December 2003 - cypherpunks-legacy

Re: Reasons in support of crypto-anarchy WAS Re: Why am I wrong?
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 03:43 AM 2/7/96 -0800, lunaslide(a)loop.com wrote: > Now, in respose to Mr. Bell. As I stated above, I found your proposal > [assasination politics] absolutely facinating, to say the least. > [...] > However, I must point out, and I'm sure you realize this, that it would not > be adopted by the public at large for some time to come, or more likely > never. There are too many people who believe that it is wrong to take a > life for any reason and that no action justifies death. This, of course, explains why war is impossible these days and why the public is outraged whenever the government executes a murderer. :-) --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

A Warning Re: Hardware RNG support for PGP 2.63
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- rngaugp(a)alpha.c2.org wrote: > Here is the README file that comes with the modifications. > - ------------------------------------------ > Hardware Random Number Support for PGP. > PGP 263 international version > > Ever get tired of typing in keyboard timing strokes while generating a > PGP key? Ever want to use PGP unattended, but be foiled because there is > no one there to type the keyboard timing strokes? > > Ever wonder if PGP's method of generating random number might have some > subtle flaw which would expose it to cryptanalysis?[..] Ever wonder that a random number device driver or hardware will have a subtle flaw??? Relying on the /dev/random NOISE.SYS driver now while it's still in beta isn't nec. a good idea. For experimentation, sure. I'm also rather concerned as to how this version of PGP handles it. Very much so. The current and latter versions of NOISE.SYS parallels the Linux random.c driver in that there are two devices, /dev/random and /dev/urandom... the older versions (pre version 0.4) will return as many bytes as are requested (from /dev/random) whereas the current version returns only as many bytes as are conservatively estimated to be "truly random". If you are using the older NOISE.SYS /dev/random or the newer version's /dev/urandom for key generation then essentially you're using a pseudo-RNG based on SHA rather than real random data. The implementation should try to get as many bits as are needed from the driver and then request some keystrokes, collect more data, etc. until you have enough bits (advantage over older PGP method? You only need to sample from driver, and not worry about processing raw samples yourself; driver also samples from other sources than keystrokes as well...) I'd be wary of relying on NOISE.SYS or any similar driver for PGP-key generation until the driver gets more thorough examination; I'd also be VERY wary of an improper use of the driver. - --Rob (who wrote NOISE.SYS). - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMRjSNSoZzwIn1bdtAQEn+wF/ZxQKqOCRyKrJjmdtYtE2kVG6v+3NkOOb 84JMpWkpzkMVe8L7LHr7bLdgzkVxDB+8 =m54+ -----END PGP SIGNATURE-----

1 0

Re: [noise] the individual and the tribe
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

>Rob said: >> ... in the sense that >>tribal societies are individualist. Jean-Francois Avon (JFA Technologies, QC, Canada) wrote: >I absolutely don't agree. The subordination of the individual to the tribe >is fundamental of their vision of the world. Some tribal societies are individualist, some are not: Most of the myths and legends of the Australian Aboriginals have a lone ranger character as the hero or villain, or at least most of the ones that I have read feature a person whose life is dramatic or heroic in part because he is tribeless, perhaps for the same reason as most heroes in Disney cartoons are orphans. Individualism is not about the >personnal opinions, it is about the vision of Man as an entity in itself, not >a type of cattle that owe his service to the collectivity of the tribe. > >Crypto makes the tribe (and it's sorcerers) loose their grip... :) > >JFA > > > --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Strong Crypto Weak
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

>The seven experts who wrote the new paper -- "Minimal Key >Lengths for Symmetric Ciphers to Provide Adequate >Commercial Security" -- say the achievement by the >students at the Ecole Polytechnique was trivial. For this they needed "designated heros" ? Have been saying the same thing for two years. Warmly, Padgett

