December 2003 - cypherpunks-legacy

Clipper
by tomh＠bambi.ccs.fau.edu 17 Dec '03

17 Dec '03

If the govt and all its agencies used Clipper for all their communications, they would be vulnerable to attack from foreign govts that have bought the keys from spys. Despite being in escrow, I can't imagine they are really as secure as everyone seems to think. If random govt agencies can get the keys for legal wiretaps, spys will also be able to do so. Does Clinton have the right to listen in on NSA communication? If he tried he might find that they aren't using Clipper internally (or that they keys aren't in the proper escrow locations).

3 2

Re: Mac encryption
by Ron Davis 17 Dec '03

17 Dec '03

>> From: Ron Davis <rondavis(a)datawatch.com> >The invention (discovery?) of public-key crypto changed the world, and >makes practical everyday use of crypto infinitely easier. It also makes >the kinds of specific things cypherpunks are interested in much more >practical (or POSSIBLE). If you correspond with hundreds of people on a >regular basis, including people you don't know and people you may send >something to once and never deal with again, it is impractical to say the >least to have to generate and exchange keys. That's the basic argument. >Why was public key crypto invented at all? Why are people interested in >using it? Practically, it's really fundamentally different from symmetric >crypto, which is of very limited use in the situation we're all in now >(anonymous communication, the net, quick hit-and-run dissemination of >information, digital signatures, etc., etc.). PGP also has the "web of >trust" structure built in. This is worlds away from basic symmetric >crypto. > >This is really basic stuff, so I'm hesitant to discuss it on the list. I wasn't saying that PK wasn't important, or the most important. I agree it is a great thing. I was just saying that I thought cypherpunks was also about non-PK crypto. I also ventured to think it wasn't just about PGP, but all crypto used for purposes of insuring individual freedom and privacy. >> Maybe I have the wrong idea about "our purposes", please correct me >> if I'm wrong. > >If you're relatively new to the list, try to get your hands on some of the >basic cypherpunk material, like tcmay's Crypto-Anarchy manifesto, the >cypherpunk articles in Wired or Whole Earth Review, etc. There are many >different views represented on the list, but I think we all agree on the >significance and importance of pk crypto. I read the Wired article. I've also read the FAQ. Missed May's manifesto is it available via ftp? > >Symmetric is fine for hiding things from your boss. PK is intended for >different purposes. But isn't hiding things from your boss important in the cypherpunks worldview, even if people choose not to use PGP? Seems to me that the fact is many, if not most, people will not use PGP because of is outlaw status. Many of us are attracted to it because of that, but many people aren't. We can still advocate methods that people are comforatable with that will further our goals. If I'm wrong about the very basics of the list, then I guess this discussion is good, because I've been around for a couple of months at least and this is the idea I got. ___________________________________________________________________________ "I want to know God's thoughts...the rest are details." -- Albert Einstein _________________________________________ Ron Davis rondavis(a)datawatch.com Datawatch, Research Triangle Park, NC (919)549-0711

1 0

Disinformation
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

The Net is growing rapidly. As it grows it will become more signifigant in our world(transaction of digital cash, etc.) Security will become more of a neccesi ty(lets face it MOST people don't need encryption) If Clipper is widely impleme nted (be it voluntary or forced) people will be looking over their shoulders and righ tfully so. Also, i feel that the structure of the Internet is likely to change( It's present structure is not a good base to build on) when the cahnge occurs do n't you think Clipper is going to become the "standard." Reuben Halper -anger is a gift- rage against the machine/freedom

1 0

Re: Disinformation (or the Truth?) About Clipper
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Tim May writes: > My use of the term "disinformation" seems to have taken on > a life of its own as "lying," with several posters saying > that the truth is best, that lying is bad, and that if we > have to lie we deserve to have Clipper and Capstone! > > What I urge--and others are free to do as they wish--is to > "educate" people by describing to them the implications > as we see them. That is, we who have thought about Clipper > and have seen past government depredations and abuses, > have seen from the beginning how Clipper is likely to be > abused, how the very concept of key escrow is anathema to > basic rights, how Clipper and its Big Brethren (I just > coined this) are likely to be made mandatory, etc. We see > truth, not the charade of "voluntarism" and the "social > need" cited by the authorities. > I'm quite satisfied with this clarification (as if it matters to any but me). Still, I believe labeling your efforts a "disinformation campaign" was a mistake. It gives the pro-Clipper people something to throw back in your face. How about changing "disinformation campaign" to "education campaign"? It has a more positive sound to it and doesn't limit you to only dry facts. Education through speculation, hyperbole, and satire can be effective and is ethical if the reader can recognize when you are engaging in speculation, hyperbole, or satire (my opinion, of course). Jim_Miller(a)suite.com

