December 2003 - cypherpunks-legacy

Markoff on Cypherpunks
by Duncan Frissell 17 Dec '03

17 Dec '03

For personal use only... Keyboarding by Lois Roth NEW YORK TIMES SUNDAY, FEBRUARY 13, 1994 Ideas & Trends Cyberspace Under Lock And Key By John Markoff SAN FRANCISCO In Silicon Valley some of the country's best computer hackers are talking about acts of civil disobedience in cyberspace. Their target is a plan by the Federal Government to discourage a proliferation of coding schemes that insure electronic conversations are private -- from everyone including the authorities. Under a plan being pushed by the Clinton Administration, the computer industry would be strongly encouraged to adopt a new data scrambling standard, embodied in a device called the Clipper Chip, that would allow law enforcement agencies, armed with court orders, to eavesdrop on electronic communications. Earlier this month, Vice President Al Gore said the proposed standard was an important law and order issue for the Administration. The danger, he warned, is that unchecked computer coding technology will make it possible for terrorists and criminals to have secret electronic conversations. The White House is also pressing for legislation that would require telephone networks, cable companies and wireless communications services to install systems that allow law enforcers to listen in. While the Clipper system is voluntary today, a coalition of Silicon Valley business executives and civil liberties advocates argues that there is no guarantee that it won't be made mandatory by a future Administration. In the meantime, it could become a de facto standard as companies that want to do Government business would have to install the chips in their products. Furthermore the Government could use existing export laws to require Clipper chips in any computers shipped to other countries. "They're asking us to ship millions of computers abroad with a chip stamped J. Edgar Hoover inside," said John Gage, director of the science office at Sun Microsystems Inc., a maker of computer work stations based in Mountain View, Calif. "We refuse to do it." A Silicon Valley group called Cypherpunks, which wants to make free and powerful cryptography available to the masses, has been discussing ways to trick officials into thinking the keys to the Clipper code have been stolen. Others are considering violating export restriction laws by sending thousands of copies of encoding software out of the country over the Internet. In fact, the ability to devise coding schemes -- unbreakable even by the most powerful supercomputers -- is so widespread that trying to impose a universal standard may be like trying to enforce Prohibition. Home- brew coding software can be easily exported by electronic rumrunners on computer disks or instantly sent over electronic networks to any city in the world. With Clipper, which was developed by the National Security Agency, communications are mathematically scrambled with an unbreakable code, but an extra set of two keys -- actually long numbers -- would permit authorized third parties to listen in, with the same restrictions that now apply to wiretapping. As a safeguard, both keys would be required to monitor conversations. But some opponents argue that the system could still be abused by Government officials or clever hackers who are able to steal the code. They also point out that despite claims that Clipper is necessary for national security, no other foreign Government or foreign company has indicated that it is willing to use a coding system that is breakable by the United States spying agencies. Even close allies like Canada and Britain have said they are not willing to adopt Clipper. Last week, Michael Nelson, an Administration official in charge of technology policy, broadcast an electronic mail message over the Internet to reassure computer users that the Government has no intention of enforcing mandatory encryption. But skeptics remain unpersuaded. "They are utterly transfixed with the horrible vision of the nuclear armed terrorist," said John Perry Barlow, a founder of the Electronic Frontier Foundation, a public interest computer group that is campaigning to stop the Clipper chip. "This is the last ditch effort of the old superpowers trying to establish imperial control over cyberspace." Across the Internet, activists are discussing civil disobedience strategies while mainstream groups like the Electronic Frontier Foundation and the Computer Scientists for Social Responsibility are organizing a lobbying attempt against Clipper. But some hackers aren't waiting for the government to back down. They're pressing ahead with their networks. A programmer named Philip Zimmerman has written free software called Pretty Good Privacy for protecting electronic mail messages. The program touched off a Justice Department investigation after it was sent overseas through international networks. Now Mr. Zimmerman is working on another free program that will allow personal computers, equipped with microphones, speakers and conventional high-speed modems, to act as secure telephones, allowing their users to have private conversations that can't be overheard. This promises to be about as popular with Clipper supporters as radar detectors are with the highway patrol. "They were angry about Pretty Good Privacy," said Mr. Zimmerman. "They're going to go ballistic over this." --- WinQwk 2.0b#1165

1 0

Re: Safire Savages Clipper
by Dave Banisar 17 Dec '03

17 Dec '03

I'll put them on the cpsr.org archive if someone sends them to me. Dave > Message-Id: <9402141903.AA16561(a)internal.apple.com> > Mime-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > Date: Mon, 14 Feb 1994 11:04:01 -0800 > To: cypherpunks(a)toad.com > From: lefty(a)apple.com (Lefty) > Subject: Re: Safire Savages Clipper > > Perry asks: > > > >Speaking of which, could someone send me the postscript for "Big > >Brother Inside" stickers? > > Me, too. Or better still, put it on an anonymous ftp site somehwere... > > -- > Lefty (lefty(a)apple.com) > C:.M:.C:., D:.O:.D:. > > >

