December 2003 - cypherpunks-legacy

1984 T-shirt news
by jdblair＠nextsrv.cas.muohio.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- More news about the 1984 NSA Shirt: A while ago, David Morrison, of the National Journal (a weekly political commentary journal) contacted me about the 1984 shirt. It turns out somebody else had been wearing one around the office, and he liked the design. He bought one from me, and asked me to send him some information about the issue clipper issue. I packed up a shirt, printed out various articles on both sides of the clipper issue (mostly from the cp archive) wrote up a short summary of each, and included a bit of my own views on the issue. I also included a copy of Tim May's FAQ on a 3.5 inch disk. At any rate, yesterday in the mail I received two copies of the Dec. 10, 1994 National Journal. On p. 2883 (the very first non-advertising page), at the bottom, a box contained a picture of the shirt, w/ the headline "Looks Like a Cheap Chip Shot." The brief text reads: More on the "Clipper" chip, the eavesdroppable encryption key pushed by the National Security Agency: Hearing an NSA spook jest that Big Brother was running 10 years behind schedule, John. D. Blair of Cypherpunks, an anarcho-libertarian Internet group--designed the eye-catching T-shirt at left. "My feelings about its illegitimacy are pretty strong," said Blair, who has sold 250 of the anti-chip shirts on the Net. NSA chief counsel Stewart A. Baker raps Clipper criticism as "the long delayed revenge of people who couldn't go to Woodstock because they had too much trig homework." I don't think the NSA spook part is fair to Kenneth Olthaff, the spook that inspired the shirt. Too bad he didn't include my e-mail address, as well ;) Seriously, though, I've found the shirt has been a good way to get people talking about Clipper, and related issues, here at super-conservative, very pro establishment Miami University (oxford, OH). Its created some inquiry where people had no idea there was even anything to inquire about (or have even heard of the NSA in the first place). If any of you want to resell them, e-mail me and we can work out a deal that makes it worth your time, as well as spread the word about Clipper. The crude web page is still in place with basic info at: http://nextsrv.cas.muohio.edu/t-shirt later, - -john. - -------------------------------------------------------------------------- John Blair: <jdblair(a)nextsrv.cas.muohio.edu> voice: (513) 529-3980 http://nextsrv.cas.muohio.edu/~jdblair 85 81 F8 16 12 97 4C 68 Unix System Administrator, Juggler A1 A0 40 95 BF 03 60 E1 Student of Interdisciplinary Studies (finger me for PGP key) -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBLu/JSvU/70a7khXpAQGXqQP/f13xNwEVYefpCGwnETBHzdP1v7fkRpQE Pdb4H8gzn8MclAF5eFNLG9Nlvbh0Fz//Qx941Ud6xKDGBNMj7P9P84A0DcN0Kv2x 5sS1WX5R1NraZi4h7D/Ctfb6dJVQUYb3pqOaQzcmqyzffu+IfOONnzySJ6BF0tmw /kisD0mWK5o= =6cWL -----END PGP SIGNATURE-----

