December 2003 - cypherpunks-legacy

Fuhrman needed a digital pseudonym!
by tcmay＠got.net 17 Dec '03

17 Dec '03

Before you folks jump on the "racist" Mark Fuhrman, think about the "surveillance state" issues. While it was not any government organization that taped Fuhrman's comments, there are some real issues involved in how deeply and how far back we want to "mine" comments made by people. Some real issues of privacy. The Mark Fuhrmans of the future may be interested in using technologies to protect their privacy, to give them "plausible deniability" should their recorded words come back to haunt them. Brief comments: * This post is primarily about the role of pseudonyms, not the OJ trial or the testimony/tapes involving Mark Fuhrman. * And the issue of "mining" of ancient records, especially as technology makes the recording of sounds, the taping of sights, and the archiving of electronic messages so much easier. * Those who think this is off-topic because it has nothing to do with coding in C are hereby invited to hit the "D" key, or whatever passes for it, right now. Caveat: I've watched entirely too much of the OJ trial on CNN, as I sit here at home and surf the Net every morning. It's easy to have the television on, and the OJ trial has had many interesting twists. When the stuff gets boring, I switch to music or perhaps to the financial network CNBC. So, I've see nearly everything being talked about here. Opinion on OJ: ***elided by Tim to head off debates about OJ's guilt or innoncence***. (I state this to show my prejudices, not to start an "OJ debate" on this list. Actually, I just elided (deleted) the opinion I had expressed, so as not to inflame anyone here.) What really bothers me, as it relates to the pro-privacy themes of this list, is the reaching back many years to comments made by a witness--Mark Fuhrman--to a screenplay writer. Because she kept audiotapes, going back 10 years, these comments may likely strongly influence the verdict in this "trial of the century." Anyone in favor of heading off the "surveillance society" should be alarmed at this development. As tape recorders and video cameras proliferate, comments may be compiled, taken out of context, and used as evidence. (Who amongst us has not said "nigger"? Does it count if I am asking why the rap group "Niggas with Attitude" chooses to label themselves as niggers? I figure that if blacks routinely call themselves niggers and call folks like me "honkies," then it's fair to call _them_ niggers. Not that I do this, but I don't see the term as so horrifying as to cause a killer like OJ to get off as this spectacle unfolds. Besides, it's become "permissable" for black leaders to refer to New York City as "Hymietown" in a way that would result in public stoning for a white to refer to a city as "Niggertown." The old double standard.) The point: Fuhrman should have used a pseudonym, should have taken steps to protect his identity. Of course, in 1985 this would have been harder. But have people given up the right to speak "for themselves" in private? If there is no solid evidence that Fuhrman actually committed any crimes, but only appeared to be puffing himself up, a la a Wambaugh wannabee, then why are his "racist" and "sexist" comments deemed so important as to have derailed the trial for the last couple of weeks? I have said an awful lot of inflammatory things at Cypherpunks meetings, at parties, in political discussions, and so forth. I don't claim that there should be a law against people bringing these issues up, or even a law against tape-recording various kinds of meetings. I just argue that we are devolving into a surveillanc To be sure, there are valid trial issues: -- Did he misspeak, misremember, or lie when he said he had "never" used the word "nigger" in the past 10 years? (I recall at the time, circa Feb-March, thinking to myself "Oh, sure!," when he said he had not used the word nigger in the past 10 years.) -- If this is perjury, how does it affect other evidence? (I'm not a lawyer, but I grok from the comments on CNN that this has to do with whether his testimony was supportive of other evidence, "cumulative," and related issues.) -- Does this possible misspeaking, misremembering, or lying have anything to do with whether he planted the bloody glove? -- etc. There are various valid issues. Spending a few weeks on these issues is another matter, though, IMHO. In my view, if I were the judge I'd have forced this issue to be resolved in hours, not weeks. Anyway, I am greatly disturbed by this "mining" of ancient comments, made to a screenwriter. Whether Fuhrman is a "racist" or not, this witch trial is a diversion from the real issues. And some real privacy issues are raised. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

TestTest
by Anonymous 17 Dec '03

17 Dec '03

Test

1 0

No Subject
by Pasquale Piombino 17 Dec '03

17 Dec '03

Hi all, I am searching PGP software. Does anyone know where I can download it? Thanks for answers. -+-+------------------->->--------------------------------:-Q------------ ° Pasquale Piombino | | Via Colombo, 35 Email: mr.xxx(a)ce.flashnet.it ° ° I-81100 CASERTA Phone - Fax: 0039 823 329152 | | ITALY ° +-+-------------8-)---------------------:-))-----------------:-o---------

