December 2003 - cypherpunks-legacy

Re: "Filegate" may be good news for us
by minow＠apple.com 17 Dec '03

17 Dec '03

>The current flap over the Clinton Administration's request for and receipt >of FBI dossiers is being called "Filegate." The Administration has claimed >the requests were innocent, and based on outmoded Secret Service lists. The >Secret Service denies this, and says the list did not come from them. ... >Why is this good news for us? (Besides the partisan issue of embarrassing >and degrading the current government, which is always a good thing.) > >Because it underscores how difficult it is, even with ostensible >safeguards, to control the distribution of dossiers, secret files, and >surveillance reports. Another reason is that it shows the problems with sensitive data even if people have *legitimate* access to that data (i.e., assuming that there was no mischief involved. Ignoring all privacy issues, escrowed encryption keys will be extremely valuable as they will allow insight into financial transactions. Thus, they will be very attractive targets for economic espionage. Martin Minow minow(a)apple.com

1 0

For the public record: My submission for the crypto hearings (LONG)
by Ernest Hua 17 Dec '03

17 Dec '03

I would encourage others to submit their opinions ASAP at: http://www.crypto.com Ern ------- Forwarded Message Date: Fri, 21 Jun 1996 17:47:51 -0400 (EDT) From: hua(a)chromatic.com Subject: Testimony submitted for Congressional hearings on 6/26/96 The following testimony was submitted from http://www.crypto.com/submit/ Please contact Shabbir J. Safdar at shabbir(a)vtw.org if any information is not correct. Do you use encryption technogies today (e.g., PGP, etc..): no If no, why not: Because it is not built in to a lot of the products I use today (e.g. email programs) As an Internet user, security and encryption are crucial to my privacy because: Both 1 and 2 equally Tell us more about why you would (or would not) use strong encryption as an individual Internet user: Unlike murder, terrorism, burglary, etc, there are activities which are socially "borderline", meaning that some people want to outlaw but some people don't. There are activities which may be embarassing to publicly acknowledge, but aren't really illegal. I firmly believe in our legal system, but I also firmly believe that there are questionable laws, and today's criminals and trouble makers could be tomorrow's civil right advocates or Nobel peace prize winners or freedom fighters. Encryption does not allow these "questionable" people to murder or harm anyone. It is just software. It is not a knife or a gun. Unlike what the FBI wants everyone to believe, encryption does not mean hackers can now break into the Federal Reserve and destroy the US banking system (in fact, encryption, among many other technologies, help protect these systems in the first place). As a business owner or employee, security and encryption are critical to my business because: Both 1 and 2 equally Tell us more about why you would (or would not) use strong encryption as a business user of the Internet: Hackers, viruses, industrial espionage, privacy, network traffic control, time stamping, etc. I don't believe, for a moment, that being a government official exempts a person from having character flaws or less-than-saintly behavior. I don't think they are necessarily any WORSE either, but I believe everyone is human to some degree. There are honest mistakes, there are less-than-honest mistakes, and there may, on rare occasions, be horrible evil. We must hold people in power (governmental and otherwise) to high standards, but we cannot lower our guard just because we expect them to be saintly. Given what you know about Key Escrow systems: I would use an escrow system only if I could choose the key holder (including my friends, lawyer, accountant, etc.) Do you think that the government should be able, under certain circumstances, for a limited time, and only with the specific authorization of a Judge, have the authority to conduct electronic surveillance in order protect public safety and national security? Yes Tell us why or why not: I think the government should have the resources to be "above current technology". They can invest in super-wiz-bang decryption and surveillance technology that the ordinary person cannot buy or make. However, if the ordinary person can buy or make it, then it is silly to think that a law will make a criminal NOT buy or make it. Just look at the illegal weapons trade as an example. Encryption should be illegal if it a morally, ethically bad thing to possess or use. However, making it illegal just because it becomes extremely inconvenient for law enforcement is like requiring that every room in every house be installed with a government-approved video camera, just in case you were involved in some illegal activity. Afterall, significant percentages of child abuse or child molestation (or pick your favorite emotionally-charged crime) are done within the comfort of the child's home. This last idea, about the cameras in every room, is not that far off in some countries. Britain has cameras in many public areas already. It would be law enforcement's (excuse the language) "wet dream" to have such all-seeing access. The only reason they have not asked for it is because it would never be acceptable to the public. But, unlike video cameras, encryption is something which very few people understand yet, so the FBI can feel okay about asking for something which only a few "hackers" and "liberals" are against. What does strict control of encryption buy law enforcement? Not much. Encryption is only hides information, but the more globally accepted illegal behaviors are far more tangible than information. A murder assumes that there is a missing person or dead body or traces to be recovered. A molested child assumes that there is a child who is harmed. No amount of super-military strength encryption can hide these physical things. So this issue becomes one of why should we give up privacy for the sheer convenience of the law enforcement community. There is also the question of why, no matter how much escrowing, should there be a strength limitation on encryption? Who ELSE is trying to decode this stuff besides law enforcement, who presummably has access to the escrowed keys? This aspect of the pro-escrow proposals raises all sorts of questions about just how much hidden abuse is there in the government. If you are not a US citizen (and live out side the US) and you use encryption, please tell us what you use and how you obtained it. I am now a citizen, but I was previously a citizen of Taiwan during some very tough times. The government was honest about violation of privacy: On the phones were clear warnings stating that you should NOT talk about political issues over the phone; you may be tapped. That's not a nice situation, but at least they were honest about how widespread the use of wiretaps would be. And those were exceptional times of crisis. But we, in the US, are not in a time of military-grade crisis. There is no foreseeable need for wide-spread imposition of martial law. There is no uprising, no wide-spread terrorism of any sort. I just do not see the need for the surveillance powers that the FBI wants. Business name:Chromatic Research Street:615 Tasman Drive, Sunnyvale State:CA Zip code:94089-1707 Phone number:(408) 752-9375 Business WWW URL:http://www.chromatic.com Description of business: High performance media processors for personal computers. ------- End of Forwarded Message