1 0

APPLIED CRYPTOGRAPHY and Mondo 2000
by schneier＠chinet.com 17 Dec '03

17 Dec '03

People: I would really like Mondo 2000 to review my book. Suppsedly my editor has been talking to someone there (if I had more details I would supply them) but they are reluctant to do the review. I remember some of you people at the meeting in Jan had some connection with the magazine. Any suggestions on who I should talk to? Bruce

1 0

Other list
by Matthew J Miszewski 17 Dec '03

17 Dec '03

Perry, What happened to that other list you were starting? Sorry if I missed any announcement my account was messed up for a week or so. --Matt ______________________________________________________________________________ In defense of liberty, encrypt for all purposes, civil and professional. In defense of privacy, encrypt all correspondence, personal and professional. In defense of sanity, do not encrypt your dry cleaning invoice! ++++++++--------mjmiski(a)macc.wisc.edu (c)1993

2 1

RE: REAL WORLD ENCRYPTION
by Blanc Weber 17 Dec '03

17 Dec '03

* intend to use these tools, or is your interest only theoretical? . I would use the tools when these became essential; in my circumstance, not necessarily every day (not yet) . It also would depend on the tools; they presently appear unreliable, unstable *how much you are willing to reorganize your life in order to take advantage of these techniques. . It wouldn't take much adjusting to go from the potential to the actual based on my inclinations, if the techniques are convincingly effective in serving to enhance the possibilities in the real world, without making it too difficult to continue to interact with it. Is it secrecy alone which could accomplish this? I would agreeable to experiment with prototypes in order to work on real solutions which are effective in making the separation from the present attachment to government-regulated toolboxes. *what factors would increase or decrease your use of cryptographic products and services. . depends on how desperate the situation has become (how socialist & coercive) . the kind of equipment required (what special items; what cost) . portability; mobility (can I use any phone anywhere; do I need to take a laptop with me or would there be an "ATM" type card to use; how, where) . ease of use (I don't write code, I don't know Unix; automated set-ups & procedures) . conflicts or difficulties in coordinating procedures with the rest of the world, or at least wherever I may be at the time Concerns: . these are all dependent on electricity, . the electric/utility companies are not anarchist . power outages & access during those times . what problems would one face with the government from the use of such tools; how apparent could it become that one is using a system which operates within "their" territory, yet outside of their influence . what if they find out; do I call EFF *creating a digital bank/open an account in a digital bank: . just how would digital money be translated (exchanged) into other currency when needed it, . so that it would be possible to do business with those who are not also using digital cash; what sort of interactions between differing systems to expect, to deal with . who would 'man' the bank (if it matters) . where would it be located (do we need to know) . what if it's raining & cold outside (ha-ha) Basically, regarding digital banks & currency, I'm interested in any alternatives to the present situation, but am not very knowledgeable of just how these procedures would work or be managed, so that a customer like myself would understand what they were doing (follow the reasoning) and be confident that they could manage their accounts; also, how the value of this kind of 'cash' is established (relative to what?). Blanc

1 0

Ccnet. Anonymous internet provider?
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Forward from comp.org.eff.talk: Netcom would loose alot of customers if its libertarian counterpart became available.... -=Xenon=- comp.org.eff.talk #26742 (0 + 1 more) [1] From: allisat(a)r-node.io.org (Allisat) [1] ccnet anonymous service Date: Mon Feb 14 10:34:24 EST 1994 Organization: allisat(a)io.org Lines: 95 Distribution: inet ccnetccnetccnetccnetccnetccnetccnetccnetccnetccnetccnet common carrier network a Mac GUI on-line system serving the metro Toronto community with an anonymous service and uncensored E-mail gateways. ccnet anonymous... (416) 588-1483 requires a Mac System 6.0+ & free FC Client software User ID : anonymous Password : anonymous Hours of Operation 00:00 - 08:00 EST ccnetccnetccnetccnetccnetccnetccnetccnetccnetccnetccnet Our private lives and personal communications are increasingly being monitored and controlled by corporate and government agencies. Individual freedom of expression will soon mean nothing unless we provide ourselves with forums which guarantee and safeguard our inallienable civil rights. ccnet anonymous is such a place. Here you will find freedom to write anything. Here you have anonimity to end the fear of being persecuted or prosecuted for your thoughts, opinions and ideas. If we don't oppose the unending infringement of our rights they will simply not exist in futureure. The choice is ours... ccnetccnetccnetccnetccnetccnetccnetccnetccnetccnetccnet ccnet electronic post guidelines ccnet's volunteer administrators do not edit messages for content and take no responsibility for any messages posted on-line. Individuals connecting to ccnet do so voluntarily and at their own risk. Parental guidance is advised. ccnet is not responsible for the titles and content of the messages which may be uploaded. ccnet does not edit remove messages for contents. The following guidelines have been established only in order to facilitate the efficient distribution and storage of messages not to interfere with, alter, determine or censor the flow of messaging 1. Messages posted to ccnet must be 18 Kilobytes or under in size. 2. All attachments to messages posted to ccnet must be PGP encrypted and compressed. 3. Messages which are over 18 K or attachments which are unencrypted or uncompressed will not be accepted for distribution and removed after posting notice to "deletions". ccnetccnetccnetccnetccnetccnetccnetccnetccnetccnetccnet for information either log in directly and send a message to "administrator" or reply to "allisat(a)io.org" ccnetccnetccnetccnetccnetccnetccnetccnetccnetccnetccnet

