December 2003 - cypherpunks-legacy

How to clear sign messages with PGP (FAQ)
by exabyte!smtplink!mikej＠uunet.UU.NET 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > How do you get those great signatures on your posts? > > I've been trying to do this with PGP, but I only get a signature file. This > file seems to be a binary file or just a signature. I'll use a command > like: pgp -s filename. > > Perhaps your using a shell? No, I just use this MS-DOS batch file called sign.bat: pgp -sta +clearsig=on %1 The %1 expands to the first argument on the command line. To sign a text file called toscott.txt, I just give the command sign toscott.txt When you get a message signed like that, you should be able to verify the signature by simply executing pgp on the file you get (provided you have my key -- it is on the key servers, available by finger mpj(a)csn.org or mpjohnso(a)nyx.cs.du.edu, ftp://csn.org/mpj/mpj4.asc, or on my BBS (303-938-9654): pgp frommpj.txt For more pgp tricks, see the FAQ ftp://netcom.com/gbe/ (echoed on ftp://csn.org/mpj/public/pgp/) or on the Colorado Catacombs BBS. ___________________________________________________________ |\ /| | | | | \/ |o| | Michael Paul Johnson Colorado Catacombs BBS 303-938-9654 | | | | / _ | mpj(a)csn.org ftp csn.org \mpj\README.MPJ for access info.| | |||/ /_\ | aka mpjohnso(a)nyx.cs.du.edu mikej(a)exabyte.com | | |||\ ( | m.p.johnson(a)ieee.org CIS 71331,2332 VPGP key by finger | | ||| \ \_/ |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.4 iQCVAgUBLXdfdj9nBjyFM+vFAQEkDAQA0sp3qwbXBcp9F4LhtHaLCtag0LKXR1XQ 6hlNsE+M5KIZzLBYcQirlMY0qQKeKwXg9SE3kPs/m/hBySsGbFMqVh0OBSVNjT8a 9QizZB2MZQg+oh91eyNq+Ys5SG04TeOCQtW5UtKdqD4Pe+Teb7UIJxbCq+gGaQ0O Ba1dF1DC8/4= =6W/G -----END PGP SIGNATURE-----

1 0

Re: How to do encrypted telnet without being root (tutorial, includes src)
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

That's quite interesting, but it sure looks like it's unable to encrypt the only part of the session that I really want to encrypt: the password. --- Jef True - that's why I suggested using one-time passwords before you get to that stage. I'm using s/key myself. If you can't install s/key checking in login, you can use an s/key shell as a user process (assuming you can change your shell that is). By the way, S/Key *doesn't* need an intelligent card - you can do what I do and print off 100 passwords small on a credit-card slip. I fetched it as soon as I discovered this. It's not a perfect system but it helps. G

1 0

Standards for Stenography/Steganography?
by Gary Jeffers 17 Dec '03

17 Dec '03

Tim May says that the criticism I received was mild. It was not that mild. I am particularly incensed by Poskanzer's suggestion that I fetch the old information when, it turns out, that info was not available. That was bullshit! Anyway, hopefully, Poskanzer's technical skills are great & he will pull a giant rabbit out of the hat. In our defense, I would guess that Sergey had the same idea that I had: "Steganography! a hide in plain sight, travel casually in day- light, leave no footprints, safe long term storage, last-ditch, safe crypt. & , apparently, no one's working on IBM micro implementations! What an opportunity to make a contribution! If we don't write the code I'll bet we can provoke a really good programmer with crypt knowledge to do it." It would be difficult for us to know that this area was already discussed, tactics pretty much resolved, & had big old guns working on it without them telling us. Thank God the big old guns were there to disabuse us of our pipe dreams & illusions! I'm pretty irreverent, but I do have a lot of respect for the really smart guys who are sacrificing huge chunks of time in writing code & theory to free us as well as themselves. It takes me many hours per week to deal with cypherpunks mailing list. So, I can understand how the big old guns can get bothered by newbies farming old ground & taking up lots of bandwidth while mudding the water. With that said, & having a lot less to say that I thought I had, I shall go back to a higher LURK/BANDWIDTH ratio & stop annoying people. As Johnathan Winter's mother used to say: "If you can't be bright, be polite." also quiet? Yours Truly, Gary Jeffers

