December 2003 - cypherpunks-legacy

Re: DOJ procedures relating to Clipper Chips and key escrow
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Mike Godwin writes: > One of the interesting passages comes at the end of the DOJ memo > about obtaining Clipper keys pursuant to an interception: > > "These procedures do not create, and are not intended to create, > any substantive rights for individuals intercepted through > electronic surveillance, and noncompliance with these procedures > shall not provide the basis for any motion to suppress or other > objection to the introduction of electronic surveillance evidence > lawfully acquired." > > What this means, apparently, is that keys or communications obtained > through noncompliance with these procedures are nevertheless considered > to be "lawfully acquired." No suppression of evidence. No civil suit. > > In other words, "if we break our rules, tough." I thought that was particularly amusing as well. On the other hand, the mere fact that it says it doesn't mean it invalidates any other privacy laws or rules about illegal surveillance or exclusion of evidence, though it does mean you need to argue a lot harder to get a judge to agree. # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Bogus paper on TEMPEST floating around
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

This bogus paper with lots of misinformation about TEMPEST is still around, though I'm surprised to see it on a NIST machine. (FTP didn't want to connect this morning, so I can't be sure it's still there.) Papers by the fictitious Hagbard Celine can't always be trusted, though they make good rolling papers if you print them out :-) But it's clearly a bunch of Discordian Disinformation. Yes, some of the TEMPEST specs are classified, it's perfectly legal to disseminate the publicly available information and technology, apply it, and use it, and do anything you want to make your equipment quiet. Even the expansion of the acronym given in the paper was bogus, and it went downhill from there. # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Re: reno_key_escrow.statement (fwd)
by Mike Godwin 17 Dec '03

17 Dec '03

Trotter writes: > Thanks to Mike Godwin for forwarding the announcement about the > Clipper chip stuff. I am not a Constitutional law person or > criminal preceedure person, but if I understand this proposal > correctly, it does not require a member of the judiciary to be > involved. Not at the key-escrow phase, no. But you have to have a valid search warrant or authorization order in hand before you can go to the escrow agencies and request the partial keys. Here's the relevant language: > > ATTORNEY GENERAL MAKES KEY ESCROW ENCRYPTION ANNOUNCEMENTS > > > > When an authorized government agency encounters suspected key- > > escrow encryption, a written request will have to be submitted to > > the two escrow agents. The request will, among other things, have > > to identify the responsible agency and the individuals involved; > > certify that the agency is involved in a lawfully authorized ^^^^^^^^^^^^^^^^^^^^^ > > wiretap; specify the wiretap's source of authorization and its ^^^^^^^^^^^^^^^^^^^^^^^ > > duration; and specify the serial number of the key-escrow > > encryption chip being used. In every case, an attorney involved in > > the investigation will have to provide the escrow agents assurance > > that a validly authorized wiretap is being conducted. The reason that Reno doesn't just say "a court-ordered wiretap" is that there are some emergency circumstances under which wiretap authorization can be gotten in advance of approval by a neutral magistrate. Both the Wiretap Act and the Foreign Intelligence Surveillance Act make provisions for such emergencies. Eventually, such emergency wiretaps do have to be reviewed by a magistrate, however. In the Wiretap Act, and, I believe, in FISA, the time limit is 48 hours. --Mike

