December 2003 - cypherpunks-legacy

sci.crypt archive ftp site
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

There's one at ftp://rpub.cl.msu.edu/pub/crypt/sci.crypt But I just looked and it only has up to April 94. By the way, everybody should check out http://www.quadralay.com/www/Crypt/Crypt.html ftp://furmint.nectar.cs.cmu.edu/security/README.html These are two budding cypherpunks WWW sites. Somebody's been busy. "Cypherpunks weave Webs!" Jim_Miller(a)suite.com

1 0

Re: Security for under a buck fifty
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

At 9:42 AM 7/12/94, Mike Johnson second login wrote: >>[Ben.Goren(a)asu.edu [me] wrote about generating pass phrases from >>true random numbers, mapping into a character set, creating mnemonics.] > >I already do this -- except that I use a keystroke- timing program for >the true random source, and I do the mnomonic generation with my brain >instead of the program. My program just converts the random numbers to >uniformly distributed printable ASCII (values between space and del), for >a little more entropy than 6 bits per character. The tradeoff is between number of characters needed (length of passphrase) and diversity of character set. I'd probably have better luck with the mnemonic if I didn't have to fit in a whole string of %*$@!, but that should probably be a user setting. >A more automated way to generate a pass phrase might be to convert every >16 bits of random numbers to one of 65536 words and names in your >favorite languages. That way, you would have real words to memorize, but >in a strange order. For example, a 128 bit key might be: >tree elephant action roof xymurgy eight top slash. > >You could try to think of some story to link the 8 originally unrelated >words together and help you to remember it. Another possibility: have a dictionary of different parts of speech and assemble them in order. For a short example, each passphrase could be in an order such as: Article adjective modifier noun verb article adjective modifier noun. Our favorite would fit: The quick brown fox jumps over the very lazy dog. This looses entropy (Mallet knows the order, and probably the dictionaries) and so you would want either a longer sentence or some other modification, like random--not decided by the person--capitalization or character substitution. Or have two sentences: The quick brown fox jumps over the very lazy dog; a lovely ermine glove fits into the hazy slumping bucket. Figure thirteen bits each with dictionaries of ten thousand each adjectives, modifiers, nouns, and verbs--your final dictionary would be 40 thousand words, total; you'd need about ten words to get 128 bits. Make that two shorter--eight word--sentences, restricted to easy-to-remember orderings, and you've more than made up for whatever entropy was lost in having a known structure. Umph. I think I need to start making time to write code, if I want to see this work. b& -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): Protect your privacy; oppose Clipper. Voice concern over proposed Internet pricing schemes. Stamp out spamming. Finger ben(a)tux.music.asu.edu for PGP 2.3a public key.

2 1

Re: Gov't eyes public-key infrastructure
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>>The U.S. government intends to operate a public-key certification >>system for government users that will also serve the private sector, >>as well. But a report just completed by Mitre Corp. for the National >>Institute of Standards and Technology (NIST) puts the price tag at >>$1 billion for the start-up of the government alone, with a possible >>$2 billion annual operational cost for managing certificate-revocation >>lists. > >All in all, I'd say this is a pretty good argument for PGP's web of trust >model... Especially given that urban folklore about everyone being only 5 hops away on the network of life. I.e. Everyone is a friend of a friend of a friend of a friend of a friend of anyone else. This was sort of troped upon in "6 degrees of Separation", the John Guare movie/play. If anyone had any concrete data about this, then it might be interesting to calculate the optimum number of people you should get to cosign your public key. Anyone remember enough about Ramsey numbers and Graph Theory? -Peter > >Phil

3 2

Re: Idle question...
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tcmay(a)netcom.com (Timothy C. May) on Tue, 12 Jul 12:14 PM >I used to know the ftp site that had archives of all >sci.crypt articles. If it's still active, anybody know >what it is? >From Cyptography FAQ of July 7, quote: Sci.crypt has been archived since October, 1991 on: ripem.msu.edu:pub/crypt/sci.crypt/ (available only to US and Canadian users) Another site is rpub.cl.msu.edu:/pub/crypt/sci.crypt/ from Jan 1992. End quote.

1 0

space contractors must use only "approved" encryption devices?
by Stanton McCandlish 17 Dec '03