1 0

No Subject
by hughes 17 Dec '03

17 Dec '03

Date: Wed, 2 Mar 1994 09:14:40 -0800 From: Hal <hfinney(a)shell.portal.com> Sender: hughes(a)toad.com Message-Id: <199403021714.JAA17114(a)jobe.shell.portal.com> To: cypherpunks(a)toad.com Subject: Re: Insecurity of public key crypto #1 (reply to Mandl) [Maintainer's note: Sometimes the subscribe filter for majordomo works too well. This message came in a couple of days ago, got filtered, and I've finally figured out how to massage majordomo into getting it out into the list. Sorry about that, Hal.--EH] I run a simple script which will provide the Cypherpunks list in encrypted form. Send me your email address and a PGP public key and I will add you to the list. Once you have it working nicely you can then unsubscribe from the regular list (I can't unsubscribe you from the regular list). Interestingly enough, I have been doing this for about a year, and in that time about ten people have asked to sign up (I haven't publicized it heavily). All but two have asked to be removed within a week, saying that it was too much hassle to deal with that volume of incoming encrypted mail! Let me know if you want to try it. Hal Finney hfinney(a)shell.portal.com

1 0

Standards for Stenography?
by Gary Jeffers 17 Dec '03

17 Dec '03

Tim May says that the criticism I received was mild. It was not that mild. I am particularly incensed by Poskanzer's suggestion that I fetch the old information when, it turns out, that info was not available. That was bullshit! Anyway, hopefully, Poskanzer's technical skills are great & he will pull a giant rabbit out of the hat. In our defense, I would guess that Sergey had the same idea that I had: "Steganography! a hide in plain sight, travel casually in day- light, leave no footprints, safe long term storage, last-ditch, safe crypt. & , apparently, no one's working on IBM micro implementations! What an opportunity to make a contribution! If we don't write the code I'll bet we can provoke a really good programmer with crypt knowledge to do it." It would be difficult for us to know that this area was already discussed, tactics pretty much resolved, & had big old guns working on it without them telling us. Thank God the big old guns were there to disabuse us of our pipe dreams & illusions! I'm pretty irreverent, but I do have a lot of respect for the really smart guys who are sacrificing huge chunks of time in writing code & theory to free us as well as themselves. It takes me many hours per week to deal with cypherpunks mailing list. So, I can understand how the big old guns can get bothered by newbies farming old ground & taking up lots of bandwidth while mudding the water. With that said, & having a lot less to say that I thought I had, I shall go back to a higher LURK/BANDWIDTH ratio & stop annoying people. As Johnathan Winter's mother used to say: "If you can't be bright, be polite." also quiet? Yours Truly, Gary Jeffers

1 0

Soundblaster for Secure Voice
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

Any number of persons had mentioned the use of a SoundBlaster board for use in a secure voice application for PCs. In the February 17, 1994 issue of EDN, there is an article entitled 'Speech-synthesis and -recognition chips personalize consumer products' by John Gallant, Tecnical Editor, starting on P. 27. There is a company mentioned, ESS Technology, Fremont CA, (510)226-1088, that produces two Sound Blaster register level compatible chips, the ESS488 (without music synthesis) and ESS1488 (with music synthesis). The ESS1488 will run on 3.3 or 5 volt Vdd, and appears to be intended for portable computer applications. Cost per ESS1488 is $18 (presumeably in quantity).

