December 2003 - cypherpunks-legacy

legal hacking
by jkreznar＠ininx.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Eric says ``... legal hacking is almost a necessity.'' Perry says ``You can't do legal hacks in an environment like this. It doesn't work.'' Delicious dichotomy. Here are the more extended contexts: At Wed, 18 May 94 12:13:28 -0700 hughes(a)ah.com (Eric Hughes) wrote > Legal hacking is a lot of fun. Prerequisites are a humility to learn > the structure of legal argument and access to legal materials. The > study guides for law students are generally excellent introductions to > the subject. Access to a law library is also useful for looking up > statute and decisions, but not essential, although reading at least a > few decisions is necessary for ensuring an understanding of the social > process involved in the creation of law. > And if what you want to accomplish with your computer hacking > requires, for implementation, something outside the computer hardware > and networks, legal hacking is almost a necessity. But at Sun, 07 Aug 1994 08:24:57 -0400 "Perry E. Metzger" <perry(a)imsi.com> wrote > The bureaucrats aren't > going to want digicash, so they are going to find plenty of excuses to > prohibit it. You can't do legal hacks in an environment like this. It > doesn't work. If the bureaucrats don't like you, they shut you down, > and there is not a damn thing you can do about it, period. > True, you can leave the country and do your business there -- I know > several hedge funds that already refuse to take any customers from the > U.S. because they don't want the headaches, and there are other > similar things happening in lots of other parts of the financial > industry. However, don't think you can finesse the folks at the Fed, > the IRS, the Treasury, and the SEC -- they are monsters, and they > won't be stopped by the courts. What differing views of ``legal hacking''! It would be wonderful if society's response to legal hacking had more of the predictability of computer hacking. But there are a hundred million constituents out there (the power behind Perry's ``monsters'') who gratuitously accept government benefits. Such a person doesn't gladly suffer any legal technicality standing between him and the pound of your flesh to which he thinks he's entitled. If you can prove that the law permits you to keep your pound, then he and his majority allies will simply change the law, requiring the IRS to collect it from you after all. This inclines me to accept Perry's cynical skepticism that legal hacking can do any good. On the other hand, Eric demonstrates time and again that his remarks are not made lightly. In this case, they bear on the prospects for the ``State Citizen'' movement that seems to be so emergent these days. I wonder how he would respond to Perry here. John E. Kreznar | Relations among people to be by jkreznar(a)ininx.com | mutual consent, or not at all. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLkdKgcDhz44ugybJAQFj5gP+IMMUdQLMY8vqG4pcmNGAroSNIxvkXlbE rSIIbR3wZddeWLxNBsK+pMT8Le3RLRqQa7bRI8MVgEed23VAmpccAn8tiLsQOzSq MdUbuFIrI7MY/t3ov0fE6pWBvoZb345g0ZH83F5EZcU9NARNp6wsVDBA2bs9aQ9d 7cz/P4kxJHQ= =JBcR -----END PGP SIGNATURE-----

2 1

forwarded message from System Daemon
by Daniel Carosone 17 Dec '03

17 Dec '03

Another one.. *sigh* it's still going on? please remove this anon id, I won't be using it. ------- start of forwarded message (RFC 934 encapsulation) ------- Message-Id: <9408090808.AA14325(a)anon.penet.fi> From: daemon(a)anon.penet.fi (System Daemon) To: danielce(a)ee.mu.oz.au Subject: Anonymous code name allocated. Date: Tue, 9 Aug 94 11:08:40 +0300 You have sent a message using the anonymous contact service. You have been allocated the code name an120044. You can be reached anonymously using the address an120044(a)anon.penet.fi. If you want to use a nickname, please send a message to nick(a)anon.penet.fi, with a Subject: field containing your nickname. For instructions, send a message to help(a)anon.penet.fi. ------- end -------

1 0

RE: CreditCard info
by Garth Brown 17 Dec '03

17 Dec '03

---------- | From: Brian Lane <blane(a)squeaky.free.org> | It's unbelieveable (to me anyway) that people would give this kind of | information out and trust that it can't be abused. It's bad enough that | we're asked to hand out our SS number for everything. It's my understanding that it's technically illegal for anyone to require your SSN for anything if they are not using it for SS related purposes. I had heard that congress passed a law when SSNs were issued to this effect. Am I hallucinating, or has someone else heard this too?! garthB> ---------------------------------------------------------------------- ------- Garth S. Brown, Semaphore Corporation 122 South Jackson Street, Suite 350 garthb(a)semaphore.com Seattle, Washington 98104 InterNIC WHOIS: GB(31) -Public key available via finger of garthb(a)semaphore.com -PGP2.6 Key fingerprint = 65 0E 48 A1 F7 38 DB 03 3F 77 77 9E B5 53 2E 96 ---------------------------------------------------------------------- ------- All problems can be solved with the proper application of high explosives.

