December 2003 - cypherpunks-legacy

Re: The Wisdom of Stuart A. Baker
by catalyst-remailer＠netcom.com 17 Dec '03

17 Dec '03

> Says Stewart A. Baker, Chief Counsel for the NSA, writes in Wired: But not for long... I understand he's resigned, and will be leaving NSA tomorrow (Friday, May 13th). Wonder what his next illustrious position will be... -------------------------------------------------------------------

2 1

Re: MIT TOC SEMINAR--ADI SHAMIR--MONDAY--MAY 16--4:15pm
by Peter Murphy 17 Dec '03

17 Dec '03

> Imvery curious as to how humans can directly decode encrypted > pictures. Do they stare at it for 10 minutes and go "ah, there > it is". > Paul E. Baclace > peb(a)netcom.com Well... maybe if it was one of those stereographic pictures, it would be a little bit easier. You just have to get your eyes in focus (and that's a bit hard for some people). Pling! You suddenly discover the hidden message, like "HITLER IS ALIVE AND LIVING IN ARGENTINA!" or some other related message. It's in 3-D, so the letters appear to be 5 mm tall! (Reminds me of when Jaws III was out at the cinema. :-)) Of course, you might have to print it out first. Sorry, just me being silly. ======================================================= | Peter Murphy. <pkm(a)maths.uq.oz.au>. Department of | | Mathematics - University of Queensland, Australia. | ------------------------------------------------------- | "What will you do? What will you do? When a hundred | | thousand Morriseys come rushing over the hill?" | | - Mr. Floppy. | =======================================================

1 0

More FOIA docs online at EFF
by Stanton McCandlish 17 Dec '03

17 Dec '03

A few new arrivals at ftp.eff.org that may be of immediate interest. The first is a recent bill, scheduled for markup very soon. EFF urges you to ask your Senators to co-sponsor and support this bill. Those following EFF Boardmember John Gilmore's FOIA battle with NSA, the Justice Dept. and other recalcitrant agencies will know why this is so important. For those that don't, the issue in a nutshell is that the original FOIA (Freedom of Information Act) did not adquately cover records that are not in hardcopy format, such as computer files; it granted overly-broad excuses to not release documents, and provided for few penalties for violating FOIA. As a result, secretive agencies have been breaking the law with impunity, vastly exceeding the mandated times in which the law requires them to respond to FOIA requests from citizens, and have been using technicalities, vague passages, and filmy excuses to withold important information that belongs to the American people. This new bill, supported by EFF, aims to correct these problems, and ensure that FOIA works the way it should. The other file is adequately described by it's entry from our /pub/README.changes file, excerpted below. 05/12/94 - added important recent bill supported by EFF: Electronic Freedom of Information Improvement Act (S1782), sponsored by Sens. Leahy & Brown. Please ask your Senators to co-sponsor this bill to "fix the bugs" in FOIA, and prevent agencies from illegally delaying and refusing to release information to the public, and also mandate procedures for dealing with electronic information as well as hardcopy: /pub/EFF/Issues/Activism/FOIA/ e-foia.bill - added 10/4/93 Clinton & Reno memos to heads of Depts. and agencies on FOIA (Freedom of Information Act) issues: /pub/EFF/Issues/Activism/FOIA/foia_clinton_reno_93.memos - Clinton urges agencies to keep pace with their FOIA obligations, saying "I therefore call upon all Federal departments and agencies to renew their commitment to the Freedom of Information Act, to its underlying principles of government openness, and to its sound administration." Something that also may be of interest: - added new E-Mail Policy in Federal Government: Report of the Electronic Mail Task Force Prepared for the Office of Management and Budget, Office of Information and Regulatory Affairs, Apr. 1, 1994 - /pub/EFF/Policy/Govt_online/ federal_email_policy_omb_report -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 14 1994

1 0

Re: The Wisdom of Stuart A. Baker
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

> Says Stewart A. Baker, Chief Counsel for the NSA, writes in Wired: But not for long... I understand he's resigned, and will be leaving NSA tomorrow (Friday, May 13th). Wonder what his next illustrious position will be... Well, I'd put a dollar on him taking up some civilian post where he can influence the acceptance of Clipper through industry. Managing director of an electronics firm. Or head of one of the escrow agencies perhaps. That how things work here in Britain anyway - most of our big company top management are ex spooks. Especially in the armaments and military-related side of things, like aircraft companies. In Baker's case I'd guess a telephone company. Much more likely that or something else civilian than another govt post like NIST or the FCC. G

