December 2003 - cypherpunks-legacy

ACM Releases Crypto Study (fwd)
by NetSurfer 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 30 Jun 1994 16:34:47 +0000 From: "US ACM, DC Office" <usacm_dc(a)acm.org> To: "usacm_dc(a)acm.org" <distribution.list(a)acm.org> Subject: ACM Releases Crypto Study Association for Computing Machinery PRESS RELEASE __________________________________________________ Thursday, June 30, 1994 Contact: Joseph DeBlasi, ACM Executive Director (212) 869-7440 Dr. Stephen Kent, Panel Chair (617) 873-3988 Dr. Susan Landau, Panel Staff (413) 545-0263 COMPUTING SOCIETY RELEASES REPORT ON ENCRYPTION POLICY "CLIPPER CHIP" CONTROVERSY EXPLORED BY EXPERT PANEL WASHINGTON, DC A panel of experts convened by the nation's foremost computing society today released a comprehensive report on U.S. cryptography policy. The report, "Codes, Keys and Conflicts: Issues in U.S Crypto Policy," is the culmination of a ten-month review conducted by the panel of representatives of the computer industry and academia, government officials, and attorneys. The 50-page document explores the complex technical and social issues underlying the current debate over the Clipper Chip and the export control of information security technology. "With the development of the information superhighway, cryptography has become a hotly debated policy issue," according to Joseph DeBlasi, Executive Director of the Association for Computing Machinery (ACM), which convened the expert panel. "The ACM believes that this report is a significant contribution to the ongoing debate on the Clipper Chip and encryption policy. It cuts through the rhetoric and lays out the facts." Dr. Stephen Kent, Chief Scientist for Security Technology with the firm of Bolt Beranek and Newman, said that he was pleased with the final report. "It provides a very balanced discussion of many of the issues that surround the debate on crypto policy, and we hope that it will serve as a foundation for further public debate on this topic." The ACM report addresses the competing interests of the various stakeholders in the encryption debate -- law enforcement agencies, the intelligence community, industry and users of communications services. It reviews the recent history of U.S. cryptography policy and identifies key questions that policymakers must resolve as they grapple with this controversial issue. The ACM cryptography panel was chaired by Dr. Stephen Kent. Dr. Susan Landau, Research Associate Professor in Computer Science at the University of Massachusetts, co-ordinated the work of the panel and did most of the writing. Other panel members were Dr. Clinton Brooks, Advisor to the Director, National Security Agency; Scott Charney, Chief of the Computer Crime Unit, Criminal Division, U.S. Department of Justice; Dr. Dorothy Denning, Computer Science Chair, Georgetown University; Dr. Whitfield Diffie, Distinguished Engineer, Sun Microsystems; Dr. Anthony Lauck, Corporate Consulting Engineer, Digital Equipment Corporation; Douglas Miller, Government Affairs Manager, Software Publishers Association; Dr. Peter Neumann, Principal Scientist, SRI International; and David Sobel, Legal Counsel, Electronic Privacy Information Center. Funding for the cryptography study was provided in part by the National Science Foundation. The ACM, founded in 1947, is a 85,000 member non-profit educational and scientific society dedicated to the development and use of information technology, and to addressing the impact of that technology on the world's major social challenges. For general information, contact ACM, 1515 Broadway, New York, NY 10036. (212) 869-7440 (tel), (212) 869-0481 (fax). Information on accessing the report electronically will be posted soon in this newsgroup.

1 0

Beware of keystroke capture tools!
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

I want to remind folks of another _practical_ security weakness in using PGP or any other crypto program: keystroke capture utilities. These are small utilities (inits in Mac terms, perhaps TSRs in DOS terms, and who knows what in Windoze terms) that record all keyboard input. Very useful for recovering from crashes and such. These started in the Unix community, where I've forgotten the name ("history"?). In the Mac community, "Last Resort" has been doing this for a couple of years, and now several other packages offer similar capabilities (QuicKeys has "GhostWriter," or somesuch). Many's the time I've forgotten I had thse things enabled, only to find in my System Folder a folder marked "Saved Work" or the like, containing files of all the histories from each rebooting. The security risks are obvious: * passphrases (and perhaps even the original key generation process, in toto) are captured over and over again. * the stored history files may be tucked away in odd places on one's disk, on various backup tapes made, and so on. (Easily recoverable with search warrants.) * anyone with access to one's machine (a snoopy coworker, an employer, a spouse, even an NSA black bag job) can insert this harmless-looking utility and then pick up the results later. There are commands to bypass such keystroke capture--specifically intended to head off these breaches--but most people will forget sometimes, and may not even know the program is installed. (And there are at least 3 of these for the Mac, so confusion is increased.) This is a well-known security concern, but I thought it important to mention. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Re: What motivates Crypto-folk?
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

sandfort(a)crl.com: > > Thanks for your thoughtful comments. However the message was > > not by me but by Sherry May <scmay(a)rschp2.anu.edu.au>. > > Sherry May, Tim's EVIL TWIN? (Or is it the other way 'round?) Sherry Mayo, not May -- <scmayo@....> ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

USACM
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

sommerfeld(a)orchard.medford.ma.us (Bill Sommerfeld): > Who is the USACM? How big is it, who can join, and who has? I thought it was pretty clear that the USACM is the US Public Policy committee of the Association for Computing Machinery. This would suggest a branch of the ACM, which as you know is rather large. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Pedophiles everywhere!!!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

