December 2003 - cypherpunks-legacy

RE: gack vs. key escrow vs. key recovery
by blanc 17 Dec '03

17 Dec '03

From: Vladimir Z. Nuri, [who still doesn't get it] what is the precise difference between gack, key escrow, and key recovery? [and] I'll be watching the debate closely, as the true extremists incapable of compromise (and thereby living in a fantasy world) show their colors.... ............................................................................... The precise difference is: who is in control. In order to understand this critical point you must understood the idea of having personal authority as a standard for living. But you would expect that everyone should accept being subject to inspection by default, as if governments owned everyone within the national boundaries and keeping personal things away from them were a sin. The more that governments obliterate the lines of division between what is exclusively one's own to manage and what they have "the right" to share in (including holding your extra keys) or to demand (access to private communication), the less defined the concept of individuality becomes (as compared to being a "borg" of the State) and the more difficult it becomes intellectually to uphold one's separateness from it, since it all seems to be the same, undifferentiated control over things in general ("we are all One - how could you object?"). It is right to resist any attempts by the State to assimilate everyone into its fold by blurring the boundaries of authority (in its favor). It is a better thing to strengthen each individual's ability to maintain their own, than to put them in a situation where they *must* use the assistance of (become dependent upon) the (supposed) benevolence and rational judgement of an overwhelming overseer. It is better to reserve the right of authority over who & when anyone may keep one's software keys in escrow. It is better than to forfeit the right to make that decision on one's own good time and according to one's own plan, which would otherwise weaken that authority. .. Blanc [If 51% of the true extremist voters would elect Harry Browne, GAK would not be a problem.]

1 0

Re: ADJ_ust
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Tue, 1 Oct 1996 10:26:12 -0800, Timothy C. May wrote: >Personally, I think there's a lot of hype about this whole "infowar" thing. >Sure, security measures and vulnerabilities always need to be looked at, >but a lot of the rhetoric is being driven by journalists looking for lead >stories. This is certainly the case with 99% of the computer industry press! I certainly have no problem believing that a group of well-supplied professionals could, with enough time and [political] support, take down a single target. For instance, if the CIA,FBI and NSA wanted to hose the 1st Bank of China, I have a feeling that they would - eventually. I have strong doubts that someone would come up with a non-nuke that could destroy stuff indiscriminately within a useably large area. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

5 4

Conspiracy Stuff: Ron Brown's death and Crypto ...
by Ernest Hua 17 Dec '03

17 Dec '03

Too much fun for the conspiracy buffs ... Did Ron Brown's plane really fly off course due to pilot error? No, don't even bother replying to me on this matter. I'm just up too late, and I tossing this one out there on a whim ... Ern -------- INCLUDED ARTICLE (From: New York Times "CyberTimes"): Commerce Department Urges Easing of Encryption Controls By Bloomberg Business News WASHINGTON - The Commerce Department will recommend easing export controls on encryption software after a study by the department and the National Security Agency found that American companies are being hurt, Commerce Secretary Ronald H. Brown said last week. Such a move may pit Mr. Brown against the military and intelligence agencies, setting the stage for a White House battle over one of the last computer technologies still covered by export controls. "I'm interested in promoting American exports," Mr. Brown said in an interview on Friday. "If your foreign competitors are exporting products with encryption capability and you are not, that puts you at a tremendous competitive disadvantage." The Government bans United States companies from exporting encryption software - hard-to-break computer codes that turn information, like files and credit card numbers, into indecipherable material that can be sent across computer networks without fear of tampering. The United States justifies the export restrictions by saying law-enforcement agencies would be hamstrung in their efforts to stop terrorists or spies from using encryption to send information worldwide.

2 1

DESCrack keyspace partitioning
by geeman＠best.com 17 Dec '03

17 Dec '03

What about the heuristics of partitioning the keyspace? Seems to me that a _subset_ of all possible keys is much more likely to appear than a random selection from an equidistributed population 0..2^56. (P)RNG's just aren't that likely to produce a key of 010101010..... nor 001100110011... etc etc and I have been thinking about how one might formalize and exploit this randomness property to increase the probability of finding the key sooner. So a keysearch strategy should be something other than a partitioning of 2^26 into N bins with a linear search within each bin. I realize that it is POSSIBLE that a key of 1010101010... was used, (excluding weak keys from consideration) ---- but I have seen "certifiable" RNG's and, God Bless 'em, they just dont ever produce anything with any predictability. Is not the lack of predictability a predictable, and therefore exploitable, attribute? Any thoughts here? ----------

