December 2003 - cypherpunks-legacy

Anyone looked at this report?
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

[Again cribbed from RISKS... --AW} From: "Lance J. Hoffman" <hoffman(a)seas.gwu.edu> Subject: crypto policy report available online The following report is available by anonymous ftp from ftp.gwu.edu under directory /pub/hoffman. The document is stored under the name "cryptpol". It is a NIST-sponsored study. The table of contents and abstract follows here. CRYPTOGRAPHY: POLICY AND TECHNOLOGY TRENDS Lance J. Hoffman, Faraz A. Ali, Steven L. Heckler, Ann Huybrechts December 1, 1993 CONTENTS EXECUTIVE SUMMARY 1. INTRODUCTION 2. TECHNOLOGY 3. MARKET ANALYSIS 4. EXPORT CONTROLS 5. PUBLIC POLICY ISSUES 5.1 EXECUTIVE BRANCH 5.2 CONGRESS 5.3 TRENDS 6. POTENTIAL SCENARIOS EXECUTIVE SUMMARY During the past five years, encryption technology has become easily available to both individuals and businesses, affording them a level of security formerly available practically to only military, national security, and law enforcement agencies. As a result, a debate within the United States about the proper balance between national security and personal freedom has been initiated. Law enforcement and national security agencies would like to maintain tight control over civilian encryption technologies, while industry and individual and privacy rights advocates fight to expand their ability to distribute and use cryptographic products as they please. This report analyzes trends in encryption technology, markets, export controls, and legislation. It identifies five trends which will have a strong influence on cryptography policy in the United States: * The continued expansion of the Internet and the progressive miniaturization of cryptographic hardware combined with the increasing availability and use of strong cryptographic software means that the strongest encryption technologies will continue to become more easily obtainable everywhere in the years ahead. * Additional growth in networked and wireless communication will fuel a strong demand for encryption hardware and software both domestically and abroad, causing the U. S. high-technology industry to be increasingly interested in selling encryption products overseas and in modifying current export restrictions. * Due to the responsibilities and bureaucratic dispositions of key Executive Branch agencies, products using strong encryption algorithms such as DES will continue to face at least some export restrictions, despite the widespread availability of strong encryption products overseas. * The American public is likely to become increasingly concerned about its privacy and about cryptographic policy as a result of the increased amount of personal information available online and the growing number of wireless and networked communications. The development and increasingly widespread use of the National Information Infrastructure will heighten these concerns. * Encryption policy is becoming an important public policy issue that will engage the attention of all branches of government. Congress will become increasingly visible in this debate due to its power of agency oversight and its role in passing laws accommodating the United States' rapid rate of technological change. Agencies will remain very important since they have the implementing and, often, the planning responsibilities. Since individuals and industry have more direct influence over Congress than over most other branches of government, Congress may place somewhat more emphasis on personal freedom than many other government actors. Four potential scenarios are likely: mandatory escrowed encryption, voluntary escrowed encryption, complete decontrol of encryption, or domestic decontrol with strict export regulations. Professor Lance J. Hoffman, Dept of EECS, The George Washington University (202) 994-4955 Washington, D.C. 20052 hoffman(a)seas.gwu.edu Fax (202) 994-0227 ------------------------------