"Perry E. Metzger" <perry(a)imsi.com>: > > The drumbeat against all those anonymous pedophiles continues.... > > _Wall Street Journal_, 6/30/94 > > PERSONAL TECHNOLOGY by Walter S. Mossberg > > "Keeping Your Kids Away From Creeps As They Play Online" > > They aren't the only ones talking about it. I've seen three articles > about this in the past week. Even the Clipper article in the Economist, who should know better, that appeared a few weeks ago talked about pedophiles abounding in a Clipper-less world... I think the pedophilic possibilities of the Internet capture the imaginations of the media -- their deepest desires, perhaps. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: WHAT MOTIVATES FORWARDERS?
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

perobich(a)ingr.com: > IMHO a more serious and prevalent problem is the onslaught of spam > whenever EFF, CPSR, EPIC, NSA, or EIEIO issue press releases even > tangentially related to crypto. Not only do I usually get a copy in my > main inbox (since my filter doesn't catch it because it's not via I had cribbed about this a while ago, after I received 6 copies of an EFF release. I suggested that we agree on individuals responsible to forward posts from different sources. IAC the major ones - EFF, EPIC, CPSR... seem to have cypherpunks(a)toad.com on _their_ lists, and many of us subscribe to them independently. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: What motivates crypto-folk?
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

At 1:28 PM 07/01/94 +0200, Mats Bergstrom wrote: >anarchy. And I don't think any ultra left-wingers are lurking on >cypherpunks. That epithet should be saved for people believing in Depends on what you call ultra-left. You have a very serious socialist here... I don't advertise it much becuase too many libertarian types spam me trying to tell me why I'm wrong. Maybe I am the only one that gets tired of those arguments... [tame but promising aproach to social welfare deleted] >But such a pinko-green approach to privacy does not, and should >not in my humble opinion, have to extend to public funding of >education, libraries, minorities, arts, infobahns or other soft >issues. And it gives no one a right to pry into my software >collection or drug cabinet. Well, you were doing well for a while...:) And this pinko agrees 110% with the last statement. My own personal opinion is that waiting for governments to collapse due to crypto and tech is gonna have you waiting a long, long time. I prefer doing something with the tools at hand to dreaming. And the government isn't all bad, as is; just mostly bad. Heck, let me be so optimistic as to say maybe even fixable, at least to what I want to see. >Mats Bergstrom Jamie "Is a Mayist Like a Janist?" Lawrence -- "Blah Blah Blah" ___________________________________________________________________ Jamie Lawrence <jamiel(a)sybase.com>

3 2

Illegal Acts & Crypto
by Duncan Frissell 17 Dec '03

17 Dec '03

The dumbest question of all: "But if you aren't doing anything illegal, why do you need crypto? (or have to worry about stop-and-frisk, or need legal due process protections.) Only lawbreakers have to worry if their privacy is violated." Great thought. Now tell me what will be illegal in 40 years in all the jurisdictions in which I will live. In addition, tell me what (legal) behaviors or characteristics of mine will nonetheless cause me to lose social approbation//jobs//friends//etc in all of the societies in which I will live. Statistics say I've got 40 years left. Forty years ago, smoking was a virtue and sodomy a vice. Twenty-five years ago, money laundering was as legal as church on a Sunday and every bank in America offered defacto secret bank accounts. Given the speed with which things are changing, in twenty-five more years, participating on a crypto mailing list like this could be punished by the death penalty under the Krypto Kingpins Kontrol Act of 2005. Or if things go another way, advocates of government key escrow systems could be subject to outlawry and instant public "vector control measures" if they accidentally wander onto the land of the wrong proprietary community. You never know. In the last 200 years of human history, people have been killed at one time or another in one place or another simply because they had any human characteristic you could name or indulged in any human behavior. You name the characteristic or behavior and I bet I can name the time when people somewhere were died because of it. Giving up your privacy is too great a risk. What do you gain. Besides, if we are all equal then the rulers are equal to us and we don't have to give up our autonomy to them. DCF --- WinQwk 2.0b#1165

2 1

RE: Politics and crypto
by Blanc Weber 17 Dec '03

17 Dec '03

From: Michael Wilson The political Left had the belief that while you, an individual, should have the right to do what you want with your body. . ., they wanted to control what you did with your money. . . The political Right had the belief that you should have the right to do what you want with your money . . , but not with your body. . . . .................................................. True! ....programs such as healthcare, Clipper, national ID cards, national information infrastructures, and so forth are all direct yet subtle attacks on such basic freedoms. It creates both the motive *and* mechanism for tyrrany. .................................................. Thus the Administration would undermine the motives & mechanisms for privacy. Everyone wants the advantages for themselves and not for their enemies; it would be useful to be able to distinguish enemies from friends, but this is not an easy task when everyone's philosophies & politics are so mixed up & inconsistent & counterproductive. At some point, it becomes unavoidable to conclude that in reality, it's "every man for himself"; i.e. - anything which helps individual, independent competence is a valuable & valid pursuit. Blanc

1 0

Password Difficulties
by kentborg＠world.std.com 17 Dec '03

17 Dec '03

Hey folks, passwords are hard to choose! It boils down to this: I can't remember as many bits as the TLAs can crack by brute force. Starting with a bunch of coin tosses I tried ways of coding them: hex, ASCII, and words off word lists. Horrors! The hex is too long, the ASCII is too long and too obscure, words words chosen by those bits too many and too obscure. Sorry, there is no way regular people are going to remember pass words or phrases with more than about 50-bits worth of information in them--and even doing that well is going to be rare. We need to slowdown password testing? Obvious things come to mind. 1) Try to pair up short passwords with slow hardware, like a smartcard that can only consider a few passwords a second. 2) Try to hide behind an expensive operation. (Does encrypting my private key 1,000,000-times equal encrypting it once with a key 20-bits longer?) What do we do? (What are you folks doing right now?) -kb, the Kent who occasionally considers practicalities -- Kent Borg +1 (617) 776-6899 kentborg(a)world.std.com kentborg(a)aol.com Proud to claim 31:15 hours of TV viewing so far in 1994!

5 4