December 2003 - cypherpunks-legacy

Clipper update
by a2＠ah.com 17 Dec '03

17 Dec '03

From: _Electronic Engeering Times_ 22-nov-93 U.S. weights Clipper chip alternatives by GEorge Leopold Washington -- The clinton administration is readying a new encryption policy that could help defuse industry opposion to introduction of the government developed Clipper chip by embracing commercial technologies as alterntives for netword security, according to government and industry sources. A National Security Council panel lead by George Tenet, psecial presidential assistant for intelligence programs, is completing a broad review of government encryption policy with an eye toward empolying the Clipper chip, as well as commercial alternatives, to ensure privacy and security on public networks. Those would include the proposed electronic superhighway, or National Information Infrastructure (NII). Tenet could not be reached for comment on the review's status, but a U.S. official said last week the results of the seven-month National Security Council policy review will be announced soon. The Clipper chip, backed by the National Security Agency and proposed by the Clinton administration in April as a new data-encryption standard, is widely viewed by industry critics as a fait accompli, since the spy agency wants to use it to protect intelligence data. Asked in an interview last Monday whether the policy review would result in modification of the Clipper chip proposal, Micheal Nelson, special assistant for information technology in the White House Office of Science and Technology Policy, acknowledged the need to consider other encryption technologies for network security, including software solutions. He also said the government should have sought greater industry participation before proposing the Clipper chip. "Clipper is not a sliver bullet, it's not even a brass bullet," Nelson said, "It's only one approach." He added, "If we don't address these [network security] issues, people won't use the NII." Nelson said last week the National Security Council review was designed to bring industry and Congress into the process of looking for commercial solutions, besides Clipper, to the network-security issue. Industry groups said last week they have contributed to the review, which began shortly after Clipper was proposed. The review is expected to result in a decision on how to implement Clipper. A decision on how to proceed with the Clipper proposal was scheduled for Sept. 1 but was delay in response to a recommendation from a private-sector advisory group to the Commerce Department. Clipper, which scrambles telephone conversatinos using an encryption algorithm called Skipjack, is at the heart of an adminstration initiative annoumced in April on secure telecom networks and wireless communication links. Forced to balance the interests of campanies and private citizens with nation-security needs, President Clinton ordered a comprehensive review of U.S. encruytion policy addressing: * Privacy, including the need for voice and data encryption to protect proprietary business data. * The ability of federal law-enforcement officials to tap phones and computers. * The employment of modern technology to build the NII, including encryption technology needed to protect proprietary information transmitted over the information superhighway. * The need for American companies to build and export high-technology products to boost U.S. competitiveness. U.S. companies may offer encryption as a feature in software sold in the United States, but are prohibited from including encryption software in commercial software exports. Proponents of decontrolling encrypted software argue that restrictions are useless because encryption technology is widely available (see Oct. 18, page 18). Acknowledging industry's concerns, the initiative also includes creation of a key-escrow system to ensure the Cliper chip would be used to protect privacy. (A Commerce Department official said last week the government has dropped the Clipper moniker, referring to it instead as the "key- escrow chip," out of convern for possible trademark infringement.) Devices incorporation the chip would have two unique software keys government investigators would need to decode encoded messages. TWo key-escrow data banks would be overseen by a pair of independent agencies designated by the Justice Department and the White House. A decision on which agencies will oversee the detabases has not been made, Commerce spokeswoman Anne Enright Shepherd said last Wednesday. According ot a White House statement announcing the encryption policy, "We need the Clipper chip and other approaches that can both provide law-abiding citizens with access to the encryption they need and prevent criminals from using it to hide their illegal activities." Despite the administration's insistence that Clipper and the rest of the encryption policy are voluntary efforts, many U.S. high-tech companies have opposed it (see June 21, page 28). Instead, they want policy makers to retain the ubiquitous federal Data Encryption Standard (DES) and use other public-key encryption technologies, such as RC-2 and RC-4. DES uses a 56-bit key while Clipper employs an 80-bit key. Clipper "was forced upon [the Clinton adminstration] before they had a chance to evaluate its impact," Bruce Heiman, a Washington attorney representing the Business Software Alliance, said last Tuesday. "NSA sold them a bill of goods." The policy review means "they realize that Clipper has problems... but they don't want to rule it out entirely," Heiman said, adding that industry would accpet Clipper as one alternative to network security only if it is part of a truly voluntary program that includes public-key encryption.