1 0

FWD>CPSR Alert 3.05
by Dave Banisar 17 Dec '03

17 Dec '03

>From CPSR FWD>CPSR Alert 3.05 ============================================================== @@@@ @@@@ @@@ @@@@ @ @ @@@@ @@@@ @@@@@@ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @@@ @ @@@ @@@@@ @ @@@ @@@ @ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @ @@@ @ @ @ @ @@@@ @@@@ @ @ @ ============================================================= Volume 3.05 March 3, 1994 ------------------------------------------------------------- Published by Computer Professionals for Social Responsibility Washington Office (Alert(a)washofc.cpsr.org) ------------------------------------------------------------- Contents [1] Welcome to the CPSR Alert [2] FBI Digital Telephony Bill Returns [3] Clipper Petition Passes 40,000 Signatures [4] Clipper and Cantwell [5] FCC and Electronic Mail [6] NTIA Privacy Inquiry [7] DIAC Conference Announcement [8] New Files at the CPSR Internet Library [9] Upcoming Conferences and Events ------------------------------------------------------------- [1] Welcome to the CPSR Alert We should take a moment to welcome the new readers of the CPSR Alert. In the last month, the number of subscribers has more than tripled. We'd like to thank you for your interest in CPSR and tell you about a few more services available. If you have FTP/Gopher/WAIS access you should explore the CPSR Internet Library at CPSR.ORG. There is a wide range of materials covering Clipper, civil liberties, information policy and the NII. Many of the Administration's materials are available from CPSR.ORG. We also provide archives for the Taxpayers Assets Projects, Privacy International, and the Cypherpunks mailing list. If you are interested in Clipper and other civil liberties issues, you should consider attending the Computers, Freedom & Privacy conference in Chicago, March 23-26. CPSR sponsored the first CFP in 1991. It is now a leading event for people interested in civil liberties and privacy. (see calendar for more information). In April, CPSR is sponsoring a two-day conference on the National Information Infrastructure at MIT. Featured speakers include Benjamin Barber, Herb Schiller and Tom Grudner. (see section 7 for more information). If you are interested in NII policy, you might want to get a copy of the CPSR NII report, "Serving the Community: A Public Interest Vision of the NII." The report is based on a series of principles developed by the Telecommunications Policy Roundtable and provides a very useful overview of the NII policy debate. The paper is available electronically by sending email to listserv(a)cpsr.org. In the message body write the command "GET CPSR NII_POLICY" (no quotes). The paper will automatically be mailed to you. You can also get the paper through ftp/wais/gopher at cpsr.org/nii/cpsr_nii_policy.txt. To request a paper copy (about 30 pages) send email to cpsr(a)cpsr.org. Welcome again to the CPSR Alert. ------------------------------------------------------------- [2] FBI Digital Telephony Bill Returns The Federal Bureau of Investigation has reintroduced its controversial 1992 proposal to require that communications service providers redesign their equipment to facilitate electronic surveillance. The Bureau has sent a draft to Congress but so far, no Senator or Congressperson has stepped forward to sponsor it. The draft bill, ironically named the Digital Telephony and Communications Privacy Improvement Act of 1994, mandates that common carriers (phone, cable and computer network companies) modify their switches and computers to ensure that surveillance can be conducted concurrently from a remote government facility. It requires that manufacturers and support companies assist carriers. In an addition to the 1992 bill, the 1994 bill also mandates that systems be designed to collect transactional information that users generate and make that information available to law enforcement agencies. This information includes data on calls made and received. Under the NII, future information collected may include all manner of transactions, including purchases, financial and medical information. Any company that fails to comply with the requirements of the bill would be fined $10,000/day and shut down. Companies would have three years from the date of enactment to comply. The Attorney General would have the authority to enact these penalties and would be encouraged to cooperate with the Federal Communication Commission. The FCC would issue rules to cover the cost of complying with the procedures. An internal FBI memo released to CPSR under a Freedom of Information Act lawsuit estimates the cost of compliance at $300 million. Communications Daily reports that other experts have estimated that the cost will be over one billion dollars. The bill also revises sections of the Electronic Communications Privacy Act to extend the legal protection of ECPA to cordless phones and clarifies ECPA to allow for monitoring of computer systems by system managers. The 1992 bill was never formally introduced due to lack of a sponsor after industry, civil liberties