December 2003 - cypherpunks-legacy

premail manual info
by test921148＠alpha.c2.org 17 Dec '03

17 Dec '03

Whopee! Just installed premail. But I have a Question on how to use it. I need some Manual explaining how to use Premail and what can I put into its Configuration-file. I use Version 0.43 of Premail. The perl Script is somewhat readable but it is better if some User-manual was available. Send Answers to test921148(a)alpha.c2.org

1 0

INFO: Sen. Burns urges White House to follow NRC recommendations (6/2/96)
by Voters Telecommunications Watch 17 Dec '03

17 Dec '03

============================================================================= ____ _ _ _ / ___|_ __ _ _ _ __ | |_ ___ | \ | | _____ _____ | | | '__| | | | '_ \| __/ _ \ _____| \| |/ _ \ \ /\ / / __| | |___| | | |_| | |_) | || (_) |_____| |\ | __/\ V V /\__ \ \____|_| \__, | .__/ \__\___/ |_| \_|\___| \_/\_/ |___/ |___/|_| SEN. CONRAD BURNS URGES CLINTON TO REASSES ENCRYPTION POLICY AND ANNOUNCES HEARINGS ON THE ISSUE for 6/12/96 REP. RICK WHITE (R-WA) SCHEDULED FOR HOTWIRED CHAT 6/5/96 9-10PM EST SEN. CONRAD BURNS (R-MT) SCHEDULED FOR HOTWIRED CHAT 6/11/96 10-11PM EST Date: June 2, 1996 URL:http://www.crypto.com/ crypto-news(a)panix.com If you redistribute this, please do so in its entirety, with the banner intact. ----------------------------------------------------------------------------- Table of Contents News Text of Sen. Burns' letter to President Clinton How to receive crypto-news ----------------------------------------------------------------------------- NEWS Sen. Conrad Burns (R-MT), principal co-sponsor of legislation to ease restrictions on encryption, yesterday sent President Clinton a letter urging the Administration to reassess its encryption policy in light of a recent report by the National Research Council. The findings contained in the NRC study, released at a briefing in Washington DC on Thursday, raise serious questions about the rational for the Administration's current approach to cryptography policy. The study states explicitly, "Current national cryptography policy is not adequate to support the information security requirements of an information society." In his letter to the President, Senator Burns said that the NRC study presents overwhelming evidence that the current approach to encryption policy has failed. Burns also pledged to hold hearings in the Senate Commerce Committee on June 12 and 26. The night before the hearings (June 11 at 10 pm ET), Senator Burns will be live online at HotWired (http://www.hotwired.com/wiredside) Be sure to save the date and stop by to talk with the Senator about his efforts to encourage the widespread availability of strong encryption and get a preview of the hearings on the Pro_CODE bill. Information on Senator Burns' legislation, as well as information on the NRC report, is available at http://www.crypto.com DON'T FORGET! Representative Rick White (R-WA) will be on HotWired Wednesday June 5th at 9pm EST at http://www.hotwired.com/wiredside/ You can tune in and listen to the chat with the RealAudio software (http://www.realaudio.com) You can ask questions of the Representative through a moderator and get real, immediate responses. ----------------------------------------------------------------------------- TEXT OF SEN. BURNS' LETTER TO PRESIDENT CLINTON May 30, 1996 The President The White House Washington, D.C. 20500 Dear Mr. President, I urge you to reassess the administration's position on cryptography policy in light of the report released today by the National Research Council, "Cryptography's Role in Securing the Information Society." The report was put together by the NRC Committee to Study National Cryptography, which included members from across the spectrum of the business, academic, defense and intelligence communities. The fact that such a diverse roster of our brightest minds could achieve consensus after taking two years to pore over the details of encryption policy is remarkable, and their recommendations should be taken most seriously. The acronym of the report's title-CRISIS-is especially apt given the massive economic and national security costs of the current policy, which severely restricts the export of software containing strong encryption. As the report states, "Current national cryptography policy is not adequate to support the information security requirements of an information society. Indeed, current policy discourages the use of cryptography, whether intentional or not, and in so doing impedes the ability of the nation to use cryptographic tools that would help to remediate certain important vulnerabilities." As the Chairman of the NRC Committee to Study National Cryptography, Kenneth Dam, states in the report "the crisis is a policy crisis, rather than a technology crisis, an industry crisis, a law enforcement crisis, or an intelligence-gathering crisis..." The most recent version of the administration's policy, as reflected in the draft white paper of the interagency working group on encryption, unfortunately reveals a continuing commitment to government-imposed mandates rather than private-sector solutions. The proposal, which was quickly dubbed "Clipper III" because of its close alignment with the earlier rejected Clipper schemes, has the support of neither the software industry nor the Net community. Indeed, as the Committee noted, an essential flaw behind the administration's policy is the continuing reliance on the national security and law enforcement communities to drive the policy through administrative diktat rather than open legislative action. As the report states, rather than vainly attempting to reign in the inevitable widespread use of strong encryption, the administration should be actively promoting it. The use of strong encryption has become vital to both ensuring the privacy of individuals and fostering the growth of the Global Information Infrastructure into the 21st century. As for the national security aspects of encryption policy, the report states that cryptography can protect proprietary information and reduce economic espionage. In addition, strong encryption can protect nationally sensitive information systems and networks against unauthorized penetration. Therefore, the use of strong encryption serves to protect national security rather than hinder it. Simply put, "on balance, the advantages of more widespread use of cryptography outweigh the disadvantages." I further call your attention to specific recommendations by the Committee: *National cryptography policy should be developed by the executive and legislative branches on the basis of open public discussion and governed by the rule of law. *No law should bar the manufacture, sale, or use of any form of encryption within the United States. *Export Controls on cryptography should be progressively relaxed. *The U.S. government should promote the security of the telecommunications networks more actively. *The U.S. government should take steps to assist law enforcement and national security to adjust to new technical realities of the information age. *Aggressive government promotion of escrowed encryption is not appropriate... *The debate over national cryptography policy can be carried out in a reasonable manner on an unclassified basis. *National cryptography policy affecting the development and use of commercial cryptography should be more closely aligned with market forces. A core recommendation of the Committee is that the administration foster an open public debate so that a national consensus on cryptography can be developed. I agree wholeheartedly and hope that the public hearings beginning on June 12 in the Commerce Committee's Subcommittee on Science, Space and Technology, which I chair, will help foster this process. Many of the NRC's recommendations are reflected in the "Burns Pro-CODE bill," S. 1726, which will be debated on that date, with an additional hearing to be held on June 26. Now that some of the best scientific and technical minds in the country have essentially endorsed the position that business and policy advocates have been taking for years, it's time for the administration to come around as well. In conclusion, I can only agree with the Chairman Dam's statement: We believe that our report makes some reasonable proposals for national cryptography policy. But a proposal for action. What is needed now is a public debate, using and not sidestepping the full processes of government, leading to a judicious resolution of pressing cryptography policy issues and including, on some important points, legislative action. Only in this manner will the policy crisis come to a satisfactory and stable resolution. Sincerely, /s/ Conrad Burns U.S. Senator ----------------------------------------------------------------------------- HOW TO RECEIVE CRYPTO-NEWS To subscribe to crypto-news, sign up from our WWW page (http://www.crypto.com) or send mail to majordomo(a)panix.com with "subscribe crypto-news" in the body of the message. ----------------------------------------------------------------------------- End crypto-news =============================================================================

