December 2003 - cypherpunks-legacy

Ninth Amendment and privacy??
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

grendel(a)netaxs.com (Michael Handler): > control to anyone except married couples. The Supremes said that this was > an undue invasion of privacy, and that there *was* a Constitutional right > to privacy. They neglected to specify exactly where it was, though. ;) > However, they suggested that it was held somewhere under the Ninth Amendment. Amendment IX (1791) The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people. C'est tout. Sounds very clearly like a right to privacy to me ;-) ----------------------------------------------------------------------------- Rishab Aiyer Ghosh They came for the Jews, and I was silent because I was not a Jew; rishab(a)dxm.ernet.in They came for the Trade Unionists, and I did not protest, because I did not Voice/Fax/Data +91 11 6853410 belong to a trade union; Voicemail +91 11 3760335 They came for the Catholics, and I said nothing because I was not a Catholic; H 34C Saket And then they came for me. New Delhi There was no one left to say anything... INDIA ----Father Niemoeller

1 0

Re: Anonymous Remailers
by usura＠vox.hacktic.nl 17 Dec '03

17 Dec '03

ghio(a)kaiwan.com (Matthew Ghio) writes: >Anonymous says: > >> Do any of the other CP remailers (other than soda.berkeley.edu) >> offer a post-to-Usenet gateway? If so, do they use the same >> syntax? > >Yes and no. I think vox.hacktic.nl can post to usenet with >X-Anon-To: alt.whatever.usenet.group > That is correct, but it can only post to newsgroups that are carried by the hacktic newsserver [apr. 2800 newsgroups] >> I know that a few of the CP remailers have a certain adddress, >> like "help@<address>" which will provide an info sheet by return >> mail. Do any of the others support that? If so, would "help" be >> used, or something else? > >Well, there's mg5n+remailers(a)andrew.cmu.edu ... If you send a message to help(a)vox.hacktic.nl you will receive a help file, on the various remailers that vox.hacktic.nl supports [you can add your PGPpubKEY to my keyring, all mail to you will then be encypted, etc..] -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0

Re: Help A Novice Understand
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: From: MWayne(a)eworld.com : Greetings all-- : I have been reading the list for a couple of months now and have come across Really? I didn't realise Apple's E-World had been online that long. : the names of two people who seen to stir some very serious passions, David : Sternlight, & L. Detweiller. : Can someone tell me who they are and why C'punks hold them in such low : esteem?? Assuming you aren't just deliberately shit-stirring, if you really want to know I suggest you subscribe to usenet groups comp.org.eff.talk, comp.org.cpsr.talk, sci.crypt, alt.security.pgp and alt.fan.david-sternlight and find out for yourself. That's how usenet works, you know... (Or don't those Apple people let you play in the big boy's sand pit?) G

1 0

Re: Anonymous Remailers
by usura＠vox.hacktic.nl 17 Dec '03

17 Dec '03

usura(a)vox.hacktic.nl (Usura) writes: >>> I know that a few of the CP remailers have a certain adddress, >>> like "help@<address>" which will provide an info sheet by return >>> mail. Do any of the others support that? If so, would "help" be >>> used, or something else? >> >>Well, there's mg5n+remailers(a)andrew.cmu.edu ... > >If you send a message to help(a)vox.hacktic.nl you will receive a help file, >on the various remailers that vox.hacktic.nl supports [you can add your >PGPpubKEY to my keyring, all mail to you will then be encypted, etc..] The syntax of this message _must_ be : To: help(a)vox.hacktic.nl Subj: help ^ only one space please, otherwise the help file will not be send. -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0

