December 2003 - cypherpunks-legacy

New book on public key law
by paul＠poboy.b17c.ingr.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There's an announcement in the latest comp.risks digest about a new book on public key law & policy. I've reproduced parts of the abstract below. It sounds pretty interesting. - -Paul >Date: Sun, 31 Jul 1994 08:51:33 -0400 (EDT) >From: Michael S Baum <baum(a)world.std.com> >Subject: Report Released on Public Key Law and Policy > **NEW INFO. SECURITY BOOK ON PUBLIC KEY LAW & POLICY** TITLE: FEDERAL CERTIFICATION AUTHORITY LIABILITY AND POLICY -- Law and Policy of Certificate-Based Public Key and Digital Signatures AUTHOR: MICHAEL S. BAUM, J.D., M.B.A. Independent Monitoring Report No. NIST-GCR-94-654 450+ pages, highly annotated; multiple appendices; indexed. U.S. DEPARTMENT OF COMMERCE National Institute of Standards and Technology Produced in support of the Federal Government's public key infrastructure study, this book identifies diverse technical, legal and policy issues affecting a certificate-based public key cryptographic infrastructure utilizing digital signatures supported by "trusted entities." It examines potential legal implications, surveys existing legal paradigms and the structures and roles of relevant governmental agencies and presents various institutional approaches to controlling liability. It considers the underpinnings of a legal and policy framework which might serve as a foundation for security policies and their implementation and concludes with a series of recommendations, both general and specific concerning certificate-based public key. Both public and private sector issues are addressed. [ .. elided .. ] SUMMARY OF CONTENTS: - - PREFACE - - ACKNOWLEDGMENTS - - TABLE OF CONTENTS I. INTRODUCTION II. SCOPE III. DEFINITIONS IV. ASSUMPTIONS V. SURVEY OF FCA ACTIVITIES CREATING LIABILITY EXPOSURE VI. LEGAL CONSIDERATIONS VII. FCA INFRASTRUCTURE - PROPOSALS AND PARADIGMS VIII. SURVEY OF, AND APPROACHES TO, TRUSTED ENTITY LIABILITY IX. OTHER APPROACHES TO MITIGATE LIABILITY X. CONCLUSIONS AND RECOMMENDATIONS XI. APPENDICES XII. GLOSSARY XIII. INDEX OBTAINING COPIES: Copies may be purchased through the National Technical Information Service, Springfield, Virginia 22161, U.S.A., Phone +1 (703) 487-4650 or 1-800-553-6847. Request NTIS Document No: PB94-191-202. Cost: $61.00 [ .. ABOUT THE AUTHOR elided .. ] - -- Paul Robichaux, KD4JZG | "Information is the currency of democracy." perobich(a)ingr.com | - some old guy named Thomas Jefferson Of course I don't speak for Intergraph. - -- Paul Robichaux, KD4JZG | "Information is the currency of democracy." perobich(a)ingr.com | - some old guy named Thomas Jefferson Of course I don't speak for Intergraph. -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLkDl46fb4pLe9tolAQFMgQQAvjuMgOxXArhyu3GXZHdpNf3ZgZpQMI4H E/DXESVRsK0adydt3cexOXMVxlzEPYM7IEqnumAx2qX3Mx0l0xAKtPnn9f09BS92 dwG/hOInI6dekvkB/4xJOGLWYfM0z3k+QuyzK+xyhEhNHspHDJIvpc7Yo3jr0GJz 1p5A0OZYa1o= =j4Qb -----END PGP SIGNATURE-----

1 0

Re: Voluntary Governments?
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Bob Snyder writes: > I think there is a balance that can be struck between code-only talk and > politics. The list seems to be heavily tilted towards politics, probably > because a good portion of the subscribers may not have the math/computer > science background to follow all the code/protocol discussion. I know that > I have a hard time following it some times. But I think opening the list > up to generic, non-cryptological debate is a bad idea. > "Opening the list up"? I've been on the list since the beginning, and anarcho-capitalist, politico-cryptologic themes have _always_ been with us. The role and nature of government in the presence of strong cryptography is a recurring, and important, theme. Those who want to discuss the mathematics and engineering of cryptology are certainly encouraged to do so, but not to stop other threads. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

