December 2003 - cypherpunks-legacy

B-PGP: news/requests
by ddt＠lsd.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Note: I'm meta-prefixing this "B-PGP" to indicate the "Beginner-PGP" thread. At 10:37 am 12/21/94, bshantz(a)spry.com wrote: >It is my own personal opinion that in order for crypto to truly become >mainframe, the software manufacturers of internet connectivity packages must >integrate crypto into the applications. [elided] FYI, any of you who haven't heard should be pleased to know that Steve Dorner is working with Zig Fiedorowicz on integrating ViaCrypt PGP/Mac functions into Eudora (on the Mac, at least, which is a good starting point). This is a major step forward, since Eudora is so POPular :) and this could certainly increase sales of ViaCrypt's s/w as well. In the meantime, I'm looking at the AppleEvent scripts that have been made public and will make comments on them soon. Anyone who's up-to-date on current Mac or Windows version development (Hal Hildebrandt?) is encouraged to contact me, per Phil's request. I just want to make sure everyone gets what they need and that the left hand knows what the right hand is doing, etc. I'll set up an FTP directory "somewhere" for a central repository if anyone feels it's necessary (location to be announced elsewhere). BTW, I'm starting work on a Beginner's PGP-FAQ and would appreciate any question/answer pairs anyone would care to submit. Please keep them simple: they are aimed at an AOL-ish user level. The final document should be extremely non-technical, non-threatening and about three pages long maximum. In it, I will describe the History of the Entire Cryptographic World in 4000 words or less. :) I'm calling the 3-Minute Shakespeare Troupe next week for pointers on how to accomplish this... Speaking of AOL, does anyone know anyone on the current Internet development team there? I used to exchange email with some internet-oriented guys there back in '90-'91 but I wonder if anyone is in current contact - I'd like to discuss the possible integration of PGP into the AOL client software. That would effectively put PGP in a couple of million users hands PDQ. With all the bidness activity there of late, it seems to me there's a need that could be filled quite nicely. >In order to bring crypto to the masses, we have got to convince people that >it is necessary. We also must make it"second nature". It sure is nice to have >a menu option or a toolbar button that will encrypt plaintext automatically. >Key management and some of the "high tech" (I know, for us it's nothing, but >for my dad who just bought a computer and doesn't understand the difference >between click, double click, and drag, crypto is a really high tech thing >just in itself.) Notice Brad didn't even mention his MOM yet. I once tried to explain PGP to my Mom. "That's very nice, dear," was about the breadth of her reaction, but I still put a box on her desk and set her up with a key, even if she won't use it yet (ever? hey, she's a mom, Okay?). Now, if it was a real point-n-click maneuver, it might have a snowballs' chance in hell with her, but until then... >things of crypto should not be directly handled by the user. >(Optional >of course. On a privacy level, the user should have full control. Indeed. I'm hoping the upcoming versions of mainstream PGP (Mac/Win) will allow for a bit more modularity in the apps. I.e. it would be nice if you could "plug in" various functions, so that you could build up the app's features as a user gained more sophistication, but this may be way beyond the v3.0 scope. More on this idea later, as it more directly relates to system software extensions than PGP application stuff. >But give the user a break...if the software is secure..as such...so is the >user's privacy.) > >You will notice that this message is not signed. That's because in order to >sign it, I would need to save my message, hop out to a DOS box, PGP encrypt >it, hop back to my mail program and insert the encrypted mail as a text file. >That's enough to discourage the average user. This is pretty much what Tim >May was talking about when he discussed why he doesn't sign his messages. >It's not that he couldn't... it's just not practical for him. It's not >>really practical for me either, but I do it when I feel it's necessary. > >The only way to make crypto practical is to basicalloy hide the technical >side from the user and make it easy. Let me describe briefly for you all (and everyone is encouraged to type up a similarly brief log of what they do on their machines so we have a UI comparison table) what I deal with when I encrypt a msg on the Mac. Keep in mind that I have worked very hard to streamline the process as much as possible, and that this is before installing the AppleEvent scripts. It's not difficult for me, but for someone without a clue... well, they get two steps in, stare at the screen and eventually bag it. type msg body (in Eudora). select text copy to Mac clipboard (system) switch to PGP with macro Encrypt (or Sign) menu command [PGP reads the clipboard here, a wonderful improvement thanks to ...Zig?] enter passphrase [PGP outputs encrypted text to clipboard, wipes temp file] macro back to Eudora. paste clipboard back into msg body Now, all of this is easily scriptable: I once did it with a long complicated macro, but it was s l o w, so I bagged that idea - it didn't even use system level events. I'm hoping the new AE scripts will handle most of this, but it SHOULD all be done in the application layer by Eudora with direct calls to PGP in the bg (see above annc re Steve Dorner), which is the current direction. Let's hope ViaCrypt's new AE support will allow for this (Zig? hello?). IMPORTANT: Anyone currently working on an PGP versions is hereby requested to mail me regarding the coordination of development efforts. Mail Phil with questions about this. ALSO: There will/should be a group discussion at the upcoming physical meeting on the 14th which both Phil and I will be attending. Please bring your keys/laptops/floppies for signing. Over and out, dave ________________________________________________________________________ Speaking of "term limits," hasn't Rush Limbaugh gotten enough attention? -----BEGIN PGP SIGNATURE----- Version: 2.6ui iQCVAgUBLvtabKHBOF9KrwDlAQFYkAQAiKcjZx5iCzn0CLIBY5/TzVOY8sl7Jclo v6MSPdNdU3ONTBLtDlI3HbSnq/SqGyJxkgxex7aLaICwB+RUsE2TMnJ2PBXD1W0T 48eqQZT3IhT35gEfV3RQnYllIS4mhEWxzq8KFMPwdCjlNrF794TqZFgBadWZL+LR 4hXhnrTuB5A= =/bL0 -----END PGP SIGNATURE-----