1 0

(no subject)
by ira 17 Dec '03

17 Dec '03

1 0

Re: Java Crypto API questions
by jim bell 17 Dec '03

17 Dec '03

At 09:30 AM 6/2/96 -0700, Martin Minow wrote: >>Today, CP's own Marianne Mueller was scheduled to give a talk at JavaOne on >>the eagerly awaited (at least by this user) Java Crypto API. >---- ---- ---- >Notes from the security birds of a feather session >---- ---- ---- > >-- Need multiple security managers: if any say no, reject the request. >-- Servet, applet need different security managers. >-- Problem with firewalls: client accesses server via firewall via > proxy servers. May not be able to open a URL directly. >-- Java Commerce API coming for payment functions. >-- Problem with foreign applet vendors: how can a non-US security > class vendor certify a class to be used (outside the US). > Currently, it must be imported and signed by Sun. But, then > it can't be exported without a Commerce Department license. > No (current) plans to establish a signing authority outside > of the U.S. We've heard this assertion before. Why not import the software, generate a detachable signature, and then export the signature for re-attachment overseas? Surely export of signatures isn't controlled (even arguably) by ITAR. Jim Bell jimbell(a)pacifier.com

1 0

Insider Trading and Inside Information
by mpd＠netcom.com 17 Dec '03

17 Dec '03

tcmay(a)got.net (Timothy C. May) writes: > And, how can someone who acts on overheard information--as > in the elevator example Sandy cited--be charged with any > crime? Unless they are "insiders," covered by SEC rules > about trading, they are free to act on essentially anything > they hear. "He who hesitates to act on inside information is > lost." > (To elaborate on this: I was never classified as an > "insider" during my time at Intel, and I certainly bought > and sold the stock based on what products and news I knew > was coming out or what rumors I'd heard. Only a select group > of executives and staff in the specific departments > generating earnings announcements, auditing, etc., were > covered. And senior executives are covered by various rules > about trading stocks. And family members and friends may be > covered, if they learn of "inside" (in the SEC sense) > information. The SEC, in cooperation with the courts, has been gradually shifting the definitions of "insider" and "inside information" to more all-encompassing ones. It used to be that an insider was an officer of the company, or someone with a fiduciary relationship to the firm, such as a auditor or investment banker with which the firm did business. Inside information was also similarly limited to a narrow collection of material subject to regulatory restrictions on its disclosure. Nowdays "inside information" has been expanded to include anything that the general public is not privy to, and "insiders" can be almost anyone as well. Indeed, the current definitions can subject to criminal sanctions low level employees trading their company's stock on the basis of rumors, or newspaper columnists trading in anticipation of reaction to their published speculations. It's not even safe to trade on what formerly would have been known as "hot tips" any more, unless the average person in the street had a mechanism to access the information. The legal theory behind all this is that anyone, no matter who they are, trading on any publicly unavailable information, no matter what it is, might be perceived as profiting at the expense of the zillions of ordinary investors, whose continued playing of the Stock Lottery^H^H^H^H^H^H^H Market the govermment and big business definitely want to encourage. Not to mention the huge public support for the prosecution of anyone who the public thinks has "gotten away with something" that Joe Six-Pack didn't have the opportunity to do, and made a few bucks in the process. If this trend continues, I won't even be able to take an Intel janitor to lunch, and trade the stock based on his impression that Andy Grove looked particularly happy while having his office cleaned, without risking an "insider trading violation" should the stock go up. A new and interesting manifestation of the "Surveilance State." -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Re: Ok, what about PGP (was: MD5 collisions)
