December 2003 - cypherpunks-legacy

NIST's ftp site
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

A couple of days ago, somebody mentioned that NIST's public ftp site contained the FIPS for DES in text form (I think the post was in a reply to "Massive ITAR Violation!"). Could somebody mail me a copy of that post, I deleted it and now I wish I hadn't. Also, what is the Internet address of NIST's ftp site? Thanks, Jim_Miller(a)suite.com

2 1

Brooks Statement on Crypto
by David Banisar 17 Dec '03

17 Dec '03

The following statement by Rep. Jack Brooks (D-TX) was today entered in the Congressional Record and transmitted to the House Intelligence Committee. Rep. Brooks is Chairman of the House Judiciary Committee and played a key role in the passage of the Computer Security Act of 1987 when he served as Chairman of the House Government Operations Committee. David Sobel <sobel(a)epic.org> Legal Counsel Electronic Privacy Information Center ============================================================= ENCRYPTION POLICY ENDANGERS U.S. COMPETITIVENESS IN GLOBAL MARKETPLACE For some time now, a debate has been raging in the media and in the halls of Congress over the Administration's intention to require U.S. corporations to use and market the Clipper Chip, an encryption device developed in secret by the National Security Agency. The Clipper Chip will provide industry and others with the ability to encode telephone and computer communications. The use of the Clipper Chip as the U.S. encryption standard is a concept promoted by both the intelligence and law enforcement communities because it is designed with a back door to make it relatively easy for these agencies to listen in on these communications. The law enforcement and intelligence communities have a legitimate concern that advances in technology will make their jobs more difficult. But the issue here is whether attempts to restrict the development, use and export of encryption amounts to closing the barn door after the horse has already escaped. The notion that we can limit encryption is just plain fanciful. Encryption technology is available worldwide -- and will become more available as time goes on. First, generally available software with encryption capabilities is sold within the U.S. at thousands of retail outlets, by mail, even, over the phone. These programs may be transferred abroad in minutes by anyone using a public telephone line and a computer modem. Second, it is estimated that over 200 products from some 22 countries -- including Great Britain, France, Germany, Russia, Japan, India, and South Africa -- use some form of the encryption that the Government currently prohibits U.S. companies from exporting. According to the May 16, 1994 issue of _Fortune_, not only are U.S. companies willing to purchase foreign encryption devices, American producers of encrypted software are also moving production overseas to escape the current export controls. Third, encryption techniques and technology are well understood throughout the world. Encryption is routinely taught in computer science programs. Text books explain the underlying encryption technology. International organizations have published protocols for implementing high level encryption. Actual implementations of encryption -- programs ready to use by even computer novices -- are on the Internet. The only result of continued U.S. export controls is to threaten the continued preeminence of America's computer software and hardware companies in world markets. These restrictive policies jeopardize the health of American companies, and the jobs and revenues they generate. I support, therefore, the immediate revision of current export controls over encryption devices to comport with the reality of worldwide encryption availability. I believe law enforcement and the intelligence community would be better served by finding real, and targeted ways to deal with international terrorists and criminals rather than promoting scattershot policies, which restrict American industries' ability to design, produce and market technology. Now -- more than ever -- we cannot afford to harm our economic competitiveness and justify it in the name of national security.

1 0

[ANSWER] NIST's ftp site
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Thanks to all who responded to my question. The answer is: csrc.ncsl.nist.gov Also, apparently, source for DES was in Appendix A of the file "/pub/nistpubs/fips181.txt". However, it was removed and replaced with the following: Appendix A This section contained a listing of the source code referenced in the Automated Password Generator Standard. This section is not available in electronic form. Complete copies of FIPS 181, including this appendix, may be purchased in hardcopy from the National Technical Information Service (NTIS) via mail or telephone. National Technical Information Service U.S. Department of Commerce 5285 Port Royal Road Springfield, VA 22161 (703) 487-4650 Order by FIPSPUB181 Price: $22.50 (Same address and phone number for discount prices on quantity orders.) -------------- I wonder if they'll ship to an address outside of the US or Canada? I wonder if the people who package and mail the stuff even look at it? Jim_Miller(a)suite.com

