December 2003 - cypherpunks-legacy

Re: Actively Sabotaging Clipper and Capstone?
by an3747＠anon.penet.fi 17 Dec '03

17 Dec '03

> But isn't this what we cherish about free speech, the > ability to talk about controversial matters, even something as > controversial (well, not to me, of course) as advocating the overthrow > of the U.S. government? A good move for anyone anticipating the overthrow of the U.S. government (or any other) is to personally quit the U.S. This is a psychological state-change after which he no longer refers to members of the U.S. in first person: > ... > toward the commercial traffic flowing in our major economic opponent. ^^^ > Which is why we're already seeing "family keys" > generated for specific target countries, like Japan, Germany, and > France (our major "enemies" in this new world without our former ^^^ ^^^ > enemies). ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: REAL WORLD ENCRYPTION
by W. Kinney 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Sandy Sandfort writes: >I would like to start a new thread. I want to know what the >people on this list intend to do with cryptography in the "real >world." I read this as an invitation to rant. :-) This is going to be a little harsh, I'm afraid. > What do you want? What do you fear? I'm here for the crypto phase change. I'm here because of a technological perception about computation in general and encryption in particular. Crypto is a lever. Crypto is about mechanical advantage, small actions with big consequences in the progress of a major social change brought on by computation. Computers are changing the world in a way comparable to the invention of iron, or the printing press, or the steam engine. And cryptography is a pivotal point of influence in the direction that society will take in the next fifty or a hundred years. >My interest is more than academic. I am one of the Cypherpunks >involved in creating a digital bank. If the 700 or so people on >this list wouldn't open an account in a digital bank, chances are >no one else would either. The same goes, of course, for secure >phones, encrypted e-mail, and all the rest. Put the digital bank on Oceana and let them both sink together. Fuck overthrowing the government. As my mother would say, "vast plans in half-vast ways..." For what it's worth, I appreciate and admire the Vision. But it's impossible to take this grandiose stuff seriously when I'm still sending my password in cleartext over my phone line. Digicash is white noise until somebody has something to spend it on. Nobody's going to put their life savings in a bank named "crazed-libertarian(a)subversive.com". Get real. The problem is not a lack of vision or a lack of expertise, it's a lack of social acuity. All those damn unsubscribe messages are telling us something, and nobody seems to be listening. The problem is that the cypherpunks can't even run a mailing list that's easy for people of limited technical ability to use, much less a bank or an entire nation. Somebody this last week posted a proposal about an encrypted terminal program, something that comes up once in a while, and the only replies I saw were from people saying "Oh, WELL, this has already been taken care of - -- just get a TCP/IP protocol connection and implement kerberos and haven't you read RFC 10329-2394032.9292-11193742 anyway? This is all standardized." Except that I'm still sending my password over my phone line in cleartext. Pr0duct Cipher is working. Mike Ingle is working. Mike Johnson and Grady Ward are distributing. Julf and the Remailer People (who mean our net no harm) are giving people meaningful channels for speech. John Gilmore is insisting on observance of the law. These things are for real. We don't need a new government. We don't need a million metric tons of hexagonal concrete slabs floating off bermuda full of "pioneers". We don't need any bullshit toy banks. The crypto phase change will be brought about by a thousand small and unromantic actions. If we are to be visionaries and subversives, let us style ourselves as visionary and subversive bricklayers, working slowly and patiently and from the ground up. The crypto phase change is not about anarchy, it is about insisting on accountability from the government we already have. The crypto phase change is about user interfaces in Windows. It's about plug-and-play software that lets people secure their own privacy in an indifferent world. These are the things that will effect change. The rest is ego. >What Real World concerns you have about crypto? > >Talk to me. Talk back. -- Will "A skilled commander seeks victory from the situation" -- Sun Tzu -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLV6sJPfv4TpIg2PxAQFK5QP+I7gz5NOi4GdzHToX/MnWL8YjpLFgZPFJ JRnwgxAw2QEMYdvORWckBFN/zgrLs7CTlgDT5Pz+uT2qEeYEXX/yRtMo9LLANeqe 8Gy8CnFWFCoC0s8Mt5rG96fG6Y4YAEAnRuYj0ZRb5vb3daU8+GPhfaXp6tr27H3a xkOioJoDG74= =L0+J -----END PGP SIGNATURE-----

1 0

Re: Strategies for getting encryption in widespread use QUICKLY
by Pat Farrell 17 Dec '03

17 Dec '03

In message Sun, 13 Feb 94 09:50:59 +0200, Johan Helsingius <julf(a)penet.fi> writes: > As far as I know, there are *several* PD Windows SLIP packages. Yes. there are. I am motivated from the other end. I can get the client code I need, I can't get "widespead use" at the server end. For example, GMU, which nominally provides Internet access to all of its students, refuses to support SLIP or PPP on any of its servers. No reason, just policy. I gave up on GMU's services and pay Netcom to give me access. They charge $2.00 per hour for SLIP/PPP, but all the async access I want is flat rate. Until the politics and economics change, I believe widespread use will require a non-IP approach. Sure IP would be better, so would ISDN. But Eudora and NUpop work fine, over straight async. they just miss the encryption hook. I have no interest in debating the value of IP. I am looking for help in building a non-IP client that can enable encrypted mail to the great mass of computer owners who are clueless about technology. Pat Pat Farrell Grad Student pfarrell(a)gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