17 Dec '03

[The person that forwarded to us noted: "It is relevant to the current efforts regarding encryption systems, specifically, it is the first instance that I have seen where the Federal Government will require non-government entities to use only government approved encryption...So much for the contention that no one would be forced to use Clipper."] Please note that the included article was NOT written by the person who actually posted it to the network. The author currently does not have Internet access, and has had to have a friend-of-a-friend post it for him. See the note from Bill Higgins just after the headers below. From: higgins(a)fnalv.fnal.gov (Bill Higgins-- Beam Jockey) Newsgroups: sci.space.policy Date: 28 Jun 94 19:49:02 -0600 Organization: Fermi National Accelerator Laboratory [Wales Larrison has been off the Net for a while and still can't post. But, through a friend's account, he has managed to send me a fresh installment of his commercial-space newsletter. Glad to help post it. This is part 1 of three parts. --Bill Higgins] SPACE TECHNOLOGY INVESTOR/COMMERCIAL SPACE NEWS -- No. 24 [edited for brevity] 3- US COMMERCIAL REMOTE SENSING POLICY FINALLY SET On 9 March, the Clinton administration finally released the official administration policy on commercial collection and sale of high- resolution satellite images. This policy allows the US Department of Commerce to license U.S. companies to operate private remote sensing space systems and sell images from those systems to domestic and foreign customers. Notably, it sets no limits on the resolution of imagery that can be sold. Under this policy, US firms desiring to operate such space systems must apply for a license from the Department of Commerce, in accordance with the Land Remote Sensing Policy Act of 1992. To get a license, each firm must: - maintain a record of all satellite tasking for the previous year and to allow the US government access to this record. - operate the satellite in accord with the characteristics submitted in the license application (although changes can be submitted for approval) - obtain appropriate export licenses for foreign sales of data or hardware. This specifically includes transfer of export sensitive components, subsystems, and information concerning remote sensing space capabilities which are on the US Munitions Control List. Transfer of such sensitive technology can be made available to foreign entities only on the basis of a government-to-government agreement. [*****************************************************************] - use only approved encryption devices, since the US government retains the right to deny unauthorized access to this data to others during periods when national security, international obligations and/or foreign policies may be compromised (as provided for under the LRS Policy Act). [*****************************************************************] - use a data downlink format that allows the US Government access and use of the data during periods when national security, international obligations and/or foreign policies may be compromised (also as as provided for in the Act). - allow the US government to limit data collection and/or distribution when national security or international obligations and/or foreign policies may be compromised. Such a limitation may only be imposed when the Secretary of Defense or the Secretary of State, and the Secretary of Commerce agree to this. Any such decision can be appealed directly to the President. - Pursuant to the Land Remote Sensing Policy Act of 1992, licensees must notify the government of intentions to enter to significant agreements with foreign customers. Under these policy guidelines, a license to Lockheed for a high- resolution space remote sensing satellite was granted on 22 March. [Commentary: I was starting to wonder if any more of the commercial remote sensing licenses would make it through the licensing system. Lockheed originally submitted their license application back in June of 1993, and under the statues which govern the licensing process, they were supposed to have had a ruling on their license within 120 days. The policy apparently hung up until the National Security Council (in particular the State Department, DoD, and CIA) could come to an agreement about how to handle such data in times of crisis. The concern expressed was legitimate -- similar data could have compromised US and allied forces during another situation like Saddam's War in Kuwait/Iraq. During that crisis, SPOT and Landsat voluntarily limited access to data from the Middle East -- but everyone involved recognized some procedure needed to be agreed upon and put in place rather having to work the situation on an ad-hoc basis. The commercial firms planning for high-resolution commercial remote sensing systems seem to fairly pleased with the new policy, and other announcements of license filings are rumored to be in the works. (See below.)]

