December 2003 - cypherpunks-legacy

Re: Easy cracking
by Marc Horowitz 17 Dec '03

17 Dec '03

>> The same kind of thing happened at Sun, except with the >> secure rpc stuff. Had a guy send mail saying, "I know your >> two primes." Sun replied, "No way." (And lauged internally.) I'm not sure this is how it happened, but the person (maybe there's more than one?) who did this is a cypherpunk, who will identify himself if he wants. He also wrote a paper on this. The first version of the paper had the private key at the top of the first page, but it got removed because certain spooks got upset. Marc

1 0

Hacking ClipperPhones
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

"Cypherpunks Hack Hardware" It seems logical that when the ClipperPhones come out, they will have some kind of vocoder chip in them. (I doubt the (co)decoding will be implemented on the Clipper chip itself) If so, cypherpunks can take advantage of this situation. By hacking up a daugherboard, the phone's vocoder/modem/sampler can be exploited and interfaced to a PC (possibility via something as simple as a null modem cable or centronics). After that, the software hackers can do their job. If the ClipperPhone becomes popular and the daughterboard is cheap to build ($25-50), it would serve as a massive hardware platform for cypherpunks phone software. The alternative is to produce our own vocoder/sampler boards, but I doubt we could approach the economy of scale that AT&T can, plus we get to ride on the back of their advertising/marketing by having them sell the basic hardware. (then we just release a hack for it) What do you think? -Ray -- Ray Cromwell | Engineering is the implementation of science; -- -- EE/Math Student | politics is the implementation of faith. -- -- rjc(a)gnu.ai.mit.edu | - Zetetic Commentaries --

1 0

Re: Disturbing statistics on wiretaps
by smb＠research.att.com 17 Dec '03

17 Dec '03

smb(a)research.att.com writes > The same is true of e-mail over the Internet--there is no > statutory exclusionary rule that would prvent its > admissibility in court. It is at least theoretically possible, > however, to exclude illegally seized communications of these > sorts using a "pure 4th Amendment" (nonstatutory) exclusionary > rule. > > Don't hold your breath, though. > > Do you really think that? One could argue, fairly strongly, that th e > rules set forth in the ECPA have created an expectation of privacy, > and that a violation of that expectation would be exactly the violat ion > of the 4th Amendment that the Supreme Court addressed in the 1967 > decision that led to the original wiretap provisions in the Omnibus > Crime Control and Safe Streets Act. What's your point? One can argue all sorts of things. Are you saying you have reason to believe an argument of this sort is likely to be a winner? Me, I just work from what I know about 4th Amendment caselaw. I realize that you know more about the relevant case law than I do. It would be pretty sad if you didn't. But I'm not completely ignorant of either this subject in particular, or constitutional law in gneral, and I like to learn more. I'm asking to be educated, and I don't like to rely on assertions by authority. I advanced what I thought was a fairly strong argument against your point. Further, the wording of the statute seems pretty clear to me. 18 USC 2515: Prohibition of use as evidence of intercepted wire, oral, or electronic communications Whenever any wire, oral, or electronic communications has been intercepted, no part of the contents of such communication and no evidence derived therefrom may be received in evidence in any trial, hearing, or other proceeding in or before any court, grand jury, department, officer, agency, regulatory body, legis- lative committee, or other authority of the United States, a State, or a political subdivision thereof if the disclosure of that information would be in violation of this chapter. As I read it, if the government doesn't follow the wiretap rules, the evidence thereby obtained can't be used. What have I missed? --Steve Bellovin

1 0

Re: Disturbing statistics on wiretaps
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

