December 2003 - cypherpunks-legacy

ITAR Amended to Allow Personal Use Exemptions
by Bruce Schneier 17 Dec '03

17 Dec '03

Today's Federal Register contains a notice from the Department of State, Bureau of Political Military Affairs, announcing final rule of an amendment to the International Traffic in Arms Regulation (ITAR) allowing U.S. persons to temporarily export cryptographic products for personal use without the need for an export license. The product must not be intended for copying, demonstration, marketing, sale, re-export, or transfer of ownership or control. It must remain in the possession of the exporting person, which includes being locked in a hotel room or safe. While in transit, it must be with the person's accompanying baggage. Exports to certain countries are prohibited -- currently Cuba, Iran, Iraq, Libya, North Korea, Sudan, and Syria. The exporter must maintain records of each temporary export for five years. See Federal Register, Vol. 61, No. 33, Friday, February 16, 1996, Public Notice 2294, pp. 6111-6113.

3 2

Re: NSA net trolling
by Eric Murray 17 Dec '03

17 Dec '03

Here's a copy of your message back to you as you requested: lmccarth(a)cs.umass.edu writes: > > Wayne Madsen wrote somewhere: > > A knowledgeable government source claims that > > the NSA has concluded agreements with [...] Netscape to > > permit the introduction of the means to prevent the anonymity of > > Internet electronic mail, [...] > > I suspect this may actually mean that they're pushing Netscape to > incorporate cryptographic authentication into browser email, which I think is > a useful development. (Hey, I read that Netscape employees get fined $1 for > referring to Navigator as a "browser".) > > At any rate, it's an excuse for me to ask some questions: > > (0) > I'm not aware of any class library objects or methods in stand-alone Java > for calling the local mail transport agent. Is there any class library > support in Java+{Navigator, HotJava, Mosaic, NetCruiser, the AOL web tool, > etc.} for calls to the local mail agent configured in the browser ? > > I would prefer not to reinvent SMTP using the Socket class in my own applets. > Ideally I'd like to have an applet that presents a form with some entry boxes > and check boxes, quantizes and encrypts the input according to the check box > settings, and spews the resulting byte streams to the MTA. > > (1) > As I recall, I used to be able to set (as an Option) the path and name of the > local MTA (e.g. /usr/lib/sendmail) in an earlier version of Netscape. That > seems to have disappeared in Navigator 2.0. Is there indeed no longer a way > to set that ? > > It occurs to me that we could have achieved partial integration of > remailing into Navigator quite cheaply with that option. > > Comments from Sun and/or Netscape and/or anyone else would be welcome. > Thanks :) > > -Lewis "You're always disappointed, nothing seems to keep you high -- drive > your bargains, push your papers, win your medals, fuck your strangers; > don't it leave you on the empty side ?" (Joni Mitchell, 1972) > > -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

1 0

IBM Breakthrough?
by John Young 17 Dec '03

17 Dec '03

IBM has an ad in the Feb 26 New Yorker where a joker e- mails a recipe-swapping friend in Osaka that "I'll teleport you some goulash." The text then states: Margit is a little premature, but we are working on it. An IBM scientist and his colleagues have discovered a way to make an object disintegrate in one place and reappear intact in another. It sounds like magic. But their breakthrough could affect everything from the future of computers to our knowledge of the cosmos. What is this breakthrough or is it just a chump tease?

3 2

mixmaster info?
by David K. Merriman 17 Dec '03

17 Dec '03

I hate to bring up the topic of privacy/crypto (yech! :-), but could someone point me at the 'specs' for Mixmaster remailers? I'm after how messages are sliced, diced, repackaged, and shipped, etc. Dave Merriman ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> For privacy tools: http://www.geocities.com/capitolhill/1148

2 1

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 18:46 2/20/96, IPG Sales wrote: >Hedging, hedging, hedging - why? I did not noitice this in my first >reply - in addition to giving you the company if you can break the >system, we will give you the company if you can establish, through our >employees or any other method, that we retain any Ocopies of the TPs, >any! - for very large systems, we maintain a temporary copy to insure >safe arrival, by excuting the check system menu item - >it is immediate destroyed upon system notification. Anyone that wants to >audit us cazn do so, unannounced at any time - subject to payment ofd >expenses! We do not keep copies, we would not be in business 30 days if >we did. It is irrelevant if you keep copies of the OTPs or not. The point is that you might. There is no way to prove to me or anyone else that you don't keep copies. [why this is true is left as an exercise to the reader]. I would not trust anyone outside my company to create keys for us. I would urge any others interested in keeping their data inaccessible to outsiders to exercise the same fundamental caution. There is no further need to look at IPG's source code or algorithms. As I said, end of story. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by dan＠milliways.org 17 Dec '03

