December 2003 - cypherpunks-legacy

Re: CLIPPER COMPROMIZED!!!! :-)
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

There's been a report going around linking Aldrich Ames to Clipper. Back when I read alt.folklore.urban a lot, I'd see stories like that. My guess about the origin of this report is that it evolved like this: - Somebody on talk.politics.crypto posts a comment like "Oh, come on - if the CIA can't prevent trusted spies like Aldrich Ames from leaking the names of other spies, how will the NSA keep its people from giving away the CLipper secrets, either for bribes or for "patriotic" reasons like loyalty to the "Office of the President". - Somebody else reads that and says "What if a *spy* like Aldrich Ames gave away Clipper?" - Somebody else reads that and says "Does anybody know if Aldrich Ames had anything to do with Clipper?" which somebody in the press hears somebody say to somebody else, and it turns into a report like: > <<CLIPPER COMPROMISED? "Security Insider Report," a monthly newsletter > published in Seminole, Fla., has reported that government officials are > seeking to determine whether former CIA employee and alleged traitor > Aldrich Ames may have sold information to the Russians about the > government's secret key-escrow technology used in Clipper Chip chipsets > and Capstone Tessera cards. The secret key-escrow technology, dubbed > Skipjack, can be used to encrypt network voice and data. which must *obviously* be true because it came off the *wire services*... Probably Aldrich Ames didn't have any contact with the people in the NSA doing Clipper or the FBI people doing Digital Telephony Prevention. Bill

1 0

Re: What's so bad about a Surveillance State?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> So did you receive/collect a goodly number of responses > to this question? ~ Blanc > Not as many as I'd hoped. And most of them said pretty much the same thing: pro: crime would be reduced con: freedom would be eliminated My primary goal was to generate thought and discussion. In that light, my original post did succeed somewhat. However, I haven't received enough variety in the responses to construct a good list of pros. I think I should rephrase the question and post again. I should not ask for the pros and cons of a "surveillance state", rather, I should ask for the pros and cons of "government sponsored surveillance technology/programs". I want to get people to think about possible benifits of government sponsored surveillance. Not because I like government sponsored surveillance, but because I feel that thinking about the technology from a "pro" perspective will give the "anti" (or better, the "indifferent") people insight into how the pro-surveillance people might attempt to justify the programs they advocate. "It is easier to defeat you enemy if you can view the battlefield from their chair." -- somebody famous probably said something like this 2000 years ago Jim_Miller(a)suite.com

2 1

Re: CLIPPER COMPROMIZED!!!! :-)
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>From: wcs(a)anchor.ho.att.com (bill.stewart(a)pleasantonca.ncr.com +1-510-484-6204) >>> <<CLIPPER COMPROMISED? "Security Insider Report," a monthly newsletter >> published in Seminole, Fla., has reported that government officials are >> seeking to determine whether former CIA employee and alleged traitor >> Aldrich Ames may have sold information to the Russians about the >> government's secret key-escrow technology used in Clipper Chip chipsets >> and Capstone Tessera cards. The secret key-escrow technology, dubbed >> Skipjack, can be used to encrypt network voice and data. > >which must *obviously* be true because it came off the *wire services*... >Probably Aldrich Ames didn't have any contact with the people in the >NSA doing Clipper or the FBI people doing Digital Telephony Prevention. Ames may have had access to the rationale Dot and an un-named white house source were quoted to effect ' ..if you knew what I know, you would understand the need' (in effect tying Clipper to national security). Were he to compromise how good the interception is IN THIS COUNTRY to a foreign powers intelligence service, for instance, it might severly change their way of doing communications in the U.S. (the target country). Thus, nullifying some of the effect of say, a hypothetical successor to SHAMROCK, (Allen Steeles Big Ear).

2 1

FWD: RIPEM/SIG - Worldwide Digital Signature Software
by Christopher Allen 17 Dec '03

