December 2003 - cypherpunks-legacy

Re: House National Security committee guts SAFE, worse than nobill
by Jonah Seiger 17 Dec '03

17 Dec '03

At 2:17 PM -0700 9/9/97, Declan McCullagh wrote: >This version of SAFE, in fact, is //much worse// for crypto freedom than >having no bill passed at all. True. <...> >It's time for advocates of crypto-freedom to turn obstructionist and >oppose all legislation dealing with encryption. And expect to accomplish what? To stick our heads in the sand now would just make it easier for the FBI to roll right over us. We still need to fight the expected FBI key recovey amendment when the Intelligence Committee and Commerce Committee vote this week, and then onto the floor (perhaps next year). Not to mention the Senate. This battle is FAR from over. It would be a serous mistake to give up now. Best, Jonah PS: Interestingly, Reuters is reporting that the Administraon has "serious problems" with the Dellums/Weldon Amendment: Clinton official not backing new encryption plan WASHINGTON, Sept 9 (Reuter) - The Clinton administration has serious problems with a new congressional proposal to tighten export limits on computer encoding technology even though it prefers the approach to one contained in earlier legislation, a top official said on Tuesday. Under Secretary of Commerce William Reinsch told Reuters that an amendment approved by the House National Security Committee earlier on Tuesday would give the secretary of defense veto power over encryption export decisions. "Giving the secretary of defense a veto is inconsistent with the president's executive order and inconsistent with the policies of four prior administrations," Reinsch said. "The administration thinks all relevent agencies should have a seat at the table and none should have a veto." Under current policy, enacted by presidential order last year, encryption export requests are reviewed by the Departments of State, Defense, Energy, Commerce and Justice, along with the Arms Control and Disarmament Agency. The most powerful encryption products cannot be exported unless they contain a feature allowing the government to decode any messages covertly. The amendment, authored by Rep. Curt Weldon, Republican of Pennsylvania, and Rep. Ron Dellums, Democrat of California, would require the president to set "the maximum level of encryption strength that could be exported from the United States ... without harm to the national security of the United States." Products at or below the established level could be exported after a one-time review specified by the secretary of commerce with the concurrence of the secretary of defense. The proposal virtually gutted the bill to which it was attached. The original bill, written by Virginia Republican Rep. Bob Goodlatte, would greatly relax export controls. Reinsch said the administration supported the "harm to the national security" standard. "It gives the administration the authority it needs," he said. "We'd much rather have this than (the original)." Software companies, civil libertarians and Internet user groups all favor relaxing the current limits and expressed strong concerns about the Weldon amendment. The amendment appeared to outlaw differential treatment currently accorded to some encryption products used by financial institutions or subsidiaries of U.S. companies. Reinsch said that section of the amendment "could be more artfully drafted." He also criticized the proposal for not requiring companies to export products with features allowing for government access to coded messages, an approach known as key recovery. The current policy "links all of the parts together and uses export controls as a device to move towards key recovery," he said. "We believe export controls should include key recovery." --Aaron Pressman((202-898-8312)) Tuesday, 9 September 1997 18:02:46 RTRS [nN0972124] * Value Your Privacy? The Government Doesn't. Say 'No' to Key Escrow! * Adopt Your Legislator - http://www.crypto.com/adopt -- Jonah Seiger, Communications Director (v) +1.202.637.9800 Center for Democracy and Technology pager: +1.202.859.2151 <jseiger(a)cdt.org> http://www.cdt.org PGP Key via finger http://www.cdt.org/homes/jseiger/