1 0

Another Demon
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

Who is zeek(a)io.com? <g> ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

Secure Wipe
by kkirksey＠world.std.com 17 Dec '03

17 Dec '03

Hola all, I've just started working on a good Mac implementation of IDEA, but I need a little more info on something. I've got more info on IDEA than I know what to do with, but I've yet to find any good references on doing a secure wipe to remove the plaintext file from the hard disk. Can anyone point me to some good refs on the topic? Many thanks... Ken

2 1

Re: Comments on NSA (was: "Pyrrhus Cracks RSA?")
by an52436＠anon.penet.fi 17 Dec '03

17 Dec '03

Well, doesn't it make some sense given the utility of prime numbers in cryptography, that the NSA, or anyone else interested in breaking codes for that matter, would have simply dedicated a computer or two to the long-term project of determining all of the prime numbers under x bits long? Granted this would take a while, but the NSA has the time, the computers, and the other resources necessary to do this. Having all of these prime numbers would greatly reduce the effort necessary to crack PGP/RSA-type cryptosystems which rely on prime numbers. It would reduce the number of factors a brute-force attack would have to check dramatically. Or am I completely off-base? Mephisto ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

3 2

900 MHz Cordless question
by analyst＠netcom.com 17 Dec '03

17 Dec '03

Catching up on my reading the other day, I noticed an article in the Economist about Cincinnati Microwave's 900 Mhz cordless phone. It seems that Cylink makes the actual chip that is used in the phone to do the spread-spectrum communications. My questions to the readers of this list are: 1: Given that Cylink was one of the two original companies to manufacture Clipper hardware, what does this say about the protocols that are used in this spread-spectrum chip? Was it designed to be easy for law enforcement to crack? 2: Of the digital 900 Mhz telephones available, are any of the phones better from a security standpoint than any of the others? Are they all using different protocols or the same? Enquiring minds want to know! Thanks. --------------------------------------------------------------------------- -- Benjamin McLemore analyst(a)netcom.com 214/522.7640 fax

3 2

The other side of LD
by bart＠netcom.com 17 Dec '03

17 Dec '03

I never thought I be caught dead forward an LD post, but here it is since I may be the only 'punk on the NEW-LIST announcements. Here we see the other side. I am beginning to get a funny feeling about all this. Consider: 1. The book published for profit by editing the submissions to rec.humor.funny. 2. The recent "compilation copyright" filed by Keith Peterson on the material contained in the Simtel archive. 3. The default apparent public domain into which all our postings seem to fall. Is LD, the prolific author that he obviously is, merely baiting the creative minds of the cypherpunks to gather material for his forthcoming novel(s)? Bart /////////////////////////////////////////////////////////////// Forwarded message: > From @VM1.NODAK.EDU:owner-new-list@VM1.NODAK.EDU Fri Nov 26 11:02:02 1993 > Message-Id: <199311261901.LAA15086(a)mail.netcom.com> > Date: Fri, 26 Nov 1993 12:47:04 CST > Reply-To: ld231782(a)longs.lance.colostate.edu, julf(a)eunet.fi > Sender: NEW-LIST - New List Announcements <NEW-LIST(a)VM1.NoDak.EDU> > From: "L. Detweiler" <ld231782(a)longs.lance.colostate.edu> > Subject: NEW: Cypherwonks > To: Multiple recipients of list NEW-LIST <NEW-LIST(a)VM1.NoDak.EDU> > > cypherwonks(a)lists.eunet.fi > > The brand new cypherwonks list on Majordomo(a)Lists.EUnet.fi is for > ambitious, energetic, can-do, hands-on individuals interested in > general cutting-edge `cyberspatial development' projects such as in > cryptography, digital cash, and `electronic democracy'. (A `wonk' is > slang for a `meticulous detail person'.) The list is both an informal > gathering place for the technically adept and also a focal point for > branching off into serious project coordination. We place a premium > on membership by technical professionals and try to hone our posts to > accommodate the busy (who, according to the adage, are those who get > all the serious work done). We are inspired by the Internet but > don't see it as ideal yet and are particularly interested in > cooperation, building prototypes, forging standards, and `long-term > incremental evolution' in our designs and goals. We're also > intensely interested in following and influencing the technological > and political developments of the emerging `national cyberspatial > infrastructure.' > > The list is *not* for political diatribes in the `radical > libertarian' agenda, e.g. rants against all forms of government as > oppressive, corrupt, or evil, or promoting the use of cryptographic > technologies for subversive activities like tax evasion, black > marketeering, or evading law enforcement. The list is *not* for > discussions of how to manipulate the honest through the use of > software technologies. The list is *not* for unconstructive > negativism against other's proposals. Above all, we are interested > in forging a `civilized cyberspace' out of the current `Internet > wilderness'. > > Historical note: the list was formed as a less ornery, more moderate > splinter group from the Cypherpunks by J.Helsingius (creator of the > popular anon.penet.fi anonymizing service) and L.Detweiler (author of > many FAQs including `Privacy & Anonymity on the Internet). > > To subscribe, send a message with the body > subscribe cypherwonks > to Majordomo(a)Lists.EUnet.fi. > > A more comprehensive charter is available with the command `info > cypherwonks' in the message body. > > To post, send a message to cypherwonks(a)lists.eunet.fi. > --

