December 2003 - cypherpunks-legacy

forged addresses
by nobody＠nowher.com 17 Dec '03

17 Dec '03

Hi, I'm not sure if there was ever a thread on this, but I was wondering if anyone can determine your real email address, if you were to fake it to your email client. I hope that this doesn't offend anyone, since this is a high traffic list, but I was wondering if this would work. To try it out, I setup my client to think I was someone else, and sent myself an email. I could only figure out what ISP it came from. What I would like to know is, can any of the experts on this list determine my address from the header of this post?? again, if this is something that I shouldn't have done, just let me know, and it won't happen again.

2 1

Re: NRC crypto policy report to be released Thursday
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The initial September 14, 1994 announcement of the NRC National Cryptography project is at: http://www.wpi.edu/~ryant/ncp.html It describes the program and lists committee members absolutely certain to deny GAK tomorrow, trust them.

2 1

NSA's role in Digital Telephony bill...
by Robert Hettinga 17 Dec '03

17 Dec '03

C'punks, I had dinner with another cypherpunk, Peter Cassidy, and he said that he just finished something for the Sacremento Bee's "Forum" section, which talks about the NSA's involvement in the Digital Telephony bill. Those of you who get the Bee might want to fill us in on the details, whenever the article. He said that the article might go to the wires, so we might see it elsewhere... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: [crypto] crypto-protocols for trading card games
by Gary Howland 17 Dec '03

17 Dec '03

David F. Ogren wrote: > Cards are not transferrable. In order to make cards transferrable the > game company must be able to invalidate cards which have been traded > to others. In other words if Alice wants to give a cards to Bob she > must: > > 1. Contact the game company and tell them she wants to give the card > to Bob. 2. The game company must issue a new card to Bob with a new > serial number and with Bob's public key rather than Alice's. 3. The > game company must invalidate Alice's old card. Since there is no way > that the game company can make sure all copies of the card have been > destroyed it must create a "invalid serial number list" and have the > players dial into that list everytime the game is played. This is the double spending problem. > Since step 3 is so costly to implement, I think it is unlikely that a > cryptography-based trading card game will have tradable cards. Given that untraceability of tradable cards is less of an issue than with e-cash, why not have a central registry of the owners of the cards (which would consist of the card details paired with the public key of the owner)? Admittedly this means the players must be on line, but then we all know how difficult off line detection of double spenders is. For anyone who is _serious_ about starting work on such a game system, I have a few pieces of Perl and Java code that would really get you on your way - let me know if you are interested. Gary -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

1 0

NRC Cryptography Report: The Text of the Recommendations
by John Gilmore 17 Dec '03

17 Dec '03

Recommendation 1: No law should bar the manufacture, sale, or use of any form of encryption within the United States. Recommendation 2: National cryptography policy should be developed by the executive and legislative branches on the basis of open public discussion and governed by the rule of law. Recommendation 3: National cryptography policy affecting the development and use of commercial cryptography should be more closely aligned with market forces. Recommendation 4: Export controls on cryptography should be progressively relaxed but not eliminated. 4.1 -- Products providing confidentiality at a level that meets most general commercial requirements should be easily exportable. Today, products with encryption capabilities that incorporate 56-bit DES provide this level of confidentiality and should be easily exportable. 4.2 -- Products providing stronger confidentiality should be exportable on an expedited basis to a list of approved companies if the proposed product user is willing to provide access to decrypted information upon legally authorized request. 4.3 -- The U.S. government should streamline and increase the transparency of the export licensing process for cryptography. Recommendation 5: The U.S. government should take steps to assist law enforcement and national security to adjust to new technical realities of the information age. 5.1 -- The U.S. government should actively encourage the use of cryptography in nonconfidentiality applications such as user authentication and integrity checks. 5.2 -- The U.S. government should promote the security of the telecommunications networks more actively. At a minimum, the U.S. government should promote the link encryption of cellular communications and the improvement of security at telephone switches. 5.3 -- To better understand how escrowed encryption might operate, the U.S. government should explore escrowed encryption for its own uses. To address the critical international dimensions of escrowed communications, the U.S. government should work with other nations on this topic. 5.4 -- Congress should seriously consider legislation that would impose criminal penalties on the use of encrypted communications in interstate commerce with the intent to commit a federal crime. [Page 28 of the "Overview and Recommendations". There's a lot more discussion of each of these in the whole overview, which should be up on the web late today at www2.nas.edu/cstbweb/.]