1 0

Re: Federal Key Registration Agency
by David Rosoff 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 03.05 AM 6/21/96 -0700, William Knowles wrote: >On Thu, 20 Jun 1996, jim bell wrote: >> If done in parallel, on a dedicated, 200 MHz custom chip, my WAG says that >> such a chip could try, and statistically analyze the results of 10 million >> DES codes per second. (it would do the decrypts on a number of parallel >> DES blocks, and look for typical ASCII code pattern probabilities, again all >> in parallel.) A typical cracking system might have 100 boards of 100 such >> chips, or perhaps a 100 billion such decrypts per second. Checking the >> keyspace would require 2**19 seconds, or about a half million seconds, or 6 >> days. Average decrypt, of course, in 3 days. Wasn't there a crypto paper three or four years ago that said if custom chips were used, a million dollar custom machine could crack a DES key in less than a day? =============================================================================== David Rosoff (nihongo o sukoshi dekiru) ----------------> drosoff(a)arc.unm.edu For PGP key 0xD37692F9, finger drosoff(a)acoma.arc.unm.edu 0xD37692F9 Key fingerprint = 25 7D AA 01 85 41 43 89 50 5A 33 76 F1 F1 99 67 Non-technical beginner's guide to PGP ---> http://www.arc.unm.edu/~drosoff/pgp/ Anonymous ok, PGP ok. If it's not PGP-signed, you know that I didn't write it. === === === === === === === === === === === === === === === === === === === === "Truth is stranger than fiction, especially when truth is being defined by the O.J. Simpson Defense Team." -Dave Barry -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMctQlxguzHDTdpL5AQE0MgP9GAtJIBZRhV+VIIqiojiZsO5qz3vqN3xe 5UQ0W1uRxZgckLOs5h57/IiDhAGTwzoB1x4pOKlbsp/Pv2zgDNl5hTAUJiQIKpHX vdcyJBUYRUCCfHuZfRxXVeEhhWMzSowLvWNVyapLSwFo6exY1ozMgcchy1YSx1sd kEpJtlUegiE= =MfyQ -----END PGP SIGNATURE-----