1 0

response to Detweiler/Boxx/ad nauseum
by szabo＠netcom.com 17 Dec '03

17 Dec '03

I'm really at a loss how to respond to this lunatic. I hope the following doesn't just stoke his boilers more, but on a worldwide public forum I don't think I can let something like that go unanswered. Anybody out there with good advice (legal, tactical, or otherwise), I'd greatly appreciate it. Here's what I wrote: Newsgroups: talk.politics.crypto,alt.privacy,alt.privacy.anon-server, news.admin.policy,comp.org.eff.talk,comp.admin.policy,alt.conspiracy Subject: Re: CRYPTOANARCHIST INFILTRATION ALERT References: <071303Z27111993(a)anon.penet.fi> an12070(a)anon.penet.fi (The Executioner) writes: >ATTENTION ALL INTERNET PERSONNEL >THE INTERNET OUTLET >szabo(a)netcom.com >HAS BEEN IDENTIFIED AS A CRYPTOANARCHIST CYBERSPACE INFILTRATION SITE >TO A 93.67% DEGREE CERTAINTY VIA PSEUDOSPOOFING DETECTION SOFTWARE. >.... Why Mr. Detweiler, that's mighty flattering of you! I'd be even more flattered by Detweiler's singling me out, if he wasn't also making death threats and accusations of criminal violations against several people who have recently disagreed with him, trying to track down our physical locations, and otherwise doing his best to scare the shit out of net users with his digital stalking. No, Mr. Detweiler, I'm not "pseudospoofing", but with nutcases like you on the net I sure as hell wish I was. Nick Szabo szabo(a)netcom.com