Re: Sternlight & PGP
by Graham Toal 17 Dec '03

17 Dec '03

: From: Greg Broiles <greg(a)ideath.goldenbear.com> : action against them if they didn't stop making PGP available via FTP. I : suspect (but cannot prove) that he was also the person who reported those : FTP sites to Bidzos, thus creating the lawsuit threat that he then pretended : to protect the FTP sites from. He recently owned up to it on alt.security.pgp ... In fact, he was bragging about it and how in fact he had "won" if anybody had won... G PS Here's the post: Newsgroups: alt.security.pgp Path: an-teallach.com!demon!uknet!doc.ic.ac.uk!agate!library.ucla.edu!csulb.edu!csus.edu!netcom.com!strnlght From: strnlght(a)netcom.com (David Sternlight) Subject: Re: Not Phil Zimmermann, Mark Riordan. Message-ID: <strnlghtCqwput.6Kz(a)netcom.com> Reply-To: david(a)sternlight.com (David Sternlight) Organization: DSI/USCRPAC References: <RbDxjiU9QXUS065yn(a)spartan.ac.brocku.ca> <2sq6aq$pll(a)nyx10.cs.du.edu> <strnlghtCqvvv0.G9p(a)netcom.com> <2sre71$7cn(a)nyx.cs.du.edu> Date: Sun, 5 Jun 1994 04:30:29 GMT Lines: 82 In article <2sre71$7cn(a)nyx.cs.du.edu>, Alex Strasheim <astrashe(a)nyx.cs.du.edu> wrote: >>Finally a few words about the "we won" nonsense at the end of Alex's >>message. > >>There is no "we" and there was never anything to "win". > >I beg to differ: we won, and you lost. We being the friends of PGP, and >you being, well, just you. You don't get it. I LIKE PGP. I grabbed it when I first saw it. Only when I found it infringed RSADSI's patents did I feel I needed to take action. That action was a deliberate strategy: 1. I worked behind the scenes urging Jim Bidzos of RSADSI to find a way to license PGP. I did so in a sustained and intense way. Ask him. We discussed many options, and he checked with his lawyers on each one. (I was not the only one and claim no special credit). 2. In order to persuade Jim it was clear to me that I had to defend his patent rights in public. Any attempt to force PGP down his throat was doomed to fail in my view. Thus I gave no quarter, and no comfort to those attacking RSADSI, following a strategy of deliberate provocation, or in any way making it harder for Jim to compromise (recall that HE has the patent, not the PGP fans. Recall also that it is an MIT/Stanford University patent, not some commercial exploiter of the civil liberties of the downtrodden.) 3. In a small number of instances I saw some underhanded cheating going on that could threaten sites I use and benefit from. By "underhanded cheating" I mean posting infringing software which I had good reason to believe put sites at risk with neither the permission nor knowledge of the site admins or owners. I have never objected to individuals putting PGP up on their own computers with full knowledge of the risks they were taking. In conversations with Jim he told me he was going to go after those sites and close them down. I didn't want that to happen, so I reported the background to a very few sites I used, leaving the site admins to make up their own minds what to do. In one case a user was asked to remove PGP and did. In another case it was taken down. In a third case the site declined to get involved. Note that in each case I was a party at interest and felt I might be damaged by the consequences of PGP being up there; rightly or wrongly my conversations with Bidzos led me to believe he was preparing imminent action, and I thus took my own action to warn sites I used, to protect myself from the possibility of losing their services. I have explained this repeatedly, but the PGP infringers, having not a leg to stand on, decided to react with a smoke screen of vilification, defamation, and falsehoods about my motives, and even my bona fides, since they could not confront the issues honestly and directly given their dirty hands in the matter. For some of the worst excesses, read this week's New Yorker article: "My First Flame." That's it. There was never a hidden agenda, or the assumption of any net.cop role--I acted to protect a very few sites I benefitted from, and even then only by presenting the facts and leaving it up to the admins. I acted in a way designed form the start to get a non-infringing PGP available in the U.S. Thus if anyone won, I did. I now have what I've been seeking all along, a non-infringing version of PGP, thanks to MIT. The de facto standard version of PGP in the U.S. is properly licensed by RSADSI. It will drive out the infringing versions in very short order and we can all, honestly and legally, use PGP. If anyone lost, it is the juvenile thugs flaunting their disobedience to authority. PGP hit its limits with the infringing version in the U.S. No serious company or law abiding professional would consider it as long as it was under a cloud. Now the infringing versions are about to become history, and using PGP 2.6 in the U.S. is an act of legitimacy, not an act of disobedience to authority or disrespect for patents one doesn't like. Those with authority figure problems will have to find another "cause"--they've now been very effectively deprived of this one by the simple expedient of respect for others' property. It was a long, hard fight, but in the end, despite the obfuscation, slime, lies, defamation, playground bully, and hoodlum tactics of a short list of people--names available on request :-) -- the good guys won. David

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

> verge on mailbombing, they are such random garbage. He > frequently posts under other names, but makes little effort > to conceal his real identity. Don't bet on that. At least not with "wilhoek"--Supermoron is battling it out right now with his alter ego on news.admin.policy.

