December 2003 - cypherpunks-legacy

Re: How might new GAK be enforced?
by jim bell 17 Dec '03

17 Dec '03

At 08:55 PM 10/1/96 -0800, Timothy C. May wrote: >At 8:32 PM -0800 10/1/96, jim bell wrote: >>At 09:39 AM 10/1/96 -0800, Timothy C. May wrote: > >>>(Else what's to stop Giant Corporation from using Non-GAKked software >>>within the U.S., which is perfectly legal (under the "voluntary" system), >>>but then "happening" to have their foreign branches and customers obtain >>>"bootleg" versions at their end? All it takes is a single copy to get out, >>>and be duplicated a zillion times. Voila, interoperability, with the only >>>"crime" being the first export...which is essentially impossible to stop, >>>for so many reasons we mention so often. Conclusion: Government must make >>>this very mode illegal, perhaps by making it a conspiracy to thwart the >>>export laws....) >> >>If this solution were really practical, it would have been tried already. > >And just what would you call PGP? The "impractical" I was referring to is the impracticality of the government implementing and enforcing restrictions on communications using (non-GAK) crypto. The only place this seems to exist is in ham radio. The crypto itself is eminently practical, as the PGP example makes absolutely clear. >Long before the MIT deal, people in the U.S. were using their "OK in >America" (not counting RSADSI's issues) software to communicate with >"illegally exported" copies in foreign lands. > >This model--leaking a U.S. version and then communicating freely between >U.S. sites and the "leakee" sites--worked for PGP. I believe the USG fears >this will happen again. > >Hence my speculation that they may try to illegalize the mere communication >with an offending product. "I predict they won't be able to do it." Jim Bell jimbell(a)pacifier.com

