December 2003 - cypherpunks-legacy

Global Government Access to Keys (GGAK)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:37 AM 7/15/96, Bill Frantz wrote: >At 2:05 PM 7/13/96 +0000, Deranged Mutant wrote: >>Or what if some terrorist was using keys escrowed in a country that >>sponsered terrorist acts? > >Deranged Mutant is absolutely right. There are about 150 (or so) >governments in the world. When people talk about making keys available to >government (or law enforcement), always ask, "Which governments can access >these keys?" If I were a non-French corporation, I would feel distinctly >nervous if the answer included France. (There are a number of other >countries where the security services have also been suspected of engaging >in industrial espionage.) There are some interesting "public relations" stunts we can use to undermine support for the concept of GAK: * Announce in corporate press releases (for some Cypherpunkish company?) that "As per the laws of the Libyan Arab Jamahiriya, we have provided Col. Qaddaffi's Office of People's Security with our encryption keys for all communications passing into, out of, or over Libyan soil." (This would likely horrify the U.S. security establishment, were it to be actually true. But it is of course essentially symmetrical with the fear those in Germany, India, Iraq, etc. would have if told to deposit copies of their keys with the U.S. National Security Agency or any other "trusted third party" mandated.) (I can't resist another aside. Sorry. In addition to the abuse of the English language with using "escrow" in this warped sense, we now have "trusted third party" used in a warped sense. "We're not saying _you_ trust them, we're saying the NSA trusts them.") * "The U.S. has designated J. P. Morgan and Company as a Designated Trusted Authority for the deposit of encryption keys for Jewish persons wishing to communicate in primarily Islamic countries." (Making the point that any international key escrow scheme which complies with various nation's laws must collide with American values about such things. In many Arab countries, Jews are restricted in various ways. Do we want the government of the U.S. participating in such restrictions? And what about the Arab boycott? It may be in decline now, but not with all countries.) * "The United States Office of Communications Security has turned over to the government of Singapore a list of all persons suspected of circumventing Singaporan law regarding encryption." (ObNazi Reference: One can imagine how a GAK program would've worked during the Third Reich. Not only would communications have been read, regardless of the supposed legal protections, but GAK would have been used to compile contact lists of people to be rounded up. Sort of the way the U.S. government violated the laws about the U.S. Census to illegally use census records to locate "Japs" for assignment to concentration camps.) And so forth, concentrating on the essentially intractable problem of how to "escrow" keys with foreign governments imimical to Western values. (The crypto literature, esp. the Proceedings of the Crypto Conference, circa the mid-80s, refers to this as the "rogue government" problem, esp. with regard to the issuance of false "is-a-person" credentials. That is, suppose a Global Identification Infrastructure (GII) is implemented, consistent with Global Government Access to Keys (GGAK). What about some countries, whether they be the Free Republic of Libertaria or the Libyan Arab Jamahiriya, who either refuse to play along or who subvert the system with false information? What if the United States itself issues false identities to its secret agents, its informants, and its 60,000+ people in the so-called Witness Security program?) There are other aspects of GAK which also collide with basic values. For example, consider several classes of communications we consider "privileged": -- attorney-client discussions, in person or over phone lines. -- doctor-patient discussions -- psychiatrist--patient discussions -- priest--penitent confessions Are the computer communications (likely in the future to increase, even if not common now) of these groups to be GAKked? Even with "safeguards," the priest--penitent relationship will be forever compromised, with neither side knowing whether some secret policemen is listening. These are not new issues; we talked about them several years ago. But now that GAK is being discussed again.... --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

DCSB: Betting on the Future
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: rah(a)tiac.net Mime-Version: 1.0 Date: Mon, 15 Jul 1996 11:26:33 -0400 To: dcsb(a)ai.mit.edu From: Robert Hettinga <rah(a)shipwright.com> Subject: DCSB: Betting on the Future Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Robert Hettinga <rah(a)shipwright.com> -----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston Presents Duane Hewitt Idea Futures "Betting on the Future" Tuesday, August 6, 1996 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Duane says: > I am a Molecular Biologist by trade but I am fascinated by all aspects of > science and technology and especially their long term ramifications. I am > completing my Master's Degree thesis as well as working full time at the > University of Massachusetts at Amherst. I have some part time work > maintaining Web pages and I have been involved with the Idea Futures Web > site from the very beginning. I also am currently working on a hypertext > reference on the biology of aging. Many of these interest can be accessed > from my home page at http://www.lucifer.com/~duane > > I will introduce the concept of Idea Futures which is a market in which > the odds of future events are set by betting. It is designed to reward > those who can accurately forecast future outcomes. It has been recognized > by the Austrian Broadcast System, and the Point Survey and mentioned in > _Wired_. I will discuss the implications of such a market as well as some > of the history behind it. I will also propose how a similar market could > be used to construct a market based voting system. This meeting of the Digital Commerce Society of Boston will be held on Tuesday, August 6, 1996 from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, One Federal Street. The price for lunch is $27.50. This price includes lunch, room rental, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men, and "appropriate business attire" for women. We need to receive a company check, or money order, (or if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, August 3, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston". If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Planned speakers for the following few months are: September Tatsuo Tanaka Some Economics of Digital Cash October Philippe LeRoux Stock Exchanges and the Web We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, rah(a)shipwright.com . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to majordomo(a)ai.mit.edu . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to majordomo(a)ai.mit.edu . Looking forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMepi6vgyLN8bw6ZVAQFsOwP/UuOoWa0LUEyY4dmQ21KIR4GwhB6PurSa L97eVsbVOigP+TVPFJX7RKqYhCxIL8gDUnSRimGnATmhLo5wdE0UXvgakeGaD5s+ vKPfhuaG9/MnuZvWFbBEZOrTTKqVE8bfoU2yiw6xTvhyQY0lDA2BSO8vjip28nOA 0Wkuh1VUBhY= =/5+9 -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