5 5

Decline and Fall
by Duncan Frissell 17 Dec '03

17 Dec '03

Decline and Fall of the Nation State: Tuesday's WSJ had an article on how private money market funds are starting to jawbone foreign governments just like the World Bank used to. Case cited was Fidelity Investments calling Mexican bank officials during the Peso crisis after the recent assasination. They said "we'll invest another $18 billion (of ours and other fund's money) if you do what we say and if not..." DCF "If they hadn't killed quite so many people, you'd almost have to feel sorry for them." --- WinQwk 2.0b#1165

1 0

Cypherpunks' mail database does exist
by Gary Jeffers 17 Dec '03

17 Dec '03

Vincent, you state that a fully archived, indexed cypherpunks mailing list exists as: http://pmip.maricopa.edu/crypt/cypherpunks/cypherpunks.src Ok, so I ftp'ed to pmip.maricopa.edu & tried to get to cypherpunks.src, but even the subdirectories weren't there. I suspect that http does not imply that we ftp. What communication method is this called & how do we use it? I send this public instead of private as I suspect that a lot of lurkers don't know what is going on either. Yours Truly, Gary Jeffers

5 4

Re: Alt.Gvmt.Immorality
by blancw＠pylon.com 17 Dec '03

17 Dec '03

Responding to msg by Stephen D. Williams: >There are some theories that various 'power' segments >of society actively cultivate a particular working >model for their own benefit. Foremost, of course, are >Clergy, lawyers, and gov. Well, reading books like the one from which I took that quote would alert one's attention to the fact that there are many working models of human nature possible, and that one should not merely take the one given out in school or at church or by whomever. I think that when one realizes that these models are all the product of our own human reasoning, then the idea of liberty & freedom becomes more meaningful, as one realizes that there are choices beyond the views created by one's elders or leaders. >I've always thought and recently espoused that there >should be classes from the beginning of highschool on >philosophy and sociology. I suppose the problem would >be which philosophy and whose spin on things the >schools would encourage. I think this would start a big fight in the public schools as to which philosophy or sociological works to use in the classroom. However, in classrooms per se if there were a general presentation of the concepts and discussions on the human ability to develop comprehensive views of the world, then everyone was turned loose in the library, each person could begin their study of any of them and proceed at their own pace & interest. At the very least they could become aware of the source of the images of human nature which surround us and could better evaluate what it means to live & act within any particular system of operations. >I just think that too many people don't think of >themselves on the 'meta' level. (Thinking about what >they think and do and why.) The opportunities for this kind of thinking are greatly limited to what the church and politics provide as a frame of reference (not that the libraries aren't open and available for budding curiosities). It was from browsing through picture books of other peoples & reading about how other cultures arrange their existence, that I developed the comprehension that there are different methods of doing things in the world, that there is such a thing as choice, and that not only cultures but individuals can arrange their affairs according to their own ideas of success. Blanc

1 0

Rep. Brooks speaks out against export controls -- DO NOT DIST
by Stanton McCandlish 17 Dec '03

