December 2003 - cypherpunks-legacy

Re: Standard for Stenography?
by tim werner 17 Dec '03

17 Dec '03

>Date: Wed, 02 Mar 94 22:32:39 PST >From: Jef Poskanzer <jef(a)ee.lbl.gov> > > In a physical meeting, the talkers would >notice the annoyed looks on the faces of everyone else; Don't forget the pleased looks on the faces of people who are glad to see that Jef P is working on stego. :-)

1 0

Re: Quantum mechanics banned
by freeman＠MasPar.COM 17 Dec '03

17 Dec '03

Tim May discusses ESP and quantum cryptography... > I learned all this watching "The X-Files." Well, *I* learned it by watching a crystal ball. -- Jay Freeman

1 0

Re: low-overhead encrypted telnet
by smb＠research.att.com 17 Dec '03

17 Dec '03

Eric Hughes says: > The reason that encrypted telnet is a good thing is that modificatio n > at the network level requires kernel modification, and encrypting a > telnet does not. Installing an encrypted telnet daemon does require > sysadmin cooperation, but it doesn't mean recompiling the kernel. Although running an encrypted IP stack does require sysadmin cooperation, it does not require a kernel rebuild -- John Ioannidis has built modloadable versions of most of the swIPe software. Assuming, of course, that you're running a system that has modload. (Ironically, CERT has recommended that you delete loadable device drivers from systems that don't need them, as a way to guard against password- sniffers.) > As such, encrypted telnet is a good intermediate while the long term > solution of encrypted IP gets developed and deployed. Agreed -- sadly its arriving VERY slowly. 4.4BSD Lite comes with a standards-compliant encrypted telnet implementation, however. What standards? There are no RFCs, nor any current drafts, that define a telnet encryption option. The last draft I saw was from 1991, and Internet drafts expire after 6 months. As I recall, the idea that was being pushed then was to integrate encryption more closely with authentication.

3 2

Re: low-overhead encrypted telnet
by Perry E. Metzger 17 Dec '03

17 Dec '03

smb(a)research.att.com says: > Agreed -- sadly its arriving VERY slowly. 4.4BSD Lite comes with a > standards-compliant encrypted telnet implementation, however. > > What standards? There are no RFCs, nor any current drafts, that define > a telnet encryption option. The last draft I saw was from 1991, and > Internet drafts expire after 6 months. As I recall, the idea that was > being pushed then was to integrate encryption more closely with > authentication. There are much more recent drafts, Steve -- the telnet authentication option is now RFC1409, as of early last year, and the encryption draft is dated April 1993 -- see the nearest internet drafts mirror for a copy. Your recollection of the desire to merge authentication and encryption is correct -- to my knowledge, the new Cray telnet is an implementation of the currently circulated draft (which was also written at Cray). Perry

1 0

RE: PGP on the HP 100
by Carl Ellison 17 Dec '03

17 Dec '03

>Has anyone tried putting ViaCrypt PGP on the HP-100? Is anyone but >me crazy enough to contemplate it? How abysmal is the performance? I may be crazier. I put it on a Mac (660) using SoftPC. It performs about like on a 286. However, that's plenty fast enough for my uses. - Carl

1 0

Re: Virtual Corporations Per Se
by Blanc Weber 17 Dec '03

17 Dec '03

> I've been researching this and related topics (offshore > corporations, non-U.S. banks, mail drops, etc.) and I have many ideas > and questions I'd like to discuss. Is this an appropriate mailing > list or does a superior venue exist? Is there enough interest for a >Don't think so. We better get a new list. .............................................. *I'm* interested ....... not simply to avoid taxes, but to live as a Hitchhiker Citizen of the Galaxy. :>) If a new list is started, you can add my name. ~ Blanc

