December 2003 - cypherpunks-legacy

Re: Don't Kill the Messenger--A New Slant on Remailers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:45 PM 10/20/95, Rev. Mark Grant wrote: >On Thu, 19 Oct 1995, Timothy C. May wrote: > >> "You have a piece of mail awaiting at our mail delivery service. The >> originator is unknown. The title of the message is "Tentacles of Medusa >> Must Die!" You may retrieve this message by replying to this notification >> with the word "Yes" anywhere in the Subject field. This message will be >> kept for 60 days and then deleted." > >I suspect that I could easily hack this into Mixmaster in a day or two, >but wouldn't it open you to attacks where Anonymous Fed, say, sends >terrorist kiddy-porn through your remailer and busts your ISP during those >60 days for possession ? I'm not sure if it would be better or worse than >current setups from that point of view. In the U.S. at least, the Electronic Communications Privacy Act (ECPA) says that e-mail should not be looked at by third parties to a communication. Yes, there are all sorts of wrinkles, such as whether an employer may look at employee e-mail, blah blah. But I suspect the ECPA adequately protects a mail deliverer against charges such as Mark describes. ("But under the ECPA I am not allowed to look at this e-mail, so how can I held be liable for it?" Not even under Stratton-Oakmont is the deliverer or holder of e-mail held liable for content or effects--the Prodigy case involved the fact that Prodigy was moderating/censoring speech in public forums, so, the judge averred, Prodigy could not claim it had no duty to moderate or censor the speech of defamers. Roughly, as IANAL.) >I might do it anyway, and set it up to only forward PGP-encrypted >messages, but I certainly wouldn't be able to keep messages for 60 days >with only a MB or so to spare. Drives are cheap. I just saw a 1.2 GB for $195 (internal, PC). I suspect that anyone sweating over having only a MB to spare shouldn't be running a remailer. (Not a slam against Mark, just a statement that there are certain minimal capabilities I'd expect to see, and not having free disk space is a serious problem.) In any case, by the time "General Delivery Remailers" would be spreading, disk space will be even cheaper. And a coupon- or stamp-based remailer could of course then buy disk space as needed. (If a 1000 MB drive costs $300 and is written off over 3 years, then the storage cost is $0.10 per megabyte-year. For the average text message of about 20 KB, the cost to store it a year is $0.002. The cost to store it for 60 days is 6 times less. Even if disk drives cost more than I've quoted, the cost is tiny, tiny, tiny. Connection costs are likely to dominate. Large files may be a different matter--the math is easy to do--but these are seldom the targets of remailers to unsuspecting parties. In any case, easy to "expire" unretrieved larger files faster.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Don't Kill the Messenger--A New Slant on Remailers
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Fri, 20 Oct 1995, Timothy C. May wrote: > Drives are cheap. I just saw a 1.2 GB for $195 (internal, PC). I suspect > that anyone sweating over having only a MB to spare shouldn't be running a > remailer. The trouble is, I can't just add a 1.2 GB disk to my ISP and use it, I have to pay monthly for more space. In addition, it would be time-limited to three months or so in any case, as I'm going to be travelling and wouldn't be able to support it. > (Not a slam against Mark, just a statement that there are certain minimal > capabilities I'd expect to see, and not having free disk space is a serious > problem.) Yeah, I was mostly intending it to be a proof-of-concept, not really as an operational remailer at this point. If it was available as a patch for Mixmaster, say, then anyone who wanted to run such a remailer and had the disk space available, would be able to do so. BTW, how would the ECPA apply to, say, bouncing non-PGP messages ? From the sound if it, doing that would be worse from a legal standpoint than not doing it, as it would imply I was censoring the mailfeed in some fashion. Mark