RE: REAL WORLD ENCRYPTION
by Pat Farrell 17 Dec '03

17 Dec '03

In message 13 Feb 94 18:38:36 EST, Sandy <72114.1712(a)CompuServe.COM> writes: > I would like to start a new thread. I want to know what the > people on this list intend to do with cryptography in the "real > world." I believe that real business will be done over the Net using EDI or some derivative. Given the Net's many security holes, cryptogrphy is needed for both digital signatures and to ensure that my business plan doesn't show up in my competitor's inbox. Most of this could be done with MIME, DHS, DSS, and PEM, if those standards ever get deployed to the "widespread" user community. But we cypherpunks must, at least, make sure that the weaknesses in the standards are exposed and corrected. > There are a number of Cypherpunk projects on the drawing > board or already deployed: Stego, encrypted phones, encrypted > and anonymous remailers, stealth PGP, a digital bank, etc. Do > the folks on this list intend to use these tools, or is your > interest only theoretical? I personally think stealth PGP is the wrong direction. Widespread, blatent acceptance of PGP by the 10 million PC users with modems will do more to guarentee the legality of PGP than all the CSPR petitions. (Hey, I sent in mine too, I just don't think that a few thousand voices will be heard) Digital money is another thing. I think it is great. I'm realy to put $1000 real US dollars into the first bank that has digital money that I can sepnd on real things. We are probably a ways away from this, but Pr0duct's work is a great step forward. Pat Pat Farrell Grad Student pfarrell(a)gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

alt.steganography
by qwerty＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm trying to get someone to create alt.steganography, 'cause I'm getting quite a few sci.crypt types asking me, yeah ME, that's who they're asking damn it, in great detail about the qualities of random noise created by various sources such as a microphone or AM radio or a scanner. And about adjusting checksums instead of direct LSB changes to store the data. Fractal stego is coming soon too. And Apple's microphone sends sounds to a D/A converter which does NOT output its noise as random. Awk! I try, but it's time to get these people talking to each OTHER, not to me. I don't know how to create a newsgroup, but if someone doesn't do it for me (us), I'll have to do it myself. I certainly do know some people to ask how. There's quite a few serious programmer types who want to create steganographic software. I've gotten quite a response to my "announcing" Stealth-PGP on Usenet. The person who gets credit for coming up with the name "Stealth" instead of my boring "VGP" says he has changed plans and hopes to offer an external utility to strip and later restore any PGP message. For the newbies, this isn't just removing the "-----BEGIN..." header and footer! How 'bout it? At least tell me what the "proper" name should be for the group. sci.steganography will take to long to get approved. alt.steganography is OK, but isn't alt.security.steganography more correct? -=Xenon=- -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLV7wVwSzG6zrQn1RAQHyuwP/ekQGxsJ0SFKl9rXkMtzBt8NUMkS72byo RNngI6XQ9LWdz6JTIv6HHvKlAg5R68IJhOXUaRpxIGY5mAZkqQ6HV6gmcGc/LVRw xle/EmESDSJZxFzPtCZZsJpmN7NUw3GkZ38BQwT7qP5raYRr92HOCcnHXbVei/kZ VysymRITmRM= =fDoU -----END PGP SIGNATURE-----

3 2

Re: Actively Sabotaging Clipper and Capstone? (fwd)
by rcain＠netcom.com 17 Dec '03

17 Dec '03

Sameer sez: > > tcmay(a)netcom.com (Timothy C. May) sez: > Cypherpatriots, > > It's becoming more and more evident that the Crypto War has already > started, that the fascists in power have decided to ban the keeping of > secrets and the use of strong crypto by nongovernment folks. Not yet. Just a kneejerk so far. They have decided they have the power, though. They have court decisions to back that up. If the administration decides to "just say no" they have shown us in the last few days that they can and will. > > How could Clipper be sabotaged? Easily. By using it for the purpose of distibuting hard public keys. Willingly or not, they have solved that problem. :-) > > Time to sabotage this whole Big Brother system. Tim, I think that those of the big brother mentality who are left are doing that just fine all by themselves. :-) Peace, Bob -- Bob Cain rcain(a)netcom.com 408-354-8021 "I used to be different. But now I'm the same." --------------PGP 1.0 or 2.0 public key available on request.------------------