1 0

Re: Message Havens
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hal wrote: >Karl's idea about message havens is interesting, but I don't fully >follow how it differs from the anonymous pools we discussed last year Well, the biggest (and maybe the only) difference is mail doesn't leave the haven. It's like a post office box, you have to show up to retrieve your mail. - From my experience running remailers, posts other operators send here, general observations, and various attacks we've all suffered through, it seems like most of the problems/objections we get stem from the fact that anonymous remailers (drum roll...) actually send mail! For example: * Eli just sent a message about somebody who used his remailer to mailbomb something... *this list has been victim to the rantings of various individuals anonymous and otherwise. *somebody forwarded a ClariNet post through Scott Collins' remailer thus causing him difficulty *remailers operators have to fear some fool will remail to whitehouse.gov (or the operatros have blocked that address) *the message pool Miron runs is susceptible to mail bombing I'm not saying we should junk the anonymous remailers and replace them with message havens... it's just a suggestion that may solve a few problems we are having. Until positive reputation filters show up and everybody digitally signs their posts, etc. Digital cash payments for each message stored would greatly reduce the mailbomb problem for message havens as well as anonymous remailers. Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdL1ToOA7OpLWtYzAQEoigP+PmJtyybo24swqPD5MaDRhuvwKhhMMfn7 txaTbdVM8mzoKWgKlsB2Sw89ZO2CMl7Rijv4kgmdaxTBL278p7CuescTmRnwYACr ArlH9DSDsM9eXqVq2jLd33J2PBWhBnpn5TdOOUIJZ7B7HrT0KgaIzFv7lGhsBXQy PUh87BWOhE4= =8T8B -----END PGP SIGNATURE----- -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

1 0

Re: Message Havens
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Downloading the whole message base to scan for one's messages >will place a massive load on net.resources, and probably >a prohibitive load on most people's terminals. I disagree. The only resource that will be hit is the message haven (unlike say every computer in the world that carries the certain usenet group you have chosen to use as a communications vehicle). Geez, think of like a place that offers anonymous ftp. It's resources are hit, but I don't buy the "massive load on net.resources". The only load I can envision being hit on a person's terminal is the time it would take to browse all messages. You have to read each message and have your communications software log in a file, or scrollback/record each one individually. I mean, the info is already coming to your computer, you just have to save it. Maybe the haven could offer a way to get all the days/weeks/whatever files in one big chuck; this is clearly no worse than just ftp'ing a large file. > This scheme should avoid this nescessity: This scheme is precisely what I described earlier! The two users agree on what to name/tag the file, and that's how they get messages to each other. The problem is Bob can't just retreive that one file (if he is concerned about traffic analysis), so he can get them all so a watcher learns nothing. You have suggested downloading a smaller portion of the available message base instead of the whole thing. >The gopherhole must be trusted not to divulge which posts came from >who, and it's key must not be compromized. Alice and Bob can get their messages to the haven via anonymous remailers to avoid problem #1. I didn't envision the message haven even having a key. It isn't needed if they both are encrypting with the other person's key anyway, so I'm not sure what problem #2 is. Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdL5hYOA7OpLWtYzAQHx8QQAtlVYJvSGyR0uGq8a8IodCewZNBwSVHou 7YJssBHIBp/I+V+s1fMpBkUSmG6oINu5L/VEeEQXRswHGJJ/F6jLtxkrFlY/kcff XKTqizrroVtemYQpZtjpPowT2eQsdlonewbslZc3Y+GdZfErgCzoiYW2dXIX8tnG yD2OvZKCAYs= =i3Ea -----END PGP SIGNATURE-----

1 0

Re: Message Havens
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Black Unicorn wrote: > Why can't gopherhole send a random number of messages with a user > selected cap? I'm taking it that a "gopherhole" is different than the "message haven" I described, so maybe I missed something... but if the "gopherhole" sends out random messages (and presumably the ones you are interested in) then the "gopherhole" will eventually be able to figure out what messages you are interested in. And how would it know what messages you are interested in unless you tell it... it would then need to be able to tie your psuedonym to your real mail address, which defeats the entire purpose of what I described. But then, maybe the design goal of a "gopherhole" is different and I missed it. Maybe I wasn't clear in what the "message haven" offered... I'm trying to get away from the penet style mapping tables, persistent information tying you and your pseudonym, and solve the "unsolicited anonymous mail" problem. The message haven requires no trust, no tables, no information since it just accepts message and files them, and if you retrieve all the message, the haven can't figure out which ones you are interested in! Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdMCx4OA7OpLWtYzAQFEyQQAlF5v1z6/GmU0HE56DDsC+IozQk8QKY8n kWmxC8VzyTq2Gjd1JOjq8MrlnQLok2F0wwJqP2+OVv8PY9iT3D3/tCVOwr2iHFq4 OF26mkwz5neIXyilrXmqhJfGPAhJQsjW5eB7PsoVSZtYkcxbjU83ZAkHGRJ6fEr3 j4tIJ6kvcto= =+ijo -----END PGP SIGNATURE-----

