December 2003 - cypherpunks-legacy

Re: Encryption and the 2nd Amendment
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:39 PM 1/20/96, Michael Froomkin wrote: >IMHO the 2nd amendment argument is bunk. [I haven't seen the Wired >article BTW, so this is just a general point.] I haven't seen the "Wired" article either, as I no longer read it. I agree with Michael that an association of crypto with arms is a long reach, unsupported in anything I've seen in the Constitution or related papers. Moreover, any successful link made could be disastrous. After all, it is well-established--whether we like it or not--that the government can regulate and control access to hydrogen bombs, bazookas, nerve gases, grenades, fully-automatic weapons, and even various kinds of rifles and handguns. I would hate to see crypto truly classified as an armament (beyond what the ITARs say) and thus be subject to the same kinds of regulations as above. Be careful what you wish for, you might get it. A much stronger claim can be made, I think, that crypto is a form of language or speech, clearly protected by the First Amendment. Thus, writing one's diary in an encrypted form (a common practice in colonial days, interestingly) is a form of language one uses. Thus, "Congress shall make no law..." about this speech or writing. That two people choose to converse in ROT-13 or in RSA or in their own private code is not something the government is authorized to interfere with. Ikewiselay, itingwray inlay igpay atinlay islay otectedpray. --Imtay Aymay Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

E-Cash and the Treasury Department
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

[POSTED BY: PUBLICUS ANONYMOUS ("Oh! That Publicus.") ("Oh! That Anonymous.") INTELLIGENCE N. 269, 24 July 1995 (Vol. 16, N. 15) Publishing since 1980 Editor Olivier Schmidt Intelligence, N. 269, 24 July 1995, p. 11 RONALD K. NOBLE - U.S.A. This time the U.S. Treasury Department hasn't jumped the gun in announcing that Ronald K. Noble, the hard-line Undersecretary for Enforcement at Treasury, was the new chairman of the Financial Action Task Force on Money Laundering (FATF) set up in Paris by the G-7 group of industrialized nations in 1988. Last year at this time, the Netherlands took over the chair but U.S. Treasury wrongly issued an announcement that Noble was occupying the post. Asked by "Intelligence" for an explanation, Treasury simply stated that it had "made a mistake." Last year in Washington, Noble backed bankers complaining about the several million Currency Transaction Reports (CTR) they were required to file every year. Noble and the banks said that filing was not necessary on deposits by businesses like department, grocery and convenience stores that routinely make fluctuating large deposits in cash, and Treasury intended to slash CTR filings by 30 percent. Critics contend that businesses exempt from CTR filing will quickly be used by criminal organizations to launder their cash. As Undersecretary for Enforcement at Treasury, Noble oversees five of the eight largest federal law enforcement agencies in the U.S.: the Secret Service, U.S. Customs, the Bureau of Alcohol, Tobacco and Firearms (ATF), and the IRS Criminal Investigation Division, and the Financial Crimes Enforcement Network (FinCEN) which was taken over by Treasury's Office of Financial Enforcement under Noble last year at this time. At the FATF, Noble replaced Leo Verwoerd of the Netherlands on 1 July 1995 and will direct the FATF for one year. Following last year's resolution to "monitor implementation of the forty Recommendations of 1990 by its members," Noble intends to use forceful methods including open criticism in annual FATF reports of non-complying members, followed by written reprimands from the FATF chairman to recidivist member countries, and finally high-level mission visits to the faulty country. Greece has already been criticized twice for its lack of progress in implementing FATF recommendations. .

1 0

Innaresting Fortune article on "Garbage Goodfellas" in NYC
by Rich Graves 17 Dec '03

17 Dec '03

January 15th Fortune (don't normally read it, but I picked up a free copy) has a lengthy and evidently well-researched article bylined Richard Behar on the efforts of BFI, a large regional trash hauler and recycler, to break into the (by most accounts) Mafia-controlled garbage collection industry in New York City. Cypherpunk relevance: BFI is cooperating closely with the DA in helping to prosecute its allegedly mob-affiliated competitors, which raises a lot of very interesting questions, for which I have yet to formulate any answers. Also a sidenote about how NYC's disclosure laws actually aid organized crime by helping the various bosses track who owns what territory. Electronic surveillance. Money laundering. Steganography (sending messages by way of the disembodied head of a dog). Open access to information and free-market capitalism versus violent bozos, with and without uniforms. Pen trumps sword. Rich says check it out. -- Rich Graves Fucking Statist

1 0

Web site with Updated Telecom Bill Info
by Thomas Grant Edwards 17 Dec '03

17 Dec '03

http://bell.com/ (Alliance for Competitive Communications) has updated Telecom Bill info including "A concise resource guide to the House Senate Conference on H.R. 1555/S. 652.", 12/22/95 draft of the Telecommunications Conference Bill, and a statement by VP Gore. (Beware of editorial bias at this site, as these people are not a disinterested party). Our beloved Vice President said: "We are very gratified that the bill contains the provisions for the V-chip that will enable families to control the contract of television programming that comes into their homes and that it contains a provision to make advanced telecommunications services available at low cost to schools, libraries and hospitals" -Thomas

1 0

Update on Netscape and the Anonymiser site
by Alan Olsen 17 Dec '03

17 Dec '03

Netscape 2.0b6a (win32 version) now reports the user name as "Mozilla". Name is no longer fed out through the ftp... Thanks Jeff! Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "Is the operating system half NT or half full?"