In cypherpunks, allan(a)elvis.tamu.edu (Allan Bailey) writes: > I don't think e-mail over the Intenet will ever be used in court > since anyone capable of reading the RFC would be able to forge email. > So, anyone could claim that the email being used as evidence is a > forgery _and_ be able to prove it by doing it or demonstrating it. Different standards of proof apply to different kinds of court cases. Criminal cases need "proof beyond all reasonable doubt"; civil cases tend to need "preponderance of evidence". Forging email is similar to forging typed documents - sometimes cases will heavily use evidence like analysis of individual typewriter characteristics (which was more useful when people had real manual typewriters than with laserprinters), other cases won't examine those details unless one side or the other claims the document isn't theirs or is forged (and remember, this is typically subject to perjury if you're caught lying.) If you're being accused of a serious crime with severe penalties, like murder, an assertion that you didn't type/email something will be taken seriously, and probably lead to more analysis; if they can't *really* prove you sent it, that can be grounds for appeal. But if you're being accused in a civil lawsuit with only monetary damages, like libel/slander or whatever the legal form was in the case where somebody on a computer network disparaged a company's stock and the directors sued when stock value dropped, the assertion may be listened to, but even if there aren't enough log-files to strongly support the assertion that you didn't say it, the jury may decide there's enough evidence to find for the plaintiff, especially if you were a user of that computer network and didn't go net.screaming that you'd been impersonated. (On the other hand, after you lose the libel/slander/etc. suit, if the government decides to charge you with perjury for saying it wasn't your email, the log-files and lack of provability become much more relevant.) Of course, if you're accused of a minor offense with major penalties, e.g. political crimes like drug possession or trespasses like the E911 document copying, lack of proof will be treated as evidence that you know something about DRUGGZZZ or HACKING and are therefore EEEVILL and your penalties will be tripled :-( # Bill Stewart wcs(a)anchor.ho.att.com +1-908-949-0705 Fax-4876 # AT&T Bell Labs, Room 4M-312, Crawfords Corner Rd, Holmdel, NJ 07733-3030 # # goin' where the climate suits my clothes ....

1 0

Re: Disturbing statistics on wiretaps
by George A. Gleason 17 Dec '03

17 Dec '03

And of course it should be remembered that there is still an old drug-war thing on the books which allows 72 hours' interception without a court order. Now depending on how that's interpreted, 72 hours are a lot of conversations. This stuff can be used for background intelligence and investigation where it never winds up in court but is used to get information to be used in other ways. "It's what they don't tell you..." -gg

1 0

Re: Hacking ClipperPhones
by George A. Gleason 17 Dec '03

17 Dec '03

Re your suggestion of a cypherpunk daughterboard to substitute for Clipper in "secure" phones etc.: I have a sneaky suspicion that AT&T won't be quite so cooperative. They constantly do things in such a way as to make it darn hard to do anything with their products except exactly what they intended to do. It might be worth a try though... OTOH anything that creates more demand for AT&T phones is a not-good thing in my view... we need an entirely competing product, and preferably cheaper than an AT&T clipperphone + daughterboard, for obvious competitive reasons. There are plenty of telephone manufacturers in the world. Some are relatively small shops in Asia which make European knock-offs for the Asian operating companies. I know of another one in Portugal which at least ten years ago was favorable to doing mildly custom stuff. If nyone here is seriously interested in competing cryptophones, I'd be willing to find an appropriate telephone set manufacturer who makes quality phones and is willing to put in a daughterboard socket or other useful mods. -gg(a)well.sf.ca.us

1 0

Re: Disturbing statistics on wiretaps
by Mike Godwin 17 Dec '03

17 Dec '03

Steve Bellovin writes: > I realize that you know more about the relevant case law than I do. It > would be pretty sad if you didn't. But I'm not completely ignorant of > either this subject in particular, or constitutional law in gneral, and > I like to learn more. I'm asking to be educated, and I don't like to > rely on assertions by authority. This is both a fair comment and a fair request. Sorry for being irritable yesterday. > I advanced what I thought was a > fairly strong argument against your point. Further, the wording of the > statute seems pretty clear to me. 18 USC 2515: > > Prohibition of use as evidence of intercepted wire, > oral, or electronic communications > > Whenever any wire, oral, or electronic communications has > been intercepted, no part of the contents of such communication > and no evidence derived therefrom may be received in evidence in > any trial, hearing, or other proceeding in or before any court, > grand jury, department, officer, agency, regulatory body, legis- > lative committee, or other authority of the United States, a > State, or a political subdivision thereof if the disclosure of > that information would be in violation of this chapter. This is not an accurate presentation of 2515, Steve. "Electronic communications" was not added to 18 USC 2515 by ECPA. The statutory exclusionary rule applies only to wire and oral communications. > As I read it, if the government doesn't follow the wiretap rules, > the evidence thereby obtained can't be used. What have I missed? You've missed the actual language of 18 USC 2515. I don't know where you got this one. --Mike

