December 2003 - cypherpunks-legacy

NYTimes: Disappearing Cryptography
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- _________________________________________________________ Forwarded to you by Attila T. Hun <attila(a)hun.attila.org> July 29, 1997 Giving Away Secrets By PETER WAYNER NYTimes OpEd BALTIMORE -- Internet hype can turn age-old problems into new grave threats. The biggest tempest may be the concern over the use of encryption, or secret codes, to scramble information sent over the Internet and other computer networks. The use of codes may thrill people who want to protect the business plans on their office computers and the love letters they send by E-mail. But it worries the Director of the Federal Bureau of Investigation, Louis J. Freeh, and other law-enforcement officials. Mr. Freeh is right to be concerned that encryption can limit the ability of law enforcement to gather electronic evidence from wiretaps and court-ordered searches. But he was wrong when he recently told the Senate Judiciary Committee that "technology and telecommunications well beyond the contemplation of the Framers" will bring "a terrible upset of the balance so wisely set forth in the Fourth Amendment." In other words, he envisions the balance tipping against the police, because they will have more difficulty conducting reasonable searches if more of the information they are seeking is encrypted. Yet cryptography wasn't beyond the contemplation of the Framers, because many of them were skilled code makers and code breakers themselves. David Kahn's book "The Codebreakers" tells how codes have affected history for more than 3,000 years. According to Mr. Kahn, George Washington had to deal with the problem when a coded message was intercepted in August 1775 from Benjamin Church, a member of the Massachusetts Congress who was a spy for the British. The message, which was finally deciphered, told the English details of American troop movements. As Mr. Kahn reveals, both sides in the Revolutionary War made extensive use of encryption. Benedict Arnold designed the complex code that he used to sell out his country. James Lovell of the Continental Congress helped win the war by breaking the codes used by General Cornwallis. After the war, Thomas Jefferson and James Madison communicated in their own private code. And Benjamin Franklin devised his own cipher for sending dispatches from Europe. Yet in writing the Bill of Rights, the Founders did not forbid cryptography, even though they knew how powerful a tool it could be. Nor did they suggest that the police be able to obtain the plain text of a coded message. But that could happen under a measure sponsored by Senator Bob Kerrey of Nebraska, a Democrat, and Senator John McCain of Arizona, a Republican. Under their bill, the key to any code used to scramble information sent on the Internet would have to be given to the proper authorities. The Clinton Administration supports similar measures. James Bamford, in "The Puzzle Palace," describes how the F.B.I. broke the case of the gangsters who were communicating without phone calls or letters. Agents discovered that the gangsters sent their shirts to Las Vegas to be dry cleaned -- and that the number of shirts held the coded message. No ban on cryptography on the Internet will be able to thwart creative crooks like these, but diligent police work can find cracks in the armor. This is why the National Research Council has recommended that Congress invest in research to help the F.B.I. better understand computers and codes. The F.B.I. faces a daunting task. Encryption makes it impossible for agents to gather all the evidence they would like. But the answer is not to regulate, and in effect destroy, the use of coded messages. Criminals would probably find a way around the rules, and the rest of us could lose a powerful tool for protecting our privacy. Peter Wayner is the author of "Disappearing Cryptography." _____________________ End forwarded message ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBM92xDL04kQrCC2kFAQE+qQP/WIO0Mj/GX5ANiyq2ekCbOiN1lfYKl/MN H6/X0TdHIEpcmZipTzxuC4UOQ4rR7XUOXRneDSiLBS+OEFCRGlm85/o8/dTWgRsG lMVF0SDR44GwONBik2sH1rV4b3m+GUzvTGvPIBkybjU2wSfZUrwSQALeRuvxkABq 8C5sJ6waEV4= =SLL5 -----END PGP SIGNATURE-----