1 0

CERN HTTPD proxy info
by Johnathan Corgan 17 Dec '03

17 Dec '03

Could someone please post the address/port for the HTTP proxy at CERN? Thanks, Johnathan

1 0

Re: Attacking Norton Encrypt
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 09:52 PM 12/23/94 IST, rishab(a)dxm.ernet.in wrote: > >Regarding the simple question about Norton Encrypt's security (and ignoring >the alt.relationship-counsellor interlude), I believe Norton uses DES (for >'maximum security' or a 'fast proprietary' method for convenience. I don't >think it has the usual errors (password stored in ciphertext etc), but a >brute force attack on DES is beyond the means of most Norton users IAC. Perhaps, but if the earlier post is accurate about it mapping UC to lc and only accepting 8 characters of password, you've gone from a 56 bit keyspace to a ~38 bit keyspace. A dictionary attack is certainly feasible--I don't recall what speeds have been achieved for brute-forcing DES lately. --Paul J. Ste. Marie

1 0

DDJ article on RC4
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

Putting the Genie Back in the Bottle What had all the earmarkings of a major-league food fight sure didn't take long to dry up and blow away. Triggering the flap was an internet posting of source code that implemented the RC4 algorithm, an act that knocked on all kinds of legal doors - trade secrets, Internet-host liabilities, reverse engineering, shrink-wrap licensing, export control. You name it. The problem is that RC4, the block-cipher encryption algorithm at the heart of RSA Data Security cryptography, is protected as a trade secret. But some on the net say the online posting let the genie out of the bottle - RC4 was made public and available for anyone to use, RSA's claims notwithstanding. RSA counters that the company used trade-secret law simply to protect its intellectual property, and there's never really been any "secret" about the algorithm. Anyone willing to sign a nondisclosure agreement acknowledging RC4's trade-secret status could have ready access to the reference and source code. Among companies which have licensed RC4-based tools from RSA are Microsoft, Novell, Apple, and Lotus, all of which distribute RC4-based binary files in shrink-wrapped applications. You can imagine the furor when an unidentified person (or persons) used an anonymous remailer to post worldwide - first to a cryptographer mailing list, then to a newsgroup - source code that was supposedly RC4. Subsequent testing by programmers and cryptographers confirmed that the code was indeed compatible with "real" RSA RC4 code. RSA Data Security responded by calling in everyone from the U.S. Customs Service to the Federal Bureau of Investigation. In a strongly worded warning on the net, RSA said it considered the posting "a violation of law ... [and] ... a gross abuse of the Internet." If the person(s) who posted the source code had in fact signed an RSA nondisclosure agreement, the issue seems pretty clear-cut. They broke the law, not to mention RSA's trust. If, as some claim and RSA disputes, the code was reverse-engineered from object files in off-the-shelf software, then the law was probably broken - unless RSA and other vendors decide to test the strength of highly questionable and likely unenforceable shrink-wrap licenses that try to prohibit disassembly/decompilation. Of course, it just might be that some cryptographer derived the algorithm after examining the key, plaintext, and ciphertext. And there's even the chance, albeit unlikely, that a dumpster diver ran across discarded copies in RSA's corporate wastebasket. Questions concerning the legal status of copyrighted material that's made freely available (illicitly or otherwise) on the Internet also have to be tackled. Can Internet hosts be held accountable for an anonymous postings of protected material? And don't forget, RC4 isn't just any software - it's ENCRYPTION software. Is posting such software online worldwide the same as exporting it? If so, the State Department might have a thing or two to say. The end result is that RC4 code is available on ftp sites worldwide, ready and waiting for you to use it. But if you grab it off the net, can you use it without RSA's permission? For the time being, the answer probably depends on which lawyer you ask. Speculation aside, the RC4 controversy explains why many developers are protecting their intellectual property with patents instead of copyrights. Gray areas like RC4 would be black and white if RC4 had been patented. But then patenting would also mean that RC4 would have been public in the first place. The immediate impact may be on RC5, the next-generation version of RC4, which Ron Rivest describes in this issue. In part because of the RC4 controversy, Ron and RSA Data Security are considering patenting RC5, a departure from their original plans. At one point, RC5 code and reference was to be distributed free-of-charge for noncommercial use. Small businesses could license the material for $500, and large businesses, for $1000. All proceeds were to go to RSA Labs - not RSA's bottom line - to fund further R&D. This could still happen even if RSA patents RC5, but the licensing fees would be higher to offset the patent costs. Likewise, there could be some repercussion in terms of exporting RC4-based systems. For the past couple of years, vendors have been allowed to export software that uses RC4 short-key encryption. The State Department could change this since RC4 is no longer secret. As for the multitude of legal questions, nothing concrete will immediately come of the RC4 brouhaha, unless those responsible for posting the code are identified. Existing RC4-based systems weren't compromised and may have benefited, since we can now see that system backdoors don't exist. What we're left with are more questions, fewer answers, and the suspicion that one of these days a big shoe is going to fall on software and intellectual-property rights - one that won't make anyone completely happy. Johnathan Erickson editor-in-chief