9 9

Re: FUCK!!!!!!;-)
by Will Rodger 17 Dec '03

17 Dec '03

Someone who won't put his name to things he writes wrote: At 04:05 AM 10/3/96 -0400, Anonymous wrote: >+ --- begin forwarded text >+ >+ "Keys" are strings of computer code that lock and unlock data. Key recovery >+ is an approach that permits the recovery of lost or damaged keys without the >+ need to store or "escrow" them with a third party. This approach could also >+ meet the needs of law enforcement to act under the authority of a court order >+ without risking the confidentiality of business data. > >Just wondering how much of a problem "damaged keys" really are in >practice. Is this something specific to Microsoft filesystems or >really cheap tape drives? I've never seen that problem under Unix, >and something like a private RSA key doesn't change very often, so you >would expect to have encrypted copies of it on many backup tapes. > >Or maybe this journalist, like most, doesn't know what the fuck he's >talking about? > To which this card-carrying member of the media replies: Companies cited in the PRESS RELEASE - that means public relations product, not journalism product - were involved in signing off on what went into the release. By definition, no member of the press was involved in producing this document It seems directing questions to the companies would be a good idea. Will Rodger Washington Bureau Chief Interactive Week.

3 2

Re: Clipper III on the table
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:50 PM 10/3/96 -0400, Anonymous wrote: > >Ernest Hua <hua(a)chromatic.com> wrote: >> I predict, therefore, Netscape and RSA would NOT capitulate to this >> latest bitter carrot. > >Huh? RSA has already gone over to the dark side. According to >http://www.rsa.com/PRESSBOX/releases/keyrecov.htm: > "The recently announced Key Recovery Alliance, of which RSA is a part, ..." I think we should refer to what they are pushing as the "Key Recovery Alliance Program". K.R.A.P. is a good description as to what we are going to get from them. --- | "Remember: You can't have BSDM without BSD." - alan(a)ctrl-alt-del.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

5 5

Re: Fw: Re: ITAR satellite provision
by jim bell 17 Dec '03

17 Dec '03

At 07:17 AM 10/3/96 -0400, Black Unicorn wrote: >On Thu, 3 Oct 1996, Remo Pini wrote: >> Date: Thu Oct 03 08:08:42 1996 >> > >* A launch vehicle or payload shall not, by reason of the launching >> > >* of such vehicle, be considered an export for purposes of this >> > >* subchapter. >> > Okay, everybody, call Estes! We've got some crypto to export...er...laun >> > ch! >> If I get the above wording correctly (unicorn, help me!), it is sufficient >> to put the cryptostuff on a disc in a LAUNCHABLE device, it never says that >> the payload has to be delivered by air. So, just put that thing in a bag >> and get it through customs... (or does "by reason of ..." mean that the >> exclusive means of export allowed is launching ?) > >The launching alone will not cause it to be an export. If it is launched >and then ends up outside the U.S., it could be an export. Certainly if it >is launched with the purpose of exporting crypto, it will be an export. Too bad you didn't support this with a logical argument. The wording was clearly intended to be an exception to a rule. What the wording doesn't include is the "exception to the exception," most likely because they weren't thinking in too great a detail when they wrote the regulations. But if the regulation is "wrong," the fault of that is those who wrote the regulation. (and we, the public, are entitled to assume that the regulation is "right" in its literal meaning.) It appears that the government left a loophole so large that you could drive a truck...er...shoot a rocket through it. Jim Bell jimbell(a)pacifier.com

4 3

How to fight GAK by obeying the law
by Ernest Hua 17 Dec '03

17 Dec '03

It seems that the best method for fighting GAK is to accelerate wide-spread domestic use of freely redistributable non-GAK crypto. The Lynux automatic firewall concept that John Gilmore is pushing is a great idea, but it is still brewing, and he's shooting for developing an exportable ... er ... importable version. That will take much time to develop, and time is what we don't have much of. We need to work on applications, API's, flexible software modules, etc. and the primary reason we cannot do it so easily is because we cannot redistribute the software so easily. First thing we definitely need is a way to determine with fairly good accuracy, whether a host is in the U.S. This MUST be an automagic mechanism ... no person involved so there is little delay in getting the goodies. The best implementation would automatically set the group of an incoming anonymous FTP session daemon to a special group if there is a high degree of certainty that the originating host is within the U.S. Second thing we definitely need is a convenient way and universal way to clearly notify the recipient of the current export restrictions of such software, so that the recipient knows what he/she is in for. Basically, we have to do our best to NOT violate the law, no matter how much we hate it. What the government wants to happen is that everyone will get hooked on GAK, and it will be too inconvenient to use something else. A good counter-strategy is to get everyone hooked on the good stuff. Right now, the FBI/NSA is looking for an excuse to prosecute anyone not jumping on their bandwagon. We have to avoid give them an excuse to prosecute us while still enabling rapid application development. Communication and distribution are key. Ern