1 0

Re: NSA leak (fwd)
by Secret Squirrel 17 Dec '03

17 Dec '03

Subject: Re: NSA leak (fwd) From: h_tuttle(a)rigel.cyberpass.net > Terawatts for a few microseconds is fairly standard technology, I > believe. Femtosecond laser pulses driven by *very* large capacitor > banks... I'm talking continuous generation - sustained for half an hour... > > Terrestrial fusion is not a serious contender yet, and I doubt > > it will be for a long time. > > It's easy to generate lots of power through fusion. The problem is > confinement. I'm still talking continuous generation - we'll leave out the H-bombs. And of course I agree confinement is a major problem. Last I heard from the cutting edge (early '90s) you could get 2MW out of a fusion reactor, but that was less than you put in to start it up. That was using Deuterium, being gentle in order to preserve the reactor. Predictions were that using D-T would break even. Even that isn't anywhere near a commercial scale generator. You know of better results ? There certainly are a number of approaches, but I think I'd know if commercial fusion reactors were working. Are you ready to take this off-list ?

1 0

Re: CPAC, XtatiX, and the Censor-State
by Mike Duvos 17 Dec '03

17 Dec '03

In alt.cypherpunks, Censorship Suck <FBI(a)Sucks.NSA> writes: > That's pretty bad, when there's not even any sex. Yes. Most of these Web pages are not even political or sexual in nature, but cute boys anywhere on the Net these days cause the Fundies to have Grand Mal seizures. > My previous suggestion was to create "virtual" WWW sites > (when necessary, possibly as a stop-gap measure when there > is a censorship attack). I read your earlier post, and find the notion of hosting Web sites on Usenet intriguing. Tim has always pointed out that Usenet already exists as a persistent uncensorable repository of virtually everything, and that applications (eg BlackNet) needing such a facility should simply use the existing one. > By virtual, I mean by posting to USENET, probably encrypted, > with the decryption key following a couple days later. > It involves considerable development for either a newsreader > or preprocessor, but then, the work is implied. A > "gathering" design is necessary. Conceptually, seamlessly extending the Web over Usenet is not complicated. Each document could be posted as a single PGP conventionally encrypted article, with some reasonable convention for encryption keys and message ids that would enable links to be followed. Browsers could be modified to maintain a open connection to an NNTP server, and to fetch and decrypt articles specified by an nntp:<message-id> link in lieu of using http. Suppose I post my favorite banned Web pages to alt.anonymous.messages on a weekly basis, and distribute browser plug-ins and patches to enable Usenet to host Web content. I forsee the following glitches. First, as anyone who has posted a large number of articles to Usenet knows, many servers will only get a subset of them. Second, policy for article expiration is site-specific, and can be made to depend on a number of parameters. Posting once a week may be fine for some servers, and not for others. Third, it is only practical to employ Usenet to host static Web content. This rules out Web-based chat boards, and other such politically interesting content, as well as anything that is cgi-bin based. Fourth, Web content on Usenet will be in an easily identified format and trivial to filter out at local sites. > Because you are exactly right: the ISPs can be attacked, > regardless of the fault-tolerant design of the Internet. > Some version of the above tool WILL route around "damage" > attempts. > Interesting, that this would in part require cryptography. > Would the government go so far as to try and outlaw crypto > posts to USENET? Good luck. Odder things have happened. > Someone should make a complete list of all the > contacts/emails involved in contacting ISPs to get them to > censor. There may be something to learn. (sort of a traffic > analysis deal) It's the "usual suspects." We know who they are, and they are making no attempt to keep their activities secret. -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

2 3

Re: Liability for Key Cracking in Idle Hours?
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

>Damien may be able to tell us if Ecole Polytechnique has raised any >questions about his highly-publicized attack on the SSL Challenge key. Well, I asked for permission before I used the machines, so I don't expect any problem. (Actually, I asked for the permission, then launched the processes, then got the permission, but it doesn't make any difference, does it ? I should have also asked permission for putting their name in my announce, though.) It seems that the Herald Tribune called them about a cracker, and they refused to comment. They must have gone in paranoid mode, because they've had lots of trouble with student crackers in the past, and there is currently not even one student on the campus. But now, the situation seems to be in control, although I had no official contact from Ecole Polytechnique. Ecole Normale Superieure did not react at all. They're all on vacation anyway. By the way, "cypherpunks" keep getting mentioned in interviews with the press. I hope that's OK with you all. -- Damien

