December 2003 - cypherpunks-legacy

Re: federal crime
by moormajb＠vuse.vanderbilt.edu 17 Dec '03

17 Dec '03

>>Date: Tue, 29 Mar 1994 05:52:22 -0800 >>From: Jack King <gjk(a)well.sf.ca.us> >> >>In Texas, Louisiana and Mississippi, it is now a federal crime to state >>orally or in writing to any federal administrative or law enforcement >>officer, during the course of an official investigation that you don't know >>what they are talking about if in fact you do. >How can something be a federal crime in only 3 states? I think he probably meant "felony" not "federal crime."

2 1

Keyserver addresses?
by Matt Thomlinson 17 Dec '03

17 Dec '03

I haven't seen mention of the keyservers by name for a long while -- the one I used to use (toxicwaste) is long gone. Perhaps we should add the keyservers' addresses to the active remailer list posted here periodically? Could someone send me a keyserver address, in any case? mt Matt Thomlinson University of Washington, Seattle, Washington. phone: (206) 548-9804 Check my home page -- ftp://ftp.u.washington.edu/public/phantom/home.html PGP 2.2 key available via email, or finger phantom(a)hardy.u.washington.edu

3 2

questions for review committee.
by sommerfeld＠orchard.medford.ma.us 17 Dec '03

17 Dec '03

Question: How many bits of true "hardware randomness" go into the generation of each set of unit keys? Question: Exactly how are these random numbers generated? Which entity or entities provide the hardware and/or software to generate them? Are they generated inside the "vault" at the time of programming or "off-line"? Question: Are any of the random inputs to the key generation algorithm held constant during the generation of a "batch" of chips? If so, what is the justification for this practice? Question: What is the current batch size? What will the batch size be if production reaches ~1 million units per year, or ~4000 per work day? Question: What assurances are there that the key generation algorithm documented and examined by the review committee is the one actually used in production? Question: What assurances are there that the encryption algorithm studied by the review committee is the same as the one implemented by the chip? More specifically, have several members of the review committee each coded their own SKIPJACK implementations, including the escrow protocols, "from scratch" on computer systems not owned or provided by the U.S. government, and compared their outputs to that of the chips under study? If this is not feasible, please explain why. Question: What assurances are there that the actual physical chip(s) implementing the EES implements exactly and only the skipjack algorithm, the documented escrow procedures, and other publicly documented features? Are there any VLSI experts on the review committee? If so, what chips have they designed, and what chips have they "reverse engineered"? ---- By "assurances" I mean that there is an active process in place for validating compliance to a particular requirement such that no single *organization*, or single model of hardware can "fail" in a way such that violation of the requirement goes undetected. I consider the set of current and former employees of the Executive Branch of the U.S. Government to be a single organization for purposes of assurance. Addendum to all of these: If this information is classified, please justify this classification etc., etc., Steve, I hope you don't consider any of these "have you stopped beating your spouse".. - Bill

1 0

Re: cfp '94 transcript
by ag588＠cleveland.Freenet.Edu 17 Dec '03

17 Dec '03

> > > >On Tue, 29 Mar 1994, Jack King wrote: > >> Mike Godwin stated that the FBI agent said something like " >> "we can lie to you, but you can't lie to us." That has always been true >> under 18 U.S.C. 1001. But now you can't even answer one of their questions >> with a "no" if the truthful answer would be "yes." You should read up on >> this, it's scarier than Clipper and the digital telephony proposal combined. > >Of course you can still refuse to say anything which is what you should >have always done in any case. > >I wonder that if you tell the agents that you reserve the right to lie -- >in other words disclaim an oath. Swear to lie. If you can beat such a rap. > >DCF > > > > Don't try to be clever when you're talking with the Feds. Your best bet is simply to demand a lawyer and then shut up. -- ------------------------------------------------------------------------- I am an attorney, seeking a position in the area of Computer Law. If you know of such a position available, or of someone who may know of such a position, please send e-mail! Thanks.