A Helpful Tip for Impatient Souls
by Tommy the Tourist 17 Dec '03

17 Dec '03

Those wishing perhaps the ultimate in Cypherpunks ease-of-use and greatest peace of mind, may find it useful to simply delete everything that does NOT come from one of the following email addresses: tcmay(a)netcom.com frissell(a)panix.com sandfort(a)crl.com Additionally, you'll probably want to let through posts from Hal Finney, Eric Hughes, and Bruce Schneier, but I forgot their addresses off-hand and am much too lazy to look them up. :) If you're using the "ELM" mailer, you can do this by creating a file called filter-rules in your .elm directory, containing the following text (more or less): if (from contains "sandfort") then save "~/cypher" if (from contains "frissell") then save "~/cypher" if (from contains "tcmay") then save "~/cypher" if (to contains "cypherpunks") then delete Add additional addresses as needed, but be careful of excessive alliteration. ------------ To respond to the sender of this message, send mail to remailer(a)soda.berkeley.edu, starting your message with the following 8 lines: :: Response-Key: the-clipper-key ====Encrypted-Sender-Begin==== MI@```&]^&2?(E<U9BPG1]W7L;=*KH_R`E[:HLL5(1[#C?F1F@+XOR[*O4;Q* M5#7=J!((PXPB/`Z?E75=RY`'42E\')B98SJ<!]_D6):*2C`'_S7T,&Y7VY1R :GOR712QF!VS=527/-L\@>E6`)=?D_W1Y'5P` ====Encrypted-Sender-End====

2 1

US Postal Public Key
by John Young 17 Dec '03

17 Dec '03

The list Cyberia posted an article yesterday on the US Postal Service's plan to use a public key system for email. If anyone wants the full posting, email me; it's about 25K. Below are excerpts: Quote: Quebec City, Canada, August 3, 1994--The U.S. Postal Service has dramatically increased its commitment to the security of communications on the NII, with the announcement of Postal Electronic Commerce Services ("Postal ECS"), which will offer a nationwide public key certification service for the authentication of digital signatures used in paperless electronic commerce. Richard Rothwell, Senior Director of Technology Integration for the USPS, officially released the news today in Quebec City, in a paper delivered to an international working group of the Information Security Committee of the American Bar Association's Section of Science and Technology, which has been developing guidelines for public key certification authorities. [Speech is all in uppercase] * * * AS