December 2003 - cypherpunks-legacy

Re: PGP reveals the key ID of the recipient of encrypted msg
by John Pettitt 17 Dec '03

17 Dec '03

At 12:28 AM 3/13/96 -0500, Robert A. Rosenberg wrote: > So long as you have your corespondent's published Public >Key, you can use it to do a one-time transmission of a private Public Key >to be used to do anonymous (ie: Not Linked to your Public Identity) >transmissions to you. > > > Yes but even a non pub keyid leaks information usefull for traffic analysis. John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch PGP Key available at: http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=0xB7AA37…

1 0

Re: Leahy bill, legalize crypto
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

schlafly(a)bbs.cruzio.com sez: > > It would be nice if the bill put in some user protections, such as > > requiring notification of the user if the escrow agent divulges his > > key, but it does not. > ^^^^^^^^^^^ eck(a)panix.com (Mark Eckenwiler) wrote: >False. See, for instance, proposed section 2802(c)(3)(C). What copy of the Bill are you reading, Mark? My copy says that escrowed keys must be given to the government secretly on demand, NO WARRANT NEEDED, and the fact that they were given MUST BE KEPT SECRET. This bill is a small but significant step towards the police state. If the bill becomes law, no one in their right mind will "voluntarily" escrow their keys, and then we shall see steadily increasing compulsion to "voluntarily" escrow keys, like the "voluntary" self assessment of income tax. Section 2802(c) > "(c) REQUIREMENTS FOR RELEASE OF DECRYPTION KEY TO > INVESTIGATIVE; OR LAW ENFORCEMENT OFFICER.- > > "(1) CONTENTS OF WIRE AND ELECTRONIC COMMUNICATIONS.- > A key holder is authorized to release a decryption key > or provide decryption assistance to an investigative or > law enforcement officer authorized by law to conduct > electronic surveillance under chapter 119, only if- > [...] or "(ii) a certification in writing by a person > specified in section 2518(7) [...] stating that- "(I) > no warrant or court order is required by law; > [...] > "(4) NONDISCLOSURE OF RELEASE.-No key holder, officer, employee, or > agent thereof shall disclose the key release or provision of > decryption assistance pursuant to subsection (b), except as may > otherwise be required by legal process and then only after > prior notification to the Attorney General or to the principal > prosecuting attorney of a State or any political subdivision of > a State, as may be appropriate. Section 2802(c)(3)(C) is worthless piety. Every time I come back to this bill it looks more and more repressive. Section 2802(c)(3)(C) reads: > "(C) The inventory required to be served pursuant to section > 2518(8)(d) on persons named in the order or the application under > section 2518(7)(b), and such other parties to intercepted > communications as the judge may determine, in the interest of > justice, shall, in the event that encrypted wire or electronic > communications were intercepted, include notice of the fact that > during the period of the order or extensions thereof a key to, or > decryption assistance for, any encrypted wire or electronic > communications of the person or party intercepted was or was not > provided by a key holder. If you chase 2802(c)(3)(C) to its end, you will find that it means stuff all, like most of the other supposedly freedom protecting provisions in this act. Any crypto bill that we could realistically get out of Washington will substantially reduce liberty. The best that we can hope for is for Washington to forget about crypto until it is too late to stop. --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from the arbitrary power of the omnipotent state. http://www.jim.com/jamesd/ James A. Donald jamesd(a)echeque.com

1 0

Re: How's that again?
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:40 PM 3/12/96 -0500, Black Unicorn wrote: >Revise your statement to: >"doesn't want anyone who hasn't spent a few years in law school to pass >judgement on pending legislation and the effect of supreme court decision >thereon..." >and you'd be right on the money. I'm not a lawyer, though I've played a politician on TV. I'll grant you that lawyers and other trained legal professionals can do a far better job of finding and analyzing cases than amateurs like myself, though I suspect a month or two's experience with Lexis would be enough to let many of "the rest of us" outsearch the average lawyer of 50 years ago who had to rely on his or her wits alone. But if the average intellegent person _can't_ evaluate a law and have a reasonable chance of figuring out what it says and what it means, there's something seriously wrong with the way new laws are written, as well as enforced. (I suppose I've complained enough that there _is_ something seriously wrong them that I'm not adding any new weight here; if the author of a portion of a law can get up on the Senate floor and say that he realizes that part of the law he's proposed is unconstitutional and unenforceable, and that this doesn't bother him*, I guess it's no surprise that one of the more-or-less "good guys" in the Senate can propose a law so ambiguously worded that it looks good on the face until a good lawyer takes the time to rip it apart - maybe Leahy will read some of Junger's review?) > And I confirm again that I'm an elitist legal snob. > At least I know what I'm talking about. [* Is it true that the reason Election Day is on the _second_ Tuesday of November is to guarantee it never falls on Guy Fawkes' Day?] #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