2 1

Re: *Here they come
by Peter Murphy 17 Dec '03

17 Dec '03

Like Lefty, I found the bit about "DEATH TO STATISTS" a bit hard to work out. For one thing, what do you define as "statist"? Does it include minarchists in this definition. I also thought that statism and PC were not synomynous. (Take Patrick Buchanan....) ======================================================= | Peter Murphy. <pkm(a)maths.uq.oz.au>. Department of | | Mathematics - University of Queensland, Australia. | ------------------------------------------------------- | "What will you do? What will you do? When a hundred | | thousand Morriseys come rushing over the hill?" | | - Mr. Floppy. | =======================================================

1 0

Re: Message Havens, gopherholes
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Okay, I think the discussion has forked somewhere along the way to "gopherholes" and "message havens". While I described the message havens, maybe I didn't do so clearly (after all, it's all worked out in my mind!) and I may be overlooking something a fresh perspective will see. But, the advantages of a message haven are: * it doesn't send mail, thus eliminating what are the strongest objections to anonymous mail - you can't harrass somebody * it doesn't require you to tell it what messages you want to retrieve * it doesn't keep a list of pseudonym and true identity mappings, which seems to be required for "gopherhole" operation * it doesn't even need to have a public key: you and your partner can use each other's keys, and in every response to a message, you can specify what to name the next message, and even include a brand new public key if you want, etc. * if you retreive all the messages, the haven can't figure out who you are communicating with (actually, it can't figure out who is communicating with you) Now, about gopherholes: [description of how randomization and tag changes will make it hard to associate pseudonyms and true names] > Yeah, it certainly isn't trivial to attack. However, I'd like to Unless I missed something, you have to tell the "gopherhole" what messages you want to receive. This allows the goperhole to associate your psuedonym and true identity. More comments! About message havens and gopherholes. Nice to see some crypto being discussed ;) Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLdMGfYOA7OpLWtYzAQHT2gP9GEpOePu8gUp/u4E37pWF8WhkyFaGwpqw nAkpqhanf8gCOsvPRhk4lvwETZ20hoCRzgR2bZzIq4F4bgtvx659bbElNBZv8kKu 5xYlMm+cV3MCwwTYXaBz7ItIl8ZC6rfQLdc2LAXhvJvjdaxHTpDeySN5l1gTdCII j9SQvUGYG1w= =/NkS -----END PGP SIGNATURE-----

2 1

Re: PGP 2.5
by Philip Zimmermann 17 Dec '03

17 Dec '03

David Sternlight, here are the answers to most of your questions. >Just so I'm absolutely clear, since I want to use PGP but not to take any >legal risks: > >1. Was the person in the administration who approved this empowered to act >for the MIT Corporation? Yes. Jim Bruce, a vice president above Jeff Schiller approved it. Another high level official (another VP) also knew, and I'm under the impression that he was in favor of it, too. The decision was a formal decision by MIT The Institution. Absolutely NOT a low-level person acting on his own. I hope I'm making this point clear enough. >2. Did the MIT legal counsel act with full knowledge of the patent situation >and MIT's relationship with PKP? Of course. With absolutely full knowledge. And extensive review. And careful analysis. And with a formal written legal opinion to MIT. >3. Were the counsel and administration people aware that 2.5 uses >non-published calls to RSAREF? Perhaps you have a different opinion of what "published" means. It is the opinion of MIT and their lawyers that the entry points that PGP uses are published entry points. They were not declared public in previous versions of RSAREF, they were declared static. But now they are declared public in the new RSAREF, even to the point of being included in a header file as public entry points. MIT advised their lawyers of the exact nature of this, and the MIT administration was fully informed, and this issue was discussed to death amongst all responsible parties at MIT before a formal decision was made. >I'm eager to start using PGP2.5, and hope it all works out. I'm puzzled that >Jim Bidzos hasn't acknowledged the non-infringing nature of PGP 2.5 if, in >fact it doesn't infringe. I'm puzzled he hasn't supported 2.5 the way he has Has Bidzos publicly asserted that PGP 2.5 is infringing? If not, then it would not be safe to assume that it is. Silence can be interpreted in a variety of ways. Or not interpreted at all. MIT carries a great deal of moral authority by officially releasing PGP 2.5. I hope this will help defuse your efforts to stamp out PGP. -Philip Zimmermann prz(a)acm.org

1 0