December 2003 - cypherpunks-legacy

Re: Cryptanalysis
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:45 PM 3/10/96 -0500, you wrote: >IS there anyone outside of governments, doing code-breaking _for a living_? Don't know if it's a full-time income or not, but there are certainly several people offering commercial products for cracking Microsoft and other popular word processor encryption for people who've lost their passwords. And people who are designing good cryptosystems to protect information have to understand how to crack them, so they can tell whether their new system is stronger or weaker. But there's usually not much other legitimate need for cracking real messages; the authorized people usually have the keys. Whether there are also Bad Guys doing the job for profit, I don't know. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

Re: Leahy and Mrs. Bemmis (now that's a subject line)
by jim bell 17 Dec '03

17 Dec '03

At 11:24 AM 3/11/96 -0500, A. Padgett Peterson P.E. Information Security wrote: >The Leahy bill is flawed in two areas. Sent a message with proposed wording >to Sen. Leahy via his web page but have not gotten a response. Have a bad >habit of reading laws without thought since this is how LEA and prosecutors >are told to enforce them - as written, not as believed. If an area is >vague, a court is required to decide how to interpret it, not LEA. If badly >written *everyone* loses. Unfortunately, this is not the way CREATIVE prosecutors enforce laws. _THEY_ try to be imaginative, "pushing the envelope" as it were, and expect the courts to stop them. Sadly, those same courts often have ex-prosecutors as judges, people who aren't particularly inclined to dissuade the abuse of laws. (exceptions exist, obviously.) >At the same time am pragmatic enough to accept the idea that it will have >no effect unless it passes and to be passed today it must have something >like the criminalization statement. I've occasionally seen statements like this, but the people who make these claims never seem to back them up with reasoned commentary, let alone facts, which would help to establish that this particular section is a "must" to any particular supporter, certainly not a substantial number of supporters of this bill. Even a quote or two from some political-type saying, "We need that section to pass this bill" would be better than nothing. I'm not suggesting this is totally implausible; merely that it would be lunacy to _assume_ that the bill "needs" this clause to pass, without more evidence or even opinion expressed by key people. It's almost as if you people have surrendered before the "fight" even has begun. _NOW_ do you understand why I'm so astonished at your reaction to this bill? Tim May would object to my use of the word, "Sheeple" here, but I think it fits absolutely. Anybody who would allow himself to be spoon-fed this _entire_, unrepaired bill _IS_ a "sheeple." Anyone who invents some requirement that this bad section be in place is WORSE. Furthermore, if any people (for example, Senators and Representatives) actually are willing to publicly stand up and insist on that section, then I'd say that's a cue for us to ask them some very hard questions. You seem to be unwilling to put them to their proof. I recommend that you stop living DOWN to your reputation, Padgett. > The goal here should not be to throw >it out since that would simply cause the whole bill to fail, Again, you do NOTHING to support this claim. How do you KNOW this to be true? And even with that knowledge, presuming you have it, why are you apparently not planning to use it to our best advantage? Why not try to "smoke out" some of the people who have conspired to include this section into the law? I'll bet they're hoping nobody questions them on their motivations! Moreover, does this comment indicate that you've had conversations or seen information that indicates that the presence of this part of the bill is necessary to its passage? And you're not TELLING US the details of that conversation or information? Suggesting that you're happy to sell the rest of us out? Hmmmmmm? Or are you just jumping to a conclusion? Padgett, the more you say the more you destroy your credibility. > but to word >it carefully enough that it satisfies those who reguire laws Huh?!? Who "require[s] laws"????????? _I_ certainly don't "require" this section to be there, and so far I haven't seen anyone on CP who _personally_ would insist on the presence of this section to condition his support the entire bill. Quite the opposite; most people express varying degrees of reservations about it. > while being narrow enough to avoid exploitation. IMNSHO the best way to do that is to >require that: >1) A felony occured (curiously misdemeanors were ommitted) > and >2) That the individual to be charged was an active participant (before, > during, or after the fact) The problem is, what is your definition of the words, "active participant"? And will YOUR definition actually be the one included in the law? I, on the other hand, see no reason to add crimes, since the implication above is that the person involved is ALREADY prosecutable in court. Why all this "piling on"? On the contrary, I believe it is absolutely certain that this clause will be used to prosecute people who are not otherwise prosecutable or convictable of any other crime. It's curious that you don't see that. > and >3) That encryption was used in furtherance. > >Note: that in the US (1) and (2) seem sufficient for a criminal charge to be >brought, so does (3) really add anything except words or possibly severity ? I sure wish you were better at answering your own questions... >Seizure seems to be a great concern of the group with the point of the >Bemmis Pontiac being brought up. For someone providing a free remailer, >that is a valid concern since the first question a court might ask is >"what was the motivation". I suspect that someone providing a remailer >and charging a reasonable fee to all who might want to use the service >might be in a much better position (not a lawyer so not allowed to know). Playing into their hands yet again, I see! Raising the price is merely a diluted form of banning, BTW. So far, people implement remailers because running them is a comparatively minor cost, and they feel that there is a need for those services. If there was some sort of de-facto rule that the operator had to charge for those services, this would complicate the use of anonymous remailers even more, deter their use even further, and achieve the government's ends just about as surely as a downright ban would do. In fact, accepting a fee might actually INCREASE the liability of the operator, not reduce it, because the remailer operator would have a financial stake in the use of his remailer. He could no longer argue that he did not "benefit" from the abuse (use) of that remailer. >One indicator might be easy to check: Has there ever been a seizure >involving a rental car (Hertz, Avis, etc.) and if so, what was the >disposition ? Well, given the fact that these auto-rental companies do billions of dollars of business each year and are known and "loved" by one and all, you could not use the (supposed) fact that no such incident occurred as some sort of positive sign. Any prosecutor is well aware that he may need a rental car some day, and angering a multi-billion dollar company is not something you do lightly. OTOH, if you discover that EVEN THESE organizations are liable for the transgressions of their renters, either civilly or criminally, that should give you fair warning that anyone smaller (especially an individual running a remailer) and less able to defend himself is certainly going to be a target eventually. Even a failed attempt to get a car rental company to be liable for something done by a renter is a sign that prosecutor was inclined to go after a big target, suggesting he wouldn't think twice before he tried to haul an individual into court. Do you think a person would operate a remailer if he thought it was likely he'd get prosecuted and have to pay thousands of dollars in legal bills, even if he were eventually acquitted? Remember, his legal bills won't be reimbursed by the government, though I believe they should be. Too bad you can't see this, huh? Jim Bell jimbell(a)pacifier.com

