December 2003 - cypherpunks-legacy

Re: ironic
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

For that matter, it's ironic, though not at all surprising, that they're crying foul so loudly that this KGB mole in the CIA is giving away the identities of CIA moles in the KGB. Fair 's fair, after all.... Though that doesn't mean he has any room to complain if he gets treated teh way the Russians treated the CIA spies in their midst. On the other hand, the papers did make a big deal about how they used wiretaps to help catch the guy, and that they've known about him for a while; is this all timed to support the "voluntary" Clipper and the mandatory Digital Telephony wiretap projects? # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

3 2

story on digital telephony from today's Washington Post (fwd)
by Mike Godwin 17 Dec '03

17 Dec '03

The Washington Post February 24, 1994 Business Section, first page FBI, Justice Seek High-Tech Surveillance Guarantees by John Mintz and John Schwartz Washington Post Staff Writers The FBI and the Justice Department are fearful that increasing sophistication in communications technology will keep investigators from tapping phones and computers and are seeking legislative guarantees that wiretaps will continue to be technically possible. The Bush administration proposed a similar bill in 1992, but withdrew it after industry officials and civil libertarians bitterly denounced it. Although the Clinton administration's new version differs in some ways from the old one, opponents said it too is flawed. Administration officials will outline their proposal today at the White House for communications executives. "We see this bill as a potential blueprint for an electronic surveillance society," said Jerry Berman, executive director of the Electronic Frontier Foundation and spokesman for a coalition of civil-liberties groups and high-technology firms. FBI Director Louis J. Freeh said in a speech last week that the new technologies and a "lack of support" by some communications executives mean "the country will be unable to protect itself against terrorism, violent crime, foreign threats, drug trafficking, espionage" and other crimes. Berman said that designing peepholes into the nation's rapidly expanding information infrastructure will do far more than guarantee law enforcement agencies the ability to tap phones. As more and more activities of everyday life go "on-line" -- from home banking to video-on-demand selections -- the initiative would provide snoopers with a profile of how citizens live, work and play, he said. The new bill would give the attorney general broad power to demand that communications gear be designed to guarantee that investigators would have access to it, and sets stiff penalties for firms that don't comply. The bill would allow the attorney general to seek fines of $10,000 a day for firms that don't provide access or, in some cases, to shut them down. A copy of the bill and the administration's analysis have been obtained by The Washington Post. Industry executives voiced concern that redesigning U.S. communications networks to accommodate the proposed legislation would cost more than the FBI's $300 million estimate. Under the FBI plan, taxpayers, not telephone ratepayers, would foot the bill. The FBI and the Justice Department say the initiative would not expand their power, but would ensure access to the type of communications they have been entitled to tap for years. Administration officials say such authority was granted in 1970 amendments to the Omnibus Crime Control and Safe Streets Act of 1968. But the communications industry at that time consisted mostly of AT&T. Not only has technology become more complex, but a host of new players have entered the field, including the "Baby Bell" regional phone companies, cable firms, computer companies and more. The FBI is concerned about a host of new phone services, including "call forwarding," under which calls are bounced from phone to phone and, in turn, defeat investigators searching for a call's final destination. Moreover, the FBI says many cellular phone systems provide only limited "ports," or entryways, for tapping. In the mid-1980s, New York City's cellular system provided only five "ports" for tapping, meaning investigators often waited in line. The new bill dropped a requirement in the 1992 proposal that would have insisted that corporate switchboards accommodate wiretaps. The new bill applies mainly to "common carriers." That term usually refers to phone firms or transportation companies, but in this bill could be interpreted to include cable firms and others. Computer and telecommunications equipment firms also would be required to provide access for investigators. The bill would require phone firms, on law enforcement's request, to provide up-to-the-second records on every call to and from any phone. The new bill would allow investigators to gather the information more quickly than ever before, and from their offices. Under current law and under the new bill, investigators can obtain such data relatively easily -- by persuading a judge that it's "relevant" to an ongoing criminal probe. Philip Servidea, government affairs director for AT&T, said the company has long believed a new law is unnecessary. "The legislation will have to have come a long sight from the last version to be acceptable," he said. "This makes the development of the communications industry a law enforcement matter," said Janlori Goldman, a privacy expert at the American Civil Liberties Union. "We're very concerned." Sen. Patrick J. Leahy (D-Vt.) said that while he looks forward to working with Freeh to update wiretap laws, giving the government "final say in how far and how fast technology advances" could "jeopardize the legitimate concerns of business."

