December 2003 - cypherpunks-legacy

Re: RoboFest 5
by jim＠Tadpole.COM 17 Dec '03

17 Dec '03

The T1 line isn't absolutely 'there' .. yet. We're fighting SW Bell.

1 0

Proposal: Another emergency session of Cypherpunks
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Summary: Maybe it's time for another emergency session of Cypherpunks to discuss policy in the aftermath of the double whammy announcements of Tessera/Clipper II and the new and even more dangerous Digital Telephony Bill. After the Clipper announcement last April, we had a special emergency meeting of Cypherpunks. Heavily attended, lots of discussion. This time around, we most knew things like Tessera and a new Digital Telephony Bill were coming, but the actuality of them has now been made real. The "ban on encryption" hasn't yet happened, but more and more roadblocks (another digital highway stupid metaphor?) are being erected. For example, any service provider, university network, hardware maker, etc., who fails to make transmissions "readable" faces $10,000 a day penalties under my reading of Digital Telephony. This could make an awful lot of service providers wary of _anything_ that doesn't look like plain old English chitchat...they may just cancel the accounts of anyone doing anything "funny." (Yes, there are probably ways to skirt these reactions, but it means pushing encryption underground, into tricks using stegonagraphy, superencryption, and less publicizing of one's PGP keys. Not a good thing. I agree with Perry Metzger that _public use_ or encryption is the best approach, practically and morally. Hiding the use of it keeps it "ghettoized.") So, I propose that we reorient our next Cypherpunks meeting (Saturday, March 12th, I presume) to deal with these issues. Some topics: * Legal overview of the Digital Telephony Bill. If Mike Godwin could link up with the other D.C.-area folks (Pat Farrell, Paul Ferguson, etc.), and then have a link to our meeting, this would be ideal. * When could Digital Telephony become law and what would be the implications? * Ditto for Tessera, Capstone, etc. * Status of Voice-PGP efforts....when will SoundBlaster-type software be available? What about encrypted IP packets on workstations instead? (Recall the impressive DES-encrypted conference call the 3 Cypherpunks groups had at the emergency Clipper meeting last April.) (I've heard talk--no pun intended--of several "Voice-PGP" projects, using SoundBlaster hardware, CELP, DSPs, etc., but no software seems to be available right now. How much longer do we have?) * How to fight these proposals, or work around them. It'd also be nice if some of the outlying groups (Cambridge, MA, Washington, D.C., London, Colorado, Austin) could link up with us at least briefly. (If we started at noon, California time, that would be fine for the East Coasters, but 8 or 9 p.m. for the Londoners....does the London group still meet?) This is just an idea. Let's discuss it. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