1 0

Re: Some details on RSA Secure
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:48 AM 8/31/95 PST, "baldwin" <baldwin(a)RSA.COM (Robert W. Baldwin)> wrote: >Here are my biased comments on RSA Secure. They are biased by >the fact that I an a techie who works for RSA Data Security. >Neatest Features: >- It is integrated with the File Manager on Windows and the > Finder on Mac System 7. It's an interesting approach - simpler than installing as a file system (I'm not using SecDrv because it needs a separate partition), but so far it seems relatively useable. On the other hand, since there are file types it refuses to encrypt, like DLLs, there are some things it can't protect (like DLLs with passwords embedded in them.) >- A settable list of files can be automatically decrypted (or > encrypted) on system startup (or shutdown). I've got mixed feelings about this - since my password has normally timed out by the time I shut down, it demands a password before shutting down, and if I had any large amount of data there, I assume it would take a while to reencrypt on my 386-box. (Laptops are generally slower than similar-age desktops, and you often want to shut them down quickly, even when they aren't shutting themselves down to save power.) I haven't tried powering it off during this process, but I assume that at best the files would be unencrypted and at worst there'd be one half-decrypted and sitting in limbo to be trashed the next time the system starts up? >Technical Features: >- The user's passphrase unlocks a master key that is used to unlock > the file encryption key for each file. Since the documentation mentions 512-bit and 1024-bit RSA keys, I'd guess that each file has a separate random RC4 key which is stored in the file header, encrypted with the user and escrow RSA keys plus the MD5 hash, plus the encrypted real filename? (The alternative would be that the userpref.!!! file contains an RC4 key encrypted with RSA, which is used to encrypt the file keys, but that would lead to much shorter headers, and cracking that master RC4 key would then allow cracking of all documents on the system, so I'm guessing that's not the approach used.) >Request for Improvements: 1) The "Emergency" menu item in the File Manager is annoying. Could it be combined with the RSA menu item, eliminated, or at least have the option of abbreviating the name? 2) Can keys and files be shared between multiple machines, i.e. the same user keys on a desktop and laptop, so that individual encrypted files can easily be moved back and forth? #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: Canarypunk: Jim Bell in a coalmine
by John Young 17 Dec '03

17 Dec '03

>From the Privacy Act Online via GPO Access [wais.access.gpo.gov] [DOCID:tres_irs-99] DEPARTMENT OF TREASURY Treasury/IRS 60.001 System name: Assault and Threat Investigation Files, Inspection--Treasury/IRS. System location: Office of the Chief Inspector, National Office; Regional Inspectors' Offices; as well as offices of the District Directors. (See IRS appendix A for addresses.) Categories of individuals covered by the system: Individuals attempting to interfere with the administration of Internal Revenue laws through threats, assaults or forcible interference of any officer or employee while discharging the official duties of his position, or individuals classified as potentially dangerous taxpayers, based on verifiable evidence or information that fit the following criteria: (1) Taxpayers who physically assault an employee; (2) taxpayers who have on hand a deadly or dangerous weapon when meeting with an employee and it is apparent their purpose is to intimidate the employee; (3) taxpayers who make specific threats to do bodily harm to an employee; (4) taxpayers who use animals to threaten or intimidate an employee; (5) taxpayers who have committed the acts set forth in any of the above criteria (1) through (4), but whose acts have been directed against employees of other governmental agencies at Federal, state, county, or local levels; (6) taxpayers who are not classifiable as potentially dangerous through application of the above criteria (1) through (5), but who have demonstrated a clear propensity toward violence through acts of violent behavior to a serious and extreme degree within the five (5) year period immediately preceding the time of classification as potentially dangerous; and (7) persons who are active members in chapters of tax protest groups that advocate violence against IRS employees. ...

