December 2003 - cypherpunks-legacy

Re: soda.berkeley.edu
by jrk＠sys.uea.ac.uk 17 Dec '03

17 Dec '03

It seems to be ok now. ftp> open soda.berkeley.edu Connected to soda.berkeley.edu. 220 soda FTP server (Version wu-2.1c(17) Wed Sep 22 18:58:23 PDT 1993) ready. Name (soda.berkeley.edu:jrk): anonymous 331 Guest login ok, send your complete e-mail address as password. Password: 230-Welcome to soda.berkeley.edu. We have recently upgraded our ftpd to 230-version 2.1c; it may still have some problems. 230-Mail bug reports to root(a)soda.berkeley.edu. 230- 230-Please read the file README 230- it was last modified on Wed Jun 2 17:02:13 1993 - 120 days ago 230 Guest login ok, access restrictions apply. ftp> The cypherpunks directory is still there too. BTW, when anon ftp servers ask you to give your email address as a password, how many of you do? -- ____ Richard Kennaway __\_ / School of Information Systems Internet: jrk(a)sys.uea.ac.uk \ X/ University of East Anglia uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K.

2 1

Business Week on PGP subpoenas
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

BusinessWeek, October 4, 1993 p. 43, Washington Outlook SPY VS. COMPUTER NERD: THE FIGHT OVER DATA SECURITY Philip Zimmermann wanted to strike a blow for freedom. To help computer users keep data safe from snoopers, the Boulder (Colo.) software consultant and self-described "privacy activist" wrote a program making it easy to encode messages with an all-but-unbreakable cipher. And he offered it free through the network known as the Internet. Now, Zimmermann's gift to cyberspace has exposed an enormous gap in the Administration's vision of a high-tech future. The White House is promoting a data superhighway as a key to a competitive future. But the National Security Agency is trying to restrict the use of high-quality encryption, which experts believe business will need to take full advantage of the "information infrastructure." The focus of the fight is a program Zimmermann calls "pretty good privacy" (PGP). On Sept. 9, two software companies in Texas and Arizona that have been involved in publishing PGP received federal grand-jury subpoenas requesting documents and information about the program. CRACKDOWN. Although the government won't discuss the investigation, the computer world has a pretty good idea what's going on. Because sophisticated encryption allows friends and foes alike to protect communications, the software is subject to the same export controls as munitions. But PGP has popped up all over the world. The probe, says Zimmermann's lawyer, Philip Dubois, is aimed at "finding out how it occurred and whether an offence was committed." Oddly, the crackdown on software comes just as the Administration is loosening export controls on computer hardware. But the schizophrenia may be more apparent than real. "I don't think they've got the export policy together enough to be split," says a key congressional staffer. The underlying problem, explains Paul Freedenberg, a Washington attorney and export-controls specialist, is that "Clinton is very cautious about dabbling in national security. This is an area that has essentially been turned over to the spooks." Meanwhile, there is growing concern in Congress about possible damange to exports. Quality encryption software "is available from foreign manufacturers...and is easily transmitted using only a long-distance telephone line and a modem," complained Representative Sam Gejdenson (D-Conn.) and a high-powered bipartisan group of colleagues in a Sept. 20 letter to the President. "Yet the U.S. continues to control this computer software as a Munitions List item." Says Douglas Miller of the Software Publishers Assn.: "The U.S. government is succeeding only in crippling an American industry's exporting ability." While the goal of the NSA and other security agencies - keeping U.S. messages secure while allowing Uncle Sam to read those of both domestic and foreign bad guys - is laudable, technology may be rendering it impossible. "Law enforcers no longer have the inside track," says Eben Moglen of Columbia University law school. Experts agree that NSA officials are smart enough to see the writing on the wall, encrypted or not. But, says James Bitzos [sic], president of RSA Data Security Inc. in Redwood City, Calif., the agency wants to maintain as much control as possible for as long as possible. Today, intelligence agencies still have a shot at finding "needles in the haystack," he says. "If they lift export controls, they might as well go home." Still, the NSA can't stave off the inevitable for long. Gejdenson hopes to produce legislation by early next year to revamp government policy on high-tech exports. The result will probably include looser restrictions on encryption software - and a victory for Phil Zimmermann in his battle to keep snoops out of his cyberspace. By John Carey ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: Active Eavesdropping of Clipper
by catalyst＠netcom.com 17 Dec '03