random numbers reverse-engineering
by Jüri Kaljundi 17 Dec '03

17 Dec '03

Is there somewhere where I could find more information on finding out RNG algorithms or reverse-engineering RNG's, once you have some quantity of random numbers generated by some RNG? For example a local bank is giving each customer a list with 600 one-time passwords (6-digit decimal numbers), and I believe they use the account number as (one of the) seeds for the RNG. Is there some program that I could use, together with the numbers and possible seed, to try to break the RNG? Jüri Kaljundi AS Stallion jk(a)stallion.ee

1 0

Re: Markoff on Clipper III
by jim bell 17 Dec '03

17 Dec '03

At 09:35 PM 7/14/96 -0700, David Sternlight wrote: >>At 02:33 PM 7/14/96 -0400, Duncan Frissell wrote: >>>Last time I looked, the oath they took was to protect the Constitution -- >>>not the nation or national security. > >Did you miss the part in the Constitution about "provide for the common >defence" If there is anything that is clear about GAK, it is a system which is NOT intended to benefit all citizens approximately equally. The vast majority (over 99.99%) of the population will never be the victim of any sort of terrorism. If anything, it's intended to provide job security for government employees who are increasingly aware that the unhappy villagers will be showing up at the castle with their torches. The best thing the government could do to prevent terrorism is to simply stop misbehaving; to stop doing those things that make many ordinary citizens feel that they are far more a victim of their government that any terrorist or criminal. Jim Bell jimbell(a)pacifier.com

1 0

Re: CookieScan 0.0 rev 0
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:34 PM 7/15/96 -0800, Chris Hull wrote: >Do y¹all think there might be an interest in a >utility which would allow the user to deal with >browser cookies? There might, but it's a difficult problem, and implementation-dependent and doesn't always tell you much. While your browser may store cookies in a disk file to use between sessions, by the time the cookie gets filed on disk, it's long since cooled down and may have been written over multiple times. The interesting time to detect cookies is when they arrive - this means either watching the network data stream for cookies (non-portable, unless you use a cookie-proxy, which is the obvious way to implement it), or else grubbing around in the browser's memory (highly non-portable, unless you're modifying the browser source.) The "doesn't always tell you much" is because cookies often seem to contain encrypted or hashed data that isn't meaningful to the browser-user, only to the cookie-originators. The cute trick you can do with cookies, which is probably used by advertising sites such as doubleclick.com, is for the web page owner to include an IMG which is an href to a CGI program at a cookie company. The CGI program is able to look at the HTTP_REFERER variable, which tells what page you were last on, and can therefore create or use cookie information that tracks where you've been between companies (e.g. Alice can contract with Cookies Inc. to tell if you've been to Bob's site recently, if Bob also uses Cookies Inc.) # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Re-delegate Authority!

1 0

Re: How I Would Ban Strong Crypto in the U.S.
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:58 AM 7/15/96 -0400, Raph Levien wrote: >4. Thus, the best leverage for the TLAs to win is to guide the >development of a key management infrastructure with the following >property: if you don't register your key, you can't play. I believe that >this is the true meaning of the word "voluntary:" you're free to make >the choice not to participate. > >5. This is _important_. If you can't get the keys for your >correspondents, you can't use encryption. If they build a key management >infrastructure that actually works, people will use it. The obvious counter is to use the key management infrastructure for authentication, but use a technique like Diffie-Hellman to decide on a session key. I see two problems with this approach: (1) It still allows traffic analysis. (2) It will be difficult to implement for one-way transmissions (e.g. email). A more complex structure would overcome (2) above. Use you GAK key to sign your PGP key. Post your PGP key on the MIT server (or successors), and people who want non-GAKed communication with you would use your PGP key, with the benefit of government approved authentication. I still think this whole GAK thing is going to fail on the, "Which government?" question. I don't see either multi-nationals or their governments wanting to share their secrets with each other, and I don't see how to set up universal GAK to prevent that form of industrial espionage. Also, the key which decodes the GAKed data is just too valuable and too easy to steal. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0