1 0

Job Openings at Consensus (Mostly RSAREF related)
by Jonathan Zamick 17 Dec '03

17 Dec '03

Heya all, thanks for the suggestions regarding 'dream features' for RSAREF. The best thing is, we can actually do some of them, and have some compromises for others. (We can't allow unlimited calls for instance, but we do have a process for setting up new APIs so people can tie in to other algorithms officially.) For those who are expecting mail from me regarding licensing, hold in there. we had to clear up a couple misphrasings that hadn't been caught. That's dealt with, and the contact looks clean... now to just get the license up and ready. (Sorry, I really had thought it would have been out to you all already.) After all the discussion recently about rewards for crypto work, and such, I thought this might interest some people. Between RSAREF and some other projects it seems we can hire some more folk. This went out on the RSAREF Announcement list, but I thought some of the people on Cpunk might be interested. (Be warned though, we aren't a hard core development house, the focus is on human focused electronic technologies, for which privacy, trust and encryption are neccessary. Its why I enjoy the place, but it might not be for everyone.) Anyway, if you have questions send them to me. If you actually want to apply, send them to ChristopherA(a)consensus.com. Later, Jonathan ---------- Consensus Development Corporation is a rapidly growing software development and consulting firm in the privacy and security field. We are the exclusive commercial licensor of the RSAREF toolkit and offer consulting and development services to companies including Apple Computer, RSA Data Security, VeriSign, Visa International, etc. We need people for the following: Lead Engineer ------------- Candidate will lead a team of staff and outside contractors to develop digital signature software. Candidate is expected to have experience with encryption and privacy software. Experience in Windows and/or Mac application and GUI design is required. General experience with BSAFE, TIPEM, RSAREF, C++, cross-platform development, internet standards and TCP/IP coding desirable. Support Engineer ---------------- Candidate will be providing front-line technical support to our RSAREF commercial licensees, integrating C code submitted by outside contributers into RSAREF, as well as writing new technical documentation and FAQs for new versions of RSAREF. This can be an entry-level position with only C experience required, however, individuals with more experience is desirable. Interns ------- We have several 2 to 3 month intern positions for work in the encryption and internet standards areas, including porting of code supporting internet standards across platforms, preparing internet-drafts of new standards, and supporting our full-time engineering staff.

1 0

Re: textbooks
by Dana W. Albrecht 17 Dec '03

17 Dec '03

Perry writes: > Kenshiro writes: > > I am planning to do take an independent study course in cryptography. A > > professor here is interested in doing it with me, but neither he nor any > > other faculty members at this school is very knowledgeable about > > cryptography (hence his interest :). I am looking for good (technical) > > books on cryptography which would work well as textbooks for undergraduate > > computer science majors with scant knowledge of number theory. > > The right place to start is the new edition of Bruce Schneier's book, > Applied Cryptography, which will be coming out within a month. The old > edition will probably do until then. There are a number of other > books, but Bruce's is the One Stop Shopping center, and you can spend > years dredging up the things in the bibliography. > > For flavor and motivation, you might also want to read the (unabridged > hardcover -- not paperback!) version of "The Codebreakers" by David > Kahn. I read this book as a child and I suppose it got me interested > in crypto for life -- the funny thing is, it appears that the same > experience inspired Whit Diffie to go off and co invent Public Key > Cryptography, so it is probably a history maker. However, I'll note > that its fluffy -- all it will do is give you a solid perspective on > how hard it is to do this stuff right and how important it is. I also suggest "A Course in Number Theory and Cryptography, 2nd Edition" by Neal Koblitz, published by Springer Verlag. "Applied Cryptography" is certainly the book of choice, but Koblitz is an excellent secondary reference for covering a lot of the relevant mathematics in more depth. In my opinion, "Applied Cryptography" was written from the perspective of computer science, "The Codebreakers" was written from the perspective of history, and Koblitz's book was written from the perspective of mathematics. They are all nicely complementary. Dana W. Albrecht dwa(a)corsair.com

1 0

The Dr. Fred scandal
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

I feel moved to make a couple of comments. o Dr. Fred did get over the edge. His communication style had little to recommend it. o He did make some good and useful comments along with some others. o Some people posting anonymously and otherwise took out of context quotes in an apparently mean-spirited way and slammed the guy. o Dr. Fred reacted o Others reacted o Some people took private email from Dr. Fred and quite unethically replied publicly on this list without his permission. o I see both sides as owing this list apologies. o There are two sides to this whole thing. Fred brought up some concerns about possible holes in software just as many of us have. Most the time things like this result in good discussions on this list and concensus is reached about the holes existing or not and the extent of the holes. Because of Dr. Fred's presentation, he quickly alienated people, and what little discussion there was about his theories was lost in the noise. We'd do better to let it drop. In the future if someone really annoys you in the way they present something, perhaps it would help more if you sent them private email noting that their communication skills are working against them and giving them some helpful pointers about how they could have done things differently. That way you'll be part of the solution instead of part of the problem. It's easier to get your dander up and express your annoyance publicly, but that affects all the rest of us. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Automatic File Wipe Utils for Win95?
by Richard Charles Graves 17 Dec '03

