December 2003 - cypherpunks-legacy

unsubscribe
by katz＠spectrum.cs.bucknell.edu 17 Dec '03

17 Dec '03

unsubscribe me please

1 0

PFF's Jeff Eisenach: "Time to Walk the Walk on Telecom Policy"
by Declan McCullagh 17 Dec '03

17 Dec '03

--------- July 2,1997 Time to Walk the Walk on Telecom Policy by Jeffrey A. Eisenach The Progress & Freedom Foundation Thanks to Ira Magaziner -- of all people -- the Clinton Administration has finally learned to talk the free market talk that brings joy to denizens of the Internet. Now, as always with this Administration, the question is whether it will also walk the walk. Magaziner deserves real credit for crafting the Administration's new "Framework for Global Electronic Commerce." In language that could have come from the Cato Institute (or my own Progress & Freedom Foundation), it credits the amazing growth of the Internet to the relative absence of intrusive government regulation. And it concludes that the Internet should remain "a market-driven arena, not one that operates as a regulated industry." The paper -- and the process that created it -- has already had a salutary impact on Administration policy. The White House has now backed away from its previous support of the Communications Decency Act in favor of "industry self-regulation, adoption of competing rating systems and development of easy-to-use technical solutions." And last month, Treasury Undersecretary Larry Summers, reportedly at Magaziner's urging, had very positive things to say about the "no new taxes on the Internet" legislation sponsored by Congressman Chris Cox and Senator Ron Wyden. The Administration's conversion to a free market view of the Internet is, however, far from complete -- even rhetorically. Most importantly, the Framework's treatment of telecommunications regulation amounts to an endorsement of the Federal Communications current policies -- policies that are, if anything, more regulatory than before passage of the supposedly deregulatory Telecommunications Act of 1996. Following the path laid out by Vice President Gore and outgoing FCC Chairman Reed Hundt, the Framework ignores the fact that technological innovation is rapidly ending the "natural monopoly" characteristics of the market for local telephone (and Internet) access. What government should be doing in this context is allowing marketplace incentives to work, thereby encouraging new technologies and new competitors to turn the potential for local access competition into a reality. What it is doing, under the FCC and with the apparent blessing of the Framework, is continuing a price regulatory regime that destroys marketplace incentives for the development of new technologies and competitors. The Framework, which begins by stating that "government attempts to regulate are likely to be outmoded by the time they are finally enacted," ends up endorsing the idea of "implementing, by an independent regulator, pro-competitive and flexible regulation that keeps pace with technological development." Nice fantasy -- but in contrast to the reality of the FCC's implementation of the Telecommunications Act, it comes off as nothing but a bad joke. Telecommunications is not the only problem area with respect to policy. Most notable among the others: Encryption, where the Administration stubbornly adheres to its unworkable, privacy-invading notion of "key escrow" for encryption software -- i.e., giving the police the key to your house in advance in case they decide later they want to conduct a search. Still, problems aside, what we have from the Clinton Administration is a real and laudable move -- partly rhetorical and partly real -- in the direction of less regulation of the Internet. For the most part, the Administration is now talking the deregulatory talk. Will it also walk the walk? Here are three giant steps that would go along way to proving the Administration means what it says. First, will the Administration appoint a new FCC (there are four vacancies, including the chairmanship) that understands the idea of dynamic competition to erode natural monopolies? The FCC's current "managed competition" approach is inconsistent with the broader principles of the Framework and hugely destructive to the innovation and entrepreneurship the paper emphasizes so strongly. A new Commission would no doubt want to re-think the Commission's recent rulings with respect to Interconnection and Universal Service, both of which represent massively regulatory approaches to problems the free market can largely solve. Secondly, will it specifically endorse the Cox-Wyden legislation prohibiting discriminatory taxation of the Internet? Saying nice things about the bill is one thing; endorsing it and working for passage is something else. Third, will the Administration support the new legislative agenda being developed and soon to be introduced by Senator Conrad Burns and Congressman Billy Tauzin (chairs of the Senate and House telecommunications subcommittees)? Among other things, this legislation is expected to declare "enhanced services" (including broadband Internet access services) an essentially regulation-free zone -- exactly the sort of thing the Framework says the Administration should support. Free marketers want to believe the Administration has seen the light on regulating the Internet. Our message now is simple: Take three giant steps -- and throw away on the key on key escrow -- and show us you really mean it. ###

