December 2003 - cypherpunks-legacy

Check out "EFFector Online 6.1"
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

The latest "EFFector Online," available in the usual places, is oriented toward crypto, having a lengthy summary of the Skipjack/Capstone issue (more legalese about escrow than crypto) and a nice Barlow piece on crypto (updating his piece a year ago in CACM). Barlow even mentions "unless you're a real cypherpunk," so we're entering the language. I'd post the whole thing here, except that it's 1100+ lines. Definitely check it out! -Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

1 0

Crypto crackdown - this is it!
by remailer＠netcom.com 17 Dec '03

17 Dec '03

Well, we knew that this had to happen eventually. Isn't it ironic that, as we read that crypto is flourishing in the Soviet Union, that their supreme court has just accepted the validity of digital signatures, we find ourselves under attack here at home! Seems like we're putting up walls just as fast as they are tearing them down over there. I just sent e-mail to those crypto developers in the Soviet Union; maybe I'll get a visit from the Thought Police. After all, I did mention RSA, IDEA, and PGP in the message, and there's not much doubt the bad guys monitor the link to the Soviet Union, now is there? In fact, everyone who has a public key on the key servers could be a suspect. This crackdown can serve no legitimate security purpose, since the algorithms involved are all readily available worldwide. This can only serve two purposes: (1) to intimidate any company which might consider publishing useful cryptographic software and information, and (2) to establish a precedent and set up the machinery for a drug-war-style crackdown on all privacy and digital speech. Why is the government so reluctant to treat digital media as equivalent to paper media? Real simple. Paper requires an organization to distribute it. If the government really wants to, they can conduct a Gestapo raid and confiscate everything (Steve Jackson Games) and prevent the publication of anything on paper. With electronic media, they can't do anything. Once it's on a disk or on the Usenet, information is forever beyond their control. The government is about to lose all control over information, and the idea scares the hell out of them. What is happening is that the network is replacing the hierarchy as the basic unit of human organization. Naturally, those who run the hierarchies don't want this to happen. The bad guys have been trying to figure out what to do since PGP was released. Being leftover cold warriors, they really don't know how to attack freeware distribution. The idea of free distribution of information is totally alien to them. But as soon as commercial sales were mentioned, they knew what to do. Yes, we should fight them tooth and nail on this one, but we should also learn a valuable lesson from it: they can't handle freeware! It's only when we go commercial, with a visible base of operations, that they know how to attack us. We need a method of zero-knowledge collaboration on software development. People could work together on a project without knowing anything about each other. This would involve a newsgroup for discussion of projects, anonymously of course, and the exchange of pseudonymous PGP keys. Private mail would be sent by posting with the recipient's key id in the subject, making it easy to grep for. Development could be broken up among different people, functions and code fragments could be posted and exchanged, and the whole program compiled and released, in such a way as to be totally untraceable. Code we need now! Windows NT, OS/2, and UNIX implementations of PGP, set up as a server so that any application can access PGP primitives. This would establish PGP as a standard encryption server outside the US. People use what is easy, so make it easy. A program to transparently encrypt hard drives on the fly, similar to KOH or Norton Diskreet (except don't use DES, and allow only part of the drive to be encrypted, like Diskreet), to protect people against unreasonable search and seizure. Let's face it, with the drug war, the Constitution's search and seizure protections are DEAD! They may not be able to prosecute you based on illegal evidence, but they can take everything you own and keep it until you are broke and homeless. A tape backup program which securely (IDEA or similar) encrypts streaming tapes. This would protect people from seizure of their records and archives. Government loves to seize paper; give the bastards something they can't read! The next few weeks and months may be decisive. This is it. If we succeed, we could have a future of freedom, privacy and equality brought about by the inherently democratic nature of networks in general and public key crypto in particular. A world in which digital cash has starved the dinosaurs of government and digital media have made censorship forever impossible. But, if we fail: "There was of course no way of knowing whether you were being watched at any given moment. How often, or on what system, the Thought Police plugged in on any individual wire was guesswork. It was even conceivable that they watched everybody all the time. But at any rate they could plug in your wire whenever they wanted to. You had to live - did live, from habit that became instinct - in the assumption that every sound you made was overheard, and, except in darkness, every movement scrutinized." -- 1984 BTW: when setting up encrypted remailer bounces, be sure to change the subject at every bounce to defeat traffic analysis based on the subject line being the same all the way through. For example: :: Request-Remailing-To: <put address here> Subject: <put new subject here> Be careful, write code, spread PGP, we might actually win this thing!