MANY EXPERTS HAVE NOTED, INCLUDING MANY OF YOU IN THIS ROOM, DIGITAL FILES AS A RULE ARE NEITHER AS SECURE NOR AS ELECTRONIC COMMERCE CONVEYS. BUT WITHOUT SOME METHOD OF SEALING A DIGITAL FILE TO ESTABLISH ITS CONTENTS, AUTHOR, AND TIME OF TRANSMITTAL, THE BENEFITS OF ELECTRONIC COMMERCE WILL INEVITABLY BE LIMITED TO HIGHLY STRUCTURED TRANSACTIONS BETWEEN PARTIES THAT KNOW AND TRUST ONE ANOTHER. * * * THE POSTAL SERVICE IS USING PUBLIC KEY ENCRYPTION TECHNOLOGY, AND RELATED TECHNOLOGIES, TO DEVELOP A PUBLIC KEY CERTIFICATION AUTHORITY AND A SET OF ASSOCIATED TRUSTED THIRD PARTY SERVICES WHICH WE CALL POSTAL ELECTRONIC COMMERCE SERVICES (POSTAL ECS). WHEN INITIALLY DEPLOYED, POSTAL ECS WILL PROVIDE A BASIS FOR ELECTRONIC ASSURANCES WITHIN AND AMONG GOVERNMENT AGENCIES, AND BETWEEN GOVERNMENT AGENCIES AND THEIR CONSTITUENTS. IN PARTICULAR, THE POSTAL SERVICE HAS DEVELOPED THE ABILITY TO: ISSUE PUBLIC KEY CERTIFICATES AND STORE THEM IN A PUBLIC DIRECTORY; PROVIDE FOR THE "SEALING" OF SELECTED DOCUMENTS OR OTHER ELECTRONIC OBJECTS AND ASSOCIATING THEM WITH A DIGITAL SIGNATURE AND A TRUSTED TIME AND DATE STAMP; PROVIDE SERVICES FOR PUBLIC KEY CERTIFICATE PUBLICATION AND REVOCATION; AND, PROVIDE THE ABILITY TO ENCRYPT CONFIDENTIAL INFORMATION MOVING BETWEEN THE USER ENVIRONMENT AND THE POSTAL ECS MANAGEMENT SYSTEM. FINALLY, PROVIDE NEAR REAL-TIME ACCESS TO CERTIFICATES AND THEIR STATUS. THE CERTIFICATION AUTHORITY WILL ISSUE AND MANAGE X.509 PUBLIC KEY CERTIFICATES CONTAINING A PERSON'S X.500 DISTINGUISHED NAME, PUBLIC KEY, AND OTHER IDENTIFYING INFORMATION. USERS CAN THEN RETRIEVE A CERTIFICATE FROM THE POSTAL SERVICE, AND USE ITS PUBLIC KEY TO AUTHENTICATE A DIGITAL SIGNATURE GENERATED BY THE COMPLEMENTARY PRIVATE KEY. * * * THESE USER AGENTS CONTAIN STANDARD PROGRAMMING INTERFACES THAT LINK USER APPLICATIONS, CRYPTOGRAPHIC ROUTINES, AND ECS SERVICES TOGETHER. OUR INITIAL IMPLEMENTATION IS BASED ON THE DIGITAL SIGNATURE STANDARD (DSS) ALGORITHM SET; BUT OUR PLAN IS TO SUPPORT OTHER CRYPTOGRAPHIC OPTIONS SUCH AS RSA IN THE NEAR FUTURE. * * * IN KEEPING WITH THE PHILOSOPHY I HAVE ARTICULATED, LET ME SAY THAT THE POSTAL SERVICE, IN ANY DEVELOPMENT OF THESE PRODUCTS, INTENDS TO SUPPORT MULTIPLE CRYPTOGRAPHIC PRODUCTS IN THE MARKET PLACE. IN ADDITION, WE WILL NOT COMPETE WITH NETWORK SERVICE PROVIDERS, NOR WILL WE BECOME A NETWORK OR CARRIER. * * * End Quote.

