December 2003 - cypherpunks-legacy

Domain name hearings starting right now. (www.democracy.net)
by Shabbir J. Safdar 17 Dec '03

17 Dec '03

The domain name hearings are going on right now (you can listen in realaudio) at http://www.democracy.net/ The future of the infrastructure hangs in the balance of this debate. Check it out. -S

1 0

opponents of GAK
by amp＠pobox.com 17 Dec '03

17 Dec '03

Has anyone out there been keeping track of all the organizations, corporations and others who have come out against GAK? Pointers would be appreciated. alan ------------------------ Name: amp E-mail: amp(a)pobox.com Date: 09/25/97 Time: 09:17:21 Visit me at http://www.pobox.com/~amp == -export-a-crypto-system-sig -RSA-3-lines-PERL #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/) == 'Drug Trafficking Offense' is the root passphrase to the Constitution. Have you seen http://www.public-action.com/SkyWriter/WacoMuseum ------------------------

1 0

American Banker - National ID - addendum
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: rhornbec(a)counselpop.com Mime-Version: 1.0 Date: Thu, 25 Sep 1997 05:59:31 -0500 Reply-To: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> Sender: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> From: Rick Hornbeck <rhornbec(a)COUNSEL.COM> Subject: American Banker - National ID - addendum To: DIGSIG(a)VM.TEMPLE.EDU Either the Temple listserve is automatically limiting the length of my posts (<gr>) or I discovered a new e-mail bug. Here is the balance of the excerpt from the American Banker article I intended to post earlier. ==================== What actions should a certificate authority be required to take in this imperfect system to certify that X's public key actually is being used by X? To allow the electronic marketplace to operate effectively and efficiently, at a minimum certificate authorities must be able to achieve some level of certainty that if they have prudently conducted the due diligence required, they cannot be held responsible for fraud or malfunctions. National Identification Verification Standards-NIVS-would underscore that there should be only a limited range of actions for which a certificate authority should be held responsible in an electronic transaction. These standards eventually would need to be truly universal because of the globality and borderlessness of cyberspace. Moreover, such standards could level the playing field vis-a-vis the different levels of trust that might otherwise be accorded certificate authorities of various sizes, financial capacity, name recognition, and national origin. What should the elements of these national verification standards be? The more that the system relies on primary "root" documentation (paper or electronic) certified by the originator, the greater the certainty, albeit imperfect, that the certificate authority can achieve. The adoption of an integrated certification data base accessible to all certificate authorities must also be explored. A network that will allow each certificate authority to cross-reference digital certificates and confirm the issuance of multiple certificates to the subscriber will allow the digital signature market to function more efficiently and safely. >From a legal point of view, a digital certificate is a form of warranty. Warranties ascribe and allocate rights in a transaction, a business that commercial banks happen to understand quite well. But a digital certificate is not meant and should not be viewed as unlimited insurance for the use of the certificate or the successful completion of an electronic transaction facilitated by that certificate. In that regard, the adoption of these standards might facilitate the development of a national market for certificate authority errors-and- omissions insurance. It might also facilitate the creation and operation of what one observer has called "cybernotaries." Without uniformity in the authentication process, the efficiencies of certificates and the effectiveness of electronic commerce will be undercut. Richard N. Hornbeck Electronic Commerce Services "The most important step in arriving at the right answer, is asking the right question." Albert Einstein ("Al"). --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: Emphasizing a point by Donald Eastlake re key recovery
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Wed, 24 Sep 1997 10:15:45 -0400 > To: Ross Anderson <Ross.Anderson(a)cl.cam.ac.uk> > From: Carl Ellison <cme(a)cybercash.com> > Subject: Re: Emphasizing a point by Donald Eastlake re key recovery > Cc: cypherpunks(a)toad.com, Ron Rivest <rivest-only(a)theory.lcs.mit.edu>, > cme(a)cybercash.com > Reply-to: Carl Ellison <cme(a)cybercash.com> > -----BEGIN PGP SIGNED MESSAGE----- > > At 09:34 AM 9/23/97 +0100, Ross Anderson wrote: > >There is also the point that the vast majority of encryption keys are > >actually used for authentication rather than confidentiality. The keys > >that encrypt your bank card PIN en route from the ATM to the bank, the > >keys in your satellite TV decoder, the keys in your gas meter and your > >postal meter - in fact the majority of all DES keys in use - are about > >authentication. In theory most of them could be replaced by digital > >signature mechanisms but given the size of the installed base, it > >won't happen anytime soon. > > For what it's worth, I once got an opinion from NSA's export control office > that I could use any kind of crypto I wanted (e.g., even triple-DES) if all > I'm doing is protecting a channel carrying a password (like the PIN), > because that's an authentication function and therefore to be encouraged. I > didn't get this in writing, however, so I'd have to go for it again. > > - Carl Well, I dunno. About 18 months ago, I was involved with the negotiations over the exportability of an SSL equipped web server I had helped develop. The export model used 40 bit RC4 and 512 bit keys. The initial version used 3DES to encrypt stored private keys, and this was turned down. I modified it to use single DES, and it passed. Note that this was for secret key storage only. Peter Trei trei(a)Process.com

