December 2003 - cypherpunks-legacy

Senate Bill 974
by David Neal 17 Dec '03

17 Dec '03

Senate Bill 974 The full text is difficult to interpret since it mostly just amends other law. Essentialy the law makes illegal: using a computer for racketeering purposes, threatening to destroy data, transferring of unlicensed software, using any method to hide illegal funds transfer, and exporting crypto software. (Relavent bits are included below). The law also expands wiretapping authority, and seems to allow electronic evidence found during a search to be introduced as evidence. You'll have to insert the text of the bill into the real laws to get full context. `(2) to distribute computer software that encodes or encrypts electronic or digital communications to computer networks that the person distributing the software knows or reasonably should know, is accessible to foreign nationals and foreign governments, regardless of whether such software has been designated as nonexportable; `(3) to use a computer or computer network to transmit a communication intended to conceal or hide the origin of money or other assets, tangible or intangible, that were derived from racketeering activity; and `(4) to operate a computer or computer network primarily to facilitate racketeering activity or primarily to engage in conduct prohibited by Federal or State law. `(b) For purposes of this section, each act of distributing software is considered a separate predicate act. Each instance in which nonexportable software is accessed by a foreign government, an agent of a foreign government, a foreign national, or an agent of a foreign national, shall be considered as a separate predicate `(c) It shall be an affirmative defense to prosecution under this section that the software at issue used a universal decoding device or program that was provided to the Department of Justice prior to the distribution.'. David Neal <dneal(a)usis.com> - GNU Planet Aerospace 1-800-PLN-8-GNU Unix, Sybase and Networking consultant. "...you have a personal responsibility to be pro-active in the defense of your own civil liberties." - S. McCandlish

1 0

Senate Bill 974?
by David Neal 17 Dec '03

17 Dec '03

Haven't seen it discussed here, but the August 28, 1995 issue of Lan Times covers Sen. Charles Grassley's (R-IOWA) Senate Bill 974. Frankly, you should probably read the text of the bill itself, because the article doesn't seem to get the facts straight. The article asserts first that the bill may outlaw any non-GAK encryption, but then quotes the senator as saying ``All my bill does is say you can't use computers to steal, to threaten others or conceal criminal conduct.'' Perhaps concealing criminal conduct is considered using non-GAK. The quote from the bill itself reads like the ITAR; it is illegal to ``distribute computer software that encodes or ecrypts electronic or digital communications to computer networks that the person knows, or reasonably should know, is accessible to foreign nationals and foreign governments, regardless of whether such software has been designated as nonexportable." The article also says that up to 64 bit keys may now be allowed in exportable software, but that ``some experts'' suggest that those keys may have to be GAK. I've never heard anything BUT the keys would have to GAK. David Neal <dneal(a)usis.com> - GNU Planet Aerospace 1-800-PLN-8-GNU Unix, Sybase and Networking consultant. "...you have a personal responsibility to be pro-active in the defense of your own civil liberties." - S. McCandlish

2 1

IP6_pi2
by John Young 17 Dec '03

17 Dec '03

IEEE Spectrum, September, 1995: Excerpt on Net security from "Upgrading the Internet," a roundtable discussion of the Internet Society on the next generation of Internet protocols, IP Version 6. Discussants: Vinton Cerf, Stephen Deering, Christian Huitema, Haruhisa Ishida, Larry Landweber, Eric Schmidt, Lixia Zhang. A most important aspect of the IPv6 is the somewhat controversial decision to require that all v6 implementations support strong privacy and strong authentication. At this level, all of the security problems won't be solved, but we can authenticate and maintain privacy of packets that flow from one machine to another. This will eliminate many security threats in the current Internet, such as source-address-spoofing, source-related routing attacks, password sniffing, connection hijacking, and so on. New Scientist, Sept 9, 1995: "Watching you, watching us." Companies that sell electronic surveillance equipment to repressive regimes face the prospect of being "outed" on the Internet this autumn. Two electronic watchdogs, the British group Privacy International (PI) and its American sister organisation the Electronic Privacy Information Centre (EPIC), are setting up an offshore Internet site that will name companies that sell electronic instruments of repression to governments with poor records on human rights. IPI-pair: IP6_pi2 (13kb)

2 1

Re: Information
by Ross Wright 17 Dec '03

17 Dec '03

On or About 2 Sep 97 at 14:27, Sandromar Ferreira wrote: > > >>>> > > > Information, please! > > >>>> > > Dont go swimming on a full stomach. > > >>>> > Don't "escrow" your keys. > > >>>> Don't take advice from strangers. > > >>>Don't ask, don't tell. > > >>Don't eat yellow snow. > > >Don't spit, just swallow. > > Don't touch anything. Don't play with that, you'll shoot your eye out. =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: (408) 259-2795

