December 2003 - cypherpunks-legacy

problems?
by mentor＠indial1.io.com 17 Dec '03

17 Dec '03

I've received no list traffic for 3 days. Is it live, memorex, or a problem with my address? Loyd -- ************************************************************************* * Loyd Blankenship mentor(a)io.com ^ * * Steve Jackson Games CI$: [73407,515] / \ * * PO Box 18957 GEnie: SJGAMES / O \ * * Austin, TX 78760 /_____\ * * 512/447-7866 * *************************************************************************

1 0

Mail outage
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

My remailer at hfinney(a)shell.portal.com is apparently unable to receive mail today and last night. I have complained to customer service about this and hopefully the problem will be resolved soon. Hal Finney hfinney(a)shell.portal.com

1 0

Regulating the Nets
by Duncan Frissell 17 Dec '03

17 Dec '03

A talk.politics.crypto post of mine forwarded because of my ego: T >I can't imagine any combination of events or circumstances which would T >keep the government out of the net.regulation business if they want to T >get in, Watch. We already know how to set up an "enterprise" network that excludes anyone the operators wish to exclude. We also know how to encrypt the traffic such that only authorized persons can read it. We also know how to do traffic mixes that make tracing difficult or impossible. And, finally, we know how to do this offshore, or in other countries, or using split processes running on different (or virtual networked) machines in many different locations at the same time. These virtual processes can shift around the physical world on a random basis. Rather difficult to regulate particularly since loads of people will be able to make their money while living anywhere on earth. In any (changing) jurisdiction. T >and I really don't see what private financing has to do with it It does provide a little more flexibility plus lower costs and better service. This would speed up the networking process. But you're right, we can use the National Information Infrastructure for our own purposes if we like. T >The net will be kept free of idiotic restrictions only if the T >majority of people want it kept that way and see to it the government T >hears them, and financing doesn't have much to do with it. The views of the majority (or the minority) are relevant only if someone can figure out a way to regulate the beast in the first place. Not a non-trivial problem. T >Do you really think Time-Warner management has a vision of a high T >bandwidth two-way communications network in which individual artists T >could offer their productions to the public in competition with the T >mindless network bilge? Or is it more likely Time-Warner imagines a T >future in which they have a stranglehold on a big chunk of the net and T >take the lions share of any profit associated with information that T >flows over it, I don't know what TW "imagines" but the competition -- Continental Cable -- is already planning to put 10 mbps Internet connections into the homes of any subscribers that want it by the end of 1994. They will not be controlling content. IBM was not able to kill "open systems" either. T >I can certainly speculate about which path is most likely to occur T >without any government interference with the be-all end-all cure-all T >magic bullet of the pure libertarian free market. You must realize by looking around you that there is no noticeable increase in obedience to authority going on. Even with decent enforcement techniques, the government will have a hard time controlling the nets. People will just choose to disobey as they increasingly do in other areas of their lives these days. In the *absence* of decent regulatory tools, obedience will be even lower. What are the powerful regulatory techniques that will bring the nets to heel? What is the government's magic bullet? Duncan Frissell You don't have to be nice to nation states you meet on the way up if you're not coming back down. --- WinQwk 2.0b#0

1 0

DES binaries for Mac -
by mjr＠TIS.COM 17 Dec '03

17 Dec '03

I'm looking for DES encryption software for a Mac that can read cbc-encrypted data created with the "des" command on a UNIX box. I found one version of DES for Macs (powers-MacDES.sit.hqx) that appears to do DES properly but uses the resource fork in some way such that it won't try to decrypt files it didn't create. Anyone out there a Mac wizard who can point me at a compatible binary? I've no access to a compiler, and I'm under too tight a schedule to port something myself. Please, buddy, can you spare some crypto? mjr.