2 1

FYI: (Meeks) Berman leaves EFF
by ddt＠lsd.com 17 Dec '03

17 Dec '03

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= cut here =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Tue, 20 Dec 1994 17:04:23 -0800 From: "Brock N. Meeks" <brock(a)well.sf.ca.us> Subject: CWD Changes in the Wind At EFF CyberWire Dispatch // Copyright (c) 1994 // Jacking in from the "Back to the Future" Port: Washington, DC -- The Electronic Frontier Foundation has fired its Policy Director Jerry Berman and will soon release a sweeping new agenda for 1995 that promises to return the organization to its original grassroots beginning. Asked to comment on his firing, Berman bristles and says: "I think that's baloney." Then he quickly adds: "Did you ever think I might have wanted to leave?" Berman has, in fact, left EFF, to head a new, as yet unannounced, policy group called the Center for Democracy and Technology. His departure from EFF and the creation of CDT will be made public this week in a joint announcement with EFF, sources said. The official line that will be spun to the public is that the two came to a "mutual parting of the ways." That benign statement, however, doesn't reflect the long hours of the behind the scenes deliberations, in which the language of the press releases will be a cautiously worded as an official State Department briefing. Heroes and pioneers always take the arrows; EFF lately has looked more like a pin-cushion than its self-appointed role as protector of all things Cyberspace. The beleaguered organization has over the course of the past two years endured often withering criticism from the very frontier citizens it was sworn to uphold and protect. The reason: A perceived move away from its grassroots activism to the role of a consummate Washington Insider deal maker. Berman is the man largely responsible for cutting EFF's policy cloth. He wears the suit well. Maybe too well. Although he has the political acumen to arm-wrestle inside-the-beltway, it comes at the expense of his management style, EFF insiders said. Those shortcomings came at the expense of EFF's day-to-day operations and didn't go unnoticed by its board of directors. The EFF board in October fired Berman for mismanaging the group's organizational and fiscal responsibilities. No impropriety or malfeasance was alleged, the board was simply dissatisfied with Berman's day-to-day managing of the shop. In a precursor to the board's October decision, it split Berman's job, giving him charge of just the policy arm, which board members said played to his strength. They then hired Andrew Taubman as executive director to oversee the day to day tasks. Separate from the organizational and fiscal misgivings, the board also couldn't brook with priority on policy affairs that Berman had engineered. Although Berman expertly navigated EFF through the choppy political waters of Washington, that course increasingly steered the organization away from its original vision as a populist group. Never was the hardcore policy-driven slant of EFF more apparent than during the two-plus year political firestorm that surrounded the FBI's infamous Digital Wiretap. The political wrangling during that time, in which Berman brokered the influence of EFF with the backing of the telephone, computer and software industries, to reach a compromise with legislators and the FBI on the bill's language, increasingly drove a wedge between the organization and its grassroots membership. Nobody within EFF interviewed for this article disagreed with how Berman ran his policy tour de force. In fact, the board was generally in agreement that Berman did an excellent job in helping to broker a less nefarious version of the FBI's wiretap bill than would have otherwise passed without his involvement on EFF's behalf. As effective as Berman was in shuffling between the political and ideological interests of EFF and its members, the "inside baseball" political bullshit was largely lost on the community of the Net, who viewed it as a kind