6 5

NRC Cryptography Report: One More Recommendation
by John Gilmore 17 Dec '03

17 Dec '03

Sigh. Add one more Recommendation. It wasn't on the summary page of the fax copy I got, but it was in the text of the Report, and is in the Web page: Recommendation 6: The U.S. government should develop a mechanism to promote information security in the private sector. John

1 0

Re: Asendmail Status & Politikal Rant
by - 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ben Holiday wrote: <Asendmail Status report deleted> >On to politiks: > >I understand that the entire concpet of this program is a bit >controversial, and I can accept that. Personnaly I am not certain exactly >how to feel about it. I suppose that I am not thrilled about the idea of >cloaking the mailer this way, but at the same time I perceive it as an >evil of requirement. Yes. Yet another example of Unintended Consequences. I seem to be hearing that meme more-and-more these days. >I beleive very strongly that remailers SHOULD exist, >whether or not the CoS, or the FBI agree; and I am willing to be a bit >impolite if thats what needs to be. My only hesitation is that I'm afraid >now might be to soon. Absolutely, I think no fair observer could say that "we" [I know, "there's no 'we'"] "started it." Your concern is valid, IMO, but it should be balanced with the equally-valid fear that later might be too late. I have said this many times, both privately and in public, but it bears repeating: "Things are likely to be worse after the election." Like many here, I am surprised, and somewhat happy [easy issue for my political party] that the administration is making GAK3 noises now, and still trying to Newspeak it into the word "escrow." <"Escrow"-rant resisted to save bandwidth> ... >Anyway, someone raised the argument that the problem was political, and >that a technical solution would do more harm than good - maybe you're >right, I can't see the future, But it seems to me that I read somewhere >that "Cypherpunks Write Code". This statement is amazingly profound in its >implications. You are right, but it all interacts, IMO, in a "team effort." cypherpunks DO write code, and politico-crypto-punks like me admire your work greatly.We also talk about it, and try to spread it around in order to "protect" it. Users are far better off if someone besides me writes their software, :) but I can help them install PGPetc. without too much trouble. [Besides, 2/3 of the Cybergate-cypherpunks seem to write excellent code. I could never compete!] >Anonymous communication on the net depends on the technical solutions >embodied in the current remailing software, and cryptography applications. >If, years ago, the cypherpunks had decided that a publicity campaign, >political lobbying, and apologizing were the right course of action, >anonymous speach on the internet would be virtually non-existant today. If >the cypherpunks decide today that coding is not the answer, where will >free speach on the net be in 5 years? I think it is very naive to beleive >that the world is going to change enough, quickly enough, that remailers >will become accepted, and protected, methods of speaking - no matter how >politically correct we try to be. Sadly, despite my and others' political work to make this statement untrue, I must again agree with Ben Holiday. >Why do we see big business and big government launching a full frontal >assault on the remailers, while the mailing lists continue to operate >without incident? Because the enemy's of free speach recognize where the >true threat to their opression lies. Relying on politics to preserve our >rights is like throwing down your gun and asking the bear to please not >eat you. Agreed. >The powers that be want us to shut up. The programs that we write are the >weapons that will defend our right to speak. Yes, and many like you fill another important function for us, a function for which many of you take personal risks and spend a lot of unpaid time (and I thank you). Without comparing the particular goals, individuals, or any other aspects of earlier movements to the "Internet Privacy movement" of today, I see examples from recent history of how we interact without always knowing it. First, and despite current anti-gun sentiments among many of the same people, I think that the Civil Rights movement in the '60s _would_ have suffered more brutality from law enforcement and the KKK were it not for the armed Black Panthers, who had a diametrically opposed strategy. Second, the more recent "environmental" movement has profited by continuously spinning off more radical factions of itself [ex. "Earth First!"] to make its positions seem more reasonable and reduce the chances of compromise. The key to success seems more to be the capability of more radical action, and yet avoidance of violence or even the advocacy of violence among the mainstream to maintain either good PR, principles, or both, while continuing the political- legal fight. The "threat" of a technical solution "weapon" forces any political opponents to show their cards before they play (or just lie) and ideally involves (because it requires) *no* physical violence whatsoever. Despite opinions to the contrary, "war is [still] the health of the state." -- I forget who said that, sorry. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "Why is it that hundreds of government and university machines can operate what amount to anonymous remailers, and no one pays any attention, and yet cypherpunks are threatened with jail time for what is essentially the same thing?" -- Ben Holiday ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <liberty(a)gate.net> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMa3D7G1lp8bpvW01AQEzawP/VhP+EU1hk5aniN3IZ7cGkn5joUFA9dhj yC/D67wj68pfsTQZNOvRsVpEiapfc2OB3INVnjJroLY3i4r7ebiCoowTl+TF6NR+ MtheZ+mkyclpG832cJQLkWI5C61Lk1M5nNRNZ4blR3Gr07Ip5ku0RVovS0Qo8qyi V9KzwwveO48= =mydx -----END PGP SIGNATURE-----