1 0

Zimmermann Defense Fund Appeal
by hmiller＠orion.it.luc.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Phil Zimmermann Legal Defense Fund Appeal In November, 1976, Martin Hellman and Whitfield Diffie announced their discovery of public-key cryptography by beginning their paper with the sentence: "We stand today on the brink of a revolution in cryptography." We stand today on the brink of an important battle in the revolution they unleased. Philip Zimmermann, who encoded and released the most popular and successful program to flow from that discovery, Pretty Good Privacy ("PGP"), may be about to go to court. It has been over fourteen months now since Phil was first informed that he was the subject of a grand jury investigation being mounted by the San Jose, CA, office of US Customs into the international distribution, over the Internet, of the original version of the program. On January 12th, Phil's legal team will meet for the first time with William Keane, Assistant US Attorney for the Northern District of California, who is in charge of the grand jury investigation, in San Jose. An indictment, if one is pursued by the government after this meeting, could be handed down very shortly thereafter. If indicted, Phil would likely be charged with violating statute 22 USC 2778 of the US Code, "Control of arms exports and imports." This is the federal statute behind the regulation known as ITAR, "International Traffic in Arms Regulations," 22 CFR 120.1 et seq. of the Code of Federal Regulations. Specifically, the indictment would allege that Phil violated 22 USC 2778 by exporting an item listed as a "munition" in 22 CFR 120.1 et seq. without having a license to do so. That item is cryptographic software -- PGP. At stake, of course, is far more than establishing whether Phil violated federal law or not. The case presents significant issues and will establish legal precedent, a fact known to everyone involved. According to his lead counsel, Phil Dubois, the US government hopes to establish the proposition that anyone having anything at all to do with an illegal export -- even someone like Phil, whose only involvement was writing the program and making it available to US citizens and who has no idea who actually exported it -- has committed a federal felony offense. The government also hopes to establish the proposition that posting a "munition" on a BBS or on the Internet is exportation. If the government wins its case, the judgment will have a profound chilling effect on the US software industry, on the free flow of information on the emerging global networks, and in particular upon the grassroots movement to put effective cryptography in the hands of ordinary citizens. The US government will, in effect, resurrect Checkpoint Charlie -- on the Information Superhighway. By now, most of us who are reading this know about Phil and the case, whether by having the program and reading the doc files or by seeing reports in the Wall Steet Journal, Time, Scientific American, the New York Times, Wired, US News and World Report, and hundreds of other news outlets; on Usenet groups like talk.crypto.politics or alt.security.pgp; or by listening to Phil give talks such as the one he gave at CFP '94 in Chicago. We know that PGP has made great strides since version 1.0, and is now a sophisticated encryption and key-management package which has become the de facto standard in both micro and mainframe environments. We know that Phil and the PGP development team successfully negotiated a commercial license with Viacrypt, and, through the efforts of MIT, a noncommercial license for PGP with RSA Data Security, the holders of the patent on the RSA algorithm on which PGP is based, thus freeing the program from the shadow of allegations of patent infringement. We know that programs such as PGP represent one of our best bulwarks in the Information Age against the intrusions of public and private information gatherers. We know that PGP is a key tool in insuring that the "Information Superhighway" will open the world to us, without opening us to the world. What we may not all know is the price Phil has had to pay for his courage and willingness to challenge the crypto status quo. For years now Phil has been the point man in the ongoing campaign for freely available effective cryptography for the everyday computer user. The costs, personal and professional, to him have been great. He wrote the original code for PGP 1.0 by sacrificing months of valuable time from his consulting career and exhausting his savings. He continues to devote large amounts of his time to testifying before Congress, doing public speaking engagements around the world, and agitating for "cryptography for the masses," largely at his own expense. He is now working, still for free, on the next step in PGP technology, PGP Phone, which will turn every PC with a sound card and a modem into a secure telephone. And we know that, just last month, he was searched and interrogated in the absence of counsel by US Customs officials upon his return from a speaking tour in Europe. Phil's legal team consists of his lead counsel, Philip Dubois of Boulder, CO; Kenneth Bass of Venable, Baetjer, Howard & Civiletti, in Washington, DC, first counsel for intelligence policy for the Justice Department under President Carter; Eben Moglen, professor of law at Columbia and Harvard Universities; Curt Karnow, a former assistant US attorney and intellectual property law specialist at Landels, Ripley & Diamond in San Francisco; and Thomas Nolan, noted criminal defense attorney in Menlo Park. While this is a stellar legal team, what