1 0

Bob Cain's mind switch
by Carl Ellison 17 Dec '03

17 Dec '03

Bob wrote: >The real issue is that this is an *enabling* technology that allows any >group of people distributed over the world to meet spontaneously in >secret to plan anything. I don't think we can even conceive, nor have >they yet, the ways the real Bad Guys (I hope we can agree that some >do exist) might find to use this new ability. A very clear danger is >sensed in Washington with little real benefit to the civilized and >civil majority. There's no question that this is a possibility. It exists. However, Clipper won't make it go away. There's no Daddy to run home to. In fact, this has always been a possibility, unless you believe that all hotel rooms, bus stations, city parks, farmer's fields, men's rooms, women's rooms, ..., are bugged and will continue to be (so that clandestine meetings can be overheard). Now, the next step for the NSA and FBI is to get on the stick and discover ways to counter this threat. Now that PCs permit criminal organizations to create their own strong crypto and worldwide communication allows them to telecommute cheaply, interaction among criminals for planning purposes will be enhanced just as interaction among businesspeople and computer designers is. The world is changing -- as usual -- and LE needs to keep up -- as usual. --------- That isn't hopeless. However, it requires thinking in new ways and I don't expect bureaucrats to be able to do that. Perhaps technical people need to be given a free hand. :-| Maybe the result is that there is no security. For example, we should not expect to achieve more protection from plans laid during electronic meetings than we would achieve from plans laid during physical meetings. ..and, no, I don't believe there should be a law prohibiting private physical meetings. There will *always* be some insecurity. There is always a nut with a gun out there. There are also car accidents. I am not totally safe and would not want to live in a world in which the police are powerful enough to make it that safe. ---------- What I kept suggesting to Dorothy Denning, as this flap was building, was that: 1. the gov't should immediately drop the Clipper proposal because it's alienating people who need to be on the gov't's side; 2. the gov't should actively promote encryption of cellular calls with an untappable algorithm, for the over the air link (with conversion back to clear voice once it hits the cellular office) -- providing the public with trustworthy security, addressing the public's biggest security threat and therefore reducing the market demand for encryption which interferes with wiretaps; and 3. the LE and intelligence community should recognize that the world has changed beyond the point of no return, thanks to the PC and to communications technology, and there is no way to prevent criminals from using totally secure cryptography to aid in their plans. Criminals have always had access to strong cryptography for their communications (cf., Kahn talking about the rum runners, for example (Elizabeth Friedman's efforts as a cryptanalyst)) and the world hasn't fallen apart yet. However, the PC and high speed digital communications mark a slight change in the landscape and these changes need to fuel some good, creative, technical work -- not a bureaucratic running-scared retreat to an impotent "there oughtta be a law". I don't know if it's too late, thanks to the FBI and NSA serious alienation of people (like us) who matter. It might be. Once they declared war on us, it's unlikely to expect us to suddenly look at them as good guys. However, if they followed my 3 step plan right now, they'd have a chance still -- at least, I believe they would. - Carl

1 0

ALERT: UK anti-porn network proposal
by russw＠netcom.com 17 Dec '03

17 Dec '03

The author of the following notice is in a sensitive vocational position, and has asked me to post the following... ###BEGIN### A Home Office press release issued on 15 Feb 94 announces the intention of the Home Secretary to crack down on computer-distributed pornography. Accordingly, last week the government introduced an amendment to the Criminal Justice and Public Order Bill which is pending before Parliament. The new clause in the Bill would amend the definition of *publication* in the Obscene Publications Act 1959. It is currently considered *publication* of a pornograph image if one *record, shows, plays, or projects it.* The proposed amendment would change this to read: ... record, shows, plays, or projects it, or, where the matter is stored electronically, transmits that data. The problem, of course, is that there is no definition of what it means *to transmit* pornographic data. There is no distinction drawn between primary and secondary transmission. This could mean that bulletin board sysops, commercial sites with Usenet feeds, and even BT, could ALL be engaged in the *transmission* of pornographic data. If this is correct, then people in the position of innocent intermediary would have to rely upon a defense of *innocent dissemination*, much like that found in UK defamation law. Essentially, if the police could show that pornographic images had passed over one's computer equipment, then one would have to prove that he *had not examined the [pornographic] article and had no reasonable cause to suspect* that its publication was illegal. Aside from being in the uncomfortable position of having to prove one's ignorance, the *reasonable cause* language may imply a duty to inspect certain data in a vain attempt to see if it contains pornographic images. This especially could be true where one provides a data feed to a known past-pornographer. It is not entirely clear why the Home Office thinks that this amendment is necessary. If the intention is to catch commercial pornographers, it would appear that *record* should include recording to CD-ROM or into RAM. Likewise, *play* should catch purchasers. The justification might be that proof of recording and playing is much more difficult than proof of transmission. CAVEAT: This discussion does not include radio and television broadcasts. There is a seperate section of the Act which specifically addresses this area. It is not clear whether or not the proposed *transmits* language would have any effect upon that section, but presumably it could. It is difficult to believe that large players like BT, Mercury, CompuServe, etc, will let this pass without a fight. It could also be, however, that they are unaware of the possible ramifications of the proposed amendment. ###END### [I will forward responses to this message. - Russell] Russell Earl Whitaker russw(a)netcom.com Director, Extropy Institute 408-366-5435 ================================================================

1 0

Re: Clipper/Skipjack
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>just a quick note to tell you all that I just read an editorial in >info security by John Droge. >Anyway, I was wondering why any sane, 1/10 intelligent person would be >defending the Clipper chip...then I read his bio...he is a VP at >Mykotronx. He is also the marketing manager for CLIPPER/CAPSTONE

1 0

'Nother possible Stego place...
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

It's a bit of a hack, but don't most char implementations in C just ignore the high-order bit? --Alan Wexelblat, Reality Hacker, Author, and Cyberspace Bard Media Lab - Advanced Human Interface Group wex(a)media.mit.edu Voice: 617-258-9168 Page: 617-945-1842 na53607(a)anon.penet.fi We are Chaos Boys. We are coming to a paradigm near you.

2 1