1 0

Re: HAVAL (was Re: crypto benchmarks)
by Deranged Mutant 17 Dec '03

17 Dec '03

> Thanks. It looks like F4 and F5 are improved. Do you know how these > optimizations can be done in general? I tried playing with F2 > as a multivariate polynomial with coefficients in GF(2) in Mathematica. > This seems to work and I found several equivalent expressions that take > 13 operations (the original also takes 13 operations). Is there a tool > that can do this automaticly? I did the optimizations by hand. Simple rules of boolean arithmetic and logic (you know, things like Demorgan's Law applied to binary operations). Other processor-related optimizations can be done by hand, such as add x,x instead of shl x,1. I think I had the same proglems with F2 as well. Couldn't find a way to optimize it reasonably. > The biggest problem I have with HAVAL now is that with 4 or 5 passes the > transform functions are larger than 10k even with compiler optimzation for > size. Since the Pentium L1 instruction cache is only 8k, this makes HAVAL > with 4 or 5 passes extremely slow. Do you have ideas how I can fit the > transform functions into L1 cache? You might do some creative optimization to use more registers than it does. I haven't looked at it in a while. The code was so huge and slow compared to optimized MD5 and SHS that I have up using it for an unfinished encrypted file system. Rob. --- "Mutant" Rob <wlkngowl(a)unix.asb.com> Send a blank message with the subject "send pgp-key" (not in quotes) for a copy of my PGP key.

3 2

Re: Idea for "friendly" Windows password hack
by pgut01＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>Why not provide a way to grab the passwords cached in RAM, encrypt them >securely, put them away somewhere, and scramble the original copy of the >passwords in RAM so that Microsoft's code can't get to them? Ahh, the problem is the "put them away somewhere" part. There's nowhere to put them. The solution I'm using now for an (unreleased) variant of SFS is to store encryption keys in write-only hardware as per FIPS PUB 140-1, but that's hardly practical for most systems. The same standard also allows for key storage in software, but at the minimum useful level (level 2) you need at least a C2-certified OS to protect the keys (the standard is good reading when it comes to protecting encryption subsystems BTW, as are the specs for things like GSS-API and GCS-API). This isn't going to happen under Win'95 (for example, here's how to get to any keys held in memory by the OS: Win'95 allows for demand-loaded VxD's, so you run a trojan with an embedded VxD which searches the system VM for the keys and then unloads itself). It would require a significant reengineering of Win'95 to make it even passably secure (assuming MS don't screw up the implementation), and I don't think it's practical to do. Under NT you can do it to some extent because this level of security was designed in from the start. Peter.