WSJ on E-Notaries
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- THE WALL STREET JOURNAL. (c) 1996 Dow Jones & Company, Inc. ------------- TUESDAY, MARCH 12, 1996 Legal Beat: Will Notaries Still Reign Over Red Tape When Documents Move Electronically? By Margaret A. Jacobs Staff Reporter of The Wall Street Journal When Jack Gillis recently refinanced his home mortgage, he was dismayed by the number of documents that had to be signed by a notary public. "I never could figure out why I had to have half of them notarized," says Mr. Gillis, a Washington, D.C., public relations consultant. "Who are notaries anyway?" he asks. "What purpose do they serve?" To anyone who has endured the hassle of trying to find a notary in a hurry, such questions probably have a familiar ring. And these days they have an extra edge: The digital age notwithstanding, notaries toil on -- improbably -- in a sea of paper. Their quaint ledger books and embossed seals are meant to deter fraud, but are hardly a match for the unscrupulous. And amid accumulating evidence of sloppy practices, some government officials are suggesting that notaries may be obsolete. There is even a move afoot to push notaries into the 21st century: A committee of the American Bar Association has recommended creating a new legal subspecialty of "cybernotary." These attorneys would combine legal and computer expertise, and would verify the authenticity of electronic documents produced in global business transactions. Part of their job would be to assure that a document's "digital signature," or unique computer code, is genuine. Though use of digital signatures is limited today, most people familiar with the technology predict it will be commonplace within a few years. Charles Faerber of the National Association of Notaries in Canoga Park, Calif., stoutly defends notaries as effective bulwarks against fraud; without them, he adds, the courts would be awash in cases challenging the authenticity of documents. The notary's duties have changed little over the centuries. The first notaries were the scribes of ancient Rome who wrote official documents. Today, they exist all over the world, virtually wherever there is paperwork. In the U.S., some 4.5 million notaries are licensed by state governments to verify the identities of people who sign documents, such as realestate deeds and court affidavits. Lawyers make copious use of notaries. To cut red tape, Congress in recent years has dropped notarization requirements for some documents filed with the federal government, including trademark applications and certain court papers. Instead, signers can declare under penalty of perjury that their information is "true and correct." At least one federal judge has also expressed doubts about the need for notaries. "It may be questioned whether notarization is actually an improvement upon the mere signature," U.S. District Judge John F. Grady of Chicago wrote in a 1990 opinion concerning proper procedures for serving a lawsuit. To ensure that people who sign documents are who they say they are, notaries are supposed to ask for identification if they don't personally know the signer. Then they are required to sign the document themselves, affixing their stamp or seal. They typically charge a fee of $2 or less. But almost anyone over 18 who pays the $25 or $30 license fee is eligible to notarize documents. In some states notary seals are available by mail order, without any required proof -- or notarization, for that matter -- that the recipient is authorized to use it. The absence of oversight has led to lax practices, critics complain. Janice Shields, director of the corporate accountability project at the Center for the Study of Responsive Law in Washington, D.C., says that when she sold her car and had the bill of sale notarized, "the notary didn't have a clue who I was. I could have stolen the car, for all the notary knew." In a 1990 survey by New York's notary trade group, only one of 217 randomly selected notaries there properly dealt with a simple affidavit. More than 82% failed to check identification, for example. Four years ago, Florida officials threatened to do away with notaries entirely if slipshod practices persisted. It tightened up on rules that are often flouted, insisting that documents be signed in a notary's presence, for example. The crackdown arose after notaries had failed to detect a rash of fraudulent boat sales, among other complaints. Earlier this year, California began requiring notaries to take signers' thumbprints before notarizing real estate deeds. Besides trying to prevent fraud, the state acted to impress upon low-income and elderly people the significance of signing away their homes, says Mr. Faerber of the national notary association. Mr. Faerber, whose 125,000-member group advocates entrance tests and training to professionalize the field, says notaries can prevent the ailing elderly from being coerced into changing their wills or making large gifts. "Nursing homes and hospitals are notary battlegrounds," he says. "They're where lots of wrongdoing is attempted." Yet for people in need of a notary, simply tracking one down in a hurry can be a challenge. Few notaries advertise; usually they perform their service as a sideline to another full-time job. Dan Holly, who works on Capitol Hill, recalls searching in vain for a notary several years ago while he was working as a newspaper reporter. He later found out that the managing editor's secretary was a notary. "I would never have known," he says. Even some notaries find notarization a nuisance. In New York, where notaries must renew their licenses every two years, real-estate broker Jane Tjian has found herself in need of notarization just as her own notary license had expired. "You count on another broker-notary being around and they're not," she says. "Then you have to scramble to find someone or run to the bank" to track one down. But Mr. Faerber of the national association says it's too soon to write his profession's obituary. If notaries were eliminated, he says, "the courts would be flooded with challenges that signatures were coerced or forged." He adds: "It may seem minor, but looking someone in the eye does impress upon people the importance of telling the truth." * * END OF DOCUMENT * *