1 0

Finally the Answer to LIFE!! Real Science, NOT FICTION!
by 64355512＠nowhere.com 17 Dec '03

17 Dec '03

FINALLY, THE ANSWER TO LIFE!! Science, Not-Fiction Have you ever pondered any of these questions? 1.What is the origin of life? 2.What is Life? 3.How were we created? 4.What happens when we die? 5.Is there other life out there? 6.Do we ever become immortal? FOR THE ANSWERS TO THESE QUESTIONS AND MORE, POINT YOUR BROWSER TO www.wgn.net/~dicewars/ www.wgn.net/~dicewars/

1 0

NSA into antigravity?
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

this apparently involves credible researchers, and it's something that would be pretty bizarre if the NSA is really implicated.. ------- Forwarded Message Date: Fri, 18 Aug 95 18:04:09 -0700 From: Albert Nanomius <nanomius(a)netcom.com> - ------- Forwarded Message Date: Thu, 17 Aug 1995 17:03:00 -0500 From: "chris (c.) currivan" <currivan(a)bnr.ca> To: snet-l(a)world.std.com Subject: NSA and science A post from alt.conspiracy: Francis E. Decstation <fed(a)cca.org> wrote: > >On July 19, Gerald Ollman and Robert Wayne, two researchers from the >University of Maryland geophysics department were detained in Fort Meade, >Maryland, apparently by agents of the National Security Agency, whilst >taking measurements of the Earth's gravitational field. After 18 hours of >questioning, they were released after being instructed not to discuss the >incident. Their equipment and results were not returned. > >Neither the University nor the NSA has commented on the incident. However, >it is believed that Ollman and Wayne were investigating a slight anomaly >in the Earth's gravitational field centered around Fort Meade. No reason has >been given for their detention.

2 1

Makes the News! (Was Re: SSL Broken)
by Robert Zach 17 Dec '03

17 Dec '03

The first trade mag article I have seen on the Subject has been delivered to my doorstep!! Check out COMMUNICATIONS WEEK August 21 PAGE 1 FYI -Rob

1 0

subscribing to cypherpunks
by ketcher＠ix.netcom.com 17 Dec '03

17 Dec '03

Lance Cottrell: Sandy Sandfort suggested I write to you about subscribing to cypherpunks. How can one do it? Thank you. Mike Ketcher

