December 2003 - cypherpunks-legacy

Re: HR361
by Rich Salz 17 Dec '03

17 Dec '03

Has anyone previously noted that HR361, the omnibus export administration act, would require the administration to assess the impact of the current crypto export controls on the software industry? I don't recall seeing mention of it, but this has been planned for awhile. There were a couple of crypto surveys, one by private industry (software publisher's association) and one by TIS for the gov't. I think. Both were mentioned in this list. /r$

1 0

Re: SSL RC4 challenge
by Hal 17 Dec '03

17 Dec '03

From: Hal <hfinney(a)shell.portal.com> > Here is a challenge to try breaking SSL using the default exportable > encryption mode, 40-bit RC4. > [...] It has been pointed out to me that I made a mistake in my analysis of the SSL packets. The MAC at the beginning of the encrypted packets is itself RC4 encrypted. That means that the 17 bytes of known plaintext start 16 bytes into the stream, not at the beginning as I thought. This just means that after key setup, RC4 has to be cycled 16 times before we start comparing its output with the XOR of the known plaintext and ciphertext. I'll produce a revision of my "challenge". If no other mistakes are found I'll post it to sci.crypt. Hal

1 0

Re: Crisis Overload (re Electronic Racketeering)
by Connie Sadler 17 Dec '03

17 Dec '03

Subject: Re: Crisis Overload (re Electronic Racketeering) Date: Thu, 13 Jul 1995 12:27:18 PDT A1-type: DOCUMENT Importance: normal >On July 13, 1995, Robert Hayden said: >Unfortunately, a system of social engineering needs to be adopted to get >massive use of cryptography started. This means, and I advocated this >from the day I entered this forum, that programs such as PGP need to be >redesigned so that the a user friendly . . . so user friendly that any >Joe Moron can figure out not only how to use them, but also how it helps >them and how it is "good" for them. This means that we need simplified >key management easy enough for the point-and-click masses to utilize. >... >Unfortuately, all I can do is stand on the sidelines and cheer, because I >am not a programmer; I'm a user and a teacher. Well put! I agree wholeheartedly! I have friends who are mostly teachers and writers who are interested in encryption from what I've told them, but their computer knowledge is pretty much limited to their word processors. A good user interface would do wonders for spreading the use of PGP. Unfortunately I am not a programmer either, but I am being motivated to become one. If only there was more time... Connie

1 0

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199507132116.VAA149322(a)smtp-gw01.ny.us.ibm.net>, jfmesq(a)ibm.net (James F. Marshall) wrote: > I haven't read the whole >bill, but I read the "regardless" phrase with a different emphasis. >In short, that language appears to mean that one could be pounded with >RICO for uploading crypto software even if the crypto is EXPORTABLE. The government doesn't want us to use any crypto that takes them an appreciable ammount of time to crack. It seems inevitable to me that such crypto will soon be outlawed. The same goes for anonymous remailers. It is only a matter of (very little) time. Yes, Black Unicorn is right. We need stealth encryption. Unfortunately even that won't help as much as one might think, because it can only be used by tight conspirators who are willing the to take the risk to be locked up in a concentration camp, I mean jail, for the rest of their lives. Crypto for the masses is about to fade away into history, before it ever really caught on. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMAWlEyoZzwIn1bdtAQFIYwF+JKboVVw7qm+Ejyj0ecTp1EbqWL2YCAlb tL3RLDWA5VLcKakMh2nI3oZns0SLknGw =+fvE -----END PGP SIGNATURE-----

1 0

Crisis Overload (re Electronic Racketeering)
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

Folks, I'm not going to exhort you to fight this latest travesty, to send angry letters to your senators and representatives. Every couple of months there's been a new legislative attack on what were once basic American freedoms. (Sorry to focus on America. I'm sure you folks in the liberty-loving paradises of, say, Germany, are gloating over our hand-wringing.) We're losing the war. We can send in donations to the NRA and EFF, offer our support to the ACLU and EPIC, but the tide just keeps rolling in, washing away our efforts. The full-time lawmakers in D.C. can proliferate new repressive laws much faster than we can fight them. Our focus on this list has been on crypto, and crypto is finally coming under the massive assault we knew would come from the earliest rumblings several years ago about "key escrow." Clipper was the warning shot, the current "War on the Internet" (fed by scare stories and hysteria) is part of the propaganda war, and now this bipartisan bill to expand the RICO Act to include any non-GAK implementation of crypto is the nail in the coffin. No wonder Stu Baker and Ron Lee were so smug at the last CFP. Ordinary lobbying is probably a lost cause. The EFF tried to "work with" the government (Administration, Congress) on the Digital Telephony Bill, and got rolled (in the opinion of many, even in the governing circles of EFF). This latest assault is probably unstoppable. The co-sponsorship by Sen. Leahy, once seen as an ally of the EFF (recall the attempts to get the Leahy alternative to Exon adopted), and the enthusiastic support of Republicans, Democrats, and the intelligence community means that GAK is coming. Oh, and the use of RICO and "conspiracy" in such a central way fulfills Whit Diffie's prediction of a few years ago that the main way crypto will be controlled is through such laws, by spreading fear, uncertainty, and doubt amongst users and corporations. Make the corporations so paranoid that they'll crack down on employees, adopt GAK methods, and freeze out the "street corner user" of crypto. (If the only users of PGP and other non-GAK tools are fringe groups and underground communities, then the main goals will have been achieved. The public use of PGP will have been squelched, the public use of anonymous cash will have been suppressed, and the social control goals will have been achieved. ) I think it's time to abandon all lobbying efforts...they don't appear to be working, and the government is proliferating new laws faster than we can fight them. The only hope is to more rapidly deploy crypto, to reach the "point of no return." Optimistically, we may already be there (the views expressed by many of us). Pessimistically, the application of RICO laws and civil forfeiture could put any of us who advocate crypto use and evasion of the new laws into a precarious position. This is enough to say for now. Suffice it to say I view the latest Grassley proposed legislation to be the culmination of the past several years worth of anti-liberty legislation. A much bigger threat than Clipper. In fact, it's what many of us saw implicit in Clipper. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