2 1

Re: anonymous web pages (Was: SurfWatch)
by Gary Howland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Nelson Minar wrote: > cp(a)proust.suba.com (Alex Strasheim) writes: > >Has anyone ever considered setting up anonymous web sites on top of usenet? > > I proposed this a couple of months ago, there should be a bit of > discussion left over in the archives. My idea was to have an account > keyed to a password - if you emailed the server with the right > password, it would take the text of your email and put it in the > specified URL. Then you can use remailers to preserve anonymity with > the server. It's sort of like the alias.c2.org accounts. Cant it be done with a web page consisting of usenet references? eg: <HTML> <HEAD> <TITLE>Test</TITLE> </HEAD> <DL><p> <DT> <A HREF="news:199603100645.XAA00982@nelson.santafe.edu?headers=all"> Test of news post </A> </DL> </body> </HTML> Gary - -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)kampai.euronet.nl> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06 - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMUQJISoZzwIn1bdtAQHsGQGA1a69oJvSO7KXYGVlRzy8H14IxwzIyybK nsWo5tA9fLsGI8qt1o9hBkNdKEfvMt0H =qiC8 -----END PGP SIGNATURE-----

1 0

PGP : what to do when a user ID has multiple RSA keys
by savron＠world-net.sct.fr 17 Dec '03

17 Dec '03

My DOS version of PGP 2.6.2 came with a built in PUBRING.PGP containing two keys ( 1024 and 512 size ) with the same user ID . For testing purposes I wanted to encrypt a message with the 512 length key , but only the 1024 size key could be used . How can I select the right key , apart from making a clone PUBRING.PGP with only the key I want to use ? Any comment welcome

2 2

Re: Leahy bill nightmare scenario?
by Gary Howland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Dan Weinstein writes: Dan says "you" wrote: > > Question: What, exactly, is the motivation of a person running an > > anonymous remailer? His motivation is clear: To allow people to > > send anonymously untraceable messages. Assuming he's of ordinary > > levels of intelligence or beyond, he is aware that somebody may some > > day use his system for illegal purposes. You're going to have to > > explain why a court _CAN'T_ interpret this as being in violation of > > the law. > > If I rent cars, someone might one day use a car rented from me in a > robbery. Does that make my an accessary? NO. This is an unfair analogy. Now if you had said that you rented cars without asking for proof of identification, thus making your car hire centre very useful to robbers, that may more closely resemble the anon-remailer situation. Gary - -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)kampai.euronet.nl> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06 - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMUQKsCoZzwIn1bdtAQFvMgF+M2YV6V31uBGswLkZtltCnwZ+Gwn3gavf 2KeYva5tb1+myr3plgxgXEvHe8wt3lXZ =vQMv -----END PGP SIGNATURE-----