1 0

Re: O.J. ObCrypto: Fuhrman's Folly Fans Fakery Fears...
by Bill Stewart 17 Dec '03

17 Dec '03

>I do not think that PGP 2.x can easily (ie: Automatically) use one key for >Signing and another for Encrypting a Message (it does both at the same time >if you ask). If I "Clear Sign" a message and then Encrypt it, then I get >the result but I'm not sure if doing the decrypt on such a message will >automatically spot the signature and verify it (as would occur with a E+S >pass). PGP identifies the key for decryption and signature checking from the message. When you're signing a message or key, you can pick which of your keys to use with the -u option. The difficulty is getting people to use your encryption key instead of your signature key when encrypting stuff for you. Derek mentioned one approach (get people to load the encryption key first); unfortunately, you can't predict their behavior, and if you change encryption keys more often than signature keys, they'll load the newest encryption key last. Another approach is to identify them in the names - my key certification key says "KeyCert-only" in the text. For the problem that started this discussion, though, there's no good solution. Since the Bad Guys _can_ encrypt a message to you with your signature key, and send it to you by anonymous remailer, they can plant a reason to suspect that you may have evidence encrypted with that key. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

2 1

Re: SSL search attack
by rkw＠dataplex.net 17 Dec '03

17 Dec '03

I wrote >>> Assuming that you are multi-threaded--- Simply run two "workers" on the >>> same machine. If there are delays in getting keys assigned, the two will >>> soon get out of phase and keep the cpu busy. >> I kind of like that idea... > To which Piete Brooks replied: >I thought of that, but: >1) for the same server load, it doubles the number of unACKed segments >2) if process A is lagging process B, then when process B finishes and is idle > waiting for the server, process A will run faster and thus reduce the lag. > This will make the processes drift into phase. > I'm not convinced one way or the other. But you forgot that when process A finishes, process B will run faster and re-establish its lead. The real question is what is the parameter that we need to minimize? Assuming that the key is distributed in the keyspace with a uniform probability, then what we need to minimize is the expectation that two or more workers are searching the same keyspace. As long as we never reach the point that all of the keys have been distributed, it does not matter how many or in what method they are assigned. (The "fairness" WRT a prize being ignored) The assignments only become important as we exhaust the space and must prepare to make another pass. Note that we never got to that point on challenge 2. The assignment of the block containing the key was processed on its first pass and the key was found. In this regard, it is probably "best" to first attempt to identify those space assignments that have been lost. If we associate with each key, either explicitly, or by inference, an expected completion time, those segments which are most overdue are certainly good candidates for having been lost. Based on our previous try, and the assumption that we would not have extremely different resources available, the master allocator would not NEED to get reports back for the first say 12 hours. That is not to imply that reports should be delayed that long, but only that there is considerable opportunity to have a hierarcy of intermediate collectors that have plenty of time to adjust their allocation algorithms to match the ability of their workers. Later, more rapid response would be needed. When the required response becomes too small for the "little guys", they could be sloughed off on the next problem, leaving the "big boys" to clean up the last pieces. Of course, the "next" problem might be to resolve the same problem because the correct answer was incorrectly reported as not found. As I see it, except for perhaps the fastest of machines there is little reason to allocate to the workers more than one segment at a time. Their supervisor can quickly respond to requests for work and consolidate the results to be passed up the chain. The only reason that I can see to separate the acks from the assignments is to be able to have "memory-less" nodes. This is certainly unnecessary if there is a web of supervisor servers. I have a lot more thoughts that I will defer to the next missive. Gotta' run... ---- Richard Wackerbarth rkw(a)dataplex.net

1 0

New use for Eternity Server
by kelly 17 Dec '03

17 Dec '03

Maybe someone should feed the pgp 5.0i sources to a c to HTML converter and post the output to the eternity servers.. mmm