1 0

Ways to Die
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

Many psychopunks, particularly T.C.May, E.Hughes, and D.Barnes, have been upset by my latest name variation, `The Executioner', supposing in their sweaty desperation at exposure for their crimes that it represents some kind of insinuated threat. Nothing could be further from the truth. The obvious meaning of `execute' in this context is `to carry out a plan', as in `execute a program,' as in `elicit the truth'. The connotation is completely harmless. I have no idea why anyone could construe it negatively, unless, as the saying goes, they have something to hide! Sorry, but I can't be responsible for tormented psyches and consciences in the face of Truth! I don't understand why these master pseudospoofers should be upset by a trivial name change. In fact, in the face of their own plethora of faces, it seems quite hypocritical! It would be like taking the words, `I'm going to come kill your family with a rusty razor blade' seriously. This idea of `execution' reminds me of historical cases of execution. There are very many variations. One of the best and my favorite is that by a lynch mob, led by a corrupt leader. The lucky criminals get hung, with their faces bulging around, and legs dangling below, a constricting, unremitting noose, sort of like a poisonous snake around the neck. `Brave New World' ends with a delightfully novel description of a hanging: NE, N, NE, N, NW, W, SW, ... (paraphrase!) I imagine that hanging is not a very bad way to die, of all the ways invented and experienced by man. Traitors were often hung by the noose in the Civil War, as I understand it, when our country turned in on itself in disunity. Who was it who was executed with the words, `I regret I have but one life to give to my country'? The infamous spy Benedict Arnold (who put on one face to the British, and another to the Americans, quite the ingenious pseudospoofer!) was hung, I understand. Other cases of execution, of course, are more grisly. We have the Inquisition to thank for some of the more hideous variations. I don't know if Poe's Pit and the Pendulum was ever really in use, but what a fantastic way to die! The shining, razor sharp blade gently swaying to and fro, hypnotically mesmerizing, swish, swosh, subtly, imperceptibly lower, approaching like a whisper in one's ear by Death. The victim in the tale faced anonymous black judges in a dark courtroom, as they handed down the sentence, described like a druglike stuporous hallucination. As I recall the protagonist in Poe's tale had his stomache glanced by the blade, dark red blood slowly oozing forth, but he was ingenious and saved himself by turning the vicious rats in the dungeon into a useful tool! Ah, what fantastic literary irony. The Pit and the Pendulum is a sort of mental and psychic torture. I wonder how many days the blade was descending over? The end could certainly not be as painful as compared with other physical torture devices, like the rack, used to elicit confessions. Who can forget that wacky human enclosure with spikes on the door? What amazing creativity. I've always been fascinated by the Guillotine in use during the French revolution. The doctor Guillotine was very humane and was tormented by the visions of humans who had a few moments of discomfort and displeasure ensuing after failing to perfectly align their necks with the executioner's blade. Of course, one swift and single CHOP! was ideal, but sometimes the executioner was drunk, or maybe his mask was in the way, and it took more than one CHOP! CHOP! CHOP! over a period of a few seconds to dispatch the soul on its merry journey. Guillotine invented his ingenious device, and executions were very rapidly improved in reliability and accuracy. This was very useful because all kinds of terrorists, counterrevolutionaries, and criminals had hidden themselves in the guise of the Victorious Revolution, and the public turned on itself after all the discredited leaders had been accounted for (in--what else?--a `head count'). The Guillotine was really unsurpassed in its efficiency at the time, a real technological marvel. I'm sure there were many people at the time who were quite impressed by it, and said that it was a fine piece of machinery, and that even though it could be put to evil uses, `Guillotines don't kill people, people kill people' and therefore no one should have any qualms about its existence and continued use, or safeguards and restrictions and regulations governing the authority of its operation by naive and unskilled unprofessionals, or even criminals, themselves ready amateur Executioners. One said, `yes, surprising as it sounds, I'm coming out in favor of the Guillotine.' The people got what they wanted. They weren't about to let some sinister, evil, oppressive government stand in their way of exercising their true glorious birthright freedoms, like killing each other. One of the things that really fascinates me is the possibility of cyberspatial-oriented murder. It seems to me that in a CryptoAnarchic society where there is no government or social order, things like hired assassins will be more readily hired, and certainly more abundant. What do you do when you are robbed or harassed? Call the police? Ha, ha, there are none of those annoying, meddlesome, timeconsuming and troublesome Social Justice Farces in our Private Utopia. Imagine the delight of hiring hitmen with completely untraceable cash, and communicating with them with Chaum style DC nets to describe the victim and pinpoint one's enemies for execution. That reminds me of the Focaultian idea that punishment and torture is related to the human body. The theory is, if you don't have a physical body, you can't experience pain. Some pseudospoofers in the psychopunk cult have suggested that they are unaccountable in this fashion -- pseudospoofing allows them to achieve a sort of godlike omnipresence and transcendance through their myriads of ephemeral identities. Actually, this philosophy appears to originate with one of the leaders and is a central tenet of their idolatry. The `fluidity of identity' exists in Cyberspace, to some extent, but all the pseudospoofers I know still have a real-world body that bleeds like any other, and all their tricky circumventions of its existence are no match for superior technology. That's The Truth! ``Any sufficiently evil machination is indistinguishable from murder.'' --S.Boxx ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Public Enemy #1
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