1 0

White House crypto proposal -- too little, too late
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 1 Oct 1996 14:56:21 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: White House crypto proposal -- too little, too late I just got back from the White House, where Gore's office held a roundtable plugging the administration's long-awaited and already widely-derided Return of Clipper proposal. Gore announced that jurisdiction over crypto exports would move to the Commerce Dept; that the export embargo on 56-bit DES would be lifted in part for two years only; that to be approved for export firms must submit a detailed proposal describing how they will move towards key escrow; that the new regulations would go into effect on January 1. The true problem with this plan is that 56-bit DES is woefully inadequate. But much of the media coverage I've read of the plan doesn't even mention that. Take Elizabeth Corcoran's article, which ran above the fold on the front page in today's Washington Post. (It's what almost certainly prompted Gore's office to move the announcement to today rather than hold it later this week.) The thrust of the article is that the administration's new proposal balances the needs of privacy, business, and law enforcement. But it doesn't. The Feds, foreign governments, and determined attackers can crack anything encrypted with 56-bit DES -- the strongest crypto that can be exported under the plan. This vital fact appears nowhere in the Post article. That's why Bruce Schneier, author of Applied Cryptography, recommends against using DES in favor of a more secure algorithm. According to Schneier: "A brute-force DES-cracking machine [designed by Michael Wiener] that can find a key in an average of 3.5 hours cost only $1 million in 1993." More recently, in January 1996 an ad hoc group of renowned cryptographers including Matt Blaze, Whitfield Diffie, Ronald Rivest and Schneier, released a report going even further. They said: "To provide adequate protection against the most serious threats - well-funded commercial enterprises or government intelligence agencies - keys used to protect data today should be at least 75 bits long. To protect information adequately for the next 20 years in the face of expected advances in computing power, keys in newly-deployed systems should be at least 90 bits long." What's even more disturbing is what the administration might do next. After the roundtable broke up, I chatted with Michael Vadis, one of the assistant deputy attorneys general who oversees national security issues. He said an international consensus is forming that terrorists can use crypto; therefore crypto must be controlled. The U.S. is certainly pushing this line at the OECD talks. "But it just takes one country to decide to export strong crypto," I said. "You're missing something," said Vadis. "What?" I asked. "Unless you're talking about import restrictions." "Exactly," he said. -Declan ******* Some background: Linkname: Brock Meeks on White House plan -- 6 Sep 96 Filename: http://www.muckraker.com/muckraker/96/36/index4a.html ******** http://www.washingtonpost.com/wp-srv/WPlate/1996-10/01/041L-100196-idx.html U.S. TO EASE ENCRYPTION RESTRICTIONS Privacy Advocates Wary of Proposal For Software Exports By Elizabeth Corcoran Washington Post Staff Writer Tuesday, October 1 1996; Page A01 The Washington Post The Clinton administration is cutting off an emotional four-year-old debate with the computer industry over the export of information-scrambling technology with a plan that it says will help U.S. companies boost sales overseas and still allow law enforcement agencies to unscramble messages, officials said yesterday. President Clinton has decided to sign an executive order that changes the rules restricting the overseas sale of the technology, the officials said. Although the full details of the plan had yet to be revealed, privacy advocates and some industry executives contended that it would be difficult to put into practice. Under current rules, companies can sell only relatively easy-to-crack scrambling technology. Under the plan, they would get permission to export somewhat more sophisticated versions of the software and hardware, which prevents eavesdroppers from looking at information. The issue has caused enormous friction between the government and computer industry and privacy groups, which contend that keeping any restrictions in place will harm the protection of personal information everywhere and slow the development of on-line commerce, which relies on keeping credit card numbers and other sensitive information secure. The administration counters that it has come a long way in meeting such objections. However, last night some companies and privacy advocates were still worried that the constraints will leave U.S. companies at a disadvantage abroad and will not ensure that individuals will be able to protect their communications. The government's plan preserves what has been its unnegotiable cornerstone since the debate began in the early day of the Clinton administration -- that law enforcement officials must have the means for peeking at encrypted information when they are properly equipped with court authorization. Earlier versions of the plan tightly limited what kinds of technology could be sold abroad. They also called for makers of encryption technology to deposit "keys" with approved third parties so that law enforcement authorities could decode material. The new plan doesn't specify who would have the keys. Last night, several companies, led by International Business Machines Corp., said they have a technical plan that they believe could comply with the new rules on keys. [...] Industry officials say they ultimately want to be able to use the most sophisticated encryption technology available. "It's really critical to doing business around the world," said an IBM source. "But governments exist. It's a balancing act . . . to satisfy the needs of the governments and make sure that markets and individuals trust the integrity of what's being sent over the networks." [...]

8 7

Re: Signs of Trouble in D.C.
by Dustbin Freedom Remailer 17 Dec '03

17 Dec '03

On Tue, 1 Oct 1996, Black Unicorn wrote: > Any person congregating in a group of 2 or more persons on > public space within the boundaries of this drug free zone for Keep moving, proles. The War on Some Drugs must continue. Now excuse me while I join my friends for a joint.

5 4

encrypting pppd?
by VaX#n8 17 Dec '03

17 Dec '03

Anyone worked on, or know of a freely available, one of these beasts?