1 0

Re: Black Eye for NSA, NIST, and Denning
by Hal 17 Dec '03

17 Dec '03

It was my understanding from what was posted here and on sci.crypt that Clipper chips were only going to be given to phone manufactureres who had an approved design. This would mean no pre-encryption of messages, and no hacks to defeat the LEAF block, would be allowed. It's not clear to me whether the same restrictions apply to the use of the Tessera plug-in card. It sounds, from what was posted here, like Blaze was able to feed sample LEAF's at his card until it accepted one. Is that correct? If so, apparently users of such cards have access to low-level functions which would allow this kind of trick to be used. Unless there is some way to get a supply of Clipper chips to allow you to make Clipper-compatible phones which still protect privacy, then all this theorizing is not too useful. I am inclined to agree with Deadbeat that if you want to give the impression that you are using Clipper on your phone calls (to blend in, to keep a low profile) but at the same time you want the key escrow not to work, then pre-encryption is a superior strategy to Matt Blaze's idea. Matt's trick only hides the session key if both sides are using it. And even in that case it appears to require particular key manage- ment techniques that may not be standard (one side provides the session key, or it is negotiated but both sides wait 30 minutes to talk). So it does seem that some pre-arrangement will be necessary in practice to allow Blaze's approach to successfully hide the session key. It's true that the Blaze technique hides the unit id, preventing traffic analysis. But that could be a negative. Playing paranoid, suppose that Clipper traffic is routinely decrypted with the family key. Then the fact that someone is using bogus LEAF's might be evident because the unit id would change with each call. Using pre-encryption makes you look like a good little boy until they bring out the escrowed keys. (Of course, they're not supposed to troll LEAF's, any more than they're supposed to break escrow, but I'm assuming that the former will be easier and more likely than the latter.) Hal

3 2

JOB POSTING: InterNex
by geoffw＠nexsys.net 17 Dec '03

17 Dec '03

Forgive my posting this here but I figure that I might just get someone who has the skillset and the sensibilities to understand the potential future issues that a service provider might have to deal with around "privacy issues" anyway: --------------------------------------------------------------------------- MANAGER OF NETWORK OPERATIONS [This is NOT an entry level position] InterNex is seeking a versatile and dynamic individual to be a hands-on senior technical leader in our rapidly growing Network Operations Center. This multifaceted job will involve all aspects of network and system administration and management in a TCP/IP based, public internet. You will have a leadership role in the design and construction of a wide area internet that incorporates high bandwidth technologies such as ISDN, Frame Relay, T1, SMDS, and ATM. You will participate in the design, construction, and maintenance of a variety of network devices and software that generate and sustain the growing area of Cyberspace for which InterNex is responsible. You will also support in-house development, including creating tools to facilitate network management, perform connection billing, implement bandwidth management, and automate new user configuration. The successful candidate will also provide technical expertise to customers with varying levels of technical sophistication and support other members of the InterNex team. You should have good writing skills and be able to communicate clearly. This job requires proven proficiency with Sun System Administration skills, a solid working knowledge of the IP protocol suite, router configuration, SMTP/Sendmail, SNMP, DNS configuration, Perl, C/C++ program porting, and firewall construction. Experience with Windows, Novell, Macintosh, X.500, ATM are pluses. Knowledge of Telco systems, and project leadership skills are desirable. Commitment to teamwork is an essential aspect of the job. More than four years previous system experience is required. A degree in computer science or a related field is desirable. InterNex is located in the highly desirable mid-peninsula community of Menlo Park. Close to Stanford University, on the edge of Silicon Valley, 35 minutes from the Pacific Ocean and San Francisco. InterNex offers a high quality of life and a team of professionals dedicated to setting new standards of excellence in technology and customer service. Compensation package includes salary, health care and stock options and is based on experience and performance reviews. For immediate consideration, please e-mail your resume (ASCII and postscript) to personnel(a)internex.net, or fax it to (415) 473-3062. No phone calls please. InterNex Information Services is a rapidly growing Internet service provider start-up that specializes in helping businesses do business on the Internet. We provide our customers One-Stop-Shopping for high-bandwidth connectivity utilizing leading edge technology. We also address the need for Internet presence by providing electronic publishing services such as WWW, Gopher, WAIS, FTP, and custom servers. InterNex is an equal opportunity employer.