11 18

Letter sent to SJ Mercury staff on CA SJR-29 ...
by Ernest Hua 17 Dec '03

17 Dec '03

Date: Tue, 9 Sep 1997 13:26:34 -0700 (PDT) From: Ernest Hua <hua(a)chromatic.com> To: business(a)sjmercury.com, computing(a)sjmercury.com, state(a)sjmercury.com Subject: Why no coverage of CA resolution on Encryption? Cc: hua(a)chromatic.com Why was there no coverage of CA State resolution SJR-29? I find it using the search facility at: http://www.sen.ca.gov/www/leginfo/SearchText.html And the result is at: http://www.sen.ca.gov/htbin/ca-billpage/SJR/29/gopher_root2:[bill.current.s… The on-line magazine has a full article by Will Rodger on this: http://www.zdnet.com/intweek/daily/970908b.html Apparently there was some attempt by the Clinton Administration to cover up their lobbying effort. I don't understand why the Administration would care about a California state RESOLUTION of all things. Why does the Clinton Administration want to prevent a state legislature from speaking its mind? And what's with this attempt to claim "copyright" on that fax? Please get some answers on this! The US Senate/House will be voting on important encryption legislation in the coming days. The people of this country deserves to have a open, informed, serious discussion of one of the most important privacy issues of the information age. We cannot afford to let a few intelligence and law enforcement agencies dictate policy TO us against our will. Ern

1 0

FW: Notification: Inbound Mail Failure
by Montgomery, Lynn 17 Dec '03

17 Dec '03

Please remove dpeterson(a)jonescyber.com from your mailing list. He is no longer at this company. -----Original Message----- From: Montgomery, Lynn Sent: Tuesday, September 09, 1997 2:46 PM To: Montgomery, Lynn Subject: Notification: Inbound Mail Failure The following recipients did not receive the attached mail. A NDR was not sent to the originator for the following recipients for one of the following reasons: * The Delivery Status Notification options did not request failure notification, or requested no notification. * The message was of precedence bulk. NDR reasons are listed with each recipient, along with the notification requested for that recipient, or the precedence. <dpeterson(a)jonescyber.com> dpeterson(a)jonescyber.com MSEXCH:IMS:JONES:CORPORATE:CEDAR 0 (000C05A6) Unknown Recipient Precedence: bulk The message that caused this notification was: To: cypherpunks(a)toad.com Subject: Letter sent to SJ Mercury staff on CA SJR-29 ... From: Ernest Hua <hua(a)chromatic.com> Date: Tue, 9 Sep 1997 14:30:38 -0600 Cc: hua(a)chromatic.com Date: Tue, 9 Sep 1997 13:26:34 -0700 (PDT) From: Ernest Hua <hua(a)chromatic.com> To: business(a)sjmercury.com, computing(a)sjmercury.com, state(a)sjmercury.com Subject: Why no coverage of CA resolution on Encryption? Cc: hua(a)chromatic.com Why was there no coverage of CA State resolution SJR-29? I find it using the search facility at: http://www.sen.ca.gov/www/leginfo/SearchText.html And the result is at: http://www.sen.ca.gov/htbin/ca-billpage/SJR/29/gopher_root2:[bill.curren t.sjr.from0000.sjr0029] The on-line magazine has a full article by Will Rodger on this: http://www.zdnet.com/intweek/daily/970908b.html Apparently there was some attempt by the Clinton Administration to cover up their lobbying effort. I don't understand why the Administration would care about a California state RESOLUTION of all things. Why does the Clinton Administration want to prevent a state legislature from speaking its mind? And what's with this attempt to claim "copyright" on that fax? Please get some answers on this! The US Senate/House will be voting on important encryption legislation in the coming days. The people of this country deserves to have a open, informed, serious discussion of one of the most important privacy issues of the information age. We cannot afford to let a few intelligence and law enforcement agencies dictate policy TO us against our will. Ern