1 0

Clipper production problems
by L. Detweiler 17 Dec '03

17 Dec '03

This is a vague hint that Clipper development is not going quite as planned -- delayed at least 2 quarters (half year!). I sure wonder what is going on in the trenches. All you Mycotronx employees out there, feel free to post anonymously :) ===cut=here=== From: koontzd(a)nebula.lrcs.loral.com (David Koontz ) Newsgroups: alt.privacy.clipper,talk.politics.crypto Subject: MYK-78 Clipper Chip Availability Date: 16 Sep 93 18:53:13 GMT Organization: Loral Rolm Computer Systems I just got off the phone with someone at AT&T Surety Communications, the date given for availability of clipper chips for inclusion in products is 1st quarter '94 (January). The previous date was 3rd quarter '93 (September), which was obviously missed. The date originated with a U.S. government agency. Will the date get further out still? [I got confirmation Mykotronx is unhappy about the delay] { I know some people who might be happy .. djf} For those not willing to wait, you can purchase Telephone Security Devices now, and for an extra $100 you can get a free upgrade to the Escrow Encryption Standard latter. Any more delays and I might not bet on it. The existing nongovernment TSDs used a Type IV proprietary encryption algorithm and NOT DES. (I'll wait for January before ordering a pair) ------- End of Forwarded Message

1 0

SEA Internet party, NY
by L. Detweiler 17 Dec '03

17 Dec '03

Society for Electronic Access. ===cut=here=== Date: Fri, 17 Sep 1993 16:46:17 -0400 (EDT) From: steven cherry <stc(a)panix.com> Subject: Electronic flyer for Sept 27th Intro to Internet event What follows is the flyer for the upcoming Intro to Internet event on Sept 27th. Please feel free to post this far and wide (or at least wide). A physical flyer will also be available this weekend. If you have already volunteered to post these and I have not contacted you by Sunday, or if you have not volunteered yet but would like to, contact me. - -- stc(a)panix.com Steven Cherry - -cut here- ####### ###### ####### ####### ### # # ####### ###### ####### # # # # # # ## # # # # # # # # # # # # # # # # # # # # ##### ###### ##### ##### # # # # # ###### # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # ####### ####### ### # # # # # ####### ##### ###### ### # # ##### ###### ###### # # ###### ##### # # # # ## # # # # # ## # # # # # # # # # # # # # # # # # # # # # # # # # # # #### ###### # # # #### # # # # # # # # # # # # # # # # # # # # # # ## # # # # # ## # # # ###### ### # # # ###### # # # # ###### # Date: Monday, September 27, 1993 Time: 6:30 PM Place: Chambers St. (bet. Centre St. and Broadway) in Manhattan The Society for Electronic Access (SEA), a New York metro area group focusing on electronic civil liberties and access issues will be holding an "Introduction the Internet" event. Topics that will be covered: + What is the Internet? + Electronic mail + Usenet Newsgroups + Using the Internet for research + Interactive real-time communications (IRC, talk, MUDs) using the Internet + What do you need to get connected? Our speakers will include Clay Irving, who is a Unix systems analyst and captain of the winning Team.Panix Internet Hunt crew; Karen Schneider, a public librarian and Internet trainer; Shabbir Safdar, an expert at computer games and interactive services; and Joe King, a publisher and the producer of the award-winning Personal Computer Show. In addition, several Internet-access providers in the 212/718 area will be present to tell you about their systems including rates, features, and how you can sign up. Refreshments will be served. RSVP..........RSVP...........RSVP..........RSVP..........RSVP The event is free, but *reservations are required* to attend. To make a reservation to attend, or for more information: leave voice-mail at (212) 592-3801 or send E-mail to gab(a)sea.org. For additional information about the SEA (including the time and place of the next SEA meeting), call via modem (212) 787-3100 and enter "sea-info" at the "login: " prompt, or send E-mail to "sea-info(a)sea.org" (you will receive an automatic reply); or you may leave voice mail request at (212) 592-3801. ------- End of Forwarded Message

