December 2003 - cypherpunks-legacy

What *is* the power of the FIPS
by Peter F Cassidy 17 Dec '03

17 Dec '03

Friends, - My editor from the Covert Action Quarterly called with a question on a piece I've authored on the NSA's involvement in the development of the digital telephony bill. I animated the characters and campaign strategies in this narrative common to the clipper and DT initiatives. In that, taking about Clipper I mentioned its rise as a FIPS, etc. - QUESTION: Just what is the power of the FIPS outside of the interop issues in sending stuff back and forth from federal agencies?

2 1

French Mystics, Martin Gardner, and Transcendentality
by mpd＠netcom.com 17 Dec '03

17 Dec '03

An anonymous traveler on the Path writes: > Actually, the French group is a subsidiary of our Bavarian > operation. However, "centuries" is, well, somewhat > inaccurate, though the mathematician who first mentioned our > existence about that time has since recanted after a visit > from the Elders... "Centuries" was perhaps an exaggeration. I first became aware of the existance of the French group when Martin Gardner published an extremely interesting April Fool's edition of "Mathematical Games" in Scientific American a number of years back. The thesis of his piece was that some very simple expressions involving transcendental numbers such as Pi and E had been proven to be integers. When you checked them on a calculator, they did indeed appear to be exact integers, in spite of a well-known theorem which claimed otherwise. The clever trick was that they were of course transcendental, but differed from integers by a small epsilon far beyond the 15 digit range of most ordinary calculators. A number of us were trying to figure out how Martin Gardner had constructed the expressions he had published, and quickly found that doing so was a non-trivial mathematical problem. We were about to give up when a young associate professor walked in, picked up a piece of chalk, and demonstrated a really clever trick involving rings which permitted one to crank out such expressions with the greatest of ease. When we inquired as to the origin of the work he was citing, we were told that this really clever mystical order in France had recently decided to release this particular discovery into the public domain, where it had served as the source for Martin Gardner's baffling column. Perhaps they will give us a factoring algorithm if we ask them nicely. :) -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Re: CDT POLICY POST No.2 -- X9 TO DEVELOP TRIPLE-DES STANDARDS
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Yahoo! > From: Jack Repenning <jackr(a)dblues.engr.sgi.com> > In a November letter to committee members, the NSA > threatened to prevent the export of triple- DES, citing > existing US law and potential threats to national > security (see attached NSA letter). > Oh, no, surely not. There must be some misunderstanding here - > they *promised* they wouldn't block export of non-Clipper > things. They wouldn't lie! There's already some extra slack in the law and the official policy for exporting encryption for use in banking; the NSA could get around it by asking the banking regulators to impose some sort of Key Forfeiture nonsense, which wouldn't lose much privacy since most banks are already pretty cooperative about such things. On the other hand, banks are rich enough to hire some off-shore programmer to write triple-DES implementations, given the current protocols, as well as to lobby CONgress or the administration to keep the NSA in line.

1 0

Re: The NSA (Was Re: Factoring - State of the Art and Predictions )
by anonymous-remailer＠xs4all.nl 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - ----- BEGIN PGP SIGNED MESSAGE HERE ---- An entity purporting to be Mike Duvos writes: > Such a situation does not apply solely to the NSA. There are, > for instance, secret lodges of French mystics who devote > themselves to higher mathematics, absorb everything the open > community produces, and rarely publish anything or draw attention > to themselves. They solve problems, write secret manuscripts, > put them on shelves, and have been doing this for centuries. > Perhaps the ultimate factoring algorithm already exists within > their walls. We would never know if it did, unless they chose to > tell us. Actually, the French group is a subsidiary of our Bavarian operation. However, "centuries" is, well, somewhat inaccurate, though the mathematician who first mentioned our existence about that time has since recanted after a visit from the Elders... A.W. - ----- PGP SIGNATURE BLOCK ---- PGP-Version: 23.5 PGP-Signature: T! - ----- END PGP SIGNED MESSAGE ----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLz/HsCoZzwIn1bdtAQEU/wF/Rr/9NvFyxbdxadvn6fql1wjfy19/oXOV 87PHHcmP1OWOxE8HU1oaZ9ZwVcNhD3XX =dIax -----END PGP SIGNATURE-----

2 1

Re: MIME based remailing commands
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