1 0

Who knows a good basic text on Huffman Codes
by Syl Miniter 803-768-3759 17 Dec '03

17 Dec '03

I am referring to the minimum bits coding scheme invented by DAVID HUFFMAN in 1951. I would like something that does some concrete examples in radix other than 2 hanks for your help. I think Huffman is at ucal-santa cruz and would like to know his e-mail address as well. He was at MIT back in the fifties and worked with Fano et al on coding theory.

1 0

SCHEME for FULL-SPEC RETURN PATH
by Jon 'Iain' Boone 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This is a portion of mail that I sent to bill stewart. Since bill seems to busy to send a critique, could someone else comply, please? Jon Boone | PSC Networking | boone(a)psc.edu | (412) 268-6959 | PGP Key # B75699 PGP Public Key fingerprint = 23 59 EC 91 47 A6 E3 92 9E A8 96 6A D9 27 C9 6C - ------- Forwarded Message Date: Thu, 03 Feb 94 13:45:31 -0500 From: "Jon 'Iain' Boone" <boone(a)psc.edu> How secure do you think this is? Three remailers: anon1+(a)a.edu anon2+(a)b.com anon3+(a)c.org Originator: boone(a)psc.edu (really igi.psc.edu, as Message-ID: shows) Receiver: wcs(a)anchor.ho.att.com ()Ka == contents inside () are encrypted with Public Key of A mail addressed to random+*(a)foo.edu == mail to user random(a)foo.edu, random's mail processor will deal with the +* The sender must encrypt his/her own address with the public key of the first remailer and put it in the X-A-R-P: field. Upon reciept of a message with X-A-S-P: set to non-empty, the re-mailer will strip off its portion of the address and decrypt the rest with its private key. It will add itself to the X-A-R-P: and encrypt it in the public key of the next remailer on the X-A-S-P: If there is nothing in the X-A-S-P: (after having removed its own address), then it needs to be sent to the To: address, so we set the From: address to be the contents of the X-A-R-P: with its own address pre- & post- pended. That way, the reciepient need not change his/her mail agent to respond via the X-A-R-P: (or even need to include the X-A-S-P: in the outgoing response). If the message doesn't have an X-A-S-P:, the remailer checks the "To:" for the contents of what would have been the X-A-S-P: with its own address pre- & post- pended. By stripping off its own address and de-crypting the resultant, it has the next address to send it to. Barring wire-tapping, your privacy is susceptible in the logs (syslog, etc.) of the first remailer (a.edu in my example) or if all the RSA-keys for a.edu, b.com and c.org are broken. To dampen wire-tapping, you could encrypt the contents of the message with padding, making traffic analysis more difficult. Comments? IGI.PSC.EDU: To: wcs(a)anchor.ho.att.com X-A-S-P: anon1+"(anon2+"(anon3+(a)c.org)Kb"@b.com)Ka"@a.edu X-A-R-P: (boone(a)psc.edu)Ka From: boone(a)psc.edu Message-Id: <348723472.AA34890235(a)igi.psc.edu> A.EDU: To: wcs(a)anchor.ho.att.com X-A-S-P: anon2+"(anon3+(a)c.org)Kb"@b.com X-A-R-P: (anon1+"(boone(a)psc.edu)Ka"@a.edu)Kb From: anon1+(a)a.edu Message-Id: <2349458.AA23575(a)a.edu> B.COM: To: wcs(a)anchor.ho.att.com X-A-S-P: anon3+(a)c.org X-A-R-P: (anon2+"(anon1+"(boone(a)psc.edu)Ka"@a.edu)Kb"@b.com)Kc From: anon2+(a)b.edu Message-Id: <8980234.AA23489203(a)b.com> C.ORG: To: wcs(a)anchor.ho.att.com X-A-R-P: anon3+"(anon2+"(anon1+"(boone(a)psc.edu)Ka"@a.edu)Kb"@b.com)Kc"@c.org From: anon3+"(anon2+"(anon1+"(boone(a)psc.edu)Ka"@a.edu)Kb"@b.com)Kc"@c.org Message-Id: <2343.AA123(a)c.org> ANCHOR.HO.ATT.COM: (Reply) To: anon3+"(anon2+"(anon1+"(boone(a)psc.edu)Ka"@a.edu)Kb"@b.com)Kc"@c.org From: wcs(a)anchor.ho.att.com Message-Id: <99234.AA23492383(a)anchor.ho.att.com> C.ORG: To: anon2+"(anon1+"(boone(a)psc.edu)Ka"@a.edu)Kb"@b.com From: wcs(a)anchor.ho.att.com Message-Id: <2342349324.AA2343242(a)c.org> B.COM: To: anon1+"(boone(a)psc.edu)Ka"@a.edu From: wcs(a)anchor.ho.att.com Message-Id: <98234234.AA123213(a)b.com> A.EDU: To: boone(a)psc.edu From: wcs(a)anchor.ho.att.com Message-Id: <7732432.AA52342(a)a.edu> Of course, some work would be necessary to accomodate double-blind conversations. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLV92F4SAMUrxt1aZAQErUQQAggfMfjxAXS0rk9AL5uZTNN9adGNJqMvF gC5QSlgSki2bmUzfeoq/2cSpdUx7vX9LPCGd88+RnnouyhCDhK0a6fOLGgEDrtar miKGU11Ernt/bQC6gwvBa+KuD7pceLM2mPGw9NLxLMwwajP/U6CxL2/bMXIQhxZ0 eMTM76QuEwE= =tfVg -----END PGP SIGNATURE----- #