17 Dec '03

Prescript: No, I am not affiliated with any government agency in any way. -----BEGIN PGP SIGNED MESSAGE----- A government agency is looking for something to ensure that files copied from a Windows 95 machine do not contain any data from unused space on the hard drive. I'm curious too. Perhaps a command.com hack that zeroes out any bits outside the actual file? The problem is that existing utilities do not work because Win95 disables direct disk access to preserve VFAT. A delete utility is not sufficient, because they are also worried about temporary files created by Win95 programs. - -rich llurch(a)networking.stanford.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIgf7Y3DXUbM57SdAQEThgQAnEWB7HI2yoxiFCdosQTNG/WxiBLkqTvJ FSf3ni7ThmHSx7acp2KueevIRcrFw89JaGj1gPH68irZj8Vh8PEP1uopQJw+QWDo A5NsTPiZnDooXN+svGNo1KH0k36+73xXh5wybXzKFgwHWz9X4RtE+lZdJ9JDf1z7 O8IT0zG6nqc= =NSyb -----END PGP SIGNATURE-----

1 0

Voicemail Security
by Rich Graves 17 Dec '03

17 Dec '03

Please see article <46775j$2tg(a)news.eecs.nwu.edu> in news.admin.net-abuse.misc. It has also been cross-posted elsewhere. I wonder how often Jeff checks his messages. It would be interesting, from a purely academic perspective of course, to see if one could anonymously drop off more information about Jeff and his clients at that number for private distribution. For example, credit card, driver's license, and social security numbers. I assume that Jeff is reading this group. How would Jeff go about protecting his voicemail box from this sort of attack? How would *I* go about protecting *my* voicemail box from this kind of attack? -rich Whose list was also spammed, but only I got it because majordomo is set to bounce all messages from non-subscribers to the list owner. Btw, is this list set up this way?

1 0

The trial of the century?
by Simon Spero 17 Dec '03

17 Dec '03

Any reports on todays outing to the Bernstein case? Any gifs of courtroom sketches to upload? Simon ----- Johnny Cochran - Sears spokesman: "If it doesn't fit, you can take it back and change it."