Excerpts from mail: 12-Feb-95 Re: MIME based remailing co.. Rick Busdiecker(a)lehman.c (1544) > Well, I have no idea why you think that MIME is an "atrocity" or > "slime", but it is perfectly clear that you have no idea what it > actually *is*, since "X-" headers have nothing whatsoever to do with > MIME. The "X-" headers are defined by RFC 822, which has been the > standard for Internet mail formats since 1982. > You base a large conclusion on a small piece of data in combination > with some poor duduction. Unless you are claiming that MIME violates > RFC 822 with respect to the handling of X- headers you have made a > number of false claims in the paragraph above. A very interesting claim. Care to tell me what my "false claims" are, or is it a secret? > It is possible for someone to find > ugliness where you find beauty without them necessarily being > uninformed. Of course. Let me tell you, though, what the real "beauty" of MIME is: It is that Internet mail was upgraded from ASCII-text-only to permit multiple character sets, images, audio, video, and arbitrary extensions, WITHOUT breaking any existing standards or software. It is that multimedia mail was defined in such a way that it can cross existing ASCII-to-EBCDIC gateways and all manner of other bizarre mail-eating paths and still be complete and comprehensible on the other end. That's the kind of "beauty" we were aiming at, so if your comments are geared to any specific technical aspects of MIME, this may be the explanation. We considered practical functioning and interoperation to be the operational definition of "beauty". -- Nathaniel

2 1

Re: What *is* the power of the FIPS
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> - QUESTION: Just what is the power of the FIPS outside of the > interop issues in sending stuff back and forth from federal agencies? The basic purpose of a FIPS is to instruct governemnt agencies on what kinds of equipment/software they should buy. Some FIPSs are mandatory, but most are pretty optional. However, in this case, the purpose is basically propaganda - the NIST can set standards, and can announce "Hey, this is standard", and even try to get other government agencies to buy lots and lots of Clipperphones. The so-called FIPS for Clipper was a horrendous abuse of the FIPS process; I took advantage of my 10 years as a defense contractor to flame out the proposed spec in great detail. I don't think I've still got my critique, but essentially I contended than the proposed "Escrowed Encryption Standard" didn't describe escrow, didn't specify encryption, and wasn't a standard.... It was fun, if you can do that sort of thing and not inhale :-) It wasn't escrow, because the functions it describes aren't escrow, and it doesn't mandate that they be used in a way that performs escrow functions using the functions it does perform. It didn't specify an encryption algorithm. It wasn't an implementable standard, since it didn't contain enough information for a user agency to specify an equipment design ("ask the NSA" just _doesn't_ rate), or for a vendor to validate whether an equipment design is compliant, or for a user to tell if it's working properly. >From the commentary around the final FIPS, which differed in some detail from the draft FIPS, it looks like most of the public comments were about the political issues, but a couple of changes appeared to be responses to technical details from the public, including things I'd flamed them about. I don't know how positive I feel about that ..... Bill

1 0

Zimmerphone, IPhone, NetPhone, Maven...
by Michael Sattler 17 Dec '03

17 Dec '03

At 11:46 2/13/95, usviszpz(a)ibmmail.com wrote: >For those for whom this is already old news, I would like to ask: any idea if >this technology is related in any way to VoicePGP? If not, any thoughts on the >development ramifications of this for VoicePGP? This is not related in any way to VoicePGP (which PRZ calls PGPFone and I call the Zimmerphone). On the CU-SeeMe discussion mailing list we've been hashing out the performance of the costware IPhone (Windoze) and NetPhone (Mac), and the freeware Maven (Mac). They all suck less over 14.4. -----------------------------------------------------------------------+ Michael Sattler <msattler(a)jungle.com> San Francisco, California | Digital Jungle Consulting Services http://www.jungle.com/msattler/ | | You couldn't get a clue during the clue mating season in | a field full of horny clues if you smeared your body with clue musk | and did the clue mating dance. - Edward Flaherty |