1 0

Triple DES products hitting market
by Anonymous 17 Dec '03

17 Dec '03

excerpted from: Communications Week No. 473, September 27, 1993 page 36 Cylink Triples Encryption by Sharon Fisher Sunnyvale, Calif. - Cylink Corp. has announced an encryption product that improves security by encrypting data three times using current standards. The Cylink product uses the Data Encryption Standard, which defines a 56-bit key for scrambling messages to prevent access by unauthorized users. DES was adopted in 1977 as the U.S. federal standard for data encryption. Skirting DES Limitations Some users have expressed concern, however, that DES' 56 bits cannot prevent a determined attacker from using more powerful hardware and software to crack the code. The Cylink product addresses the problem by using DES to encrypt the data more than once, according to company officials. Cylink's Cipher/Decipher-HSi offers triple-DES, which encrypts DES data three times, and gives the 56-bit key the effect of a 112-bit key, according to the company, based here. The triple-DES approach makes the Cylink product more secure than the government's proposed Clipper system, which uses an 80-bit key, the company said. Users could get the triple-DES effect by manually encrypting data three times, but the process would take three times as long as single DES encryption, Cylink noted. Cidec-HSi uses improved circuit technology that performs the three encryptions without taking that long, the company said. Cidec-HSi works at speeds of up to 2.048 million bits per second and is available with a wide variety of interfaces, Cylink said. It also includes a public key management system, which lets users exchange keys so that they can read each other's messages. The device also offers an optional embedded channel service unit, which can be connected directly to the public T1 carrier network, the company said. Cylink said it can retrofit current Cidec-HSi systems so they can benefit from the new triple-DES technology. AT&T Compatibitlity The company said that Cidec-HSi meets compatibility standards for use with AT&T's Accunet T1.5 and Extended Superframe Format services. Cylink can be reached at 735-5800.

2 1

Re: saturation tactics?
by ssteele＠eff.org 17 Dec '03

17 Dec '03

Nate asks: >BTW, what is the snail-mail address to send these letters to? Willam B. Robinson United States Department of State Bureau of Politico-Military Affairs Office of Defense Trade Controls Washington, DC 20522-0602 George suggests: >yeah, here's a cheaper version. Write to the arms excport license people >and pester them with questions: I'm a BBS operator, what should I do?; I'm a >businessperson travelling overseas and need my crypto to comm with the home >office what should I do?; all this kind of thing. Swamp them with letters. >Every person and every circumstance which even remotely fits. > >An alternative version which would require more guts and perhaps a serious >conscientious decision about whether it's worth making this an act of civil >disobedience, is to write to them and say, "I'm a BBS operator, not an arms >merchant, and on the strength of my 1st-A rights I'm not going to censor my >board or get a license..." or "I'm a businessperson who travels & takes my >cryupto out of the country on my laptop to comm with the home office; I'm >not an arms dealer either and I don't intend to get a license..." And >again, there is strength in numbers here. I like the first idea. As an attorney (stop with the hissing out there!), I feel a need to remind you that these State Department guys are serious. They can really make your life miserable -- just ask Phil Z. I strongly suggest that you keep that in mind before openly suggesting that you intend to export encryption. I agree that the export laws stink. I'm hoping we can get the law nixed without anyone going to jail. Shari

1 0

unsubscribe
by jhall＠lambda.msfc.nasa.gov 17 Dec '03

17 Dec '03

unsubscribe

1 0