December 2003 - cypherpunks-legacy

help/subscribe
by Dark 17 Dec '03

17 Dec '03

HELP SUBSCRIBE In the event there is a human on that end, I was a cypherpunk recipiant before I went home (Europe) for the summer. Please sign me back up! -uni- (Dark)

1 0

FOIA lawsuit re Clipper
by Lee Tien 17 Dec '03

17 Dec '03

John Gilmore wanted me to let the list know that there will be a hearing this Friday, Oct. 29, at the Federal Courthouse at 450 Golden Gate in SF, around 9:30 am (time is always unclear), in his FOIA suit against the FBI/DOJ re release of documents in the Clipper Chip matter. Very briefly, we have received some mostly uninteresting documents regarding Clipper so far. We moved for an index of the withheld documents and for expedited processing. The gov't response was to move for a stay of proceedings until early 1997. That's not a typo-- almost 4 years! We sent them some discovery as to their FOIA processing, and they then moved for a protective order barring discovery. So basically, what we're going to be arguing about on Friday is whether the case moves forward, or gets put on hold until the FBI gets around to processing John's request. John encourages interested cypherpunks to attend. He will not be there himself. Feel free to e-mail me, Lee Tien, for details. I prefer to be reached at tien(a)well.sf.ca.us. Lee Tien

1 0

signed mail + steganography = ?
by baumbach＠atmel.com 17 Dec '03

17 Dec '03

What if you couldn't tell when a letter was signed unless you new the public key of the person signing it? How could this be done? Encode the digital signature with steganography. Is this possible when steganography alters the very message you wish to sign? I don't know. The benefit of this is signed and unsigned messages look like each other. People can't be lazy anymore and just assume the signature is yours. Your boss isn't likely going to notice you used pgp to sign your mail. Peter Baumbach baumbach(a)atmel.com

2 1

Re: on the term `signature'
by owen＠autodesk.com 17 Dec '03

17 Dec '03

> From: rjc(a)gnu.ai.mit.edu (Ray) > L. Detweiler () writes: > > Consider the term `signature' in the conventional connotation of a > > handwritten scrawl. What are the *critical* properties of a handwritten > > signature of a person [x]? > > > > 1) no person [y] can `forge' the signature of [x] > > 2) the signature of [x] is unique to [x] > Well (2) is untrue since I know people who can forge signatures with > great precision (even my own). However if they forged your name on one of your checks, you wouldn't take such a blase attitude to it would you? And in such a case you have an opprtunitty to prosecute them for their criminal act of forgery should you be able tpo prove it. Digital signature systems need to include the ability to track and succesfully prosecute criminal forgery, or digital signatures are worthless for transactiuons that require reliable accountability. IMNSHO > Since we're going for an ideal Brave New Cyberspace where forging > ids is impossible, I've got some suggestions. These should make you very > happy: > > 1) Phase out handwritten signatures in society and switch to finger prints, > retinal scan, and DNA codes. Whenever you sign anything, the store/business/ > govt office will require a blood test (for DNA), retina scan, and finger > print. With today's technologies, these can be made painless and quick. > > 2) Require everyone to have a global positioning tracker installed under the > skin so they are "accountable" at all times. This worked great in > demolition man. > > 3) Mandatory caller-id, video-id for everyone. No one should be able to > make calls without the other person knowing who you really are. Payphones > should have finger print/retinal scanners for verification. > > 4) all new computers should come equipped with finger print recognizing > keyboards. No more spoofed messages posted on people who leave their terminals > accidently logged in (in the computer lab) > > 5) get rid of cash! we can't have unaccountable transactions taking place > in the economy. Banish the free market. Nationalize all businesses under > NSA control. What makes you think that the bleak vision of the future reflected in your satire above isn't exactly what the typical power/control-freak government types want to impose? > > If a person cannot be traced based on their digital signatures, where > > is the accountability? What if a person signs a document with a > > `digital signature' and *breaks* that contract? you have no recourse > > unless the identity is ultimately identifiable and you can take `that > > body' to court. > Get a clue for god's sake. Digital signatures won't exist in a vacuum. > No one is going to accept the validity of a signature unless it is signed by > some trusted/certified authority and that authority would be liable for the > person's true name or actions. right, so where are the systems that certify trust and authenticity? and who is designing them , and what are the design criterea, and what happens if the government decides they don't want to, and..... LUX ./. owen

2 1

Re: the Joy of Pseudospoofing
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

