December 2003 - cypherpunks-legacy

Re: (X:x)e$ 's other use
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 04:05 PM 3/26/96 EDT, E. ALLEN SMITH wrote: > The > Fed has done an actually rather admirable job of standing up to the pressure Every couple of years the politicians start leaning on Greenspan. Greenspan lets it be known they are leaning on him, the money markets mark the dollar down and the politicians stop leaning on him. The Greenspan standard is not a good as a gold standard, but its not bad. Only trouble is he is mortal, unlike gold. Come to think of it, there is actually some crypto relevance here: Internet currencies will be necessarily non physical and it will be difficult to go after the issuer in the event of default, so the best currency will have a value that depends on peoples belief that the issuer will defend the value of the currency. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

How to enter the US without a visa?
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

This is somewhat off topic for cypherpunks, but alt.forgery is dead, so cypherpunks is probably the nearest group. Suppose (hypothetically) an American resident cypherpunk had a hypothetical friend who is most unlikely to obtain an American visa. Now the standard way of dealing with situation is for an American friend to get a certified birth certificate of someone born in America, concoct some photo ID, send it to the out-of-America friend, and then the out-of-America friend comes in through Montego Bay or some similar point where there is lots of tourist traffic. But the thought struck me that this might not work for some one who hypothetically has a foreign appearance and a truly terrible accent. Now a fake greencard would probably work, but greencards have age and sex etc encoded on them, and conceivably they check them against a database, in which case it would be necessary to obtain the greencard number of a real person of the right age and sex, which is not easy. Any suggestions? Surely lots of people have dealt with this problem already. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

vogon punk haiku
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

looking down his nose, Senator Exon banned it Haiku's not a crime Rights groups lobbying politicians waffl"ing Cypherpunks write code At First Virtual tense hot alien in barn encrypts no message Later releases in some communications there are signatures digicash tokens no one knows what you're buying follow the money Senator Exon! Imminent Death of the Net! GIFs at eleven! what they cannot read they don't want to let you say you must encrypt it Crypto power tools cannot be exported yet? how can they stop them? Freeh is watching you Big Brother is watching you NSA listens #ifdef crypto you cannot export this code #endif crypto if code is outlawed bhgynjf jvyy unir cevinpl talking to their friends Beating a dead horse idle thoughts typed on a train need more ideas Senator Exon And the horse he rode in on ******* indecent #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 01:59 AM 3/26/96 -0800, Timothy C. May wrote: >At 7:08 AM 3/26/96, Shabbir J. Safdar wrote: >My point is that I see no compelling legislation that is needed. If enough >people in Washington really want increased length in _exported products_ >(remember the "exported" part), the Congress and the President should find >it easy enough to get said products on to the Approved List. (I note that >the Leahy Bill really doesn't change this system anyway...some products go >on the list, some don't...the law only seems to say that when the horse has >already left the barn, i.e., when "comparable" products are already in >fairly wide use outside the U.S., then the products should be put on the >approved list. Big deal. There is, however, a slightly different way of looking at this. For centuries, there was a saying "Nature abhors a vacuum." While not scientifically correct, from the standpoint of people living below an ocean of atmosphere it seemed to be true. Likewise, the political system seems to abhor a situation where there is neither law, nor a proposed law. The best tactic might be to insist on modifications to the Leahy bill, most of which are quite justified, but cumulatively will be seen by "the enemy" as being so extreme as to be unacceptable. At that point, the enemy may actually agree with our assessment that no law is better than the corrected Leahy bill, and we'll both walk away satisified with the "no law" option. Think of it like pouring sugar into a gas tank. [stuff deleted] > >And, frankly and bluntly, while I am not as extreme (in some ways) as, say, >Jim Bell, in other ways I and many others of us are quite extreme. Hey, see, I'm useful! I make you look more, uh, "reasonable", right? Jim Bell jimbell(a)pacifier.com

1 0

Re: So, what crypto legislation (if any) is necessary?
by shabbir＠vtw.org 17 Dec '03