WashPost: A "hate speech" horseman of a different color
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Search July 15th www.washingtonpost.com for "massive armamentarium" [sic]. With Innovative Use, the Web Empowers the First Amendment By John Schwartz Washington Post Staff Writer Monday, July 15 1996; Page F19 The Washington Post [...] Lately, though, I've gotten a nice, big dose of hope from watching hatemongers on the Net as they duke it out with the truth-squaders. In any intellectual combat, those who can support their arguments with facts are better armed. And guess what? The Internet gives us a new kind of arsenal. That might go against what you've been reading. A lot of journalists are discovering "hate speech" on the Internet -- racism, antisemitism, the whole vile package. It's the cover story for the current issue of Emerge, with the arresting image of a mouse cord tied in a noose. Such groups as the Simon Wiesenthal Center in California try to persuade publications to run stories on this loathsome trend, and they urge governments to drive those who spread messages of hate off the Net. [...] The on-line guest book at Nizkor is an evolving testament to the power of free speech. One visitor wrote: "As the child of survivors of the Holocaust I am particularly dismayed when intelligent and reasonable people are influenced by revisionist pap. I'm often frustrated to the point where I'd sooner tolerate censorship than the promulgation of neo-Nazi lies. Your work restores my faith in reasoned debate and the drive of honest people to find and spread the truth." Memo to the Founders: Thanks, guys. You got it right. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMeqQV5NcNyVVy0jxAQF8vAIAlGyi91nOxj1qhRN7GPXcChO9FOraJSc1 h/WyEC01HJj/W5uj51AxZbJIHjkz/eCcMb2AmjclfGeKIThrsSoY9A== =Olej -----END PGP SIGNATURE-----

1 0

re: Organized Crime Home Page - Four Horsemen, No Waiting
by Charley Sparks 17 Dec '03

17 Dec '03

>Well, with the UCMJ ( Uniform Code of Military Justice ) and the Oath >of Allegiance Military Personnel take on induction being re-written >to Support and defend the United Nations and to accept direct and >lawful orders from UN personnel, this doesn't surprise me.Soon, UN >Secretary-General Boutros Boutros-Ghali, or someone like him will >repeal more of the amendments to our constitution. First our guns, >then our code. > >I'll give up my pass phrase when > they pry it from my cold dead fingers ! Charley Sparks Booz Allen & Hamilton http://www.clark.net/pub/charley/index.htm Public Key Available

1 0

Someone can't read
by Charley Sparks 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- So, I'm a member of something anyway... could be worse... I could be a politician... being a geek, at least requires "some" brains !! {Snip snip } > >As I recall the NRC members in DC said, in *EXPLICITLY* rejecting >the "If only you know what we know..." mantra, that if there was >something the [NRC] did not know, it wasn't cuz that had not asked >everyone involved. (Or words to that effect) > >So it appears the Admin was withholding data from the Congress.... > > I have here in front of me, documented proof that there > are crypto-carrying members of the Cypherpunk Party... > > >-- >A host is a host from coast to coast.................wb8foz(a)nrk.com >& no one will talk to a host that's close........[v].(301) 56-LINUX >Unless the host (that isn't close).........................pob 1433 >is busy, hung or dead....................................20915-1433 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCXAwUBMeq/9+J+JZd/Y4yVAQGmHgQKAmooJ6NLnY3CF08TmYPOYvS9nDIMsYvL cLDC7wGPo1nnWFmGHVgJzalDJgip2gDQZUdt4i96kCy4E4w1epJxerVkJW0b2edY BF8HaZGLRlqDGNQIJwl+18gupV0g9DuchSiNgG5hodxrS8n/bLlRPGKeAKabKJY5 jvSyqR+tg6nUpA== =L5pp -----END PGP SIGNATURE----- > >

1 0

Re: Markoff on Clipper III
by jim bell 17 Dec '03

17 Dec '03

At 01:30 PM 7/15/96 -0400, Mark M. wrote: >Nowhere in the Constitution does it say that firearms (or crypto in this case) >are a threat to national security. In fact, the second amendment explicitly >dictates that people have the right to own firearms. No, it says "arms," not "firearms." Firearms are a subset of "arms," which a nearby dictionary defines as "objects used as weapons." By that definition, chemicals and biologicals, as well as explosives of all sorts, are "arms." Jim Bell jimbell(a)pacifier.com

1 0