7 7

co-sponsors
by perry＠imsi.com 17 Dec '03

17 Dec '03

I searched Thomas and couldn't find any evidence of co-sponsors to the Senate bill. Am I wrong here? .pm

1 0

No Subject
by Kevin Stumborg 17 Dec '03

17 Dec '03

send me mail

1 0

HR361
by perry＠imsi.com 17 Dec '03

17 Dec '03

Has anyone previously noted that HR361, the omnibus export administration act, would require the administration to assess the impact of the current crypto export controls on the software industry? .pm

1 0

def'n of "computer network"
by Jon Lasser 17 Dec '03

17 Dec '03

Bet you 10-1 that "Computer Network" as implemented in the new bill will refer to any computing system that could possibly defend /itself/ through common carrier status. IE including small non-networked fringe BBSs that attempt to claim "common carrier" status. And many networks that don't claim common carrier status, too. The real solution to the crypto-legalization problem is anonymity. Seeing as I've not checked the bill out yet, nor am I a lawyer, I can't say what the implications for that are. If there are anti-remailer implications, the solution may be to build tools with "security flaws" (ie remailing capability). I know that this has been discussed before, but this is the time to implement it. Obviously, the information about the "security holes" will have to be spread widely, but the flaws will have to be built so deep in the design as to not be removable. In addition, now is the time to deploy stego, on a massive scale. How many stego programs have been released for Unix? Can these be integrated with mailing programs in the same way that PGP has been? What would be the legal liability of the maintainer of a common-carrier status system that had a guest account which had been (or based on the current legislation) could be used for anonymity/crypto stuff? If he's liable, does this mean that system administrators are liable for any potential security hole in their system that a random evil internet hacker uses to abuse another system? Hmmm... Usenet alt.binaries.pictures.barney + stego software + unmaintained 'guest' account on a random system = ??? Any lawyers? Jon ------------------------------------------------------------------------------ Jon Lasser <jlasser(a)rwd.goucher.edu> (410) 494-3253 Visit my home page at http://www.goucher.edu/~jlasser/ You have a friend at the NSA: Big Brother is watching. Finger for PGP key.

4 7

mistake on my part
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Perry Metzger <perry(a)imsi.com> writes on cpunks: > I made a small mistake -- the new bill does *not* make it a crime to > make crypto software available at Egghead -- but it does more or > less make distribution of crypto software over the internet > impossible if it isn't an escrow based system. I thought there was some kind of "read my lips" type statement about not mandating key escrow a short while ago. Making it illegal to not use escrow on the internet (in the US and certain materials) sounds dangerously close to mandating key escrow. Also I remember one list member making a prediction, that as they'd said _definately no key escrow_, that you could bet your ass that meant exactly the opposite, and that it would rear it's head anytime soon. I think the poster even had a prediction in terms of months, but don't have the original post handy, looks like he was right. Anyway these things are in stages: 1. voluntary key escrow 2. mandatory key escrow for certain materials 3. mandatory key escrow across the board If they pull this off stage 2, I wonder how long till stage 3, I think it'll be time to leave the sinking ship while exit visas are still granted! Adam -- ------------------ PGP.ZIP Part [025/713] ------------------- M83PL=@FR8ES%:6Q"(F9A#)K!&_;X4TXZ?(T]6(]`>$*.^]3K*K["(239)\@F MHA\"<%"5(%N->/2!'>X3XPU<0!Y,F``58RK(F;K#XD2,^`F[L09CT1>MH,7/ MC(a)FR+[`#J_`.6J`QW&"'YPZ4A[,XC10,0(a)\T1R.H\52,%3N1CI\TY('#M1)D ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

4 3