1 0

Re: Science Lessons in the Mountains of New Mexico
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:39 PM 6/21/96, se7en wrote: >Cryptography may not academic science's only contribution to making >business work in an unpredictable, technology-driven world. If a growing >community of natural scientists, social scientists, and business >theorists are right, then the cryptographic algorithms taht make >electronic transactions secure will soon seem downright prosaic. > >This unusual admixture of pure researchers and real-world practitioners >tends to congregate around research institutions in New Mexico, which has >been a scientific hotbed ever since the atomic bomb project of the 1940s. ... Se7en, I am curious. Did you write this, or is this a forwarded article? If you wrote this, it is very typical of journalistic treatments, and is well-written. You have a career in journalism ahead of you (or perhaps you currently are a journalist, under another name, in which case you should still indicate what your actual journalistic name is, as I doubt you write under the name "se7en." If you did not write this, then you need to start including indications about who did write it, and where it appeared, and that it's a forwarded article. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Sen. Specter and Kerry move to delay crypto legislation
by Declan McCullagh 17 Dec '03

17 Dec '03

Two things: 1. The letter was copied to Mark Heilbrun, and a phone number is helpfully provided below. 2. D'Amato was copied to encourage him to claim jurisdiction over part of this legislation, yank it into the banking committee, and delay, delay, delay. -Declan declan(a)well.com -------------------------------------------------------------------------- United States Senate Select Committee on Intelligence June 7, 1996 SSCI #96-2219B The Honorable Patrick J. Leahy United States Senator Senate Russell Building, Room 433 Washington, D.C. 20510-4502 Dear Pat: We write to express our concerns about legislation you have sponsored which would impact directly upon federal encryption policy, including export control policy. Recognizing that American innovation in encryption technology is unequaled, we appreciate the need to balance US economic competitiveness with the need to safeguard national security interests. As such, it is our belief that this legislation requires careful study and reflection and that the Senate and the Congress as a whole should proceed with caution until all of the implications of such an initiative are fully discerned. Along these lines, it is our understanding that industry representatives are currently meeting with the Administration to discuss new policy initiatives to address this issue. Also, both the Congress and the Administration have undertaken to conduct a thorough analysis of a two-year congressionally-mandated study on federal encryption policy that was facilitated by the National Research Council. We therefore feel that your legislation initiative at this time is premature. We appreciate your efforts to bring some needed clarity to United States policy in this area and wish to keep the lines open for discussion and debate on this important issue. The staff point of contact on this issue is our Committee Counsel, Mark Heilbrun, who can be reached at 224-1700. Sincerely, Arlen Specter J. Robert Kerrey Chairman Vice-Chairman cc: The Honorable Alfonse D'Amato Chairman, Senate Committee on Banking --------------------------------------------------------------------------

2 1

Re: Federal Key Registration Agency
by Bill Stewart 17 Dec '03

17 Dec '03

>Michael Froomkin writes: >> I have seen the text of the speech. The wire service accounts wildly, >> wildly exaggerate. This is a non-story...except for AG Reno's assertion >> that it would take the government a year to break one DES message with a >> "supercomputer". She presumably believes this. .... At 07:54 AM 6/21/96 -0400, Perry wrote: >The numbers in the Blaze et al paper are very realistic on this. A >year is total bull -- not even within several orders of magnitude of >accuracy. Actually, it may even be low - Cray-type supercomputers aren't particularly designed for the bit-twiddling you need to do DES well. An application- specific cracking machine can do it several orders of magnitude faster for a smaller amount of money. Wiener's design was two orders of magnitude more cost-effective than the two previous designs (Peter Wayner's content- addressible-memory design and somebody-from-DEC's GaAs chip design were both about $50M for a 1-day crack), and those were substantial breakthroughs when they came out. But yes, she's giving out very misleading numbers for what cracking DES really costs, and I'd assume she's way too competent to be doing so by accident - or at least she should be... As far as Jim Bell's cracking cost estimates go, a Wiener-style machine would cost about $1M for a 3.5-hour crack, or about 7 keys per day with known plaintext. If the on-chip penalty for detecting probable patterns instead of specific ones is small (e.g. first cut is to accept keys which have all the high-bits zero, which is 1/256 of the total), you should be able to do better than three days per crack, especially if it's also not too expensive to haul the key-schedule out of the chip on the 1/256 hits. Double the cost if you think there's a random initialization vector, and do other minor annoying things to the chip design if you're checking for several popular known plaintexts and other creeping featurism, and you're still close. You may be willing to feed the hits from the first round set of crunching into a more normal computer as well... # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Dispel Authority!