1 0

RE: Letter sent to SJ Mercury staff on CA SJR-29 ...
by Chris DiBona 17 Dec '03

17 Dec '03

The reason is because... The sjmn is crap. Thier valley coverage is terrible, and when it isn't it's coming off ap or reuters. They commonly commit factual errors and thier business editor is a joke. My friends and I in the valley don't even call it by it's name, it's become known as the "Fry's ad" (for those not in the valley, frys is a large consumer and computer electronics shop. But on steriods. And they advertise like crazy all over the sjmn). Remember SJMN motto: If it's news, it ain't here. Chris -----Original Message----- From: Ernest Hua [SMTP:hua@chromatic.com] Sent: Tuesday, September 09, 1997 1:31 PM To: cypherpunks(a)toad.com Cc: hua(a)chromatic.com Subject: Letter sent to SJ Mercury staff on CA SJR-29 ... Date: Tue, 9 Sep 1997 13:26:34 -0700 (PDT) From: Ernest Hua <hua(a)chromatic.com> To: business(a)sjmercury.com, computing(a)sjmercury.com, state(a)sjmercury.com Subject: Why no coverage of CA resolution on Encryption? Cc: hua(a)chromatic.com Why was there no coverage of CA State resolution SJR-29? I find it using the search facility at: http://www.sen.ca.gov/www/leginfo/SearchText.html And the result is at: http://www.sen.ca.gov/htbin/ca-billpage/SJR/29/gopher_root2:[bill.cu rrent.sjr.from0000.sjr0029] The on-line magazine has a full article by Will Rodger on this: http://www.zdnet.com/intweek/daily/970908b.html Apparently there was some attempt by the Clinton Administration to cover up their lobbying effort. I don't understand why the Administration would care about a California state RESOLUTION of all things. Why does the Clinton Administration want to prevent a state legislature from speaking its mind? And what's with this attempt to claim "copyright" on that fax? Please get some answers on this! The US Senate/House will be voting on important encryption legislation in the coming days. The people of this country deserves to have a open, informed, serious discussion of one of the most important privacy issues of the information age. We cannot afford to let a few intelligence and law enforcement agencies dictate policy TO us against our will. Ern

1 0

Re: first virtual "security" (!!) (was Re: Security Flaw Is Discovered InSoftware Used in Shopping)
by NSB's Portable (via RadioMail) 17 Dec '03

17 Dec '03

At 4:32 AM 9/21/95 +0200, Laurent Demailly wrote: >You have excellent points in your detailed answer, thank you, but Thanks. I'm glad to be able to conduct this discussion at a cordial and intelligent level. >If FV was as used as SSL could be, what prevents, to use your terms, >someone to get MILLIONS of FV's identifiers and use each one only >once, etc ... (imo your figures about SSL and crypto softs risks are >over evaluated, so I over evaluate the 'risks' of yours using same >assumptions) I think you still don't get it, Laurent. If you intercept millions of credit cards, you immediately have something very valuable and untraceable. An FV-ID is much less useful than a credit card number, because it only works with email confirmation and only works on the net. And merely intercepting them doesn't get you anything -- you have to be able to answer the confirmation messages, which is much harder to do "en masse" than passively sniffing for things (and possibly then decrypting them). And a scheme that also replies to such messages is far more likely to leave traces by which the criminal is caught. In other words, when you look at the "millions of interceptions" case, the value of doing this is lower for FV, the difficulty of automating it in the large scale is higher, and the risk of detection is higher, as compared with a one-way scheme that transmits credit cards, whether encrypted or not. >There can't be more security by transferring data on the clear >compared to an encrypted one... except maybe that people using >encryption can often feel overconfident. Of course there can, if you're not talking about the same data, which we're not. It's much safer to transmit something without high intrinsic value in unencrypted form than to transmit something with high intrinsic value in encrypted form. That's why FV-ID's were designed the way they are -- low intrinsic value, easy to revoke & reissue, etc. By analogy, it is safer to send a weather report unencrypted than to send detailed instructions about nuclear weapons encrypted. >So, as someone pointed out, >it is not that much a problem about CC# which are available easily >anyway, but in fact, using encrypted communications is the only way to >ensure (some) *privacy*, in addition to being a security improvement. Also not true. A scheme like FV's gives a fairly high privacy level through the use of pseudonyms. Your FV-ID can be traced to you *only* by FV, and we won't hand out that informaton without a court order. >financial insecurity never was a problem as >long as it remains under a small %. This is an amazing statement, Laurent. It's sort of like saying that building a city in the middle of a flood plain isn't a problem as long as there isn't a flood. You can't dismiss even a low-probability disaster if the consequences of the disaster are extremely high. If the SSL bug had been discovered AFTER there were hundreds of millions of credit cards being transmitted via SSL, and if the person who discovered it had criminal intent, the entire global credit card infrastructure really would have been endangered. Personally, I'm always suspicious of any claims to have "fixed the last bug", so I don't see any reason to assume this isn't inevitable in the long run if a scheme like SSL is used. >Anyway, if you have happy customers, good for you... I'd suggest that >you'd use "Security through Clarity" as motto ;-) That's not a bad motto. I'd prefer to describe our system as focusing on practical, comprehensive security rather than chasing the myth of perfect cryptographic security. (For example, we've probably put more effort into making our server secure from breakins than just about any other site on the Internet.) We're not opposed to cryptography, by the way. There are some obvious places where the use of digital signatures could directly enhance our system, and we're pursuing them. It has also not escaped our notice that, even though we strongly believe that transmitting FV-ID's in the clear is safer than transmitting credit cards encrypted, it would be safer STILL to transmitthe FV-ID's encrypted -- sort of the best of both worlds. And you can count on our doing that when there is a good Internet infrastructure for doing so, which we don't yet believe to be the case. -- Nathaniel