makes it even more extraordinary is that several of its members have given their time for free to Phil's case. Still, while their time has been donated so far, other expenses -- travel, lodging, telephone, and other costs -- have fallen to Phil. If the indictment is handed down, time and costs will soar, and the members of the team currently working pro bono may no longer be able to. Justice does not come cheap in this country, but Phil deserves the best justice money can buy him. This is where you and I come in. Phil Dubois estimates that the costs of the case, leaving aside the lawyers' fees, will run from US$100,000 - $150,000. If Phil's team must charge for their services, the total cost of the litigation may range as high as US$300,000. The legal defense fund is already several thousand dollars in the red and the airline tickets to San Jose haven't even been purchased yet. In September, 1993 I wrote a letter urging us all to support Phil, shortly after the first subpoenas were issued by Customs. Today the need is greater than ever, and I'm repeating the call. Phil has assumed the burden and risk of being the first to develop truly effective tools with which we all might secure our communications against prying eyes, in a political environment increasingly hostile to such an idea -- an environment in which Clipper chips and digital telephony bills are our own government's answer to our concerns. Now is the time for us all to step forward and help shoulder that burden with him. It is time more than ever. I call on all of us, both here in the US and abroad, to help defend Phil and perhaps establish a groundbreaking legal precedent. PGP now has an installed base of hundreds of thousands of users. PGP works. It must -- no other "crypto" package, of the hundreds available on the Internet and BBS's worldwide, has ever been subjected to the governmental attention PGP has. How much is PGP worth to you? How much is the complete security of your thoughts, writings, ideas, communications, your life's work, worth to you? The price of a retail application package?i Send it. More? Send it. Whatever you can spare: send it. A legal trust fund, the Philip Zimmermann Defense Fund (PZDF), has been established with Phil Dubois in Boulder. Donations will be accepted in any reliable form, check, money order, or wire transfer, and in any currency, as well as by credit card. You may give anonymously or not, but PLEASE - give generously. If you admire PGP, what it was intended to do and the ideals which animated its creation, express your support with a contribution to this fund. * * * Here are the details: To send a check or money order by mail, make it payable, NOT to Phil Zimmermann, but to "Philip L. Dubois, Attorney Trust Account." Mail the check or money order to the following address: Philip Dubois 2305 Broadway Boulder, CO USA 80304 (Phone #: 303-444-3885) To send a wire transfer, your bank will need the following information: Bank: VectraBank Routing #: 107004365 Account #: 0113830 Account Name: "Philip L. Dubois, Attorney Trust Account" Now here's the neat bit. You can make a donation to the PZDF by Internet mail on your VISA or MasterCard. Worried about snoopers intercepting your e-mail? Don't worry -- use PGP. Simply compose a message in plain ASCII text giving the following: the recipient ("Philip L. Dubois, Attorney Trust Account"); the bank name of your VISA or MasterCard; the name which appears on it (yours, hopefully :-)); a telephone number at which you can be reached in case of problems; the card number; date of expiry; and, most important, the amount you wish to donate. (Make this last item as large as possible.) Then use PGP to encrypt and ASCII-armor the message using Phil Dubois's public key, enclosed below. (You can also sign the message if you like.)i E-mail the output file to Phil Dubois (dubois(a)csm.org) Please be sure to use a "Subject:" line reading something like "Phil Zimmermann Defense Fund" so he'll know to decrypt it right away. Here is Phil Dubois's public key: - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.7 mQCNAiyaTboAAAEEAL3DOizygcxAe6OyfcuMZh2XnyfqmLKFDAoX0/FJ4+d2frw8 5TuXc/k5qfDWi+AQCdJaNVT8jlg6bS0HD55gLoV+b6VZxzIpHWKqXncA9iudfZmR rtx4Es82n8pTBtxa7vcQPhCXfjfl+lOMrICkRuD/xB/9X1/XRbZ7C+AHeDONAAUR tCFQaGlsaXAgTC4gRHVib2lzIDxkdWJvaXNAY3NuLm9yZz6JAJUCBRAsw4TxZXmE uMepZt0BAT0OA/9IoCBZLFpF9lhV1+epBi49hykiHefRdQwbHmLa9kO0guepdkyF i8kqJLEqPEUIrRtiZVHiOLLwkTRrFHV7q9lAuETJMDIDifeV1O/TGVjMiIFGKOuN dzByyidjqdlPFtPZtFbzffi9BomTb8O3xm2cBomxxqsV82U3HDdAXaY5Xw== =5uit - -----END PGP PUBLIC KEY BLOCK----- * * * This campaign letter will be posted in a number of Usenet groups. I will also be turning it into a FAQ-formatted document, which will be posted monthly in the relevant groups and which will be available by anonymous ftp from ftp://ftp.math.luc.edu/pub/hmiller/PGP/pzdf.FAQ. If you come upon, or up with, any other ways in which we can help raise funds for Phil, drop me a line at hmiller(a)luc.edu and let me know, so that I can put it in the FAQ. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLu6xOtEdYC5Hk8UpAQEhFwP+JrEyY1LvnPmcjp+oLGmIAUbZixJj3QfE T3KpjnNotoJ7/CtWF1EjhjHN8IXPgcQcyF3p38ekysARDv0MA4tzXhL1Egdq/7QV L8XW2z0PjWgu8X/Om0eXZkIOGeaoBvP/e/qDYEIcWXtxrwokYcEtoNCR/KQoZw+A 6NnK1nwxnLw= =Ez3J -----END PGP SIGNATURE----- -- Hugh Miller, Ph.D. Voice: 312-508-2727 Asst. Professor of Philosophy FAX: 312-508-2292 Loyola University Chicago Home: 312-338-2689 6525 N. Sheridan Rd. E-mail: hmiller(a)luc.edu Chicago, IL 60626 WWW: http://www.luc.edu/~hmiller PGP Public Key 4793C529: FC D2 08 BB 0C 6D CB C8 0B F9 BA 55 62 19 40 21