1 0

EPIC Alert 2.09
by Dave Banisar 17 Dec '03

17 Dec '03

============================================================= @@@@ @@@@ @@@ @@@@ @ @ @@@@ @@@@ @@@@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @@@ @ @ @@@@@ @ @@@ @@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @ @@@ @@@@ @ @ @@@@ @@@@ @ @ @ ============================================================= Volume 2.09 August 21, 1995 ------------------------------------------------------------- Published by the Electronic Privacy Information Center (EPIC) Washington, DC info(a)epic.org http://www.epic.org *Special Edition: Crypto* ======================================================================= Table of Contents ======================================================================= [1] "New" Crypto Policy Announced: Clipper II? [2] NIST Announcement on Key-Escrow Workshops [3] Documents: FBI & NSA Want to Ban Non-Escrowed Encryption [4] EPIC Crypto Web Pages Online [5] Upcoming Conferences and Events ======================================================================= [1] "New" Crypto Policy Announced: Clipper II? ======================================================================= The Clinton Administration ended a year of silence on August 17 when it issued a long-awaited statement on the Clipper Chip and key-escrow encryption. Unfortunately, the "new" policy is merely a re-working of the old one -- the Administration remains committed to key-escrow techniques that ensure government agents access to encrypted communications. The only changes are a willingness to consider the export of 64-bit encryption (if "properly escrowed"), the possibility of private sector escrow agents to serve as key-holders, and consideration of software implementations of key-escrow technologies. As EPIC Advisory Board member Whit Diffie observed in an op-ed piece in the New York Times, the new approach won't work. "While other nations may share our interest in reading encrypted messages for law enforcement purposes, they are unlikely to embrace a system that leaves them vulnerable to U.S. spying. They will reject any system that gives decoding ability to agents in the United States." Diffie further notes that "64-bit keys are not expected to be adequate." In a statement re-printed below, the National Institute of Standards and Technology (NIST) announced two public workshops "to discuss key escrow issues." More information concerning these meetings can be obtained from Arlene Carlton at NIST, (301) 975-3240, fax: (301) 948-1784, e-mail: carlton(a)micf.nist.gov. ======================================================================= [2] NIST Announcement on Key-Escrow Workshops ======================================================================= EMBARGOED FOR RELEASE: NIST 95-24 3 p.m. EDT, Thursday, Aug. 17, 1995 Contact: Anne Enright Shepherd COMMERCE'S NIST ANNOUNCES (301) 975-4858 PROCESS FOR DIALOGUE ON KEY ESCROW ISSUES Furthering the Administration's commitment to defining a workable key escrow encryption strategy that would satisfy government and be acceptable to business and private users of cryptography, the Commerce Department's National Institute of Standards and Technology announced today renewed dialogue on key escrow issues. A Sept. 6-7 workshop will convene industry and government officials to discuss key escrow issues, including proposed liberalization of export control procedures for key escrow software products with key lengths up to 64 bits, which would benefit software manufacturers interested in building secure encryption products that can be used both domestically and abroad. Key escrow encryption is part of the Administration's initiative to promote the use of strong techniques to protect the privacy of data and voice transmissions by companies, government agencies and others without compromising the government's ability to carry out lawful wiretaps. In a July 1994 letter to former Rep. Maria Cantwell, Vice President Gore said that the government would work on developing exportable key escrow encryption systems that would allow escrow agents outside the government, not rely on classified algorithms, be implementable in hardware or software, and meet the needs of industry as well as law enforcement and national security. Since that time, discussions with industry have provided valuable guidance to the Administration in the development of this policy. For example, many companies are interested in using a corporate key escrow system to ensure reliable back-up access to encrypted information, and the renewed commitment should foster the development of such services. Consideration of additional implementations of key escrow comes in response to concerns expressed by software industry representatives that the Administration's key escrow policies did not provide for a software implementation of key escrow and in light of the needs of federal agencies for commercial encryption products in hardware and software to protect unclassified information on computer and data networks. Officials also announced a second workshop at which industry is invited to help develop additional Federal Information Processing Standards for key escrow encryption, specifically to include software implementations. This standards activity would provide federal government agencies with wider choices among approved key escrow encryption products using either hardware or software. Federal Information