December 2003 - cypherpunks-legacy

pna.show_story?p_art_id=318329&p_section_name=Sci-Tech
by Jim Choate 17 Dec '03

17 Dec '03

CNN Custom News logo Home [INLINE] World U.S. Weather Sports Your Money Business Sci-Tech Showbiz Lifestyle On Target [INLINE] Customize Profile [INLINE] Help Feedback Switch User CNN Interactive CNN Interactive Sci-Tech [INLINE] CNN SI [INLINE] CNN FN [INLINE] All Politics [INLINE] InfoSeek Link of the Day [LINK] Video Pick of the Day [LINK] [INLINE] September 16, 1997 7:50 pm EDT [INLINE] Sci-Tech Title [INLINE] Ad Space The story below was selected from CNN Custom News - a new personalized service that delivers only the news that's important to YOU. Sign up now to receive your personal news stories, weather, sports scores, and stock quotes from over 100 different sources - all for FREE. If you're already a user, please login. Custom News Criminal Intellegence Eases Policeman's Lot Reuters 16-SEP-97 CAMBRIDGE, England, Sept 16 (Reuter) - Privately held Harlequin Group Ltd said it introduced a software product which harnesses artificial intelligence to speed up criminal investigations. The product, Harlequin Intelligence, displays criminal investigation data in graphical form. Artificial intelligence is used to break down witness statements into their component form and instantly links evidence to existing databases. The graphic displays allow a quick snapshot of the progress of an investigation. In a statement released at the Cambridge International Symposium on Economic Crime, Harlequin said the system discovers links or identifies associations that may not be immediately apparent to an investigator or analyst. ``Harlequin Intelligence is designed for use by major law enforcement and investigation agencies to combat many different types of crime including homicide, fraud and drug related offences. It is also designed for use in commercial business information environments where these powerful technologies can be equally applied to corporate business concerns,'' the Cambridge based company said in a statement. A spokesman declined to reveal the cost of the system or the company's sales targets but said the system had already been sold to the Los Angeles Police Department, a force in Florida, the U.S. Federal Bureau of Investigation, and four police forces in Britain. Search the net: InfoSeek _________________ ____[Help] [INLINE] Ad Space Top Copyright © 1997 Cable News Network, Inc. A Time Warner Company ALL RIGHTS RESERVED. Terms under which this information is provided to you. [INLINE]

2 1

Re: CJR returned to sender
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:10 AM 10/27/95 -0400, "Josh M. Osborne" <stripes(a)va.pubnix.com> wrote: > They may help spread the word about >how foolish the ITAR is, and that is their only real value (well >aside from entertainment). US News & World Report, October 16, 1995, page 28, has a short article on the shirt in their Washington Whispers column :-) It's not totally accurate, but it talks about how the Feds oppose export of "simple but powerful computer programs that can be used to encrypt electronic communications. Computer buffs and private security experts say such restrictions are a threat to privacy - as well as an absurd anachronism, since the programs are already widely available. To underscore the point, one disgruntled citizen is now offering for sale over the Internet (http://colossus.net/ wepinsto/wshome.html) a T-shirt emblazoned with an encryption program known as RSA" and a bit more about the shirt and issues (and Don's refund offer to anyone arrested for wearing it) >However I think it is a good idea to slowly approch the dividing >line between exportable and non-exportable. Wouldn't it be nice >to be able to hold up the shirt and say "this is exportable", and >then scan it & save it onto a floppy and then say "this is not" >(assuming that a floppy of the shirt is denyed CJ) when arguing >with someone about how arbatary the export laws are? Obviously the next revision of the shirt should have a pocket for the optional non-exportable floppy disk :-) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Notes from the Cypherpunks September Bay Area Meeting
by Martin Minow 17 Dec '03

