December 2003 - cypherpunks-legacy

Re: "Key Escrow" --- the very idea
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Keywords: ranting, crime in cypherspace X-Oops: let's try including the contents file this time:-) Mike_Spreitzer.PARC(a)xerox.com writes > (1) I'm not an anarchist. Does that make me out of place here? No problem, as long as you can handle surprising rhetoric on occasion :-) > I'm willing to live with some amount of government, I don't see that there's much choice, and after we get rid of the first 90% of the government I'll be happy to debate theory for the other 10% :-) > My biggest problem with Capstone is that it > changes the balance of power too much. It's more than a change - it's a declaration that the government already had the *right* to control all your communications, and is just now getting around to implementing it. But aside from the arrogance, I'll agree that it's too much power for them. By the way, you used the term "social contract" in your letter. Somehow, the government has gotten the idea that the "social contract" is between them and us, rather than between us and us. It's not, or at least none of the copies *I* signed included them... > (2) I think crimes can be committed in cyberspace. Substantially, if not > entirely, in cyberspace. Maybe not so many now. I have to agree, and I distinguish between "real crimes" vs. "laws". a) Untraceable payments for physical violent crimes (e.g. kidnap ransom) b) Better communications for conspiring to do violence (murder contracts...) c) Bank Robbery (any respectable digibank can protect itself technically, but we're already seeing Teller Machine card forging in Britain, and other banks will probably have weaknesses as we learn digibanking.) d) Forgery - digital signatures are great, if they're long enough, but protecting your keys is more critical than it used to be. e) Fraud - you'll probably have to do a better job checking reputations for a digital stockbroker living behind anonymous remailers paid with digicash than you currently do for physically traceable brokers like Ivan Boesky. f) Extortion - it's hard to break somebody's legs in cyberspace, but you can send the threat that way, and tell where to send the money; you can also threaten to publish their private key which you stole. Of course, the big "crimes" that the government usually wants to use wiretapping for are things like drugs and money laundering, both of which are none of their business. > I accept the terms of the 4th amendment: search and seizure allowed > when due process followed. The 4th amendment's terms aren't for you - they're for the government to obey. While I suspect the authors of the amendment assumed the government would seize criminals and search for them, they don't claim that power as their right, they only place limits on it. > "Key escrow" is an attempt to implement the cyberspatial analog of search. No, it's not. Wiretapping, electromagnetic eavesdropping, and demands for records you were already keeping are search. Ordering you not to have private conversations without recording them for the government and not to have locks without giving them the keys first are the analogs of so-called "key escrow". > to be worth it. Note that's a comparison of their money and success rate > against our privacy; no wonder they got it so wrong. Well said... > > (4) If you accept points (1) and (2) above, you're left wanting a way to > implement searches in cyberspace when due process is followed. > I hope anarchists won't be the only people opposing changing the > balance of power greatly in the government's favor As a moderate not-quite-pacifist anarchist, I still understand people's desire to protect themselves and their property, though I'm not sure that I agree that revenge after the fact has a real moral justification, but if it does, then you'd probably want to hire some police to get your stolen stuff back or avenge injuries done to you, or at least detectives to find out who injured you so you can publish bad reputations about them. The government aren't always *my* police force of choice, but I certainly have no intention of imposing my spy service on all your conversations. > (by poorly designed key escrow). What are the rest of us left to answer with? > Perhaps a much better key escrow design. "Escrow" is an arrangement between two parties to hire a trusted third party to keep something for them, typically down payments in contracts. If you want to escrow keys in conversations between the two of us, feel free. If the people who work for the government think that *they* are one of the parties to my conversations with other people, when I wasn't talking to them, they're rude and arrogant :-) If they think they *own* my conversations and can limit them, it's time to see how the Bill of Rights limitations on "takings" apply in cyberspace.... > One that integrates the search with the due process in a cryptographically > strong way; one that can't be subverted by a few people in a few organizations. > For example, who says an escrowed key must have only two parts? The Clipper chip only has one master key per chip; the fact that they store it in multiple pieces is a political charade designed to increase its chance of acceptance by focussing on the details. It certainly wouldn't have been hard to design a chip that really *did* have two separate master keys input by separate agencies. Or more. > And again, remember where we're weighing money against freedom. > It may be that we just have to spend more to stay a reasonably free society. > Also, it's worth debating just how strong the protections have to be. Money is part of the issue; the more important part is weighing restrictions on people's freedom against the benefits of order. The government has essentially announced that *they* get to do the weighing and deciding. And the technical issues are all classified, thank you :-) But you can trust the NSA; they're competent professionals. There really *are* benefits to order, and there are real crimes that may be less likely to happen if order is imposed on us. Freedom has risks. I think they're worth it. And unlike the folks who've decided they're in charge of order, I think it's wrong to make that decision for others, at the cost of their freedom, which mandatory escrow does. Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

2 1

GSM and A5
by ifarqhar＠macadam.mpce.mq.edu.au 17 Dec '03

17 Dec '03

I last week had a chat with someone at Austel, mainly to try and chase down the full protocol specifications for AMPS, GSM and pagers. During the conversation, the subject of A5 was raised. Here is a quick summary of what was said: 1. A5 and A5X are no longer the current names of the algorithms. Here are the new names: A5 is now A5/1 (purportedly "military grade" crypto) A5X is now A5/2 ("we export to anyone" crypto) A5/2 is unsupported by any existing equipment, and there is a LOT of discontent within the international Telco community from the countries who are being told they will be given A5/2. Personally, I rather sympathise with them. Note that A5/[12] is only ever used between the GSM phone and the local cell station anyway, and once it gets to the carrier's network it's in the clear anyway. This is public information. 2. The argument reported by the CPSR (and others) between the Australian (ASIO, AFP etc) who wanted A5/2 and the telcos who wanted A5/1 did not, according to the person I spoke to, bear much relation to reality. All three Telcos are using A5/1 (although Vodophone, when I rang them to ask which they were using called this information "classified". I will not comment. :) Unfortunately, everyone is keeping VERY quiet about what did happen. Time to speak to my local member of parliament, I think. 3. (HERE'S THE BIG ONE). The description of the A5 algorithm which was released to the network was a VERY early design, and I am told bears little relationship to A5/1 as implemented now in GSM. Just thought people might be interested... Ian.