I don't know where all these slanderous accusations that I am L.Detweiler come from. I want to have absolutely nothing to do with that paranoid conspiracy theorist. People who are associating me with him are nothing but scurrilous hypocrites. You only allow anonymity so long as it doesn't threaten you personally! PseudoAnonymity that attacks the government through tax evasion and black marketeering is OK, but pseudoanonymity of L.Detweiler (who is really Hitler's grandson), who attacks the Cypherpunks, is Heretic Blasphemy, and he must be tracked down and punished! Why is it that no one bothers T.C.May about BlackNet or Deadbeat, anyway? I guess stealing information is a legitimate use of anonymity, but exposing corruption through whistleblowing is not. All of you who are so smugly certain that I am L.Detweiler, where do you get your insane fantasies? The only thing I can think of that would be objective and qualitative is the extensive style analysis software of E.Hughes, but it seems to me that would also show that he is posting pseudoanonymously under G.Broiles, and besides he's not really interested in sharing any of his software with anyone anyway, especially whatever helps him pseudospoof and detect it by others. However, I have many ideas on how to get even with L.Detweiler for his callous disregard for pseudospoofing. Imagine, the sheer arrogance of attacking our holy religion, and making our leaders look like pathetic fools for their deceptions! We are left trying to defend them with increasingly worthless tentacles. Y'know the ones that penetrated RISKS? They are *really* valuable, like N.Szabo, and he is on to them all. The man is an arrogant bastard for trying to prevent us from our joyous deceptions, perversions, and depravities. We have to make him pay. What can we do? One thing to do would be to slander him in public forums. I mean, he has done the tiniest smidgeon of CryptoAnarchic work, like that Anonymity FAQ (which was usefully infiltrated by quite a few of our pseudospoofed tentacles, including the eminent N.Szabo). But otherwise, he's just a self-important asshole like G.Spafford who has no life out of cyberspace. We should show no mercy. I propose that we mailbomb him some more beyond P.Metzger's feeble assault. And D.Barnes has not gone nearly far enough to root out his personal associates and friends and find any useful blackmail or other leverage, like his employer. E.Hughes and T.C.May can try harassing his postmaster some more. Maybe we can get the Holy Grail -- get him to lose his Internet account. Damn, that would be AWESOME. We wouldn't have to put up with any more of those slimy verbose FAQs. `Privacy and Anonymity' HAH. more like Pathetic Assholery. Here's an idea. I've been tampering with REMOBZ a lot lately and have gotten pretty good at it. I hear L.Detweiler was looking for a job awhile ago. (I stole his resume with a fake job advertisement in his mailbox as bait. Hee, hee! what a dickhead.) I am going to try to tap his home phone line and figure out what employers he has been talking to. I can rig it so that when they call his number, I spoof his answering machine (this is possible by recording his own message onto my own answering machine and redirecting the phone call). The employer records his message, `you have the job, report to work at 9:00 tomorrow' like nothing is wrong. But L.Detweiler never shows up! Hee,hee. And if he tries to find out what went wrong, he looks like a hallucinating drug user. `I never got your message on my answering machine!' Ah, a grand psychopunk prank in line with the best of the legendary K.Mitnik revenge techniques. (The master!) Here's another idea. We all know how much WetLiar admires that clueless NYT reporter Markoff -- you know the guy, the one who fell for our Big Movement facade hook line and sinker. (Hee, hee! Privacy for the Masses! The Cryptographic Revolution!) I propose that we infiltrate his system and impersonate Markoff's email to L.Detweiler. Unless it is for deception, it's not illegal! No problemo! L.Detweiler will go away crestfallen that his hero comes across as a clueless idiot in email. If he calls Markoff in desperation, we can do the old `redirect the phone call' trick and do our best Markoff imitation on the phone. Detweiler is such a clueless, trusting idiot that he won't know the difference. Hee, hee! I love poking holes in other people's delusions. The world is an ugly place, and it's about time that someone did a favor to L.Detweiler and taught him that. The asshole will learn what it means to tangle with Cypherpunks. OK, here's my best idea. You know his cutesy little mama's girl girlfriend, Sonia Applegate? The one that loves to cook him those big dinners when he gets home from a hard day of battling our beauteous tenacles? The one that he is going to marry next spring? (Thanks, BlackNet spies, for all your information, the checks are in the mail, also the REMOBZ wiretapping is also a really invaluable source.) I propose that we call her up and pose as a clinician from an AIDS testing clinic and tell her that L.Detweiler has AIDS and that he listed her as a sex partner. Regurgitate her all her personal information we found off the stolen credit records and then say, Yes, Ma'am, I'm sorry. You'll have to report to the clinic immediately for testing. Hee, hee! ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Secret sharing program available
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

[Note: I'm not subscribed so if you reply, remember to Cc: me] A few hours ago I was bored so I started experimenting with Shamir "threshold" sharing in G++. The result: Cryptosplit. It's a hacked up but working implementation of polynomial interpolation over an integer field of prime order. Basically, you can take an arbitrary integer, D, generate m keys, k of which are required to reconstruct the original integer. Its inner workings are very simple. Pick a random polynomial P(x) of degree (k-1) over Z_p with constant term D, and generate m 2-tuples (x, P(x)). These "keys" are output in the form x*p+y which can be reversed by the division algorithm. The interpolation process generates a k X k matrix of linear equations by plugging (x,y) into y=a_n*x_n + ... + a_1*x + 1*D and then solving by Gaussian elimination (upper triangular matrix. element k,k is the constant term D) Right now it's not very usable since you have to choose your own prime modulus > D (I was too lazy to write a prime generation routine. I just choose Mersenne primes of sufficient size) and because it only accepts base-ten input from the command line. It needs to be optimized a lot too. If anyone wants the source (especially if they want to fix it up), let me know. -Ray -- Ray Cromwell | Engineering is the implementation of science; -- -- rjc(a)gnu.ai.mit.edu | politics is the implementation of faith. --

1 0