December 2003 - cypherpunks-legacy

Re: Crippled Notes export encryption
by olbon＠dynetics.com 17 Dec '03

17 Dec '03

At 10:49 PM 1/24/96, Lucky Green wrote: >At 19:34 1/24/96, Derek Atkins wrote: >>If I have a function that does something like this: >> >>authenticate (args) >>{ >> ... >> >> des_encrypt (); >> ... >>} >> >>I would have to remove the des_encrypt() call from the authenticate() >>routine before it can be exported... > >What if you replaced it by rot_13 () ? Surely, they can't ban that. And >someone later could just swap all rot_13 () for des_encrypt () > > >-- Lucky Green <mailto:shamrock@netcom.com> > PGP encrypted mail preferred. Better idea: replace des_encrypt() with fuck_the_itar(). Seriously, this just illustrates the idiocy of banning "hooks" in software. How does one define a "hook"? Just providing source code could be defined as providing a hook, since a good programmer could then modify it to do crypto. Also, how about the various kits and tools used to integrate pgp with pine, eudora, etc -- are these not "hooks"? Clay --------------------------------------------------------------------------- Clay Olbon II | olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: finger olbon(a)mgr.dynetics.com Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 "To escape the evil curse, you must quote a bible verse; thou shalt not ... Doooh" - Homer (Simpson, not the other one) ---------------------------------------------------------------------------

1 0

Bernie S. Sentencing
by dan＠milliways.org 17 Dec '03

17 Dec '03

I believe that Ed was the first person to be sentenced under PA's new anti-toll fraud law which makes it illegal to build, distribute, or distribute plans for, or use "toll-fraud" devices which include EEPROM burners, cellular diagnostic equipment, etc. The Man couldn't put him away for any length of time for that, so they're trying another angle. ObCrypto: When they pass laws against "info-laundering"/"electronic identity hiding" tools, it'll probably go something like this. =========BEGIN FORWARDED MESSAGE========= Date: Mon, 22 Jan 1996 06:48:44 -0500 (EST) From: Emmanuel Goldstein <emmanuel(a)2600.COM> Subject: Bernie S. Sentencing Friday I just found out that Bernie S. will be sentenced this Friday morning at 9 am in Easton, PA for the crime of removing batteries from a tone dialer several years ago. This is defined as a victimless misdemeanor for which the judge in this small town (under considerable influence from the Secret Service) set bail at $250,000. He could get two years in prison at sentencing. Press attention could be very helpful in avoiding a sentence as irrational as the bail setting - right now the only influence these people are getting is from the Secret Service and they want to put Bernie S away for as long as they can. If you're not entirely up to date on this story, finger bernies(a)2600.com for all of the details. If you know of anyone who will cover this story, please get ahold of them right away so they can plan on being there. If anyone is interested in going, let me know so we can hopefully fill some cars from NYC. Sentencing is scheduled for Friday, January 26 at 9 am Courtroom 5 Northampton County Government Center 7th and Washington Street Easton, PA 18042-7492 (610) 559-3020 (district attorney) case # 2173-1993 The Commonwealth of Pennsylvania vs. Edward E. Cummings Misdemeanor 2 - tampering with physical evidence Please help spread the word. emmanuel(a)2600.com =========END FORWARDED MESSAGE=========

7 7

Re: Crippled Notes export encryption
by Rich Salz 17 Dec '03

17 Dec '03

> Seriously, this just illustrates the idiocy of banning "hooks" in software. Yes. That's why an API that supported generic data transforms and that included compression and for non-export encryption would be a useful thing. I have a start toward such an API definition that I will email to anyone who might wanna finish it off. I started doing it around the time that Raph talked about his per-user crypto server. > How does one define a "hook"? Just providing source code could be defined > as providing a hook, since a good programmer could then modify it to do > crypto. Also, how about the various kits and tools used to integrate pgp > with pine, eudora, etc -- are these not "hooks"? They define a hook. They define it on a case-by-case basis. "They" is the Office of Defence Trade Controls, in conjunction with their consulting experts primarily people in the department of Export Control at the NSA. Luckily the ITAR talks about willful violations. /r$

1 0

Secrecy of NSA Affiliation
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:55 PM 1/25/96, Rich Salz wrote: >Up until recently (18-30 months ago) NSA employees were only allowed >to identify themselves as employees of DoD. It was common knowledge, >that unspecific references to Fort Meade meant NSA; and if you saw >a P.O. from Procurement Office, Fort Meade, it meant the NSA was buying >it. When I attended Crypto '88, nearly 8 years ago, at least several of the NSA attendees had "National Security Agency" on their name badges. It may be that run-of-the-mill employees still maintain the fiction for public consumption that they are DOD employees, but such was not the case in 1988 at "Crypto." (Recall the "NSA Employees Manual" which 2600 liberated, and which Grady Ward then redistributed. It had some tips, as I recall, on what employees should tell the curious.) When I visited the D.C. area in early '91 or '92 (I forget which year it was), I stopped by Fort Meade to see the place. The sign out front prominently said "National Security Agency," complete with the NSA seal (an eagle lifting a hacker up in its talons). Also, much other evidence points to the NSA having "gone public" much farther back in time than 18-30 months ago. Former DIRNSAs on the MacNeil-Lehrer Newshour were always introduced as former directors of the NSA. As early as the mid-80s, as I recollect. I think Bamford's book pretty much outed the name, though it was widely known before that, of course. (I attended my freshman year of high school in Langley, VA. Through the woods on one side of the school was CIA headquarters. At that time, 1967, it was still only labelled as something like "Department of Transportation Road Testing Facility." Everyone knew what it really was, of course. Rick Smith, on this list, was a classmate of mine and can attest to this. The CIA "went public" in the early 70s, the NSA in the early 80s, the NRO in the early 90s...I sense a pattern. This means the ultra-secret ERO (Extraterrestrial Research Organization) will be outed in the opening years of the next decade.) --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4