1 0

NIS&T Key Escrow Export kangaroo conference
by Bill Trost 17 Dec '03

17 Dec '03

Pat Farrell's summary of the NIS&T conference (thanks for the report, by the way!) discussed a bunch of "criteria" that an "acceptable" GAK system should provide, including a couple that are supposed to limit the ability of law enforcement to use keys beyond the bounds of the search warrant. Another criterium that needs to be brought up (although I'm not sure of how one would phrase in a way that is either clean or polite) comes out of a debate between Philip Zimmermann and Dorothy Denning I ran across at one point: "How can a GAK system be arranged so that some future Congress cannot destroy the protections of the split-"escrow" system by issuing a resolution like 'All key components of suspected Comm^H^H^H^H terrorists shall be provided to the House Committee on Unamerican Activities'?" The links to McCarthyism are important here. GAK proponents can't claim this kind of thing won't happen -- it *has* happened, and could easily happen again. Anyone who claims otherwise is either terribly naive or is being outright misleading. In some sense, this criterium goes to the very heart of the whole GAK question -- even if you believe in the allegedly legitimate power of law enforcement to look through people's love letters, the "safety mechanisms" for the keys are nothing more than a set of flimsy policies that Congress could toss aside the next time something scary comes along. The protections that the GAK proponents are proposing (and proponing (-: ) are frightfully ephemeral. By the way, I'm a few days behind, so sorry if this is "old mail".

1 0

Digital Fingerprinting
by cman＠communities.com 17 Dec '03

17 Dec '03

A couple of threads have recently touched on aspects of "digital fingerprinting", a term that covers a variety of methods for making changes to digital documents in order to trace the origin of illicit copies. This subject has been on my mind after several discussions on this topic at Crypto, as well as the one formal presentation on the subject. Here are some of my thoughts on this subject: o If the domain of changes is well understood, and can be altered without significant loss of quality, then it is trivially easy to remove the fingerprinting. In other words, if you know the algorithm used to create the fundamental codewords in the fingerprint, and you can overwrite arbitrary codeword bits with other codeword bits, then the scheme can be avoided without collaboration of any kind. Example: A software company fingerprints its software by mapping two equivalent machine instructions onto binary "0" and "1", respectively. Someone who knows about this could randomly replace one instruction with the equivalent one, which would reduce the fingerprint to noise. Example: A publishing company uses an even number of points between paragraphs to indicate "0" and an odd number of points to indicate "1". Someone who understands this can overwrite the fingerprint as above. o If a fingerprinting scheme depends on the secrecy of an algorithm, then this is really "security by obscurity", which may be effective for a period of time, but is likely to meet the fate of most copy protection schemes that have rested on raw obscurity. o Certain domains of information lend themselves to the secure formation of fingerprint "bits" that are very difficult to scrub in this way. One such scheme was used as the basis for the presentation at Crypto: imagine that a film was shot with two (or N) cameras. For each frame of the film, the distributor can chose to take a frame from a different camera. Frames from camera 0 would be mapped onto binary "0", frames from camera 1 would be mapped onto binary "1". Using this approach it is possible to construct schemes that are resistant to collaboration up to "N" people. The security of such schemes rests on the assumption that given one frame, it is very hard (and possibly intractable) to fuzz up the frame such that the parallax information doesn't give away which camera shot the frame. Rather than hiding the fingerprint information in the "low bits", this technique hides the information throughout the picture. In one sense, a 2D picture of a 3D object is similar to a one- way hash function. It is a form of lossy compression on the 3D object that is impractical to work backwards. o Note that overwriting a fingerprint with random noise (or whatever) does not generate a valid replacement fingerprint. Therefore it would still be possible to tell that a document had been tampered with (and was not a valid copy), even if its provenance could not be determined. o A number of people are working on "black box" viewer technology, which would allow people to purchase documents that could only be read on devices with tamper-resistant hardware in them that would be required to decrypt media. Certainly much piracy could be done by capturing the output of such a box (unless it was embedded in a tamper-resistant chasis); there are some proposed schemes for reducing the payoff of output capture, but they depend on a similar approach to the movie fingerprinting idea above -- the base data format is somehow richer, possibly capable of generating different output under different circumstances or on different hardware platforms, while the output of the black box represents only one view of the base data. Example: a base format for a 3D object is encrypted with a public key resident in the "black box". Said black box also includes a hardware 3D rendering engine. The output of the black box consists of a series of 2D frames, which may make it impractial to reproduce the base 3D object. It is my considered opinion that this sort of technology will meet with tremendous customer resistance, and will not prove practical or cost-effective; many analysts are predicting a trend toward more general purpose computers for media viewing rather than towards specialized hardware that is needed for this kind of approach. o There are also some profound practical and legal problems with the use of digital fingerprinting. For one thing, it involves generating a unique copy of every document for each consumer. After the digitial fingerprinting session at Crypto, a guy from Microsoft was pointing out the incredible difficulties posed by trying to fingerprint, say, every copy of Windows 95. On the legal front, it's not clear what you can do to someone even if you _can_ prove that the 100,000 pirate copies of Windows 95 circulating in Amsterdam stemmed from his copy. Machines get hacked, co-workers and family members often have free access to machines running software -- it's not clear that media companies _want_ to invoke the paranoia associated with potential responsibility for millions of dollars in damages if someone makes an illegal copy of one's software and the loaves and fishes ensue. [Imagine what great revenge this would make for jealous co-workers, ex-wives, etc.]