1 0

Re: Stealth PGP and Stegonagraphy (Summary)
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Hiding the file in deleted sectors on the disk has a number of problems. 1) It's highly non-portable. 2) If the Bad Guys are looking for contraband files, either they're competent or they're not. If they're competent, they'll certainly notice your weird drivers and TSRs holding the disk stuff around. Your virus-checking software may notice it also :-) 3) If the Bad Guys aren't competent enough, you can get by either hiding the file under an innocuous name (e.g. boring.dat), or you can go a bit farther by using mimic functions or other steganographic techniques to make the file really look like something boring. 4) If the Bad Guys are competent, and they suspect you, they may try using Norton UnErase or similar ommands to recover the stuff anyway. Fractals are a good place to hide stuff, since random-looking low-order bits could come from steganography, or could just be from the fractal itself; it's really hard to tell since it's tough to regenerate unless you know the precise starting parameters and machine behavior. You could probably hide 4 bits per byte without major visibility instead of the 1 bit/byte you typically can get away with in normal gifs. More important is making sure your encryption program doesn't have incriminating stuff visible in it, such as "BEGIN PGP STUFF" character strings in the object code.... Bill

2 1

No Subject
by cort＠ecn.purdue.edu 17 Dec '03

17 Dec '03

Kinda-Fair-Secret Message Passing -OR- Self-Decrypting Messages I have an IDEA. It may have already been thought of.... Problem: - PGP is great, but like so many infant technologies, encryption programs are not quite "turnkey". - Many people do not have PGP installed. I want to send messages to some of these people. (Oh, I know, a true geek doesn't bother to communicate with PlaintextPunks!) Solution: - Securely encrypted messages with programmable "key question" and "response key" for self-decryption. Scenario: Fred wants to send a message to Ida. Fred is a cypherpunk and is quite proficient with PGP. However, Ida is not set up with PGP and does not desire to learn PK cryptography. Fred and Ida know each other (or something about each other). Fred sends a self-decrypting message to Ida in an executable file. Ida simply receives the file and executes it. (This is analogous to self-extracting zip files.) When the file is executed, it will ask Ida a question that Fred has set up (with her in mind). This question will ideally be answerable only by Ida. If Ida answers correctly, her response will form a key to decrypt the message. I have thought a bit about the implementation. It seems that it may be pretty simple to do using PGP Tools. The passphrase recognition could use a one-way function (MD5?). IDEA could be the encryption algorithm. RSA is not needed. The tricky part is providing an executable file while providing a little bit of instruction at the front of this file (to instruct the recipient to down-load and execute). Also, it seems that an assumption of recipient platform (e.g. DOS, Unix, etc.) may be necessary. Uuencoding or similar ASCII/binary conversion may be required. Comments? Would someone do this? Does it already exist? It would be a nice augmentation to the PGP package! Cort. -- cort(a)cc.purdue.edu

5 7

Re: Clipper is Voluntary? Hah!
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Of *course* it's voluntary. You don't have to use it! (Pay no attention to that Digital Telephony Bill beind the curtain!) Actually, it *is* voluntary - for the government. They don't have to use it, at least not currently, and they'll still leave themselves loopholes for use of anything they want for national security, etc. Bill

1 0

An Australian Clipper!
by Peter Murphy 17 Dec '03

17 Dec '03

Does anyone know if there is any proposals (whether tentative or as a bill) to introduce some equivalent of Clipper into Australia. I have only heard about it when my cryptology lecturer alluded to it. When I pressed him further, he said that he didn't have any hard information, but noted that the Australian government were looking at the American Clipper proposal with some interest. I find this very disquieting. Any comments or information would be appreciated. Thank you. Peter Murphy. (pkm(a)axiom.uq.oz.au)