17 Dec '03

Mike Ingle quotes Matt Blaze (and I paraphrase): >[...] so the procedure for placing a secure call is to recognize >each other's voice in the clear mode, go secure, and read the hash >value to each other [...] you have to rely on prior knowledge of each >other's voice. [...] This is out of band WRT the encryption engine. Note that it can be used exactly like an asymmetric encryption key for authentication. You know the other persons signature/voice in advance and it is hard for an attacker to reproduce it. >[an attacker could] trick you into saying some numbers, digitally record >them, and then rearrange them and play them back. The 'replay' attack. Of course you always make the other person say the hash _and_ some (never reused?) data in a lump (re: my earlier post -- concatenate your challenge data with their a^x before signing) for instance: "Bob, please sing me the hash to the tune of 'Raindrops Keep Fallin' on My Head'" (Security can be fun). >Or introduce enough line noise so the person couldn't recognize your >voice, and read the fake key Signature not valid. Sorry Bob, I'll have to call you back. That is, _if_ it's really you. Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

Source for MacPGP 2.3
by jrk＠sys.uea.ac.uk 17 Dec '03

17 Dec '03

I wrote: >I have MacPGP 2.3 (the Macintosh application). From what ftp site can I >obtain the source? soda only has Mac source for 2.2. In fact, I've found that I do have the source for MacPGP 2.3 (although someone told me the source wasn't released yet). I can't remember where I got it though. I won't undertake to email it to anyone, nor to place it on anonftp indefinitely, as the only anonftp area I have is on my desktop machine. However, I'm not going to be around for about a week, so I'm willing to make it available during that time. Any last-minute demands for me not to do this for some reason? Tough, I'm about to leave, after which it's out of my hands. One-time offer, valid for one week only!! ========================================= MacPGP2.3 application, documentation, and source (for Symantec (Think) C 5.0.4), will be available by anon ftp on jrk.sys.uea.ac.uk, from Thurs 30 Sep (today) 14:00 GMT until Fri 8 October 08:00 GMT. Note that this machine is in the UK. It is the responsibility of those accessing it to satisfy themselves of the legality of their actions. These files are available strictly on an "as-is" basis, with no warranty, express or implied, concerning their contents. Instructions: ftp to jrk.sys.uea.ac.uk and give the following commands. user anonymous (Give your email name as password...or not. All transfers will be logged.) cd "RK's Public Folder" (Yes, there are spaces in the name of the directory. This is a Macintosh.) ascii get macpgp2.3src.sea.hqx.pgp (NB. If you are ftp-ing from anything but another Mac, the above file must be transferred in ASCII mode.) binary get macpgp2.3.sit Once you have these files, you need to do the following steps: 0. Put both files on a Mac, if they aren't there already. 1. Use Stuffit 1.5.1 or any decoder (such as DownLine) which understands that format to decode macpgp2.3.sit. This will give several files, one of which is the MacPGP 2.3 application. 2. Use the application to verify the signature on macpgp2.3src.sea.hqx.pgp and to strip the ascii armoring from it, creating a file macpgp2.3src.sea.hqx. (If you already have PGP on a unix machine, you can do this there and then transfer the .hqx file to the Mac.) 3. Use a BinHex decoder to decode macpgp2.3src.sea.hqx. This yields an application macpgp2.3src.sea. 4. Run that application, and it will decode itself into the source for MacPGP2.3. Paranoids should note that macpgp2.3.sit is not PGP-signed, and you only have my word that it does what I say it does. macpgp2.3src.sea.hqx.pgp is signed, but not by me, and I am not in a position to certify its signature. I use MPW C, so I haven't even compiled the source myself. I am *not* able to answer any questions about MacPGP itself, nor will I or anyone else be available during the coming week to sort out any ftp problems. I will probably be out of reach of email during that time as well. -- ____ Richard Kennaway __\_ / School of Information Systems Internet: jrk(a)sys.uea.ac.uk \ X/ University of East Anglia uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K.