17 Dec '03

I thought some of you might be interested in this. -----BEGIN PRIVACY-ENHANCED MESSAGE----- Proc-Type: 2001,MIC-CLEAR Content-Domain: RFC822 Originator-Name: jim(a)chirality.rsa.com Originator-Certificate: MIIB0TCCAXoCECnMhIY+nEfjCOoQ6zRCtbAwDQYJKoZIhvcNAQECBQAwbTELMAkG A1UEBhMCVVMxIDAeBgNVBAoTF1JTQSBEYXRhIFNlY3VyaXR5LCBJbmMuMRwwGgYD VQQLExNQZXJzb25hIENlcnRpZmljYXRlMR4wHAYDVQQDFBVqaW1AY2hpcmFsaXR5 LnJzYS5jb20wHhcNOTQwMjAzMjI1NTIxWhcNOTYwMjAzMjI1NTIxWjBtMQswCQYD VQQGEwJVUzEgMB4GA1UEChMXUlNBIERhdGEgU2VjdXJpdHksIEluYy4xHDAaBgNV BAsTE1BlcnNvbmEgQ2VydGlmaWNhdGUxHjAcBgNVBAMUFWppbUBjaGlyYWxpdHku cnNhLmNvbTBZMAoGBFUIAQECAgIFA0sAMEgCQRXPDLvu49Ikame3mN/Yci1FUijy EQfqFWhjifbbXCawQz2rnKgnKedJXi4YePJ/XlG75EFvS+2LvEYmi43mjZVNAgMB AAEwDQYJKoZIhvcNAQECBQADQgAB3sOZFwyhZrc6MYHfPsAFqY5UwXj40xShPJdU tD8moSL01EL1lzMOBU4VWjUQLQrpu/pXBAMn9XVDDOUqPmQm8g== MIC-Info: RSA-MD5,RSA, CewPjwtOrehhCf0+jTJygRCLL1qQuK5ezzwZCGkkrRfoHIJA5INVIKoeDSztImvm qrKofD6ofR0jqxOkjFG0isI= More info: Kurt Stammberger, RSA Data Security, Inc. 415/595-8782 To download RSAREF and RIPEM, send any message to rsaref(a)rsa.com or ftp from msu.edu RSA DATA SECURITY ANNOUNCES DIGITAL SIGNATURE SOFTWARE THAT IS FREE AND LEGAL WORLDWIDE Information superhighway gets free tool to authenticate information; an answer to Vice-president Gore's concerns over Internet break-ins - --------------------------------------------------------- Redwood City, Calif. (March 21, 1994) - RSA Data Security, Inc. announced today a first: digital signature software that is both free and legal worldwide. RSA applied for and received a "commodities jurisdiction," or CJ for a software package called RIPEM/SIG, which was built with RSA Data Security's RSAREF toolkit, a freeware package. A CJ, which is a ruling that the software falls under the Commerce Department's jurisdiction as opposed to the State Department, allows RIPEM to be freely and legally exported. Further, RSA has relaxed the use restrictions in its free crypto toolkit. RSAREF, and any application built with it, may now be used in commercial settings as long as it is not sold or used to provide a direct for-profit service. Digital signatures are produced using the RSA cryptosystem, which is a public-key cryptosystem. Each user has two keys - one public and one private. The public key can be disclosed without compromising the private key. The RSA cryptosystem was invented and patented in the late 1970's by Drs. Rivest, Shamir, and Adleman at the Massachusetts Institute of Technology, and was based on work by Whitfield Diffie and Martin Hellman at Stanford University. Electronic documents can be "signed" with an unforgeable "signature" by using a document/private-key combination to produce a signature unique to the author/document. Anyone, by using only RIPEM and the public key of the author, can verify the authenticity of the document. Applications of digital signatures are endless. One reason that the paperless office has never materialized is that paper must still be printed so that handwritten signatures can be applied. RSAREF and RIPEM solve that problem. Expense reports, any electronic forms, administrative documents, even tax returns can be electronically signed to speed electronic document flow and eliminate fraud. Information on the Internet can be signed and verified to prevent spoofing. Recently, unauthenticated messages at Dartmouth College caused an important test to be cancelled; messages impersonating faculty were sent out. "Data mailed, posted, or put on servers on the Internet is inherently untrustable today," said Jim Bidzos, president of RSA. "Tampering with electronic documents takes no special skills, and leaves no trace. With the availability of a free, legal, and exportable tool such as RIPEM, there's no need for such a situation to continue. It can be used by individuals, corporations, and government agencies at no cost." In a February 4th announcement, Vice-president Gore stated that the recent Internet break-ins could have been prevented with digital signatures. "Here they are," said Bidzos. Recently, cryptography has caused clashes between government and industry, over privacy issues, law enforcement concerns, and export issues. "The US government has approved this software for export," said Bidzos. "Clearly, it's no threat to them. And it's free." Digital signatures can also be used to detect any virus before a program is executed, since any change whatsoever is detected. The RIPEM application was developed using the RSAREF toolkit by Mark Riordan of Michigan State University. A Macintosh version, developed by Ray Lau of MIT, the author of the popular "Stufit" program, is also available. Versions for DOS, Unix, and all popular platforms are supported. "PEM" stands for Privacy Enhanced Mail, a published Internet standard for secure electronic mail. Other innovative applications can also be built with RSAREF and distributed at no cost. The full encryption-capable RIPEM is available only in the US. RSA digital signatures are a standard feature of Lotus Notes, the Apple System 7 Pro Operating System, Novell NetWare, Microsoft Windows at Work, Windows NT, IBM System Security Products, DelRina PerformPro, WordPerfect InForms, SHANA InFormed, BLOC F3 Forms, Fischer International Workflow, and numerous other products. Over 3 million commercial products in the market today already use RSA signatures under license from RSA Data Security. Other RSA licensees include General Magic, Hewlett-Packard, Oracle, Unisys, Digital Equipment Corp, Motorola, and numerous others. RSA Data Security, Inc. designs, develops, markets, and supports cryptographic solutions toolkits and products. The company was founded by the inventors of the RSA cryptosystem in 1982 and is headquartered in Redwood City, California. -----END PRIVACY-ENHANCED MESSAGE----- ------------------------------------------------------------------------ ..Christopher Allen Consensus Development Corporation.. ..<consensus(a)netcom.com> 4104-24th Street #419.. .. San Francisco, CA 94114-3615.. .. o415/647-6383 f415/647-6384.. ..Mosaic/World-Wide-Web Front Door: .. ..ftp://netcom7.netcom.com/pub/consensus/www/ConsensusFrontDoor.html ..