TOP_tap
by John Young 17 Dec '03

17 Dec '03

1-25-96. TWPsst: "Military Men Named to Top Intelligence Posts." AF Gen. Kenneth Minihan to run all US eavesdropping on foreign governments and citizens at NSA, which is responsible for providing US officials with a steady stream of intercepted electronic data on foreign weapons and conversations involving foreign politicians. The NSA's eavesdropping costs an estimated $3.5 billion a year, a large portion of which supports its computer operations at Fort Meade and its world-class experts in mathematics. TOP_tap

2 1

Re: V-chip?
by williams＠va.arca.com 17 Dec '03

17 Dec '03

Tim May writes: > Anyone telling me I have to rate my work, or submit it to a ratings agency, > is aggressing against me. Now, if others rate my work (which is already > happening with digest services such as "CP-Lite"), this is their business, > not mine. But the V-Chip precedent is a precedent for the government to > insist that all sorts of content be rated. This should be fought in a free > society. But what if they *ask* you nicely to label your work? "If you think your message is offensive, violent, or racist, would you please consider labelling it?" I don't think I'd mind. In fact, *optional* labels would make me more likely to post such material, because I'd have some confidence that it would only be read by people who want to read it. (And they could even find it more quickly!) There's nothing inherently wrong with labelling information. When messages here are labelled [NOISE], I know to avoid them. This sort of meta-information is helpful and good. The precedent is what's troubling. Someone will probably try to mandate the labels...Someone will try to write a law that says "Anyone who posts what I consider offensive without a label is guilty." This is what should be fought...not labels. --Jeff

4 3

Re: Crypto Exports, Europe, and Conspiracy Theories
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:58 PM 1/25/96 -0500, Michael Froomkin wrote: >It's called "strict liability" -- you are liable when you didn't know. >The economic justification is that you were in the best position to avoid >the harm (either by doing some checking, or, in this case (they, not I, >would say) not offering the service at all. Vague memories of Law School... Doesn't strict liability apply to "inherently dangerous activities." Like using explosives to demolish buildings or something. Is carrying message traffic an inherently dangerous activity? Any strict liability situations today not involving inherently dangerous activity? I suppose having disposed of waste in a "Superfund Site" leads to automatic liability but does not necessarily involve an inherently dangerous activity. Is this a "strict liability" situation? I'm trying to think of other sorts of examples. DCF "If we're so poor these days, why do we have more of everything?"

1 0

Re: Crippled Notes export encryption
by andr0id＠midwest.net 17 Dec '03

17 Dec '03

> >Item (1) allows people to travel abroad if they know crypto. It's unclear >that it allows them to emigrate or return to their country of origin. >Items (3),(4),(5) seem to prevent such a person from using, or even mentioning, >crypto to or "on behalf of" a foreign person. > Okay, question.. Is "crypto" and "defense" the same thing?

1 0

RE: Microsoft's CryptoAPI - thoughts?
by geeman＠best.com 17 Dec '03

17 Dec '03

>What does everyone think about this? Perhaps I already missed the boat, but >I just found out about it. How would international apps work? Would a data >file encrypted with an app compiled with a US-only CSP (cryptographic >service provider) be able to be loaded by a European equivalent app? > >[Info can be found at: http://www.microsoft.com/intdev/inttech/cryptapi.htm] > > >-- >rickt(a)psa.pencom.com >egalitarian, philosopher, unix cowboy, '68 chevy pickup hacker > > To which I would like to generalize: what do you (all those with an opinion on the matter) think/feel/intuit about general crypto API's overall? How would you compare some of the simultaneous threads of development going on now in different orgs? Any strong positions out there?

1 0

The cost of breaking RC4 with a 40 bit key.
by norm＠netcom.com 17 Dec '03

17 Dec '03

I think that special hardware to break RC4 would require 256 bytes of registers and only a few hundred control gates. Lets say 5000 transistors per "module". You can put several hundred modules on a chip. Each module can easily do one step in 5 ns. I havn't figured out what the attack would be (known plain text etc.) and hardware to handle that might be more. In mass production the marginal cost of such a chip might be $100. Perhaps trying one key requires 100 steps. I get the cost per key trial as follows: (100 $/chip)(100 steps/trial)(5 (module*ns)/step)/ ((10^9 ns/sec)(10^8 sec/(economic lifetime))(200 modules / chip)) 10^(2+2+.7 - (9+8+2.3)) $/keytrial= 10^(-15+.4) $/keytrial = 2.5*10^(-15) $/keytrial I compute the cost of breaking a 40 bit key as 2.5*10^(-3) $ or one quarter of a cent.

1 0