1 0

MAIL: positive reputations
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Earlier, I mentioned my stab at a positive reputation scheme for anonymous mail. I made some changes to the script I posted earlier (which I discovered was truncated because of a lone period on a line - PERL's marker for ending a format specifier). The script sifts through an elm folder, reporting message number, email address of author, and subject. When a pgp signed message is found, it sends the message through pgp, extracting the signature and reports that instead. (At the moment I'm not sure what happens if the public key needed to verify the signature isn't on your keyring, or if a signature is bad). Positive reputations, digital postage, and easier methods for replying are a solution for the "how to mark anonymous mail" question which crops up from time to time. That is, you don't mark anonymous mail - instead, in the future, mail readers will be capable of getting the digital signature from a mail message and reporting it, of replying to anonymous mail, etc. I mean, who wrote the message is what you are really interested in, now so much how it got to you (via anonymous remailing chains, etc.). Positive reputations and digital postage are more appealing to me because I'm a "purist" - I'm more interested in "pulling it off" (anonymous mail) than in other concerns. Marking anonymous mail with certain subject headers and so forth is an unacceptable solution to me. Now, there isn't a requirement that the signature on the message be for a "real" person - a good positive reputation system would allow a person to adopt a pseudonym (ala Demosthenes and Locke in Card's _Ender's Game_) and speak via that pseudonym. When you read your mail and you note messages are from "Demosthenes" and you agree with the opinions expressed, you will mentally note that Demosthenes is intelligent, and be willing to read further message. On the other hand, if you feel Locke is an idiot, you will skip messages, or set your advanced email filters to reject the messages. I thought about a possible real life example, and this came to mind: suppose David Sternlight, heartened by a legal PGP, decided he was going to blow off USENET and instead participate here, on cypherpunks. He knows that for many, merely seeing the email address "strnlght(a)netcom.com" will cause a variety of reactions :-). So he could form a pseudonym for himself and participate, allowing himself to start afresh. Following is the script. It is inefficient (the while loop that drives the thing needs massive reworking, pgp is called to get a signature from a document) but eventually these will be fixed (I'll rewrite the loop, a pgp library will be made available). Plus, as I said above, I'm not sure what happens with bad signatures or missing public keys. Also, to prevent some mailer from truncating this post, I'll move the formatting period over by a space - this will cause a "format not terminated" error if you try to run this script without moving the period back! Here's how I use it: scan cypher where cypher is an elm mail folder. I get back a report that looks like this: 1 collins(a)newton.apple.com blank lines v. the remailer 2* Karl L. Barrus <klbarrus@o REMAIL: cache 3 collins(a)newton.apple.com Re: anon.penet.fi 4 hfinney(a)shell.portal.com Restrictions on crypto exports 5 mccoy(a)ccwf.cc.utexas.edu money money money... 6 nobody(a)soda.berkeley.edu Re: your mail 7 ld231782(a)longs.lance.colos remailer ideas 8 ld231782(a)longs.lance.colos list split? 9 0005542837(a)mcimail.com PKZ and NON-RSA 10 derek(a)cs.wisc.edu Re: Why RSA? 11 hfinney(a)shell.portal.com Propriety of crypto on Munitions List 12 hfinney(a)shell.portal.com First amendment and ITARs 13 hfinney(a)shell.portal.com Mail outage 14 frissell(a)panix.com Propriety of crypto on Mu 15 frissell(a)panix.com Regulating the Nets The asterisk means message 2 is pgp signed by "Karl L. Barrus" - the rest of what pgp reports is truncated. - --------------------8< cut here >8-------------------- #!/usr/local/bin/perl #report email address and subject of messages in an elm folder #frm sometimes reports name and not email address - not that I # guarantee this works in all cases #if the message is pgp signed, report signature instead of address #simple version of mh scan command #Karl L. Barrus <klbarrus(a)owlnet.rice.edu> ($name,$passwd,$uid,$gid,$quota,$comment,$gcos,$dir,$shell)=getpwuid($<); chdir "$dir/Mail" || die "Can't cd to ~/Mail\n"; while (@ARGV) { $file = shift @ARGV; if (-T $file) { if (-z $file) { #zero length folders with no messages print "Folder $file has no messages\n"; } elsif (!open(FOLDER, "./$file")) { print STDERR "Can't open $file\n"; } else { $state = 1; #Look for a new message $num = 0; while (<FOLDER>) { #this whole loop need massive reworking!!! if ($state == 1) { #Delimits a new message $num++; $from = ""; $subject = ""; $sig = ""; $state = 2; #Look for From: and Subject: } if ($state == 2) { #Already found a message; looking for headers /^Subject: (.*)/ && ($subject = $1); #match subject /^From: (.+)/ && ($from = $1); #match "From: add" /^From: (.+) <(.+)>/ && ($from = $2); #match "From: name <add>" /^From: (.+) $(.+)$/ && ($from = $1); #match "From: add (name)" if ($from ne "" && $subject ne "") { #found both headers $state = 3; #look for possible pgp signed message } } if ($state == 3) { #Found a message, found headers, look for pgp if (/^-----BEGIN PGP SIGNED MESSAGE-----$/) { $sig = "*"; $temp = "./.tmp_" . $num . "_" . $$; $tempsig = "./.tmp_sig_" . $num . "_" . $$; open (OUT1, "> $temp"); $state = 4; #write out pgp signed message to a file } } if ($state == 4) { #writing pgp signed message to a file print OUT1 $_; if (/^-----END PGP SIGNATURE-----$/) { close (OUT1); system ("$dir/bin/pgp -f < ./$temp 1>/dev/null 2>$tempsig"); open (PGPOUT, $tempsig); while (<PGPOUT>) { /^Good signature from user "(.+)"\.$/ && ($from = $1); } close (PGPOUT); unlink $temp, $tempsig; } } if ($state >= 3 && /^From[^:]/) { $state = 1; #go back to looking for a new message write; } } } } elsif (-d $file) { print STDERR "$file is a directory\n"; } } exit; format STDOUT = @###@<@<<<<<<<<<<<<<<<<<<<<<<<<< @<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< $num, $sig, $from, $subject . - --------------------8< cut here >8-------------------- ^--- remember to move this back a space! -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLKH09IOA7OpLWtYzAQH7mwP/QsgQ9cbj8lPIu0o9eLzH38JFCP948DNO NnoUdoyk+gJtx6ohIyv6uWmX3sDh5ACDTd9SyT91XbyuHz/dWBCMYGY8S1hfvsJG JhK1Dr3p5PubS/neHro1cYR33Ex2QbZ/NNBgKPNpPF+lPg2RcO7WWpL8kFofD/Cs HCakIr/s0SE= =A69F -----END PGP SIGNATURE-----