1 0

Good News / Bad News
by A Player To Be Named Later 17 Dec '03

17 Dec '03

Bill Gore, FBI - "The good news is that we have apprehended Ramon Eduardo Arellano-Felix in return for paying out the two million dollar reward for his sorry, drug-dealing, scum-sucking ass." Louis Freeh, Lying Nazi Fuck - "What's the bad news? Bill Gore, FBI - "We payed the two million to Jim Bell, and he used it to place a bet..."

2 1

Re: The Telcos oppose Oxley
by Lizard 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 At 06:32 PM 9/24/97 -0400, Declan McCullagh wrote: >At 13:23 -0700 9/24/97, Lizard wrote: >>At 09:47 PM 9/24/97 +0200, Peter Herngaard wrote: >>>They support the penalty enhancement for use of encryption >>>in futherance of a felony. >> >>I don't find this particularly offensive, on the grounds that if you're >>convicted of any given crime, the government can more-or-less drum up so >>many related charges they can put you away for 500 years ANYWAY, so what >>difference does it make? > >Lizard's position is sadly incoherent. If he believes in civil liberties -- >and I know he does -- then he should think twice. Just because the federal >government has broad powers doesn't mean we should give them more. > <shrug> Rather, my position is that the system is ALREADY hopelessly corrupt and imbalanced;altering the letter of the law to say '20 years' as opposed to '10 years' FOR SOMETHING THAT SHOULDN'T BE A CRIME AT ALL is irrelevant. The government can just as easily create two trumped-up ten year charges as it can one 20 year charge;'law' and 'justice' have nothing to do with one another anymore. The whole concept of criminilizing the use of crpytography is offensive;the exact specifics -- 10 years or 20 years -- are pretty much the same. Though, on second thought, there is a serious issue with it -- if, as we hope, encryption becomes widespread, than anyone doing anything will be using it;including 'in the commission of a crime'. This could make petty misdemeanors into 20 year federal crimes, and THAT is something to worry about. Hm. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNCm7HjKf8mIpTvjWEQL6ywCgrLu61z4DOjcIgboX8wJPZaKxHE4An2yH QzcO/ZeobOWzOnhM5CxeULp4 =pwGM -----END PGP SIGNATURE-----

4 3

Stop Collection Agencies Cold!
by 75706395＠aol.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> /////////////////////////////////////////////////////////////////////// STOP COLLECTION AGENCIES COLD! \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ If you have received this electronic mailing by mistake, please pardon our intrusion. Greetings, Have you or somebody that you know experienced the humiliation of a collection agency calling at work or at home? They always seem to know when somebody is sitting at your desk or visiting your home when they call. Millions of collection telephone calls and letters are made or sent each week to people who owe money. Those of us who owe money will pay our debts and do not need the help of a collection agency hounding us at our homes or place of business. Consumers have been helpless to stop the harassment of these predators, UNTIL NOW! Our hard-hitting report 'Stop Collection Agencies Cold (C 1996)' will show you how to put an end to those telephone calls and letters, INSTANTLY! At the same time, the collectors will be forbidden to EVER call or write you again!! 'Stop Collectors Cold (C 1996)' is a brief, concise report that will tell you everything you need to know to stop the harrassment forever and comes to you with a 100% money-back guarantee! This report is normally $49.95, but if you act WITHIN THE NEXT 24 HOURS, you will pay only $18.00 plus $1.95 S&H. ----------------------------------------------------------------------- ORDER INFORMATION IMS 5201 Kingston Pike, Suite 6-216 Knoxville, Tennessee 37919 YES, please rush me the special report 'Stop Collectors Cold (C 1996)' to: Name:___________________________________________________ Address:________________________________________________ City:___________________________________________________ State:____________________ Zip:________________________ Your E-Mail address (Needed for confirmation):__________ /////////////////////////////////////////////////////////////////////// I have enclosed $18.00 + $1.95 shipping and handling ($19.95 TOTAL). ___Personal Check ___Money Order ___Cashiers Check ___I am faxing my order NOW! Please send as a bonus the collector letter package (A $9.95 value). \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ Fax Your Order NOW! Please tape your signed personal check in the space below and fax to IMS. The 24 hour facsimile number is 1-423-681-6520. ***************************************************************** FAX: 1-423-681-6520 PLEASE TAPE YOUR CHECK HERE PLEASE SIGN YOUR CHECK ***************************************************************** Thank You for your order! </FONT><FONT COLOR="#000000" SIZE=3>