1 0

Cypherpunks change bytes!
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I ought to be studying, but goofing off is more fun. I generated a test key with the binary distribution of PGP 2.3a for DOS. I then changed the byte at offset 2F688 in PGP.EXE from 0x33 (ASCII "3") to 0x34 (ASCII "4"), and the byte at offset 2F689 from 0x61 (ASCII "a") to 0x00 (null). The patched PGP.EXE identifies itself as "Version 2.4" in ASCII armor blocks and otherwise; the key generated with the "2.3a" version extracts as a "2.4" key after the patch. ViaCrypt PGP 2.4 for DOS can successfully read files encrypted with the patched PGP.EXE, and add keys generated under "2.3a" but labelled as "2.4" keys. I haven't done a lot of testing, but spot checks make it look like everything's fine. I don't see the point in forcing everyone to patch their binaries or recompile from source - does anyone else? Bidzos & Co. are certainly smart enough to anticipate this step. What's the catch? -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLclzd33YhjZY3fMNAQGiDwP9HjSYfNfn4q/9L/BOqXluH06015x3YmDM gNPfg5T2lWcsYJyyx/tMnVWdtAnFENAFUB7zK5vNq+Y/tquKaE6kEuZeUzZz1o+k sOofUAR1Y+sUii4Fu8R2J7scNCDL2pjl/hIqAAfT0voHiexxOTR9uxCDeiWxz9w0 xpyuvJBLQq8= =G5Oq -----END PGP SIGNATURE-----

3 2

What the IRS is up to
by johnl＠iecc.com 17 Dec '03

17 Dec '03

Here's some excerpts from a speech by Coleta Brueck, Project Manager, Document Processing system, at the Internal Revenue Service, that she gave at the Computer Press Association Awards luncheon in New York on April 15th. I was at the lunch, but the transcript of the speech just arrived today. The ellipses are mine, but I think I'm not distorting what she said. She started by explaining that their current systems are functionally based on punch card systems from the 1950s, and they want to get more stuff on-line so that when you call with a question, the person at the IRS can retrieve a copy of your records while you're still on the phone. But then: "We should be able to provide you on-line access to that information. ... You will have the availability to know what your current account information is, very much like if most of us who have an American Express Card, you can call -- you don't really know where that 800 number goes, but what you do know is when that person answers your call, they have your complete account information. ... They can give you information on your account, they can update your account, or they can provide you futuristic looks into your account as to where you might be next year, even, for filing tax returns. We've often talked about, and this is the terminology that I used when I was in on a task group, we've talked about the "golden eagle" return. This is the golden -- or gold American Express Card return. At the end of each year, if you have an American Express Card, you get a gold account summary of what you've done for the year. ... Basically, what I say is that if I know what you've made during the year, if I know what your withholding is, if I know what your spending pattern is, I should be able to generate for you a tax return so that I only come to you and tell you, 'This is what I think you should file for the next year, and if you agree to that, then don't bother sending me a piece of paper.' ... But I am an excellent advocate of return-free filing. We know everything about you that we need to know. Your employer tells us everything about you that we need to know. Your activity records on your credit cards tell us everything about you that we need to know. Through interface with Social Security, with the DMV, with your banking institutions, we really have a lot of information, so why would you, at the end of the year or on April 15th, today, do we ask the post office to encumber themselves with massive numbers of people out there, picking up pieves of paper that you are required to file? ... We could literally file a return for you. This is the future that we'd like to go to." Lest there be any doubt, she was entirely serious, and she clearly expected that that we'd all think this is as wonderful as she does. Regards, John Levine, johnl(a)iecc.com, jlevine(a)delphi.com, 1037498(a)mcimail.com