groups and the public criticized it. Copies of the 1994 and 1992 drafts are available from the CPSR Internet Library. (see below for details). Also available are educational materials about the Digital Telephony proposal. To obtain a video copy of the ABC Nightline special on the original FBI proposal, send $14.98 plus 3.98 s/h to MPI Home Video, 15825 Rob Roy Dr., Oak Forest, IL 60452 and request a copy of the 5/22/92 program "FBI Pushes for Wiretap Powers." The program features a debate between former FBI Director William Sessions and CPSR Washington Director Marc Rotenberg. Available from CPSR is a 450-page sourcebook of materials on privacy and cryptography, including the materials on the original digital telephony proposal with commentary. The CPSR Sourcebook is available for $50. Send a check to CPSR, 666 Pennsylvania Ave., SE, Suite 301, Washington, DC 20003 --------------------------------------------------------------- [3] Clipper Petition Passes 40,000 The CPSR Internet Petition to oppose the Clipper Proposal has now passed 40,000 signatures. The petition has been signed by users at over 2,600 sites, including 1,100 companies and 800 colleges. For specific sites, MIT has the highest single vote tally, with over 600 messages. Messages continue to arrive at a rate of over 1,000 per day. To sign on to the letter, send a message to: Clipper.petition(a)cpsr.org with the text "I oppose Clipper" (no quotes) You will receive a return message confirming your vote. To obtain a copy of the petition, email a blank message to petition-info(a)cpsr.org For more information on Clipper, email clipper-info(a)cpsr.org. You will receive a copy of the Clipper FAQ. Thanks for your help. --------------------------------------------------------------- [4] The Cantwell Bill and Clipper We've received several inquiries concerning H.R. 3627, Rep. Maria Cantwell's bill to liberalize export controls on encryption software. Some people have been given the impression that the Cantwell bill is a response to the Administration's Clipper initiative and that passage of the legislation would effectively put the Clipper issue to rest. Because of the confusion surrounding this proposed legislation, we think it's important to provide some clarifying information. Rep. Cantwell introduced H.R. 3627 on November 22, 1993. Her comments on the purpose of the legislation appeared in the Congressional Record on November 24, 1993, at Volume 139, Page 3110. According to Rep. Cantwell: The legislation I am introducing today is needed to ensure that American companies do not lose critical international markets to foreign competitors that operate without significant export restrictions. Without this legislation, American software companies, some of America's star economic performers, have estimated they stand to lose between $6 and $9 billion in revenue each year. American hardware companies are already losing hundreds of millions of dollars in lost computer system sales because increasingly sales are dependent on the ability of a U.S. firm to offer encryption as a feature of an integrated customer solution involving hardware, software, and services. * * * This legislation takes some important steps to resolve a serious problem facing some of our most dynamic industries. It would give the Secretary of Commerce exclusive authority over dual use information security programs and products, eliminates the requirement for export licenses for generally available software with encryption capabilities, and requires the Secretary to grant such validated licenses for exports of other software with encryption capabilities to any country to which we already approve exports for foreign financial institutions. * * * My legislation is straightforward. It would allow American companies to sell the commercial software they develop in the United States to their overseas customers including our European allies -- something that is very difficult if not impossible under present policies. Rep. Cantwell's remarks contained no reference to the Administration's Clipper initiative, which had first been announced some seven months earlier. Indeed, there is no provision in H.R. 3627 that would in any way rescind the Administration's recent decision to adopt key-escrow Clipper technology as the government encryption standard. The legislation would do precisely what Rep. Cantwell said it would do -- relax restrictions on the export of strong encryption products outside of the United States. Some have suggested that passage of the Cantwell bill would create an environment in which it is less likely that Clipper will become the de facto encryption standard within the United States. This view was expressed by the Electronic Frontier Foundation (EFF) and several large corporations in a letter to the President last December which expressed "tentative" support for Clipper on a "voluntary" basis. CPSR dissented from this position in a subsequent letter to the President and expressed its opposition to the Clipper proposal under any circumstances. While it is possible that the Cantwell legislation