4 3

Party with the Nextropians! at Nexus-Lite!
by plaz＠netcom.com 17 Dec '03

17 Dec '03

MEET THE NEXTROPIANS: WE ARE HERE AND NOW AMONG YOU __________________________________________________________________________ Romana Machado - Geoff Dale - David Gordon - Nick Szabo - Russell Whitaker We can't call ourselves Nexus-Lite any more. When Dave Gordon moves in, we'll have tied the most populous nexus* of all recorded history. The residents of Nexus-Lite (but getting heavier by the minute), an Extropian intentional community, invite you to a Nexus Naming Potluck Party. Prizes for the best name for our Nexus will be awarded. We are also celebrating Housemistress Romana's appearance in WIRED and bOING bOING, describing her excellent shareware program, Stego! Thanks for your excellent articles, Sandy! Dress for the future, bring a friend. Flip a coin; heads bring food, tails bring drink. When: Saturday, March 12, 1994, 7.p.m (after the Cypherpunks meeting, until an indeterminate time on the following day) Where: 21090 Grenola Drive, Cupertino CA (See Obligatory Crude Ascii Map Attached Below) Tel: (408) 253-1692 *nexus (neks-us) n. A place where extropians** live in comfort for mutual profit, and work on extra credit assignments without fear of reprisal. **extropian (eks-tro-pee-an) 1) n. A boundlessly optimistic futurist who will live forever or die trying. 2) n. Exactly like a human, only much, much better. 3) n. A champion in the war against entropy. 4) adj. Any way cool thing an extropian would like. nextropian (neks-tro-pee-an) 1) n. An extropian who lives in a nexus. 2) Welcome to the Next Level. DIRECTIONS: Nexus-Lite is located at 21090 Grenola Drive in Cupertino. Geoff Dale's phone number (in case you get lost) is 408-253-1692. >From 280: Take the Saratoga/Sunnyvale (Or DeAnza Blvd, its all the same thing) Exit (which is actually the 85 South detour). Turn north on DeAnza (aka Saratoga/Sunnyvale Road) at the exit (a left turn if you are coming from San Francisco; right if you are coming from San Jose). Turn left at Homestead; go three blocks to N. Stelling, take left (at the McDonalds). (Note: North Stelling is called Hollenbeck on the other side of Homestead. Don't be fooled!) >From 101: Take 85 south and exit at Homestead; turn left onto Homestead. Proceed several blocks (you will pass a high school); then turn right on N. Stelling. Once on N. Stelling: Right at first light: Greenleaf First left, Flora Vista First Right on to Grenola Dr 21090 (mnemonic: anagram for Beverly Hills zip code) is a tannish house on left with a high roof that slopes toward the street. Park on the street -- in the direction of traffic, or you may get a $15 ticket. This has happened. OBLIGATORY CRUDE ASCII MAP (not to scale; up is not north): /\ || ^ ^ || (85) | | || | | || |Hollenbeck | /|| | | <----++---/ /-- (Homestead) ---+------------------+------------------> || | | || |N.Stelling | || | | || | DeAnza|Saratoga/Sunnyvale || | | <=========/ /== (280) =======] | [================+==================> || | || | || ^ | || | | Greenleaf \/ <----------+-------+-----------------> | | Flora Vista| | | | | | Grenola | | <-------------+ | *=21090 | | | | V V Excelsior! Forward, onward, upward, outward, and every which way but loose! Once more into the future dear friends!

1 0

Re: standard for stegonography?
by Jef Poskanzer 17 Dec '03

17 Dec '03

On reflection, it seems that some users will want an interoperable standard, and other users will want complete stealth. So what I'll do is add a bunch of switches to pnmstego and pnmdestego, so that the user can specify all sorts of different formats. Letting the switches default will get you a simple interoperable mode, so you can send stuff to people without prior arrangement or put stuff on an ftp server; but an attacker will be able to extract the bits and try to decrypt them. Specifying things like offsets and bit-usage schedules will mean that the attacker won't even be able to extract the bits; but the settings you use will be equivalent to that much more key material that you have to communicate or remember. --- Jef

2 1

More crypto in real life...
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

[The following is excerpted from RISKS digest. I have sent mail to Valente asking him to be more specific about what kind(s) of encryption they use for their authentication routines. I am slighly worried by the somewhat naive statments in this posting. --AW] Date: 17 Jan 1994 20:09:29 -0800 From: "Luis Valente" <luis_valente(a)genmagic.genmagic.com> Subject: Safety in Telescript Phil Agre's message of January 6th ("Wild agents in Telescript?") brings up some very good points. In this message I would like to describe some of the safety features of Telescript that are used to prevent both ill-intentioned scripts (e.g., worms, viruses) and buggy scripts from damaging a Telescripted network. 1) The Telescript language is interpreted, rather than compiled. Thus, Telescript programs cannot directly manipulate the memory, file system or other resources of the computers on which they execute. 2) Every Telescript agent (i.e, Telescript program that can move around a Telescript network) is uniquely identified by a telename. A telename consists of two components: an authority which identifies the "owner" of the agent (e.g., the Personal Communicator from which it originated) and an identity which distinguishes that agent from any other agent of the same authority. The authority component is cryptographically generated and cannot be forged. Thus, when an agent is transferred from one Telescript engine to another, it is possible to verify (using cryptographic techniques) that the agent is indeed of the authority it claims to represent. (N.B.: a Telescript engine is a program capable of interpreting and executing Telescript programs). 3) Every Telescript agent has a permit which limits its capabilities. Permits can be used to protect users from misprogrammed agents (e.g., an agent that would otherwise "run away" and consume resources for which the user would have to pay) and to protect Telescript service providers from malicious agents. Two kinds of capabilities are granted an agent by its permit. The first kind is the right to use a certain Telescript instruction, e.g., the right to create clones of itself. The second is the right to use a particular Telescript resource and by which amount. For example, an agent is granted a maximum lifetime, a maximum size and a maximum overall expenditure of resources (called the agent's allowance), measured in teleclicks. An agent's permit is imposed when the agent is first created and is renegotiated whenever that agent travels to an engine controlled by a different administrative authority. If the agent exceeds any of its quantitative limits, it is immediately destroyed by the Telescript engine where it is executing. 4) Telescript agents move around a Telescript network by going from one Telescript place to another. Telescript provides an instruction -- go -- that gives agents this travelling capability (if granted by their permit, of course). Places are Telescript programs in their own right. Before accepting an incoming agent, a place can examine the agent's telename, permit and class (N.B.: an agent represents an instance of a Telescript class; thus, the class of the agent represents the "program" that the agent executes. Like authority names, class names cannot be forged). Based on that information, the place can do any the following: a) Do not allow the agent to enter. b) Allow the agent to enter but only after imposing upon it a permit more restrictive than the one it currently holds (e.g., the agent is only allowed to consume 100 teleclicks while in this place). c) Allow the agent to enter and execute under its current permit. 5) When a Telescript process (agent or place) interacts with another Telescript process, the telename and class of the former is available to the latter. This enables Telescript applications to control who can interact with them and in what ways. I hope this (brief) description of some of the more pertinent security features of Telescript will help Risks readers understand how we've addressed the issues raised in the NYT article and in Phil's message. -Luis Valente, General Magic, Inc. ------------------------------