1 0

Documents re 9th Circuit Emergency Stay now online
by John Gilmore 17 Dec '03

17 Dec '03

The Government asked the 9th Circuit on the 10th for an "emergency stay" of the District Court's limited injunction that would let Prof. Bernstein publish his Snuffle software online. Now you'll find Bernstein's opposition to that motion, filed on the 17th, online. And the government's attempted emergency reply, filed on the 22nd. You will also find the 9th Circuit motions panel's terse order granting the government motion (blocking Bernstein from publishing online) and scheduling the case for very fast processing. The final 9th Circuit hearing will be in December, and we have a prospect for hearing a decision by Christmas. See http://www.eff.org/pub/Legal/Cases/Bernstein_v_DoS/Legal/. (You may have to ask your browser to "Reload" to see the new changes.) John Gilmore Electronic Frontier Foundation

1 0

Re: Why the WHite amendment is a good idea (fwd)
by Ernest Hua 17 Dec '03

17 Dec '03

Oops ... this may appear twice due to a mail hiccup. To: aweissman(a)mocc.com Subject: Re: Why the White amendment is a good idea (fwd) Cc: cypherpunks(a)algrebra.com > From: Aaron Weissman <aweissman(a)mocc.com> > > The NETCenter is a great idea. Very few of us would argue that our > society has an interest defining rules and in prosecuting their > transgression as crimes. Once we have agreed on that point, the > issue changes to a (still very important) discussion on methods. I believe MOST people would agree with this statement. I must point out, however, that your next statement does not logically follow because the primary complaint of the NSA/FBI is that unless the work factor is artificially reduced (via some method) to some negligible point, their jobs in the future will become much harder (that is, if all they do is stick with the same ol' operational methods) per intercept. In fact, they are claiming that "much harder" could mean "practically impossible". > creating a decryption lab (and funding it with tremendous amounts of > money), our society will fulfill the basic obligation to protect > against the transgression of our rules. I am ignoring the comments on protecting the US citizens against abuse of this lab. I seriously doubt they could abuse significant numbers of individuals given free market development of encryption. If there was only one standard (say, DES), then there would only be one target. If there were 100 standards and 1000 data formats each, you can pretty much kiss this lab good bye. It is much more likely that this lab will engage in breaking incompetent criminal-use cryptography. It is unlikely that this lab can engage in the sort of mass data sweeps that NSA has been priviledged enough to do in the past. This sudden drop in capabilities and sudden jump in cost per intercept will enforce the status quo which the FBI has had to deal with to today. The cost per intercept has been estimated at $50K per domestic target. This is expensive enough that it does not make sense to tap anyone except where the cost can really be justified. > I have no doubt that a considerable portion of the NETCenter's time > will be spent in matters of foreign intelligence. (As I said, we > cannot afford two massive decryption laboratories -- the NSA will > have to give its decryption mandate to this new agency). I completely disagree here. You might be right, but I give you 1 million to 1 odds. The NSA is absolutely NOT about to give up its role as the numero uno decryption lab without sacrificing many politicians (possibly with their lives, too, as its accountability to the public is near non-existent). The NSA is politically impossible to take on for very obvious reasons. > In other words, this is a great tool for prosecutors to use *after* > they have established probable cause in their most heinous cases, > and a strong guarantee that the eyes of the government will not > intrude into our persons, papers and effects. The astronomical cost per decryption and the lack of a guarantee that it might necessarily produce useful evidence will guarantee that this tool is not abused. I agree with this kind of conclusion. That is, I believe that, if any side of this debate is to be guaranteed anything, it should be that abuse is guaranteed to be low, rather than LE access is guaranteed to be easy. > The passage of this amendment helps ensure that the terms of this > debate remain centered on our civil liberties -- not kiddie porn. I assure you that this debate will always be shifted toward the "suitcase nuke", kiddie porn, child molestor and drug dealers by the FBI and the NSA in secret briefings. There is not a chance in hell they will give up the best PR tool they have to scare the legislators, judges and the president without anyone present to counter their arguments. Ern

1 0

Re: Oxley Amendment
by Syniker＠aol.com 17 Dec '03

17 Dec '03

I'd like to see a path for this thing too... maybe declan can help there... I'm gatherin addressess for my own mail, fax, phone thing... Larry. pgp pubkey: http://www.jetlink.net/~aargh/

2 1