of betrayal. The fact that there would be a backlash from the Net came as no surprise to Berman and EFF, who recognized the fine line they had to walk in dealing with a politically charged issue rivaled only by the Administration's insipid Clipper Chip encryption policy. You see, the Net community is a binary braintrust, a world of ones and zeros -- either on or off -- in which shades of grey are rarely an option. Yet it is exactly these shades of grey in which Berman excels and thrives. It is a skill -- and damn near an art form -- to be able to move among the shadows and Washington's land of a thousand different agendas. And that's right where Berman had steered EFF. However, it's not where the EFF board thought the organization belonged. And so, in a few days the Net community will read a grand announcement in which EFF and Jerry Berman state they've had a "mutual parting of the ways." The announcement will be several fold, including: -- The formation of Berman's new Center for Democracy and Technology. -- That EFF has hired current board member David Johnson, currently a computer law attorney with the Washington law firm of Wilmer, Cutler and Pickering, to be its new policy director, although that exact title has yet to be finalized. -- A new policy agenda for EFF that includes creation of an annual "State of the Net" report. EFF Executive Director Taubman declined to comment on Berman's firing, saying only that the organization and its former director had, indeed, agreed to a "mutual parting of the ways." He said EFF and Berman's new group would continue to work closely with each other and that the efforts of each would be mutually beneficial. Johnson said he was excited about the new policy efforts he would be heading up for EFF, which, in addition to the "State of the Net" report, includes commissioning papers and studies to help build a more solid idea of what exactly constitutes the Net "community" on a global basis and helping to define the Net's community as recognizable legal entity. In addition to the new policy efforts, Johnson will have to restock EFF's policy department: All the EFF policy wonks have jumped ship, resigning their positions and joining with Berman's new venture. The upheaval at EFF -- which included moving the entire operation here to new digs in Washington -- apparently hasn't hurt moral which has "never been higher," Taubman said. Underscoring Taubman's remarks is EFF's on-line legal council Mike Godwin, who said the changes "create an opportunity for us to return to our more populist mission and vision that we started with." All Things Being Equal ================= Adversity for a political junkie is the warp and woof of Washington culture. Berman is no worse for the wear, having parachuted out of EFF and into his new organization. He said CDT will be differ from EFF "on what to emphasize." That emphasis will be to focus on "on the ground public policy," he said. And it won't only be Berman's staff that sets the scene for familiarity as he jump starts CDT. The former EFF policy staffers will supply him with horsepower and his political currency will open doors. But he needs cold hard cash to feed the troops and pay the rent. That means his new organization must have financial backing and here, too, there are no strangers. Berman's bringing along a fair chunk of EFF's corporate sponsors to his new home. Companies providing seed money to Berman's CDT include AT&T, Bell Atlantic, Nynex, Apple Computer and Microsoft. These same companies provided a combined $235,000 in donations to EFF in 1993, minus Nynex, which wasn't listed as a major donor (over $5,000) on EFF's tax returns. It's not known if these companies will continue to fund EFF in full or in part or what amount they have pledged to Berman's group. Just how well-heeled CDT is and exactly who makes up the full roster of its sponsorship remains to be seen. We'll know that after the organization files its first tax returns, which will be a matter of public record. Meeks out...