1 0

Chill out.... was Re: Keyserver service outRAGE
by Pat Farrell 17 Dec '03

17 Dec '03

"Perry E. Metzger" <perry(a)snark.imsi.com> writes: > Rather than everyone freaking out about 2.5, why not just wait a few > hours until the FTP site is announced and look at the thing for > ourselves? > > Myself, I'm running on the assumption that this is a good thing, > because now PGP is completely legal in the U.S., and doubtless a PGP > thats legal overseas using a library compatible with RSAREF will > appear within days of release. Amen to this! Wait a week, and this might be a great thing. If not, keep using 2.3a. I know that Jim Bidzos was interested in having a "pgp compatible" program that started with rsaref and was legal and free. I know because I asked him about liscensing last spring. He pointed me to an effort that professor Jeffery Schiller (pgp key 0C4EE1 (jis@mit) on the usual servers) was coordinating. I exchanged a few messages with a student up there, then got lost in GMU work and lost track. I think the student did something else, like crack RSA-129. But there are lots of students at schools like MIT and GMU. I sure hope this can provide a cloud free PGP for broke students. Lets drop this thread for while, ok? Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

2 1

MIT keyserver: don't panic...
by Mike Ingle 17 Dec '03

17 Dec '03

Take a look at pgformat.doc, which is included in the source or doc releases of pgp23a. Both the public key and signature packets have only a single-byte version number, which is always equal to 2. So there is no way to tell by looking at your key which minor version (2.xx) it was created by. You can tell which version was used to extract it to ascii armor by looking at the "Version: 2.xx" line in the ascii armored message. So get a text editor. Big deal. You will not have to regenerate your keys and get new signatures on them. If we have a no-doubts legal PGP, with source code, and free, that's good! If something sucks about it, PGP23a is not going to disappear. This can only be a positive development. As for why the keyserver crippling was imposed, RSA can lose its patent rights if it can't show in court that it made an effort to prevent its patents from being infringed. --- Mike

1 0

DefenseServices
by Peter Murphy 17 Dec '03

17 Dec '03

From: "Perry E. Metzger" <perry(a)snark.imsi.com> Sender: owner-cypherpunks(a)toad.com Precedence: bulk Status: R _______ MESSAGE BEGINS ___________ Jim Miller says: > Section #120.9 of the ITAR defines "Defense Service" as: > > (1) The furnishing of assistance (including training) to foreign > persons, whether in the United States or abroad in the design, > development, engineering, manufacture, production, assembly, testing, > repair, maintenance, modification, operation, demilitarization, > destruction, processing, or use of defense articles; or > (2) The furnishing to foreign persons of any technical data > controlled under this subchapter (see #120.10), whether in the United > States or abroad. This is sick. According to this, I cannot teach foreigners about cryptography in the U.S. -- even about the open literature. This is a grotesque denial of my first amendment rights. I wonder if I should hold an open enrollment cryptography class for the sake of civil disobediance. Perry ______ MESSAGE ENDS _________________________________________ That's interesting..... My cryptology lecturer seems to have an American Mid-West accent (not Canadian - I can generally tell), and seems to be commiting the "heinous" crime of teaching such matters to mainly Australian people. He seems to be on conference somewhere overseas. Well, I hope he doesn't get arrested if he crosses any U.S. border posts. It would certainly piss me off. (For one thing, it would fuck up my syllabus :-[.) Seriously, I don't think it is an offense to teach cryptology to non-NAFTA nationals. All of the stuff is non-classified, and he seems pretty aware of the legal issue of cryptology. That is, he wouldn't do anything that he could be nabbed for (discounting any warped interprepation of the legal statutes...;-( .) ======================================================= | Peter Murphy. <pkm(a)maths.uq.oz.au>. Department of | | Mathematics - University of Queensland, Australia. | ------------------------------------------------------- | "What will you do? What will you do? When a hundred | | thousand Morriseys come rushing over the hill?" | | - Mr. Floppy. | =======================================================

1 0

PGP.....
by lile＠netcom.com 17 Dec '03

17 Dec '03

The MBone session "Cyberstation:audio feed" is going to have Jeffrey Schiller talk about the new public PGP V2.5 release.... Cygnus has a mbone connection.... -lile ps. You can also see info at http://www.media.org/pgp.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lile Elam | "Remember... No matter where you go, there you are." lile(a)netcom.com | Un*x Admin / Artist | Buckaroo Banzai ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0