4 3

No Subject
by Bill Garland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There has been much Meta Discussion of late. There has also been much but not too much trivial and meta-meta stuff, of which I gues I would have to categorize _this_ posting. I don't suppose anyone is interested in metabolizing this any further... All I have to do is take a break for a few days and I have these 457 New Messages to catch up on. You all know what I am talking about, I presume. Now that I have lost my job, and am more or less finished with soaking the hapless taxpayers, I can finally get around to doing those things I have previously referred to as homework, and turn them around into revenue generating memes. I am going to unsub for a week or so, and ::exclude all for a while, and unsub permanently from anything else except moribund IMP - I'll wait to see if anything happens in that arena - cypherpunks have assumed control over IMP memes anyway...so that when I get back, there will only be regular personal mail from net.friends and darters (my secret passion - a wonderful type A behaviour pattern) mail. I may have only five weeks of net.access at this address, anyway, but my seniority and status as alumnus and donor and decus membership entitle me to to historical use of my bill(a)kean.ucs.mun.ca True Name address. I can, I expect, get a forwarding privilege as part of my severance package, although I _will_ be going to a commercial internet service as soon as I get a round tuit. There are other possibilities, which I wont bore you with right now. So I'm off to write some code, do some homework, and take some annual r & r. Before I go, I thought I'd send this rant to the list, just one message or so before I send the appended .sig in to the Idea Factory for maintenance. We have discussed this before, so maybe after my Annual General Meeting coming up this Perseids, deep in the woods, I'll come up with an idea of how to make this come about - how to, say, achieve the goal - meanwhile I am just going to rant. I want Extropian mailing list software equivalent for Cypherpunks! Others want it. It has been mentioned as a possibility. I understand there are some intellectual property rights involved, but jesus h christ as my old man used to say, what can we say about the intellectual property rights of prz that we now take for granted? [Did anyone notice the AP article about prz the other day that was okay as a news bite but they spelled his name incorrectly!] [[Someone with a much-too-long-but-only-occassionally-used .sig also spells his name wrong...homework for another cypherpunk...]] I understand there are machine property rights involved, too. Perhaps these can be hashed out at TAZONO. I'll be there in spirit, if not in the flesh nor by upload... I know there are other problems, too, but hey, this code has already been written. Let's get it done. I haven't yet used the ::exclude features of Extropian list software for Extropian mail, but I could _sure_ use it for cypherpunk mail. Meanwhile I am about to unsub cypherpunks for a week, and ::exclude all for a while, and I'll be back RSN with some non-meta harangues. Opps, redundancy noted. Some notes for the future : 1. HEx will reanimate itself as a reputation market. I have to read some Chaum, first. 2. INFO_Banque will spontaneously order itself into existence. I have to read some Chaum, first, and tend to some other stuff. 3. Watch for the INFO_Banque_Protocols and the INFO_Banque_PPL. I claim copyright to these words...I guess I am going to have to sign this rant. 4. Perhaps I should sign all my future postings as a matter of personal discipline and policy, as I embark upon some personal self-transformation. 5. Perhaps I should invent another pseudonym for myself. It is known publically, although not widely, that I sometimes write things for an alter ego personality I have named Wendell Noseworthy. The new nym will have to be a credentialled entity... But I have to read some Chaum first, and I _still_ can't find a copy of Schnier in our library and now that I need all my paper cash to feed my replicant units, well, there may be some delays involved... Meanwhile, I will be interested in receiving encrypted mail from cypherpunks and Extropians, just for practice, of course. Very soon now I hope to get my PGP key signed by somebody, but I have been waiting a decision on moving to 2.6ui or 2.7...or 3. Use this public key for now, and we can verify it later in life. You can check the signature if you wish and let me know if I have made any blunders. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAiynHCkAAAEEANbd5hw0IR+keK2U2DoGnAPdcctWxipdXbJ2Qr83ScX7d7K1 uP1bkRkGOCYJpQTksgtHf/ulUsZwq4TEFb7QUyvHnoRJcO4q0RX7CnH9fhXQ1F+k LeuU4NSCYIzrvI6kdoMR1nTN3N8zm793CafB/SI0ZoJs2b5p1UqYjDfdkCPxAAUR tCxCaWxsIEdhcmxhbmQgKFdtLlIuKSAgPGJpbGxAa2Vhbi51Y3MubXVuLmNhPg== =Z9Sb - -----END PGP PUBLIC KEY BLOCK----- So, as I said, I'm off for some R&R to write some meta-code. I'll retire this .sig below now, [perhaps another message or two will sneak through to other channels...] Copyright 1994, right now, me. Please do not distribute this rant. Bill Garland /----------------------------------------------------------------------\ | I am an Extropian. | Macronic Systems, Inc. offers Ideas for Sale ! | | BEST: DO_IT_SO ! | Go for it : Pledge a Digital US Dollar now. | | CryptoAnarchist. | Send PGP key for more information. | | Cypherpunk. | Get in on the ground floor. Invest Now. Trust me! | | Owner : MSInc., |---------------------------------------------------| | HEx, INFO_Banque | Bill Garland = bill(a)kean.ucs.mun.ca | \__________________________________o o_________________________________/ -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLkdEdkqYjDfdkCPxAQEkTgP+LZeoDVqECXIwaF8W5SrdsI57PNrd9818 /kTrMNBwq5Vq24Z17BBSD7AojT07TjBSdoM8sVJAfjFWanHvLslbGipraKdVv8cK robByfFvazcGTHEX/8tslKOChmSkS2yhU6aQzNOKgN4HS29GqBnFeAaTSU08sSZX 7gBrRoBUI50= =n0Cp -----END PGP SIGNATURE-----