1 0

Re: Remailer passphrases
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:51 PM 3/12/96 -0500, Perry E. Metzger wrote: >Bill Frantz writes: >> One of the reasons classical (government) crypto users change keys >> frequently is to minimize the amount of data compromised by a broken key. >> We keep hearing about NSA decrypting 20 year old cyphertext and showing >> more of the workings of the atomic spy rings operating in the 40s and 50s. >> If an opponent can rubber hose the key, her job is easy. If she has to >> perform cryptoanalysis, it is much harder. Remailers should regularly >> change their keys to avoid compromising previously recorded traffic. (They >> can have a long lived key for signing their traffic keys.) > >Signed Diffie-Hellman key exchanges have the property known as >"Perfect Forward Secrecy". Even if the opponent gets your public keys >it still will not decrypt any traffic for him at all -- it just lets >him pretend to be you. Thats one reason why protocols like Photuris >and Oakley use the technique. Unless I am badly mistaken, these exchanges need interaction, which makes them unsuitable for simple remailers. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

4 4

Re: What about PGP? (was Re: Leahy Bill a Move to Slow Crypto Exports as Much as Possible)
by shabbir＠vtw.org 17 Dec '03

17 Dec '03

Mutant Rob writes: >Timothy C. May wrote: >> I think this is showing that one of the intended purposes of the Leahy bill >> is to slow down exports of crypto for as long as possible, and then only to >> grant export licenses when competition from abroad threatens to undo the >> effects of the stalling process anyway. I think this is somewhat skewed. Let's look at our situation now: We don't get to export much crypto software. The Leahy bill takes us to: We get to export lots of software that is "generally available", "in the public domain or publicly available", or if similar products exist already in other countries. (That's a lot of stuff, but it's not the whole enchilada.) We want to be at: We get to export all crypto software. (I mean legally; I think we all know that export controls don't work against someone with enough brains to post news, send mail, or use ftp) This is a pretty good improvement in the situation, and will hopefully pave the way for the "whole enchilada". It's not good strategy though to criticize this because it's not the ultimate crypto bill. Let's be honest with ourselves here, this is Congress we're talking about and this is a pretty bold step. We need to educate them to see the facts we understand so thoroughly: that crypto export controls do not work, endanger our own requirements for confidentiality, and aren't helping contain this technology in the rest of the world. Forcing Congress to have this debate will lay bare these facts and hopefully embarass the Administration for their absurd policy approach on encryption. They say that liberty is seldom lost all at once, but a little at a time. Regaining it is probably done this way as well. In this case, the Leahy bill gives us back a mouthful. -S > >Hmmm. > >But what about the case of PGP? It's a relatively strong product, and >an international version exists. I'd guess that PGP 3.0 may implement >other algorithms (PK and symmetric), and likely an international PGP3 >would follow... so how could the Commerce Dept rationalize not giving >an export license to ViaCrypt? > >And would a similar, but non-compatible, utility that used RSA and/or >IDEA, 3DES, etc. also be exportable? ... > -Shabbir J. Safdar * Online Representative * Voters Telecomm. Watch (VTW) http://www.vtw.org/ * Defending Your Rights In Cyberspace

1 0

re: Video resolution
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

Note: this refers to the IBM PC & clones only > The point is that they do a lousy job on dithering. So does Microsoft > explorer. They probably purchased the identical code from some clot. Have been watching this go back and forth & get further from the original question as usual. I suspect that if the original poster looks in her/his/ its/other SYSTEM.INI file, the line "display.drv=vga.drv" will be found in the [boot] section. This is the default 16 color driver installed by Windows to be compatible with every 256k 640x480 VGA card. This makes a decent GIF or JPEG - even "64 gray scale" such as the QuickCam produces - look like olifactory solid waste products. To do better, you need three things: 1) A video card with higher resolution (usually at least 1 Mb of video memory is necessary). 2) A video monitor capable of supporting the card's output. 3) An increased resolution (at least 256 colors as the first responder mentioned) video driver to replace vga.drv (YMMV). If any of these are missing, see the second paragraph above. Warmly, Padgett ps the CDA does nothing to block really creative insults 8*).