1 0

FIDOnet encryption (or lack thereof)
by Just-in-time terraforming 30-Sep-1993 1008 17 Dec '03

17 Dec '03

>Mike, Please advise the sender of this message that I DO NOT allow >encrypted mail to pass thru this system. I expect folks to abide by this >rule voluntarily... > >I would hate to have to block all messages from this source becuase >someone wishes to violate my policy :) > >BTW, the debate about "encrypted" mail with me is MOOT... I will not vary >from my position... (just thought I'd let you know in case you wanted to >try to convince me it is OK to allow encrypted mail...) please have the >other person send encrypted mail directly to your machine... Heh. OK. Well, if one behaves "ethically", then I guess *that* closes the issue. It's his machine and he gets to make the rules. (this is my personally-adhered-to point of view) On the other hand, he doesn't seem to have protected himself against steganographic users (though the low bandwidth of steganography compared to obvious encryption may make the steg channel less useful). Others may choose to take this point of view- but it's your karma. -Bill

5 8

A Word From Bill
by Duncan Frissell 17 Dec '03

17 Dec '03

Since president(a)whitehouse.gov is not yet a full duplex operation, I wanted to take this opportunity to speak personally to all you cypherpunkian-Americans (and the odd foreigner) out there. I feel your pain. I understand your concerns. Your concerns are my concerns. As I said on September 14th: I want to say to my fellow Americans, when you live in a time of change, the only way to recover your security and broaden your horizons is to adapt to the change, to embrace it, to move forward. Nothing we do, nothing we do in this great capital can change the fact that factories or information can flash across the world, that people can move money around in the blink of an eye. Nothing can change the fact that technology can be adopted, once created, by people all across the world and then rapidly adapted in new and different ways by people who have a little different take on the way that technology works... ...I tell you my fellow Americans, that if we learn anything from the collapse of the Berlin Wall and the fall of the governments of Eastern Europe, even a totally controlled society cannot resist the winds of change that economics, and technology, and information flow have imposed on this world of ours. That is not an option. Our only realistic option is to embrace these changes... William Jefferson Blythe Clinton --- WinQwk 2.0b#0

1 0

Availability of ACM papers on Net ?
by trestrab＠GVSU.EDU 17 Dec '03

17 Dec '03

Are any of Chaum's papers on untraceable mail and digital cash available on the Net? Advise and thanks. Jeff

2 1

reading mail
by lowton＠typhon.dra.hmg.gb 17 Dec '03

17 Dec '03

> My question is this: how does he know that the mail is encrypted if he's > not examining the mail that passes through his system? If he *is* > examining the mail that passes through his system, it seems likely that he > is violating the Electronic Communications Privacy Act. > > > --Mike He could be using an automatic search for the string at the beginning of pgp encrypted messages. Maybe someone on his system could check this out by removing the strings and seeing if he notices it then. Not that I'm encouraging anyone to break the rules of the system you understand :) mr lotion

1 0

Re: FIDOnet encryption (or lack thereof)
by doug＠netcom.com 17 Dec '03

17 Dec '03

J. Michael Diehl <mdiehl(a)triton.unm.edu> said: According to Mike Godwin: >> examining the mail that passes through his system, it seems likely that he >> is violating the Electronic Communications Privacy Act. > >That was my first question. Then it occured to me that I have seen bbs's which >have disclaimers wrt email privacy. That is the loophole he is exploiting. I haven't kept up on this, so correct me if I'm wrong, but I thought that BBS's had a choice as to whether to operate as Common Carriers or not, as long as they were strictly consistent. If they want to be categorized as Common Carriers then they have to have strict policies of hands-off privacy, are not liable for the content of messages on their board, and the ECPA applies. But if they do not guarantee privacy, do not perform any kind of censorship or other control of message contents, then they are not Common Carriers and the ECPA does not apply. Prodigy would be an example of the former, Internet email & news would be an example of the latter. Yes? No? Is this stale, ancient, and incorrect info? Or if the concept is correct, is the problem that they are merely forwarding email from systems that *are* CC's, and so the ECPA applies to that particular service, whether or not it applies to the rest of what they do? Doug

3 2

Communications Week Article
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

In the Sept 28 issue of Communication Week, Pg 35-36. _Who will hold the Clipper Keys?_ *Last Paragraph* The administration will choose the escrow agents based on experience in handling sensitive information, according to the EFF report. It will avoid choosing low enforcement agencies to avoid conflicts of interest and it will not choose private companies because of concerns about the companies' longevity, the report said. Well hmm... what about the longevity of governmental agencies, or even the government itself?

1 0