1 0

Anyone looked at this report?
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

[Again cribbed from RISKS... --AW} From: "Lance J. Hoffman" <hoffman(a)seas.gwu.edu> Subject: crypto policy report available online The following report is available by anonymous ftp from ftp.gwu.edu under directory /pub/hoffman. The document is stored under the name "cryptpol". It is a NIST-sponsored study. The table of contents and abstract follows here. CRYPTOGRAPHY: POLICY AND TECHNOLOGY TRENDS Lance J. Hoffman, Faraz A. Ali, Steven L. Heckler, Ann Huybrechts December 1, 1993 CONTENTS EXECUTIVE SUMMARY 1. INTRODUCTION 2. TECHNOLOGY 3. MARKET ANALYSIS 4. EXPORT CONTROLS 5. PUBLIC POLICY ISSUES 5.1 EXECUTIVE BRANCH 5.2 CONGRESS 5.3 TRENDS 6. POTENTIAL SCENARIOS EXECUTIVE SUMMARY During the past five years, encryption technology has become easily available to both individuals and businesses, affording them a level of security formerly available practically to only military, national security, and law enforcement agencies. As a result, a debate within the United States about the proper balance between national security and personal freedom has been initiated. Law enforcement and national security agencies would like to maintain tight control over civilian encryption technologies, while industry and individual and privacy rights advocates fight to expand their ability to distribute and use cryptographic products as they please. This report analyzes trends in encryption technology, markets, export controls, and legislation. It identifies five trends which will have a strong influence on cryptography policy in the United States: * The continued expansion of the Internet and the progressive miniaturization of cryptographic hardware combined with the increasing availability and use of strong cryptographic software means that the strongest encryption technologies will continue to become more easily obtainable everywhere in the years ahead. * Additional growth in networked and wireless communication will fuel a strong demand for encryption hardware and software both domestically and abroad, causing the U. S. high-technology industry to be increasingly interested in selling encryption products overseas and in modifying current export restrictions. * Due to the responsibilities and bureaucratic dispositions of key Executive Branch agencies, products using strong encryption algorithms such as DES will continue to face at least some export restrictions, despite the widespread availability of strong encryption products overseas. * The American public is likely to become increasingly concerned about its privacy and about cryptographic policy as a result of the increased amount of personal information available online and the growing number of wireless and networked communications. The development and increasingly widespread use of the National Information Infrastructure will heighten these concerns. * Encryption policy is becoming an important public policy issue that will engage the attention of all branches of government. Congress will become increasingly visible in this debate due to its power of agency oversight and its role in passing laws accommodating the United States' rapid rate of technological change. Agencies will remain very important since they have the implementing and, often, the planning responsibilities. Since individuals and industry have more direct influence over Congress than over most other branches of government, Congress may place somewhat more emphasis on personal freedom than many other government actors. Four potential scenarios are likely: mandatory escrowed encryption, voluntary escrowed encryption, complete decontrol of encryption, or domestic decontrol with strict export regulations. Professor Lance J. Hoffman, Dept of EECS, The George Washington University (202) 994-4955 Washington, D.C. 20052 hoffman(a)seas.gwu.edu Fax (202) 994-0227 ------------------------------