1 0

question about reputation
by Wei Dai 17 Dec '03

17 Dec '03

In an economy based on positive reputations, how does one acquire a reputation capital? One way may be to initially perform services at a price below cost, but this has some problems. For example, Alice starts a anonymous consulting service, and announces that she will answer the first ten queries for free. Upon hearing this, Mallet immediately starts another consulting service, and announces the same offer. At this point Mallet can simply forward his customers' queries to Alice and Alice's answers back to his customers. Thus, he gains reputation at no cost. On the other hand, this "man-in-the-middle" attack can also work against conventional True Name based services, but perhaps with less effect. Has anyone ever heard of this being done? Is there a better way to acquire a good reputation? Wei Dai

4 5

Re: not a flame please read and think about this
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Rich said >>> even phil zimmerman is selling the rights to pgp. what about all the >>> people who contributed code (like me) ... . ask phil >>> about me and when i asked about sharing profits from the code i >>> conrtibuted. also about the deal with r.f... > >Mr/Ms. Anonymous is lying. His/her name appears nowhere in the credits, >and his/her code appears nowhere in any PGP release. Don't waste any >neurons on it. Let Anonymous have a share of prz's legal bills as well. No matter how much Phil is getting from licensing, somehow I doubt he is netting a profit... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMFOfeGGnwFiC3O2NAQHedwf/T9QOEUBdX7DZx1ygdk4/Us2wmiYQiDUG PZxht4G+66aYO/7IYwxIES9ksAvCP/vZJ14a55Lc+NJABFnMe/eJrbXmNSjyGdFP hoHUXGWv3BJDpx6QvhapDFoAsG0b0KgDQMpG2/6s9VPKsDoNNioUDzvpV4lh7fNh RhjO1yA1dYHVcW2ihICByw/e43aU35xhrDhzFm/9ExtVT2STMGvnTso3Pgj/oAqa Szbj2AzKp6NmI+BdfWrZmdFcFdji8toQ5AtUmBY1gBU1DbDZzdV8BiDYnMJfbcyH TIKxU4xPWpXi3WjfE37CsPnxGv+ASylHuCUpanldKaz3y03hRawIBQ== =3Pw7 -----END PGP SIGNATURE-----

1 0

Re: Digital Fingerprinting
by Hal 17 Dec '03

17 Dec '03

I'm not sure how to do it for software, but for novels it should be easy to fingerprint. Every couple of pages the author writes a sentence twice in different forms. This would not take a great deal of extra effort on the part of the author. Software can then choose from the alternative variations in different patterns to produce a unique fingerprint for every copy. There would seem to be two approaches to removing the fingerprint. One would be re-writing every sentence in the novel. The other would be to collect enough copies to identify all of the sentences which have variations. Most of the mathematics of fingerprinting research is oriented around figuring out how many different points of variation there must be to be secure against a certain number of copies of the fingerprinted item being compared. Perhaps a similar approach could be applied to software, where in many cases a couple of statements could be trivially interchanged, or other kinds of simple transformations could be manually generated. Those could be marked by the programmers without too much extra work. I agree with Doug that fully automated fingerprinting schemes which post process "vanilla" documents are going to be forced to rely on security through obscurity, probably a losing battle. Also as Doug says the viability of legal sanctions against the source of fingerprinted docs is questionable. Maybe it could work if you had just a few copies out and the people who were given copies can be seriously held to non-disclosure agreements. Hal

1 0

Beware free 'gifts'
by Eric Murray 17 Dec '03

17 Dec '03

Spammed to Usenet news: >Subject: Check Em Out >Date: 1 Sep 1997 01:43:23 GMT >Organization: MediaOne SouthEast >Lines: 36 >NNTP-Posting-Host: surf219.pompano.net >Mime-Version: 1.0 >Content-Type: Text/Plain; charset=US-ASCII >X-Newsreader: WinVN 0.99.9 (Released Version) (x86 32bit) > > > Discreet Research > > http://www.dresearch.com > > Background Checks, People Finder, Driving & Criminal Records & more! > * NOW WITH A RESELLER PROGRAM! > > Lost a friend or loved one? we can find em'! fast and cheap! > > Want to check out your mate ? we can! everything from there > driving record, bank account!, license tag trace (all legal!) > > > New Product : PHONE TRAPCARD > > Here's how this exciting new service works. You request who you > want a phonecard sent to. Discreet Research then sends your subject > a disguised gift packaged phonecard charged with 60 minutes of > calling time. Your subject will then use the card to make phone calls. > > Discreet Research will then notify you by fax, e-mail, or by phone with > a daily log that tells you the phone numbers your subject called, > & the phone numbers the calls were placed from. The trapline can trace > any type of phoneline even payphones! The phonecard is valid for 3 > months. > >We also offer a reseller program if you would like to get into the biz! > > > http://www.dresearch.com > e-mail : research(a)mediaone.net > I wonder how long this company would last if say James Kallstrom was 'tracked' using their 'trapcard'.... -- Eric Murray Chief Security Scientist N*Able Technologies www.nabletech.com (email: ericm at lne.com or nabletech.com) PGP keyid:E03F65E5

1 0