1 0

Nuclear Capone in Russia?
by nobody＠jarthur.claremont.edu 17 Dec '03

17 Dec '03

Los Angeles Times, Saturday, Feb. 26, 1994, p.A10 FBI Director Sees Parallels Between Russia Now, Chicago Then Crime: Louis J. Freeh doesnÕt want a Slavic Al Capone to endanger U.S. investments or undermine the fragile democratic process. And he is working to help prevent it. By Ronald J. Ostrow Times Staff Writer Washington - To FBI Director Louis J. Freeh, organized crime in Russia today bears disturbing similarities to ChicagoÕs in the 1920s and 1930s - violent but fractionalized, a danger to itself as much as to the rest of society, and with a potential for much more. The likes of Al Capone, unchecked by the FBI or any other law enforcement body, welded the Chicago mob into a unified force that preyed on the community for decades. Freeh does not want a Slavic equivalent of Capone to do the same today in Russia, for fear not only of endangering American Business activity there but also of undermining that countryÕs fragile democratic process. And he is working to help Russian authorities prevent it. Already, Freeh said, elements of Russian organized crime are responsible for everything from "bushwhacking" American businessmen to dealing in materials that could be used in nuclear weapons. If authorities do not act soon, he said, organized crime will become so entrenched throughout the former Soviet Union and its Eastern European satellites that, like the Mafia in Chicago, it will take decades to remove it. "We have to look at it as something that's clearly directed toward the United States, toward our economy," Freeh said in an interview. "Even with decreasing resources, we can't afford to do what the FBI did with respect to La Cosa Nostra for 30 years, and that was to completely ignore it." The situation in Russia today, Freeh acknowledged, is not as dire as in Chicago in the 1920s and 1930s. But German and Russian law enforcement authorities "are concerned about the very rapid inroads that these gangs are making into officialdom, into police and government officials," the FBI director said. To help the Russians cope, Freeh wants to station up to three FBI agents in Moscow by the end of spring to serve as liaisons with Russian authorities. Contacts are now handled largely by two agents based in Bonn, who have responsibilities beyond the former Soviet Union. Authorities in Russia's Interior Ministry and the Moscow police "are desperately in need of our help," Freeh said. "They want our training, our methodology." He also wants to bring Russian agents for 11 weeks of training at the FBI's National Academy in Quantico, VA., where they would learn about laboratory and computer work and the other technologies that the FBI uses against organized crime. For now, Freeh said, the victims of Russia's organized crime are mostly Russian Entrepreneurs and other business people. But he warned that American businesses seeking a foothold in Russia are just as vulnerable. "Part of the [Clinton] Administration's program is to give not only economic aid but to [assist] economic institution-building and to encourage American and other foreign investments" in the former Soviet Union, he said. "If the scouts for leading American corporations are getting bushwhacked in their hotel rooms in Moscow or, perhaps worse, establishing a foothold and having to face extortion and economic criminal activity they are not prepared to do, our economy takes a serious hit," Freeh said. "The end product is that the process for democracy and a free economy in Russia takes a very significant step backward. "I guess it's an irony, but it's much harder to police in a democratic fashion than than to police in a totalitarian fashion," Freeh said. "Police work is very hard if you do it according to due process and democratically." Authorities in the former Soviet Union "don't have that experience and haven't had it for 70 years. So they're having to learn all of the tools, skills and techniques and, at the same time, deal with a burgeoning crime crisis," Freeh said. U.S. authorities are particularly concerned that Russian gangs "are aggressively looking to buy and sell nuclear materials," the FBI director said. The materials so far are less than weapons grade, but they could be used for designing devices deadly to population centers, according to FBI intelligence. "That's a whole different threat than we've faced before," Freeh said. He declined to give any more specifics on the threat, but said the United States under the law now lacks authority to fully deal with it. Under the 1950 Atomic Energy Act, the FBI has authority to investigate the transfer or shipment of nuclear materials only if their origin or destination is American or they have entered and left the United States. Freeh said he has discussed with Atty. Gen Janet Reno and other Justice Department officials the need for a law broadening the FBI's authority over such matters. The FBI is also interested in the criminal activities of Russian immigrants in the United States, according to Jim Moody, who directs the FBI's efforts against organized crime. In the late 1970's and early 1980's, about 200,000 people entered the United States from the Soviet Union, and Moody estimated that about 1% of them - 2,000 - were "hard-core criminals." But he regards them as second-string players who are now being replaced by more highly skilled, educated lawbreakers. In one of the more sophisticated conspiracies involving Russian emigres, a federal grand jury in Philadelphia last June charged 15 people and two corporations with evading federal and state excise taxes on the sale of more than 51 million gallons of diesel fuel in Pennsylvania and New Jersey.

2 1

Security of andrew.cmu.edu anon-server?
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

What kind of encryption is the anonymous contact system at andrew using? I think someone said that it used a home-brew cipher. How secure might such a system be against cryptanalysis (or just brute force key searches?) Or has it been changed to use something like DES or IDEA? (In the former case, DES, it might not be completely secure, unless you used 3DES or something.) If someone could break the code, they could find out _EVERYONE'S_ mail address that ever posted using an anon address from that remailer...

2 1

[julf@penet.fi: Re: VIRTUAL meeting needed]
by joshua geller 17 Dec '03

17 Dec '03

>> Instead, perhaps we need to organize for another virtual meeting again. >> With a little more organizing, it would go smoother. >How about trying IRC this time? be something worthwhile on irc for once. and people would be there who wouldn't otherwise (like me). josh

1 0

Mailing list software losing posts
by Matthew J Ghio 17 Dec '03

17 Dec '03

The list software seems to be having problems again. I sent the below post to the list three times, and it never got sent out. But since another post from me just showed up, maybe it's working now... (Let me know if you got more than one copy, because I sure didn't.) ----- To: cypherpunks(a)toad.com Subject: Re: lists of U.S. cypherpunks and Tentacles. CC: Matthew J Ghio <mg5n+(a)andrew.cmu.edu> In-Reply-To: <9402260131.AA08270(a)toad.com> References: <9402260131.AA08270(a)toad.com> Date: Sat, 26 Feb 1994 11:34:54 -0500 (EST) From: Matthew J Ghio <mg5n+(a)andrew.cmu.edu> mg5n+eaibiubkxb58z84cy2iaf9r61u26ra5x26mc0h(a)andrew.cmu.edu wrote: > Please add me to your list. As you can see, I clearly have > a US-based email address. :) hehe... This didn't come from my site tho. It looks like a clever port 25 hack. However, the return address is valid. I suppose this points out another problem with the US export laws: How can you know where a message came from? As the above example shows, there is really no way to know where the person you're communicating with is. In other words, you can't not break the US export laws. All you have is someone's word that they are in the US or not, but you really can't know for sure. Something to mention in your letters to Rep. Cantwell. > -Ibiu Cute... using part of your encrypted address as a handle? I never thought of doing that... hmm...