2 2

PGP Tools Debugging
by remailer＠merde.dis.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >> Pr0duct Cypher > Warlord >>I've got the code written to check the whole coin, and I found another >>subtle bug caused by precision setting. Since setting precision does not >>seem to affect the speed of the decryption (I think the mpi library sets >>it internally during modexp) I'm just going to fix it at maximum >>and leave it there. Tomorrow I will strip out all of these damn things. >Yea, MPI lets the precision. This is not a bug -- the MPI library >needs to know how big the number is. (The bug is that its done in a >global variable and not as a part of the number internally, but thats >a different matter). The reason it needs to know is so that it >doesn't need to perform large operations for small numebers. For >example, there is no reason to perform a 1024-bit modexp when you are >dealing with 384-bit numbers! The bug was in my code, not in mpilib, but the need to set precision can be a real pain. I've been plagued by intermittent bugs caused by mpis not being completely cleared or fully calculated out. Since modexp does it automatically, I'm just going to set it to max. If you or someone else with both types of machines wants to fix that, feel free. I don't have the means to do so, and it's been my experience that writing code you can't test is a waste of time. >FYI: I have both big-endian and little-endian machines at my disposal. >Also, I was having problems building PGP Tools under mips-ultrix -- >you have some global variables in ptd that you expect from time.h >which don't exist. In particular, timezone and daylight. PTD is a kludge. There are no similar dependencies in the library itself. PTD was just written as needed to test the rest of the library, and was not intended to be a usable application. You can either put in #ifdefs for your machine, or set up another module with the needed globals. I just wanted to code around the need for timezone stuff and get the test code working. I've got another version of PGP Tools ready which removes most of the set_precision stuff, and a version of Magic Money which checks the whole coin when it receives it. There are a few more changes for Magic Money, but I should be mailing out soon. Someone wrote that they had success with a big-endian machine - whew! and thanks for testing it. Pr0duct Cypher -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLVcQUsGoFIWXVYodAQEiQQP/Tsm/AIi+zNJ5YIzPfaEjzeSyyi4pwLTp ZYzo88FyBBrayFpt+CkSdlatnOVu7EwyHcNBgh8Z3LJeffOcI8Wiw9WPO9v0vqHj yE35Yq9rFfBnTjQuZ3uNnb03l1G0XfyG2AyuYer3Y4shEKwO/6DgYr4b5K9Y2Wqc p8qpWGwUC6I= =itBc -----END PGP SIGNATURE-----

1 0

Re: A Nice Summary of Motives for Clipper
by freeman＠MasPar.COM 17 Dec '03

17 Dec '03

Patrick May says: > the [Clipper] algorithm will not be a secret forever ... A fascinating point! Perhaps Clipper's accomplishment will ultimately be positive, serving to inculcate upon us all the habit and administrative forms of routine use of cryptography, albeit in flawed implementation. Thus when the algorithm is unraveled, the transition to widespread use of a more nearly adequate cryptographic standard may well be very rapid indeed. -- Jay Freeman

1 0

Re: Atlantis Project/Oceania
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > The Atlantis Project is a group in Las Vegas which is trying to build a > > floating city in the Caribbean sea. Their new city would be an > .... > Of course, the U.S. will immediately declare they a national threat and > bomb them back to the stone age. :-) Which is kind of a problem for a floating city, since stones don't float very well, concrete canoes excepted :-) I'm not sure their economics can float that well either - if it costs $500M to build, and holds 1000 people, that means $500K/person.... Maybe they're looking at more people or less money. Nice T-Shirts and promo material, though.

7 6

Re: Nate's Remailer Shutdown.
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

The reasons the Post Office gets more slack are that 1) They're the government, or at least used to be 2) They can randomly open mail when they feel like it, see 1)

1 0

Re: Atlantis Project/Oceania
by Blanc Weber 17 Dec '03

17 Dec '03

"I'm not sure their economics can float that well either - if it costs $500M to build, and holds 1000 people, that means $500K/person.... Maybe they're looking at more people or less money. Nice T-Shirts and promo material, though." ...................... Does it not seem that they are putting more effort into the publicity, marketing, & attraction of money for support of this virtual country, than into the establishment of other fundamentals? Like: setting up an alternative currency & banking system, the manner of conducting business with the rest of the conventional world, and resolving the many little problems that would be of concern when living under such conditions? Blanc

3 2

Clipper Qs
by Colin Orion Chandler 17 Dec '03

17 Dec '03

Hurm...I have had a couple of thoughts, no dowbt simple ones, but maybe you can help: If I bought a a ClipperFone and switched chips with my neighbors chips (Clipper Chip, that is), could the .gov tell what was going on? Also, can these chips be re programmed? ;) I'd like a cracker... ___________________________________________________________________________ |---===================================--| /\ | | \ |_ _\ \ / | |---Colin Titus Orion Xavier Chandler----| \\ \ | | . | | > < | |---===================================--| \ \\ / \__/ _|\_|___|_/\_\ | | _____ | / \/ / / | |/\ __ \ __ "What year is it?" | / / \//\ "If it's not a | |\ \ \/\ \ _ __ /\_\ ___ ___ | \//\ / / Sun, it's not a | | \ \ \ \ \/\`'__\/\ \ / __`\ /' _ `\ | / / /\ / computer." | | \ \ \_\ \ \ \/ \ \ \/\ \L\ \/\ \/\ \ | / \\ \ .__ __ | | \ \_____\ \_\ \ \_\ \____/\ \_\ \_\ | \ \\ |_. | | |\ | -| | | \/_____/\/_/ \/_/\/___/ \/_/\/_/ | \/ __| I_| | \| __|/160| +________________________________________+_______________________________+ | Colin Chandler |"It can only be accountable to *human* error."-HAL9000| | (415) 388-8055 | orion(a)crl.com, wizard @ BayMOO (mud.crl.com 8888) | |________________________________________________________________________|