4 5

Key Escrow Workshop agenda & discussion paper 3
by Pat Farrell 17 Dec '03

17 Dec '03

The following message segment: ------------------------------ From: Arlene Carlton <carlton(a)micf.nist.gov> Fri, 01 Sep 1995 15:30:46 -0400 Cc: carlton(a)micf.nist.gov Subject: Key Escrow Workshop agenda & discussion paper 3 September 1, 1995 Dear Participant: Thank you for agreeing to participate in the two-day meeting on software key escrow encryption. We are anxious to work with you and other industry representatives to facilitate development of exportable key escrow encryption in software products. I look forward to the workshop being an important step in that process. [snip] --------------------------------- Was sent to the following folks. I assume that this means that these people are participants. I see Dan W from CDT, Soble from EPIC and Whitfield Diffie, on our side, plus assorted folks with stakes such as tis.com and netscape.com And of course, DERD for the other side. Blank Unicorn had posted to c'punks that he was attending. Of course, while I know what he looks like, I have no idea which nym is his. Pat List of attendees/registered participants follows: 100436.3361(a)compuserve.com, 73167.2027(a)compuserve.com, 73534.3011(a)compuserve.com, 75300.3232(a)compuserve.com, 76225.2603(a)compuserve.com, ablee(a)mitre.org, ads012(a)email.corp.mot.com, ams(a)eit.com, amte09(a)email.corp.mot.com, asteen(a)novell.com, baum(a)world.std.com, bekutz(a)aol.com, bflowe(a)mcimail.com, bill.poulos(a)oga.eds.com, bill.poulos(a)oga.eds.com, branstad(a)tis.com, bsaclu(a)aol.com, c.baggett(a)cablelabs.com, carol.donovan(a)network.com, ccrafton(a)gi.com, charlesabzug(a)acm.org, ckc(a)rfpo1.rfc.comm.harris.com, cmo(a)cohnmarks.com, coallen(a)us.oracle.com, cpadilla(a)attmail.com, cpadilla(a)attmail.com, csmith(a)steptoe.com, davery(a)grci.com, david_rose(a)ccm.fm.intel.com, ddodson(a)nist.gov, denning(a)cs.cosc.georgetown.edu, deyoung(a)rpcp.mit.edu, dinsmore(a)tis.com, djw(a)cdt.org, dkozlay(a)ire.com, dmiller(a)spa.org, Don_Sortor-ads012(a)email.corp.mot.com, ebarker(a)nist.gov, ed(a)tecsec.com, emessmer(a)world.std.com, ezzy_dabbish-amte09(a)email.corp.mot.com, flahavin(a)csmes.ncsl.nist.gov french(a)zeke.enet.dec.com, gomes(a)dockmaster.ncsc.mil, gordon(a)ipower.nsc.com, hoffman(a)seas.gwu.edu, housley(a)spyrus.com, hoydyshd(a)mcln.unisysgsg.com, i.goldsmith(a)nexor.co.uk, infocker(a)megaweb.com, jackk(a)microsoft.com, jag(a)jgvandyke.com, jaltman(a)milchev.com, jamanni(a)missi.ncsc.mil, james.hughes(a)network.com, jdrandall(a)vnet.ibm.com, jean_m_baronas(a)co.xerox.com, jeff.rulifson(a)Eng.Sun.COM, jeff(a)netscape.com, jerry(a)ods.com, jgheiner(a)aol.com, jimmy(a)ipower.nsc.com, jimn(a)calv1.cray.com, jkrauss(a)cpcug.org, john(a)ipower.nsc.com, john_pascatore(a)ivision.com, jroberts(a)cmp.com, js(a)cup.hp.com, jseiger(a)cdt.org, jwinston(a)ota.gov, jya(a)pipeline.com, jya(a)pipeline.com, kandy(a)micf.nist.gov, karen.randall(a)att.com, kawamoto(a)mitre.org, kaye(a)ix.netcom.com, kent_landfield(a)sterling.com, khrose(a)annap.infi.net, klensin(a)mci.net, lc2m(a)andrew.cmu.edu, lcarnahan(a)nist.gov, lhg(a)nrc.gov, lovornj(a)usva8.dyncorp.com, lshomo(a)hqops.hq.nasa.gov, lthrash(a)hqamc.army.mil, lydia.bell(a)tip.navsea.navy.mil, maitgmu(a)aol.com, martin.ferris(a)treas.sprint.com, mary_smolenski(a)ita.doc.gov, mbohannon(a)banyan.doc.gov, mccord(a)nosc.mil, melanie.carter-maguire(a)nt.com, mendelson(a)tis.com, mfa(a)compaq.com, michael.palgon(a)sciatl.com, mignon(a)atc.boeing.com, mikus(a)viacrypt.com, mjl(a)liii.com, mpapillo(a)snap.org, mpapillo(a)snap.org, mppulkk(a)mikropc.fi, mrainey(a)itic.nw.dc.us, murray2(a)vnet.ibm.com, natstrat(a)dgs.dgsys.com, nazario(a)csmes.ncsl.nist.gov, paradise(a)wellsfargo.com, pfarrell(a)netcom.com, pjclark(a)ix.netcom.com, po7114(a)email.mot.com, polk(a)csmes.ncsl.nist.gov, powar(a)visa.com, randy(a)mci.net, ravenis(a)novell.wd.cubic.com, rjg9324(a)glaxo.com, rjoconnor(a)aol.com, rmedlock(a)mitre.org, roberth(a)bsa.org, rolfe.doc.gov(a)micf.nist.gov, rozzie(a)iris.com, rwessman(a)us.oracle.com, sbaker(a)steptoe.com, Schneck(a)mitre.org, Schneck(a)ncsl.nist.gov, sevans(a)csn.com, shabbir(a)panix.com, simona(a)sea.org, sking(a)mitre.org, sltm(a)msg.ti.com, snouffer(a)st1.ncsl.nist.gov, sobel(a)epic.org, squires(a)arpa.mil, stuart(a)bellcore.com, stw(a)atc.boeing.com, sullivan(a)interramp.com, tajalli(a)tis.com, tec.teclgl(a)micf.nist.gov, ted_gerbracht(a)ml.com, tfuhrman(a)ostp.eop.gov, thomas_clare(a)sterling.com, trivers(a)is.ge.com, trstsc(a)tevm2.nsc.com, ttobin(a)atl.ge.com, wafranklin(a)attmail.com, walker(a)tis.com, walt(a)osf.org, walters(a)snad.ncsl.nist.gov, wford(a)bnr.ca, whitehurst(a)vnet.ibm.com, whitfield.diffie(a)Eng.Sun.COM, whpayne(a)abq-ros.com, wmcglone(a)milchev.com, wright(a)dockmaster.ncsc.mil, Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