17 Dec '03

Perhaps you should apply for an export license for your software. I'm sure that the ability to use your system across national borders fits nicely within your marketing strategy. To do so, you simply submit your product to the U.S. National Security Agency, and submit a Commodity Jurisdiction application to the State Department. After the NSA evaluates its security, you'll be able to sell your product overseas. Please see pages 610-618 of Applied Cryptography, Second Edition for general information on the process. By the way, you might note that Cypherpunks is only a mailing list, there is no way to get the signed consent of everyone on the list to agree to anything, much less formal rules of a contest. My suggestion is to post the OTP-expansion algorithm to sci.crypt. It's really in all of our best interests to have the greatest number of people examining your product. Think of the publicity it will generate. Your work will remain protected with whatever patents or copyrights you have applied for. This approach is nothing new, RC2 and RC4 were both posted to sci.crypt. Both are in wider use today because of it. Both algorithms stood up to many people's tight scrutiny. I think your algorithm should be given the chance to do the same. Dan ************************************************************************** Support your local info-calypse dan(a)milliways.org "The Internet cannot be regulated. It's not that laws aren't relevant, it's that the nation state is not relevant." Nicholas Negroponte, 1996 The Cypherpunks: Civil liberties through complex mathematics. **************************************************************************

4 5

CoFR Report Site
by John Young 17 Dec '03

17 Dec '03

Thanks to KLP, the Council on Foreign Relations report on the future of US intelligence: http://www.tc.umn.edu/~klp/CoFR.txt (text) and http://www.tc.umn.edu/~klp/CoFR.gz

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

At 06:10 PM 2/20/96 -0600, you wrote: >> ** fairly remarkable coincidences. Or is it that great minds >> think alike? > >heh, actually the Elementrix POTP sounds like plaintext-driven autokey >cipher and probably wouldn't be offensive if they weren't touting it as a >'OTP'... > Yes, that's true, but they also allude to "a large number of randomly spinning dice" [rotors?] of which some are selected by contents [perhaps] the autokey stream. This from a discussion held with the POTP people. The allusion to the numerous 'dice' is what suggested to me a similarity with the new [unknown but perfect, of course] system. The autokey of POTP was supposedly only part of the scheme....

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

At 01:00 PM 2/20/96 -0600, you wrote: >Derek - We accept the gaunlet that Cyperpunks threw down, We will >provide the complete set of algoritms and free demo systems - we will not be >asking you to sign a NDA or anything like that, but we do want it to be a >two way street - if we put our head in your guillotene, to be chopped >off by the warlord and his minions, then we expect you to perform >reciprocal actions. I'd like to go on record as being interested in looking at this. Thanks! > >There has never been an idea advanced, where the orginator was not >thought of as a crank - Oliver Wendell Holmes Sr., "Over Teacups" > But not all those thought of as cranks are originators of worthwhile ideas ...

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Can't you just run a dumb TCP relay? I used to have one somewhere, but I can't remember if I solarified it to run with multi-threading. I can try and dig it up, but it'd probably be faster for you to rewrite from scratch. I also have a ssl proxy for the client side which I wrote to demo the MITM attack, but that doesn't sound like what you need. Simon On Tue, 20 Feb 1996, Lucky Green wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > I need firewall software, preferably for free and running on an x86, that > allows me to place an SSL webserver behind the firewall. > > Any pointers? > > TIA, > > - -- Lucky Green <mailto:shamrock@netcom.com> > PGP encrypted mail preferred. > > > - --- > [This message has been signed by an auto-signing service. A valid signature > means only that it has been received at the address corresponding to the > signature and forwarded.] > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.2 > Comment: Gratis auto-signing service > > iQBFAwUBMSpFICoZzwIn1bdtAQF3YgGAnt2V+2sTgv7cHDu0k3HZ/664sFbYsu9V > 4sWnsBNuJoMRVlG4RbxE/iERpu0nR6ZF > =kPCC > -----END PGP SIGNATURE----- > > --- They say in online country So which side are you on boys There is no middle way Which side are you on You'll either be a Usenet man Which side are you on boys Or a thug for the CDA Which side are you on? National Union of Computer Operatives; Hackers, local 37 APL-CPIO

1 0