1 0

NIST Explains Clipper "Revi
by David Sobel 17 Dec '03

17 Dec '03

NIST Explains Clipper "Review" The National Institute of Standards and Technology (NIST) has clarified the role of five experts selected by the agency to evaluate the government's Clipper Chip proposal and the underlying SKIPJACK cryptographic algorithm. In a recent letter to the CPSR Washington Office, NIST asserts that the panel was not established to provide "advice or recommendations" to the government. Rather, according to NIST, the reason for convening the group was "to provide the opportunity for independent experts to satisfy themselves as to the strength and effectiveness of the algorithm in order to encourage widespread acceptance of it in the marketplace." NIST concludes that the panel's evaluation therefore falls outside the scope of the Federal Advisory Committee Act, which opens the work of advisory panels to public scrutiny. In response to CPSR's request for documents relevant to the panel's review, the agency reveals that NIST has no records which were made available to or prepared for the five experts for the purpose of enabling them to evaluate the Clipper Chip proposal. Any such records would be in the possession of the National Security Agency, where all activities related to the work of the experts were conducted. This disclosure provides further confirmation that NSA, and not NIST, is the driving force behind the Clipper proposal, despite NIST's public role as the "proposing" agency. The only NIST document released to CPSR is a copy of the invitation sent to the five experts who participated in the evaluation. That letter describes the "key escrow" system and states that the escrowed keys will be made available "only to authorized government officials under proper legal authorizations, usually a court order." This language -- "usually a court order" -- suggests that there will be instances in which the escrow keys will be provided to government agents without presentation of a judicial warrant. The government has never clearly defined what will constitute "legal authorization" under the Clipper system. David L. Sobel CPSR Legal Counsel <dsobel(a)washofc.cpsr.org>