1 0

Re: NRC crypto policy report to be released Thursday
by frantz＠netcom.com 17 Dec '03

17 Dec '03

The San Jose Mercury News has the top business section article: ON-LINE SECRECY WINS BACKING Without it there could be havoc, panel says Basically the report says the US will get more protection by using strong crypto to secure its networks and systems than by keeping week crypto and allowing LEAs to read comm. The report describes GAK as "an untested, unproven technology that should not be foisted on the public until it is proven in extensive field use by the government." A quote: "We believe government policy should support the broad use of cryptography." ... "We believe it presents problems for the legitimate concerns of national security and law enforcement. But we also point out that strong cryptography is needed because of the proliferation of computer-based crimes, that it would deal with national security issues by protecting vital public networks." - Kenneth W. Dam, Chairman ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Your experiences with CFS
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Hello, Does anyone have any real experience running CFS under Linux (1.2.13)? I was planning to start using it, but am concerned about its reliability. Has anyone experienced any glitches with CFS? How does CFS behave in case of a sudden power loss? Have you tried to use CFS under pre2.0 versions of linux? Thanks! - Igor.

1 0

NRC's CRISIS report: Chairman's opening statement
by Jim Gillogly 17 Dec '03

17 Dec '03

OPENING STATEMENT KENNETH DAM Max Pam Professor of American and Foreign Law University of Chicago Law School and Chair, Committee to Study National Cryptography Policy News Conference on Cryptography's Role in Securing the Information Society National Press Club Washington, D.C. May 30, 1996 *** Good morning. In this age of telecommunications and lightning-speed advances in computing, keeping private information private gets tougher all the time. Without proper safeguards, personal financial transactions, medical records, corporate secrets such as bidding information and proprietary research reports may be compromised by criminals and corporate spies. Without proper safeguards, crucial information systems such as those of the banking system and the public switched telecommunications network may be vulnerable to intrusion by terrorists, curious computer hackers, and unfriendly foreign governments. One of the best ways to protect electronic information is through encryption, which is the use of mathematical formulas to scramble information into digital codes. Once of concern only to spies and the military, cryptography has now become a vital tool for protecting the legitimate interests of the nation's businesses and the privacy of its citizens. This change has created a dilemma for the U.S. government because encryption also can be used in a wide range of illegitimate activities. Drug dealers, terrorists, and other criminals can use cryptography to thwart even legally authorized search and surveillance by law enforcement officials; foreign governments can encrypt information that the U.S. needs to protect its national security. Now the federal government -- which in the past has sought to restrict the spread of encryption -- must weigh the pros and cons of promoting broader use of cryptography. The National Research Council was asked by Congress to provide policy makers with guidance in making this assessment. Our study committee was made up of individuals with expertise in many relevant fields: technical expertise in computers, communications, and cryptography; policy experience in law enforcement, intelligence, civil liberties, national security, diplomacy, and international trade; business experience in telecommunications and computer hardware and software, as well as in protecting information in the for-profit and not-for-profit sectors. It was formed to examine the appropriate balance among various national security, law enforcement, business, and privacy interests. Our committee's broad conclusion is that the advantages of cryptography in safeguarding information outweigh the possible disadvantages of making apprehension and prosecution of criminals more difficult. Thus, we believe that federal policies should promote rather than discourage the use of encryption. For example, current export controls impede the use of strong encryption by U.S. firms with foreign customers and suppliers as well as reducing the availability of strong encryption domestically. The government needs to make it easier for U.S. companies operating internationally to use strong encryption, and for U.S. technology vendors to develop and sell cryptography products both in this country and abroad. Indeed, maintaining world leadership for U.S. information technology vendors is an important contribution to national security, as well as being important to the economy. Furthermore, the