1 0

Re: Breaking into girlfriend's files
by blancw＠pylon.com 17 Dec '03

17 Dec '03

Responding to msg by Black Unicorn, who is having a bad hair day (and so close to Christmas!): "Had I encrypted with Norton encrypt? I would have been deserving of whatever attack ensued." Are the cypherpunks all of one mind regarding ideals and morality? Had I inquired of the list how I could break into my dearest one's privacy, I would have been deserving of whatever commentary ensued regarding the disgusting implications of that act. "Disgusting. Get off this list, you belong on alt.codependency.recovery, or alt.bleeding.liberal." (Say - isn't this why Tim left for a bit? Oh, well.) "I may disagree with you, but I will defend to the death your right to express your [sanctimonious] opinion." (or something like that). .. Blanc

2 1

Re: FRAUD: Progress & Freedom on the Web-Frontier?
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 05:39 AM 12/24/94 -0800, Dave Del Torto forwarded someone else's writings: [...] > Even more has been written about the most famous Gopac document, > > ... a memo by Gingrich called "Language, a Key Mechanism of > Control", in which the then-House minority whip gave candidates > a glossary of words, tested in focus groups, to sprinkle > in their rhetoric and literature. For example, it advised > characterizing Democrats with such words as "decay, sick, > pathetic, stagnation, corrupt, waste, traitors". (LA Times, > 12/19/94, pages A31) Paging Prof. Chomsky, paging Prof. Chomsky... This is exactly the sort of information manipulation that can create a chain reaction on the net. The infamous modem tax is a good example of this sort of cascade effect. Use of "hot button" terms can product astonishing effects. > How does this model scale to 200,000-plus people? Well, at that > point it starts to sound a lot like the information superhighway > -- a technology for centralized broadcast of programs to a group > that isn't the "mass audience" of conventional TV broadcasting > but is distributed across the country. More tailored programming > could be distributed as well -- to particular geographical > regions, to activists on particular issues, and so forth. It's > not a decentralized model like the Internet, but then it's not > the political vision that normally goes with the Internet either. > It's closer to the asymmetrical distribution model found in the > plans of many cable and regional phone companies -- some of whom, > you might recall, sponsored the Progress and Freedom Foundation's > conference. Yawn--this is the same old crappy broadcast paradigm that every govt drone that has looked at the net insists on regurgitating out of their craw. The nature of the net is that everyone is a broadcaster, and the concept of a band of Newt-clones spamming the net is annoying. It's good that these people are this clueless--someone that selectively and judiciously inserted a few posts here and there on appropriate newsgroups could have quite an effect, given an understanding of the language manipulation techniques mentioned above. > As a case study in these issues, let's consider an organization > called the Wireless Opportunities Coalition. The WOC has [posted a web page with minimal credits for sponsorship] > Why is it "idi.net" and not "idi.com"? Never mind. My point > is not that these folks are evil or that they have no right > to speak. My point is that they are a public relations firm > practicing their craft on the Internet. In the future, I expect > that ordinary citizens using the Internet will want to inform > themselves about who's behind all of those slick web pages. This gets right down to one of the fundemental differences between Usenet news and the WWW. The Web is essentially a broadcast model for information exchange, even though everyone can publish their own Web page. News & mailing lists, OTOH, give everyone involved an opportunity to respond and point out stuff that is complete bullshit. Until you can hang responses off of Web pages, it will never give the value of the newsgroups and mailing lists, despite all the fancy fonts and glitzy graphics on the Web pages. --Paul J. Ste. Marie

