December 2003 - cypherpunks-legacy

Re: Interactive Week exclusive - White House to launch "Clipper III"
by tcmay＠got.net 17 Dec '03

17 Dec '03

Bottom Line: In a way, I am hoping that "Clipper III" is proposed, as it will energize us once again. Historically, the "Cypherpunks antibodies" have had their most vigorous growth when faced with a government antigen. At 8:09 PM GMT 5/18/96, Will Rodger wrote: >The White House is about to answer recent attempts to liberalize encryption >exports with a proposal of its own. > >Documents obtained by Interactive Week show the Ciinton Administration has >been lobbying key Republican committee members to compromise on encryption >through a policy that looks very much like previous commerical key escrow >efforts. ... >The URL for the complete article is: >http://www.zdnet.com/intweek/daily/960518y.html > >Will Rodger >Washington Bureau Chief >Interactive Week Many thanks to Will for passing this on the Cypherpunks list. Our opposition to Clipper I and Clipper II was strong and, I expect, will continue with CIII. A question for Will Rodger: Is this "White Paper" ("The newest proposal is contained in a 24-page White Paper, a draft of which hit Capitol Hill earlier this week") related in any way to the one being prepared by Herb Lin and a bunch of other folks? It was due out about this time, and the topic seems similar. A bunch of us gave input to Herb and his panel at the CFP in '95...if this is the same White Paper, looks like we might just as well have saved our breath. I read the stuff at the URL, and at first blush it looks to say nothing about _domestic_ (within the U.S. and Canada) encryption. I'll be anxious to see what the White Paper says about domestic encryption. (To be clear, there are currently _no_ laws whatsoever about the types of crypto a citizen (or resident alien, or, for all intents and purposes, anyone) may use, nor about the key length, nor about any form of GAK, etc. Even Clipper I did not actually mandate allowable forms of crypto, though many of us thought that this was the desired end-state, down the road. So, I am tentatively assuming that Clipper III, if passed, will not diretly impinge on domestic encryption policy, about which the government currently says nothing.) However, as with other proposed crypto laws and "trial balloons," there are several questions which arise: 1. Will there be pressures put on the browser companies (Netscape, Microsoft, etc.) and the e-mail companies (Qualcomm, Microsoft, Claris, Lotus, etc.) to produce a "world version" that meets export standards with a single shrink-wrapped package? (Recall that last fall some of the various companies stated as their goal having a single package that could be shipped worldwide. Some of them claimed having two versions, a domestic U.S. version and an international version, was too onerous. I am skeptical of this, given that they have multiple platforms to support, multiple operating systems, etc. But they claim it is.) 2. Interoperability. How will U.S. users exchange messages with international users? Will a U.S. user have to register with the Authorities to get the proper credentials, protocols, etc.? Will the U.S.-sold versions of Netscape or Explorer, for example, contain the international GAKed versions for use with international users? 3. With products like PGP, there are already international users (lots of them). Thus, no "export laws" are involved. So, will I be able to communicate with them using my existing PGP methods? (If not, then my right to use an encryption product is in fact being limited, contrary to the putative wording of what Clipper III is supposed to be. To make this clear, I'm _already_ communicating with PGP, so no "export version" is needed.) And if U.S. users can continue to interoperate with international users as they are now doing, this puts the lie to claims about how key escrow will be useful for law enforcement. 4. And of course there is always the issue of _superencryption_. How a GAKked program can detect that superencryption is being used has never been adequately explained (to my satisfaction at least). Entropy measures won't do it, and forbidding any encryption of messages already containing "BEGIN PGP" will clearly just be a klugey bandaid. 5. What about U.S.-based corporations with offshore offices? Is a company supposed to replace its entire intranet corporate network with a GAKked system if even a single user is outside the U.S.-Canada? (I fear that this is indeed the proposal. The effect will then be to make all corporations GAKked.) 6. What about U.S. persons travelling abroad? 7. What about packets zinging around the world? Lots of complications if GAK is insisted upon. And lots of new avenues for "packet laundering." 8. The issue of why other countries would insist that their citizens GAK their keys when U.S. citizens don't have to!! ("Yes, Herr Glomlutz, we are insisting that all Germans using Netscape 4.0 must deposit their keys mit der Key Authority. No, we are not requiring our own citizens to do this." I don't think this will fly too well.) I can't see how other countries will go along with this. And what about the usual problem of "rogue nations" like Iraq, Iran, North Korea, Israel, and Liberia? 9. Many other issues. (They never answered the similar questions raised the last time, so I doubt they will this time.) Clipper III, if it turns out to be another worthless proposal which is laughed out of Washington, will be no real threat. If Clipper III actually outlaws or places limits on domestic use of crypto (as I think it must, else it can be too easily circumvented completely), then it will be a rallying cry which will likely see our membership increase still further, the anti-Washington rhetoric escalate, and likely some new developments in the war. In a way, I am hoping that "Clipper III" is proposed, as it will energize us once again. Historically, the "Cypherpunks antibodies" have had their most vigorous growth when faced with a government antigen. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Toastmasters? Incorporating
by remailer＠2005.bart.nl 17 Dec '03

