December 2003 - cypherpunks-legacy

Re: Digitally Signing Physical Objects
by fnerd＠smds.com 17 Dec '03

17 Dec '03

i wrote- > >[Physical signature] > > seems to have a tricky dependence on the tolerance. The forger can > >get a valid plaintext and signed feature vector. So, if the tolerance > >for error is too low, you get false positives, but if it's too high, a > >forger could create something starting from the feature vector. An > >interesting CAD/CAM problem. Allen J. Baum replied- > To keep black market forgery part off the market, a 30% tolerance is way > more than enough. There should be no false negatives (making a real part > look fake), but if 1/3 of the forgeries slip through (i.e. 2/3 don't), this > has the affect of driving the forgery price up by a factor of 3, > effectively pricing them out of the market. I don't see how you factor out the variables of the resolution, what physical property is scanned, etc. For some combinations, it would be easy to forge 100% matches. For others, it would be hard to get a 30% match on the original object... Maybe the whole scheme could be improved by a trap-door function that has built-in error-tolerance. (By the way, if anybody knows about fuzzy hash functions, please write me; I'm curious for other reasons.) > (Unless the real goods are overpriced a factor of 3...:-) Isn't Great Art overpriced by thousands of times, in terms of reproduction cost? Anyway, a 2/3 rejection rate would be tough. -fnerd quote me - - - - - - - - - - - - - - - We shall have to evolve Problem solvers galore As each problem they solve Creates ten problems more. --Piet Hein -----BEGIN PGP SIGNATURE----- Version: 2.3a aKxB8nktcBAeQHabQP/d7yhWgpGZBIoIqII8cY9nG55HYHgvt3niQCVAgUBLMs3K ui6XaCZmKH68fOWYYySKAzPkXyfYKnOlzsIjp2tPEot1Q5A3/n54PBKrUDN9tHVz 3Ch466q9EKUuDulTU6OLsilzmRvQJn0EJhzd4pht6hSnC1R3seYNhUYhoJViCcCG sRjLQs4iVVM= =9wqs -----END PGP SIGNATURE-----

1 0

story on digital telephony from today's Washington Post (fwd)
by Mike Godwin 17 Dec '03

17 Dec '03

The Washington Post February 24, 1994 Business Section, first page FBI, Justice Seek High-Tech Surveillance Guarantees by John Mintz and John Schwartz Washington Post Staff Writers The FBI and the Justice Department are fearful that increasing sophistication in communications technology will keep investigators from tapping phones and computers and are seeking legislative guarantees that wiretaps will continue to be technically possible. The Bush administration proposed a similar bill in 1992, but withdrew it after industry officials and civil libertarians bitterly denounced it. Although the Clinton administration's new version differs in some ways from the old one, opponents said it too is flawed. Administration officials will outline their proposal today at the White House for communications executives. "We see this bill as a potential blueprint for an electronic surveillance society," said Jerry Berman, executive director of the Electronic Frontier Foundation and spokesman for a coalition of civil-liberties groups and high-technology firms. FBI Director Louis J. Freeh said in a speech last week that the new technologies and a "lack of support" by some communications executives mean "the country will be unable to protect itself against terrorism, violent crime, foreign threats, drug trafficking, espionage" and other crimes. Berman said that designing peepholes into the nation's rapidly expanding information infrastructure will do far more than guarantee law enforcement agencies the ability to tap phones. As more and more activities of everyday life go "on-line" -- from home banking to video-on-demand selections -- the initiative would provide snoopers with a profile of how citizens live, work and play, he said. The new bill would give the attorney general broad power to demand that communications gear be designed to guarantee that investigators would have access to it, and sets stiff penalties for firms that don't comply. The bill would allow the attorney general to seek fines of $10,000 a day for firms that don't provide access or, in some cases, to shut them down. A copy of the bill and the administration's analysis have been obtained by The Washington Post. Industry executives voiced concern that redesigning U.S. communications networks to accommodate the proposed legislation would cost more than the FBI's $300 million estimate. Under the FBI plan, taxpayers, not telephone ratepayers, would foot the bill. The FBI and the Justice Department say the initiative would not expand their power, but would ensure access to the type of communications they have been entitled to tap for years. Administration officials say such authority was granted in 1970 amendments to the Omnibus Crime Control and Safe Streets Act of 1968. But the communications industry at that time consisted mostly of AT&T. Not only has technology become more complex, but a host of new players have entered the field, including the "Baby Bell" regional phone companies, cable firms, computer companies and more. The FBI is concerned about a host of new phone services, including "call forwarding," under which calls are bounced from phone to phone and, in turn, defeat investigators searching for a call's final destination. Moreover, the FBI says many cellular phone systems provide only limited "ports," or entryways, for tapping. In the mid-1980s, New York City's cellular system provided only five "ports" for tapping, meaning investigators often waited in line. The new bill dropped a requirement in the 1992 proposal that would have insisted that corporate switchboards accommodate wiretaps. The new bill applies mainly to "common carriers." That term usually refers to phone firms or transportation companies, but in this bill could be interpreted to include cable firms and others. Computer and telecommunications equipment firms also would be required to provide access for investigators. The bill would require phone firms, on law enforcement's request, to provide up-to-the-second records on every call to and from any phone. The new bill would allow investigators to gather the information more quickly than ever before, and from their offices. Under current law and under the new bill, investigators can obtain such data relatively easily -- by persuading a judge that it's "relevant" to an ongoing criminal probe. Philip Servidea, government affairs director for AT&T, said the company has long believed a new law is unnecessary. "The legislation will have to have come a long sight from the last version to be acceptable," he said. "This makes the development of the communications industry a law enforcement matter," said Janlori Goldman, a privacy expert at the American Civil Liberties Union. "We're very concerned." Sen. Patrick J. Leahy (D-Vt.) said that while he looks forward to working with Freeh to update wiretap laws, giving the government "final say in how far and how fast technology advances" could "jeopardize the legitimate concerns of business."