5 5

FUCK!!!!!!;-)
by Robert Hettinga 17 Dec '03

17 Dec '03

It seems to be worse than we thought? Apple and *Sun*? Doesn't *Whit Diffie* work for Sun? Curioser and curioser... Cheers, Bob Hettinga --- begin forwarded text From: sombody... Date: Wed, 2 Oct 1996 15:41:38 -0400 To: rah(a)shipwright.com Subject: FUCK!!!!!!;-) NEW YORK AND PARIS--(BUSINESS WIRE)--Oct. 2, 1996--Eleven major information technology vendors and user organizations today announced the formation of an alliance to develop an exportable, worldwide approach to strong encryption. The goal of the alliance is to enable companies to conduct secure international electronic commerce. The alliance was formed in response to demand from customers who are conducting more and more of their business processes electronically. Internationally available strong encryption would enable these firms to send sensitive information securely over the Internet and other international networks. The companies forming the alliance will achieve this by developing modern, high-level cryptographic "key-recovery" solutions that meet the requirements of business and could allow easing of restrictions of cryptographic import/export around the world. Members of the alliance are Apple Computer, Inc., Atalla, Digital Equipment Corporation, Groupe Bull, Hewlett-Packard Company, IBM, NCR Corp., RSA, Sun Microsystems, Inc., Trusted Information Systems and UPS. The alliance is also open to other companies with an interest in key recovery. "Keys" are strings of computer code that lock and unlock data. Key recovery is an approach that permits the recovery of lost or damaged keys without the need to store or "escrow" them with a third party. This approach could also meet the needs of law enforcement to act under the authority of a court order without risking the confidentiality of business data. Modern, high-level cryptography works to ensure four critical elements of security -- Confidentiality: prevents against unauthorized parties from seeing information; Integrity: determines that information has not been changed during transit; Authentication: verifies the identity of the user and the user's eligibility to access and use information; Non-Repudiation: provides evidence that a transaction took place, for example, that a customer actually placed an order. "Apple recognizes and supports the need for key recovery, and we are pleased to be a part of the alliance," said Ellen Hancock, chief technology officer and executive vice president of R&D for Apple Computer, Inc. "We believe that this alliance will help industry lead in developing solutions for secure transactions while prompting the evolution of the Internet as a business environment." "Securing commerce over the Internet using strong encryption technologies will require a common set of standards and approaches to fundamental security issues such as key recovery and key management," said Robert Gargus, Atalla president and general manager. "Once these standards are accepted and globally deployed, public networks such as the Internet will provide a secure, multi-national commercial trading environment for worldwide electronic commerce." "The alliance has struck a balance between government and business needs," said CommerceNet Chairman Marty Tenenbaum. "Allowing encryption to this degree opens the door to the proliferation of electronic commerce." "Strong encryption is a necessary element in delivering secure network business solutions to our customers worldwide. Key recovery is a mechanism that addresses government policy concerns about the export of strong encryption while at the same time meeting growing commercial needs," said Sam Fuller, vice president and chief scientist for Digital Equipment Corporation. "Digital sees this alliance as an effective means to develop open and interoperable key recovery standards." "Electronic Commerce is planned to be $1T by the year 2010 according to experts. The capability to have secured transactions is a prerequisite for the market," said Alain Couder, senior executive vice president of Groupe Bull. "Groupe Bull had been actively involved in the search for a solution to provide a balance between the legitimate need for users to have privacy, for corporations to protect their trade secrets and relationships and for governments to maintain national security. Bull has the ambition to be a leading provider of this capability with key encryption technology, smart cards and its Internet products and services." "HP is pleased to be a founding member of the alliance," said Richard W. Sevcik, HP vice-president and general manager of the Systems Technology Group. "Exportable strong encryption is a key enabler for international electronic commerce and provides businesses with the ability to perform secure transactions and other communications regardless of geography. Key recovery is one of several technologies that will be important." "Key recovery will truly open the Internet for serious business," said Irving Wladawsky-Berger, general manager, IBM Internet Division. "Once businesses are confident that their electronic transactions are safe and they control the recovery of keys, a flood of new market opportunities will open. The Internet is rapidly shifting from a place to browse for information to an environment for conducting real business." "Export controls are a fact of life," said Jim Bidzos, president of RSA Data Security. "The key recovery alliance's approach will allow companies to use cryptography with differing levels of security in an interoperable way. When the alliance implements this technology it will give the user a new level of flexibility that did not exist before. In an imperfect world this technique will at least allow you to take advantage of what governments around the world will allow." "We're delighted to be part of the alliance because we believe the adoption of a worldwide standard for key recovery is essential to solving current network security problems," said Stephen T. Walker, president and CEO of TIS. "User-controlled key recovery systems including our own products have already demonstrated that user privacy concerns and exportability requirements can be successfully addressed. But there must be worldwide interoperability. And it is our hope that the alliance will be able to accomplish that." "The work of the alliance could have a profound impact on conducting international business over the Internet," said Joe Pyne, UPS vice president of marketing. "UPS is committed to improving the movement of both information and packages in secure and time sensitive manners. The alliance allows us to combine our expertise, energies and financial strength to quickly develop standards that will open the door for rapid development of products and services." CONTACT: Apple Computer, Inc. Maureen O'Connell 408-862-6689 or Atalla Gary Lefkowitz 408-435-5715 or Digital Equipment Corp. Patrick Ward 508-493-9441 or Groupe Bull Jean-Jacques Roulmann 33-1-39-66-3970 or Hewlett-Packard Kimberly Daniel 408-447-4587 or IBM Mike Corrado 914-766-1162 or NCR Bob Farkus 513-445-2078 or RSA Data Communications Ginny Kirkley 415-595-8782 or Sun Microsystems Inc. Ray Nasser 415-786-4395 or Trusted Information Systems Homayoon Tajalli 301-854-6889 or UPS Pat Stephen 201-828-6103 KEYWORD: NEW YORK INDUSTRY KEYWORD: COMPUTERS/ELECTRONICS COMED BW0153 OCT 02,1996 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