17 Dec '03

I think this is a very important area to consider, and I thank Tim for putting his thoughts into this very organized form. My replies: Timothy C. May writes: >>If the Leahy bill is unacceptable, what legistlation is necessary? I >>can't see how the use of cryptography in the commission of a crime needs >>to be a separate offence, but I could see how it could be treated as a >>special circumstance - that doesn't really needed a new law though. > >I don't see any compelling need for U.S. legislation. And given the >pressures to attach all sorts of language to bills, I think it best that no >legislation happen. Unfortunately, this is not an option. Legislation will happen, with our endorsement or without it. One good example is the Grassley computer crime bill earlier in 1995. Nobody advised him on this, as far as I can tell, he just went out and drafted it. Lo and behold, he drafted a provision that basically criminalized all crypto, including rot13. We have to wake up and learn from the fight against the net censorship legislation. This is realpolitik. Congress will legislate crypto, whether we want them to or not. This is not news anyone wants to hear, but we have to face up to it. >* DOMESTIC USE OF ENCRYPTION: Currently, no restrictions whatsoever. No >laws saying messages can't be encrypted, no laws saying keys must be >escrowed, no laws about permissable strength of ciphers, no special laws >covering disclosure of keys. Just silence, blessed silence. The >Constitution says there shall be no laws about permissable speech (what >language one speaks in, or writes in), and other provisions about compelled >testimony seem adequate. Congress has discovered the net, and partly though the widespread fame of this list, they have also discovered crypto. Simply saying, "we don't want any laws that address crypto" may be the ideal solution, but that won't stop them from passing laws that govern the domestic use of crypto. >* EXPORT OF CRYPTO BEYOND U.S.: This is indeed a thorn in the sides of U.S. >companies, but is not _per se_ an issue I worry about. So long as I have >strong crypto, I don't really care too much about export. It would be nice >to get the ITARs modified, but not at the risk of adding language (such as >Leahy did) making use of encryption a possible crime (we've debated this, >so I won't elaborate here). Besides, I think the best way to overturn the >ITARs is through a court challenge; as I have noted, even the NSA's lawyers >felt that the ITARs would not withstand court scrutiny. Unfortunately, many U.S. software companies don't agree with you. While I agree with you (I've got PGP, what's the problem?), several of these companies are working through their trade organizations to introduce and push crypto legislation to allow them to raise the key length in their products. Put ourselves in their shoes for a minute. They're sitting there, with their 40 bit products, knowing that it blows chunks. They want to produce stronger crypto, but know they won't be able to export it. They talk to the company's attorneys, who speak to speak to the lobbyists, and poof, a crypto bill. >* KEY ESCROW: A matter of contract law, nothing more. If I want to give a >copy of my key to my lawyer, fine. If I want to give a copy to Vince's >Offshore Key Repository, no current U.S. laws stops me from doing so, and I >can even get it to him securely without violating any ITARs by using the >cipher that _he_ uses and then importing it here! > >IMPORTANT NOTE: It is often said, in a correct interpretation I think, that >a third party holding a key (Joe's Key Warehouse) is _not_ covered by the >5th Amendment's protections against self-incrimination, and so must honor a >subpoena. Sounds accurate to me. However, what if Joe is _also_ one's >lawyer? Does attorney-client privilege apply here? Perhaps. A better >solution is also fully legal at this time: use only offshore key storage. A >U.S. subpoena to Vince's Offshore Key Repository will carry no weight in >Anguilla. (Can I be compelled to ask Vince to send my key? Sure. But Vince >and I could have a stipulation that such "duress requests" will not be >honored, no matter how loudly I squawk.) This is actually very important. The Leahy bill forces Joe's Key Warehouse to only divulge your key when they've been presented with a warrant that's on par with whatever they used to get your original communication. That means that Louis Freeh can't issue an administrative subpoena to get your key, after he's got a judge to allow the FBI to search your house. They have to get a judge involved for both parts. It's better than where we are today, where Joe's Key Warehouse is vulnerable to every law enforcement joker that can write an administrative subpoena. We haven't yet had an incident that demonstrates this, but we will. Of course, if you're the sort of person who thinks that the FBI and the Department of Justice are involved in a big criminal conspiracy to begin with, we shouldn't even be talking about due process, as you don't believe it exists... >In conclusion, things are fine as they are. I see no compelling need to >write a special law confirming the rights we already are enjoying. If the >Congress wants to relax the ITARs (fat chance), they can direct that the >language of specific sections be redrafted. (I'm not even sure when and how >the original language was crafted, though it is part, I believe, of the >ancient Munitions Act and/or Trading with the Enemy Act. The enabling >legislation for the ITARs, and especially for the specific items actually >ON the "Munitions List" could be trivially changed. Were this Leahy's >intent, an easy thing to write a bill for. I doubt this was his intent, >however. I think this indeed is what Leahy was aiming for. A quick glance at the bill will prove this out. The approach that "things are fine as they are" is like saying "I'm on a freight train, heading for a cliff, but they're still serving me caviar so it's OK". Sure, it feels ok, but the train's still moving, no matter how far you are into your denial. I can't say this enough: the net has moved into realpolitik. Congress has found us, and their first step is to regulate us. Then, they'll outlaw us. Let's hope we convert enough legislators to netizens before they outlaw us. -Shabbir J. Safdar co-founder, Voters Telecommunications Watch