1 0

Re: Please send me SSL problems...
by Rich Salz 17 Dec '03

17 Dec '03

>None of these organisations have mentioned GSSAPI to me. >Do you have a source? Digital: ask John Wray. IBM: find someone in the DSOM group HP: no name I can give.

1 0

Re: Cdn-Firearms Digest V1 #982
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Forwarded from the Canadian Firearms Digest V1 #982 -------------------------------------------------------------------- Date: Tue, 9 Sep 1997 11:31:58 -0600 From: "David A. Tomlinson" <nfadat(a)telusplanet.net> Subject: Provincial-Federal Court Battle Over Gun Law The first day of court: An application from Clayton Ruby (the Coalition For Gun Control Lawyer [CFGC]) to have a paper by one Professor Killias admitted waas denied. The CFGC had submitted it, then fiddled around to prevent cross-examination of Prof. Killias. An earlier judge had then ruled the paper inadmissible because there was no opportunity for cross-examination. The Court ruled 3 to 2 to exclude the paper. Rod McLennan, acting for Alberta, then put Alberta's case. It quickly became evident that Chief Justice of Alberta Catherine Fraser had carefully studied the federal government's case. She mousetrapped McLennan into a swamp by asking him why registration of handguns was legitimate, and registration of rifles and shotguns was not. Instead of pointing out that the matter of registration of handguns was not before the court, that the question of the legitimacy of registration of handguns was an issue that might appear someday before some other court, that only the opinion of the judge in such a case could settle the legitimacy or otherwise of handgun registration, and that he could only give his personal opinion on the matter, McLennan tried to answer her. He assumed that handguns are intrinsically evil, that registration of handguns is legal and proper and constitutional. Those were dubious assumptions, and only his personal opinions. He characterized handguns as having no legitimate purpose, as being used primarily by criminals, and as legitimate targets for regulation within the criminal law. The judge then demanded to know why the arguments for registration of handguns should not apply to rifles and shotguns. McLennan was reduced to arguing that the difference between a rifle/shotgun and a handgun was "one of degree." He had been mousetrapped into fighting from a bad position that he could have -- and should have -- refused to move into. McLennan then recouped his losses by reading into the record a prepared statement (NOT something uttered in the heat of debate) made by Alan Rock during his introduction of Bill C-68. In that statement, he made it very clear that C-68 is not aimed at criminals, is expected to have no effect on crime or criminals, but is designed to make our society more "orderly," and to control property. In short, he gave a convincing presentation to tell Parliament that C-68 is REGULATORY law, dealing with PROPERTY issues, and equating it with automobile registration laws. Why is that important? Law is divided into regulatory law and criminal law. Broadly speaking, Criminal law prohibits behavior that is evil and damaging to the rights of others. Violation of a criminal law is, almost always, punishable by a term of imprisonment. Criminal law and its severe punishments are reserved for the worst evils found in society. The consitution allocates the power to make criminal law to the federal Parliament. Broadly speaking, regulatory law is law that regulates society, prohibiting behavior that normally will not -- but MIGHT -- have evil or damaging effects on the rights of others. Regulatory law is usually NOT punishable by a term of imprisonment. Regulatory law and its gentler punishments are reserved for REGULATION of our society, with the intent to make life easier and more orderly, and to deal with property issues (e.g., should you be allowed to own pesticides, or store pesticides where rain can corrode the containers). The Constitution allocates the power to make regulatory law -- in fields that existed before Confederation (1867) -- to the provincial legislatures. (In fields that did not exist prior to 1867 (e.g., air transport) and fields that straddle provinces (e.g., marine transport), the Constitution allocates the power to make regulatory law to the federal government. Firearms clearly existed before 1867, and their ownership, possession and use is local. Firearms are property.) Rock's equation of firearms registration with motor vehicle registration is useful. Motor