development of products with encryption should be driven largely by market forces rather than by government-imposed requirements or standards. There are no legal limits on the kinds of encryption that presently can be sold in the United States and we strongly endorse the idea that no law should bar the manufacture, sale, or use of any form of encryption within the United States. We do not believe that by adopting such a course the government would necessarily be choosing the interests of business and individuals over those of national security and law enforcement. We say this for two reasons. First, availability of encryption technologies will benefit law enforcement and national security. Here's how: by making economic espionage more difficult, cryptography supports law enforcement. By protecting elements of the civilian infrastructure such as banking, telecommunications, and air traffic control networks, cryptography safeguards national security. The second reason is that current national policy -- which discourages the use of cryptography despite its many valuable applications -- can at most delay encryption's spread. Already, the use of such technologies is growing, and in the long run, we believe widespread non-governmental use of cryptography in the United States and abroad is inevitable. The government should recognize this changing reality and help law enforcement and national security authorities develop the new technical capabilities they will need to conduct investigations and surveillance in a world in which information will be more protected and even unencrypted communications will be harder to read. Our report also urges that the government should explore escrowed encryption rather than the aggressive promotion that is the case today. Encrypted information is unintelligible to anyone lacking the keys to unlock the digital code. In escrowed encryption, the decoding key would be held by a trusted third-party organization or institution. This is attractive to law enforcement agencies because with a court order, they could obtain the key and unlock even the most unbreakable code. However, escrowed encryption is relatively untried and many unresolved issues remain, ranging from the liability of these third parties to the magnitude of the risk incurred by companies trusting these third parties with the keys to their sensitive business plans and trade secrets. Rather than aggressively promoting escrowed encryption, our committee believes that the government should explore escrowed encryption for its own purposes as a way of gaining operational experience with this technology and making it more useful to the commercial sector. Even when that occurs, we say that adoption of escrowed encryption or of any other specific technology or standard by the commercial sector should be voluntary and based on business needs, not government pressure. To make it easier for U.S. companies with foreign customers and suppliers to protect their information with the best encryption technologies, the committee believes that export controls should be progressively relaxed, though not eliminated. Right now federal law makes it hard to export strong encryption technology. This helps protect the government's ability to gather foreign intelligence. However, it also makes it more difficult for U.S. technology vendors to produce and sell cryptography products both here and overseas, and it limits what's available here because software companies are reluctant to develop different products for U.S. and foreign markets. And we call on the executive and legislative branches to develop national cryptography policy on the basis of open public discussion. In the past, government officials have treated many aspects of cryptography policy as "top secret," to be discussed only behind closed doors. This has led to considerable public distrust and resistance, which makes it impossible to achieve consensus. In our report we point to a number of specific areas such as telecommunications and banking where the government should actively promote the adoption of encryption. For example, the privacy of the cellular phone and the security of the nation's telecommunications networks should be enhanced through the use of cryptography. In the case of the cellular phone many people have at home, the digital signals sent between the cell phone and the cell's ground station could be encrypted. This would prevent eavesdroppers from listening in on conversations. Overall, we believe that adoption of our recommendations would lead to enhanced protection and privacy for individuals and businesses in a many areas, while also bolstering the international competitiveness of U.S. companies. My colleagues and I will now entertain questions from the media. Before asking a question, please step to an aisle microphone and state your name and affiliation. ----------------------------------------------------------------------------

1 0