1 0

Re: Clipper is Voluntary? Hah!
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Of *course* it's voluntary. You don't have to use it! (Pay no attention to that Digital Telephony Bill beind the curtain!) Actually, it *is* voluntary - for the government. They don't have to use it, at least not currently, and they'll still leave themselves loopholes for use of anything they want for national security, etc. Bill

1 0

An Australian Clipper!
by Peter Murphy 17 Dec '03

17 Dec '03

Does anyone know if there is any proposals (whether tentative or as a bill) to introduce some equivalent of Clipper into Australia. I have only heard about it when my cryptology lecturer alluded to it. When I pressed him further, he said that he didn't have any hard information, but noted that the Australian government were looking at the American Clipper proposal with some interest. I find this very disquieting. Any comments or information would be appreciated. Thank you. Peter Murphy. (pkm(a)axiom.uq.oz.au)

1 0

WE WANT SELF DECRYPTING STENOGRAPHY NOW!
by Gary Jeffers 17 Dec '03

17 Dec '03

What is SELF-DECRYPTING STENOGRAPHY? Something like a self-extracting PKZIP file. Its definition would be: picture + password = plaintext. Its utility? Imagine a bunch of state agents searching your pc & they find a subdirectory of pretty pictures. The stenography has no telltale flag or tag. No embarrassing arguments with a judge about passwords or contempt or court. No hassles with customs agents. No interceptions of internet code pointing you out as a dangerous dissident or freeman. Just a bunch of pretty pictures! Admittedly, programming it could be a bitch. But then, succeeding with it would put your reputation up there with Zimmerman & the RSA discoverers. It would also give us all a wonderfully safe method of encryption. The encryption engine itself could be of our own choosing. I would recommend IDEA. Your programming job would consist of 2 problems. 1. The method of taking out your already encrypted data from a picture. 2. the bootstrapping method of having the picture with password unravel itself. One might be a little difficult but I would guess it would just be some assembler drudge work, taking a month or two if you are experienced. Two might be very tricky & you might be forced to resort to a small hidden or remembered xor type assembly program. Only the decryptor would be tricky. The encryptor would be much simpler since it would all be hidden in a pretty picture! When strong cryptography is outlawed, only outlaws with SELF-DECRYPTING STENOGRAPHY will converse with impunity. GO TEAM GO! GO TEAM GO! PUSH EM BACK! PUSH EM BACK! WWWAAAAAYYYYYY BBAACCKKK! BBBEEEAAATTTT STATE!

1 0

Clinton Uses E-Mail to Respond to Swedish Prime Minister Feb 18 (fwd)
by geoffw＠internex.net 17 Dec '03