2 1

RE: REAL WORLD ENCRYPTION
by qwerty＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Pat Farrell wrote, >I personally think stealth PGP is the wrong direction. Widespread, blatant >acceptance of PGP by the 10 million PC users with modems will do more to >guarantee the legality of PGP than all the CSPR petitions. (Hey, I sent in >mine too, I just don't think that a few thousand voices will be heard). First of all, you only seem to be considering the USA. Widespread acceptance of PGP in some countries isn't going to happen. But it sure would be nice to be able to talk to people in those countries. Second, if Stealth-PGP not be "the solution" or "the right direction" then realize that simply its presence would add great psychological power to our words against Clipper. And also realize that Uncle Sam in a year from now fully intends to obtain the technology to smart-search all electronic communications for PGP messages. If we can show that even in times of national emergencies or crime-wave scares, that having Clipper and the FBI wiretap proposal there to rely on, is just a foolish waste of our money. Third, I think the PGP developers are almost just as guilty as the Clipper designers in trying to, behind closed doors, design us an encryptor. The same encryptor for everyone. The Great Grand Solution to everyone's needs. Stealth-PGP would be powerful in the hands of the small minority who want to use it. You don't need 10 million other users to create the "security through obscurity" condition. It's trivial to put 10 million PGP users on a list, then draw lines between names to find groups of "subversives", then with another button push in the bowels of the NSA, start taping their phones. Lastly, PGP has been out there for years. Where's the 10 million users? You don't even have 10,000. And Microsoft has a cryptographic division now. And Clipper is so easy to use! The big boys are getting involved, and PGP isn't what 10-100 million people are going to be using, unless you port the thing to Mac and Windows and make it as easy to use as a Clipper phone. The internet is a small world. There's only 15 million e-mail users. Do you really expect to get 70% of them to start using PGP? When? In a year? Because you better, or "Microsoft Encrypt" not to mention "SONY EncryptorMan" are coming within a year or two. Time's running out for PGP. But Stealth-PGP is a timeless technology, like fire or the handgun. Once it's made, someone 1000 years from now can still use it to hide their encrypted message. -=Xenon=- -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLV+hNwSzG6zrQn1RAQETHwP8CzC+/l1tdHckRkxGqVnRqjIgGigkZFu3 bCuC8MHp/yQr6i+mVarfpLcu0sjt5O0tJ6Ph4Jnfsy5vn4YrodAX1ShHzo6YwwsU 9jxxXcA17Xyh3lb6+4N7r+BC3AJ2PoSjrkV36OnuY0jKunB2iP2l1RZi75Pq/jHP WYZEJEcJhHc= =rr0c -----END PGP SIGNATURE-----

2 1

Re: Tracking Contacts with Clipper
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

Sandy wrote, "Tim asked about "phone remailers" in one of his recent posts. Until that happens, remember that the anonymous phone cards offered by AT&T and Western Union (and others) are almost as good. This is especially true if you "chain" call through two or more different phone cards." Please post details of these. How do they charge you then? Must you use a phonebooth? -=Xenon=-

4 3