December 2003 - cypherpunks-legacy

USACM APPLAUDS CALIFORNIA LEGISLATURE (fwd)
by Cypherpunks Maintenance Account 17 Dec '03

17 Dec '03

----- Forwarded message from ACM US Public Policy Office ----- >From cpunks Wed Sep 10 06:16:47 1997 Message-Id: <v03110704b03c203ab0f0(a)[204.91.138.81]> Date: Wed, 10 Sep 1997 06:02:32 -0400 To: list <usacm_dc(a)acm.org> From: ACM US Public Policy Office <usacm_dc(a)acm.org> Subject: USACM APPLAUDS CALIFORNIA LEGISLATURE Sender: owner-cypherpunks(a)toad.com Precedence: bulk PRESS RELEASE Association for Computing U.S. Public Policy Office September 8, 1997 USACM APPLAUDS CALIFORNIA LEGISLATURE FOR UNANIMOUSLY ENDORSING RELAXED EXPORT CONTROLS ON ENCRYPTION As the Congress prepares to address the issue of computer security and privacy, the California legislature has sent a clear message that relaxing controls on cryptography is a critical first step. On September 5, the California legislature passed a resolution that calls on the California members in Congress to support legislation that would make it easier for US companies to develop and market strong cryptography products. The resolution was sponsored by Representative Vasconcellos (D. San Jose) and passed without opposition. Dr. Barbara Simons, chair of the policy committee for the Association for Computing (USACM), said that the California resolution makes clear that industry and users are united in support of good cryptography. "We believe that Congress should support the Security and Freedom Act, sponsored by Representative Goodlatte. The legislation will help protect security and privacy on the internet. It will be a serious mistake for the administration to oppose the development of this technology," said Dr. Simons. On August 26, USACM Chair Barbara Simons spoke in support of the Vasconcellos resolution before a California Senate committee. Also participating at the Committee hearing were Dr. Whit Diffie from Sun, Kelly Blough from PGP, Jack Wilson of ACL Datacom, Chuck Marson representing the California Internet Industry Alliance (Netscape, Microsoft, AOL, CompuServe and Netcom), and a representative of the Software Publishers Association. Undersecretary of Commerce Reinsch wrote a letter opposing the resolution. The Association for Computing (ACM) is an international non-profit educational and scientific society with 76,000 members worldwide, 60,000 of whom reside in the U.S. USACM, the Association for Computing's U.S. Public Policy Office, serves as the focal point for ACM's interaction with U.S. government organizations, the computing community and the U.S. public in all matters of U.S. public policy related to information technology. The USACM web site is located at http://www.acm.org/usacm/ For more information, please contact USACM Chair Barbara Simons at 408/256-3661 or USACM Associate Director Lauren Gelman at 202/544-4859. /\ /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/ Association for Computing, + http://www.acm.org/usacm/ Office of U.S. Public Policy * +1 202 544 4859 (tel) 666 Pennsylvania Ave., SE Suite 302 B * +1 202 547 5482 (fax) Washington, DC 20003 USA + gelman(a)acm.org To subscribe to the ACM Washington Update, send e-mail to: listserv(a)acm.org with "subscribe WASHINGTON-UPDATE name" (no quotes) in the body of the message. ----- End of forwarded message from ACM US Public Policy Office -----

1 0

Re: Infoworld and Denning's study (fwd)
by Cypherpunks Maintenance Account 17 Dec '03