17 Dec '03

How do corporations work, in terms of liability? If the cost of incorporating isn't forbidding, I would think a remailer operator might consider incorporating a company, and making the remailer a function of that company. That way, any losses are restricted to the total value of the corporation; that is, nothing. Any flaws? There must be something wrong with it somewhere. Thanks.

5 5

Re: anonymous companies
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"unicorn(a)schloss.li" "Black Unicorn" 18-MAY-1996 11:16:57.48 > At 06:42 PM 5/16/96 -0700, Wei Dai wrote: > > Solution: smart contracts. This is Nick Szabo's idea of building > > contractual obligations into cryptographic protocols so that the parties > > have no choice but to fullfil them. But again we don't know whether this > > will actually work for this problem. >But what happens when there are nuances or circumstances which contracts >do not anticipate? This "complete" reliablity is also a curse for >flexibility which fast moving entities need to survive. That's an argument for combining them with escrow agencies. If the escrow agency is less likely to need to intervene, then they'll charge less... the principle of insurance company risk estimation. -Allen

2 2

Interactive Week exclusive - White House to launch "Clipper III"
by rodger＠interramp.com 17 Dec '03

17 Dec '03

The White House is about to answer recent attempts to liberalize encryption exports with a proposal of its own. Documents obtained by Interactive Week show the Ciinton Administration has been lobbying key Republican committee members to compromise on encryption through a policy that looks very much like previous commerical key escrow efforts. This time, however, the administration has proposed a new, licensed network of certification authorities and escrow agents to control access to strong encryption abroad. The newest proposal is contained in a 24-page White Paper, a draft of which hit Capitol Hill earlier this week. Much of the administration's "key management infrastructure" assumes a similar network of certification authorities abroad. CAs would link public keys to their owners, and could serve as escrow agents for users' private keys, as well. The two would not have to be under the same roof, however. An overarching "Policy Approving Authority" would supervise all subordinate CAs and escrow agents. Since US escrow of exported products pose well-known problems for privacy and business concerns, the US is proposing foreign governments get into the act as well. If other governments acted as escrow agents, the Clinton White House argues, interlocking agreements among governments would protect all their common security concerns while giving non-US citiczens access to US encryption products. The ultimate goal, the White House says, is to allow export of anything at all, so long as keys are escrowed with an agent of its approval. The White House is evidenty relying on OECD initiatives for much of this to happen. Specifically, the "Clipper III" paper says that: U.S. companies can export software programs that use keys that are 64 bits of data long, if they agree to escrow keys that unlock the encryption in the U.S. or with an appropriate agency abroad. Manufacturers can export hardware that use 80-bit keys to encrypt data, if keys are escrowed. Large U.S. companies can escrow keys and not rely on third parties. Reaction is as before. Civil libertarians are already denouncing the White Paper, while pro-escrow forces are praising it. Staffers to Commerce and Judiciary committee call it the same old proposal, but with a large bureaucracy behind it. Quoted in the Interactive Week article: David Sobel of Electronic Privacy Information Center, Dorothy Denning og Georgetown U. and Stewart Baker, former NSA counsel. Hill staffers also quoted on background. The URL for the complete article is: http://www.zdnet.com/intweek/daily/960518y.html Will Rodger Washington Bureau Chief Interactive Week

