December 2003 - cypherpunks-legacy

Council of Europe proposes to outlaw strong encryption (fwd)
by wb8foz＠netcom.com 17 Dec '03

17 Dec '03

********************************************************** > SUBJECT: Euroclipper > Apologies if this is old news to you folks, but thought I should > pass it on. Date: Thu, 21 Sep 1995 00:42:39 -0400 Subject: IP: Council of Europe proposes to outlaw strong encryption According to an article in `Communications Week International', the 34-nation Council of Europe has agreed to outlaw strong encryption products which do not make keys available to governments. The article, `Euro-Clipper chip scheme proposed', is on the front page of the magazine's issue 151, dated 18th September, which arrived in my mail this morning. It relates that the policy was approved on the 8th September at Strasbourg by the Council, and coincides with an attempt by the European Commission to propose a pan-European encryption standard. The Council - unlike the Commission - has no statutory powers to enforce its recommendations. However, Peter Csonka, the chairman of the committee that drafted the document (and an administrative officer at the Council's division of crime problems) says that `it is rare for countries to reject Council of Europe recommendations'. The proposal would make telecomms operators responsible for decrypting traffic and supplying it to governments when asked. It would also `change national laws to enable judicial authorities to chase hackers across borders'. Opposition to this measure was expressed by Mike Strezbek, VP responsible for European telecomms at JP Morgan, who said that his organisation `will challenge any attempt to limit the power of our network encryption technologies very strongly'. Czonka said that the Council had given consideration to business interests but had tries to strike a balance between privacy and justice. However, `it remains possible that cryptography is available to the public which cannot be deciphered,' his document says. `This might lead to the conclusion to put restrictions on the possession, distribution, or use of cryptography.' Apparently another international organisation, the OECD, has called a conference of its members in December to devise a strategy on encryption. I for one will be making clear to my MP that his stand on this issue will determine how I cast my ballot at the next election. I note that John Major stated in a 1994 parliamentary written reply to David Shaw MP that the government did not intend to legislate on data encryption. I am disppointed that government policy has changed to the point of supporting the Council of Europe, and that this change has sneaked through during the parliamentary recess. Ross Anderson ------- End of Forwarded Message -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close...........(v)301 56 LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead........vr vr vr vr.................20915-1433

1 0

Re: Removing Tyranny from Democracy (Part II), (fwd)
by Steve Schear 17 Dec '03

17 Dec '03

>Forwarded message: > >> From: amp(a)pobox.com >> Date: Tue, 09 Sep 1997 09:26:21 -0500 >> Subject: Re: Removing Tyranny from Democracy (Part II), >> was Democracy is the true enemy... >> >> > I don't believe there are intrinsic flaws in democracy, so much as >> > there are intrinsic flaws in *human*nature* that are coming to light >> > after decades. government is a reflection of our human natures. >> > one cannot really expect a government to correct the flaws of its >> > users, any more than software could do the same. >> >> No intrinsic flaws in democracy? >> >> Surely you jest. > >Please be so kind as to detail your top three flaws... I think my Parts II and III detailed a number of shortcomings of democracy, at least when the franchise goes to 'employees' as opposed to 'customers' of government. --Steve

1 0

Re: FROM A FRIEND . . . (or the joys of boating)
by s675570＠aix2.uottawa.ca 17 Dec '03

17 Dec '03

On Thu, 21 Sep 1995, Landon Dyer wrote: > naturally, commuting to canada is probably a *lot* cheaper than > owning a boat. the uninitiated have little idea what these holes- > in-the-water really cost.... :-) *Loud* chuckles. Who says you have to *own* the boat? (haha) A suitably paid Canadian boat-captain could easily testify that you arrived every day to the boat with your trusty laptop, to develop your software within Canada. The disk with your saved code on it never left the boat. When you finished your development, you used a borrowed satellite phone to call up your ISP in Canada (we're talking physical Canada, not virtual, maritime, and bullshit Canada) to post your code and uuencoded executables to sci.cript, and alt.test. And since you used a satellite phone, for the modem transmission, no US phone lines were used (a cellphone wouldn't do). Of course you wouldn't actually have to do any of this. The gentleman just has to say it in court. The truth, the whole truth and nothing but.