1 0

Re: rad
by Black Unicorn 17 Dec '03

17 Dec '03

On Sat, 13 Nov 1993 ndibble(a)komets.k12.cfa.org wrote: > I wish the NSA executives would come out of the closet... > It's warm in here. 073BB885A786F666 nemo repente fuit turpissimus - potestas scientiae in usu est 6E6D4506F6EDBC17 quaere verum ad infinitum, loquitur sub rosa - wichtig!

1 0

PGP 2.7
by Tony.Gurnick＠nzdairy.co.nz 17 Dec '03

17 Dec '03

I keep seeing pgp 2.7 in public key & sig blocks. Where do we get it? T

1 0

Question for remailer operators
by dmandl＠panix.com 17 Dec '03

17 Dec '03

For the anon remailer operators out there: I'm looking for figures on the average number of messages that pass through the different remailers a day (or week, or whatever). This is for an article I'm working on to be published in a local paper here in NYC. I'd appreciate any numbers I can get from any of you. Estimates are fine if you don't have exact figures. (Sorry to spam the list like this. It's just that I'm sure my list of remailers is very out of date, and even if it's not, I wouldn't know how to reach the operators of most of them.) Many thanks. --Dave. -- Dave Mandl dmandl(a)panix.com

3 2

No Subject
by ddt＠lsd.com 17 Dec '03

17 Dec '03

X-PGP Key ID: 4AAF00E5 X-PGP Fprint: 30D81F3484E6A83F 6EC8D7F0CAB3D265 Date: Thu, 15 Dec 1994 06:55:23 -0800 To: cypherpunks(a)toad.com From: ddt(a)lsd.com (Dave Del Torto) Subject: KEYSRVR: tabula rasa? Cc: Philip Zimmermann <prz(a)acm.org>, Michael Graff <explorer(a)iastate.edu> -----BEGIN PGP SIGNED MESSAGE----- [parts from a separate thread w/ Derek] Why is it possible for someone other than ME to add MY key to a keyserver? I realize that at some point (perhaps only the first time you submit a key?), there has to be some trust model employed, but it seems like this anyone-can-submit-anyone-else's-key situation offers a very obvious attack: anyone could propagate bogus keys across the net by just generating bogus keys with someone else's email/name on them, leading to massive impersonation problems. Maybe I'm missing something obvious, but it seems like there should be a more rigorous method available to, and employed by, keyserver operators for verifying someone's identity before accepting a key submitted (supposedly) by them. Shouldn't the key submission msg itself at minimum be required to be contained within a signed msg from someone with enough "nearness" in trust levels from some trusted introducer known to the keyserver op? I thought this sort of situation was precisely the reason for the trust level system in PGP in the first place. This may be a can of worms (or not), but if cpunks require fairly decent methods for verifying the identities of people who want to trade keys with them personally, then it seems keyservers should require at LEAST that level of verification (or better). I'd like to CLEAR/REMOVE ALL keys from ALL keyservers that are: - attributed to me by others (without my knowledge) - added by others (unknown to me) - purporting to have been generated by me) and start with a tabula rasa. Maybe in a few weeks, once all these (what I consider to be) bogus keys are GONE, I can add my actual key to a keyserver. There doesn't seem to be any elegant mechanism available for doing this yet, but I'm ready to be educated on this point. Any comments? dave -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLvANraHBOF9KrwDlAQGVDwQAs4/OuwICvnl+hHpatlcpp8o7MrF21x9f 4SJd0NUJ/koa648bDwr0qxyhs7NSwon2jU4FPI/QBPVAcrsSAMkfXWr2NpF6pOlV TIFIQ9xouT9RP7KT86bU0EiU3RQsO3q8LJRjylWOA2zBEYC+b7Ah5ALfZ/tng293 wE8W2E/rxl0= =64dw -----END PGP SIGNATURE-----