would make it less likely that Clipper will become the de facto privacy standard, such a result is by no means a certainty. It is, in fact, possible that passage of the legislation would provide better U.S. encryption products overseas than would be available within the United States -- particularly if, as many fear, Clipper eventually becomes a mandatory standard in this country. We believe that the Cantwell bill is a step in the right direction, as it would remove current disincentives to the development of strong encryption products by U.S. companies. But the proposed legislation is not a panacea -- it would not address the threat to privacy in the United States created by the Clipper initiative. Export controls on cryptography are a related issue, but they are not central to the Clipper controversy. The Administration's adoption of the key-escrow Clipper standard must be opposed and reversed. --------------------------------------------------------------- [5] FCC and Electronic Mail [Note: The Taxpayers Assets Project is circulating a letter to encourage public participation in FCC proceedings through the Internet. CPSR has endorsed the letter and encourages other organizations and individuals to support this effort. Please repond by March 15.] SIGNATURES NEEDED FOR LETTER ASKING THAT INTERNET BE USED TO BROADEN DEMOCRATIC DEBATE OVER FCC PROCEEDING The following is a letter that will be sent to Reed Hundt, the Chair of the FCC, asking that the FCC use the Internet to broaden democratic participation in FCC proceedings. Specifically, Hundt is asked to 1) set up listserves for discussions of FCC rulemakings and inquiries, 2) accept public comments by electronic mail, and 3) provide easier access to the new FCC.GOV internet node. If you are willing to sign the letter, send the following information to Michael Ward of the Taxpayer Assets Project at: Internet: TAP(a)ESSENTIAL.ORG Fax: 202/234-5176 Postal: P.O. Box 19367, Washington, DC 20036 Voice: 202/387-8030 Name: _________________________ Affiliation: _________________________ (Optional, will be listed as: for purposes of identification only) Postal Address:__________________________ __________________________ __________________________ Voice: __________________________ Internet: __________________________ -------------------------------------------- March 15, 1994 Honorable Reed Hundt Chairman, Federal Communications Commission 1919 M Street, Room 814 Washington, D.C. 20554 Dear Chairman Hundt: We are writing to ask that you use the Internet to broaden opportunities for democratic participation in FCC proceedings. We applaud the FCC for its recent announcement that it has established FCC.GOV as an Internet node, and that the FCC Daily Digest is now available for free by ftp from FCC.GOV. We were also pleased that you have asked the FCC staff to examine methods and procedures for accepting comments on FCC dockets electronically. The measures discussed below would build on your efforts, and are intended to make it easier and less costly for citizens to follow the FCC's work. 1. The FCC should provide Internet electronic mail discussion "lists" on all FCC rulemakings and inquiries. Citizens should be able to sign up for a proceeding by sending a message to the FCC.GOV listserve, with a simple message such as "subscribe pcs-auction-rules-93-253." These Internet discussion lists use today's technology to empower citizens, by enhancing their ability to follow important policy debates. In an Internet discussion list, a citizen can send a message to the FCC listserve, and that message will be echoed to every subscriber on the list. The persons receiving the message will have an opportunity to respond, and a real dialogue can take place. As discussions and debates on the Internet email lists unfold, citizens will have opportunities to gain a much deeper understanding of the issues raised in the proceedings, and how they will be affected by the FCC's actions. 2. In considering methods for accepting comments from the public in FCC dockets, the Commission should provide citizens the opportunity to file comments via electronic mail which is gatewayed through the Internet. These comments should be separate from the dialogue on the discussion lists, and reflect the commentors final views on the subject matter. Several federal agencies now provide opportunities to file comments by electronic mail. For example, OMB's Office of Information and Regulatory Affairs (OIRA), began accepting comments on its Circular A-130 by electronic mail in 1992. 