1 0

[julf@penet.fi: Re: VIRTUAL meeting needed]
by joshua geller 17 Dec '03

17 Dec '03

>> Instead, perhaps we need to organize for another virtual meeting again. >> With a little more organizing, it would go smoother. >How about trying IRC this time? be something worthwhile on irc for once. and people would be there who wouldn't otherwise (like me). josh

1 0

Nuclear Capone in Russia?
by nobody＠jarthur.claremont.edu 17 Dec '03

17 Dec '03

Los Angeles Times, Saturday, Feb. 26, 1994, p.A10 FBI Director Sees Parallels Between Russia Now, Chicago Then Crime: Louis J. Freeh doesnÕt want a Slavic Al Capone to endanger U.S. investments or undermine the fragile democratic process. And he is working to help prevent it. By Ronald J. Ostrow Times Staff Writer Washington - To FBI Director Louis J. Freeh, organized crime in Russia today bears disturbing similarities to ChicagoÕs in the 1920s and 1930s - violent but fractionalized, a danger to itself as much as to the rest of society, and with a potential for much more. The likes of Al Capone, unchecked by the FBI or any other law enforcement body, welded the Chicago mob into a unified force that preyed on the community for decades. Freeh does not want a Slavic equivalent of Capone to do the same today in Russia, for fear not only of endangering American Business activity there but also of undermining that countryÕs fragile democratic process. And he is working to help Russian authorities prevent it. Already, Freeh said, elements of Russian organized crime are responsible for everything from "bushwhacking" American businessmen to dealing in materials that could be used in nuclear weapons. If authorities do not act soon, he said, organized crime will become so entrenched throughout the former Soviet Union and its Eastern European satellites that, like the Mafia in Chicago, it will take decades to remove it. "We have to look at it as something that's clearly directed toward the United States, toward our economy," Freeh said in an interview. "Even with decreasing resources, we can't afford to do what the FBI did with respect to La Cosa Nostra for 30 years, and that was to completely ignore it." The situation in Russia today, Freeh acknowledged, is not as dire as in Chicago in the 1920s and 1930s. But German and Russian law enforcement authorities "are concerned about the very rapid inroads that these gangs are making into officialdom, into police and government officials," the FBI director said. To help the Russians cope, Freeh wants to station up to three FBI agents in Moscow by the end of spring to serve as liaisons with Russian authorities. Contacts are now handled largely by two agents based in Bonn, who have responsibilities beyond the former Soviet Union. Authorities in Russia's Interior Ministry and the Moscow police "are desperately in need of our help," Freeh said. "They want our training, our methodology." He also wants to bring Russian agents for 11 weeks of training at the FBI's National Academy in Quantico, VA., where they would learn about laboratory and computer work and the other technologies that the FBI uses against organized crime. For now, Freeh said, the victims of Russia's organized crime are mostly Russian Entrepreneurs and other business people. But he warned that American businesses seeking a foothold in Russia are just as vulnerable. "Part of the [Clinton] Administration's program is to give not only economic aid but to [assist] economic institution-building and to encourage American and other foreign investments" in the former Soviet Union, he said. "If the scouts for leading American corporations are getting bushwhacked in their hotel rooms in Moscow or, perhaps worse, establishing a foothold and having to face extortion and economic criminal activity they are not prepared to do, our economy takes a serious hit," Freeh said. "The end product is that the process for democracy and a free economy in Russia takes a very significant step backward. "I guess it's an irony, but it's much harder to police in a democratic fashion than than to police in a totalitarian fashion," Freeh said. "Police work is very hard if you do it according to due process and democratically." Authorities in the former Soviet Union "don't have that experience and haven't had it for 70 years. So they're having to learn all of the tools, skills and techniques and, at the same time, deal with a burgeoning crime crisis," Freeh said. U.S. authorities are particularly concerned that Russian gangs "are aggressively looking to buy and sell nuclear materials," the FBI director said. The materials so far are less than weapons grade, but they could be used for designing devices deadly to population centers, according to FBI intelligence. "That's a whole different threat than we've faced before," Freeh said. He declined to give any more specifics on the threat, but said the United States under the law now lacks authority to fully deal with it. Under the 1950 Atomic Energy Act, the FBI has authority to investigate the transfer or shipment of nuclear materials only if their origin or destination is American or they have entered and left the United States. Freeh said he has discussed with Atty. Gen Janet Reno and other Justice Department officials the need for a law broadening the FBI's authority over such matters. The FBI is also interested in the criminal activities of Russian immigrants in the United States, according to Jim Moody, who directs the FBI's efforts against organized crime. In the late 1970's and early 1980's, about 200,000 people entered the United States from the Soviet Union, and Moody estimated that about 1% of them - 2,000 - were "hard-core criminals." But he regards them as second-string players who are now being replaced by more highly skilled, educated lawbreakers. In one of the more sophisticated conspiracies involving Russian emigres, a federal grand jury in Philadelphia last June charged 15 people and two corporations with evading federal and state excise taxes on the sale of more than 51 million gallons of diesel fuel in Pennsylvania and New Jersey.