2 1

Re: SEVERE undercapacity, we need more remailer servers FAST
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

What countries are noticeable for being anti-Scientology? They would appear to be good locations for special-purpose remailer ultimate-output ends. -Allen

2 2

Layman's explanation for limits on escrowed encryption ...
by Ernest Hua 17 Dec '03

17 Dec '03

Could someone with some knowledge of NSA/DoS/FBI intentions please explain why key length limitations are necessary for escrowed encryption? Please reply by E-Mail. Thanks! Ern

3 2

Re: The Crisis with Remailers
by John Deters 17 Dec '03

17 Dec '03

At 12:14 PM 5/22/96 -0400, Perry wrote: > >Matts Kallioniemi writes: >> At 17:44 1996-05-21 +0200, bryce(a)digicash.com wrote: >> >Matts, you don't want to do floating point for money, because >> >floating point doesn't give you good control of precision. >> >> Yes I do. Several major currency traders in Sweden keep all >> their money in 64 bit floating point storage. > >I have trouble believing you. None of the forex accounting I know of >in the U.S. is done in floating point. It simply isn't accurate >enough. > >It is true enough that *rates* can be stored as floats if you want, >but never actual sums. I wish there were a hard-and-fast rule that this were true. I work in Point Of Sale (POS or cash registers), and occasionally we will see a vendor whose software stores money/currency in floating point data types. I try very hard to make sure we do not purchase their software, because this implies the most gross lack of understanding imaginable. Floating points are simply not accurate when you're performing math on other people's money. And, yes, rates are acceptable to store and use as floats, but even the conversion process ultimately yields a long, not a float. And, we usually go out of our way to code rates up as integers and perform the decimal point shifting in code. In the currency class we use, we have an exponent property that defines where the decimal point is. I imagine that by converting the exponent from a short to a long we could even handle lira! :-) * * Note to persons who respect the Italian economy**: That was a joke! ** Note to persons who believe there are people who respect the Italian economy: That was a joke! -john -- J. Deters >From Senator C. Burns' Pro-CODE bill, which I support and you can find at: http://www.senate.gov/member/mt/burns/general/billtext.htm " (2) Miniaturization, disturbed computing, and reduced transmission costs make communication via electronic networks a reality." +---------------------------------------------------------+ | NET: jad(a)dsddhc.com (work) jad(a)pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'33"N by 93^16'42"W Elev. ~=290m (work) | | PGP Key ID: 768 / 15FFA875 | +---------------------------------------------------------+

1 0

Re: National Journal article sez net-activism is just political hicks
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:06 AM 5/24/96, jim bell wrote: >At 03:31 PM 5/23/96 -0500, Declan McCullagh wrote: >>>Tommorrow, Washington's politically-powerful National Journal reportedly >>>will publish a know-nothing piece of "journalism" saying that net-aided >>>politics is essentially nothing but a batch of ineffective, know-nothing >>>nerds and back-water political hacks. > >At least we now know that the National Journal hasn't heard of >Cyber-Anarchy--- or they didn't understand one word of it. What is this "cyber-anarchy" (or "Cyber-Anarchy") you keep talking about? --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 6