1 0

H. Finney: #1 Cyberspatial Lawyer
by L. Detweiler 17 Dec '03

17 Dec '03

I'm truly in awe. H. Finney gets my vote as Cypherpunk of the Week for uncovering all this dazzlingly appropos information. [U.S. vs. Posey decision] >Technical data that is relatively harmless and even socially val- > uable when available domestically may, when sent abroad, pose unique > threats to national security. gad -- they simply don't understand that cyberspace has no boundaries, subject to the same delusions of the NSA. Maybe they should read that extraordinary quote by Mr. President uncovered by Markoff. >In any case, this decision and the earlier one it quotes both represent >rejections by the 9th circuit appellate court (which includes California, >where the grand jury investigations are taking place) of the argument >that the ITARs infringe on First Amendment rights. This will make it more >difficult to use the First Amendment defense in any new charges of arms >export violations. either that, or we're TAKING THIS TO THE SUPREME COURT! hee, hee. for the mentally challenged, that's *satire*, folks, don't get excited.

1 0

Propriety of crypto on Mu
by Duncan Frissell 17 Dec '03

17 Dec '03

H>So Congress and the court agree that the propriety of an item's H>placement on the Munitions List is not a matter for the courts to H>decide. There appears to be little chance that any prosecution for AECA H>violations will result in the judical removal of cryptographic equipment H>from the Munitions List. However, cryptographic software being writings not equipment could be protected. Thanks for your postings Hal but I note that the Supremes haven't spoken yet. Even though it is tough to get a grant of cert, if we were able to a different result might occur. Note that in a number of "regulatory" first amendment cases, the appeals courts decided in favor of the government while the Supremes voted unanimously in favor of freedom of communication. Sometimes you have to make it up the ladder. Two examples (sans names because I'm doing this from memory): The Newsletter Case of 1985. SEC tried for years to get investment newsletters to register as security advisors. They picked a good test case. Man was barred from security industry for perfidity kept running newsletters, SEC sued to force registration (which would have been rejected), SEC lost at trial, C of A went for the government, Supremes voted 8-0 for the defendent. Minnesota or Wisconsin case -- man speaks at public hearing held by school board, State Labor Commissioner sues him for "unfair labor practice", he is a teacher and they accused him of 'negotiating with his employer outside of the collective bargaining process,' he loses at every level until he wins unanimously at State Supreme Court Level. It ain't over 'till it's over. Why don't UK companies produce PGP software for sale in the US? They couldn't be reached as easily. Duncan Frissell A little war poetry for our current war: (brought to you as a public service by Frissell & Associates, Privacy Consultants) "FOR ALL WE HAVE AND ARE" 1914 by You Know Who FOR all we have and are, For all our children's fate, Stand up and take the war. The Hun is at the gate! Our world has passed away, In wantonness o'erthrown. There is nothing left to-day But steel and fire and stone! Though all we knew depart, The old Commandments stand:-- "In courage keep your heart, In strength lift up your hand." (cont in next msg) --- WinQwk 2.0b#0

2 1

CPSR NIST info
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

David Sobel <dsobel(a)washofc.cpsr.org> >This disclosure provides further confirmation that NSA, and not >NIST, is the driving force behind the Clipper proposal, despite >NIST's public role as the "proposing" agency. SURPRISE! ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

DC nets for network access?
by Timothy Newsham 17 Dec '03

17 Dec '03

DC Nets allow a single person to talk in a group of people without giving away the identity of the talker. Telnet servers are programs that are easily set up from a user account that allow a you to connect in to and then back out of a machine with little or no logging. Would it be possible/practical to marry these two concepts? Make a network of clients who wish to have anonymous access at some point or another and ahve them transmit information by using a DC-NET protocol and then having a listener which is a telnet server and allows connections to the outside world. The biggest problem I see is 'sessioning', keeping data originating from one user seperate from data originating from another user without giving away the users identity. If data is allowed to mix then there will be a resulting security problem of course. Any comments?

1 0