December 2003 - cypherpunks-legacy

RE: Wassenaar Statement
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: "Phillip Hallam-Baker" <hallam(a)ai.mit.edu> To: "Robert Hettinga" <rah(a)shipwright.com>, <dcsb(a)ai.mit.edu> Subject: RE: Wassenaar Statement Date: Fri, 4 Dec 1998 18:02:40 -0500 MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Importance: Normal We have seen this type of press release before. Uncle Sam goes off to a conference and returns to state that the rest of the world has committed to its position - only to find out later that the rest of the world did not. Anyone remembe the time the crypto Tzar went off to the European Association (a non binding talking shop) and got a similar 'undertaking'. It is more likely that the Wassenaar statement reflects what went on at the meeting. But even then most countries in Europe have a democratic process in which decisions are made by elected representatives and not by beaureacrats at closed treaty negotiations. Just as the munitions acts under which the ITAR crypto regulations are purported to be made clearly do not provide the executive with the powers claimed, neither do most of the European enabling acts for COCOM. Nor in a parliamentary system is it quite so easy for the executive to perform Zimmerman type persecutions. If the same tactics had been used in the UK the Home secretary would have faced political consequences for the failure of the prosecution. The Matrix Churchill affair played a significant part in the collapse of the Major government in the UK. I doubt Straw would be keen on a repeat. The UK DTI proposals requiring GAK as a condition of CA licensing may appear to meet the Freeh objectives but since there is no proposal to make licensing a requirement of doing business the result is most likely to be nobody becomes a 'licensed CA'. There is a legitimate business need for key recovery but nobody offering those services is going to want access to the customer's private keys. Doing so would be akin to keeping triffids as pets. It is not necessary to keep actual private keys to achieve the objective of controlling access to the private keys. Phill --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: FC: So far, I think Mr. Aarons' Wassenaar statement is disinformation
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Fri, 4 Dec 1998 18:19:58 -0500 (EST) From: Peter F Cassidy <pcassidy(a)world.std.com> To: Robert Hettinga <rah(a)shipwright.com> Cc: dcsb(a)ai.mit.edu Subject: Re: FC: So far, I think Mr. Aarons' Wassenaar statement is disinformation Mime-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Peter F Cassidy <pcassidy(a)world.std.com> Friends, In e-mail exchanges with EC ministers and government ministers in W. European nations that I have had about Aarons one thing is consistent. All seemed to be shocked and dismayed at his ability to report out facts to the press in the US and to the Clinton Administration that have little to do with actual events. It would not surprise any of them if Aarons' unilaterally declared a 33 nation crypto-control agreement that was based entirely on his baroque misunderstanding of the facts. PFC On Fri, 4 Dec 1998, Robert Hettinga wrote: > > --- begin forwarded text > > > X-Sender: declan(a)mail.well.com > Date: Fri, 04 Dec 1998 15:29:29 -0500 > To: politech(a)vorlon.mit.edu > From: Declan McCullagh <declan(a)well.com> > Subject: FC: So far, I think Mr. Aarons' Wassenaar statement is > disinformation > Mime-Version: 1.0 > Sender: owner-politech(a)vorlon.mit.edu > Reply-To: declan(a)well.com > X-Loop: politech(a)vorlon.mit.edu > X-URL: Politech is at http://www.well.com/~declan/politech/ > > [John is basing his analysis below on what's been posted on the Wassenaar > site so far, and these kinds of documents aren't always put online > immediately. That said, if Ambassador Aaron is talking about the online > documents and John's analysis is correct, the Clinton administration is > going beyond mere spin: it is trying to deliberately deceive. --Declan] > > ********* > > Subject: So far, I think Mr. Aarons' Wassenaar statement is disinformation > > Date: Fri, 04 Dec 1998 10:55:00 -0800 > From: John Gilmore <gnu(a)toad.com> > > I have not found a single confirmation of the Aarons statement that > the 33 Wassenaar countries have agreed to change the exemption for > mass market crypto software. (The NY Times and Reuters stories both > quote Ambassador Aarons.) > > This lack of confirmation includes the Wassenaar Arrangement statement > itself, which merely says: > > The amendments to the lists included elimination of coverage of > commonly available civil telecommunications equipment as well > as the modernisation of encryption controls to keep pace with > developing technology and electronic commerce, while also being > mindful of security interests. > > http://www.wassenaar.org/docs/press_4.html > > The Wassenaar Arrangement works by consensus; any member can block the > adoption of any item merely by voting against it. The policy Aarons > announced is directly contradictory to the recently reaffirmed > government policies of Finland and Ireland. In addition, Canada and > Germany have recently stated strong pro-crypto positions (while > waffling on the particular issue of the treatment of PD and MM > software). > > The Wassenaar Arrangement also states: > > This arrangement will not be directed against > any state or group of states and will not impede > bona fide civil transactions. > > To the extent that there is any attempt in the Agreement to control > mass market or public domain crypto software, such a provision > would clearly contradict this limitation written into the Arrangement. > The Arrangement is for military goods -- not for civilian goods. > PGP and other civilian crypto tools are not military by any stretch > of the imagination. It's hard to imagine that all 33 countries would > ignore this obvious problem, especially when it was pointed out to them > by concerted lobbying over the last several months. > > I also note that none of the statements are clear about exactly what > is affected. PGP, SSH, SSLEAY, Linux IPSEC, and many other crypto > tools are "public domain" rather than "mass market" software. The > General Software Note (originally from COCOM, and adopted bodily by > Wassenaar when it was formed) exempted both "public domain" and "mass > market" software from all controls. > > Finally, a companion paper released from Wassenaar yesterday shows a > clear concern by the body for human rights and fundamental freedoms: > http://www.wassenaar.org/docs/criteria.html: > > e. Is there a clearly identifiable risk that the weapons might > be used for the violation and suppression of human rights and > fundamental freedoms? > > (In this case if the the Aarons statement was true, Wassenaar itself > would be used for the violation and suppression of human rights and > fundamental freedoms. It's hard to see that the delegates would also > ignore this and vote to suppress human rights and freedoms.) > > So, I see two major probabilities here: > > * Either Aarons is lying, to see how much trouble this stirs up. > This would be taking a page from FBI Director Freeh, who > announced FBI support for domestic controls on crypto last year, > and was then disavowed by the Administration when a ruckus > resulted. > > * Or the NSA has cut a deal with these countries. Then the > question is: what did NSA offer in return? The usual trade > has been access to the flow of wiretaps (as in the UKUSA > agreement that gives Britain, NZ, Australia, and Canada access > to Echelon -- look who the strongest supporters of the US position > are). Another alternative is that they used wiretaps to > blackmail senior politicians in the recalcitrant countries. > (It happened in the US by J. Edgar Hoover for many years.) > > Do either of you have any info that would tend to confirm or deny > one of these theories? > > EFF and the GILC members are checking with various governments to > start to flesh out what *actually* happened. > > I should also note that developments like this are rather expectable. > Every time crypto policies get decided in a closed-door meeting where > the US government is invited, they get worse. Whenever crypto > policies are set in open meetings where the public and the press are > able to watch -- or even, god forbid, participate -- they get better. > The OECD meetings of a few years ago were intended to be the first, > but citizens and journalists swarmed the meeting site, buttonholed > delegates as they entered and left, and turned it into the second. We > should've done the same with this Wassenaar meeting. > > US civil libertarians are prying crypto policy decisions into the > light of day via the courts and the Freedom of Information Act. > Classified NSA/FBI testimony to Congress is getting declassified, and > then its obvious lies are easily rebutted by the public. > > The natural response of a bureacracy that is more concerned with its > own power to wiretap, than with making the right decisions for its > citizens, is to move its crypto maneuvering overseas into "diplomatic > meetings", held under cover of diplomatic secrecy, where they can lie > and twist arms with impunity. > > John > > > -------------------------------------------------------------------------- > POLITECH -- the moderated mailing list of politics and technology > To subscribe: send a message to majordomo(a)vorlon.mit.edu with this text: > subscribe politech > More information is at http://www.well.com/~declan/politech/ > -------------------------------------------------------------------------- > > --- end forwarded text > > > ----------------- > Robert A. Hettinga <mailto: rah(a)philodox.com> > Philodox Financial Technology Evangelism <http://www.philodox.com/> > 44 Farquhar Street, Boston, MA 02131 USA > "... however it may deserve respect for its usefulness and antiquity, > [predicting the end of the world] has not been found agreeable to > experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' > > For help on using this list (especially unsubscribing), send a message to > "dcsb-request(a)ai.mit.edu" with one line of text: "help". > For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Streams, Voice, and Sensitive Dependence
by Michael Motyka 17 Dec '03