1 0

Re: Bad news from Judge Richey
by jim bell 17 Dec '03

17 Dec '03

At 11:33 PM 3/25/96 -0800, Timothy C. May wrote: >At 3:28 AM 3/26/96, jim bell wrote: > >>I realize that this may appear to be a rather disrespectful tactic, but have >>you considered reminding the judge that if you are not allowed to profit by >>exporting encryption that the government doesn't want to see exported, >>you'll just have to make money in some other way, and this may lead you to >>talk to Jim Bell about implementing a program using encryption that doesn't >>_need_ to be exported...legally anyway. > >Whoahh! Hold on there, Jimbo! You're crossing the line. > >You're coming perilously close to actually calling for the killing of a >federal judge. My recollection is that a couple of folks have been arrested >and charged for calling for the killing of judges. Now now, Tim. You know me better than that. You know that I would never be so restrained as to call for the killing of ONLY ONE federal judge. Seriously, however, I think you slightly mis-read my letter. The implied "threat", if you are inclined to call it that, would simply be that if domestic software writers are prohibited from exporting encryption software, they might be inclined (and have time for) writing the entire AsPol system into software. Once that happens, we won't have to worry about ITARs or any other governmental impediment. At that point, the danger is not to one specific federal judge, and not even just to all of them, but every government employee at every level, working for every jurisdiction. Judges, I presume, are quite familiar with accepting a sense of personal danger for the consequences of their bad decisions. It would be an entirely different situation, I suggest, if it were made clear to them that the fallout from their misbehavior would ultimately be visited on a few million people. And it would shock them to the core if it were explained that this could be done entirely legally, with the obvious exception of a few unidentifiable people who actually do the anonymous work. Jim Bell jimbell(a)pacifier.com

1 0

Re: WSJ on Big Java Flaw
by Steve Gibbons 17 Dec '03

17 Dec '03

In Article: <199603261814.KAA23974(a)netcom5.netcom.com>, frantz(a)netcom.com (Bill Frantz) wrote: # At 10:58 AM 3/26/96 -0500, John Young wrote: # > Java was originally touted by Sun as a secure language. But # > at least two other flaws have already been discovered in # > the technology, including a less-serious problem uncovered # > by the Princeton team last month. Sun's Ms. Mueller said # > the problems have been correctable details in the way the # > Java code is written, not problems with its basic design. Actually, I suspected and reported the same bug some weeks before the group at Princeton. <URL: http://www.aztech.net/~steve/java/~>. That said... # Having worked on a secure OS, with a small security kernel etc. etc. etc. I # realize that even those systems have bugs. The Java people will work out # their bugs. Others will read their code and find more bugs. (It is to # Sun's GREAT credit that they are releasing their source under a not very # restrictive license.) Eventually, in several years, Java security will be # ready for prime time. This is exactly what I would say. Sun has released source code for what that they label as "Beta Software." I agree with their labeling, and don't fault them for having buglets in beta software. I commend them for releasing souce code. My biggest gripe is with other companies (no names mentioned) who are shipping Java, integrated and "turned on" by default in their "production-level" products. # Of course, for really valuable things, or the really paranoid, you # shouldn't connect your computer to a network. The top dog certificate key # in SET is handled this way. Generally good advice. (SET is an "Alpha Specification" and has its own problems, that I won't go into here, but again, I commend the principals involved for allowing "outsiders" to view and comment.) I'd also add that running uncertified (by the local CA) applications is bad voodoo, and should be avoided, but that's an issue that most admins don't have much real control over in most environments. -- Steve(a)AZTech.Net [ I thought about adding a P.S., but most of you probably don't care what I do for a living, who I work for, nor what I work on, and why. Send email if you're curious. ]