Re: Fuhrman needed a digital pseudonym!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:00 PM 9/1/95, Jeff Barber wrote: >I don't see any "surveillance state" issue. Fuhrman openly agreed to >speak to the screenwriter. AFAIK, he had no reason to believe the >screenwriter wouldn't tell anyone else. Nor should he have counted on >that anyway. Any loss of credibility (or other penalty) he receives >is entirely deserved, IMO. By the way, McKinny did not volunteer the tapes, nor did she consent to having them taken from her and used by the Defense. Private property was taken by a court action (the North Carolina lower court ruled that the tapes were the property of McKinny and could not be taken, then an appeals court overruled this decision and ordered McKinny to produce the tapes). (It is not clear how Cochrane and his team learned of the tapes. Speculation is that McKinny's agent or lawyer was doing some freelance shopping-around of the script. McKinny has denied that she was trying to sell the tapes. Regardless, they are her property and should only come in to a court case when directly and centrally involved. This is closely related to the Church of Scientology issue, and is being debated on another mailing list I'm on, the Cyberia list.) This raises serious issues. She was a screenwriter, Fuhrman was helping her to generate a salable script. Neither was speaking for the LAPD. (Kind of like the disclaimers we see on the Net, which I suspect are becoming worthless.) >> Anyway, I am greatly disturbed by this "mining" of ancient comments, made >> to a screenwriter. > >Not me. A few weeks there was a thread concerning the use of >information by private "reputation" bureaus. I can't find the thread >in the archives but I seem to recall you defending the right of >private entities to keep and distribute such information (my apologies >if this was someone else). Anyway, to me, these tapes fall clearly in You're imputing to my comments about what will happen, and what cannot be stopped except by coercion, a conclusion which you think is at odds with my point here. Just because I think people (like me, you, Laura McKinny, etc.) have the "right" to compile records, make notes, make tapes of conversations, etc., does not mean I think that courts can order them given to the court. (This is an issue I have with "discovery" in general, where even peripheral witnesses can be compelled to turn over diaries, journals, letters, tapes, records, financial reports, etc.) >the same domain. This screenwriter isn't a government agency, the >information was freely given, and the screenwriter has every right to >offer it for whatever purpose she deems appropriate, for free or >for money (barring any agreements to the contrary, of which I have >heard nothing). Again, to make it clear, McKinney did not offer the material and fought in the North Carolina courts to have her property kept confidential. The court ordered her to turn it over. (And apparently members of the defense team leaked the most damaging, and out of context, parts, provoking Ito to announce a major investigation of this is to come, with severe sanctions for those who leaked it.) We need a justice system which will not be dragged into spending a full year on this matter, with every indication that a mistrial or hung jury will result. I look forward to a day in which an OJ would get a reasonable, month-long trial...and then, if found guilty, be given an execution date no longer than a month away. As it is, OJ will be guesting on the talk show circuit. He butchers two people--from the overwhelming mound of evidence I've seen--and essentially cuts the head off of his ex-wife, but will likely get off as this trial spins out of control and fragments in various ways. Don't misunderstand my motivations: I'm sort of happy this is all happening. It makes people even more suspicious of governments and lawyers, and it will accelerate the disintegration of the current system. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0