1 0

Escrow what ain't
by XXCLARK＠indst.indstate.edu 17 Dec '03

17 Dec '03

Extract from EFFector Online Volume 6 No. 1 "... The briefers admitted that the proposed system is not really an escrow. The agencies holding the key components will not have any duties or responsibilities to the Clipper users. The escrows' obligation will be to the government, and they will be liable to Clipper users only under the Bivens doctrine, where any failure must be shown to be wilful. ..." If it isn't really an "escrow", why do we continue to use the term? If keys are, in effect, surrendered before the fact, why not call it the "key surrender system" when we write or speak about this miasma? Or any other term more nearly accurate than what it is not... Haven't seen a single post promoting tax evasion all day. How curious. --------------------------------------------------------------------- internet : xxclark(a)indst.indstate.edu Vanilla BITNET: XXCLARK@INDST We're all Bozos on this bus... ---------------------------------------------------------------------

1 0

Crypto crackdown - this is it!
by Timothy Newsham 17 Dec '03

17 Dec '03

Anon Said: > Code we need now! > > Windows NT, OS/2, and UNIX implementations of PGP, set up as a > server so that any application can access PGP primitives. This > would establish PGP as a standard encryption server outside the US. > People use what is easy, so make it easy. I would love to see this happen. The programs I have written (Circ and link) are currently using an implementation of RSA I grabbed off of the ghost site in italy. It is slow and the interface is poor. I would love to have a library of routines that will use PGP key files, use PGP random number generation etc. It would also be nice if this library allowed access to the math primatives as well, for implementing other schemes not in the library like DH (which maybe should be part of the library). Alls that needs be done is to rip out all the crypto routines, the random number routines and the key management routines and placing them in seperate modules. PGP could be rewritten with this new structure which would probably make it alot easier to manage and find bugs in (due to modularity). This would also ease recofinguring PGP to do other encryptions (like triple DES). The PGP command interface would just be a front end, and graphical front ends could access internals directly instead of hacking around the normal PGP front end. Is this something we could see happen? What do PGP people have to say about it? ...