1 0

Re: Fair Credit Reporting Act and Privacy Act
by Peter Conrad 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi, Duncan Frissell wrote: >At 08:25 AM 2/5/96 -0500, Frank Willoughby wrote: > >>If the Privacy Act were rewritten to be as strict as the BDSG, businesses >>would have a (mandatory) legal requirement to: >> [...] >Unfortunately, it would also: > >* Require government registration of computers and databases containing >information about people (whether these computers are used by business or >individuals). This eases regulation of computers and future confiscation. This is not true. Individuals are not required to register anything, the BDSG simply does not apply do them (see. Par. 1 Section (2) ). Businesses are required to register (besides their address and the kind of business they do) a person who is responsible for any personal information they want to keep and a general description of the kind of data they intend to keep (see Par. 32 Sect. (2) ). Computers are hardly mentioned anywhere in the BDSG, in fact, most of it applies to any method of processing personal information. It doesn't matter if a business keeps data printed on paper or stored in a computer. >* Reduce market efficiency by making it harder to match buyers and sellers >(because neither could easily find out about he other) thus causing higher >prices and poorer people. Oh well. In the past buyers and sellers have always found each other without keeping large databases. Most buyers are quite capable of finding appropriate sellers (that's what advertisement and commercials are good for). The goal of the BDSG is to give the individual control of information kept about him. An example: The Deutsche Bundesbahn issues so-called 'BahnCards'. If you buy a BahnCard you can use the Bundesbahn-trains for half the normal price. Until a couple of months ago, the Bundesbahn gave all the information they got from their BahnCard customers to the Citybank AG. The Citybank AG sent their junkmail to all Bahncard customers and tried to make them get a credit-card. This was in violation of the BDSG. And I still know where to get a credit-card if I want one. >* Do nothing to protect personal information from the government which >would get to collect more of it than ever in the course of enforcing data >protection laws. Oh yes it does. The same rules (or even stricter ones) that apply to businesses apply to all government organizations. If any government organization (even the police) violates the BDSG you have the right to file a lawsuit against the organization (or the individual who violated your rights). >If you don't want people to know things about you, don't tell them. You sometimes have no choice. Those of you capable of understanding german might take a look at http://www.fh-ulm.de/bvd/gesetz.html Bye, Peter NB: I subscribe to this list through a digest only. Please CC: me on followups. - -- Peter Conrad | "They say time is the fire in which we burn." Am Heckenberg 1 | Dr. Soran, Star Trek - "Generations" 56727 Mayen Germany Email: p_conrad@informatik.uni-kl.de,conrad@unix-ag.uni-kl.de -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAgUBMRiPe7FFskV8RCVHAQEMwQP7B6/QSo0E8bAiPcusg9+Etzx+WdIi6nuP WVvnJ7RWrwoScnPkRJs7uaBfCpedFu3TZX7RyOm6bVAX4mwFe/dtqhBxcy8U3lQg fqa3WUAhyBNPcr6tF38sVocKs6hWRiw+KckzvnCx9grJpqVHz6kvimAcVOIg027O Zzk8jyopYDw= =PBa7 -----END PGP SIGNATURE-----

1 0

Re: CypherPunks as Teachers; source material [Re: Hey,we are quaint! , (Was: A Sign of the Future)]
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"attila(a)primenet.com" "attila" 6-FEB-1996 02:05:25.34 > Jefferson certainly would role over at the degeneration of "his" party which began in the 30s as liberal news, particularly radio, demagougues discovered they could fan the riff-raff and control the direction of government. --------------- An interesting example of Jefferson's thoughts on the subject of the "Natural Aristocracy" can be found at http://ils.unc.edu/~vreer/aristoi.txt -Allen

1 0

Re: Telecoms Bill
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: Deranged Mutant <wlkngowl(a)unix.asb.com> >Encrypted/truly anonymous ftp would be nice (though some folx would understandably have problems with truly anonymous uploads, and crypto export restrictions in the US could be problematic legally). I think there is already work on encrypted telnet (stel) by the CERT/IT people. ---------------- If a completely encrypted http method (ssl) is indeed available, a (clunky) solution to both of the above would be a web proxy on an encrypted server that would act like a ftp or telnet proxy. I'm not sure about the limits of the html language for doing this (updates, et al)- it may have to be graphics to the user and form input back, which would take a while. -Allen

1 0

Re: Assassination Politics--isn't it gambling?
by banelaw＠med.com 17 Dec '03

17 Dec '03

Jim: as to "Assassination Politics." Isn't the structure you describe gambling? Placing money on a prediction, with the correct predictor winning? And if so, isn't it illegal if done over the wires, i.e., federal commerce? I'm not looking for a way to declare your scheme illegal, I'm just pointing out that there are other angles, especially if done over the wires. I guess you could move the structure off shore--pity the poor country hosting such an entity! If you were at all succesfull, the server accepting digital cash would be moving from place to place--remember pirate radio? Philip BaneLaw Suite 210W 1800 112th Ave NE Bellevue, WA 98004 206.455.5537 Fax:206.812.2032

1 0

RE: Why am I wrong?
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

(Was referring to the govs ability to control communications *with them*) >Perhaps I do not understand your point. They can perhaps >control the communication between them and me, but not between me and >everyone else. Ok please view my three points fromn the standpoint that so much of the total traffic would be affected by at least one, that "uncontrolled" communications would be minimal. >>2) communications using someone else's equipment/network (university, >> employer, etc) >Employers nor universities have any jurisdiction over whether you use >encryption in your transmissions while using their networks unless it >specifically does not allow it when you first agree to have an account with >them. I think you had better review the concept of "property rights". Unless you have a contract that says you can, or can establish "expectation", the property owner who allows you to use their equipment may control how it is used. >>3) communications with anyone (Internet merchant, etc) who says "this >> is not what <MasterCard|Visa|AmEx> approves..." >I don't quite understand your meaning. I am a merchant and I encourage my >customers to use PGP when they send information over the internet, whether >to me or to anyone else. That is fine but what if MasterCard refuses to accept this method ? (Not saying they will, just "what if" ? You are free to use digicash if you want but is not "legal tender for all debts public and private". >Comments? Bring 'em on! :-) I dood it. Warmly, Padgett