I just joined this mailing list a couple of days ago (you may remember my clue-less subscribe request that I broadcast to the list). Anyways, I expected to lurk for a while, get a feel for the types of conversations that appear, and then occasionally post something. However, I simply must comment on "the Joy of Pseudospoofing". I'll go through it in steps. > Not a single person has said they understand what I have > been talking about in describing the evils of > pseudospoofing. > I understand what you're talking about and I'm just a newbie. I would hazard a guess that almost everybody on the list understands what you're talking about. The thing is, most people on the list probably don't find "pseudospoofing" to be an evil menace. I generally don't care who authors a message. I care about the *content* of the message. If the content of the message is interesting, I save it. It's boring, I delete it. I often don't even look at who sent it. As a member of a mailing list, I accept the fact that message headers can be forged or that people can use multiple nyms for nefarious purposes. It simply doesn't bother me. There will always be jerks. I joined this list to acquire a good understanding of cryptographic technology and how it might affect the world. The discussions of the technology will stand on their own. The ideas will either be good ideas, bogus ideas, or require further study. I don't think it is possible for people to use multiple nyms to somehow "corrupt" the discussion of the technology. However, people could use multiple nyms to bias the discussions of the social effects of widespread cryptography. So what. I have long since abandoned using majority opinion as a tool for forming my own opinions. I form new opinions based on the quality of the debates, not the quantity of posts. > .....She never posts uncharacteristically under JR, > such as talking about some other arbitrary subject she's > knowledgeable on but would be a bit surprising if JR said > anything about it. > > Okay, let's stop and take note of this. Is any `deception' > going on here? Absolutely. Should this be permitted? I agree that 'deception' is taking place. Should this be permitted? To even ask this question show that you haven't fully grasped the implications of the technology. > But the problem with all this is that in a regular social > setting, there are some very ancient, venerable, and > sophisticated rules involving propriety and courtesy > of communication that break down dangerously on any > online `forum' when a single person has multiple > pseudonyms, and these `subversive uses' are what I will > expand on. > This paragraph says it all. Many of the rules and assumptions that were developed for regular social settings (e.g. face-to-face) are not valid for the online experience. This is something you apparently need to come to terms with. > The final and most important aspect of group > communication psychology is that of *consensus* and > *peer pressure*. This can be an extraordinarily > powerful force. Many people are `lurkers' and are most > influenced by what they perceive to be other's opinion on > various subjects, or the general group feelings as > gauged through multiple postings. They are unlikely to > question what they read. > What can I say? I guess I have a higher opinion of the people lurking on this list than does L. Detweiler. To me, this is his strawman: *People are gullible and we need to protect them!* > This leads directly into the ego case. What about people > who are simply out to assuage their own ego? Suppose > Medusa wishes to do this. She could `stage' very clever > situations where jr(a)netcom.com says `I heard that > Medusa knows a lot about industrial sabotage, and am > always fascinated by her posts.' Medusa pops up a few > messages later under snake(a)netcom.com and says `Thanks > Jim, I really respect your knowledge of number theory > too, and I hope you can provide some more updates on it' and > launches into an amazingly relevant post, considering > what Jim asked about. > > So, cypherpunks, what do you think of that? This strikes > me as rather perverted. > So what's wrong with being perverted? By the way, who defines perversion these days anyways? THEM, no doubt. > Finally, let's look at how peer pressure can be > influenced by these pseudonymous postings of Medusa's. > Obviously, she has created the illusion of support or > rejection of something that is not consistent with > reality. It is a deception. People may have lowered or > raised their opinion of something merely because they > saw multiple posts criticizing the same thing, when they > all came ultimately from Medusa. > Here we go again with the "multiple posts" mechanism for forming opinions. > These fantasies would totally pollute and poison any > trust in an online community. It could be compared to > brainwashing. > Well, perhaps trust is not something that carries over easily to the online community. Ever think of that? Why do you continue to expect online social settings to exactly parallel face-to-face social settings? They are two different types of fruit. They are not directly comparable. > Note that in all these cases, if any of this was going on in > `real world meetings' it would be considered shocking > depravity. > I don't like baseball because no one ever scores a touchdown. > The very final possibility of pseudospoofing I would > like to describe , perhaps the most treacherous and evil, > is the following. Suppose Medusa not only had no ethics > and morality, but was actually Satan in disguise. > <sigh> > ``Death is the ultimate form of censorship.'' (author unknown) > > Jim Riverman > Software Engineer > jr(a)netcom.com > (415) 941-4782 [work] > Oh my god! It's really happening!!!!! <yawn> Jim Miller Software Engineer jim(a)suite.com (at work)