3. As you have already indicated, it will be important that the FCC take steps to ensure that the use of electronic communications is consistent with the legal requirements that the public record be complete and accessible. We understand that the Commission will have to devise ways of ensuring that this broadened public dialogue becomes part of the public record and is in compliance with the Administrative Procedures Act. The Commission should make these comments available to the public both online and through the FCC's reading room. 4. Many citizens can access the Internet via electronic mail, but do not have access to ftp or gopher technologies. Thus, it would be very helpful if the FCC.GOV would provide an "email ftp" service for obtaining files from FCC.GOV, as well as an ability to subscribe to the Daily Digest through electronic mail. Of all the vaunted promises of the information superhighway, the most important is that new information technologies provide opportunities to enhance democratic processes. One of the most important and valuable aspects of the Internet has been its role in restoring civic discourse on a wide range of issues. By adopting these recommendations, the FCC will gain a deeper understanding of the opportunities for enhanced democratic discourse, and it will broaden citizen opportunities to participate in debates over FCC policies. Sincerely, James Love, Taxpayer Assets Project Jeff Chester, Center for Media Education Marc Rotenberg, Computer Professionals for Social Responsibility ---------------------------------------------------------------------- James Love, Taxpayer Assets Project; internet: love(a)essential.org P.O. Box 19367, Washington, DC 20036; v. 202/387-8030; f. 202/234-5176 12 Church Road, Ardmore, PA 19003; v. 215/658-0880; f. 215/649-4066 ---------------------------------------------------------------------- --------------------------------------------------------------- [6] NTIA Privacy Inquiry DEPARTMENT OF COMMERCE National Telecommunications and Information Administration [Docket No. 940104-4004] Inquiry on Privacy Issues Relating to Private Sector Use of Telecommunications-Related Personal Information AGENCY: National Telecommunications and Information Administration (NTIA), Commerce ACTION: Notice of Inquiry; Request for Comments SUMMARY: NTIA is conducting a comprehensive review of privacy issues relating to private sector use of telecommunications-related personal information associated with the National Information Infrastructure. Public comment is requested on issues relevant to such a review. After analyzing the comments, NTIA intends to issue a report, which may make recommendations to the Information Infrastructure Task Force and Congress in the area of telecommunications and information policy, as appropriate. DATES: Comments should be filed on or before March 30, 1994, to receive full consideration. ADDRESS: Comments (seven copies) should be sent to the Office of Policy Analysis and Development, NTIA, U.S. Department of Commerce, 14th St. and Constitution Ave., N.W., Room 4725, Washington, D.C. 20230. FOR FURTHER INFORMATION CONTACT: Carol Mattey or Lisa Leidig, Office of Policy Analysis and Development, 202-482- 1880. AUTHORITY: National Telecommunications and Information Administration Organization Act of 1992, Pub. L. No. 102- 538, 106 Stat. 3533 (1992) (to be codified at 47 U.S.C. s. 901 et seq.). A full copy of the notice is available at the CPSR Internet Library (see below for details). --------------------------------------------------------------- [7] DIAC Announcement "Developing an Equitable and Open Information Infrastructure" Directions and Implications of Advanced Computing (DIAC-94) Symposium Cambridge, MA, USA April 23 - 24, 1994 Benjamin Barber on Electronic Democracy Herbert Schiller on Media Control and Alternative Programming Tom Grundner on Grassroots Networking The National Information Infrastructure (NII) is being proposed as the next-generation "information superhighway" for the 90's and beyond. Academia, libraries, government agencies, as well as media and telecommunication companies are involved in the current development. Computer Professionals for Social Responsibility (CPSR) and other organizations believe that critical issues regarding the use of the NII deserve increased public visibility and participation and are using the DIAC Symposium to help address this concern. The DIAC-94 symposium is a two-day event and will consist of presentations on the first day and workshops on the second day. The DIAC Symposia are held biannually and DIAC-94 will be CPSR's fifth such conference. We encourage your participation both through attending and through conducting a workshop. Sponsored by Computer Professionals for Social Responsbility Co-sponsored by the Internet Society and the MIT Communications Forum. Other co-sponsors are being sought. Please contact us if your organization would like to help with this event. For more information on co-sponsorship or on general issues, contact conference chair, Coralee Whitcomb, cwhitcom(a)bentley.edu. ------------------------------------------------------------- [8] New Files at the CPSR Internet Library Dr. Dorothy Denning's paper presenting the law enforcement view of cryptography and privacy issues. /cpsr/privacy/crypto/ denning_crypto_law_enforcement_feb_94.txt NTIA Call for Comments on Privacy Issues related to Private Sector use of Telecommunications Related Information. /cpsr/privacy/misc_privacy/ntia_privacy_comments_notice_feb_94.txt The inaptly named FBI Digital Telephony and Communications Privacy Act of 1994, Feb 1994 