1 0

I sell out
by frissell＠panix.com 17 Dec '03

17 Dec '03

They finally got to me. after fretting for years about how (melanin-rich) hordes of illegal aliens were poised to steal *my* job, I've decided that something has to be done. The turning point came this morning while reading about the report of the Commission on Immigration Reform. They have proposed a brilliant idea -- a national registry of the names and SS numbers of all *Real* Americans (as well as those sneaky legal aliens) so that employers can (would have to) verify that their prospective employees are legal. Since this is such a fabulous idea, I thought that we might help out by creating a Social Security Number Server on the nets to make valid names and SS numbers available to *everyone*. Nice WWW interface with forms support, etc. After all, since it's such a good thing to do, we should *help* the Feds by doing more of it. As you may know, there's a guy on alt.privacy who has been collecting SS numbers for a while (a perfectly legal activity). I will be contacting him to see if he would be interested in contributing the numbers that he has collected. Anyone else interested contact me. DCF Who is among the 2% of Americans (it's actually higher) not covered by the Social Security Act and who will be part of the 5% of Americans (again it will be much higher) not covered by the Health Security Act.

2 1

Re: Voluntary Governments?
by dance＠cicero.spc.uchicago.edu 17 Dec '03

17 Dec '03

>> > > Imagine if the government stopped trying to force people to >> > > join it. Or imagine if they tied decision making power to >> > > how much you pay in taxes. The more you pay, the more say >> > > you get. After accepting the idea that government is a >> >> Without the legal monopoly on coercion, this so-called "government" would >> be just another service provider, like Safeway or Goodyear or K-Mart. [JWS writes:] >Well isn't that how its supposed to be? [....] No. The object of government is to limit the freedom of the people it governs. The word is derived from "govern" which means "3. To control the actions or behavior of 4. To keep under control; *restrain*" [American Heritage Dict.] It would be great if government could be a service provider, or simply feel responsible for those it governs--but then it would not be a government any longer. It would also be nice if I won the lotto. ;) _/_/_/ _/_/_/ _/_/_/ _/ _/ All men recognize the right of _/ _/ _/ _/ _/_/ _/ revolution; that is, the right _/_/_/ _/ _/ _/_/_/ _/ _/ _/ to refuse allegiance to, and to _/ _/ _/ _/ _/_/_/_/ _/ resist, the government, when its _/_/_/ _/_/_/ _/_/_/ _/ _/ _/_/_/ tyranny or its inefficiency are _/ great and unendurable. --Thoreau, Civil Disobedience

2 1

Re: broadcast encryption
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

At 5:55 PM 8/3/94, Jonathan Rochkind wrote: >That kind of explains why encryption is not allowed on ham bands, but it >doesn't satisfy me. The difference between ham and other bands, is to use >other frequencies I've got to pay the FCC major money for a license, or >pay some commercial service provider who payed the FCC major money. Not quite. As someone else noted, there are unregulated (except for power and equipment) bands where no license at all is required. >With ham, I don't have to pay no one nothing, except maybe $10 for a ham >license. ham, or some other frequency reserved to work like ham, could easily >serve as a poor man's connection to the internet. Anyone with a desktop >PC can invest another hundred dollars or so, and have a really low >bandwith (2400bps) direct connection to the internet. You can do IP >over ham, although it's really dificult to do so currently without breaking >the law and losing your license. Doing IP over the amateur bands is easy, and is done by many people. Doing a connection to the Internet over amateur bands is hard. >A public ham or ham-like radio band would seem to be something the cypherpunks >would really like. It would definitely facillitate the creation of a sort >of blacknet type thing. The government has given the public citizens band, and >ham radio, if they're not going to open up ham so it can be used in the ways >I'm thinking of, why not take another hunk of spectrum and give it to the >public, specifically intended for digital transmissions (IP or otherwise). >This seems to be something we should be campaigning for, and the EFF >should be lobbying for. I don't object to your goals, but honestly, I think the EFF should be lobbying harder for some more important things, like killing the FBI's wiretap bill and getting cryptological export control lifted. Bob -- Bob Snyder N2KGO MIME, RIPEM mail accepted snyderra(a)dunx1.ocs.drexel.edu finger for RIPEM public key When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

1 0

Re: broadcast encryption
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

At 3:37 PM 8/3/94, Brian Lane wrote: >and my Linux system. Maybe they'll changes the rules if enough 'new' hams >could get together. I say 'new' because there are alot of old hams who >like things the way they are - they even fought the change in rules that >allow no-code users to get a license without having to take morse code(a >waste of time in my opinion). This may be blasphomey on this list, but I don't have a problem with the restriction on obscuring the meaning of transmissions on the amateur bands. My reading of the rules (and I'd probably double-check with the appropriate persons at the American Radio Relay League before doing so) is that cryptology that doesn't obscure the message, like digital signature, is permitted. After all, the encrypted portion of the message is easily computed or decoded, so its meaning would not be obscured; it just couldn't be generated by anyone else. This could be a solution to a problem I've always had with the digital amateur radio operations: the ease with which someone could be spoof. It's very easy to configure your system to transmit with the callsign of another, or even with a non-existant callsign. This is possible with wired networks as well, but requires access to the machines or cables on the network. With wireless, you can do it from anywhere, and as long as you keep connections short, not get tracked down. With digital signatures, it is possible to authenticate every message, or even better, every packet, and ignore unsigned message/packets. Getting a ham radio license (within the US) is fairly simple. You take a test the questions come from a pool which is public knowledge, pay the volunteer examiners ~$5 to cover the cost of the test(s), and wait for the FCC to send you your 10 year license. No fee for the license itself, and no renewal fee. Given the public nature of amateur traffic, I don't see a problem with the restrictions. There is no such thing as "private communications" on the ham bands. Never has been. If you want such privacy, use one of the commercial bands where it's allowed. Bob -- Bob Snyder N2KGO MIME, RIPEM mail accepted snyderra(a)dunx1.ocs.drexel.edu finger for RIPEM public key When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