1 0

WE WANT SELF DECRYPTING STENOGRAPHY NOW!
by Gary Jeffers 17 Dec '03

17 Dec '03

What is SELF-DECRYPTING STENOGRAPHY? Something like a self-extracting PKZIP file. Its definition would be: picture + password = plaintext. Its utility? Imagine a bunch of state agents searching your pc & they find a subdirectory of pretty pictures. The stenography has no telltale flag or tag. No embarrassing arguments with a judge about passwords or contempt or court. No hassles with customs agents. No interceptions of internet code pointing you out as a dangerous dissident or freeman. Just a bunch of pretty pictures! Admittedly, programming it could be a bitch. But then, succeeding with it would put your reputation up there with Zimmerman & the RSA discoverers. It would also give us all a wonderfully safe method of encryption. The encryption engine itself could be of our own choosing. I would recommend IDEA. Your programming job would consist of 2 problems. 1. The method of taking out your already encrypted data from a picture. 2. the bootstrapping method of having the picture with password unravel itself. One might be a little difficult but I would guess it would just be some assembler drudge work, taking a month or two if you are experienced. Two might be very tricky & you might be forced to resort to a small hidden or remembered xor type assembly program. Only the decryptor would be tricky. The encryptor would be much simpler since it would all be hidden in a pretty picture! When strong cryptography is outlawed, only outlaws with SELF-DECRYPTING STENOGRAPHY will converse with impunity. GO TEAM GO! GO TEAM GO! PUSH EM BACK! PUSH EM BACK! WWWAAAAAYYYYYY BBAACCKKK! BBBEEEAAATTTT STATE!

1 0

Clinton Uses E-Mail to Respond to Swedish Prime Minister Feb 18 (fwd)
by geoffw＠internex.net 17 Dec '03

17 Dec '03

Subject: 2532 Clinton Uses E-Mail to Respond to Swedish Prime Minister Feb 18 Clinton Uses E-Mail to Respond to Swedish Prime Minister Feb 18 SUPERHIGHWAY REPORT HPCwire ============================================================================= Washington, D.C. -- President Clinton exchanged the first-ever electronic message with another head of government on February 4. According to reports from the Associated Press, the White House said the computer messages, commonly called E-mail, started with a "Dear Bill" electronic letter from Swedish Prime Minister Carl Bildt. Clinton responded the next day with a "Dear Carl" E-Mail. In his message, AP reports, Bildt said he was testing the global Internet system. He congratulated Clinton on ending the trade embargo on Vietnam and said he will take up the issue of Americans taken prisoner or missing in action in that country when he visits Hanoi in April. "Sweden is -- as you know -- one of the leading countries in the world in the field of telecommunications, and it is only appropriate that we should be among the first to use the Internet also for political contacts and communications around the globe, Yours, Carl." Bildt concluded. Clinton's reply -- "Dear Carl: "I appreciate your support for my decision to end the trade embargo on Vietnam and thank you for all that Sweden has done on the question of the POW-MIAS. I share your enthusiasm for the potential of emerging communications technologies. This demonstration of electronic communications is an important step toward building a global information superhighway. Sincerely, Bill." ***************************************************************************** H P C W I R E S P O N S O R S Product specifications and company information in this section are available to both subscribers and non-subscribers. 901) ANS 902) IBM Corp. 904) Intel SSD 905) Maximum Strategy 906) nCUBE 907) Digital Equipment 909) Fujitsu America 912) Avalon Computer 914) Applied Parallel Res. 915) Genias Software 916) MasPar Computer 919) Transtech Parallel 921) Cray Research Inc. ***************************************************************************** Copyright 1993 HPCwire. To receive the weekly HPC Select News Bulletin at no charge, send e-mail to "trial(a)hpcwire.ans.net". ----- End Included Message -----

1 0

No Subject
by smb＠research.att.com 17 Dec '03

17 Dec '03

And there's also the question of whether or not I'm going to execute a random program that you've sent me, allegedly to do a decryption....

2 1

Infomercials, FUD... time?
by Kragen J. Sittler 17 Dec '03

17 Dec '03

Despite all our word-of-mouth and -of-net efforts, the general public knows little or nothing about the Clipper issue. Perhaps it's time to let them know what's going on... not in an article buried on the third page (?) of the New York Times, not in an article on page 30 of Time Magazine, but in some way which lets them know the real facts. I suggest that we air an infomercial, or series thereof, urging the citizens of the US to protest. Phone calls to religious groups, special-interest newsletters, and even mainstream newscasters would also be a help. Most of us cypherpunks have little income. A few, such as Winston Timothy C. May, have enough for an infomercial or two. But there is supposedly an industry coalition headed by Novell to oppose Clipper. Is there anyone here who can successfully solicit these companies for money? I don't know enough details to do this. I don't know the cost of a half-hour infomercial on a national network at 11:00 at night. But I know it can be bought. I don't know which companies are involved in the coalition. Nor do I know how committed they are. But I suspect we could raise enough money... and we do have a number of experienced public speakers and broadcasters among us. If the public knows the facts, just the known, confirmed facts, many of them will be outraged. The response that a single half-hour infomercial could produce in a nation of 260 million would make the puny tens of thousands of votes on the CPSR petition look insignificant... as indeed they are. C'mon folks... what's stopping us? Kragen

2 1