1 0

DDJ editorial
by bart＠netcom.com 17 Dec '03

17 Dec '03

I think this sentence was missing a NOT: If, as some claim and RSA disputes, the code was reverse-engineered from object files in off-the-shelf software, then the law was probably broken - unless RSA and other vendors decide to test the strength of highly questionable and likely unenforceable shrink-wrap licenses that try to prohibit disassembly/decompilation. (But I don't have the DDJ to verify this)

2 1

FRAUD: Progress & Freedom on the Web-Frontier?
by ddt＠lsd.com 17 Dec '03

17 Dec '03

Apologies for this not-so-crypto posting, but this is highly interesting for those who might've missed it. Note the references to our new $4M Newtonian Speaker of the House... dave ________________________________________________________________________ Speaking of "term limits," hasn't Rush Limbaugh gotten enough attention? =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= cut here =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= From: Phil Agre <pagre(a)weber.ucsd.edu> T H E N E T W O R K O B S E R V E R VOLUME 1, NUMBER 12 DECEMBER 1994 ... The future of network politics. In the December 1994 issue of Wired (page 121) there appears an ad for something called The Progress and Freedom Foundation. Under the headline "Cyberspace: It's Nobody's Highway", this advertisement announces the availability of a "Magna Carta for the Knowledge Age". Small type at the bottom informs us that this document ... ... emerged from an August 23-24 conference in Atlanta, Georgia. Participants included Jerry Berman, Esther Dyson, John Gage, George Gilder, Jay Keyworth, Lewis Perelman, Michael Rothschild and Alvin Toffler. Major support for the conference was provided by BELLSouth and the Competitive Long Distance Coalition. Additional support was provided by Agorics Enterprises, Inc., AT&T, Cox Enterprises, J.L. Dearlove and Affiliates, Forbes, Scientific Atlanta, Video Tape Associates and Wired. Creative Consulting and Ad Production by J.L. Dearlove & Affiliates, Chicago, IL. Regarding the Magna Carta itself, it provides the e-mail address PFF(a)aol.com and some phone numbers, or, if you must, cross your fingers and send POM to 1250 H St. NW, Suite 550 Washington, DC 20005. Listen to the language. If you must? It's as though they're trying to talk jive to ingratiate themselves with the kids on the street. They don't even have a home page. So who are these folks? The ad says that: The Progress & Freedom Foundation believes cyberspace is a frontier, not a government project. We can learn a little more by turning to journalistic accounts. For example, in the 12/12/94 Wall Street Journal's article on Republican plans for the Food and Drug Administration (page A16), we read the following: In September, Rep. [Newt] Gingrich [incoming Speaker of the House] told a biotechnology trade group that he was launching a project to design a replacement for the FDA. Leading the effort is the Progress and Freedom Foundation, whose head, Jeffrey Eisenach, formerly ran Gopac, Mr. Gingrich's political action committee. Without apology, Mr. Eisenach acknowledges that drug companies are financial contributors to the foundation, and notes that drug companies will be involved in the project. And he dismisses suggestions that drug-company involvement could taint the results. "So I should go to Ralph Nader and do it?" he says. "That's silly". So the Progress and Freedom Foundation is active on more than just telecommunications issues. But it is not just an industry lobbying organization. In particular, the connection to Gopac is not at all coincidental. The purpose of Gopac has been to train conservative Republican candidates in the particularly aggressive style of politicking that Mr. Gingrich pioneered during his early days in Congress, and the Progress and Freedom Foundation may contribute to a generalization of this model. [By 1994] "Newt World" was now far-flung, from GOPAC to the National Republican Congressional Campaign Committee; the Friends of Newt Gingrich campaign committee; a weekly TV show on the conservative cable TV network, National Empowerment Television, and a think tank called the Progress and Freedom Foundation. Its messages were coordinated with talk-show hosts such as Rush Limbaugh and with Christian Coalition groups. [...] "The goal of this project is simple", Jeffrey A. Eisenach, director of the Progress and Freedom Foundation, wrote in a fund-raising letter. "To train, by April, 1996, 200,000-plus citizens into a model for replacing the welfare state and reforming our government." (LA Times 12/19/94, page A31) What can we expect from this rising army? The Gopac's record provides some evidence. Much has been written about the tactics that