1 0

Re: Crypto CD UpDate (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > It pains me to often be the one who throws cold water on what seems to be a > good idea, and what comes from a well-intentioned person. But I have to > call 'em as I see 'em. And maybe I'm wrong. But here are my thoughts. You know you love it...;) > 1. The CD-ROM "freezes" the various programs, archives, etc. at the moment > the files are finalized and the CD-ROMs are pressed (or burned individually > on a CD-R, at somewhat higher per-copy price). If the author of the CD-ROM > is not committed to updating the CD-ROM at frequent intervals--say, every > few months--then the programs will exhibit "version decay" and be nearly > useless. > The next point is the reason. I do soho consulting and I help provide several of my customers with software of various nature. One thing I have come to realize is that they are not interested in being in the fast lane. They are secure in knowing that the software behaves in a predicible way (not necessarily designed that way either). A large part of this attitude is based in their not being computer anything sorts. I find CD's a great way to keep libraries of old software that sometimes comes in handy. > 2. The Web does a better job at making the latest versions instantly > accessible. True, a CD-ROM will generally have faster access, but I care > more about getting the _latest_ version of PGP, even if takes a minute or > two to snarf off the Web. That I could get an _older_ version of PGP in > fractions of a second off this CD-ROM is not compelling to me. (And > fractions of a second is too charitable: in actuality, I'd have to locate > the CD-ROM, dismount anything already mounted, mount the CD-ROM, search it > for "PGP," etc. Probably not even faster than using Alta Vista and > downloading.) Yes, except it is much easier to track my access to the web than my CD-Rom. > 4. The Web approach allows powerful search engines, links from other pages, > and--importantly--multiple jurisdictions. The PGP could come from the U.S., > the Digital Postage code from Sweden, and so on. And, again as noted in # > 1, the developers could keep improving and iterating the code. CD's are great advertising.

1 0

Random Number Testing (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi Fred, Forwarded message: > Subject: Random Number Testing > Date: Tue, 26 Mar 1996 18:00:26 -0800 (PST) > From: Fred <admin(a)dcwill.com> > > The limitation seems to be in the testing process. > > An inviolable rule of test and measurement is that the testing process > must have a higher degree of accuracy and precision than is expected from > the item under test. If all you have is a non-graduated stick one meter > long, you can't measure increments of less than one meter unless you add > some additional resolution to the system (such as a human's judgment > that the object is four sticks, plus about another third of a stick, > long). Not if I am allowed geometry. I believe such situations are a test of lateral thinking more than any fundamental insite into nature. > > Our ability to synthesize pseudo-random data, and the degree to which > it approaches true random data, is limited by our ability to discern > between the two. If the best testing process available yields the > same results for the output of a true RNG and a particular PRNG, what > can be done to improve the randomness of the PRNG? How could we tell > the difference based on the data itself? What are you defining as random? The definition I use in practice is basicly that if I am given 100% intelligence on a stream of numbers the odds of my succesfully choosing the next number is never higher than chance. All data is random (by definition) until the pattern(s) can be discerned. In this context pseudo-random has a definite meaning, namely that it takes a long time to amass enough information about the data stream to break the chance boundary. The question quickly becomes, how do you test various sequences against one another for robustness? It seems to me that it has to be done statisticaly. One aspect of this is what I call the 'ghost' pattern. In short, in the process of analyzing some random data a pattern is found. Is it possible that there could be more than one pattern (ie interpretation) of the data? Is it possible for a data stream to contain two (or more) messages coherently? If a message does contain two or more coherent messages, how does this affect the size of the data? Can this occur only on messages above a certain size?

1 0

Re:
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 04:42 AM 03/28/96 -0800, Anonymous wrote: >At 12:21 AM 3/28/96, Syed Yusuf wrote: >>If a person who speaks three languages is tri-lingual >>If a person who speaks two languages is bi-lingual >> >>What do you call a person who only speaks one language? >> >>---------------------answer follows: >> >>An American. > >Or our version: > >What do you call a person who has to learn English as a second language in order to compete in the world? > >A foreigner. > >(Sorry for the insult, but it seems that this thread is bringing out insults from foreigners of all sorts.) > >--Tim > > >Dont be sorry! > >Foreigner can atleast speak broken English. Can American speak broken foreign language? As a matter of fact, I speak broken Tagalog, broken Japanese, pidgin Korean, and and can generally make myself understood in Chinese, Thai, Vietnamese, Spanish, and French. Oh, yes, I'm also fluent in Aussie :-) Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMVoK/8VrTvyYOzAZAQHrXAP/ZMOgx+VkqHXCQHBFXIdVVHzlCcJIo3L6 2LyqMnY0cJ5ZFD8mCNsBTTe2DAXFpN1WV03JFym/JIxAuL0TQuN0WKZ2HFSuk997 AZPo21whZbXVQlRGrr6JjiR8p2nqHMMBpNC2bfr2r/rny7UmnGGp8C1e6crPtrQF PiyDbd20zbM= =Swae -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0