17 Dec '03

----- Forwarded message from Peter Gutmann ----- >From cpunks Tue Sep 9 00:08:29 1997 From: pgut001(a)cs.auckland.ac.nz (Peter Gutmann) To: cryptography(a)c2.net Subject: Re: Infoworld and Denning's study Reply-To: pgut001(a)cs.auckland.ac.nz X-Charge-To: pgut001 X-Authenticated: relaymail v0.9 on cs26.cs.auckland.ac.nz Date: Tue, 9 Sep 1997 15:58:02 (NZST) Message-ID: <87377748221122(a)cs26.cs.auckland.ac.nz> Sender: owner-cypherpunks(a)toad.com Precedence: bulk >Infoworld NZ has just published an awful article (written by US reporter Sari >Kalin and titled "Criminals Eyeing Encryption"), which emphasises repeatedly >that encryption is a major problem just waiting to happen, using Dorothy >Dennings report as a basis. This represents a rather ugly way to interpret >the report (and, presumably, an attempt by the USG to recover something from >a report which was supposed to come down firmly in favour of crypto >restrictions but didn't). Due to the late hour I got that wrong, it's Computerworld NZ, not Infoworld (slight difference in naming). Even later last night I wrote a letter to the editor which, I gather, will appear in the next issue. I've included it below in case anyone finds it useful, it's written for a general audience who probably aren't aware of the deeper issues apart from the fact that the USG has a peculiar attitude towards crypto, due to length constraints I couldn't go into too much detail. If you feel the need to circulate this, please don't do so until after next Monday when it's officially published. Peter. -- Snip -- The article "Crims eyeing encryption" in the September 9 Computerworld presents an extremely peculiar view of the study "Encryption and Evolving Technologies in Organised Crime and Terrorism". The final conclusion of the study was that there is no real "encryption problem" which justifies placing limitations on the use of encryption, and yet the article, by more or less ignoring the conclusion and concentrating instead on a number of scaremongering quotes, manages to create exactly the opposite impression. To understand what's involved here, it might be useful to know a bit about the background of the study. For a number of years the US government has held that it needs to strongly restrict peoples access to encryption. They can't actually provide you with any supporting facts for this because they're all classified, but if they were allowed to tell you, they're certain you'd agree with them. Now over the years they came to the realisation that people weren't really buying this argument, and so they decided to create a study which would provide proof, once and for all, that they were right. The two people who worked on this study were Dorothy Denning, virtually the only supporter of the US governments policy apart from the US government itself, and a vice-president of SAIC, a large defence contractor. They toiled away for quite some time, and finally announced their results a month or two back. Unfortunately the findings put them in a rather awkward position: Although the study was supposed to provide proof that there was some sort of "encryption problem" which needed to be countered, it instead showed that there wasn't really a problem at all. Sure, it showed that criminals occasionally use encryption, just like criminals also drive cars, eat pizza, drink Coke, and (quite probably) read Computerworld. The important point - which was almost completely ignored in the article in favour of running scaremongering quotes from a variety of US government officials - was that the "encryption problem", the whole reason for the governments' claimed need to restrict encryption, by and large didn't exist. It got even worse for the government though. So convincing was the evidence in the study that Denning - for years a very outspoken supporter of their policies - did an about-face and declared that she was no longer prepared to back government plans for restricting encryption until someone proved to her that there was a very good reason for it (this was reported in a number of US papers and publications which cover computer issues, so it was reasonably well known, eg "Denning unable to confirm FBI Assertions; alters her position" in the Mercury News, the largest silicon valley paper). Although the governments star technical witness was unable to find any evidence that their position was valid, the Computerworld article, by resorting to selective quoting and innuendo, paints a very different, and quite inaccurate, picture. (As a side-note, I find it amusing to read that the government policy relies on people handing over their encryption keys to them. Quite apart from the question of why anyone would trust the US government with their keys, there's also the small problem that no criminal will ever do this - that's why they're criminals after all. The only ones who'll ever get caught by this cunning plan are you and I). -- Snip -- (I'm assuming most readers will get the Baldrick/Blackadder reference in the last sentence :-). ----- End of forwarded message from Peter Gutmann -----

1 0

Re: [LONG} Funding Cypherpunks Projects
by Sean Roach 17 Dec '03

17 Dec '03

At 01:54 PM 9/7/97 -0400, Robert Hettinga wrote: >At 3:35 pm -0400 on 9/3/97, Tim May wrote: ... >Certainly a bass-ackward way to do it. Unfortunately, that's the way Disney >did it, or L.B. Mayer did it, or Gates, or Edison, or Parekh did it. They >had a picture in their head of the way the world worked, or should work, >they did things, as cheaply as possible, which should work in that picture, >and they were right. They still invested something, is my point, whether it >was their money or their time, or their inspiration. ... Gates? The closest he had to a grand vision is being able to predict the financial gain behind programming computers. That in my opinion was marketing savvy, not a grand vision, for lack of a readily available substitute. You know about traf-o-data. This was a far cry from what he now has. He rode the wave by changing with the times, hedging his bets, being in the right place at the right time, etc. That, however is about all I know as the book he wrote was a little too basic alone the lines of my interests for my tastes and I had to put it down for more enjoyable activities like staring at the wall. When I can next stomache reading more kindergarten level computer analogies, I'll finish reading his book. ... >> Asking Jim Clarke or Bill Gates to opine on his strategies for success is >> not quite as pointless, but is not real useful either. Ask also Manny >> Fernandez about Gavilan Computer. Or ask the financiers of Ovation, >> Processor Technology, Mad Computers, Symbolics, Thinking Machines, Trilogy, >> or a hundred other examples of companies that burned through a billion >> dollars of hard-earned investor money. ... Interesting note. I heard that the guy that started Thinking Machines is now an imagineer at one of the evil empires. Who would have thought that one of the guys responsible for parallel computing development would now be building theme park rides. BTW. I love this little game of artistic response. It actually reads like a conversation and makes it a whole lot easier to take the origional post out of context. Remind me to use line numbers when I respond to one of your posts with a long message. Or at least number the paragraphs. Not that it would matter.