1 0

Re: Leahy bill, legalize crypto
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

schlafly(a)bbs.cruzio.com wrote: > Obstruction of justice is already a crime. Why add penalties for > using encryption? Intimidate crypto users? Discourage use of > encryption? Give the feds jurisdiction over crypto matters? There are several different interpretations of the most controversial sections of the bill, it is vague and ambiguous. The only interpretation that I have seen that gives effect to the stated purposes of the bill is that if a cop is investigating a felony, he can demand your secret key, and if you refuse to give it to him, you get five years for obstruction. If the objectionable parts mean anything at all, they must *widen* the already alarmingly broad concept of "obstruction of justice". That is to say, of the many possible interpretations of this section, the only one that gives effect to the stated purposes of this legislation, delegates judicial powers to cops. > I see nothing good in this bill, except the export rule relaxation. This bill is a net loss: It gives the software companies considerably less than they thought they were getting, and violates the rights of individuals. The best bill we can hope to obtain is no bill at all. Crypto is profoundly harmful to the vested interest of Washington, and the more attention they pay to it the worse we will be: Any bill that Washington could pass is a bad bill. Any attempt to fix this bill is likely to make it worse. > >Roger --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from the arbitrary power of the omnipotent state. http://www.jim.com/jamesd/ James A. Donald jamesd(a)echeque.com

1 0

Stealth for Mac?
by Rev. Mark Grant, ULC 17 Dec '03

17 Dec '03

I've had a request from someone for a copy of Stealth that can run on a Mac (I have the README for the DOS/Unix version on my Web site). Has anyone ported it? Or if not, would anyone be able to? You should be able to just hack up a simple GUI around the main filter code to select input and output files. Mark

1 0

Why escrow? (was Re: How would Leahy bill affect crypto over HAM
by Deranged Mutant 17 Dec '03

17 Dec '03

jim bell <jimbell(a)pacifier.com> > Well, okay, but we've really got to define whose key is being escrowed, > anyway. Most corporations will probably handle it themselves, OR they will > only give an ENCRYPTED escrowed key to the escrow agent. This would prevent [..] They may use secret sharing or splitting methods and handle parts by different organizations within themselves and hand other parts to an outside agent. Sometimes this makes sense when there are political rivalries within an organization. They want the ability to get into Dilbert's files if he drops dead, but they want an objective party to hold part of the key so his rivals don't try to steal his files. Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

Re: PGP reveals the key ID of the recipient of encrypted msg
by Bill Stewart 17 Dec '03

17 Dec '03

>On Mon, 11 Mar 1996 savron(a)world-net.sct.fr wrote: >> I began testing PGP a few days ago ( I'm a PGP newbie ) and I found >> that it gives out the key ID of an encrypted message . From this you >> can get the identification of the recipient of the message , if it's >> someone who has publicaly distributed his key (keyserver , homepage >> ...) . So even if you are unable to decode the message you can find >> who is the recipient of a given message . I think this is a big >> privacy problem . How much of a problem it is depends on the application you're using PGP for, but yes, it's a concern. There's a program called "stealth" by "Harry Hastur" which lets you remove or hide this information, as well as hiding most of the PGP headers. (There are some aspects of PGP file structure that are difficult to hide, at least without doing almost as much work as PGP was already doing, and I don't know if it adjusts for the mathematical properties of RSA-encrypted data which make it possible to identify the public key over some number of messages.) When the new PGP 3.0 comes out, there will be some support for shorter keyIDs (which isn't perfect, but for instance a 4-bit keyID would let you not try to decrypt 15/16ths of the messages, while not really fingering you as the recipient.) Also, if you have someone you frequently correspond with on some topic (perhaps a mailing list) and want to be able to send them messages that don't identify them, have them generate a public key they use just for that application. You can send your request by anonymous remailer, and they can send you a reply by anonymous remailer or post to alt.anonymous.messages. This still permits traffic analysis (nobody knows who keyid 0x12345678 is, but they know you sent him ten messages in the last month.) >> The problem is carried along when you encrypt a message for multiple >> recipients , you get the key IDs of all the recipients and same >> problem as above . I think something like 'blind email copy' should >> be used , because the recipients don't have to know the identity of >> each other . markm(a)voicenet.com replied: >You could just encrypt a message to different key ID's seperately, rather than >in one pass of PGP. The would have the effect of Bcc. Yep. That was the original PGP approach (i.e. "do nothing special"), and multiple-recipients were added as an efficiency measure. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