1 0

Re: You want to read MY e-mail?
by llurch＠networking.stanford.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- bdavis(a)thepoint.net (Brian Davis) shared with the world: >On Sat, 20 Jan 1996, Scott Staedeli wrote: > >> from the Nando Times- >> >> DENVER (Jan 20, 1996 01:16 a.m. EST) -- A college student's request to look >> at the electronic mail of several high-profile state politicians got >> lawmakers' attention Friday. >> >> ... >> OK, if _I_ can't read your e-mail Mr. Legislator, why should you >> be able to read _mine_? > >The Colorado state legislature has nothing to do with federal wiretapping >laws and with federal laws relating to encryption. Mostly true. But state governments and state politicians have been naughty as well. Certain southern governors in the 50's and 60's spring immediately to mind. However, I think "an eye for an eye" is the wrong approach in the first place. There's an opportunity for education here, and progress. >Rather than the "government is inconsistent and bad" spin, why not >"Colorado legislators and the Colorado governor agree that privacy is >paramount in electronic communications. In opposing a request for >blanket access to their private electronic mail, they necessarily oppose >federal attempts to have access to all electronic mail, once again >showing that Washington is out of touch with the rest of the country. This is clever, but I don't think it works. There is a legitimate public interest here. Even if there's nothing incriminating in the email messages themselves, the questions of how much government business is conducted electronically, and how much non-government business (personal matters, political fund-raising) is conducted on publicly funded computers on government time are legitimate. Pertsonally, I'd be reluctant to peep into every message ever sent on a government computer -- it's too voyeuristic for my tastes. I'm especially thinking about that poor staffer who was grilled by the Whitewater Committee about one use of the word "bastard" in an unrelated email message to a friend that had been deleted years before. It doesn't seem right to grep for out-of-context soundbytes. Not that the new book "White House Email" isn't good for hours of entertainment. I'd like to see politicians put on official notice that all email on publicly owned computers is public property, though it would be hard to draw the line where politicians and political appointees end and the innocent line employee begins. If the politicians end up using crypto on government computers, great -- maybe they'd start to "get it." If the politicians want to open accounts with outside ISPs on their own (or their political party's) dime, great -- that's what a lot of other people on this list have had to do. Of course if some politician starts using an outside account for official business (and only then), then that account becomes fair game for public disclosure as well. It's a matter of ethics and accountability. Because politicians have not yet been put on official notice that this is the policy, though, I would not endorse making this policy retroactive and grepping all their email for dirt, unless the public has something like probable cause to do so. Next year, sure, it's all public record. Politicians should be educated that privacy without strong encryption is illusory anyway. Making a law that the public can't read their email simply isn't going to work. It's unenforceable. Sure it'll slow down the rate of public disclosure a bit. Still, some disgruntled ex-employee, or some Woodward & Bernstein type, or Jim Bell :-), is bound to get through. Scandals long to be free. >Parts of the federal government are catching on, however. The U.S. Commerce >Department recently agreed that federal attempts to >eavesdrop on electronic transmissions counterproductive in that they are >causing problems for U.S. companies which create computer programs >designed to allow secure use of the Internet to engage in private >discussions and secure commerce. Estimates the dollar value of exports >lost range up to $xxx, and continued chilling of U.S. programmers will >give foreign programmers the chance to catch up in a field where U.S. >expertise presently leads the world. ...." > >Needs to be re-written and juiced up, but you get the idea. Might play to the right crowd (for example, preaching to the choir here), but sounds like a non sequitur to me. Not that clever non sequiturs aren't useful. By the way, I read something about something similar happening in California. The new Republican Assembly "leadership" was trying to hold the computers of the previous Democtatic "leadership" in escrow so that they could look for dirt. Anyone know the outcome of that? - -rich - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMQH7yioZzwIn1bdtAQHC/wF8DHUhQpWkNAE8bVHeB9zUbXG7ju2Y1+Bo LHsVK6M4Qwd8Q2HMbaMe2/y5xBpryyVh =A+29 -----END PGP SIGNATURE-----

2 1

Re: "Trustworthy" PGP Timestamping Service ??
by Douglas F. Elznic 17 Dec '03

17 Dec '03

At 03:42 PM 1/21/96 -0800, Timothy C. May wrote: >At 6:51 PM 1/21/96, Matthew Richardson wrote: >>-----BEGIN PGP SIGNED MESSAGE----- >> >>I have recently setup a free PGP timestamping service which operates >>by email. >> >>The objective of the service is to be able to produce "trustworthy" >>timestamps which cannot be backdated without detection. It achieves >>this by:- >> >>(a) giving every signature a unique sequential serial number; >> >>(b) every day making a ZIP file of that day's detached signatures >>and feeding the ZIP file back for signing (and hence the assignment >>of another serial number); >... > >It sounds like a variant of the Haber and Stornetta work on digital >timestamping, about which much has been written on our list (check the >archives, and/or sections of my Cyphernomicon). > >They have a company, Surety, which is doing this (or was, last time I heard). > >www.surety.com will get you there. > >My hunch is that your scheme implements a version of a hash (the idea of >hashing the doc and then publishing the hash as a "widely witnessed event," >in Haber and Stornetta terms) that could infringe on their patents >(assuming they applied, as I recall hearing they did). > >Before you go much further on this, it would behoove you to check on what >they are doing and on what patents, if any, you might need to license. > >--Tim May > >Boycott espionage-enabled software! >We got computers, we're tapping phone lines, we know that that ain't allowed. >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Higher Power: 2^756839 - 1 | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." > > > > > > What was the web page for the first mentioned service? -- ==================Douglas Elznic=================== delznic(a)storm.net http://www.vcomm.net/~delznic/ (315)682-5489 (315)682-1647 4877 Firethorn Circle Manlius, NY 13104 "Challenge the system, question the rules." =================================================== PGP key available: http://www.vcomm.net/~delznic/pgpkey.asc PGP Fingerprint: 68 6F 89 F6 F0 58 AE 22 14 8A 31 2A E5 5C FD A5 ===================================================

1 0

Re: HAVAL (was Re: crypto benchmarks)
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Sun, 21 Jan 1996 01:29:49 -0800 (PST), you wrote: [..] Now, the *big* question is... any new cryptanalysis that sheds light on the security of HAVAL? (I haven't yet gotten AC2 if there's info in there.) Email to one of the authors of HAVAL said he knew of nothing but that a recent attack on MD5 didn't apply.

1 0