2 1

copyrights of anonynous messages
by jito＠iikk.inter.net 17 Dec '03

17 Dec '03

Can someone tell me what the understanding is about reprinting and reposting messages send via anonymous remailers? IE if I am writing an article and want to quote from this list, I will try to get permissions from the author. What do I do about anonymous notes? - Joi -- true name: <Joichi Ito> closest email address: <jito(a)netcom.com> closest fax number: <+81-3-5454-7218> current physical location: <Tokyo> travel path: <.> mosaic home page: http://iikk.inter.net/ -- finger jito(a)netcom.com for PGP Public Key, RIPEM Public Key --

2 1

Precedent for PGP legality
by Mike Ingle 17 Dec '03

17 Dec '03

Found on alt.security.pgp. This might be worth researching and putting in a future PGP manual. While it wouldn't keep PKP from harassing commercial services into taking PGP down, it might help to keep keyservers and the like alive. This is a court decision that found the construction of a patented device for nonprofit purposes is not an infringement. From: cjohnst(a)xmission.com (Charles Johnston) Newsgroups: alt.security.pgp Subject: PGP could be perfectly legal in the United States!!!!! I was researching in the University of Utah law library nearby, and I found a case that talks about patents and private/experimental use. It's 73 Fed 206,211 if you're interested in looking it up. I haven't Shepardized it yet (found all future cases affecting the opinions), but here it is. This is Bonsack Mach. Co. v. Underwood Speaking of patents: "The making of an infringing machine merely as an experiment is not an actionable infringment..." and "To constitute an infringement, the making must be with an intent to use for profit, and not for the mere purpose of a philosophical experiment." This seems to say that PGP is okay to use! I would appreciate ANY comments! I will be researching this further REALLY soon! By the way, when was the RSA patent granted? They only last 17 years! Charles Johnston

3 3

decrencr or crypdec?
by fnerd＠smds.com 17 Dec '03

17 Dec '03

Bob Cain says- > > ...decrencr. (Short word > I just coined for decryptor/encryptor as in modem or codec :-) How about crypdec (pron. "cryptic")? -fnerd quote me - - I am the sea of permutations I live beyond interpretation I scramble all the names and the combinations --Eno -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

2 1

The Clipper connection
by hkhenson＠cup.portal.com 17 Dec '03

17 Dec '03

If I may boil down one side of the Clipper/Capstone debate, it is certain members of the government saying: "We need to implement this encryption method so as to avoid problems we think may be coming. Trust us! We promise not to abuse your privacy." [except for the following--expandable--list of reasons.] Unlike some in this debate, I do not doubt the sincerity of Dorothy Denning or others like her. And I would have a lot fewer problems with Clipper/Capstone proposal if the people who will be granting access to the keys and those with legal access to the keys were of Dorothy's caliber. However, people of good will are not likely to be the ones who apply for these keys to your privacy in the future. I am right in the middle of a case which has remarkable similarities to a Clipper "request for keys." Full details have been posted to comp.eff.talk and misc.legal, but in brief summery, a Postal Inspector from Tennessee is attempting (for political reasons) to impose the obscenity standards of that region on an adult BBS run from Milpitas (just North of San Jose). To this end, he obtained a warrant to take the BBS hardware. Because of contained email and First Amendment activities of a BBS, subpoenas, not warrants, are required under two sections of federal law. The laws are Title 42, Section 2000aa, and Title 18 Section 2701, the same ones which were applied in the well-known Steve Jackson Games case. Pointers to these federal laws were *posted* on the BBS. The postal inspector downloaded this file (most of which *I* originally wrote), and *included* it in his affidavit for a search warrant to a Magistrate-Judge in San Francisco, along with a remarkably weak theory of how he could avoid application of these laws to himself. To obtain a warrant to take email and 2000aa materials, a number of judicial findings should have been made. None were. The postal inspector got his warrant, mailed child pornography to the BBS, served the warrant, and "found" the child porn. To give you an idea of the good will (and competence) of the particular agent involved, he had not included the child porn in the warrant, and so had to fill out another document at the time of the search. On this form he specifically described the material as "sent without his knowledge" (referring to the sysop). Of course this statement did not prevent this child pornography (in the sysop's house for all of half an hour) from being the basis of one count (of 12) of a grand jury indictment the BBS sysop faces in Tennessee. This warrant example applies to the Clipper situation. The risk under Clipper is that your private communications will be protected by the *weakest* link in the chain--one of the thousands of low level Magistrate-Judges among whom law enforcement agents shop for warrants and will shop for keys. These judges tend to be busy, or lazy or both, and they *trust* law enforcement agents. Even if the law is *directly quoted* in search warrant affidavits or key requests, and these laws *expressly forbid* granting warrants or key requests under the conditions cited, the judge may not even read a lengthy supporting affidavit before approving it. He is *very* unlikely to consider a the underlying laws when granting a request. The key escrow agents provide no protection whatsoever since they simply fill orders from agents with approved applications. Judges ignore the law with impunity, and so do law enforcement agents because one agency will almost never investigate another. As a practical matter, applications for search warrants are almost never denied. The same situation is certain to occur for Clipper key applications, no mater how weak the justification happens to be, or what laws are being violated by those seeking the keys. Keith Henson

2 1