7 11

Magic Money and Remailers
by remailer＠merde.dis.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: >Subject: Simplified Digital Postage--Proposal >... A more sophisticated system based on true digital cash, perhaps >based on Magic Money," is more desirable, but almost anything is better >than the current system. (Well, not _anything_.) >I propose remailers immediately adopt some form of digital >money/postage, even if current instantiations are not fully debugged >or optimized. "Magic Money" may be ready for such a trial use. Magic Money will have to be modified for that use. As it works now, clients A and B are using a common server S's coins. Client A wants to pay client B some money. Client A sends client B the coins. Client B sends the coins along with new, blinded but unsigned coins, to server S. Server S checks the old coins, signs the new ones, and sends them back to client B. This leaves two options: A) The remailer is the server. In this case, you don't need Magic Money, just a straightforward blind signature system, and I could write that if someone could describe in detail what they want it to do. The remailer operator could write it too, using PGP Tools and Magic Money source code as a basis. B) There is a third party server, and all remailers use its coins. In this case, the remailers have to mail the coins to the server and get the server to verify the coins before remailing the message. A good way to set up a time lag, but pretty complicated for an all-automatic system (the client would have to be modified, too) and lost mail from the server would wreck the system. First someone has to set up a Magic Money server, which so far nobody has. >- subtle flaws in digital money protocols (and I doubt "Magic Money" >is completely free of subtle or not-so-subtle flaws...everything needs >debugging and evolutionary learning) will not be so serious when only >"postage" is involved. As opposed to "real money" situations, where >finding a way to break or spoof the protocol could result in large >amounts of money being lost. At least with digital postage, about the >worst that could happen is someone gets free remailing--the current >situation. Magic Money isn't too bad in security. It uses Chaum online cash: a random number x, MD5(x) put in a properly padded signature packet and blindsigned by the server, and different e/d pairs for different denominations. Messages to the server are encrypted with the server's PGP key, and the server's replies are encrypted with the client's PGP key (provided in the original message) and signed with the server's key. >How ready is Magic Money for a test-bed use like this? Right now it's designed to allow people to pass coins between each other, but the code could be hacked to accept coins automatically. I have mixed emotions about pay-per access (to remailers or anything else) but I am interested enough in seeing digital cash experimentation to write the code now and worry about the ideology later. >- and of course, a charge of, say, $2.00 in real money (send in $20, >get bact 10 remailer "stamps" of some form, suitably anonymized >through a blinding procedure a la Chaum) would mean that posting to 20 >newsgroups would be a nontrivial expense for a would-be flooder. Everyone would use the free remailers rather than pay $2. Both Chaum and RSA would jump on you if real money was involved. What about just having a finite number of stamps going around, to prevent mailbombing? Here's an anonymity-breaking attack I've been worrying about: In an untraceable digicash system, deposits cannot be matched to withdrawals, so the bank cannot find out where a customer spends money. However, the bank in collaboration with a payer can determine who deposits a particular coin. Suppose you are providing a non-approved service or product, using remailers and digital cash to protect your identity. Someone wants to trace you. All they have to do is set up a sting: buy your service with coins which are recorded, and get the bank to identify who cashes in those coins. To prevent this, the bank cannot know who deposits particular coins. The bank cannot know who any of its accountholders are. Being an accountless system, Magic Money can be operated through a remailer. But Magic Money is an online system. Offline systems depend on the bank knowing who the customers are, and being able to punish them for double spending. How could an offline system be made immune to this attack? I don't know about remailers, but I wish someone would set up a Magic Money server. I haven't heard much about Magic Money on the list lately. That could be good (the code works) or bad (nobody cares). Which is it? BTW the latest versions are PGPTL10C and MGMNY10E. Pr0duct Cypher -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLWGqBMGoFIWXVYodAQEFjAP/SvhcAGk4ZGuvDaFN9oNiTtZi0Yhf1Q63 ARqSJgHGtrwsMxoxKnT5cuErjoV3+ba0b7Id49apq6zdS6W7UVo6Gpm5WIxfIOui V6VeFlYE5Wry4YKrMahjYCd4th80hWLWpgcGcjCw0WqmESfR0i8jLVpiKzwB0cKO VldNKHU4/GY= =7EVp -----END PGP SIGNATURE-----