Gopac suggested to its candidates. An article about Gopac leader Joe Gaylord (Wall Street Journal, 8 December 1994, page A18), for example, says: Mr. Gaylord is one of the brains behind Gopac ... . [He] wrote its how-to textbook, which urges challengers to "go negative" early and "never back off". They must sometimes ignore voters' main concerns because "important issues can be of limited value". The book suggests looking for a "minor detail" to use against opponents, pointing to Willie Horton as a good example. Though it says a positive proposal also can be helpful, it counsels candidates to consider the consequences: "Does it help, or at least not harm, efforts to raise money?" Mr. Gingrich has called the book "absolutely brilliant". Even more has been written about the most famous Gopac document, ... a memo by Gingrich called "Language, a Key Mechanism of Control", in which the then-House minority whip gave candidates a glossary of words, tested in focus groups, to sprinkle in their rhetoric and literature. For example, it advised characterizing Democrats with such words as "decay, sick, pathetic, stagnation, corrupt, waste, traitors". (LA Times, 12/19/94, pages A31) In my view, though, the most significant feature of Newt World is not its language, which is certainly fascinating, or its association with industry, which is hardly surprising or novel, but rather its use of technology. Mr. Gingrich is a pioneer in the use of new technologies to build a political movement. I do have to hand it to him -- he has worked hard and he has a genius for political organizing. Having observed in the early 1980's that candidates spend a lot of dead time on the road traveling around during campaigns, he hit upon the idea of sending them videos and other materials about campaigning. This is what Gopac did. As time went on, they generalized this model to include scheduled conference calls and video broadcasts in which Mr. Gingrich and others would provide campaigners with advice about messages and methods. How does this model scale to 200,000-plus people? Well, at that point it starts to sound a lot like the information superhighway -- a technology for centralized broadcast of programs to a group that isn't the "mass audience" of conventional TV broadcasting but is distributed across the country. More tailored programming could be distributed as well -- to particular geographical regions, to activists on particular issues, and so forth. It's not a decentralized model like the Internet, but then it's not the political vision that normally goes with the Internet either. It's closer to the asymmetrical distribution model found in the plans of many cable and regional phone companies -- some of whom, you might recall, sponsored the Progress and Freedom Foundation's conference. This is not to say that Newt Gingrich and company are engaged in a conspiracy against the Internet. After all, Mr. Gingrich has made some encouraging statements about making Congressional materials available to citizens on the Internet, and this is certainly a good and laudable thing. The situation and the participants' views are often complicated. The point is that technologies are not neutral. Technologies certainly do not determine how they will be used, but neither are they simply tools that can be used for any old purpose at all. Rather, technologies and social forms evolve together, according to the affordances of the machinery and the forces of the social system. None of this coevolution goes simply or smoothly in practice, of course, nor is any of it inevitable. As the Internet illustrates extremely well, machines frequently have uses that nobody ever thought of, and these can often be resources for people wishing to engage in genuine, bottom-up democracy. The machines can't restore the health of our democracy, though -- we have to do that ourselves. And in doing so, we need to be aware of the complex and ambiguous interactions between the workings of our machinery and the forms of our political life. In particular, we should not assume that the Internet's open and decentralized architecture necessarily makes it a force for democracy, or that it necessarily levels the field for all players. The practice of politics on the Internet is increasingly complicated, with new kinds of players and new variations on the existing games. As a case study in these issues, let's consider an organization called the Wireless Opportunities Coalition. The WOC has circulated an alert on the net seeking support for a certain position in a fairly arcane regulatory fight within the FCC over the rules in certain frequency bands for digital wireless communications. The WOC's materials are also available on WWW: http://wireless.policy.net/wireless/wireless.html