1 0

Lack of secrecy in U.S. Banks
by ph＠netcom.com 17 Dec '03

17 Dec '03

I ran across an interesting fragment of the U.S. Code. Apparently, the Federal Government may access any banking records whatsoever if the Director of the FBI (or the Director's designee) certify that the information is sought for "foreign intelligence purposes." Further, it is illegal for anybody to disclose that the records were turned over to the government, or even sought. I do not know the penalties for disclosure. The Attorney General appears to set guidelines for the dissemination of the information obtained through this law. Note that if banking privacy is violated for reasons which are not related to counter-intelligence operations, the victim is unlikely to be in a position to seek relief from the courts because the privacy violation is likely to remain secret. I've enclosed the law below. I'm not a lawyer, so it raises more questions than it answers. Perhaps the more skilled readers on the list will be able to deduce the implications. The U.S. Code is available at http://www.pls.com:8001/his/usc.html This particular law is available at the improbable URL: http://www.pls.com:8001/cgi-bin/taos_doc.pl?unix+0+uscode+17566+query+a+Gov… Here is the law itself: -CITE- 12 USC Sec. 3414 01/24/94 -EXPCITE- TITLE 12 - BANKS AND BANKING CHAPTER 35 - RIGHT TO FINANCIAL PRIVACY -HEAD- Sec. 3414. Special procedures -STATUTE- (a)(1) Nothing in this chapter (except sections 3415, 3417, 3418, and 3421 of this title) shall apply to the production and disclosure of financial records pursuant to requests from - (A) a Government authority authorized to conduct foreign counter- or foreign positive-intelligence activities for purposes of conducting such activities; or (B) the Secret Service for the purpose of conducting its protective functions (18 U.S.C. 3056; 3 U.S.C. 202, Public Law 90-331, as amended). (2) In the instances specified in paragraph (1), the Government authority shall submit to the financial institution the certificate required in section 3403(b) of this title signed by a supervisory official of a rank designated by the head of the Government authority. (3) No financial institution, or officer, employee, or agent of such institution, shall disclose to any person that a Government authority described in paragraph (1) has sought or obtained access to a customer's financial records. (4) The Government authority specified in paragraph (1) shall compile an annual tabulation of the occasions in which this section was used. (5)(A) Financial institutions, and officers, employees, and agents thereof, shall comply with a request for a customer's or entity's financial records made pursuant to this subsection by the Federal Bureau of Investigation when the Director of the Federal Bureau of Investigation (or the Director's designee) certifies in writing to the financial institution that such records are sought for foreign counterintelligence purposes and that there are specific and articulable facts giving reason to believe that the customer or entity whose records are sought is a foreign power or an agent of a foreign power as defined in section 1801 of title 50. (B) The Federal Bureau of Investigation may disseminate information obtained pursuant to this paragraph only as provided in guidelines approved by the Attorney General for foreign intelligence collection and foreign counterintelligence investigations conducted by the Federal Bureau of Investigation, and, with respect to dissemination to an agency of the United States, only if such information is clearly relevant to the authorized responsibilities of such agency. (C) On a semiannual basis the Attorney General shall fully inform the Permanent Select Committee on Intelligence of the House of Representatives and the Select Committee on Intelligence of the Senate concerning all requests made pursuant to this paragraph. (D) No financial institution, or officer, employee, or agent of such institution, shall disclose to any person that the Federal Bureau of Investigation has sought or obtained access to a customer's or entity's financial records under this paragraph. (b)(1) Nothing in this chapter shall prohibit a Government authority from obtaining financial records from a financial institution if the Government authority determines that delay in obtaining access to such records would create imminent danger of - (A) physical injury to any person; (B) serious property damage; or (C) flight to avoid prosecution. (2) In the instances specified in paragraph (1), the Government shall submit to the financial institution the certificate required in section 3403(b) of this title signed by a supervisory official of a rank designated by the head of the Government authority. (3) Within five days of obtaining access to financial records under this subsection, the Government authority shall file with the appropriate court a signed, sworn statement of a supervisory official of a rank designated by the head of the Government authority setting forth the grounds for the emergency access. The Government authority shall thereafter comply with the notice provisions of section 3409(c) of this title. (4) The Government authority specified in paragraph (1) shall compile an annual tabulation of the occasions in which this section was used. -SOURCE- (Pub. L. 95-630, title XI, Sec. 1114, Nov. 10, 1978, 92 Stat. 3707; Pub. L. 97-320, title IV, Sec. 432(b), Oct. 15, 1982, 96 Stat. 1527; Pub. L. 99-569, title IV, Sec. 404, Oct. 27, 1986, 100 Stat. 3197.) -REFTEXT- REFERENCES IN TEXT Public Law 90-331, as amended, referred to in subsec. (a)(1)(B), is Pub. L. 90-331, June 6, 1968, 82 Stat. 170, as amended, which is set out as a note under section 3056 of Title 18, Crimes and Criminal Procedure. -MISC2- AMENDMENTS 1986 - Subsec. (a)(5). Pub. L. 99-569 added par. (5). 1982 - Subsec. (b)(2). Pub. L. 97-320 struck out ''of'' after ''financial institution''. -SECREF- SECTION REFERRED TO IN OTHER SECTIONS This section is referred to in sections 3402, 3409, 3421 of this title. __________________________________________________________________________

1 0

Article on Digital Cash in "Worth"
by tcmay＠got.net 17 Dec '03

17 Dec '03

I don't recall seeing mention of this, so here goes. The October 1995 issue of "Worth" magazine has a fairly long article about digital cash in several forms, and about David Chaum's Digicash in particular. It has a more detailed description of his Amsterdam operation, and his history, than I recall seeing anywhere else. While I'm on the subject of Chaum and Digicash, several recent posts here have commented about my dislike of Digicash's current approach, or about my criticisms of the current approach. Given the recent "piling on" aimed at Netscape (for various reasons I think are obvious--see Note), I don't want to be perceived as one of Digicash's leading critics. The fact is, I'm not in the business of trying to deploy any kind of digital cash, so I don't follow too closely the ins and outs of what various "digital money" systems are currently offering. I have some long-range interests in the societal implications of truly anonymous digital cash, and argue the issues frequently, but I avoid worrying overmuch about Mondex vs. First Virtual vs. QuickenCash vs. whatever. Note: About half of all posts to the CP list for the past several weeks have somehow involved Netscape. The attacks on Netscape have been impressive, but many of the posts have a "me too" flavor, sort of the way my smaller cat takes every opportunity to nip at my larger cat when the larger cat is in distress. The phrase "kicking them when they're down" comes to mind. Not that the issues aren't real, just that a lot of folks want to be the "next Goldberg and Wagners," or that they want to add their two cents about how Netscape is blowing it. I stay out of this, but I certainly don't want to see Digicash given the same treatment. Their current product may not be all that some of us desire (in terms of anonymity, for example), but it sure does beat the alternatives in essential ways. I don't want to see Netscape so trashed that people turn to lesser-tested alternatives without good reason (Microsoft Network being one example), and I don't want to see Digicash so trashed that people turn to some product like Mondex. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2