17 Dec '03

Here are some notes I took at the Cypherpunks September Bay Area Meeting on September 13 at "PGP World Headquarters" in San Mateo. Quotes are summaries and interpretations, but hopefullfy fair and accurate. My interpolations enclosed in square brackets. Cypherpunks meetings are not particularly formal, but more like a dialog between a number of people, punctuated with slightly more formal presentations. ---- Introductory discussion of the recent crypto-gutting legislative proposals. ---- Eric Hughes (EH): This is the fifth anniversary of Cypherpunks. At the first meeting, we demonstrated a number of the technologies that are now becoming widespread, including remailers, and breaking weak (i.e., exportable) cryphograph. Tim May (Tim): What we feared five years ago is worse than Clipper -- it's an absolute disaster. The government has declared war on privacy. The only survivor is likely to be Trusted Information Systems, which has very close connection to the NSA. EH: The government now desires access to all plaintext communication. Tim: The British, and OECD, trusted third party proposal is a nightmare: even if you have access to software such as PGP and Explorer that provides strong privacy, the British now regard the keys you need to use that technology as "crypto material" -- and it will be illegal to distribute unbreakable keys [presumably without license or escrow capabilities]. Vinnie Moscaritalo (Vinnie): Black market? EH: No: there will be an underground market [the distinction is important] what we need are legitimate distribution of keys and crypto. Social pressure will otherwise keep crypto unused. Tim: Quoting Whitfield Diffie: this is like the war on drugs. Ban grypto and companies will dpeutize themselves to assist the government just as they did by requiring urine tests. EH: [The computer industry is moving to] remote policy enforcement -- copyright enforcement [to prevent you from using software if you don't have a license to it, or to prevent you from viewing a copy of a movie]. The same mechanisms can be used to enforce crypto regulations. You can characterize GAK/ATP (Government access to keys, access to plaintext) as possession with the intent to communicate. Tim: The intelligence community wants to be your supplier of big-brother crypto. They are not fascists; they just don't have a clue. Intel's next [next plus one?] generation processors will devote 3-4% of their chip area to functions that facilitate encryption. All processors will be serial-numbered. [This makes it very simple to "seal" a program so it can only be used on a single, specific, processor. This capability has been used for a decade in the minicomputer world.] Tim/EH: The battle must be fought in [the context of] the First Amendment. Qooting Don Hayes: "Nothing good can come out of crypto." [I think Hayes was referring to crypto legislation.] ----- Jeremy of Blue Money Software briefly described their electronic cash programming interface. Someone (Jeremey?) described an "onion routing" electronic mail protocol that conceals all information. This lets two people communicate without any external party either reading the mail or determining the sender or receiver. This was developed by the U.S. Naval Research Laboratories. They need ths because they otherwise cannot conceal sensitive communications within public traffic. ----- Kelly Blough, PGP's Government Relations representative discussed the recent legislation initiatives. The Pro Code bill is dead. Stuck in a senate committee. The McCane Kerry bill passed commerce, but was not reported out: McCain doesn't like it. This is good news. The SAFE bill (in the House) passed the [which?] committee in a way that we like. The bill removes export control on public code. It allows Americans full access to strong crypo. It was referred to National Security, Commerce, and [International Relations?] committees. National Security gutted the bill. Intelligence added FBI-requested access to plaintext. This was done in an unusual closed-door markup. [These are usually only done for military and intelligence funding bills.] "The intelligence community wants to set policy." Dave Del Torto (DDT): A friend says that the military intelligence personnell are swarming on the Hill. Kelly: thinks that this is mostly driven by domestic law enforcement, not the military Commerce added a gutting amendment, but now waiting two weeks. Tim: Declan McCullogh said that Louis Freeh said that, if a Congressman votes against gutting crypto, the FBI will blame the next Oklahoma City bombing on that Congressman. Kelly: This is good in one way: the cards are now on the table. The regional telephone companies, auto manufacturers, are all on PGP's side: "How can we help?" Banks and other financial institutions are not on PGP's side: because of the export exception.. Maybe this will change when the impact of domestic restrictions sink in. John Gilmore (JohnG): sens a fax to his respresentative, Nancy Pelosi. Asked whether this law should be passed without review. Her chief of staff replied that Pelosi brought up issues, but didn't change the consensus. Also brought up the lack of law enforcement tracking and notification. Tom Lantos, who sits on both the National Security and International Relations committees (and who is the representative for PGP's district) -- for someone who is strong on on human rights, he is voting against strong crypto. Tim: Why does PGP participate in export committees. Kelly: Industry group to lobby: Microsoft, etc. Big companies: trying to demonstrate that it's not just software. DDT: Electronic Freedom Foundation? JohnG: We got out of lobbying. Focussing on the Bernstein appeal. John is talking to Pelosi individually. She will write a minority report of disagreement with the National Security committee decision. EH: PGP needs support from cypherpunks. Kelly: Lobbying media. Gutting crypto gives government access to reporters' notes, to communication with anonymous sources. [Also lawyer, client.] The SAFE bill will probably go to the floor as written. Amendments must be voted upon. Pro Code is dead. DDT: Political liability: Gore was thought to be a friend to Silicon Valley -- maybe not now. But, maybe he doesn't think that Silicon Valley helped Clinton in 1996. JohnG: The "one time review" proposal lets "NSA read your source code" Lets them find holes in your product. Pelosi's chief of staff said to John that it will be illegal to sell strong crypto immediately after the law passes. But distribution will be allowed until 2000. This was put in for PGP: human rights workers are using it -- this will let PGP spread around for three years. Tim [?]: WIPO (world intellectual property agreement) will ban all forms of code cracking. Pushed by content providers to secure their intellectual property. Kelly, with PGP former president Tom Steddings, wrote the recent California legislature resolution. JohnG: Trusted Information Systems has three patents on key recovery. EH: Why do the Fed's want access to plaintext? The motivation has not been made clear. Policy goals are stated in technological terms, not in policy terms. ------- Other notes (more technical) Don't use a hardware black-box to generate private keys: they can leak private key information in the public key. Use a mix of software and hardware: do final generation in auditable software. Ian Goldberg: Move crypto to Palm Pilot. Demonstarted secure e-mail and web browsing on a Palm Pilot connected (through a bizarre collection of cables) to a Metricom radio modem. Dave Lainer [??] discussed cell phone privacy. There are three kinds of information that needs to be secured: the voice message, the number that you are calling, and the cell-phone identification. None of this is secure on analog phones. The phone companies don't care about user privacy: only about call setup privacy. NSA lied to telecom committees about call security. Voice privacy is trivial. PGP is trying to get their PGP phone technology into digital cell phones. This can do end-to-end encryption between PDP-enhanced phones. There are several kinds of information that need to be secured: voice, billing information, dialed numbers, and the caller's physical location. The government likes secure billing information -- if they don't know who made the call, they can't use it as evidence against an accused. JohnG: the cell phone authentication algorithm was recently cracked. EH: New Japanese phenonemon: tiny PKS cell phones. Teen-agers (who are driving lifestyle changes) all use them. ---- DDT: Discussed Open PGP: a non-proprietary standard presented to IETF: This includes a public-key infrastructure, trust model, message format, MIME (content format), and meta-certificate technology. Proposed to the Vatican (Papal representatives must communicate with Rome). Big battle in Rome between Netscape and Microsoft to be the "official browser of the Vatican." Big is an underestimate: Microsoft is offerring "eternal" licenses. ---- My notes end here. Apologies for any errors in transcription or understanding. Martin Minow minow(a)apple.com