1 0

TWP on Crypto Keys
by John Young 17 Dec '03

17 Dec '03

The Washington Post, March 11, 1996, p. A18. Security and Software [Editorial] The number of computer users continues to grow, but use of the Internet for business and financial transactions isn't keeping pace. At least, that's the complaint of many who expected a flood of Americans to go on-line for banking, publishing and mail-ordering -- with tremendous profits to the on-line industries that handle these services. One big reason for the lag is customer concern about the safety of information, from credit-card numbers to bank balances and business secrets, in the hacker-rich environment of the Internet -- an eminently reasonable concern that many in the industry believe can be addressed only by the wider use and availability of sophisticated "encryption software," which scrambles information en route, making it indecipherable to anyone who doesn't hold the key to the code. The sense that encryption technology holds the key to future economic growth on the Internet is pushing an arcane but intense argument between the Clinton administration and the computer industry over whether to lift existing restrictions on the export of the most powerful encryption software. The administration, especially its law enforcement agencies, bars on national security grounds the export of encryption software above a certain difficulty level, saying that it needs to be able, if neqessary, to seek and obtain the equivalent of a permit to wiretap. The makers of the software argue that these restrictions are ruinous for U.S. competitiveness in the international market because foreign customers want the most secure encryption available. Some civil liberties organizations argue that the restrictions are an invasion of customers' privacy rights. Legislation introduced this month in both the House and the Senate would ease the export restrictions while attempting to meet some of the government's security concerns. Code makers would deposit a "spare key" to any exported encryption software with a trusted third-party agency -- a compromise the Justice Department and national security agencies also have been pursuing in talks with the industry, but at which the industry hesitates because it fears that the existence of "spare keys lying around" would cause potential customers to balk. (The Justice Department also would like a spare-key agreement for encryption software sold domestically, but has less leverage because such sales require no license.) The legislation would heavily penalize any "key holder" agency that provides an unauthorized copy to anyone besides the government. But it also would make it legal to export any encryption technology that is already "generally available" -- for instance, in stores or on domestic computer bulletin boards. Such a sweeping change, law enforcement authorities fear, could render the other barriers and safeguards in the bill close to academic in the borderless, lightning-quick world of Internet transmission. Once it's widely available overseas, "uncrackable" software or hardware can't be recalled. The U.S. intelligence agencies with their superior computing power can still crack most coded software, if not immediately, then much faster than 99.9 percent of ordinary commercial hackers. But that doesn't mean their concerns should be shrugged off. Like arms sales, encryption technology sales have implications for traditional national security interests as well as the economic kind. The urgent interest both sides share is to get this resolved soon. [End]

1 0

Re: Vexatious Litigants (was: SurfWatch)
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- E. ALLEN SMITH wrote: > > From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 10-MAR-1996 04:29:37.67 > > >Presumably, almost nobody in Europe is going to add these silly Yankee > >rating labels to their web pages, except a few commercial content providers > >who want to sell advertising or services into markets that block > >un-rated web pages. So schoolkids behind rating-mandatory sites > >will have to ask their teachers why the "World-Wide-Web" is just American --- > >"It's got All 50 States, Johnny!" <Exonive deleted>! > > The WWW consortium is approaching European governments about their > rating system - the one found at SafeSurf. > -Allen Disclaimer: I don't work on PICS and I don't speak for the consortium. Actually the European govts are far more likely to see labels being used. In the US a piece of crackpot legislaion has been passed which has some clearly unconstitutional parts. The ban on abortion related speach for example which the justice dept isn't going to defend in any way. I expect that the Exon amendment will eventually be ruled unconstitutional through being overbroad. The problem is that it is difficult to get people to do something voluntarily after ordering them to do so and being overuled by the courts. This is the kind of small minded, foot stomping politics that the US congress is famous for worldwide. In Europe the governments tend to be more aware of their impotence. There is also much less hysteria about kids seing pornography, the main concern is violence and in particular amoral US TV shows for kids, the sort where people beat each other up but nobody ever gets hurt. In France one can buy hard core porn in the supermarket. The govt. is far more concerned about foreign language material. The whole point about PICs is that it is not bound to a single rating scheme. I had a go at producing a spec for a rating scheme back in '94 but gave up since life is too short to waste. The Web is decentralised and anyone can set up shop in it. Now we have a scheme in which anyone can set up a rating scheme. So we will have the kook brigade filtering out material on evolution and the concerned parents preventing their five year olds from viewing the alt.tv.very.scary gifs. Actually this is the main point of the exercise. I can't think of any system which is going to defeat determined 14+ kids from finding porn but its a bit easier to stop the 7 and unders from accidentially seeing stuff that will give them nightmares. Phill - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMURLKSoZzwIn1bdtAQGeWgGA0n4wmvgI8F4UspSxmWJ3Q9C2+LaxVPl7 xy+H0/0QN66VneWZg+h+pNZd3kmLdgOj =+z3H -----END PGP SIGNATURE-----

1 0