3 2

Re: properties of FV
by Andrew Lowenstern 17 Dec '03

17 Dec '03

> > That would make this counterparty pseudonymity, not anonymity. > > The merchant, while not knowing the true identity of his clients, > > is still able to correlate the transactions of individual accounts > > (and must be able to under FV's policies). A malicious merchant, > > for instance, could recognize that a particular account is more > > interested in certain types of information and charge accordingly. > > Good point. I stand corrected, at least as far as the terminology > is concerned. However, as far as the particular malicious-merchant > scenario is concerned, I must say I'd be skeptical about any merchant > who didn't tell me the price up front, *before* he asked me for my > account-id... -- Nathaniel Of course, but what if you bought something from a Web server, revealing your account-id to the server. A smart server could adjust the prices on pages that haven't been retrieved yet. I don't know if this is necessarily possible with hhtp (i.e. does your client always use the same return port number for requests during a given instance of the client? <bear with me, I don't know the real details of http>), but you get the idea. Worse, linkability of transactions also allows the merchant to do 'payment traffic analysis' in an attempt to determine the real identities of it's clients. Many merchants can get together and compare transaction logs as well... These 'attacks' are a feature of any payment system that has only counter party pseudonymity (as opposed to anonymity), not just First Virtual... andrew

1 0

FV fine print
by eric＠remailer.net 17 Dec '03

17 Dec '03

In looking over the FV docs, I found the following interesting tidbit. ---------------------- * YOU shall retain computer data of all sales for at least three years from the date of the transaction. In the event you are not able to store such information, you may contact infohaus-info(a)fv.com to make storage arrangements. ---------------------- Interpretation is left to the reader. Eric

1 0

Re: FV fine print
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

Excerpts from fv: 15-Dec-94 FV fine print Eric Hughes(a)remailer.net (403) > * YOU shall retain computer data of all sales for at least > three years from the date of the transaction. In the event > you are not able to store such information, you may contact > infohaus-info(a)fv.com to make storage arrangements. > Interpretation is left to the reader. FYI, this is a direct carryover from the standard terms & conditions of a Visa/MasterCard merchant account. Basically, this is a legal necessity to process inquiries from the cardholder's issuing bank, etc. You'll note that we don't say you have to provide the information to us, merely that you have to keep it -- that way, if there's a court action requiring us to provide the information, we can point out that you are required to have the information. If you haven't kept it, you won't have nearly as much of a problem with us as with the government. In any event, the most we can do is say, "oh, you violated our terms and conditions, you can't be an FV seller any more." What we're doing here, in essence, is allowing ANYONE to function as a Visa/MC merchant, with the addition of the 90 day hold and a few other things. In order to do that, our terms and conditions have to ensure that you comply with the Visa/MC terms and conditions, that's all. -- Nathaniel

2 1

Re: Less Flaming, More Civility
by amanda＠intercon.com 17 Dec '03

17 Dec '03

> C'punks, when this list started we were a bunch of idealistic privacy > freaks. Look who's on the list now: the developers of cutting edge Internet > software. The two are not necessarily mutually exclusive :). And from this point of view, I have to say that for all of my complaints about the specifics of various things Netscape has put forth, I cannot fault them for trying to improve the status quo. One thing that everyone has in common here is that we all believe that the issues we discuss are important, and that it's worth trying to solve the problems. This is in part, I think, why tempers flare from time to time--I know this was true in my case. Amanda Walker InterCon Systems Corporation

1 0