1 0

Persistent Services Needed
by tcmay＠got.net 17 Dec '03

17 Dec '03

One of the problems we're facing with "Cypherpunks" services is that they are catch-as-catch-can, or, bluntly, "flaky." Archive sites stop being archives, remailers vanish overnight (*), and other experiments pop up and then vanish with regularity. (My favorite example, and one which always makes me smile, is the example of a remailer in Europe a couple of years ago which became inoperative with the message: "The foo remailer will stop operating tonight because I have to take my laptop with me for the summer to Portugal.") I'm not criticizing these folks. Rather, I'm just saying something pretty obvious, that _persistence_ is important. This probably means commercialization, or formalized business relationships. With such persistent business set-ups, "the show must go on." Another reason for digital money. --Tim May Notice: With 1000 people on the Cypherpunks list, and many on other lists I am on, nearly every article I write generates at least one question, request for more information, dispute with my choice of words, etc. I have been trying to respond to these, usually privately, but the burden has become too much, and I no longer plan to respond to trivial or ephemeral points. If you don't hear from me, this is why. Some requests for pointers to information will still be handled, but I advise people to learn how to use the archives and/or search tools. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Mondex Broken
by John Young 17 Dec '03

17 Dec '03

We've received from anonymous a report on breaking Mondex's pilot system by TNO along with a confidential 1996 memo describing the break: TNO's Ernst Bovenlander gave some details of these attacks (though he didn't mention Mondex as the target). He showed an electron micrograph of a fuzed link in a smartcard; while intact, this link activated a test mode in which the card contents were simply dumped to the serial port. The TNO attack was to bridge the link with two microprobes. At the last RSA conference, Tom Rowley of National Semiconductor reported a similar attack on an unnamed chip using an ion beam to rewrite the link . Included is a letter from the Bank of New Zealand to Electronic Frontier Canada attempting to suppress publication of the memo. http://jya.com/mondex-hack.htm

6 5

Re: FROM A FRIEND . . . (the joys of boating)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:00 PM 9/21/95, Landon Dyer wrote: > here's a possible bullshit wrinkle. i'm not a lawyer, but one of my >bosses was, once. > > said boss owned a boat that was of canadian registry. he was a >canadian citizen with a green card. he *claimed* that, even when >docked in the SF bay area, his boat was technically considered >canadian territory, due to some maritime law malarky. US authorities >theoretically had to go through various hoops to legally board his >vessel. > > i wouldn't try to halt a SWAT team, or even the local fuzz, with >this tidbit of legal gaga. but doing crypto development on such a >vessel might hold up in court for something as squishy as ITAR. I'm skeptical of this, as boating friends of mine tell me they are much more easily boarded by the various water.cops who check for compliance with navigation laws, with drug laws, with Customs laws, etc. Within the 3-mile limits, or further out (?), broad discretion is given to the water.cops who tell you to "Prepare to be boarded." That a ship or boat is of Panamanian, Liberian, or even Candian registry does not seem to have any effect on enforcement of drug-smuggling, gun-running, waste-dumping, or reckless-manouvering laws. I've already expressed my views on the hype surrounding the "This T-Shirt Has Been Declared to be a Munition" hoopla, so I won't draw the obvious inference about whether someone wearing an RSA-in-Perl t-shirt while scrubbing their decks will be shot on sight. (Was Randy Weaver's wife wearing an illegal t-shirt? Hmmmhhh, many conspiracy angles here!) --Tim May Notice: With 1000 people on the Cypherpunks list, and many on other lists I am on, nearly every article I write generates at least one question, request for more information, dispute with my choice of words, etc. I have been trying to respond to these, usually privately, but the burden has become too much, and I no longer plan to respond to trivial or ephemeral points. If you don't hear from me, this is why. Some requests for pointers to information will still be handled, but I advise people to learn how to use the archives and/or search tools. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: netscape bug
by Joe Tardo 17 Dec '03

17 Dec '03

Reply to: RE>netscape bug "Vladimir Z. Nuri" writes: >I am willing to bet that the netscape bug would have been fixed quickly if it >had been quietly brought to their attention, without the blaring media >lights (I enjoy the media circus as much as the next guy, but on the >other hand, doing some things quietly may actually advance the cypherpunk >cause further than by making a noisy hullaballoo in cyberspace). I can't speak for Netscape in particular, but from bitter personal experience (in a previous life) I would be more willing to bet that bringing such a flaw to management's attention would raise the priority a bit to perhaps just below whatever their equivalent of the 'cut line' is. The rationale: "we are so resource limited; can't just keep it under wraps and fix it in the next release?" just rings in my ears. I can really empathize with what the developers at Netscape must be going through, but the 'social good' of raising security flaws to the level of the front page of the NYT is hard to deny. Rather than saying "security through obscurity is bad" you can point to a precedent of the consequences of being found out. --Joe