Re: (Fwd) Re: TCM: mafia as a paradigm for cyberspace
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Take note: If you want me to read you, cc me since I unsubscriVed :) from Cypherpunks... While frothing at the mouth (and god knows what other sphincters...), on a 22 May 96 at 12:37, somebody that behaves like a Rotweiller wrote: > oh, so in other words, a lot of "innocent" people will be murdered > under AP. ah, another great "feature", not a "bug", right?? Yes, but please note that the point for the validating of his statement is that even if this will happens, overall, *less innocents* will suffer from the seemingly random violence of AP than from the actual system. He might be wrong, but you seem to bring no new knowledge that would elucidate the question. Should the US have not dropped the A-Bomb on Japan and let happen 10 times mores casualties (from both sides)? The following paragraphs illustrate very well the way our local Rotweiller sees the world, which is very close to the vision of most statists. > ah, like murder. I see. well, I think you are violating my rights > by disagreeing with me. I shall arrange your consequences > accordingly. > but who decides what is wrong? the arbitrary opinion of some single > human idiot out anywhere in the world? don't you see the tyranny of > this? > it is far worse than the tyranny of a government if I were to > be killed by someone who believes that I violated his rights by > breathing air particles or whatever. via AP, you wish to give him > the mechanism to murder me without trace. Why do you fear so much for yourself? I guess, thoses who want to murder for all sort of reasons like hunting white baby seals or smoking in public simply share your psycho-epistemology. They would have no reasons to put a contract on you. Or would they anyways? > deny rights, legitimacy, justice, blah, blah, blah. the terms you > use have no meaning in the system you are advocating. there are no > "rights" in an anarchy, because a government is the entity created > to safeguard/protect them. all actions are legitimate in an > anarchy, because there is no civilized system that rejects any ones > in particular. By definition, you are right. But note that *they* never advocated true anarchy, only *you* claim that they do. Their vision of Life clearly entail some vision of Rights, Rules of Conduct, etc. They did *not* rule out laws, they only said that they do not like laws that are there to oppress peoples. Now, might you say, how are you gonna know? Because your philosophy is somewhat of a cross between Nietche and Sartre, you see no way out. But they (proponents of AP) have a vision of life that value, as the good old american constitution say, life, liberty and "pursuit of happiness". I might even agree with you, dear Rotty, that Jim Bell is a bit naive and shows a kind of outdated philosophy. Jim Bell et al. entertain the delusion that human beings are intrinsically joyous rationnal animals that, most of the time, love life. Therefore, for them, the AP scheme cannot lead to anything but a kind of laissez-faire world where everybody would be able to pursue happiness to the best of their abilities. OTOH, you believe that the natural tendency of AP would bring a world as you describe it vocally here. A world where the essence of Mankind is not to be a rationnal animal, but an animal, period. In that vision, you believe that a bloodthirsty beast within us will always take over. Maybe you learned that truth from your *own* life experience, I have no idea. So, according to your logic, anybody who doesn't like you will put a prize on your head, and probably look up the necrology section of the paper everyday while gigling. And here, I have to conceed that you may be right. After all, what philosophy ran the country since a hundred years? Huhh? So many peoples are so convinced of that that AP might very well turn against it's originator and further corruption. Don't you think so? > if you think that a government is a tyranny, perhaps you are not > aware of the tyranny of the irrationality of individual men. That sentence should earn one of the top spot of the CP top-ten-of-the-year list! ROTFL and L and L and L ! > it will "work" exactly as anonymous murdering now works. Nobody is more deaf than the blind who does not want to smell... > ah yes, exactly what we need. "enhanced anarchy". you and TCM really > should get together and collaborate. I'm sure you'd come up with > some fruitful conclusions. Who knows? JFA DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal JFA Technologies, R&D consultants; physists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 I reserve the right to post publicly any private e-mail sent to me. Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

1 0

Re: MixMaster fair use
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"loki(a)infonex.com" 22-MAY-1996 03:43:54.45 >It is patent on RSA, which expires in 2000 as I remember. It can be >licensed, but it is not cheap. I don't know how they would handle a free >program which people pay to use. Do they allow non-profit usage? If so, you could send out a new version that supported ecash payments, with an agreement not to use it for profit. I'd call building up a reserve against legal fees a justifiable action for a non-profit organization (if the interest went back into the same account or toward operating the remailer), but IANAL. Could someone who is comment, preferably after looking over the RSA license? -Allen

1 0