2 2

Re: Utah as a Religious Police State
by Deana Holmes 17 Dec '03

17 Dec '03

On 2 Oct 96 at 8:47, John C. Randolph wrote: > > Moroni says: > > >I never cease to be surprised by the interest that gentiles show > >in working mormon communities while totally neglecting their own > >failing areas. > > I don't do a lot of nit-picking on this mailing list, but: > > I am a Jew. *You* are a gentile. So are all the rest of the mormons. > Get this point straight. Uh, in Utah, Jews are Gentiles. No lie. Deana Deana M. Holmes April 1996 poster child for clueless $cientology litigiousness alt.religion.scientology archivist since 2/95 mirele(a)xmission.com

3 3

Public Apology (this list is a joke)
by Dave Temple 17 Dec '03

17 Dec '03

I just wanted to apologize to the list for "whining like a 4 year old". I was upset that I was not "adult" enough to save the welcome message I received when I joined the list. I thought that if I acted like a jerk someone would get upset and either kick me off the list or at least give me instructions to do so myself. I was right. I joined this list knowing next to nothing about cryptography. I have learned quite a bit from those who have actually posted worthwhile mail and would like to thank them. I realize that a public list is very hard to maintain, we have just begun offering listservs to our faculty and we are already having problems. So thanks to those of you who have sent me messages on how to unsubscribe. Once again, I am sorry for the whining.

3 2

Re: EUB_low
by Duncan Frissell 17 Dec '03

17 Dec '03

> in the world, 24 hours a day. A U.S. official said, "The > bank is being investigated for violating U.S. laws with > open solicitations on the Net, which is at best for tax > evasion and at worst for money laundering." > I hate to tell the Feds but the internet is more of an international publication than "High Life" (the BA inflight mag) or the BBC World Service mag (whatever it's name is these days. International publications can advertize offshore accounts and investments. DCF