1 0

Re: Apple, AOCE, and key pair security
by catalyst＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - From the MacWeek article: >validity. To get your own digital signature from RSA, you take a form to >a notary public, who verifies your identity, notarizes the information >on the form, and then mails the form to RSA. The form contains your name, address, etc, and a printout of your public key. >Based on the notary >public's authority to say you are who you claim to be, you eventually >receive a disk in the mail with your personal electronic signature. _Not_. The disk contains a PEM style certificate, authenticating your public key. On your local machine, where you generated your private key, is a file (your private key) called a signer. This file is your private key + software to make it sign things, so the whole thing is a self contained application -- but it refused to function until you bind it to a certificate. >Your >electronic signature has a two-year expiration date, and includes some >verification information. Certificate, not signature, just like RSA has been trying to sell them all along. >If someone wants to make sure your signature >is valid, he or she contacts the issuing authority listed in the >certificate. Wrong again. Validation occurs locally because an entire chain of certificates is provided in the signature >There will be issuing authorities other than RSA. For >example, Apple Computer's security department plans to issue signatures >to all Apple employees with employee badges." Not signatures, certificates. All key generation takes place locally. RSA does not generate the keys. These articles are a woeful misrepresentation by over simplification. I will happily provide clarification to the authors if they call me. If anyone wants, I will demonstrate this software at the next Bay Area cypherpunks meeting. Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLMw0nSmBKTQiZpaHAQFWOwQAqnD+C7cO0XDzCrbh7hxjzTSDEhbbtxZZ B4+dXNghqSSI24c+T8FZC/gwBIhDq4Q1z0iEml2d84VcFZoHdLJL2Vi803go179E 86uwlggClAPVT+vhqE/LG7NrOC7+r8gTBk5S4gi5fX4hCkMQXdjcNOaWvgQ/slOF XbH+g4vjhF8= =Kn0e -----END PGP SIGNATURE-----

1 0

CPSR NII Paper
by Dave Banisar 17 Dec '03

17 Dec '03

CPSR NII Paper FOR IMMEDIATE RELEASE Contact: Todd Newman (CA) 415-390-1614 Eric Roberts (CA) 415-723-3642 Coralee Whitcomb (MA) 617-356-4309 Marc Rotenberg (D.C.) 202-544-9240 COMPUTER SCIENTISTS RAISE SOCIAL AND DESIGN CONCERNS ABOUT THE INFORMATION HIGHWAY Palo Alto, Calif., October 25, 1993 -- In the wake of sudden corporate mergers and rapid technological developments, Computer Professionals for Social Responsibility (CPSR) today voiced concern that the planned information superhighway will not realize its full potential. The public interest organization put forward specific guidelines for the National Information Infrastructure (NII) in a paper titled, "Serving the Community: A Public-Interest Vision of the National Information Infrastructure." Urging the Clinton Administration to move quickly to adopt these principles, CPSR President Eric Roberts said, "Although there is widespread agreement on general goals, there is no specific plan to ensure that these goals are met." "It is much easier to state a vision than to achieve it, " said Dr. Roberts, who is also Associate Chair of the Computer Science department at Stanford University. "And there are many dangers on the horizon that threaten to compromise the value of the NII as a resource for the public. "For example, if a small number of companies dominate the market, we're in danger of stifling competition and innovation on the network. If those same companies control the programming, then open and diverse speech is limited. If pricing structures do not cover universal service, the average person and the poor will be struggling to use the backroads of the information highway. If privacy isn't protected, your TV could keep more detailed records of your finances than the IRS. And, if the NII is not designed to allow everyone to communicate freely and to publish their own contributions, it could become nothing more than a medium for delivering 500-channel television, with interactivity limited to home-shopping and trying to guess the next play during sporting events." CPSR's paper expands on these dangers and makes specific policy and technical recommendations for the newly formed Information Infrastructure Task Force. The Task Force is expected to coordinate network policy for the Clinton Administration. "In its 'Agenda for Action' document, the Administration has set forth a positive vision of what the NII can be," said Dr. Roberts. "To achieve that vision, however, the government must play a major role in the design, development, and regulation of the network." CPSR recommends that the Administration adopt the following policies: o Promote widespread economic benefits by evaluating the NII's economic success using measures that reflect its impact on the society as a whole, not merely the profits of NII investors and service providers. o Evaluate the social impact of the NII by conducting periodic reviews as the NII is implemented and used to guarantee that it continues to serve the public interest. o Guarantee equitable and universal access through an appropriate mix of legislation, regulation, taxation, and direct subsidies. o Promote the development of a vital civic sector by ensuring resources, training, and support for public spaces within the NII where citizens can pursue noncommercial activities. o Promote a diverse and competitive marketplace in terms of the content carried over the NII. o Provide access to government services and information over the NII. o Encourage democratic participation by ensuring full public disclosure, and actively promoting democratic decision-making and public participation in all stages of the development process. o Actively facilitate the seamless connection of America's NII with the information infrastructures of other nations by working to resolve such issues as security, censorship, tariffs, and privacy. o Guarantee the functional integrity of the NII by establishing critical technical requirements including ease of use, widespread availability, full functionality, high reliability, adequate privacy protection, and evolutionary expansion. The recommendations follow from a yearlong review of the NII conducted by CPSR. The process included collecting more than 1,200 suggestions for NII policy from network users across the country, drafting a report, holding special chapter meetings on the NII in Berkeley, Boston, Seattle, and Washington, D.C., and having a multiple-draft review process by the membership. Final changes to the report were made at the annual meeting of CPSR, where the report was adopted unanimously by the CPSR Board of Directors. Dr. Roberts noted that he was very pleased by the level of participation in the NII report. "The computer community knows that the NII is the critical technological issue facing the United States today. Our members were extremely responsive when we asked them to participate in this project, because they understand from their own experience how much the NII has to offer." CPSR also worked closely with the Telecommunications Policy Roundtable (TPR), a coalition of more than sixty nonprofit, consumer, labor and civil rights organizations based in Washington, DC. CPSR's paper endorses the principles set forth by TPR. TPR will unveil its founding principles in a press conference, Tuesday, October 26th at 10:00 a.m. at the National Press Club in Washington, D.C. CPSR is planning a conference next April in Cambridge, Massachusetts, on the future of the NII, The Directions and Implications of Advanced Computing. The conference will investigate at a more specific level how to achieve the principles in the CPSR report. Founded in 1981, CPSR is a national, nonprofit, public interest organization of computer professionals and others concerned with the impact of computer technology on society. With offices in Palo Alto, California, and Washington D.C., and 22 chapters across the country, CPSR works to encourage public discussion of decisions involving the use of computers in systems critical to society and to challenge the assumption that technology alone can solve political and social problems. CPSR's NII paper is available electronically by sending email to listserv(a)cpsr.org. In the message write the command "GET CPSR NII_POLICY" The paper will automatically be mailed to you. You can also FTP/WAIS/Gopher cpsr.org/nii/cpsr_nii_policy.txt. For a hard copy of the paper or for more information about CPSR, call 415-322-3778 or write to cpsr(a)cpsr.org. For information about the Telecommunications Policy Roundtable, contact Jeff Chester at 202-628-2620 or cme(a)access.digex.net. - END -

