December 2003 - cypherpunks-legacy

Your Home Town Provides Everything You Need
by zida27＠aol.com 17 Dec '03

17 Dec '03

YOUR HOME TOWN WILL DO 100% OF THE WORK FOR YOU WE OFFER: You the chance to own your own Home Based Business. WE OFFER: To build your Home Based Business for you. WE OFFER You financial independence. WE OFFER: You life saving and life changing products. WE OFFER: You the easiest way we know to, improve your Health, your Wealth and your Happiness. For more information Call: Our toll free 24 hr message center at 888-771-9338 Our toll free 24 hr recorded message at 888-771-9340. Reference # 1007698 our research showed you would be interested in this subject. If this is not true and you would like to be removed from our data base please call 888-771-9338 and leave your e-mail address for removal. Thank You.

1 0

New Page!
by StanSqncrs＠aol.com 17 Dec '03

17 Dec '03

I made another page, which details what Capital records did to Dark Side of the Moon when they reissued on cd. Guess what they covered-up. :-) Check it out, Stan, The Desecration of 'The Dark Side of the Moon' http://members.tripod.com/StanSqncrs/DarkSide/darkside.html

1 0

CTIA Daily News from WOW-COM - July 7, 1998
by CTIA Daily News 17 Dec '03

17 Dec '03

============================================= Welcome to today's edition of the CTIA Daily News from WOW-COM. Please click on the icon / attachment for the most important news in wireless communications today. =============================================

1 0

Private-enterprise wiretapping
by bill.stewart＠pobox.com 17 Dec '03

17 Dec '03

STOLEN NUMBERS -- [New York Times, p. 31, 7/5.] Federal investigators said the scam was ingenious in its simplicity: Five people in New York City would tap into public pay phones at major airports across the country, then steal calling-card numbers punched in by unsuspecting travelers. The scheme ended last month with the arrests of four men and one woman. But the case is only the latest machination in a $4-billion-a-year telephone fraud industry that keeps reinventing itself. "This is something we have not seen before," said Boyd Jackson [of] network security at AT&T, one of the industry experts who helped Federal investigators on the case. "And there is nothing I am aware of that customers can do to fully protect themselves." The Secret Service was tipped off by AT&T, Bell Atlantic and MCI after they received an unusually high number of complaints from customers who had recently used their calling cards in airports. [Also San Jose Mercury News, 1C; Rocky Mountain News, 33A; Sun-Sentinel, 3A, 7/4.]

1 0

Covert Access to Data and ID
by John Young 17 Dec '03

17 Dec '03

Dave Emery's remarks on government access to keystrokes (proposed by the NYT as an alternative to GAK) points to the probable increase of intrusive devices to counter increasing use of encryption and other privacy and anonymity measures. This topic comes up here now and then, with mentions of a slew of methods to protect privacy of data during transmission or storage. But the possibility of logging the initial creation or manipulation of data is not as often discussed, nor how to tie a person to the data, as now being asked in legal and law enforcement fora to identify, catch, convict and jail computer culprits. That the NYT floated the idea surely means someone is testing public response to an idea that seems to be more intrusive than GAK: the logging of initial data and any manipulation of it, prior to encrypting, and maybe including a means to link the actions to the user. If this is logging (and related retrieval) is done covertly, encryption could thereby become a falsely reassuring cloak of privacy. Dave thinks devices like these are surely in the works, and he can say more about their sponsors, technologies and implementations. One driving force, as he previously noted, is the desire for devices to assure copyright protection, backed by the WIPO treaty, which now being considered for approval. See the House report on it at: http://jya.com/hr105-551.txt (141K) And the EFF and ACLU opposition to it: hr2281-opp.htm Other forces, though, are employers who want to snoop, law enforcement, government, marketers, actually the same groups who dislike privacy protection measures, but often prefer to snoop covertly while loudly proclaiming support for privacy. Thus, the more general question Dave has raised is how widespread is the development and implementation of technolgies for covert surveillance on the Web and in desktop boxes -- happily spreading quietly while attention is focussed on the very encryption which it will circumvent? And what are these devices, or what might they be, what might be countermeasures and who might be working for and against them. SDA must have insights to share. Over to Dave Emery and those more knowledgeable. For those who missed his earlier message we've put it, with a follow-up at: http://jya.com/gaks-de.htm