3 3

Re: Newsday Editorial
by bsteve＠zontar.attmail.com 17 Dec '03

17 Dec '03

Dorothy: We have not been formally introduced. My name is Steve Blasingame. I am a long-time proponent of quality encryption systems for both private and commercial communications. I am also a long-time employee of The AT&T Company responsible for AT&T-GIS strategies, programs and products in internetworking. I am very pleased that AT&T is manufacturing the "Clipper Phone" product and believe that "Clipper" is an enabling technology for government and business. However, I must challenge the basis of your "Newsday" editorial as false. >" The Clinton administration has adopted the chip, which would allow >law enforcement agencies with court warrants to read the Clipper codes >and eavesdrop on terrorists and criminals." It would be great if this were true, but it is false. Criminals and terrorists operate outside the confines of the law and are not obliged to use encryption schemes sanctioned by statute. >" But opponents say that, if >this happens, the privacy of law-abiding individuals will be a risk. >They want people to be able to use their own scramblers, which the >government would not be able to decode." Given that criminals would not be obliged to use the statutory method of encryption, what other purpose could be served by such a technology enforced by law? " If the opponents get their way, however, all communications on the information highway would be immune from lawful interception." It is clear that the security of communications on the information highway is an important issue. However, as a corporate citizen, I am more concerned about the un-lawful monitoring of communications and do not consider that there is a sufficiently robust encryption technology to make a statutory encryption standard workable for more than a few years. >" But then who would have >thought that the World Trade Center bombers would have been stupid >enough to return a truck that they had rented?" I think that this qualifies as an appeal to ignorance. "Can you prove it isn't true?" >"... Lawlessness would prevail." If you examine definition 3 from the latest edition of the "American Heritage Dictionary" in your study, you will find that "Lawless" means "not governed by law." This is certainly a law that we can all do without. Very truly yours, Steve Blasingame bsteve(a)zontar.com

1 0

Re: Infomercials, FUD... time?
by Anthony D Ortenzi 17 Dec '03

17 Dec '03

Excerpts from internet.cypherpunks: 24-Feb-94 Re: Infomercials, FUD... time? by Timothy C. May(a)netcom.co > However, a few minor problems with the infomercial idea: > > 1. The incredible cost. Ross Perot could afford to blow $5 million per > show, not many others can. Anyone know where ol' Ross stands on this issue? He could communicate the dangers to a large sector of the population... if he believes in our cause. It's hard to imagine him not, being a little on the paranoid side about the Republicans tapping his communications, and all that jazz... and he's got to have an internet e-mail address somewhere, although it is probably under a pseudonym or something to keep him from being inundated by the masses. Someone who uses whois with Perot finds lots of Perot Computer Systems or whatever the damn name of the company is. It can't be that hard to get in touch with him via e-mail. Someone has got to be able to get through to him to check. Even though he is now not as highly regarded because of the NAFTA fiasco, he's still got some pull. Go to it, 'punks... ()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()() ()/----------------------------------------------------------------------\() ()| Anthony Dante Ortenzi () ao27(a)andrew.cmu.edu () feynman+(a)cmu.edu |() ()| -------------------------------------------------------------------- |() ()| adortenz(a)suvm.acs.syr.edu () ortenzi(a)chaos.bsu.edu |() ()\----------------------------------------------------------------------/() ()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()

2 1

using mediamoo - correction
by David Galiel 17 Dec '03

17 Dec '03

re:previous message about possible use of mediamoo for mtg. Ooops - the ultimate NetSin - mispelled my address. It's galiel(a)world.std.com (sheepish grin) Flout 'em and scout 'em -- and scout 'em and flout 'em; Thought is free. -- Shakespeare

1 0

Cryptography, fascism; Perot
by Brad Dolan 17 Dec '03

17 Dec '03

There has been a lot of discussion of cryptography/communications issues on the UWSA reflector (uwsa(a)shell.portal.com) This list is monitored by people who work for Perot, so post there and it might get his attention. You can be added to the reflector by e-mailing to: telcon(a)shell.portal.com [I think that's right - I believe it used to be telconsort(a)shell.portal.com] Brad bdolan(a)well.sf.ca.us

1 0

Re standard for stegonography?
by Derek Upham 17 Dec '03

17 Dec '03

> Is there a standard for stego yet? I just added stego and de-stego > filters to my pbmplus image toolkit, using a simple protocol I made > up on the spot. Now I'm wondering if I should make them compatible > with existing stego tools. There appear to be two existing steganography packages for images. One is "jsteg", a Unix-based system which stores data in JFIF- compliant JPEG images; it is based on version 4 of the cjpeg/djpeg package. The other is "Stego", a Mac-based system which stores data in Mac PICT files (I think---I don't have a Mac to examine it). "jsteg" is available in the Cypherpunks FTP archive in the applications subdirectory as the original jpegsrc package, plus the patches, plus a README file. However, you might be better off tracking down the "Stego" sources since "jsteg" stores its data in a rather odd way (see the docs for more information). Derek Derek Lynn Upham University of British Columbia upham(a)cs.ubc.ca Computer Science Department ============================================================================= "Ha! Your Leaping Tiger Kung Fu is no match for my Frightened Piglet Style!"

1 0