The basic idea of the WOC's arguments is that companies with very sensitive communications devices shouldn't be able to displace other users of certain frequencies, including low-power digital wireless communications used for educational purposes, for example in local community networking in areas that do not have high rates of telephone service. This certainly sounds like a good cause, and it probably even *is* a good cause. But note that the Wireless Opportunities Coalition, is a creation of a public relations firm called Issue Dynamics Inc, whose largest clients include Bell Atlantic and a lobbying alliance of the US regional phone companies. (To be fair, they also include the Democratic Senatorial Campaign Committee.) I couldn't find this information by searching through the WOC web pages, but you can verify it easily enough by aiming your web client at the underlying index: http://wireless.policy.net/ As recently as December 9th this page was entitled "IDI Index"; it is now, as of December 20th, called "Policy.Net". Click on "Issue Dynamics", read down to the bottom, and click on the IDI logo, which will take you to: http://idi.net/clients.html Why is it "idi.net" and not "idi.com"? Never mind. My point is not that these folks are evil or that they have no right to speak. My point is that they are a public relations firm practicing their craft on the Internet. In the future, I expect that ordinary citizens using the Internet will want to inform themselves about who's behind all of those slick web pages. Public relations and its place in society is a fascinating and important topic, and I encourage everyone to learn more about it. If you're interested, here is a brief reading list: Edward L. Bernays, The Engineering of Consent, Norman: University of Oklahoma Press, 1955. Bill Cantor, ed, Experts in Action: Inside Public Relations, New York: Longman, 1984. Oscar H. Gandy, Jr., Beyond Agenda Setting: Information Subsidies and Public Policy, Norwood, NJ: Ablex, 1982. Jack A. Gottschalk, Crisis Response: Inside Stories on Managing Image Under Siege, Detroit: Visible Ink, 1993. James E. Grunig and Todd Hunt, Managing Public Relations, New York: Holt, Rinehart and Winston, 1984. Elizabeth L. Toth and Robert L. Heath, eds, Rhetorical and Critical Approaches to Public Relations, Hillsdale, NJ: Erlbaum, 1992. Finally, let me close with a pertinent quote: "One practice which I believe should be eliminated is that of the so-called "paper front". A client is advised to finance an "organization" to promote or fight for its cause under the guise of an independent and spontaneous movement. This is a plain public deceit and fraud and of course is a technique developed with consummate skill and in great profusion by the Communists. In a free country any interest with a cause has a right to present its case to the public, to inform and, if possible, to persuade to its heart's content. But that right of free speech also carries the obligation that the source of it will be in the open for all to see. Attempts to fool the public by making it believe an "organization" existing only on paper is really a vociferous group favoring this or that cause have helped to cast a shadow upon the business of public relations counseling. No counsel who wants to preserve his own reputation will ever be a party to the issuance of any public statement by a client unless the source is clearly set forth. Obviously, when a client is involved in a public relations controversy, supporting statements are welcomed from every responsible source. But such statements should be issued by real-live people or organizations and not phoneys." This quote is from the autobiography of John W. Hill ("The Making of a Public Relations Man", recently republished by NTC Business Books, pages 139-140), who founded one of the largest public relations firms, Hill and Knowlton. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= end here =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

2 1

Re: Thoughts on 15 day CJ crypto
by Phil Karn 17 Dec '03

17 Dec '03

In article <94Dec16.08.5320(a)qualcomm.com>, you write: |> So it's possible the RSA requirement is in there to provide an |> assurance that the right key was selected. Isn't it common practice to pad out a plaintext block with random garbage to the size of the modulus before you RSA-encrypt it? E.g., if you have an 8-byte DES key and you want to encrypt it with an RSA public key having a 512-bit modulus, you'd stick 56 bytes of random stuff in front of the DES key before you do the exponentiation. When you decrypt with the secret key, you simply throw away the random padding. At least RSAREF does this. Wouldn't this thwart the kind of attack you describe? Phil

2 1