2 1

Re: Why only public-key crypto?
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

>I find this to be a strange statement. Do we have no interest >in non-public key methods? Seems the Cypherpunks should have >an interest in all forms of crypto. It's not so strange. Cypherpunks are trying to bring about social changes, not primarily technological ones. Crypto is here, and we want to change our culture in a way where, through strong crypto, privacy becomes the norm rather than the exception. With this goal in mind, public-key systems are vastly more interesting because they are the `social' solutions. Scott Collins | "That's not fair!" -- Sarah | "You say that so often. I wonder what your basis 408.862.0540 | for comparison is." -- Goblin King ................|.................................................... BUSINESS. fax:974.6094 R254(IL5-2N) collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2D Cupertino, CA 95014 ..................................................................... PERSONAL. 408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

quetion about Multi-user systems
by Grand Epopt Feotus 17 Dec '03

17 Dec '03

I myself have a Linux system at home, all set up with PGP and rather secure from outside thrats since it is unconnected from the net except for when I dial-up. I was wondering what strategies some people use in order to make it easier to write and respond to mail. I dont feel like writing a message at home, encrypting it and then U/Ling it to my acount and mailing it. Is there another wya to use PGP on my mail account wihtout severely reducng mysecurity? I know the Sysop can read my secring etc.. at any time and can also intercept my passkey for my secring, BUT I would still like to perhaps use a low security key from my Unix account and then have a high security key on my home system that is very safe. The problem is, figuring out which message goes to where and all. Could someone with extnsive knowledge of PGP use on a Unix system help me out here>? You're eqipped with a hundred billion nueron brain, that's wired and fired, and it's a reality generating device, but you've got too do it. Free youself ----Tim Leary----

1 0

Dorthoy Denning editorial, Newsday
by Matt Blaze 17 Dec '03

17 Dec '03

Note: I'm just passing this on. I am only the messenger. ------- Forwarded Message Return-Path: research!cs.georgetown.edu!denning Received: from big.l1135.att.com by codex.UUCP (4.1/4.7) id AA26751; Wed, 23 Feb 94 16:18:14 EST Received: from research (research.research.att.com) by big.l1135.att.com (4.1/4.7) id AA08487; Wed, 23 Feb 94 16:18:13 EST Posted-Date: Wed, 23 Feb 1994 16:16:09 -0500 (EST) Received: by ninet.research.att.com; Wed Feb 23 16:17 EST 1994 Received: from cs (cs.cosc.georgetown.edu) by guvax.acc.georgetown.edu (PMDF V4.2-11 #5850) id <01H98BXBMQA88YCH3A(a)guvax.acc.georgetown.edu>; Wed, 23 Feb 1994 16:16:33 EST Received: from chair by cs (4.1/SMI-4.1.2) id AA01896; Wed, 23 Feb 94 16:16:09 EST Date: Wed, 23 Feb 1994 16:16:09 -0500 (EST) From: denning(a)cs.georgetown.edu (Dorothy Denning) Subject: Newsday Editorial Errors-To: Postmaster(a)cs.georgetown.edu Message-Id: <9402232116.AA01896@cs> Content-Transfer-Encoding: 7BIT ====================================================================== | Newsday, Tuesday, February 22, 1994, Viewpoints | ====================================================================== The Clipper Chip Will Block Crime By Dorothy E. Denning Hidden among the discussions of the information highway is a fierce debate, with huge implications for everyone. It centers on a tiny computer chip called the Clipper, which uses sophisticated coding to scramble electronic communications transmitted through the phone system. The Clinton administration has adopted the chip, which would allow law enforcement agencies with court warrants to read the Clipper codes and eavesdrop on terrorists and criminals. But opponents say that, if this happens, the privacy of law-abiding individuals will be a risk. They want people to be able to use their own scramblers, which the government would not be able to decode. If the opponents get their way, however, all communications on the information highway would be immune from lawful interception. In a world threatened by international organized crime, terrorism, and rogue governments, this would be folly. In testimony before Congress, Donald Delaney, senior investigator with the New York State Police, warned that if we adopted an encoding standard that did not permit lawful intercepts, we would have havoc in the United States. Moreover, the Clipper coding offers safeguards against casual government intrusion. It requires that one of the two components of a key embedded in the chip be kept with the Treasury Department and the other component with the Commerce Department's National Institute of Standards and Technology. Any law enforcement official wanting to wiretap would need to obtain not only a warrant but the separate components from the two agencies. This, plus the superstrong code and key system would make it virtually impossible for anyone, even corrupt government officials, to spy illegally. But would terrorists use Clipper? The Justice Department has ordered $8 million worth of Clipper scramblers in the hope that they will become so widespread and convenient that everyone will use them. Opponents say that terrorists will not be so foolish as to use encryption to which the government holds the key but will scramble their calls with their own code systems. But then who would have thought that the World Trade Center bombers would have been stupid enough to return a truck that they had rented? Court-authorized interception of communications has been essential for preventing and solving many serious and often violent crimes, including terrorism, organized crime, drugs, kidnaping, and political corruption. The FBI alone has had many spectacular successes that depended on wiretaps. In a Chicago case code-named RUKBOM, they prevented the El Rukn street gang, which was acting on behalf of the Libyan government, from shooting down a commercial airliner using a stolen military weapons system. To protect against abuse of electronic surveillance, federal statutes impose stringent requirements on the approval and execution of wiretaps. Wiretaps are used judiciously (only 846 installed wiretaps in 1992) and are targeted at major criminals. Now, the thought of the FBI wiretapping my communications appeals to me about as much as its searching my home and seizing my papers. But the Constitution does not give us absolute privacy from court-ordered searches and seizures, and for good reason. Lawlessness would prevail. Encoding technologies, which offer privacy, are on a collision course with a major crime-fighting tool: wiretapping. Now the Clipper chip shows that strong encoding can be made available in a way that protects private communications but does not harm society if it gets into the wrong hands. Clipper is a good idea, and it needs support from people who recognize the need for both privacy and effective law enforcement on the information highway. ====================================================================== | Copyright Newsday. All rights reserved. This article can be freely | | distributed on the net provided this note is kept intact, but it may | | not be sold or used for profit without permission of Newsday. | ====================================================================== ------- End of Forwarded Message