by Deranged Mutant 17 Dec '03

17 Dec '03

On 30 May 96 at 1:26, Chris Adams wrote: > How about a NSA-stomper option that would use all-of-the-above? For the truly paranoid (or > owners of Pentium-Pro 200Mhz multi-processor machines Chances are that if the algorithms alone aren't "NSA-stompers", an all-of-the-above option won't be. > Also, what's the verdict on IDEA? Is there a switch yet that would allow straight RSA? > (with the obvious speed decrease...) That would actually be less secure. RSA may be PGP's weakest link. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

penet to be compromised again? More Scientology lawsuit crap
by Deana Holmes 17 Dec '03

17 Dec '03

I just received some information on IRC channel #scientology that Julf Helsinghuis is being sued by $cientology *yet again* for a name. Apparently this has to do with the deposition request to Homer Wilson Smith (lightlink.com) Scamizdat #3 was posted through lightlink.com and the $cientologists have wanted for a long time to figure out who did it. (Which is why they sued Grady Ward.) Homer, in response to the deposition request, consulted his logs, and said that the original post came from penet.fi. So $cientology has apparently gone to the Finns again to ask that Julf be forced to give up the name. I'm appending a copy of the IRC log, as I'm too lazy to edit it down to particulars. It includes the name of the police officer involved (Kaj Malmberg) as well as a Finnish newsgroup and article id for the whole story. If someone knows Finnish and can give a rough translation, it would be terribly appreciated by a lot of people. <enclosed IRC transcript> <Ignatius> hi guys... do you have the latest news on Julf Helsingius' case? > Ig: what do you mean, latest news? <Sherilyn> The julf case? * Sherilyn didn;t know there _was_ a julf case... <Ignatius> ok... copyright offences are crimes under Finnish law, not torts. <Ignatius> Kaj Malmberg, the Finnish police officer who handles the investigation of the copyrighted material through penet.fi, posted an article to a domestic newsgroup today. <Sherilyn> Do you have the message-id and group name? <Ignatius> the scienos have filed a motion at a local court in Helsinki to force Julf Helsingius to give out the name of the poster. <Ignatius> sherilyn, are you good at Finnish? <Sherilyn> ig: lol! <skaplin> Who posted what through penet?? <Ignatius> the hearing is scheduled for the beginning of next week... perhaps already tomorrow. <Sherilyn> So was penet the server before lightlink in the scamizdat case? <Sherilyn> Homer gave them the name of the prior server, or was going to *** skaplin changes topic to "Penet under attack...Again!" <Sherilyn> Well this needs to be put out loud on groups where people use penet <skaplin> Ignatus: How good are you at translating? <Sherilyn> Last attack on penet got the scientologists a very bad rep > Ig: We need that post. > IN ENGLISH > ASAP! > even if it's a lousy translation. <Sherilyn> This cop guy speaks English <Sherilyn> Didn't he post in English to a.r.s.? > Sheri: he may not want to post it on a.r.s <Sherilyn> It's true, skap <Ignatius> i don't know more than what I already mentioned. The police officer didn't even mention Scientology; he just mentioned that he was investigating a copyright offence. <Sherilyn> She would make a lovely domina > sheri: you should see what I'm reading now :) <skaplin> We're sure penet is under attack for a name though... <Sherilyn> Bloody hell fire! <Sherilyn> I have 6440 posts downloading! <Ignatius> i'm writing an article to post to the ng:s, but it's obvious we don't have all the bits of the puzzle yet. <skaplin> Want some kippers with your spam sheri?? :) <skaplin> Ignatus: What newsgroup was it in? > ig: please post it asap. > also, send it to rnewman(a)cybercom.net. <Ignatius> skap, sfnet.keskustelu.laki; <4os5bu$flp(a)idefix.eunet.fi> <Ignatius> the police officer, Kaj Malmberg, is at kaj.malmberg(a)helsinki.poliisi.fi <end of transcript> Deana Holmes mirele(a)xmission.com