3 3

RE: Nuclear Hedge Funds / Social Engineering in History / Wiretap DiFi
by rab＠stallion.oz.au 17 Dec '03

17 Dec '03

Declan McCullagh wrote: > On Mon, 8 Sep 1997, Bill Stewart wrote: > > However, we need to get off this "Nuke Washington!" kick, > > and on to something more realistic like "Wiretap DiFi!" > > I'd like to ask that if anyone is planning to Nuke Washington, they > politely let me know so I can go on an extended business trip to the > Montana mountains. I mean, it's just common courtesy! Look on the bright side: You will probably never know what hit you :-)

6 6

Mondex Broken
by John Young 17 Dec '03

17 Dec '03

We've received from anonymous a report on breaking Mondex's pilot system by TNO along with a confidential 1996 memo describing the break: TNO's Ernst Bovenlander gave some details of these attacks (though he didn't mention Mondex as the target). He showed an electron micrograph of a fuzed link in a smartcard; while intact, this link activated a test mode in which the card contents were simply dumped to the serial port. The TNO attack was to bridge the link with two microprobes. At the last RSA conference, Tom Rowley of National Semiconductor reported a similar attack on an unnamed chip using an ion beam to rewrite the link . Included is a letter from the Bank of New Zealand to Electronic Frontier Canada attempting to suppress publication of the memo. http://jya.com/mondex-hack.htm

6 5

Re: Removing Tyranny from Democracy (Part II), (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: amp(a)pobox.com > Date: Tue, 09 Sep 1997 22:49:25 -0500 > Subject: Re: Removing Tyranny from Democracy (Part II), (fwd) > > From: Jim Choate <ravage(a)ssz.com> > > > >Please be so kind as to detail your top three flaws... > > 1. In a democracy, 51% of the people can vote to enslave the other 49% Not in this democracy they don't. In every democracy currently extant there is a bill of rights. The government may not respect it, but that is a flaw of implimentation not theory. > 2. In a democracy, you can't have property rights because 51% can > capriciously decide to confiscate anyone's property. See above. > 3. A pure democracy is true mob rule - a mob has no concience, or bounds to > it's tyranny. Look into the history of ancient Athens. Since there are no true democracies extant your point is moot. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

3 2

Re: The Next Hack
by alt＠iquest.net 17 Dec '03

17 Dec '03

At 05:01 AM 9/22/95 -0400, Futplex wrote: >sameer writes: >> 2) Organize a net-wide search over the space of the RNG seed to >> crack the private key of some well known secure server. >> >> 3) Release the private key to the net. > >FWIW, for the record, I'm uncomfortable with this. It sounds unethical, IMHO. > >For me at least, targeting the key of some particular server that happens to >be out there is over the line. > >If you said you would have someone volunteer a supposedly secure server for >the challenge, I'd have no qualms. I might disagree with the part about releasing it to the net, but I don't disagree with targeting a server which is claimed to be "secure." Why? Nobody would have been too upset or surprised if someone had built the Titanic for the sole purpose of trying to sink it. It only made waves (pun alert) because it was claimed to be "unsinkable" (secure), but sank anyway. Maybe a good tactic would be to crack a "secure" server, and send the results ONLY to the server operators, along with a description of machine-time involved. Put out a public press release, describing the machine-time involved, how it was possible due to weak crypto imposed by the government, and the possible economic and commercial implications of said weak crypto.