1 0

BusinessWeek 3/21 -@ antiClipper articles
by baum＠newton.apple.com 17 Dec '03

17 Dec '03

Don't you hate it when you see something posted after it's already old news, and its been posted 3 times already. I hope I haven't done that. The March 21 business week has a full page article on Clipper, the FBI Telephony bill, and relatved matters. It has a back page editorial that comes down REAL hard on Clipper, using a warning from Thomas Jefferson. I think the they're getting the idea. ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, 20525 Mariani Ave, MS 305-3B * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

1 0

Re: Getting EFF to sign their postings
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> Can you use PGP after you buy ViaCrypt? After all, you paid for > ViaCrypt, and since it's supposedly the same as PGP, can you simply > use PGP and mention that you have purchased ViaCrypt? No. ViaCrypt uses a licensed version of RSA code. Regular PGP doesn't. When the ViaCrypt port to Macs comes out, you'll be able to use that, though. Now, if you mean "Can you use it without getting caught, as long as you remember to change the Version number in your PGP and recompile?" - probably. But that's not EFF's objective :-) > The other thing you could do is get a PC hooked up via appletalk to > your Mac network (or via ethernet, etc.) You could send batch files > for it to execute somehow, and it should run in full speed. [approach deleted...] > Shouldn't take more than a few days worth of work to implement... Sounds doable. I'd hate to have to count how many hacks like that I've built over the years :-) Bill

1 0

Def Con
by flesh＠wps.com 17 Dec '03

17 Dec '03

A while ago someone posted the latest Def Con announcement for Vegas. Seeing that I'm planning my wedding around it, could someone please re-post it? 'Tanks.

3 2

Re: Counterfieting $$$$
by Jeremiah A Blatz 17 Dec '03

17 Dec '03

Excerpts from internet.cypherpunks: 18-Mar-94 Re: Locating Color Copiers by stevenJ(a)alpha1.csd.uwm.e > Additionally, it's only possible to photocopy $1, $5 and $10 because anything > larger than that has that funny little strip of plastic in the bill. Actually, they have strips on the tens, too. Re: passing bills Okay, so the 10's and 20's have little mylar strips on them. You can't copy old bills, because they get wrinkles, and, anyway, if someone handed me a crisp, new 1983 $20 I'd get a bit suspicious. There are ways to age bills, but they look a lot less convincing. However.... What night manager at Denny's knows about the strips. How many times have you seen someone at your local convience store check for the strip when you hand them a $20. If you travel a lot, and never use counterfiet bills for transactions where your name is recorded, you can do lots with counterfiet money. True, though, if you wanted to sell suitcases of it for $3 per twenty dollar bill (I just guessed at the price), you may have a problem. Not a crook, Jer darklord(a)cmu.edu | "it's not a matter of rights / it's just a matter of war finger me for my | don't have a reason to fight / they never had one before" Geek Code and | -Ministry, "Hero" PGP public key | http://www.cs.cmu.edu:8001/afs/andrew.cmu.edu/usr25/jbde/

1 0

PGP/ViaCrypt
by John B. Fleming 17 Dec '03

17 Dec '03

I just obtained a copy of PGP 2.3a about 2-3 months ago and have been using it off and on. I just subscribed to this list a couple of days ago and have seen mentions of ViaCrypt PGP. I did a little research, and I now know what ViaCrypt PGP is. My question is, what are the details surrounding the licensed RSA technology in the two. I have gathered that Freeware PGP does NOT have a license, and ViaCrypt PGP does. ... Does this mean in any way that it is technically illegal to use Freeware PGP? Or does it even matter? Thanks John -- FLEMINGJ(a)WABASH.EDU -- (Please request PGP public key via e-mail)

1 0

Re: EFF gun-shy of legally employing PGP
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Anonymous is alleged to have said: > : > Yes, but the point of the reply, is that PGP signatures SHOULD > : > be used by sysops. > : Hmmm... why PGP, as opposed to the FIPS Digital Signature Standard? > Yes, you can use the DSS (unless it is given away to PK partners, that is). No, you can't use the DSS. The reason NIST was getting into confusion about whether they have to give it to PKP is that PKP says that it infringes on Schnorr's patent, which they recently bought up; assuming that's true technically (I haven't looked in a while), this means you need a license from PKP to use DSS. Unlike RSA, which the government has some rights to use because it partially funded their work, even the government doesn't have rights over Schnorr's work, since they didn't fund it, so the NIST is in deeper yogurt with DSS than with RSa signatures. You can still use DSS for research and the usual things you can use patents for without a license, but you can do the same with PGP. RIPEM can be used free non-commercially in the US+Canada under the RSAREF license terms, and RIPEM-SIG can even be exported. (Now all we need to do is find a way to get RIPEM-SIG to do key exchange and message encryption as well as signatures and patch it into PGP :-) (presumed not possible...) Bill

1 0