2 1

Re: Clipper and Traffic Analysis
by smb＠research.att.com 17 Dec '03

17 Dec '03

> Also, it probably goes via a different physical path. And at least some > SS7 trunks are encrypted with DES. Care to say anything about which ones are encrypted and why? Or to ask it another way, who decides? I phrased it that way because I'm not certain of the extent, and I'm not certain how much of what I know is AT&T-proprietary. But the obvious risks that encryption avoids are traffic analysis by enemies (pick your own definition of enemy), information on what channels to wiretap (remember the furor a few years ago about the location of the then-Soviet embassy on a hilltop in Washington, D.C.?), and the threat of phone-phreaking by introducing bogus call setup messages. On the latter point, recall that out-of-band signaling was introduced in part in response to ``blue boxes'' and other device that exploited in-band signaling technologies.

1 0

AT&T stopped talking to me
by rcain＠netcom.com 17 Dec '03

17 Dec '03

Cryptophiles, I don't know if there is any signifigance to this or it is incompetence. I was in discussion with a rep for AT&T about their VSELP part and getting the firmware development software to add crypto to the part. (Don't even need hardware, the simulator is supposed to be so good.) This rep had put me in touch with the local AT&T marketing person for the part in order to handle some questions he couldn't. Things were going along pretty well until the AT&T fellow asked me what my application was. I was queasy about answering that question and rightfully so. I felt a sudden change of attitude from the guy when I told him it was to implement my voice crypto and I have gotten nowhere with them since. I asked for the complete datasheet for the part and received instead the same two page summary I already had. There is no way one could design in this part with the info in that marketing blurb so something else *must* exist. I cannot get them to even return a call any more. I left a message on the men's phone mail detailing that I was ready to purchase the development software and wanted to meet briefly to discuss that and explain the real design information I need for the part. I have been unable to get either to return my calls. In my last conversation with the AT&T guy he was trying to discourage me, telling me that to get any support for this firmware development required some kind of market study showing that the application would result in the sale of 100,000+ of the devices. I told him that I saw little problem with that number and anticipated potentially ten times that quantity or more over the life of the product. :-) I dunno, maybe it is coincidence but it sure seems to me that AT&T's willingness to sell to me and help support a product development vanished at the point when I mentioned crypto. Steve B., since you are with AT&T is there any policy that you know about regarding sales of devices for use in crypto? Peace, Bob -- Bob Cain rcain(a)netcom.com 408-354-8021 H 415-966-9549 W (10 am to 7 pm) "I used to be different. But now I'm the same." --------------PGP 1.0 or 2.0 public key available on request.------------------

4 3

Barlow article on Clipper
by Mike Godwin 17 Dec '03

17 Dec '03

Forwarded message:

1 0

The L. D. persona...
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

The other day, I noticed that MacPGP seemed to give credit to a person with the initials L. D. He certainly seems unpopular...was he at one time a more positive force? Or is this a dumb question on my part? Regards, Dave

2 1

Re: AT&T stopped talking to me
by smb＠research.att.com 17 Dec '03

17 Dec '03

Steve B., since you are with AT&T is there any policy that you know about regarding sales of devices for use in crypto? I know of no such policy. To be sure, I wouldn't necessarily know of it if it existed, being enmeshed in the wilds of Research -- but I know of none.