1 0

Netscape for Linux
by Jeff Simmons 17 Dec '03

17 Dec '03

Found this on Comp.os.linux.misc - hope it's true: Tobias Engel <s120808(a)fb1.fhtw-berlin.de> writes: >I looked at the Data Sheet-Page for the Netscape Navigator 2.0 today (http://home.netscape.com/comprod/products/navigator/version_2.0/datasheet.h…) >There is a "Supported Platforms"-List at the end of the Page. For Unix it >says: >--- >Digital Equipment Corp. Alpha (OSF/1 2.0) >Hewlett-Packard 700-series (HP-UX 9.03) >IBM RS/6000 AIX 3.2 >Silicon Graphics (IRIX 5.2) >Sun SPARC (Solaris 2.4, SunOS 4.1.3) >386/486/Pentium (BSDI) >--- >So, where is Linux??? In comp.infosystems.www.browsers.x Jamie Zawinski <jwz(a)netscape.com> said that there *will* be a 2.0 version for Linux. He also explained why Linux isn't listed and why Netscape will tell you that there will not be a supported version of Netscape for Linux. This is a copy of that article, which is worth reposting here, I think, because of the large threads about this subjects: From: Jamie Zawinski <jwz(a)netscape.com> Newsgroups: comp.infosystems.www.browsers.x Subject: Re: Netscape 2.0 for Linux Organization: Netscape Communications Date: Wed, 20 Sep 1995 16:11:19 -0700 Marco Trincardi wrote: > > There will be a Linux version of the new upcoming Netscape 2.0 ??? > At Netscape HomePage i didnt find usefull info. And I replied: > > Yes, once 2.0 is released (please don't ask me when) it will be > available for all platforms on which 1.1 is available. Since then, it would seem that some folks have called our customer support lines and gotten a seemingly different answer, so allow me to clarify: When someone in customer support tells you "we will not be supporting Linux in Netscape 2.0," they're right: but that's because we didn't support it in 1.0 or 1.1 either. "Support" means we sell the software, and you can buy a support contract. This is not, and has never been the case for Linux. You have never been able to get a *supported* version of Netscape Navigator for Linux. We have no Linux *product*; our sales and support folks don't deal with it in any way, and never have. However, there has been an unsupported educational/evaluation version available for that platform, and this will also be the case for 2.0. -- Jamie Zawinski jwz(a)netscape.com http://www.netscape.com/people/jwz/ -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204 -- Jeff Simmons jsimmons(a)goblin.punk.net

1 0

Re: The Next Hack
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199509211832.LAA24086(a)infinity.c2.org>, sameer(a)c2.org (sameer) wrote: >Proposal for action: > >1) Reverse-engineer a server to see if the keygen phase uses >a weak RNG seed. -- if so, determine the exact algorithim. > >2) Organize a net-wide search over the space of the RNG seed to >crack the private key of some well known secure server. > >3) Release the private key to the net. Count me in. Let's start with Netscape's own. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMGMSJSoZzwIn1bdtAQFqiwF+IZKDv1t5Q2va2yE2JZMCHGITkxoDHHML alvjYK+XyxPNaVGgRgMk5gTsZMcHqBvz =meVk -----END PGP SIGNATURE-----

1 0

RE: RE: House National Security committee guts SAFE, worse than no bill
by jay holovacs 17 Dec '03

17 Dec '03

Here I am Jay -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzCmKpkAAAEEANq8z8b2fiVI8rB3n3iJVyqDSGu7KdYy0hE95DDAbkh017ew oTEASfiZmP7mPXy9y7HWi9oYYIY1eGSH9Xe/oGLOfjoETKGES6YqObRJ5B5LmK+y Xxsv89NCw/K7s/OSm+CscewZqXt0cHnHFx7/9heGEqDNii3xgdXsLniA5KoFAAUR tB9KYXkgSG9sb3ZhY3MgPGhvbG92YWNzQGlvcy5jb20+ =c5gz -----END PGP PUBLIC KEY BLOCK----- ========================== >From: Hiawatha Bray <wathab(a)tiac.net> >Subject: RE: House National Security committee guts SAFE, worse than no bill >Date: Wed, Sep 10, 1997 4:40 PM > >I hate to tip folks off as to my column for tomorrow, but that's exactly >what I'm doing in it. I have written that if the Feds try to impose >key-recovery crypto on me, I'll start using some encryption program that >doesn't comply with the law, and I'll send copies of the messages to the >Feds, so they can come and arrest me. If I really thought they would, I >wouldn't have written it! But I'll stand by it. > >Anyway, I don't presently encrypt my mail. No reason to--I ain't no >pedophile...;-) >So if I want to send crypto I must find some partner in crime. Any >volunteers? > >Hiawatha Bray >Technology Reporter >Boston Globe >P.O. Box 2378 >135 Morrissey Blvd. >Boston, MA 02107-2378 USA >617-929-3115 voice >617-929-3183 fax >http://members.tripod.com/~krothering/index.html > > >On Wednesday, September 10, 1997 10:04 AM, Syniker(a)aol.com

1 0