1 0

What's a "real encryptor"?
by qwerty＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I (Nik) got a letter from a mathamatician asking me to clarify what I meant by a "real encryptor". Here is the answer I gave. It is for the newbies out there, not the serious cryptographer types who know this already. Warning: one of my Xenon character's last rants will be arriving shortly. Take it with a grain of salt; it's pretty nasty, and not meant for those who already understand its message. I'm trying to drum up some public demand for a "real encryptor", for one thing. Think of it as propoganda, for it appeals to emotion not logic, and it is not very fair. Steganography involves hiding a message in a file. I can use the Mac program Stego to place say a PGP message into a Mac PICT (just a picture) file as the least significant bit of each pixel. If it is a 24 bit per pixel color picture, then you can't even see a difference. If it is 8 bit color, then you CAN. It looks like digital noise. On off, on off. No matter. The problem IS, anyone with Stego can extract the file and immediately see that it is an encrypted PGP message. When PGP encrypts a file, after compressing it, it includes in the final output all sorts of extra things like a checksum at the end, and full information given out to anyone about the name of the key that it was encrypted with. It will proudly announce, for instance, "This message can only be read by Pr0duct Cypher. You do not have the secret key required to read it." I don't know the full details. The PGP documentation mentions some of them, for the binary format PGP output files. I could send you this if you want. What I mean by a "real encryptor" is something just like PGP, but minus the convenience features that get tagged onto the PGP messages. It might be as simple as stripping them away the PGP convenience procedures. If the output was simply an encrypted message, and it seems to me PGP could do this, it should be hard to distinguish it from a random series of bits. Hopefully nearly impossible! Then you can use steganography for your messages but no one can tell if what they extracted is a message or not! The least significant bit of most messages such as sound files is noise anyway. On off, on off. They can't even tell how big it might be. That is a potential mega problem with PGP itself not being able to know how big it is though. You would have to know before hand, or make the picture or sound file BE the right size, EXACTLY. That's certainly easy for sound files! Just send voice mail! You could pad the content of the PGP message if you wanted to hide the actual size of the decrypted message. If you get voice mail from a stranger saying something vaque, you can check if it contains a PGP message encypted with your public key. If PGP outputted such a hard-to-distinguish-from-random data format, it opens up many different possibilities for sending your messages. Ideally, no one would be able to tell if it was an encrypted message except by successfully decrypting it. As it is now, such schemes have to rely on "encrypting" an already encrypted PGP message to hide the fact that it IS a PGP message! Many of us just want to be left alone and are tired of having our files tagged as BEING encrypted. Personally, I suggest using PGP as a Clipboard utility so I can cut a message out, encrypt it, paste it back in and save it as a word processor file which I then Macintosh BinHex encode as text, and e-mail off. Now I'm just sending a BinHexed word processor file, just like thousands of other Macintosh e-mailers out there every day! This isn't good enough since it is so easy reverse, by anyof them ;-), and they are still struggling with just e-mail. PGP is still a program only used by those why really need it. It may remain that way, so for those people, having a random data block output would mean they wont set off alarms and catch the attention of the government, just for sending a love letter to their mistress ;-). -Nik (-=Xenon=-) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLVb/QgSzG6zrQn1RAQHPRgQAttdvv7y01xE0+8xKOnoODYJ3Xmlw0Wrs hIlMIGglirxY8Q244EEfjA538QES19jS95+8G5q9p5eEjM6w0apkRKQbyQOxme8j tfBU+yhhtqTGPUidLdiOWNszn2DvD0hrTVFH15b3yFoB2F1mA1kkjbfmXAm1r7gS MmJaO0c6ZNE= =SIQx -----END PGP SIGNATURE----- P.S. Were PGP like many programs, able to accept modular "Plug ins" like say Adobe Photoshop, this "bare" data block output could be an add-on featue ("feature stripper?") that those who want it would use. Or at least a separate utility that would strip and restore PGP messages.

1 0