1 0

Euro-Clipper
by Ian Goldberg 17 Dec '03

17 Dec '03

I don't think I've seen this here (but it was on a bunch of security newsgoups...) - Ian Forwarded message: > > According to an article in `Communications Week International', the > 34-nation Council of Europe has agreed to outlaw strong encryption > products which do not make keys available to governments. > > The article, `Euro-Clipper chip scheme proposed', is on the front page > of the magazine's issue 151, dated 18th September, which arrived in my > mail this morning. > > It relates that the policy was approved on the 8th September at > Strasbourg by the Council, and coincides with an attempt by the > European Commission to propose a pan-European encryption standard. The > Council - unlike the Commission - has no statutory powers to enforce > its recommendations. However, Peter Csonka, the chairman of the > committee that drafted the document (and an administrative officer at > the Council's division of crime problems) says that `it is rare for > countries to reject Council of Europe recommendations'. > > The proposal would make telecomms operators responsible for decrypting > traffic and supplying it to governments when asked. It would also > `change national laws to enable judicial authorities to chase hackers > across borders'. > > Opposition to this measure was expressed by Mike Strezbek, VP > responsible for European telecomms at JP Morgan, who said that his > organisation `will challenge any attempt to limit the power of our > network encryption technologies very strongly'. > > Czonka said that the Council had given consideration to business > interests but had tries to strike a balance between privacy and > justice. However, `it remains possible that cryptography is available > to the public which cannot be deciphered,' his document says. `This > might lead to the conclusion to put restrictions on the possession, > distribution, or use of cryptography.' > > Apparently another international organisation, the OECD, has called a > conference of its members in December to devise a strategy on > encryption. > > I for one will be making clear to my MP that his stand on this issue > will determine how I cast my ballot at the next election. I note that > John Major stated in a 1994 parliamentary written reply to David Shaw > MP that the government did not intend to legislate on data encryption. > I am disppointed that government policy has changed to the point of > supporting the Council of Europe, and that this change has sneaked > through during the parliamentary recess. > > Ross Anderson > > > >

3 2

Re: NSA and Netscape Crack
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 3:46 PM 9/19/95, Jim Ray wrote: .... >I don't expect to know NSA's specific brute-force capability, but >does anyone know if the NSA has *ever* found a glaring weakness in >software and then told its author(s) or owner(s) about it? Do "we" >perform the "COMSEC" role Tim was speaking of better than the NSA? >JMR .... Once upon a time NSA would find weeknesses in friends' crypto systems and tell them about it -- depending, of course, on the situation. It was a reciprocal practice. We don't know that NSA didn't tell Netscape.

3 2

Re: Removing Tyranny from Democracy (Part II), (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 9 Sep 1997 19:02:37 -0700 > From: Steve Schear <azur(a)netcom.com> > Subject: Re: Removing Tyranny from Democracy (Part II), (fwd) > >> No intrinsic flaws in democracy? > >> > >> Surely you jest. > > > >Please be so kind as to detail your top three flaws... > > I think my Parts II and III detailed a number of shortcomings of democracy, > at least when the franchise goes to 'employees' as opposed to 'customers' > of government. I have read 'The Sovereign Individual' as well so am somewhat familiar with the thesis they propose. I will ask you the same question I would ask of Davidson & Rees-Mogg... Assume that we accept this thesis that the best way to run a government is to structure it such that customers set policies and procedures. What inherent protections does that give me regarding abuse by the system? How do you propose to keep the majority from deciding that it is uneconomical to protect my rights as some minority group? A careful study of business practices versus race or socio-economic group (as expressed by dress) will quickly show that persons of the wrong 'type' receive less service than those of more acceptable groups. The sort of service the customer receives is after all in the hands of the salesperson, not the customer. Let's look at an admittedly contrived example but I believe it will suffice. There are two fires at opposite ends of the coverage area for a fire house. On Saturday they receive a call to go to one end, where the wealthy live. Would you have the owner pay prior to the firemen putting the fire out? Would they pay some premium beforehand? Now on Sunday a fire occurs on the other end where the poor are. Assuming they can't pay the bill would the firemen drive away? If so, wouldn't this in fact pose a threat not only to the other poor but also the wealthy since the fire might spread if it got large enough. Would the wealthy then be asked to pay for that run of the fire truck? What if they refused, how would the firemen pay for the food to feed their family? Perhaps go out and burn down more rich houses... If there are not some inherent or explicit checks in place then such a econo-government would reduce to mob-rule just as happens with democracy without explicit bills of rights. Neither you or Davidson/Rees-Mogg address this issue sufficiently. Furthermore, neither you or the authors address exactly why such a government would abandon the use of force totaly. Exactly why would this form of government reduce say burglary, thereby eliminating the need for police. Is this form of government going to do away with bomb weilding weenies, I doubt it, so we clearly have a need for federal or national level law enforcement fully armed. Since it is clear that all 200+ world governments would not abandon their current forms of government there is a clear and present danger from outside our borders. How do we protect ourselves from this threat? You can't pay them not to attack you, otherwise you are doing exacly what the system was supposed to avoid doing - paying tributes. You want a government with minimal intervention, the issue is not whether it is a democracy or a econo-government or even a communism. What measures that is the rights of the people recognized by the government and how the government respects those rights. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1