draft. /cpsr/privacy/communications/wiretap/ fbi_wiretap_bill_draft_feb_94.txt The CPSR Internet Library is a free service available via FTP/WAIS/Gopher/listserv from cpsr.org:/cpsr. Materials from Privacy International, the Taxpayers Assets Project and the Cypherpunks are also archived. For more information, contact ftp-admin(a)cpsr.org. ---------------------------------------------------------------- [9] Upcoming Conferences and Events "Computers, Freedom and Privacy 94." Chicago, Il. March 23-26. Sponsored by ACM and The John Marshall Law School. Contact: George Trubow, 312-987-1445 (CFP94(a)jmls.edu) Directions and Implications of Advanced Computing (DIAC)-94 "Developing an Equitable and Open Information Infrastructure" Cambridge, MA. April 23 - 24, 1994. Sponsored by CPSR. Contact: cwhitcomb(a)bentley.edu or doug.schuler(a)cpsr.org. Computer-Human Interaction 94. Boston, Mass. April 24-28. Sponsored by ACM. Contact: 214-590-8616 or 410-269-6801, chi94office.chi(a)xerox.com "Navigating the Networks." 1994 Mid-Year Meeting, American Society for Information Science. Portland, Oregon. May 22 - 25, 1994. Contact: rhill(a)cni.org Rural Datafication II: "Meeting the Challenge of Providing Ubiquitous Access to the Internet" Minneapolis, Minnesota. May 23-24, 1994. Sponsored by CICNet & NSF. Contact: ruraldata-info-request(a)cic.net. Send name, mailing address and e-mail address. "Information: Society, Superhighway or Gridlock?" Computing for the Social Sciences 1994 Conference (CSS94). University of Maryland at College Park. June 1-3, 1994. Contact: Dr. Charles Wellford 301-405-4699, fax 301-405-4733, e-mail: cwellford(a)bss2.umd.edu. Abstracts for papers due March 1. Contact William Sims Bainbridge (wbainbri(a)nsf.gov) Grace Hopper Celebration of Women in Computer Science. Washington, DC June 9-11. Contact: 415 617-3335, hopper-info(a)pa.dec.com DEF CON ][ ("underground" computer culture) "Load up your laptop muffy, we're heading to Vegas!" The Sahara Hotel, Las Vegas, NV. July 22-24, Contact: dtangent(a)defcon.org. Conference on Uncertainty in AI. Seattle, WA. July 29-31. Contact: 206-936-2662, heckerma(a)microsoft.com. Symposium: An Arts and Humanities Policy for the National Information Infrastructure. Boston, Mass. October 14-16, 1994. Sponsored by the Center for Art Research in Boston. Contact: Jay Jaroslav (jaroslav(a)artdata.win.net) Third Biannual Conference on Participatory Design, Chapel Hill, North Carolina, October 27-28, 1994. Sponsored by CPSR. Contact: trigg(a)parc.xerox.com. Submissions due April 15, 1994. (Send calendar submissions to Alert(a)washofc.cpsr.org) ======================================================================= To subscribe to the Alert, send the message: "subscribe cpsr-announce <your name>" (without quotes or brackets) to listserv(a)cpsr.org. Back issues of the Alert are available at the CPSR Internet Library FTP/WAIS/Gopher cpsr.org /cpsr/alert and on America Online in the Mac Telecomm folder. Computer Professionals for Social Responsibility is a national, non-partisan, public-interest organization dedicated to understanding and directing the impact of computers on society. Founded in 1981, CPSR has 2000 members from all over the world and 23 chapters across the country. Our National Advisory Board includes a Nobel laureate and three winners of the Turing Award, the highest honor in computer science. Membership is open to everyone. For more information, please contact: cpsr(a)cpsr.org or visit the CPSR discussion conferences on The Well (well.sf.ca.us) or Mindvox (phantom.com) ======================================================================= CPSR MEMBERSHIP FORM Name ___________________________________________________________ Address ___________________________________________________________ ___________________________________________________________ City/State/Zip _____________________________________________________ Home phone _____________________ Work phone ______________________ Company ___________________________________________________________ Type of work ______________________________________________________ E-mail address _____________________________________________________ CPSR Chapter __ Acadiana __ Austin __ Berkeley __ Boston __ Chicago __ Denver/Boulder __ Los Angeles __ Loyola/New Orleans __ Madison __ Maine __ Milwaukee __ Minnesota __ New Haven __ New York __ Palo Alto __ Philadelphia __ Pittsburgh __ Portland __ San Diego __ Santa Cruz __ Seattle __ Washington, DC __ No chapter in my area CPSR Membership Categories __ $ 75 REGULAR MEMBER __ $ 50 Basic member __ $ 200 Supporting member __ $ 500 Sponsoring member __ $1000 Lifetime member __ $ 20 Student/low income member __ $ 50 Foreign subscriber __ $ 50 Library/institutional subscriber (Corporate memberships also available) Additional tax-deductible contribution to support CPSR projects: __ $50 __ $75 __ $100 __ $250 __ $500 __ $1000 __ Other Total Enclosed: $ ________ Make check out to CPSR and mail to: CPSR P.O. Box 717 Palo Alto, CA 94301 ------------------------ END CPSR Alert 3.05 -----------------------