1 0

No Subject
by tim werner 17 Dec '03

17 Dec '03

>From: tcmay(a)netcom.com (Timothy C. May) >Date: Sat, 23 Jul 1994 11:40:19 -0700 (PDT) >But I do like the explicit emphasis of the connection between >encyption and free speech; this is the line I use with people. To wit, >"Nobody can tell me what language I have to write or speak in." This is a neat way of expressing a good idea, but I wouldn't count on it. A language can probably be construed as something that can be understood by anyone who learns it. Even though I speak PGP, I still can't understand what you say without a key. There's probably no legal precedent for that yet, but look what they've done with the rest of the Constitution so far. Depending on technicalities to get the authoritarians to leave us alone will not work. We elect these people to serve us, but they think they are our keepers. If we actually had freedom of religion in the U.S. there would be no laws against the use of sacramental drugs, for instance. Sorry I don't have a better argument than yours for the legitimacy of government-proof encryption, but I think we need one. tw

1 0

Pantent archive?
by solman＠MIT.EDU 17 Dec '03

17 Dec '03

Is there an archive of important cryptographic patents any where on the net? JWS

1 0

Re:
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 10:48 AM 7/24/94 -0400, tim werner wrote: >>From: tcmay(a)netcom.com (Timothy C. May) >>Date: Sat, 23 Jul 1994 11:40:19 -0700 (PDT) > >>But I do like the explicit emphasis of the connection between >>encyption and free speech; this is the line I use with people. To wit, >>"Nobody can tell me what language I have to write or speak in." > >This is a neat way of expressing a good idea, but I wouldn't count on it. >A language can probably be construed as something that can be understood by >anyone who learns it. Even though I speak PGP, I still can't understand >what you say without a key. SophistMode(on) Hate to pick nits here, but isn't the acquisition and use of a public key "teaching" your machine to read Tim's "language"? Holmes and Blackstone are probably spinning in their graves (in counterrotation, to boot). Bob ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

3 3

Re: Voice/Fax Checks
by Hal 17 Dec '03

17 Dec '03

2 1

Raytheon as Big Brother, Inc.
by Adam Shostack 17 Dec '03

17 Dec '03

(Excerpted & paraphrased from todays (22 July 1994) Boston Globe:) Raytheon won an 800 billion dollar, six year contract with the government of Brazil to provide monitoring of the Amazon vs. drug & mineral smugglers. System will employ telecomm, satelite imagery, ground & air based monitoring to monitor an area more than 1/2 the size of the US. System will use unspecified defense converted technologies. System will reduce deforestation & wildlife destruction, combat illegal mining & drug trafficing, protect indigenous tribes, *monitor traffic*, stengthen border controls. Team members include IBM/Brasil, INFRANAV, a Brasilian militray contracter, MacDonald Dettwiler (hmmm) of canada, and others. The article fawns about how nice it will be for Raytheon not to go out of buisness. Raytheon has been having difficulty recently, since the Army decided to go with a longer range anti-missile system, bypassing future Patriot missile purchases. "If Brazil wins the world Cup, the government will be able to pass the most repressive legislation ever, and no one will care." -- Pele -- Adam Shostack adam(a)bwh.harvard.edu Politics. From the greek "poly," meaning many, and ticks, a small, annoying bloodsucker.

1 0

Raytheon got a great deal
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

Wow, an 800 billion dollar contract! Someone put me in contact with the government of Brazil! ;-)

1 0

Re: Voice/Fax Checks
by Hal 17 Dec '03

17 Dec '03

1 0

LITTLE BROTHER INSIDE
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, I was just thinking about computer seizures and thefts. I think I've come up with a couple of interesting solutions. REMOTE CONTROL--In addition to denying access to your files by encrypting, you might want to *change* them in some way *after* your computer has been seized/stolen. Pagers are cheap. They can be pinged no matter where they are located in their service area. They can be accessed from any phone (even a jailhouse payphone). And they are small enough to be wired into your computer. It souldn't be too difficult to fix it so your computer can read transmitted numbers from the pager's memory. Code numbers could be used to tell your computer to take various actions. Depending upon your circumstances, you could tell your computer to decrypt this or that set of files, to reformat the hard drive, to fry the CPU, etc. LITTLE BROTHER INSIDE--Even better than a pager, would be a cell phone. It would be more expensive, but also more versatile. In addition to giving instructions to your computer, a cell phone could be used to *eavesdrop* on the location where your computer is being held. By disabling the ringer and remounting the mouthpiece, you could surreptitiously call your computer, any time, from any phone and monitor conversations in the area. (To paraphrase an old military curse, "bug the bugging buggers.") As long as the computer is plugged in, the cell phones batteries will continue to be topped off. (For the truly thorough privacy advocate, a GPS unit could be hooked into the cell phone to give you its location.) S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 3