1 0

To: an5877@anon.penet.fi
by J. Michael Diehl 17 Dec '03

17 Dec '03

Sorry folks. This person anonymously sent me a message to which he expects a reply. But it is impossible for me to reply to this person anonymously since he would be able to place my anonymous Id with my real Id. I know I should learn how to "bounce" anonymous messages, but there seems to be a lack of standardization in this area which I don't want to deal with at the moment. Sorry for the bandwidth. -----BEGIN PGP MESSAGE----- Version: 2.2 hDwC8VlOkFb8HfkBAYCgq9GJ1tSQXsX5Pm5pGrvFfjJPaIRlsYcLdotqAUuSx6jj Rgl3GZfgp8WRRigwd6qmAAAEmyQ6+Ci6MqT5oSmmXNUJ3rR/cguMWRHDt1TOJlae ck6ezF0MZZlQCWp4Lvh7IhWNZckT9pQ4VWHsWqp5jgeWzYaRbspVfEWnZXVvEAvT 9qZVgNJn7ZGlrmXjkpLTMj+/bk516lLAuVCpGj1TaiIRPTt7YEKgJIYY5FjNdvc5 kLkab5GJcRaNOLG8VjVlSyxRg+sbce1eUEgNaIJtg0VvR2dy9BlPyh3xbBgko3C5 3DZ9TIpM3dtHUueOCm16BRITEkzBvHOYgL+xcj4RVcWrkkxI/hiEi12u1SthDQHK CVmvYcsnt5XGgp27dTPprS1i6COPIHtufH7l9/GIbBrOfn4+whegAl0TT72dL2An on62k+RMP2uPFkbAMNPGtMuWZW0ibpoqx/Wz5njsV8ubPVXDXayiXl0WSGBst/DV dQ56iqmV2tUI5ZDe09ARpnkj61mdnjvlBvFYaoRo6SCI2iLg7m6VsUm6XzNYBzG0 KNvpsd0SLFqz98wrSYIK9RqFrvgNKklsliGwciDwg7AJBYIUxxqrmSvRLtZ7eucm 5+Qc5uMPbPp6UohewDp20zwLz6Jjxff7APZOONKn58xKj+bpbKJb2giuohcI+ZzU EJMGis+dZQtcUPHonf6GQ65ly3HDDcDu5nAz9qZOkLASEZ0zRJjgOXprC6bwyiYF p1tXZCIAJPlEeT6uAejMEhBGeUxmbzd0mgGP+Zft0ITMDESeJS/Z3dtW16OcI1+k i77lMw6cNxtLjy5BDgjGaMUhQy7fH9+Xu7csuhoaTPGn+ljSyfxYyV1BwCdYW0h6 lhR3lblqAzSjQrEFQIm9GOn5rHM2iUh0cCPisc0ZKDHsBt6ay4gB5B+MkbO3MPj9 9QtIAtfzjBbJXUh+/jZgKD6lgix3FLoGLt7yYOcxZ4FIcviEW4/5gKoieIy6DPtk WN9L8bSjodnMtKBNFx/H4nUL5HAFyB9WV5PTD3RjgBIZ9p0CNn9TOUkplYQ1uOHa Amfw/z1IIa3Db5YIxEJinRbwfjWudG0jwaaa1Bj6xn/OxY4guw1k3WJ17PrTP61b DDonzptjqRY9UHcvnnrolIaESFYT5Cb2dUZk5yXEcjOsG90lKkIJ+pueGOYY3ZDh CuCONfnAT7ph+vjtYHA0w+s5q6I5rGOI3Pwa7eRi2N4U/bV/O8k207i2NFeqJZ/l aQMs0eFk31mdz4NFsEctX7DZ7bNo5xhQH4ojCDcUhP2GFkghMr6683NGsH90qjZJ 52h23g4ZXCOONDJLkR4kPzcWF+CzfgFPAYzDzjSYPa02RAlapOBV41HkNNJ69vae X5cypQ/HyCIvos6ayNZHdPI+y+13U1GBdwu5O1AwaONqz/B0Q2H3jriSHzqAdDZK 0N8qvutz0PouNBlcMHpTUxon7VTR10oSRV/JieQqYVJ+nlT8WBj+mVxsU2ZGD2mH peg8ZpJWP3X7tW7518BQRH95fLcEoX4Fcnb509hGv9+F+JTH30eG6H5R1aDD6ZXT tfgz05vIrelBI8XYJuZtmid1cxQzXBwML9r9skgF7Scp8q+1pDeAUz4yAp/Oyw==