1 0

Medusa's Snake Speaks
by L. Detweiler 17 Dec '03

17 Dec '03

------- Forwarded Message

1 0

A Second Snake Speaks
by L. Detweiler 17 Dec '03

17 Dec '03

------- Forwarded Message

1 0

New Crypto Tool - Beta Testers Wanted
by Mike Ingle 17 Dec '03

17 Dec '03

I've been writing a new crypto tool called Secure Drive, and I need people to help me test it. This is a program which encrypts hard drive partitions and floppy drives, at the sector level, on the fly, as you use them. To use the program, you create a small partition, usually D:, big enough to hold everything you want to keep private. Then you run the utility CRYPTDSK to encrypt the partition using a passphrase. Everything on the partition except the boot sector is encrypted, in place, at the sector level. Your C: drive is not affected. Then you load the tsr module, SECTSR, which takes only 2K of RAM. Use LOGIN to enter your passphrase, and the D: drive becomes accessible. All reads are decrypted on the fly, and all writes are encrypted on the fly. When you turn off your computer, it is automatically secure. You can decrypt your partition at any time using CRYPTDSK. You can also encrypt floppy disks using CRYPTDSK. You LOGIN /F and enter the floppy password, and the floppy becomes accessible. You can freely interchange encrypted and clear disks, as long as all of the encrypted ones use the same passphrase. The TSR senses encrypted disks and turns itself on and off automatically. If you use different passphrases for different disks, you have to run LOGIN /F again to change the passphrase in memory. Floppies can also be decrypted. CRYPTDSK will not allow you to decrypt with the wrong passphrase and scramble a disk. You can have an encrypted hard drive partition and encrypted floppies active simultaneously, using different passphrases. The program uses Colin Plumb's very fast assembly language IDEA code in CFB mode, and it uses MD5 to hash the passphrase. The disk ID and sector number are used in the IV to make each sector unique. Colin Plumb has also provided advice in writing the program. To be a beta tester, you have to: Live in the U.S., of course. Agree not to export the program out of the U.S. Please don't give out the beta version; it may be buggy. Source code will be forthcoming as soon as I'm sure there aren't any serious problems with the code. Have two partitions or be willing to repartition your hard drive. (There is supposedly a program to do this non-destructively, do you know where to get it?) Back up your hard drive. This program does sector-level I/O, and a bug or interaction could easily scramble your hard drive. Operation with DOS 6 and with two physical hard drives particularly needs testing. I have DOS 5 and one hard drive, so I'm not sure if it will work. Use this program at your own risk! Back up everything. If you want to help test the program, send me e-mail. State that you agree not to export, and tell me if you want the files in UUENCODE or PGP ascii armor (not encrypted) format. There are more detailed docs with the program. Send me all bug reports, problems, comments, suggestions, etc. --- MikeIngle(a)delphi.com

1 0