17 Dec '03

> It is my understanding that the PGP algorithm is primarily intended > as a block cypher. Therefore, wouldn't an Outer Block stream cypher > be more effective for phone conversations? Both solutions require > hardware for a practical (tolerably noiseless) implementation, so > there's nothing to be gained by streaming data into a block format. > Unless you have a really fast ( 1 Mbit / s? ) data connection you're going to want to do some voice compression. The algorithms I've seen break the audio into discrete time frames and (de)compress frame by frame. As a point of reference say about 16 bytes for every 33 msec of voice. Quality roughly follows data rate, of course. This makes a block cipher seem not so unreasonable. Block cipher or stream cipher, either way you're going to have to introduce a latency of _at_least_ a couple of frames to allow for resends or deliberate out-of-order frame transmission. This makes the block cipher look like the better choice. I think that using HW voice compression and a 33.6 modem you could get a full duplex secure conversation over POTS with a latency in the 0.1 - 0.3 second range and a direct cost in the vicinity of $100. With a reasonably quick microP any encryption method could probably be done as SW. This is not a particularly difficult device to build. Any fine US citizens want to build some prototypes? Mike

2 1

PGP Disk
by Mixmaster 17 Dec '03

17 Dec '03

Has anyone had the chance to try out the new McAfee PGP disk? It seems pretty straightforward, allowing for the creation of encrypted "drives" using the CAST algorithm. Is anyone aware of any security flaws with it?

1 0

Re: y2k/gary north delusions (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: y2k/gary north delusions > Date: Fri, 4 Dec 1998 17:40:59 -0600 (CST) > From: ichudov(a)algebra.com (Igor Chudov @ home) > Well... The answer is that there is much less washing needed for > survival than it is needed for day to day civilized American life. True, you don't have to water your grass and wash your car. > For instance, I change my shirts every day. If shit hits the fan, > you can wear a shirt for two weeks. Similar story is with other > clothes. You won't do that sort of stuff for long. A couple of months at best before you get skin infections and then it's down-hill from there. It's pretty much a bogus point though since none of the systems like power, water, and sewer won't be down more than a week at most. ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: y2k/gary north delusions (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 04 Dec 1998 20:22:18 -0500 > From: Michal Hohensee <mah248(a)nyu.edu> > Subject: Re: y2k/gary north delusions > You cannot sustain a modern city without a working sewer system. > Remember what cities were like in the middle ages? I believe some > historians refer to them as "population sinks" for the surrounding > countryside. Not for a lack of wealth or commerce, but for a lack of > sanitation. Paris and London had populations of over a million each and didn't have a sewer system. It was traditional for people to throw their chamber pots out into the street along with the offal from the various animals. The reality is that the folks who support the various systems would have them no manual over-ride within 24 - 48 hours so the worst case scenario won't happen. Countries that aren't automated won't notice the difference and the city services that are won't be down more than a week. ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