17 Dec '03

Rep. Brooks submitted the following statment on encryption export controls today. You may with to send a "thanks" or "great statement" note of kudos to Rep. Brooks (Chair of the House Judiciary Cmte., and longtime detractor of Clipper. He's involved in these issues on several fronts.) NOTE: Even after today, keep faxing, calling, writing. It DOES make a difference. If the bill is butchered, express your opinion on that. It won't get changed otherwise. If it passes the Intell. Cmte. with flying colors, send notes of thanks and approval. GET INVOLVED, otherwise politics control the people instead of vice versa. ***************************************************************************** Floor Statement of Congressman Jack Brooks U.S. House of Representatives re: Encryption Export Controls June 15, 1994 ENCRYPTION POLICY ENDANGERS U.S. COMPETITIVENESS IN GLOBAL MARKETPLACE For some time now, a debate has been raging in the media and in the halls of Congress over the Administration's intention to require U.S. corporations to use and market the Clipper Chip, an encryption device developed in secret by the National Security Agency. The Clipper Chip will provide industry and others with the ability to encode telephone and computer communications. The use of the Clipper Chip as the U.S. encryption standard is a concept promoted by both the intelligence and law enforcement communities because it is designed with a back door to make it relatively easy for these agencies to listen in on these communications. The law enforcement and intelligence communities have a legitimate concern that advances in technology will make their jobs more difficult. But the issue here is whether attempts to restrict the development, use and export of encryption amounts to closing the barn door after the horse has already escaped. The notion that we can limit encryption is just plain fanciful. Encryption technology is available worldwide -- and will become more available as time goes on. First, generally available software with encryption capabilities is sold within the U.S. at thousands of retail outlets, by mail, even over the phone. These programs may be transferred abroad in minutes by anyone using a public telephone line and a computer modem. Second, it is estimated that over 200 programs from some 22 countries -- including Great Britain, France, Germany, Russia, Japan, India, and South Africa -- use some form of encryption that the government currently prohibits U.S. companies from exporting. And this is just the beginning. According to the May 16, 1994 issue of _Fortune_ , not only are U.S. companies willing to purchase foreign encryption devices, American produces of encrypted software are also moving production overseas to escape the current U.S. export controls. Third, encryption techniques and technology are well understood throughout the world. Encryption is routinely taught in computer science programs. Text books explain the underlying encryption technology. International organizations have published protocols for implementing high level encryption. Actual implementations of encryption -- programs ready to use by even computer novices -- are on the Internet. The only result of continued U.S. export controls is to threaten the continued preeminence of America's computer software and hardware companies in the world markets. These restrictive policies jeopardize the health of American companies, and the jobs and revenues they generate. I support, therefore, the immediate revision of current export controls over encryption devices to comport with the reality of worldwide encryption availability. I believe law enforcement and the intelligence community would be better served by finding real, and targeted ways to deal with international terrorists and criminals rather than promoting scattershot policies, which restrict American industries' ability to design, produce, and market technology. Now -- more than ever -- we cannot afford to harm our economic competitiveness and justify it in the name of National Security. ***************************************************************************** -- Stanton McCandlish * mech(a)eff.org * Electronic Frontier Found. OnlineActivist F O R M O R E I N F O, E - M A I L T O: I N F O @ E F F . O R G O P E N P L A T F O R M O N L I N E R I G H T S V I R T U A L C U L T U R E C R Y P T O

1 1

HR 3627? Success or failure?
by Michael Handler 17 Dec '03

17 Dec '03

So? Did the good guys win this time, or were we just tilting at windmills again? -- Michael Brandt Handler <grendel(a)netaxs.com> Philadelphia, PA PGP v2.6 public key on request

1 0

Re: Cypherpunks' mail database does exist (fwd)
by osten＠hurricane.seas.ucla.edu 17 Dec '03

17 Dec '03

> > It does my heart good to hear someone use the term 'grok' -- I don't > hear many folks use that term very much anymore. ,-) > > - paul > > What does it mean?

5 4

Re: DES w/ variable S-boxes
by Matthew Ghio 17 Dec '03

17 Dec '03

Ben.Goren(a)asu.edu wrote: | However, as Bruce Schneier points out (p. 242), *variable* S-boxes make | | differential cryptanalysis impossilbe, as such an adaptive plaintext attack | | relies on knowledge of the composition of the S-boxes. If the boxes and | | their contents change with both keys used and plaintext--probably with the | | help of a strong RNG--then the only way such an attack could work would be | | by first figuring out what causes the changes in the S-boxes; in that case, | | the attack is probably already finished, by other means. Perhaps, even, the | | S-boxes could change with so many chunks of text--again, variable, of | | course. | You should take a look at Michael Paul Johnson's Diamond Encryption Algorithm. It uses variable S-boxes as you describe. Source code and documentation is availiable on ftp csn.org. /pub/mpj/...

1 0