4 4

Re: legality of wiretapping: a "key" distinction
by Greg Broiles 17 Dec '03

17 Dec '03

At 04:42 PM 10/4/96 -0800, jim bell wrote: >I've been saying this for years! I think that one of the most telling >arguments is that the main (if not the only!) reason that wiretaps are kept >secret is that, for obvious technical reasons, they CAN BE kept secret! >Pardon me for being facetious, but I see no principle in the Constitution >that states "Anything the government can get away with is okay," so I think >it's predictable that wiretap law would be constitutionally defective. I see. Wiretaps have been litigated for 70 years, but the reason they're still Constitutional is that nobody's pointed out to a court the absence of the "Anything the government can get away with" clause. Good thing you found that. Are there any other secret missing clauses which render other things unconstitutional which you haven't mentioned yet? >I think it's really very simple. Wiretaps in the US were illegal until >1968. Then please explain what the Supreme Court was doing some 40 years prior to 1968, in _Olmstead v. US_ 277 U.S. 438 (1928), where the product of a wiretap was held to be admissible because without a physical trespass there was no Fourth amendment violation. (This is no longer good law.) Have you ever even driven past a law library? >Of course, some >lawyers (who have been trained to accept the status quo with little or no >challenge) will disagree! However, those same lawyers would have accepted >the Dred Scott decision without question, Plessy vs. Fergusen, etc. There's a difference between understanding the status quo and liking it. But making up your own interpretation of the Constitution and then just repeating it over and over is not legal argument and doesn't win cases. It's malpractice; and if you do it on your own behalf it's just sad to watch. Making up your own rules is a nice philosophical exercise (and you could probably make some money if you printed out all of your weird conjectures and sold them to the same militia goofballs who get excited about yellow-fringed admiralty flags and "Comptrollers' Warrants" and all of that bullshit) but it's not useful if you want to deal with people in the real world. It doesn't really matter if there's a secret reason why the US Government is actually a bankrupt religious for-profit corporation organized by FDR and income taxes go straight to the Grey Aliens and wiretaps weren't "legal" until 1968; the legal system pretends that that's not true, and soldiers on regardless. You can choose to understand the legal system, or not. I think it's less dangerous to me if I understand it. This doesn't mean I like what it does, or that I think what it does is morally correct or consistent with the way I'd read the Constitution. But active misunderstanding can be dangerous when you're dealing with a system that can and will take all of your stuff away or put you in prison or kill you. An attorney practicing in the era of Dred Scott or Plessy v. Ferguson would do his or her clients a serious disservice to fail to tell them what the status quo was. Being honest and realistic is much kinder and more responsible than being optimistic to the point of dishonesty. You clearly have no qualms about simply making up your own version of the law and suggesting that it's got a chance of being adopted in court. Would you want an attorney who did that, or would you like an attorney who gave you an honest assessment of what courts were likely to do with your argument(s) and fact(s)? I don't want an attorney who will lie to me or help me tilt at windmills without telling me that I'm tilting at windmills. And I don't want an attorney who tells me "all wiretaps are unconstitutional" if wiretap evidence can be and will be admissible. Every few weeks there's someone on the list (whose name escapes me) that pops up and tweaks Tim with the notion that there's no such thing as "negative reputation", e.g., that there's no person who says things that are consistently false. As far as I can tell, your comments about the legal system are the proof that Tim's critic is wrong. It's really not possible to simply make up your own version of how law ought to work, because law is about a shared body of rules & interpretations & expectations. If you are not sharing in the way other people do it, you are not doing law. You are doing philosophy or navel-gazing or something else which may be very honorable and right and good but it isn't law. >While I'm sure that I will be corrected if this is wrong, somehow I doubt >whether there has EVER been a "before-the-fact", full challenge of a wiretap >order _including_ representation for the target of the wiretap. I suspect there hasn't been one because it's not required under the way the Constitution is and has been interpreted. Here's a tip: if you think of a way to interpret the Constitution that would make law enforcement not merely less efficient but effectively impossible, your interpretation will not be adopted, and therefore is not useful. It might or might not be theoretically elegant or logically attractive, it will not be adopted. So stop thinking about it. >I don't know about you, but somehow I'm past the idea that it's possible to >reliably get unbiased justice in court. Know what I mean? I agree with you, but your chances are better if you don't act like a loon. >Well, they don't technically need the "cooperation," but they are still >required to inform the target. For example, if they get a search warrant >for a house that happens to be empty when they show up, they are obligated >to leave notice of the search and lists of what was taken. Apparently they >need to do this EVEN IF they would have been able to get into the house >surreptitiously without leaving any trace. Hey, you got something right. Go back to wherever you got this from and read it some more. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