Re: Leahy bill, legalize crypto
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:18 PM 3/13/96, James A. Donald wrote: >Any crypto bill that we could realistically get out of Washington will >substantially reduce liberty. The best that we can hope for is for >Washington to forget about crypto until it is too late to stop. This is our best hope at this point: that Washington moves on to other things as the campaign heats up and forgets about crypto. One reason Washington pushed for the Wiretap Act (aka Digital Telephony) was because digital switches have made conventional methods of wiretapping and pen registers harder and harder to do. (I'm not a phone phreaker expert, as some of you no doubt are, so I don't know the details of how wiretaps were done prior to the advent of digital switches...I picture wires connected to the back of PBX systems, and I presume the ESS systems and their ilk changed this dramatically.) However--and here's the kicker!--they blew it. If you look at Louis Freeh's testimony before Congress a couple of years ago (which I did in detail, as I scanned and OCRed it for Whit Diffie, who may make it available soon) he was clearly worried about the phone system becoming so complex and "so digital" that FBI surveillance capabilities would fall behind the technology curve. So, he and his supporters (including the EFF) pushed for the Wiretap Act. (No money has yet been allocated, last I heard, so the $500 million supposedly to reimburse the telcos for providing wiretap capability, hasn't happened.) The main way they blew it is that the Wiretap Act ostensibly does not cover end-to-end encryption, especially as computers are used in place of telephones. And as Internet voice systems become widespread, especially with transparent, easy-to-use encryption (Nautilus, PGPhone, etc., in a couple of version iterations), even some goombah in Little Sicily will be able to communicate securely and essentially unbreakably. That they are realizing this, belatedly (although hints of this recognition can be found in Freeh's comments to Congress), may be why a couple of moves are occurring: - a fast-track review by the FCC to determine if "Internet voice" services are to be regulated, controlled, enacted, redacted, and impacted. (The traditional phonecos are the ones squealing most loudly, but others are expressing concern over the "anarchy" of unlicensed Internet applications.) - the Leahy Bill, which would as various analysts have noted make disclosure of keys mandatory, would protect the legitimate needs of law enforcement, blah blah blah. Speculatively, I can see something coming on the horizon. Suppose the FCC, under the Telecommuications Act, the Leahy Act (or whatever), and the Digital Telephony Act, extended to the Internet the same general restrictions on cryptography that currently apply to the airwaves? Suppose encryption is allowed, but only with key escrow? While I can think of various problems with enforcement--the very points many of us have raised over the past several years--I can also see this as having wide support. And it might pass constitutional muster (for the same reasons the FCC jurisdiction over airwaves and the ban on encryption by ham operators, got approval. Sure, I understand that Internet bandwidth is not the same as the "public airwaves," but this subtlety may not be enough to stop the parallel from being successfully drawn. Especially if the phone companies and other threatened players are pushing hard for the FCC to step in and regulate. Food for thought. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Commercial Key Escrow as Prerequisite to 64 bit Export
by koontz＠netapp.com 17 Dec '03

17 Dec '03

SIGNAL, March 1996, page 9: U.S Allows Firewall Export The U.S. government has approved a 56-bit data encryption standard (DES) encrypted firewall for export. The device could create a global virtual private network by encrypting the Internet protocol layer of the communications stream among firewalls. The system's manufacturer has obtained permission to exports its 56- bit, DES-encrypted firewall by incorporating a proprietary commercial key escrow recovery technology into the firewall. The U.S. govern- ment will allow the export of cryptographic products with key lengths of up to 64 bits, provided that a capability allows emergency access to encryption keys for law enforcement and national security reasons. Terms of the export license require the manufacturer, Trusted Information Systems, Incorporated, Glenwood, Maryland, to maintain a commercial key escrow data recovery center in the United STates. --- 1) Is there a market for products overseas that the U.S. government can peer through? 2) Will we ever hear what constitutes a demand for disclosure of keys for "national security reasons"? {please CC: koontz(a)netapp.com, currently not subscribed to cypherpunks}

1 0