4 4

Re: Don't Kill the Messenger--A New Slant on Remailers
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:45 PM 10/20/95 +0100, "Rev. Mark Grant" <mark(a)unicorn.com> wrote: >> "You have a piece of mail awaiting at our mail delivery service. The >> originator is unknown. The title of the message is "Tentacles of Medusa >> Must Die!" You may retrieve this message by replying to this notification >> with the word "Yes" anywhere in the Subject field. This message will be >> kept for 60 days and then deleted." > >I suspect that I could easily hack this into Mixmaster in a day or two, >but wouldn't it open you to attacks where Anonymous Fed, say, sends >terrorist kiddy-porn through your remailer and busts your ISP during those >60 days for possession ? I'm not sure if it would be better or worse than >current setups from that point of view. One way to deflect this attack is to encrypt the message for storage using a symmetric-key algorithm with a randomly generated session key, and send the session key to the recipient with the notification. You still have 300 MB of planted kiddy-terrorist narcopornography on your machine, but it's encrypted and you can happily tell the judge that you _can't_ decrypt it because you don't have the key. The Feds _could_ get the keys by eavesdropping on your outgoing correspondence or using your system to send the material to themselves (or a conveniently employed child), but at least you're not storing it in plaintext. More of a problem with this system is that it's only useful for terminal remailers; to use it in the middle of a chain, the next remailer would need to be configured to auto-accept such messages, or else your remailer would need to have a list of known remailers and use direct delivery for all mail sent to them. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: MD5 weakness ? [was Re: Netscape Logic Bomb detailed by IETF]
by Bill Stewart 17 Dec '03

17 Dec '03

>>As to weaknesses, I seem to remember that someone managed to forge a >>modification to a program used to observe networks on a Sun so that it >>had the same MD5 checksum as the official trusted version. But whether >>this is real is not strictly the issue. There was a program that forged CRC checksums that came out a couple years back, letting you create a Trojan Horse and modify it to match Unix "sum" checksums by adding junk to the end. I'd be extremely surprised if anyone did this with MD5; CRCs are invertable, and generally short enough to brute-force as well. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Quebec Libre
by J. Kent Hastings 17 Dec '03