1 0

No Subject
by an118＠vox.hacktic.nl 17 Dec '03

17 Dec '03

I saw an interesting post in sci.crypt last week about a particular cypher. I think it ws called "The Penknife Cypher" or something along those lines. I guess I have been so PGP oriented that i've sort of stuck my head in the sand and ignored other possibilities regarding encryption. ARE there any other good cypher's out there, suitable for e-mail usage? And more importantly, are they readily available, likely through ftp from some European source. I guess it doesn't matter how popular they are, but how secure they are. I'd be interested in a strong one for usage between a couple of friends and myself. The keys could be spread via PGP and then I suppose we could start using the cypher. Any ideas? Or is my best bet to pickup Schneir's Applied Cryptography and use an algorithim from that? -------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)vox.hacktic.nl Please report any problems, inappropriate use etc. to admin(a)vox.hacktic.nl Direct replies to the sender of this message are -not- anonymised <YuK>

4 4

Gore Letter and Software Key Escrow
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Some interesting comments from a recent issue of "EE Times": "While some critics declared Clipper dead, Gore made it clear that any encryption system used for voice communications must retain that the key-escrow framework that is the central feature of the Clipper chip. The only difference will be whether private-sector escrow agents will be added." ["Gore letter clouds U.S. Clipper policy," George Leopold, "EE Times," 1994-07-25, p. 4] [the article mentioned Gore's "We welcome the opportunity to work with industry to develop a more versatile, less expensive system. Such a key-escrow system would be implemented in software, firmware, hardware or any combination thereof, would not rely on upon a classified algorithm, would be voluntary and would be exportable."] In an earlier article: "Sen. Patty Murray, D-Wash., cosponsor of the Senate bill, said the Clipper-chip proposal "has had a chilling effect on software manufacturers in my state," particularly Microsoft Corp. She and other Clipper critics testifying last week argued that software encryption is widely available. "Federal efforts to put the genie back in the bottle will be futile," Murray said." ["Congress adds its voice to Clipper debate," George Leopold, "EE Times," 1994-05-09, p. 16] And this chilling comment from Stephen Walker of TIS: " "Most Americans would accept government-imposed key escrow if it was established by law" and subject to judicial review, said Stephen Walker, president of Trusted Systems Inc. [sic] and a former NSA official." ["Congress adds its voice to Clipper debate," George Leopold, "EE Times," 1994-05-09, p. 16] >From these and other articles I continue to believe that several related things are happening: * The Administrations has backed away from the hardware-based, proprietary Skipjack approach that Clipper and EES represented. Though Clipper is not yet officialy dead, its brain wave has flatlined. * The software industry was apparently pressured, based on comments by various people, including Rep. Maria Cantwell (D-Wash) and Sen. Patty Murray. The form and timing of this pressure is not public knowledge, but hints of it keep emerging. * A software-based key escrow system, involving the new Walker-Belenson-others algorithm, is the likely basis for this new "more versatile, less expensive system" that Gore says would be "implementable in software, firmware, hardware or any combination thereof..." Practically speaking, this means software, as the hardware base of machines already out in the world pretty much makes hardware- or firmware-based deployment very problematic...few people will buy new hardware, which is what helped to kill Clipper. * Ostensibly this will be "voluntary," but the "voluntary" part may only be choice from a Chinese menu of approved and licensed escrow agents. [This is my interpretation, reading between the line of a dozen or so articles, articles which quote sources about how "private industry" will provide escrow agents, how choice will be preserved, and how the infamous "legitimate needs of law enforcment" will be preserved. * This compromise will likely put software key escrow (SKE, or Carl Ellison's "GAK"..."Government Access to Keys") into the software for audio and video teleconferencing, communication, and possibly into the OS itself (as this would be needed to ensure wide coverage of installed machines). * The articles suggest Sen. Leahy, Rep. Cantwell, and many others have already accepted this compromise. Enabling legislation could come at any time, and may be closely related to the Digital Telephony Bill, which has had the same behind-the-scenes negotiating. In closing, I reject the point made by Walker, that Americans will accept a "government imposed key escrow if it was established by law." I think this is the real threat on the horizon. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