Processing Standards provide guidance to agencies of the federal government in their procurement and use of computer systems and equipment. Industry representatives and others interested in joining this standards-development effort are invited to a key escrow standards exploratory workshop on Sept. 15 in Gaithersburg, Md. This workshop is an outgrowth of last year's meetings in which government and industry officials discussed possible technical approaches to software key escrow encryption. The Escrowed Encryption Standard, a Federal Information Processing Standard for use by federal agencies and available for use by others, specifies use of a Key Escrow chip (once referred to as "Clipper chip") to provide strong encryption protection for sensitive but unclassified voice, fax and modem communications over telephone lines. Currently, this hardware-based standard is the only FIPS-approved key escrow technique. NIST officials anticipate proposing a revision to the Escrowed Encryption Standard to allow it to cover electronic data transmitted over computer networks. Under this revised federal standard, the Capstone chip and other hardware-based key escrow techniques developed for use in protecting such electronic data also will be approved for use by federal agencies. As a non-regulatory agency of the Commerce Department's Technology Administration, NIST promotes U.S. economic growth by working with industry to develop and apply technology, measurements and standards. ======================================================================= [3] Documents: FBI & NSA Want to Ban Non-Escrowed Encryption ======================================================================= On a related note ... Declassified government documents recently obtained by EPIC show that key federal agencies concluded more than two years ago that the "Clipper Chip" key-escrow initiative will only succeed if alternative security techniques are outlawed. The information is contained in several hundred pages of material concerning Clipper and cryptography EPIC obtained from the FBI under the Freedom of Information Act. The conclusions contained in the documents appear to conflict with frequent Administration claims that use of key-escrow technology will remain "voluntary." Critics of the government's initiative, including EPIC, have long maintained that government-sanctioned key- escrow encryption techniques would only serve their stated purpose if made mandatory. According to the FBI documents, that view is shared by the Bureau, the National Security Agency (NSA) and the Department of Justice (DOJ). In a "briefing document" titled "Encryption: The Threat, Applications and Potential Solutions," and sent to the National Security Council in February 1993, the FBI, NSA and DOJ concluded that: Technical solutions, such as they are, will only work if they are incorporated into *all* encryption products. To ensure that this occurs, legislation mandating the use of Government-approved encryption products or adherence to Government encryption criteria is required. Likewise, an undated FBI report titled "Impact of Emerging Telecommunications Technologies on Law Enforcement" observes that "[a]lthough the export of encryption products by the United States is controlled, domestic use is not regulated." The report concludes that "a national policy embodied in legislation is needed." Such a policy, according to the FBI, must ensure "real-time decryption by law enforcement" and "prohibit[] cryptography that cannot meet the Government standard." The FBI conclusions stand in stark contrast to public assurances that the government does not intend to prohibit the use of non- escrowed encryption. Testifying before a Senate Judiciary Subcommittee on May 3, 1994, Assistant Attorney General Jo Ann Harris asserted that: As the Administration has made clear on a number of occasions, the key-escrow encryption initiative is a voluntary one; we have absolutely no intention of mandating private use of a particular kind of cryptography, nor of criminalizing the private use of certain kinds of cryptography. The newly-disclosed information suggests that the architects of the key-escrow program -- NSA and the FBI -- have always recognized that key-escrow must eventually be mandated. Coming to light on the eve of the announcement of a "new" Administration policy, the FBI documents raise significant questions as to the government's long-term strategy on the cryptography issue. Scanned images of several key documents are available via the World Wide Web at http://www.epic.org/crypto/ban/fbi_dox/ ======================================================================= [4] EPIC Crypto Policy Web Pages Online ======================================================================= EPIC is now making available an extensive series of pages on cryptography policy. Each page highlights an area of controversy and provides links to key documents. Materials include formerly secret government documents obtained under FOIA by EPIC and CPSR, reports from the Office of Technology Assessment, the General Accounting Office and others on cryptography. Topics include: o Efforts to ban cryptography o The Clipper Chip o The Digital Signature Standard o The Computer Security Act of 1987 The pages are available at http://www.epic.org/crypto/ More pages will become available soon. ======================================================================= [5] Upcoming