1 0

(Fwd) Returned mail
by Richard F. Dutcher 17 Dec '03

17 Dec '03

> Date: Sat, 11 Feb 1995 01:41:09 -0600 > To: cypherpunks(a)toad.com > From: dls(a)mcs.com (David Sallach) > > > >"Free" speech has always been a balancing act. The founders > >certainly didn't intend to provide "free" speech for blacks and > >women. > > The Founders created a larger space for free speech than had ever > existed. Slaves were deprived of many freedoms including speech, of course, > but women and free blacks were included in the Bill of Rights and exercised > free speech, frequently compellingly. > And were frequently thrown in jail for their pains - note especially the experiences of the early feminists [anachronistic label alert]. And let us not forget what happened to the Mormons ... > Check out Frederick Douglass' practicing oration while still a > slave, and then winning his freedom to become one of the greatest > abolitionist orators. Consider the appreciation of diversity of thought and > speech manifested by Jefferson, Lincoln and many other American political > leaders. > > And Douglass spent a good portion of his life as a refugee in a protected enclave [Boston] where he had powerful friends to keep him from being arrested. I'm not dissing the Founders, or the Bill of Rights -- just the simplified pap their invocation in most discourse has become. I was trained in high school as a scientist, and in college as an historian, and in both instances to value the messy contingent realities over the tempting simplicities of ideology and theory. And there are few contingent realities messier than the law ... > > . . . "They" have never liked "free" speech ... :-( > > Invoking poitically 'correct' stereotypes does not strengthen your > argument. > > David Sallach Irony-impaired, are we? There's a Polish word, used by most of the populace after the 1979 coup to refer to the army and apparat, that is usually translated as "them." I [probably incorrectly] recall it as "Oni" -- would you prefer it? My own first encounter with the term "politically [in]correct" was among 70's feminists, who used it ironically, to tell people they needed a vacation/to get laid/to get a grip. Would that Newt used it that way ... =================================== Rich Dutcher, San Francisco Greens P.O. Box 77005, San Francisco, California 94107 USA "That's libertarians for you - anarchists who want police protection from their slaves." Kim Stanley Robinson, "Green Mars" Greens, of course, only enslave plants - so weed-whackers work better than cops ... ====================================

1 0

EPIC to Debate Exon on CNN
by Dave Banisar 17 Dec '03

17 Dec '03

CNN's 6:00 p.m. (EST) news broadcast tonight (2/13) will include a segment on S. 314, "The Communications Decency Act," introduced by Sen. James Exon (D-NE). Judy Woodruff will moderate a discussion of the bill with Sen. Exon and Marc Rotenberg of the Electronic Privacy Information Center (EPIC). _________________________________________________________________________ Subject: EPIC to Debate Exon on CNN _________________________________________________________________________ David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * ftp/gopher/wais cpsr.org Washington, DC 20003 * HTTP://epic.digicash.com/epic

6 5

Distributed Key Service for PGP (was: why pgp sucks)
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Matt Blaze writes: > >Doesn't having some kind of central record of keys go against > >the principle of PGP? > > The only "principle" of which I'm aware (and particularly interested > in supporting) is that of having widely fielded, useful and strong > privacy and authentication tools that work properly and transparently. > That means, among a great many other things, flexible protocols > and tools that support remote key distribution services. Another main principle of PGP is that it _has_ to be able to work in a decentralized fashion, so it's usable by > the civilizing forces of Anarchy (PGP?) even if the most common uses are in the centralized wired real-world. Perry and other write: [ lots of things about the need for distributed scalable key servers ] [ particularly the numeric-only IDs. ] There are two main times you need to get PGP keys - encrypting a message to someone, and validating a signature from someone. The former can be distributed easily enough - use something DNS-like to serve keys for joe_user(a)foo.bar.com, and add them to your local keyring if they're not there (possibly with temporary keyrings, if that's easy enough on PGP version N.) Fetching keys needs to be a separate tool from PGP anyway, since PGP should be general enough to work on wired and unwired systems, with different protocols and APIs for using the available networks. (And of course, the fetched keys need to be validated using web_of_trust or whatever, adding yet another step.) Sounds like a job for a shell... The latter problem is more difficult - partly PGP's fault, but partly because the underlying problem is harder. Signed documents _may_ arrive from keyids not on the keyservers, whether they're from non-wired users, users who wish to remain pseudonymous, one-or-two-use keys, etc.... What PGP can be blamed for, which will hopefully be addressed in version 3.x, is that it's possible to have collisions in the abbreviated key_ids, especially for the optional short key_ids that have been requested as an added feature for people who _very strongly_ want to remain anonymous. (There have already been collisions in the 24-bit key_ids, and it's been shown that it's possible to generate arbitrary key_ids if you _want_ to cause a collision, as well as birthday-problem probabilities of random collisions.) One way to address it is to make it easy to loop through a bunch of keys with the same key_id, which is a bit tough given PGP's current MS-DOS-like interface. Another way is out-of-band attachment of the user_id with the message, followed by DNS-like lookup, or attachment of the signature key with the message, accompanied by a lookup to validate it. As Matt said, there's a lot of policy-vs-mechanism issues here; PGP version 3.0 will have some library support that makes it easier to build some of these things. Bill

1 0