4 3

Junger decision
by Cindy Cohn 17 Dec '03

17 Dec '03

For those who haven't yet heard, Judge Gwin in the District Court in Ohio has granted the government summary judgment in the Junger case. Judge Gwin apparently agreed with the government that the "functionality" of encryption source code, and the government's claims that it only intends to regulate that "functionality" mean that the regulations are not "narrowly and directed at expressive conduct" and so do not merit prior restraint analysis. The Judge then held that the regulations were content neutral, applied the intermediate scrutiny tests and found that the export restrictions meet those tests. I haven't had the opportunity to review the decision yet. As soon as I have, I will post some brief comments. Still no decision from the 9th Circuit in Bernstein. Cindy ****************************** Cindy A. Cohn, Cindy(a)McGlashan.com McGlashan & Sarrail, P.C. 177 Bovet Road, 6th Floor San Mateo, CA 94402 (650) 341-2585 (tel) (650) 341-1395 (fax)

1 0

RE: Junger et al.
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Nevermind that source code is suppose to be "human readable" material that is _translated_ into function instructions of machine code. A play is normally considered 'protected' free speech under US law, but what if robot was created which acted out the play and Gwin's argument was extended to apply the situtation where a play performed. Would the play itself no longer be a protected form of free speech, because it is seen as "functional" instructions to the robot actor? Would the playwrite become responsible for the robot's actions, such as killing a character/actor? As a programmer, I have "acted out" source code myself, as part of the debugging process. It is normally called "a walkthrough," so the difference between source code and a play is not as broad as some people may view it. I have followed the source code like a script, acting out the instructions like stage directions in a play. Does it matter who might 'read' the material, in regards to the protection of free speech? Whether it is written so that Russians or computers might be able to read it? If source code is written on a napkin, it can be currently exported, but what if tomorrow a vendor announces a 'napkin computer' which can directly read from napkins akin to a super-low densiy floppy disc. At 07:20 PM 7/6/98 -0700, Ernest Hua wrote: >Did anyone demonstrate the "functionalness" of any arbitrary language >via a scanner and a compiler? > >Why doesn't Gwin understand that the moment one successfully claims that >a specific class of source code is not speech by the virtue of the fact >that a compiler can transform it automatically into executable code >which performs a function, then ANY speech of ANY sort is fundamentally >vulnerable to being classified as functional as soon as a compiler can >transform it into real machine code. > >Ern > > -----Original Message----- > From: jkthomson [SMTP:jkthomson@bigfoot.com] > Sent: Monday, July 06, 1998 7:12 PM > Reuters > >3:40pm 6.Jul.98.PDT WASHINGTON -- A district court has dismissed a law >professor's challenge to US regulations strictly limiting the export of >computer data-scrambling technology. > >Judge James Gwin ruled late Friday that the export limits, which prevented >Case Western Reserve University Law School professor Peter Junger from >posting the text of encryption programs on the Internet, did not violate >the constitutional right to free speech. > >The Ohio court's ruling contradicts a California district court ruling last >August that said source code -- the instructions a person writes telling >the computer what actions to perform -- constitutes a form of speech >subject to First Amendment protection. > >"Unlike instructions, a manual or a recipe, source code actually performs >the function it describes," Gwin wrote. "While a recipe provides >instructions to a cook, source code is a device, like embedded circuitry in >a telephone, that actually does the function of encryption."

3 2

A note on the latest randomness quarrel
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

* Never use "the lowest few bits" or (t1>t2)?1:0 for the actual random number generation. You only use things like that for estimating the amount of entropy in a source. The number of bits of entropy in a pile of bits is one more than the base-two logarithm of the average number of guesses required of a badguy knowing your condidtioning routine, observing what it can, and interfering with your generator to figure out the value of the bits in the pile, so if your studies and statistical analyses estimate that it requires 2^127 guesses to guess the output of your conditioning routine, good for you, you've estimated that somewhere in its input are 128 bits of entropy. Um, I digress...point is, don't use that output straight. Take twice as much unconditioned input, non-random-looking stuff and all, as you estimate your conditioning routine needs to produce a key's worth of entropy and _hash_it_. Your conditioning routine can introduce some little bias you didn't see or make some unnoticed mistake that lets through predictable bits. Hashing can, too, but we've studied the hash functions to make sure they're good a lot more than we've studied your conditioning procedure. * A badguy's introduction of extra events doesn't poison your randomness. A badguy could introduce a multitude of predictable-but-random-looking events to make your generator close shop before it has enough unpredictable events to get its entropy. However, that only works if extra events make your generator stop collecting earlier. The amount of time it spends collecting randomness shouldn't depend on _any_ output of the generator, because that needlessly leaks entropy. Also, a badguy could introduce two nearly-simultaneous events near the beginning of the process, when it can be fairly sure that the wait between its events and the previous event will make a zero or make the lowest few bits of the delay between the bits match a certain value. (Interpreting that sentence is left as an exercise to the reader :) However, you can only do this in a system where your conditioning routine allows extra events to cause the routine to output bad bets. However, if you hash your raw data rather than using one of those conditioning routines, it's nearly -- nearly, that's your cue to say it has to be always -- impossible to weaken the output without knowing the other data hashed. Third, el badguy could introduce so many events that the gap between events was always less than the measurement threshhold. However, note that the Geiger counter, the computer, and the operator would all fail under these circumstances. Therefore, pretty much any strategy allowing extra events to kill entropy is flawed. ================================================================================ /// anonymous : nobody(a)replay.com : http://replay.com /// ================================================================================