1 0

Re: [Off-Topic] "Curfews"
by jim bell 17 Dec '03

17 Dec '03

At 07:45 PM 6/1/96 -0700, Timothy C. May wrote: >At 1:59 AM 6/2/96, Duncan Frissell wrote: > >>Of course curfew laws only control the inarticulate and scruffy. Well >>dressed children (coat and tie for the boys dress or suit for the girls) who >>can claim that they are out doing tons of protected things like work and >>school and worship and political campaigning and "trying to save street >>children for Jesus" will not be picked up. They can also say things like > >This, by the way, is the main thing that concerns certain civil rights >groups (including the Santa Cruz chapter of the ACLU). They say they'll be >monitoring enforcement patterns to see if more "children of color" are >picked up than their percentage in the population represents. This, the curfew situation, is yet another of the reasons I'd favor "playing hardball" with the government. I'm very much against discriminatory enforcement, but on the other hand I don't think my liberty should be dependent on getting an organization like the ACLU to look out for and complain against discrimination against me. I feel if a group of left-handed albinos think the police are being too hard on left-handed albinos, they shouldn't have to convince the ACLU of this, and should be entitled and able to fight back effectively and prevent what they view as abuse. True, such a situation may occasionally lead to abuses, but I strongly expect that those abuses will be far fewer than the current system. Jim Bell jimbell(a)pacifier.com

2 1

Re: Java Crypto API questions
by minow＠apple.com 17 Dec '03

17 Dec '03

Jim Bell writes: >>-- Problem with foreign applet vendors: how can a non-US security >> class vendor certify a class to be used (outside the US). >> Currently, it must be imported and signed by Sun. But, then >> it can't be exported without a Commerce Department license. >> No (current) plans to establish a signing authority outside >> of the U.S. > >We've heard this assertion before. Why not import the software, generate a >detachable signature, and then export the signature for re-attachment overseas? > I suspect (but don't have any direct knowledge) that strong crypto classes are distributed after encryption by Sun's private key. The corresponding public key is enbedded in the Java Class Loader and/or virtual machine (or the security framework class -- I'm only speculating here). This means that "rogue" encryptors can't work under Sun's security manager as they will be rejected as "unloadable" Martin Minow minow(a)apple.com

1 0

Re: [Off-Topic] "Curfews"
by Deranged Mutant 17 Dec '03

17 Dec '03

On 1 Jun 96 at 21:59, Duncan Frissell wrote: > I'm afraid that some courts have explicitly held that "the child does not > have a right to liberty but only a right to custody." That is old law, > however. Kids have lost many rights recently too including gun rights, etc. ....which dates back to laws that said women and children were mens' possessions. Very archaic. A case from several years ago comes to mind. Apparently a federal(?) court ruled that a 16-yr-old girl's parents were in the legal right to burn her krshna books and ban her from practicing it. [There was a protest in downtown SF sometime in 1989 or '90 about this.] --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

2 1