1 0

Administration Buys Off EES Patent Holder (fwd)
by Stanton McCandlish 17 Dec '03

17 Dec '03

Date: Mon, 11 Jul 1994 14:53:56 -0700 From: "Brock N. Meeks" <brock(a)well.sf.ca.us To: com-priv(a)psi.com Subject: White House Pays CyberWire Dispatch // Copyright (c) 1994 // July 11 // Jacking in from the "Blank Check" Port: Washington, DC -- The Administration will today announce it has sidestepped the threat of patent infringement lawsuit involving its Escrow Encryption System, commonly known as Clipper. The solution: Toss the original patent holder a blank check and buy him off. The National Institute of Standards and Technology (NIST), the agency walking point for the White House on its proposed encryption Clipper encryption standard, has agreed in principle to license two key patents relating to the technical workings of the key escrow system from patent holder Silvio Macali, an MIT professor. The government's key escrow system depends on the capturing of digital "keys" that allow authorized law enforcement officials to unscramble Clipper encoded speech or Capstone encoded data, including electronic mail. Macali, as it now turns out, thought up the idea and had the moxy to patent his scheme. Macali's inventions detail the process whereby a digital key is divided into pieces. Those pieces are then held by separate "key escrow agents" which now turn out to be hand picked government agencies; one is NIST the other a division of the Treasury Department. Those keys must be combined to successfully unlock the code that allows law enforcement officials to listen in. The license agreement effectively eliminates "concerns Macali raised about possible infringement of his patents," said NIST spokeswoman, Anne Enright Shepherd. It also sidesteps a potentially ugly lawsuit in which Macali lawyers could have uncovered all sorts of currently unknown information about the Clipper program. According to sources familiar with the negotiations, the government's agreement with Macali grants the Administration a nonexclusive license to the patents for use in current implementations of Clipper and Capstone and for future implementations, Shepherd said. It's not known whether the government will make a single payment to Macali or pay royalties. "The procurement phase of the agreement is still continuing," Shepherd said. Disclosure of the amount paid to Macali and details of the license agreement are expected to be made public sometime early next month, she said. That agreement, however, wont result in any user fees, Shepherd said. Questions Raised ================ Although the government's action today nullifies a pesky problem, it also continues to raise serious questions about the Administration's -- and more pointedly -- about the National Security Agency's ability to ramrod an encryption policy that has been elevated to the status of a national security issue. Surely the NSA or NIST can dial up the U.S. Patent Office and query its database, looking for patent conflicts. Apparently the clock and dagger crowd was too busy with other matters. Arrogance or oversight? "Macali made the existence of his patents known during the public comment period," Shepherd said. "He let the government know he had some patents that he felt were similar to some technology used by the key escrow system. So the discussions kind of began at that point," she said. Unfortunately, the "public comment" period was launched only after the White House trotted out its Clipper policy as set in stone. Nobody expected Macali to piss the parade. Privacy and civil liberties groups have roundly criticized the government for developing Clipper in secrecy, not allowing public debate on the issue. If that debate had taken place, Macali would have come forward years ago. Despite the Administration's continued efforts to push Clipper into the deep waters of the mass market, there are rumblings that it may not be christened after all. At very least, it may not be the only encryption standard blessed by the government. Several groups are now floating their own alternatives to the Clipper program. And although the National Security Agency is working behind the scenes to sink such efforts, NIST, at least, is making the appearance of listening. Earlier this year, NIST put out a call for the Cooperative Research and Development Agreement (CREDA), which was an effort to draw publicly interested parties into a cooperative venture to develop a key escrow alternative. Those that came forward have now thrown off working formally with CREDA, but have instead formed their own working group, government sources said. Those efforts are being heard and taken seriously, according to several government sources familiar with the discussions. "Encryption isn't a front page issue, but those [inside the Administration] working on this issue are tired of being beat up over it," said a White House official. Discussions on Clipper alternatives "are continuing," Shepherd said. "And we're still open to other alternative ideas and we're working with the people who have presented their own ideas at this point." Meeks out...

1 0

Re: Idle question...
by John Young 17 Dec '03

17 Dec '03

Responding to msg by berzerk(a)xmission.xmission.com (Berzerk) on Tue, 12 Jul 10:8 AM >On Tue, 12 Jul 1994, Graham Toal wrote: >> Subject: Didn't anyone note the A5 posting? > Does anyone have a copy of this posting? I would appreciate getting a copy of this posting also. John Young

1 0

The Detweiler Files
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

jamiel(a)sybase.com (Jamie Lawrence): > I have a writing assignment coming up (nothing to do > with much that is talked about on this list), and some > example posts by Detweiler could be really handy as > references. I have one from a long time ago, but could > use some others- anybody save any for posterity? If so, > could you forward me a couple of juicy ones? I have about 580k of 'Detweiler files'. These are sorted by mail from his presumed identities, mail to them and relevant mail about him. Separately stored are some of his gems, including his roman torture piece and S Boxx's poetry. You can't ftp _in_ to my SLIP node, but I can ftp it to some place convenient. Compressed, it should be about 200k (ZIP). ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

New National ID Card Proposal
by David Banisar 17 Dec '03

17 Dec '03

CBS Evening News just reported that Clinton has "tenatively signed off" on a National ID card recommended to him by a commission on immigration reform. The obstensive reason for the card is for employment and immigration. Each card will contain a name, photo, mag stripe with info and a "verified SSN." It was supported by Senator Alan Simpson of Wyoming, a long-time supporter of id cards. Gov. Pete Wilson of California has apparently offered to make California a test-bed for the proposal. The proposal was opposed by Xavier Beccera, a Congressman from California. A previous effort to impose a national id card was rejected by Congress in 1986. EPIC is working with Privacy International to investigate this report. PI has led successful campaigns aginst national id cards in Australia, New Zealand, and the Phillipines. In Australia, the PI-led campaign led to the dissolution of both houses of the federal Parliament in 1987 after hundrends of thousands marched in protest. The Australian campaign brought together groups from all parts of the political spectrum from the Communist Party to the Libertarian Alliance, farmers and conservation groups, rock stars, academics, large businesses such as banks and mining corporations, but the overwhelming support came from the public who created the biggest civil protest in Australian history. David Banisar (banisar(a)epic.org) Electronic Privacy Information Center 666 Penn. Ave, SE #301, Washington, DC 20003 202-544-9240 (v) 202-547-5482 (f)

1 0

NATIONAL SECURITY PORN RISK
by Sandy Sandfort 17 Dec '03

17 Dec '03

C'punks, Does anyone on the Cypherpunks Channel have any inside information about the "computer porn ring" that was busted at Lawrence Livermore Labs? Is there a crypto tie-in? S a n d y

5 4