vehicle registration is only required for motor vehicles that travel public roads, not for POSSESSION of motor vehicles. It is PROVINCIAL REGULATORY law, not FEDERAL CRIMINAL law. Imprisonment is NOT a punishment that can be imposed for violation of a motor vehicle registration law. When Rock equated the two in his prepared statement, he largely made the provincial case. Registration of firearms may be imposed by government in a law, but it is fundamentally REGULATORY in nature, not CRIMINAL. One question that has not been raised yet -- and should be -- is the question of licensing within the CRIMINAL law. Bill C-68 criminalizes simple possession of any firearm. If a person has possession of any firearm, that is a crime, and his or her behavior is criminal behavior -- according to Bill C-68. In Bill C-68, the federal government then offers to SELL the person a license to commit that crime. If that concept is worthy of inclusion in the criminal law, one wonders how far such a precedent may take us. Will our government someday be selling licenses to burgle? To murder? Obviously, those two suggestions are laughable -- today. We must, however, recognize how much laws change over a term of years. It was not that long ago that we prosecuted Mafia hirelings for their activities in selling gambling tickets that gave people chances to win money through the "numbers racket." Today, the "numbers racket" has been taken away from the Mafia. We buy our tickets legally -- from the federal government -- and the renamed "numbers racket" is called Lotto 6/49. Oddly enough, the Mafia used to give us better odds than the federal government does today. When one looks at licensing the commission of crimes, the problems become clear. If the criminal law is reserved for dealing with crimes and criminal behavior -- the sort of evils that have major damaging effects on the rights of others -- then how can such bad behavior be legitimized by selling a license to commit the crime to any applicant? Either the behavior is not that evil -- in fact, is perfectly acceptable in our society -- or the selling of the license to engage in the behavior is wrong. True, the C-68 system contains ways to deny the license; but it is unequivocal that the license is available, that the behavior is NOT intrinsically evil, and that the government expects huge numbers of Canadians to buy the license. The "evil" behavior is acceptable -- yet it is a crime. There is something wrong here. There is something very disturbing about the selling of licenses to commit crimes. One cannot help but feel that either the behavior is not truly criminal behavior, or, alternatively, the law is actually REGULATORY law that should NOT be embedded in the criminal law. And what happens when the applicant cannot afford to buy the license? Some of the licenses offered in Bill C-68 will cost over $1000. Is it fair or reasonable that a person should be criminalized by poverty -- or alternatively, denied the right to participate in a business, sport or recreational activity by government avarice? The more one looks at the regulatory nature of Bill C-68 -- as was so ably described by then Minister of Justice Rock -- the more one is disturbed to find it embedded within the criminal law, laced about with penalties of multiple years of imprisonment, and defective in its principles. For example, Bill C-68 makes it a criminal offence to be in possession of any firearm. Then it offers to sell a license commit that crime, to engage in that criminal activity. A Canadian buys the license, and engages in the behavior. Five years later, the license expires. If the person does not notice that his license has expired, the expiry criminalizes the individual without his knowledge. The penalty is multiple years of imprisonment. There have already been laws on the books that were struck down for that defect. The principles of our laws make it impossible to have a law that imposes imprisonment for an offence where the accused did nothing wrong, but merely did not notice that an expiring document was about to criminalize him or her. One hopes that those aspects of Bill C-68 will be brought out in future days of the Alberta Court of Appeal hearing. Dave Tomllinson, NFA -- Jean-Francois Avon, Pierrefonds(Montreal) QC Canada DePompadour, Societe d'Importation Ltee Finest of Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing. PGP encryption keys at: http://w3.citenet.net/users/jf_avon http://bs.mit.edu:8001/pks-toplev.html ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C