1 0

To: an5877@anon.penet.fi, again.
by J. Michael Diehl 17 Dec '03

17 Dec '03

Sorry folks. This person anonymously sent me a message to which he expects a reply. But it is impossible for me to reply to this person anonymously since he would be able to place my anonymous Id with my real Id. I know I should learn how to "bounce" anonymous messages, but there seems to be a lack of standardization in this area which I don't want to deal with at the moment. Sorry for the bandwidth. -----BEGIN PGP MESSAGE----- Version: 2.2 hDwC8VlOkFb8HfkBAYCgq9GJ1tSQXsX5Pm5pGrvFfjJPaIRlsYcLdotqAUuSx6jj Rgl3GZfgp8WRRigwd6qmAAAEmyQ6+Ci6MqT5oSmmXNUJ3rR/cguMWRHDt1TOJlae ck6ezF0MZZlQCWp4Lvh7IhWNZckT9pQ4VWHsWqp5jgeWzYaRbspVfEWnZXVvEAvT 9qZVgNJn7ZGlrmXjkpLTMj+/bk516lLAuVCpGj1TaiIRPTt7YEKgJIYY5FjNdvc5 kLkab5GJcRaNOLG8VjVlSyxRg+sbce1eUEgNaIJtg0VvR2dy9BlPyh3xbBgko3C5 3DZ9TIpM3dtHUueOCm16BRITEkzBvHOYgL+xcj4RVcWrkkxI/hiEi12u1SthDQHK CVmvYcsnt5XGgp27dTPprS1i6COPIHtufH7l9/GIbBrOfn4+whegAl0TT72dL2An on62k+RMP2uPFkbAMNPGtMuWZW0ibpoqx/Wz5njsV8ubPVXDXayiXl0WSGBst/DV dQ56iqmV2tUI5ZDe09ARpnkj61mdnjvlBvFYaoRo6SCI2iLg7m6VsUm6XzNYBzG0 KNvpsd0SLFqz98wrSYIK9RqFrvgNKklsliGwciDwg7AJBYIUxxqrmSvRLtZ7eucm 5+Qc5uMPbPp6UohewDp20zwLz6Jjxff7APZOONKn58xKj+bpbKJb2giuohcI+ZzU EJMGis+dZQtcUPHonf6GQ65ly3HDDcDu5nAz9qZOkLASEZ0zRJjgOXprC6bwyiYF p1tXZCIAJPlEeT6uAejMEhBGeUxmbzd0mgGP+Zft0ITMDESeJS/Z3dtW16OcI1+k i77lMw6cNxtLjy5BDgjGaMUhQy7fH9+Xu7csuhoaTPGn+ljSyfxYyV1BwCdYW0h6 lhR3lblqAzSjQrEFQIm9GOn5rHM2iUh0cCPisc0ZKDHsBt6ay4gB5B+MkbO3MPj9 9QtIAtfzjBbJXUh+/jZgKD6lgix3FLoGLt7yYOcxZ4FIcviEW4/5gKoieIy6DPtk WN9L8bSjodnMtKBNFx/H4nUL5HAFyB9WV5PTD3RjgBIZ9p0CNn9TOUkplYQ1uOHa Amfw/z1IIa3Db5YIxEJinRbwfjWudG0jwaaa1Bj6xn/OxY4guw1k3WJ17PrTP61b DDonzptjqRY9UHcvnnrolIaESFYT5Cb2dUZk5yXEcjOsG90lKkIJ+pueGOYY3ZDh CuCONfnAT7ph+vjtYHA0w+s5q6I5rGOI3Pwa7eRi2N4U/bV/O8k207i2NFeqJZ/l aQMs0eFk31mdz4NFsEctX7DZ7bNo5xhQH4ojCDcUhP2GFkghMr6683NGsH90qjZJ 52h23g4ZXCOONDJLkR4kPzcWF+CzfgFPAYzDzjSYPa02RAlapOBV41HkNNJ69vae X5cypQ/HyCIvos6ayNZHdPI+y+13U1GBdwu5O1AwaONqz/B0Q2H3jriSHzqAdDZK 0N8qvutz0PouNBlcMHpTUxon7VTR10oSRV/JieQqYVJ+nlT8WBj+mVxsU2ZGD2mH peg8ZpJWP3X7tW7518BQRH95fLcEoX4Fcnb509hGv9+F+JTH30eG6H5R1aDD6ZXT tfgz05vIrelBI8XYJuZtmid1cxQzXBwML9r9skgF7Scp8q+1pDeAUz4yAp/Oyw== =tHfY -----END PGP MESSAGE-----

1 0

Crypto crackdown - this i
by Duncan Frissell 17 Dec '03

17 Dec '03

R >They may not be able to prosecute you based on illegal evidence, but R >they can take everything you own and keep it until you are broke R >and homeless. Unless you are judgement proof. For a small fee, I am always willing to teach people how to become judgment proof (which is *not* the same thing as poor). Duncan Frissell ::Exclude *.gov --- WinQwk 2.0b#0

1 0

anon.penet.fi
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

>What is your policy on chaining to anon.penet.fi? Hmmm, it would be bad to post to anon.penet.fi through a remailer, as the anon id assigned by penet would be associated with the remailer, _not_ with you. Therefore, people who responded to the message would actually be sending mail to the operator of the remailer that was the hop into penet. Not to mention the fact if the remailer account were also a personal account, and the operator was a client of penet, that his anon id could be compromised in this way (if he was foolish enough not to have a password). Therefore, it seems reasonable that remailers should refuse to mail into penet, unless and until a non-anonymous reply to anonymous mail facility becomes available there. To the penet knowledgeable: is my understanding correct? Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 1 Infinite Loop, MS 301-2C Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

3 2