1 0

EFF WANTS YOU TO CALL FOR SENATE HEARINGS ON CLIPPER
by Mike Godwin 17 Dec '03

17 Dec '03

EFF WANTS YOU TO CALL FOR SENATE HEARINGS ON CLIPPER *** Distribute Widely *** Feb. 15, 1994 Dear Friends on the Electronic Frontier, Thank you for your efforts in fighting the government's ill-considered Clipper proposal. We have already delivered over 2250 messages supporting H.R. 3627 to Rep. Cantwell, and your messages have continued to flood in. We'd now like to ask you to help us call for Congressional hearings on Clipper by writing to Senator Patrick Leahy c/o leahy(a)eff.org. As we have previously reported, the Clinton Administration has announced that it plans to proceed on every front to make the Clipper Chip encryption scheme a national standard and to discourage the development and sale of alternative powerful encryption technologies. If the government succeeds in this effort, the resulting blow to individual freedom and privacy could be immeasurable. So far, the government has resisted requests that it explain its policy. When the Presidential Decision Directive calling for Clipper deployment first appeared last spring, the Administration promised a report that re-evaluated cryptography and privacy policy in light of technological changes, the coming of the National Information Infrastructure, and the end of the Cold War. The Administration also made a commitment to meaningful public dialog before taking any major action on escrow deployment or new legislation. Yet in spite of the efforts of EFF, CPSR, ACLU, and other groups to provide extensive input to the Administration, the promised policy report never arrived, and the Administration has now said there will be no report after all. This failure of public accountability makes Congressional hearings an absolute necessity. There are individuals in Congress willing to look into the Clipper proposal and related policies--if they hear from you. Senator Patrick Leahy (D-Vermont), who chairs one of the key committees responsible for these issues, has asked for comments and concerns about the viability of the Clipper initiative. Here's where we need your help. *Please write Senator Leahy at leahy(a)eff.org and ask that the Senate hold hearings about Clipper.* Senate hearings may be the only means of ensuring public feedback about Clipper, and, just as important, they may be the only means of forcing the Administration to explain its Clipper policy. Please express your concerns about the United States' Clipper policy and cryptographic policy in general. Your letters in support of hearings will be printed out and delivered to the senator. And if you haven't written Rep. Maria Cantwell to show your support for H.R. 3627, her bill to relax export restrictions on encryption technology, now's the time to do so. Just send e-mail to cantwell(a)eff.org and put "I support H.R. 3627" in your Subject header. Letters in support of the bill will be printed out and delivered to Rep. Cantwell. Our fight to keep national encryption policy out in the open--and to continue allowing individuals to use encryption to ensure their own privacy--has only just begun. In the coming weeks and months, we will be working to give you more ways to make your voice heard on these vital public issues. Sincerely, Jerry Berman Executive Director Electronic Frontier Foundation

1 0

Re: AT&T stopped talking to me
by a2＠ah.com 17 Dec '03

17 Dec '03

I've had extensive experience with hardware vendors, and the behavior you describe is extreremely anomalous. It is just barely possible that your rep has quit, and his replacement hasn't picked up the slack yet. On just the basic problem of getting the data sheets, you might have better luck calling AT&T's literature department directly. This works very well if you have the part number of the data sheet, but just the part's id should get you the info. If the part is more than a few months past announcement, it's data sheet has probably been bound up with a whole lot of other data sheets and printed in some family book, which might be easier to ask for, and give you some alternates to consider. Or, you could ask some smiley friend ;+> to try to get the information for you. Buying the part shouldn't be as hard, they are required to sell to you. However, if you are experiencing politics, beware of such things as deliverly delays and a high percentage of bad parts in your shipment. Going through a distributor is probably enough to avoid most of these problems. So, when can I buy your gadget? -a2

1 0