2 1

Re: Remailer stuff
by Jonathan Rochkind 17 Dec '03

17 Dec '03

> Sorry if I'm being dense - will someone please E-mail me and tell me > why outgoing-only (or incoming-address-unavailable) remailers are > useful? I'm not sure that they are. The idea is, that some people might want to philanthropically provide a remailing service without revealing their identity. (or, heck, do it for a profit with anonymous ecash). This is currently pretty much unworkable. If a system that provided a reliable decentralized remailer infrastructure (like I _think_ the one I've proposed does), then it might become more workable, but I'm not certain if it would cross the boundry into something actually practical. But it's an interesting idea. > Also, with respect to getting the addresses of working remailers from > a newsgroup - it may not be a good idea to treat any address > advertising itself as a remailer as a useful remailer. Remailer 'x' > may well be run by a remailer-hater who publishes its traffic openly, This is a valid point, but it exists in _any_ remailer system or infrastructure. It's safest to assume that some cypherpunks list members who set up remailers are actually NSA agents. If you chain your message through 15 or 20 remailers, as long as 3 or 4 of them are not "evil", you are probably in good shape. But there's certainly a chance that all 20 are evil; I don't see how the "alt.anonremailer.net" concept changes the odds of getting a chain of all evil remailers. And, yes, I agree that the wise person wouldn't indiscriminately use remailers from this newsgroup, but only use those whose keys are signed by someone he trusts. It's obviously up to the user _how_ to use this hypothetical infrastructure, and there are ways that it could be used that wouldn't give you very much security. But I'm confident that if used properly it wouldn't give you any _less_ security then the current system, which is basically people telling each other about new remailers, and manualy adding them to their PGP rings and such.

1 0

Voluntary Governments
by kkirksey＠world.std.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >The specific point about "imagine if they tied decision making power to >how much you pay in taxes" was tried a while back: only tax-payers could >vote. I'm all in favor of this, but I doubt many of my fellow citizens are. > >(And to some extent we have this, through bribes and influence-buying. >Campaign contributions, etc.) > >Would anyone choose to pay more in taxes for an increased voting share? >Hardly. Do the math on how influential any one vote is in an election. For >specific cases, maybe. Again, that's how influence-peddling arises. Not a >very healthy development, even for a cynic like me. Heinlein suggested something similar (along with a few other "alternative" forms of government) in the afterword to "Who Are The Heirs of Patrick Henry" in _Expanded Universe_. Heinlein suggests: "A State where anyone can buy for cash (or lay-away installment plan) one or more franchises, and this is the government's sole source of income other than services sold competitively and non-monopolistically. This would produce a new type of government with several rabbits tucked away in the hat. Rich people would take over the government? Would the, now? Is a wealthy man going to impoverish himself for the privilege of casting a couple of hundred votes? Buying an election today, under the warm body (and tombstone) system is much cheaper than buying a controlling number of franchises would be. The arithmetic on this one becomes unsolvable...but I suspect that paying a stiff price (call it 20,000 swiss francs) for a franchise would be even less popular than serving for two years." Personally, I favor his government that requires an intelligence/knowledge test before a person can vote. I especially like his "Improving the Breed" variation on this one. :-) BTW, he also suggests the government in Twain's _The Curious Republic of Gondor_, but I've never read this book. Can anyone describe the goverment posited in this book? Ken ============================================================================= Ken Kirksey kkirksey(a)world.std.com Mac Guru & Developer - ----------------------------------------------------------------------------- And the Clinton administration launched an attak on people in Texas because those people were religious nuts with guns. Hell, this country was FOUNDED by religious nuts with guns. - P.J. O'Rourke -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLkD2AusZNYlu+zuBAQHsoQP9F/DcR8QUMpdCz7nfLlsUE1+kbJRDb6FC h3/613tR3IqRcKCj15nIg0QLYGH+OtcgPRskAJypPupZOS7+IZkeUk2bOPg57K0t H8UQbXY/xoc2WOUBKGsnXQnoBYQPvftU/M0V7t9ygVqGVFKIMapoVt+nXxYIsBLa EV54B/+2fsg= =KhXR -----END PGP SIGNATURE-----

1 0