Privacy Related Conferences and Events ======================================================================= Advanced Surveillance Technologies. Sept. 4, 1995. Copenhagen, Denmark. Sponsored by Privacy International and EPIC. Contact pi(a)privacy.org. http://www.privacy.org/pi/conference/ 17th International Conference of Data Protection and Privacy Commissioners. Copenhagen, Denmark. September 6-8, 1995. Sponsored by the Danish Data Protection Agency. Contact Henrik Waaben, +45 33 14 38 44 (tel), +45 33 13 38 43 (fax). InfoWarCon '95. September 7-8, 1995. Arlington, VA. Sponsored by NCSA and OSS. Email: 74777.3033(a)compuserve.com. Business and Legal Aspects of Internet and Online Services. Sept. 14-15. New York City. Sponsored by National Law Journal and New York Law Journal. Contact: (800)888-8300, ext. 6111, or (212)545-6111. The Good, the Bad, and the Internet: A Conference on Critical Issues in Information Technology. October 7-8. Chicago, Ill. Sponsored by CPSR. Contact cpsr(a)cpsr.org or http://www.cs.uchicago.edu/discussions/cpsr/annual 18th National Information Systems Security Conference. Oct. 10-13. Baltimore, MD. Sponsored by NSA and NIST. Contact: 301-975-3883. Managing the Privacy Revolution. Oct. 31 - Nov. 1, 1995. Washington, DC. Sponsored by Privacy & American Business. Speakers include Mike Nelson (White House) C.B. Rogers (Equifax) and Marc Rotenberg (EPIC). Contact Alan Westin 201/996-1154. 22nd Annual Computer Security Conference and Exhibition. Nov. 6-8, Washington, DC. Sponsored by the Computer Security Institute. Contact: 415-905-2626. Global Security and Global Competitiveness: Open Source Solutions. Nov. 7-9. Washington, D.C. Sponsored by OSS. Contact: Robert Steele oss(a)oss.net. 11th Annual Computer Security Applications Conference: Technical papers, panels, vendor presentations, and tutorials that address the application of computer security and safety technologies in the civil, defense, and commercial environments. Dec. 11-15, 1995, New Orleans, Louisiana. Contact Vince Reed at (205)890-3323 or vreed(a)mitre.org. Computers Freedom and Privacy '96. March 27-30. Cambridge, Mass. Sponsored by MIT, ACM and WWW Consortium. Contact cfp96(a)mit.edu or http://www-swiss.ai.mit.edu/~switz/cfp96 Australasian Conference on Information Security and Privacy June 24-26, 1996. New South Wales, Australia. Sponsored by Australasian Society for Electronic Security and University of Wollongong. Contact: Jennifer Seberry (jennie(a)cs.uow.edu.au) (Send calendar submissions to Alert(a)epic.org) ======================================================================= The EPIC Alert is a free biweekly publication of the Electronic Privacy Information Center. To subscribe, send the message: SUBSCRIBE CPSR-ANNOUNCE Firstname Lastname to listserv(a)cpsr.org. You may also receive the Alert by reading the USENET newsgroup comp.org.cpsr.announce. Back issues are available via http://www.epic.org/alert/ or FTP/WAIS/Gopher/HTTP from cpsr.org /cpsr/alert/ and on Compuserve (Go NCSA), Library 2 (EPIC/Ethics). ======================================================================= The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues relating to the National Information Infrastructure, such as the Clipper Chip, the Digital Telephony proposal, medical record privacy, and the sale of consumer data. EPIC is sponsored by the Fund for Constitutional Government and Computer Professionals for Social Responsibility. EPIC publishes the EPIC Alert and EPIC Reports, pursues Freedom of Information Act litigation, and conducts policy research on emerging privacy issues. For more information, email info(a)epic.org, WWW at HTTP://www.epic.org or write EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington, DC 20003. (202) 544-9240 (tel), (202) 547-5482 (fax). The Fund for Constitutional Government is a non-profit organization established in 1974 to protect civil liberties and constitutional rights. Computer Professionals for Social Responsibility is a national membership organization of people concerned about the impact of technology on society. For information contact: cpsr-info(a)cpsr.org If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "The Fund for Constitutional Government" and sent to EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington DC 20003. Your contributions will help support Freedom of Information Act litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and funding of the National Wiretap Plan.. Thank you for your support. ------------------------ END EPIC Alert 2.09 ------------------------ _________________________________________________________________________ Subject: EPIC Alert 2.09 _________________________________________________________________________ David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * HTTP://epic.org Washington, DC 20003 * ftp/gopher/wais cpsr.org

1 0

interesting quote, Baltimore Sun 8/21
by Thomas M. Swiss 17 Dec '03

17 Dec '03

Page 7A of today's _Baltimore Sun_ features an op-ed piece by Carl R. Eisendrath, "a former U.S. foreign-service officer", entitled "Bringing Light to Covert Operations", which cites an interesting quotation: "In the period between the two world wars, Secretary of War Henry Stimson closed the cryptography section of the State Department because, as he reputedly said, "Gentlemen don't read each other's mail." -Tom Swiss / tms(a)tis.com

1 0