1 0

Kings & Queens/George Michael/Knocked up with NyQuil
by STUFFED/EUREKA! 17 Dec '03

17 Dec '03

1 0

US to Ease Crypto Export
by John Young 17 Dec '03

17 Dec '03

7 July 1998 Source: http://www.washingtonpost.com/wp-srv/WPlate/1998-07/07/064l-070798-idx.html Thanks to FT U.S. to Ease Limits on Export of Data-Scrambling Technology By Elizabeth Corcoran Washington Post Staff Writer Tuesday, July 7, 1998; Page E04 Commerce Secretary William Daley plans to announce today that the government will give U.S. software companies new freedom to export their most sophisticated data-scrambling technology to financial institutions chartered in 45 countries, according to Clinton administration sources. Under the new rules, which officials said are likely to take effect in late summer, eligible banks, securities firms, brokerage houses and credit-card companies will need to receive approval only once from the Commerce Department before they can license the most sophisticated "encryption," or data-scrambling, technology. Once they receive approval, those institutions will be permitted to share the technology with any of their branch offices, except for those located in terrorist states. Government sources estimate that the new rules will include about 70 percent of the world's banks, including the 100 largest (ranked by assets). For years, the government has closely regulated export of encryption software, on the grounds that terrorists or hostile governments might use it to cloak their communications. The software industry argues that the rules are unworkable and unfairly block foreign sales. Unfriendly parties wanting to use encryption already can obtain it overseas, industry executives said. The new rules on banks are "a move in the right direction," said one industry executive familiar with the regulations. "But we're still leaving some groups out. Basically, we need to keep spreading the circle wider," to include the growing number of businesses offering financial services, such as insurance companies. "What we've heard sounds great," said Kawika Daguio, a lobbyist for the American Bankers Association. "We've been arguing [for several years] that the regulatory structure we have guarantees we're good citizens" who wouldn't make illicit use of the technology, he said. Now the government appears to have agreed. Current regulations require that U.S. companies apply for permits before exporting anything but the simplest versions of encryption products. To export more sophisticated technology, organizations must have a plan for creating so-called "spare keys." That way, law enforcement officials who have obtained a court order would be able to unlock the information. In May 1997, the Commerce Department said it would not restrict the sophistication of the data-encryption technology sold to financial institutions. But it required spare keys and case-by-case licensing. Approvals have been slow. Now the government is doing away with the key requirement, defining more precisely which financial institutions qualify and pledging to end case-by-case approval. Because of concerns about money laundering, the government will grant the new permission only to financial institutions chartered in countries that have agreed to take steps against money-laundering. If U.S. companies want to sell to financial institutions chartered in other countries, they will have to apply for licenses from the Commerce Department. Such provisions still fall short of the demands of U.S. companies. "To take a piecemeal approach [to loosening encryption restrictions] is the wrong direction," said Ed Gillespie, executive director of Americans for Computer Privacy, a lobbying group. "We need a blanket lifting of restrictions with individual prohibitions," such as bans on sending such technology to terrorist states, he said. In a related development, a federal court in Ohio ruled on Friday that posting the text of an encryption program on the Internet, where people all over the world could see it, was not protected by the constitutional right to free speech. The ruling, made late Friday, contradicts a ruling made by a California district court last August. Privacy advocates predict that the issue will be taken up by the U.S. Supreme Court. © Copyright 1998 The Washington Post Company

1 1