3 2

Re: e$: Cypherpunks Sell Concepts
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 10:23 AM 8/7/94 -0700, Eric Hughes wrote: >It might be, but remember that in making the case to business, the >financial privacy, such as it exists today, is _not_ "at any time, for >any reason". It might be in the future, but then you're making a >perceived-weaker argument. Ah, my Burroughsian hyperbole strikes again... Gotta get that AJ subroutine fixed... > It might be the threat of > international deployment and regulatory arbitrage which brings them around, > and fires up the lobbying apparatus on our side of the issue. > >With that in mind, shouldn't you have your first conference in London, >invite a bunch of US bankers, and raise the issue explicitly? As soon >as you can get different countries competing for revenue, you're more >than halfway home. One could accuse you wanting to get a "deductable junket" to Europe here ;-), and you might be right about doing it in London, but it seems to me that to present a xenophobic argument to the American banking community, it's best do to that on American soil. Without sounding too parochial, it's entirely possible to incite greed in the international markets with leaving home. I really want to get regulators into the same room, also. The site I have in mind is six blocks from the Federal Reserve Building in Boston. Boston is, you understand, the fulcrum of the universe, even if the long end of the lever finishes up somewhere about Berkeley... > > On the other hand if those reporting > requirements are frictionless, they don't *need* to fight it, do they... > >Nope. And remember, the divide-and-conquer is likely already >starting. The first bank to provide FINCEN with a live transaction >feed will likely see some regulatory hurdles fall, no? JargonQuery(FINCEN?) I'm having fun now. Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

NRO spoof
by paul＠hawksbill.sprintmrn.com 17 Dec '03

17 Dec '03

On the local news this morning (Washington DC) there was a clip with Sen. John Warner expressing his displeasure with how the "intelligence community" has hidden the money for a massive construction effort to house the NRO. The land was bought and permits were applied for under the guise of a development for Rockwell International. There will probably be a follow-up story in this morning's Washington Post. - paul

4 3

IDEA vs DES
by Phil Karn 17 Dec '03

17 Dec '03

Now that I've got DES running about as fast as it can go on the 486, I did a little analysis on IDEA. The algorithm is definitely more straightforward to implement than DES, but not necessarily that much faster. It uses three primitive operations, all on 16-bit quantities: XOR, ADD and multiplication modulo 65537. Each encryption involves 48 XORs, 34 adds and 34 multiplies, plus a few exchanges. The multiplies are a problem. On the 486, a 16x16 integer multiply takes from 13-26 clocks, depending on how many significant bits there are in the multiplicand. Random data usually has 15-16 significant bits, so this distribution is probably weighted more toward the 26 clock figure. So I count an optimistic total of 990 clocks per 64-bit encryption, assuming plenty of registers (which I don't have), not counting the modular reduction steps for each multiply, and ignoring the memory references for the subkeys. I figure my DES code is currently taking about 1300 clocks per encryption. So IDEA won't be much faster, though it may be more secure. Anybody know the speed of the integer multiply instruction on the various PowerPC chips? Along with modular exponentiation and vocoders, which also do a lot of multiplies, it looks like fast multiplication is becoming rather important in secure communications. Phil

5 4

No more NSA supra-computer?
by Jeff Gostin 17 Dec '03

17 Dec '03

Ben.Goren(a)asu.edu writes: > Anybody know what happened to this machine? Did they lose funding? Decide > it's not worth it? Is there some sort of subterfuge involved? Hmmm: "Dear Sir; Here at the NSA, we take National Security very seriously. Persuant to USC 422.932(b), we can pluck out your fingernails for releasing information about our computer resources. Please remove all information and references to and about the National Security Agency from your listing. Sincerely, Sue D. Nym, Agent at Large" True, this is an OBVIOUS spoof, but the point is still there.... --jeff

1 0