17 Dec '03

-- [ From: J. Kent Hastings * EMC.Ver #2.5.02 ] -- Cpunx, especially offshore banking "fonts of wisdom," A friend asks: > Concerning Quebec Libre, I would love to establish residence there before the > separation (not necessarily physical residence). Have these fonts of wisdom > on St. Louis and Anguilla banking anything on getting Quebec residency, mail > services, and bank accounts? Any plans if Quebec secedes? Kent -- "Put pages for your business on the World Wide Web, just $5 per month!" -- J. Kent Hastings -- zeus(a)pinsight.com -- http://www.pinsight.com/~zeus/

2 1

Fuck them all. Lock and load. Rock and roll. / Re: Liberals and their tacit
by The Real Guy 17 Dec '03

17 Dec '03

Tim May wrote: > >> It's war. Too late for a public relations campaign so that some future > >> Congress will slightly relax their laws. > >> And in a war, gotta break some eggs. > Perhaps if it were J. Edgar Hoover doing this instead of Democrat Louis > Freeh, we wouldn't see "nominal" liberal Ron Dellums, amongst so many > others, standing shoulder to shoulder with the fascists. (Not that I ever > though Dellums was anything other than a fascist, mind you.) > Perhaps if it were former CIA director George Bush pushing this (in his > alternate universe second term) there would be more outrage from liberals. > I'm beginning to think Federal Bureau of Inquisition Director Unfreeh must, > as rumors have long had it, have the goods on Janet Reno and Bill Clinton. > Left to our imagination what these items may be. I know for a fact that the Spooks had nothing to do with Richard Nixon recording every dirty deal that took place in the White House. I know for a fact that they certainly wouldn't use all that criminal information for blackmail. I know for a fact that they wouldn't spy on politicians and major financial figures, or take advantage of nefariously gained information in order to increase their money and power. People who smoke dope, dodge the draft, commit adultery, and perform financial fraud while govenor get to be elected President all the time, and nobody ever tries to 'control' them, or manipulate them in any way. I know all of this because I'm The Real Guy, "I used to be The Bad Lie until I got caught cheating at golf and was nominated for the Presidency."

1 0

QUF_jpg
by John Young 17 Dec '03

17 Dec '03

We have scanned "Quantum Computation's" seven formulae and six figures as JPEG graphics files and will send for a plea: quf1.jpg -- Formulae 1-7; 32 kb. quf2.jpg -- Figures 1 and 2; 72 kb. quf3.jpg -- Figures 3 and 4; 95 kb. quf4.jpg -- Figures 5 and 6; 72 kb. Or, we will mash'em up .TIF, .PCX, .GIF, or tire-smeared pigeon. QUF_jpg (4-part package, or items selected) [or *_tif, *_pcx, *_gif, *_tsp]

1 0

Brit conference asks for more cyberspace violations
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- *** Fraudbusters seek fresh angles as cybercrime grows Crimebusters must devise more ingenious ways of combating fraud and will need new international policing powers to stem a rising tide of high-tech economic crime, experts say. Delegates at an economic crime conference in Cambridge, England, this week complained they lacked the tools and power to take the fight to the organized criminals whose only barrier was the speed of their modems. Culprits were hard to pin down, said Rosalind Wright, head of Britain's Serious Fraud Office. It was harder still to "swat the fly-by-nights," she said. See http://www.infobeat.com/stories/cgi/story.cgi?id=4974072-ff5 ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNB9t9704kQrCC2kFAQGLEQP/Xo9+l5MV3KE3X1X7hCdJpaWr8gprctKR jIm2k+2RwHIVBT9IzQ0s/VEWI+8ftO43b18qlYYdbyiSGCPnJsoZtXOmivTTdcg3 U8FAJNTrbILZ4lcTYbxsAUm0U12xc4flOjK16UWzKrI3gli8Y/YPO2hMbxkBcH6P aknorOx6BpY= =1+3N -----END PGP SIGNATURE-----

1 0

Re: Digicash will not fly (not)
by msprague＠owens.ridgecrest.ca.us 17 Dec '03

17 Dec '03

"James A. Donald" <jamesd(a)echeque.com wrote: >While Chaum is a brilliant cryptographer, he is an incompetent businessman > >He has demonstrated this in numerous ways. > >The latest being "Cash" where the bank skims off 4% to 10% every time. > >No one is going to use digicash under these kinds of terms and >conditions. Doesn't just about everyone do precisely this when they pay sales tax? Every time a buck arrives or departs a hand one pays a tax yet the system (you and I)continues accepting these terms albeit painfully. > --------------------------------------------------------------------- > | >We have the right to defend ourselves | http://www.jim.com/jamesd/ >and our property, because of the kind | >of animals that we are. True law | James A. Donald >derives from this right, not from the | >arbitrary power of the state. | jamesd(a)echeque.com

2 1