3 2

Clipper III questions
by Eric Murray 17 Dec '03

17 Dec '03

The recent CDT policy post sez of Clipper III: >* Access to keys internationally "would be provided in accordance with > destination country policies and bilateral understandings." This reminds me of the understanding between CIA/NSA and their counterparts in British Intelligence. Both sides are prohibited from spying within their own countries borders but are encouraged to spy in other countries. Both would very much like to spy on their own citizens (for legitimate law encorcement/national security reasons only, of course). So, they have a simple system in place. The British spy on the American citizens that the Americans want spied on and then turn over the intercepts. The Americans do the same for the British in Britain(*). Sometimes they lie to each other or withhold material, but that's what spy organizations do all the time. If Clipper III passes and the OECD gets their member nations in line with what the American miliary wants, I predict a similar system will evolve. "Destination country policies" will allow decryption of incoming GAKked messages from non-citizens. After all, they have no rights, do they? Cooperating intelligence agencies will then exchange intercepts. Presto Chango, pesky privacy rules vanish right before your eyes! Of course this is in our best intrest, we must fight against terrorisim with all methods possible. The ends justify the means. A question: What happens if a company decided not to go along with Clipper III? Can they still ship the "old" 40-bit-style GAKware unimpeded? Or will there be a slow tightening of the rules to force compliance? The existing way of doing things depends to a large degree on a set of "common practice" which the NSA doesn't have written down. For example you won't find the 40 bit limit written anywhere in ITAR, and if you want to export something that's already been approved elsewhere (i.e. another implementation of SSL) you still have to go through the approval process. (*) this comes from "The War Aginst the Jews" which is worth reading. Sorry I can't find my copy at the moment, maybe someone who's got it handy will provide authors/ISBN. Capsule review: covers government dirty dealing from the early 1900s on, mostly British and American. Concentrates on Jews and Israel of course but they seem to have been the brunt (sometimes the instigator) of a lot of the dirty pool that governments have played. -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

3 2

gack vs. key escrow vs. key recovery
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

cpunks, a note about recent developments in "key recovery" initiative. I think cpunks as a group should reconsider very seriously their own positions on cryptography and come up with something more sophisticated than "any government bill or plan associated with crypto is evil" which is the functional equivalent of the ideology behind many recent posts. what is the precise difference between gack, key escrow, and key recovery? TCM has argued that the administration is muddying the issue by manipulating the terminology. perhaps so, but I feel that cpunks are equally guilty, by branding anything that emanates out of the government as inherently orwellian. do you always have to have an enemy? is the government always going to be your enemy, no matter what they do? I have posted here before that many companies find the concept of "key recovery" highly acceptable and even desirable. the basic question is, what does this mean to wiretapping and search warrants and subpoenas? it is clear we are coming to a fork in the road at this moment. there are going to be two types of cpunk opinions based on recent developments. 1. those who feel that wiretapping was illegitimate from the start and are working to make wiretapping impossible. confronted with a legal search warrant/subpoena etc. for personal data, they would not hand over keys. they would "superencrypt" in systems that do etc. 2. those who feel that there is such a thing as a legal warrant or subpoena for information protected by cryptography keys, and would agree that this logically means that governments will be getting access to "key recovery" infrastructures. personally I am leaning toward 2, because I feel that we already live in such a society, and that it is not orwellian. companies are going to lean toward (2). I do agree that the gov't has the potential to twist this process to evil ends, but that has always been true of everything about democratic government, and the recipe for 200+ years has always been and remains "eternal vigilance". in other words, I am in favor of some kind of mechanism by which the government can obtain keys via subpoenas/warrants. cpunks, I think we should try to clarify our terms and come to some conclusions. those who continue to pursue (1) are going to be perceived as more and more radical and extremist, because arguably it is not even a system we have today or one that was ever devised. remember, the constution guarantees freedom from *unreasonable* search and seizure, but never prohibited search and seizure in the first place!! apparently at least our found fathers believed that "reasonable" search and seizure was a wholly legitimate function of government, based on this wording. regarding (2): the government may actually help bring crypto to the masses via the post office and other routes. are cpunks going to continue to hold the simplistic, reactionary, knee-jerk, black-and-white opinion that "anything with the word 'government' in it is evil"? "if the government is doing something, then we must sabotage it"? I'll be watching the debate closely, as the true extremists incapable of compromise (and thereby living in a fantasy world) show their colors....

6 6