.
by Anonymous 17 Dec '03

17 Dec '03

... > A few rules of thumb result from even cursory examination > of the likely environment: > ... > 5. Ultimately, the only way the remailers will provide > what might be described as Pretty Good Security will > be when we have software that maintains a regular > or random rate of messages to and from the remailer > cloud, a stream into which the meaningful messages > can be inserted with no visible change in traffic. > Until then, the best we can do is try to keep traffic > levels up, and to send and receive frequently enough > to frustrate end-to-end traffic analysis. Well, the existing remailer net doesn't make "Pretty Good" anonymity very feasible. I'd think something based on the general idea behind Crowds. (Furthermore, most remailer structures still can't erase some other security concerns -- 1: remailers acutally can be hacked or physically compromised 2: clients really can be screwed 3: etc. To help solve the first, you'd want a two-box setup doing remailing, with the security-critical stuff loaded on a box not directly connected to the Net with something 140-1ish to make tampering harder, a secure OS, etc. -- or, of course, you can scrap all that to get really big remailer count. To help solve the second problem, there needs to be a better web-of-trust setup -- that is, one which applies to code as well as keys. Those who wish to verify code get a .sig-verifying program from a trusted source then use a WoT to authenticate various facets of the program necessary for security. A solution to the third problem is expected RSN.) > > 6. Don't send anything that can have grave consequences. Remember the consequences to an adversary who uses its secret decoder ring, though: the more plausible it becomes that a certain source is being used for intelligence-gathering, the more likely it is that that source will promptly begin to run dry as the spied-upon realize that Something Got Broke. My advice, however, agrees with that of the other Anonymous. That is, unless you've really thought things out, think of an remailed message as merely .sigless, not anonymous. > > 7. Take names. Always take names. Some day... > > FUDBusterMonger > > It Ain't FUD til I SAY it's FUD!

2 1

PGP Disk
by Anonymous 17 Dec '03

17 Dec '03

>Has anyone had the chance to try out the new McAfee PGP disk? >It seems pretty straightforward, allowing for the creation of >encrypted "drives" using the CAST algorithm. Is anyone aware of >any security flaws with it? I'm sure somebody will check if they are bored some day. Where can we find the source code? If the source code isn't available, don't trust it. That's a good general rule.

1 0

Re: y2k/gary north delusions (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: y2k/gary north delusions (fwd) > Date: Fri, 4 Dec 1998 18:46:17 -0600 (CST) > From: ichudov(a)Algebra.Com (Igor Chudov @ home) > > Paris and London had populations of over a million each and didn't have a > > sewer system. It was traditional for people to throw their chamber pots out > > into the street along with the offal from the various animals. > > Guess why they had those devastating epidemics. True enough, but that sort of stuff takes more than a week or two. The various cities could go around setting up port-a-potties and latrines in parks with plastic liners for easy removal, etc. It isn't nearly the civilization shaking event some would make of it. ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

3 2

Re: Vengeance Libertarianism
by Michael Motyka 17 Dec '03

17 Dec '03

My oh my, The alternative to outright revolution has historically been to pack up and ship out to whatever frontier was in vogue. Dangerous, difficult, but apparently compelling if the home situation sucked badly enough. Potentially very rewarding to the survivors. The historical fate of any frontier has been that as soon as it has become somewat hospitable the shitheads arrive with their carpet bags and make it over into the same fucking thing that everyone ran away from in the first place. The first sign of inFESTERation was often a church, followed by a town hall which filled up quickly enough and shortly thereafter hired a sheriff to enforce the town gun ban and who eventually needed more men... And so the cycle repeats with the virtual frontier we're in right now. It was just fine until "they" came along to "civilize" it. Unfortunately backs are to the wall and there is nowhere else to go because SPACE SUCKS MOOSE ALIENS DRY LIKE BUGS. Top that. they - esRb to civilize - to own, regulate, commercialize and tax esRb - evil, scumsucking, Reptilian bastards I could probably develop some sort of virtual space cowboy allegory here that would go on for (p)ages and involve the painful, bloody death of many an evil villian at the hand of a courageous hero and enough deviant sex ( whinny ) to keep the audience enthralled to the very end. The story could probably be continued until well after the traffic has subsided but what the hell, I like driving 5 mph, it's good for my car's engine, my patience and the bandwidth shortage. m

1 0