Re: legality of wiretapping: a "key" distinction
by Greg Broiles 17 Dec '03

17 Dec '03

>no, all I am asking for is lawyers who are familiar with wiretap law >to make a quick case against it based on a commonly-known precedent >within their field. if you don't want to answer, don't post. This sounds like a very reasonable proposal. But please don't take a lack of response to your speculation as an endorsement of your idea, or a suggestion that it's got even the teeniest shred of merit. I understood you to be suggesting that because nobody's shown to your satisfaction that it's meritless, you've somehow stumbled across something important. >I will write on anything I damn well please and research it poorly or >thoroughly as I like, and whisper questions to any lawyers out there who care >to talk about the subject to an interested layman. This response illustrates precisely why Uni was reasonable in declining to give you references. If you're not willing to look up your own crackpot ideas, you certainly shouldn't imagine that someone else is. (But here's a hint - if you read the statutes, you might discover that some notification to the target of a wiretap is required, although not prior to installation.) >you have a lot of good advice, but I ask none of the things you are >attributing to me. I simply would like to carry on a discussion with >a civilized lawyer who specializes in the subject, rather than have >a people tell me why I cannot even do this, and must become a law >specialized before I can even use the word "wiretap" with any >meaningfulness. You can no more meaningfully discuss law without learning about it than you can discuss cryptography or biology or philosophy or any other area of human scholarship and knowledge. I think it would be a positive change were the law reworked so that it was more accessible to lay people, and so that the practice of law were not such a specialized field. But please note that I talk about that as a *change*, that is to say, different from how it is today. You can, if you want, try to work on similar questions in parallel with established institutions - probably all fields have a group of rogue scholars or dissidents who believe nonstandard things, adopt nonstandard methodologies, etc. Sometimes they turn out to be right, sometimes not. This dynamic exists with law - e.g., what I'd call "Militia Law" (I think they call it "Common Law" but I'm not sure). Jim Bell seems to be working on a similar track - starting with original documents and deriving his own interpretations, rules for statutory construction, and so forth. Perhaps history will smile on Jim or the militia/common-law folks. Perhaps not. But crossover is not possible (as should be clear from the past few days' discussions). Arguments from one school of thought are not useful in the other because the premises are different, and sometimes contradictory. I think that it's interesting and good that people are working on their own theories of law apart from the traditional institutional ones. But I think it's sad when they try to use their theories (which I think are best understood as the laws of a foreign, albeit imaginary, nation) in contemporary state & federal courts. See <http://www-leland.stanford.edu/~jgadams/taxcases.html> for a big list of cases where people with their own versions of the law got spanked in traditional courtrooms. I think it's a shame when people excited about their own legal theories get innocent third parties roped into these peculiar scams. (Then again, there's the argument that this is evolution in action.) So that's a long way of saying "plonk." I don't think it's productive for me to try to keep track of multiple versions of the constitution; and I've settled on the one that's used today in court as the one I'm going to pay attention to. I don't get the impression that you care about how things actually work; you seem much more interested in making some baroque rhetorical point about how all cypherpunks are evil. (In particular, I'm suspicious that you think wiretaps are unconstitutional yet it's evil to try to avoid them with crypto. I think you want someone to write you several pages' worth of memorandum about how wiretaps are legal, so that you can cleverly turn around and argue that defeating something which turns out to be so clearly legal must, in fact, be wrong. And I think you take that position simply to be contrary.) If you are truly interested in the legal questions around notice to subjects and Title III wiretaps, see LaFave & Israel, "Criminal Procedure" (West). It's got quite a few pages of discussion about Title III. I'm not going to summarize it here because my copy is old enough that I don't know if the research behind it is still current, and I'm not in the mood to do free research for people who will ignore my results. But I'm willing to bet that you'll never look it up anyway. >the chief point of my post was to question why the EFF etc. are not >at all interested in challenging the wiretap "status quo" in spite >of what many people here believe/advocate-- that wiretapping was >never legitimate in the first place. this is curious because EFF >etc. *are* willing to back up the cryptography cases out there, >ala Bernstein etc. The EFF's failure to work on your little project seems like it might be caused by: 1. a conclusion that it's not a viable argument, and hence a waste of time/effort 2. a conclusion that the constitutionality of wiretaps isn't specialized enough that they should concentrate on it, they can leave that argument to well-funded defense attorneys for Mafia/drug clients, who deal with wiretap evidence frequently 3. lack of a good case to raise it with My guess is it's mostly (1), though (2) and (3) might be enough to make it uninteresting even if (1) wasn't true. But I don't know poo about how or why EFF decides which issues to work on. Are you even a member? -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

4 5