17 Dec '03

Subject: 2532 Clinton Uses E-Mail to Respond to Swedish Prime Minister Feb 18 Clinton Uses E-Mail to Respond to Swedish Prime Minister Feb 18 SUPERHIGHWAY REPORT HPCwire ============================================================================= Washington, D.C. -- President Clinton exchanged the first-ever electronic message with another head of government on February 4. According to reports from the Associated Press, the White House said the computer messages, commonly called E-mail, started with a "Dear Bill" electronic letter from Swedish Prime Minister Carl Bildt. Clinton responded the next day with a "Dear Carl" E-Mail. In his message, AP reports, Bildt said he was testing the global Internet system. He congratulated Clinton on ending the trade embargo on Vietnam and said he will take up the issue of Americans taken prisoner or missing in action in that country when he visits Hanoi in April. "Sweden is -- as you know -- one of the leading countries in the world in the field of telecommunications, and it is only appropriate that we should be among the first to use the Internet also for political contacts and communications around the globe, Yours, Carl." Bildt concluded. Clinton's reply -- "Dear Carl: "I appreciate your support for my decision to end the trade embargo on Vietnam and thank you for all that Sweden has done on the question of the POW-MIAS. I share your enthusiasm for the potential of emerging communications technologies. This demonstration of electronic communications is an important step toward building a global information superhighway. Sincerely, Bill." ***************************************************************************** H P C W I R E S P O N S O R S Product specifications and company information in this section are available to both subscribers and non-subscribers. 901) ANS 902) IBM Corp. 904) Intel SSD 905) Maximum Strategy 906) nCUBE 907) Digital Equipment 909) Fujitsu America 912) Avalon Computer 914) Applied Parallel Res. 915) Genias Software 916) MasPar Computer 919) Transtech Parallel 921) Cray Research Inc. ***************************************************************************** Copyright 1993 HPCwire. To receive the weekly HPC Select News Bulletin at no charge, send e-mail to "trial(a)hpcwire.ans.net". ----- End Included Message -----

1 0

Re: Stealth PGP and Stegonagraphy (Summary)
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Hiding the file in deleted sectors on the disk has a number of problems. 1) It's highly non-portable. 2) If the Bad Guys are looking for contraband files, either they're competent or they're not. If they're competent, they'll certainly notice your weird drivers and TSRs holding the disk stuff around. Your virus-checking software may notice it also :-) 3) If the Bad Guys aren't competent enough, you can get by either hiding the file under an innocuous name (e.g. boring.dat), or you can go a bit farther by using mimic functions or other steganographic techniques to make the file really look like something boring. 4) If the Bad Guys are competent, and they suspect you, they may try using Norton UnErase or similar ommands to recover the stuff anyway. Fractals are a good place to hide stuff, since random-looking low-order bits could come from steganography, or could just be from the fractal itself; it's really hard to tell since it's tough to regenerate unless you know the precise starting parameters and machine behavior. You could probably hide 4 bits per byte without major visibility instead of the 1 bit/byte you typically can get away with in normal gifs. More important is making sure your encryption program doesn't have incriminating stuff visible in it, such as "BEGIN PGP STUFF" character strings in the object code.... Bill

2 1

No Subject
by smb＠research.att.com 17 Dec '03

17 Dec '03

And there's also the question of whether or not I'm going to execute a random program that you've sent me, allegedly to do a decryption....

2 1

Sending encrypted stuff to non-PGP users.
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

PGP already lets you do almost what you want. The pgp -c option does conventional crypto, using IDEA, and prompts you for a passphrase to encrypt it with. (You can look at the code to see if it crunches it with MD5 or just uses the first 16 bytes / 128 bits.) To decrypt, you just do pgp -d filename. This lets anybody who has the PGP binaries on their machine decrypt it, even if they haven't bothered setting up public and private keys. If they use DOS, and either you're located in an encryption-tolerant country or they're located in your country, you can send them the binary if they want. If this is too big, you can shred apart the PGP source and do a version with just the IDEA decryption stuff, leaving out the patent-sensitive RSA code and most of the fancy help and file-handling stuff. Of course, if you *still* really want something that's widely executable for people who don't want to install crypto code on their machines, you could write yourself an IDEA-decryptor in PostScript (tm) and let them print the file on their laser printer. A tad slow, but...... (Yes, they'll need some way to input the passphrase; editing the file works but leaves traces around. You'll think of something user-friendly if you're that perverse :-) Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Re: Clipper
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Clipper is currently only rated for non-classified use. It could be done securely, assuming there aren't any unannounced backdoors, by simply using chips for which the keys are not escrowed, or are only held by the military and protected with certain classification levels, but they'd have to do a couple of things to use it. The most important is making sure that a secure Clipperphone is only used to talk to other secure Clipperphones, and in addition you'd probably want to make sure the users have some way of knowing they're talking to appropirately cleared users, since it's sometimes hard to tell if the voice on teh other end of the phone really has the authorization it claims it does. Features like these are built into STU-II and other classified-use approved phones, but aren't likely to be built into vanilla Clipperphones. It may be possible to do that with Tessera, though; I'd have to see more information than they're likely to give out.... Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

2 1