1 0

Re: Patents and trade secrets was: Encryption algorithms used in PrivaSoft
by Pat Farrell 17 Dec '03

17 Dec '03

thad(a)hammerhead.com (Thaddeus J. Beier) writes: > At this point, in this country, a patent is secret until it is issued. This will change in the US fairly soon. It is fallout of one of the world-wide trade and tarriff treaties -- we have to make our patent process be more in line with the rest of the world. One of the big technical challenges that the PTO and PRC have is how to release in-process patents securly. (PRC is the systems integrator for the PTO's APS (advanced Patent System) that had all the text and images of all patents since 1970 online.) They have even talked about putting patents on the WWW, but actually doing it is quite a way off in the future. Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

Re: USA Today on Fear of Credit Cards over Net
by Randy Catoe 17 Dec '03

17 Dec '03

At 07:35 PM 9/20/95 -0400, Perry E. Metzger wrote: > >Re: The risk of credit cards. > >I suppose that indeed there are large risks elsewhere in the credit >card system. However, I think that the credit card system itself is >stupid and insecure and ought to be scrapped -- sending around account >numbers as magic keys to get payment is a stupid move. Its not >suprising how large credit card fraud is. > >One of the great hopes I have for cryptographic technology is its >ability to lower the incidence of fraud, and thus lower transaction >costs a lot. Someday, hopefully, everyone will be able to be a credit >card merchant because you won't have to trust the merchants not to >steal. > >Perry > > I'm told that the revenue lost to fraud in the credit card industry is around .15 percent of the gross purchase value. I'm also told that the credit card companies actually face higher costs from disputes, i.e. when you call them up and busy out a person to resolve a question on you bill. Randy

2 1

Re: Net Papa: Global Internet Taxes Inevitable
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

> --------------------------------------------------------------------- > This mail is brought to you by the e$pam mailing list > --------------------------------------------------------------------- > (09/09/97; 12:00 p.m. EDT) > By Douglas Hayward, TechWire > > Cerf co-developed the > TCP/IP[LINK] protocol on which all Web and Net transaction depend. Net-Papa bullshit! > ..."If something is becoming an infrastructure that is important for > people's daily lives, then governments will have the right to be > concerned about the public's safety and well-being," Cerf said. Absolute Bullshit! Bit tax comes down to taxing thinking! This guy might have been a (past tense) a smart programmer but he'd better shut up about the rest... jfa -- Jean-Francois Avon, Pierrefonds(Montreal) QC Canada DePompadour, Societe d'Importation Ltee Finest of Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing. PGP encryption keys at: http://w3.citenet.net/users/jf_avon http://bs.mit.edu:8001/pks-toplev.html ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C

1 0