1 0

Re: Win95 Blowfish Implementation
by Bill Stewart 17 Dec '03

17 Dec '03

>So correct me if any of the following statements are incorrect: >1. Blowfish is not patented and can be used without royalty. According to Schneier's book (which should be authoritative, since it's his algorithm), the algorithm is unpatented and the C code in the back of the book is public domain. >2. SHA can be used without royalty. Yup. Use SHA-1 rather than the original SHA, though; the NSA "updated" it in ways that do appear to strengthen it. >3. MD5 can be used without royalty if the RSAREF library is used, >and if the proper credit is given to RSA. >Also, can the MD5 algorithm be used outside the RSAREF library? In >other words, can I rewrite the code to take in effect MFC classes? Yeah. I think there's even an RFC that comments on it. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Dispel Authority!

1 0

Re: Science Lessons in the Mountains of New Mexico
by Deranged Mutant 17 Dec '03

17 Dec '03

So where did you get this promotional hype? At least quote your sources. (Or did you write this?) The tone of that piece sounds like an advert telling me to invest $$$ into Santa Fe Inst. On 21 Jun 96 at 13:39, se7en wrote: [..] > The current thinkers are looking into not just mathematical complexity, > but complexity itself. Complexity theory. Complex systems of any > definition--the weather, perhaps, or the human immune system, or the > organizational behavior of insects--and how their workings and > adaptations might hold lessons for other fields, not least business. [..] Methinks "Complexity theory" (aka Dynamical Systems Theory) is wonderful hype to get research grants. Certain people think by throwing money into this area that they can predict better, when much of theory deals with how these systems *cannot* be well predicted in *some* areas of behavior. Other people over-mystify the complexity of a system and declare *nothing* can be predicted, of course. Something akin to 60s-70s electrical utility exces bragging to each other on golf courses about how they own nuke plants. Hip thing now is for the company to invest in research or use methods based on "Chaos Theory"... you'll be really cool at parties if you drop those words to people. Any form of analysis that uses lots of variables gets labelled as having to do with "Chaos Theory" and the research grants grow, even though it may not deal with those variables as a *dynamic system*. Substance though? Not that studies in compelx systems are useless. By far the opposite. (though the question of useful to *who* is important. Using chaos theory to enhance methods of central control rather than allowing emergent behaviors is one downside of what some people are looking to the Santa Fe institute for.) Other than noting crypto in the first paragraph and mentioning SmartCards, what does this have to do with crypto and socio- political implications of widespread use of crypto? ObCrypto: similarities in literature on chaos theory and cryptanlysis. I've seens refs to using various forms of chaotic equations or cellular automata for crypto, but most of the writers seem ignorant of any crypto-literature (never mentioning that Wolfram's PRNG is crackable, for instance). Backburner Idea: if all 1D CA's are equivalent to LFSRs, and if [need to find refs to this alleged proof] all 2+D CA's have an equivalent 1D CA, then if a crypto algorithm can be duplicated as a CA... Alas I ramble on about ideas which I am not an expert at... Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Reno's Cyberspace Address
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Thanks to LG: "Law Enforcement in Cyberspace Address by the Honorable Janet Reno, United States Attorney General." Presented to the Commonwealth Club, June 14, 1996. http://pwp.usa.pipeline.com/~jya/addres.txt (25 kb) ADD_res

1 0

Re: FW: Bashing "Wired"
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:32 AM 6/21/96 -0700, you wrote: >And notice that increasingly the "journalists" are the quoted thinkers and >strategists in important areas? Someone majors in English, starts writing >for "Netizen" or "HotWired," and the next thing you know they're debating >crypto policy with Conrad Burns and Dorothy Denning. We're in an age where >the medium truly is the message You don't think the rest of the press is truly any better, do you? At least on the net, you get to see the horse's mouth on a bad day, and sometimes you can even meet the people and track down the rumors hat eventually become headlines, and pull the wool over your own eyes. Dorothy Denning may know a lot of mathematics about cryptography, but that doesn't make her any more fit to decide what policies the government ought to enforce than I am. She'll get the technical details correct far more often than Senator Burns, as would most people here, but being a trained ethicist would perhaps be more relevant than being a trained mathematician - it doesn't take that much technical explanation to know that crypto lets you have private conversations. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Dispel Authority!

2 1