1 0

Re: Digitally Signing Physical Objects
by Hal 17 Dec '03

17 Dec '03

Tim has an interesting point on the use of digital signatures. A variation is to use an "undeniable" signature. This is a signature which can only be checked with the cooperation of the signer. However, the protocol is such that the signer cannot cheat and try to deny a valid signature (hence the name). This could be used by manufacturers to authenticate their products only to certain customers; for example, to customers who have paid for them. This might be especially useful for software, although Tim's idea would extend it to any object for which the authentication is especially valuable. PGP is distributed signed by Phil Zimmermann using an ordinary digital signature. This allows anyone to verify that it is a good package, free of viruses or trap doors. If it instead had an undeniable signature, this verification would require interacting with Phil (or his agent) via a protocol; but at the end the same assurance would result. This kind of signature would be more appropriate with a payware product. Undeniable signatures cannot be passed on from one person to another. If Alice verifies Bob's undeniable signature, she can't prove to Charlie that the signature is good. She can claim it is good, and assure Charlie that it is good based on her own reputation, but Charlie can in general not be convinced unless he verifies it himself directly with Bob. Hal

2 1

NIST Crypto Update (fwd) - a Feb 4 doc we somehow missed...
by Stanton McCandlish 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Give me your privacy and I will protect you.
by Michael Johnson 17 Dec '03

17 Dec '03

The following letter was received anonymously via USPS, postmarked "SUBURBAN MD MSC 206, 19 FEB 94 PM, and printed using an HP DeskJet printer in 12 point courier type. I thought that I would share it with you, not because I agree with it (I don't), but because I thought that it was interesting that it has been the ONLY comment I have received on my paper that expressed disagreement. Note that the entertaining mis-spelling of "imperfect writing" is the original author's, and not mine. For a copy of the paper I refer to, ftp csn.org:\mpj\cryptusa.* or see my posting in alt.privacy and talk.politics.crypto **************************************************************** TO: Michael Paul Johnson Re: Data Encryption Software and Technical Data Controls in the United States of America Read your document. You made very sweeping statements. Obviously, you are not an expert for all the material addressed. Educated people, when not an expert, cite to references for positions articulated in a paper. One example of your imprefect writting style is the "law enforcement" section. You never mentioned or solved the law enforcement community's efforts in detecting the transfer of illegal drugs. Your paper needs a major rewrite. FROM: Not Impressed **************************************************************** I won't waste time on a rebuttal. I just want to say that I consider traffic in harmful drugs to be a major problem. I'm not willing to give up my Constitutional rights in the War on Drugs, but I am glad that there are law enforcement agents who are intelligent enough to be a real threat to criminals without being a threat to the honest citizens that they are hired to protect. In fact, I believe that the vast majority of law enforcement agents fall in this category. Just say "NO!" to harmful drugs, promiscuous sex, the ITAR's restrictions on strong cryptography, and Key Escrow! Write YOUR Congressional Representative NOW and express support for Maria Cantwell's bill to ease restrictions on privacy software!

2 1