1 0

more steganography talk
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Stuff that Sergey Goldgaber, Hal, and others wrote induced the following ideas in my head: Goal - create a steganography system that hides cyphertext in such a way that only the true recipient of the message will be able to prove an encrypted message is hidden within a public message. Nobody else will be able to determine if the public message also contains an embedded encrypted message. In Hal's words: > A test, then, for the success of a steganographic > technique is this: given some sampling of data items, > half of which have embedded hidden messages, can the > opponent guess which ones have such messages with better > than 50% accuracy? If not, the steganography is fully > successful. If he can do slightly better than 50%, it may > still be useful depending on the situation. If he can > guess with 100% accuracy, the steganography has failed > and is totally worthless. > If the LSBs of most picture files were truly random, then good steganography would be trivial. Anyone could just plop an unremarkable encrypted message (Stealth-PGP) in the LSB's, starting at the beginning of the file. Since one sequence of truly random bits statistically looks like any other sequence of truly random bits, nobody would be able to prove the picture file contained a hidden encrypted message. Unfortunately, I doubt that most, or even many, picture files have truly random LSBs. It would be possible to write frame grabber or scanner software to purposely place random bits in the LSB of picture files to generate a source of useful picture files. When this software became widely used, good steganography would become trivial. Unfortunately, I don't have much confidence that this could be pulled off on a large enough scale. If it could be done, great, but I'm not holding my breath. Assuming the LSBs of most picture files are not truly random, and wont be any time soon, the next approach to good steganography would be to figure out how to transform a sequence of random bits (your encrypted message) into a sequence of bits that resemble the kinds of bit patterns you see in typical picture files. If you could do this, and do it without requiring more secret keys, then good steganography becomes trivial again. [Actually, you don't have to transform your random bits into a *sequence* of typical picture file LSB bits. The steganography algorithm could deposit the bits anywhere in the picture file, as long the process was reversible and the result was undetectable.] "Reversible, undetectable, without requiring additional keys." Sounds like a good set of requirements for a steganography system. I have an idea to help with the "reversible" part and the "no additional secret keys" part, and it suggests a direction for the "undetectable" part. The idea: Encrypt a widely known value with the recipient's public-key and use the result as an initialization vector for a clever transformation/steganography algorithm. The message recipient recovers the encrypted message by re-calculating the initialization vector using the same widely known value and his public-key and reversing the transformation/steganography step. The initialization vector will be different for each message recipient. The "widely known value" could be a large block of bytes. A large file of random bits could be shipped with the steganography executable. The intent is to make it more difficult and time consuming for the opponent to determine if a public message contains a hidden encrypted message. It's not fool-proof. The opponent could try to discover a hidden message by reversing the process using every known public-key. Worse, an opponent could narrow the search by only trying the public-keys of suspected recipients. However, I think it is an improvement over the techniques being used today. One significant property this technique does *not* possess is deniability. A perfect steganography system will produce results that will let a recipient claim that they did not know a message contained a hidden encrypted message (e.g. most picture files had truly random LSBs). If somebody sent you a hidden message using your public-key and the initialization vector technique, your claim of ignorance might not hold up. Anybody could use your public-key to recover the random bit sequence. They would not recover the contents of the hidden message, but they would be able to show that your file did contain what appears to be a hidden message. It might be enough to tip the scales of justice against you. In my mind, the perfect steganography system depends upon either an environment containing ubiquitous random bit sequences or a reversible algorithm that can transform non-random bit sequences into random bit sequences without using encryption (unlikely). However, I believe a less-than-perfect, but still useful steganography system could be created using the initialization vector technique described above. Jim_Miller(a)suite.com

3 2

SF Chron comes out against Clipper
by baum＠newton.apple.com 17 Dec '03

17 Dec '03

Well, not exactly the Chron, per say, but... this morning a new column debuted about computer networks, the internet, the information highway, and other extrememly trendy topics. The first column was all about Clipper, and why it was a bad idea. I didn't bring it with me today, so I'm not remember lots of details. The writer has an email address on the well (rbr(a)well.sf.ca.us??) ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, 20525 Mariani Ave, MS 305-3B * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

2 1

even more steganography talk
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Another way to describe a successful steganography system... I am the opponent. I possess a collection of files that might contain hidden encrypted messages. My task is to determine if they do contain hidden encrypted message. A casual inspection of the files does not reveal any bit patterns that deviate significantly from patterns found is most examples of these kinds of files. However, I suspect these files contain hidden messages that were deposited using a steganography algorithm initialized from a public-key generated initialization vector. To test my hypothesis, I will reverse the steganography process using a large collection of public-keys and then examine the resulting bit sequences. -------- If the steganography algorithm is a good one, reversing the steg process will produce a sequence of bits that appears relatively random, even if there is *no* hidden message. What does "appears relatively random" really mean? How do you measure the randomness of a sequence of bits? I'm not an expert in this field, but I would guess you could measure the randomness by attempting to compress the bit sequence. If the bit sequence does not compress much, it is relatively random. How much is "not much"? In other words, what threshold compression percentage value should you use to declare one bit sequence random and another not random? I don't know. To generalize, an opponent will perform some kind of test to determine if the result of reversing the steg process produces a random bit sequence or a non-random bit sequence. The test will have some threshold value below which indicates a random sequence. If the output of the reverse steganography step always falls below the threshold, even if there is no hidden message, then the opponent will not be able to determine if a file contains a hidden message. Jim_Miller(a)suite.com

2 1