2 1

Re: Newsday Editorial
by bsteve＠zontar.attmail.com 17 Dec '03

17 Dec '03

Dorothy: We have not been formally introduced. My name is Steve Blasingame. I am a long-time proponent of quality encryption systems for both private and commercial communications. I am also a long-time employee of The AT&T Company responsible for AT&T-GIS strategies, programs and products in internetworking. I am very pleased that AT&T is manufacturing the "Clipper Phone" product and believe that "Clipper" is an enabling technology for government and business. However, I must challenge the basis of your "Newsday" editorial as false. >" The Clinton administration has adopted the chip, which would allow >law enforcement agencies with court warrants to read the Clipper codes >and eavesdrop on terrorists and criminals." It would be great if this were true, but it is false. Criminals and terrorists operate outside the confines of the law and are not obliged to use encryption schemes sanctioned by statute. >" But opponents say that, if >this happens, the privacy of law-abiding individuals will be a risk. >They want people to be able to use their own scramblers, which the >government would not be able to decode." Given that criminals would not be obliged to use the statutory method of encryption, what other purpose could be served by such a technology enforced by law? " If the opponents get their way, however, all communications on the information highway would be immune from lawful interception." It is clear that the security of communications on the information highway is an important issue. However, as a corporate citizen, I am more concerned about the un-lawful monitoring of communications and do not consider that there is a sufficiently robust encryption technology to make a statutory encryption standard workable for more than a few years. >" But then who would have >thought that the World Trade Center bombers would have been stupid >enough to return a truck that they had rented?" I think that this qualifies as an appeal to ignorance. "Can you prove it isn't true?" >"... Lawlessness would prevail." If you examine definition 3 from the latest edition of the "American Heritage Dictionary" in your study, you will find that "Lawless" means "not governed by law." This is certainly a law that we can all do without. Very truly yours, Steve Blasingame bsteve(a)zontar.com

1 0

Mailing list software losing posts
by Matthew J Ghio 17 Dec '03

17 Dec '03

The list software seems to be having problems again. I sent the below post to the list three times, and it never got sent out. But since another post from me just showed up, maybe it's working now... (Let me know if you got more than one copy, because I sure didn't.) ----- To: cypherpunks(a)toad.com Subject: Re: lists of U.S. cypherpunks and Tentacles. CC: Matthew J Ghio <mg5n+(a)andrew.cmu.edu> In-Reply-To: <9402260131.AA08270(a)toad.com> References: <9402260131.AA08270(a)toad.com> Date: Sat, 26 Feb 1994 11:34:54 -0500 (EST) From: Matthew J Ghio <mg5n+(a)andrew.cmu.edu> mg5n+eaibiubkxb58z84cy2iaf9r61u26ra5x26mc0h(a)andrew.cmu.edu wrote: > Please add me to your list. As you can see, I clearly have > a US-based email address. :) hehe... This didn't come from my site tho. It looks like a clever port 25 hack. However, the return address is valid. I suppose this points out another problem with the US export laws: How can you know where a message came from? As the above example shows, there is really no way to know where the person you're communicating with is. In other words, you can't not break the US export laws. All you have is someone's word that they are in the US or not, but you really can't know for sure. Something to mention in your letters to Rep. Cantwell. > -Ibiu Cute... using part of your encrypted address as a handle? I never thought of doing that... hmm...

3 3