1 0

Internet Passports, Identity Escrow, and Back Doors
by tcmay＠got.net 17 Dec '03

17 Dec '03

lmccarth(a)cs.umass.edu risks violating the terms of his PC probation by writing: >I just sent this to the remailer operators' list, but it may be of interest >here too. I think Tim or Lucky or someone suggested something like GAI >(Government Access to Identities) here a while back.... > >Forwarded message: >> Lance writes: >> I hypothesize that the Strassmann & Marlow paper is meant to lay the >> groundwork for some sort of eventual Government Access to Identities proposal >> (which would more likely be termed "identity escrow" by the Feds). It's >> about the only way I can reconcile statements like the following >> (juxtaposed by me, not them): Indeed, several of us have written extensively about the rationales for "is-a-person" credentialling by government, what I have quipped is a kind of "identity escrow" (further abusing the term "escrow"). I lack the time to write a concise summary, so will instead mention a bunch of points. Searching the archives for mentioned terms may yield more comprehensive articles. * "Internet Driver's License." This is not just a joke, although the reported systems are not called this. But the idea is the same. A credential, probably a signed key certificate, that is granted after proof of age is presented. (For example, one might show a passport or conventional Driver's License at a Post Office and they'd issue a signed key....something they'd like to get into the business of doing, from various reports.) * An age credential such as this is essentially going to be necessary, in the worst case, for accessing the Net and Web. If the CDA is upheld--which may take several years to decide for sure--then sites will probably have to take positive steps to verify that users are not minors. Unless they carry only G-rated Barney material (but no Barney jokes, as children might be traumatized). * This age credential obviously cannot be just the "I swear that I am old enough to view adult images" sort of click button. (Although it mostly works with ordering adult material through the mail to immunize a provider, except in this case there is the additional "check" of mail delivery, where a postal carrier may may informal inquiries about the age of the recipient. Plus the parents can intercept the subscription to "Hustler" that 14-year-old Johhny ordered.) * The various schemes for signature authorities, which I admit to not following very closely, all the stuff about Verisign and whether Netscape will or will not accept signatures of rogue signers....all this suggests a worrisome situation in which all messages must be signed by the True Name (see above) of the message originator. (For a good fictional treatment of this, see John Brunner's "The Shockwave Rider.") * Remailers and Web proxies obviously represent an end-run around the CDA and key escrow, in various ways, so I think it likely that these will come under attack. The legal means of attacking them may be one or more of the following: - holding the remailer site operator legally responsible for what can be traced back to his system, especially if in plaintext. (This would make the last site in a chain of otherwise-encrypted messages especially vulnerable if the message is delivered in plaintext to the recipient. Of course, with wider use of crypto, the message can be delivered in encrypted form. I see more and more remailers insisting on encrypted (high entropy) messages.) - for sites that charge any kind of fee for remailing, extensions of the business laws to require that logs be maintained ("so that customers can dispute bills"!!). These logs could then be subpoenaed to aid in tracing messages back to origins. (Sure, it gets hard when hops outside the country are involved...I'm not saying this'll be easy or effective, just a possible avenue of attack on remailers.) - finally, outlawing of remailers and proxies. Or extensive registration of them. (We've had this debate a couple of times, about whether mail-forwarding services really have to register, get proof of ID, send records along to the government, etc.) * Identity Escrow obviously fits in closely with key escrow in general. In closing, I think the next couple of years will see increasing pressure to require some kind of "Internet Driver's License," at least within the U.S. Other countries will jump at this (Germany, China, France, the usual suspects). Call it an "Internet Passport." For some interesting insights into the thinking of some in the crypto community, go back to around 1986-8 in the "Crypto" Conference Proceedings and you'll find some papers, by Fiat and Shamir I believe, on the "problem" of "rogue governments" (they cited Libya for their example) issuing "false passports." (I have commented in the past that the U.S. government has a reported 50,000 or more people in the Witness Security (aka Protection) Program, under the U.S. Marshal's Service, and reserves the right to create completely fake "legends" (dossiers) for these people, including false credit records, false education records, and false employment records. Not to mention their various secret agents. Clearly the government would want "back doors" into any Internet Passport system!) --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0