amendment right to speak in a encrypted way," said Eben Moglen, a professor of law and legal history at Columbia University who is familiar with the case. "The right to speak P.G.P. is like the right to speak Navajo. The Government has no particular right to prevent you from speaking in a technical manner even if it is inconvenient for them to understand." Protection from Code-Breaking P.G.P. has been controversial since it was written by the programmer, Philip Zimmerman, because it uses a coding formula that many researchers believe powerful enough to protect information from even the National Security Agency's high-speed code-cracking computers. The formula was developed by three well known computer scientists: Ronald Rivest, Adi Shamir, and Leonard Adelman. --------------

1 0

Stunned and amazed
by msattler＠netcom.com 17 Dec '03

17 Dec '03

>Perry Metzger >Puzzled and incredulous I'm not one to snivel about bandwidth ('cause I think the Internet can deal with a lot more text messages from us to ourselves), but the kind of thing that's gotten Perry in the state he's in reminds me of a time-honored way of dealing with trivial, nonsensical, toxic waste messages: IGNORE THEM AND THEY'LL GO AWAY. It's the attention that's craved. We now return you to your insightful cypherpunks list, already in progress. :-) M ----------------------------------------------------------------------------- Michael S. Sattler msattler(a)netcom.com +1 (415) 358-3058 Digital Jungle Software Encrypt now; ask me how. (finger for PGP key) "Don't Panic!" -- Douglas Adams "Don't Panic. Stay Cool." -- PRZ

1 0