1 0

Clipper- Who's Fooling Who
by jp＠jep.pld.ttu.ee 17 Dec '03

17 Dec '03

It simply is not possible for them to have ACCIDENTALLY OVERLOOKED such a thing as 16 bit CRC. Let us assume, that 2 distinct users want to initiate clipper connection. They will have their secret keys generated inside chips and as key distribution is not a part of clipper they can happily use DH or whatever to do it, meaning that they still are the only ones to know them. To be able to intercept these keys clipper chips have ( presumably ) skipjack cipher to make LEAFS. Now cipher must take arguments data and key. But we assume, that Chips have Family key, but not Master key ( such a thing would have been nonsense- you cannot rely on one key for all chips ), meaning that they share no global knowledge except SJ algorithm. So, for other chip to make difference between RIGHT and WRONG LEAF it has shared secret, meaning session key and LEAF. What could have been simpler than using these 2 components and SJ to generate cryptographic checksum? Nothing, execpt that this checksum is of no use to goverment- it does not know shared secrets, so it cannot use this checksum anyway. BUt that is not such a big pr oblem - line noise and checksums can be applied externally. So why not use session key and SJ, generate a 80 BIT checksum and append it to LEAF. I do not believe that it would make SJ useless because of cancellation :-) The proposed scheme would look like this: Sa, LEAFa, Sb, LEAFb the session keys and LEAFs of a and b 1. A and B generate and exchange keys 2. A sends to B SJ(LEAFA,Sb), LEAFA 3. B verifyes it and takes into use Sa. ,the same thing in opposite directions. Rather EASY not to implement it. Now they did not do it. Instead they used only 16 bits. Weird. Unless... OK, SJ has no backdoors, but somehow manages to send the parts of LEAF fields maybe 0.5 bits per one SJ coded user data block. (it is always possible to compress data that much ) That would change the things. We would be happy about our checksum and they would be really happy about (us) US. A little media now and then - it's for advertisment. Just think that This 16 bits did not make SJ weaker, meaning people who would have used it for sequrity will do so anyway. The i-do-not-know class will switch over to it because of if-I-want-I-can-crack-it( or buy device or have it installed or whatever). I'm Looking for a partner Someone who gets things fixed Think about it seriosly do you want to get rich? OK for Pet Shop Boys, but NSA??? JP from TTU

1 0

Applied Cryptography
by NetSurfer 17 Dec '03

17 Dec '03

Aloha, CP's: Periodically there have been people seeking copies of Schneier's "Applied Cryptography". I've found a source you can order them from electronically if you are so inclined. "Applied Cryptography", by Bruce Schneier 0-471-59756-2 $44.95 Wiley Books Stacey's Bookstore - staceysbks(a)aol.com Softpro - softpro(a)csns.com Reiter's Scientific & Professional Books - bks(a)reiters.com Quantum Books - quanbook(a)world.sto.com Softpro - softpro(a)world.std.com -NetSurfer #include standard.disclaimer >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> == = = |James D. Wilson |V.PGP 2.4: 512/E12FCD 1994/03/17 > " " " |P. O. Box 15432 |finger for key / Viacrypt Reseller > " " /\ " |Honolulu, HI 96830 |====================================> \" "/ \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

1 0