December 2003 - cypherpunks-legacy

US Postal Public Key
by John Young 17 Dec '03

17 Dec '03

The list Cyberia posted an article yesterday on the US Postal Service's plan to use a public key system for email. If anyone wants the full posting, email me; it's about 25K. Below are excerpts: Quote: Quebec City, Canada, August 3, 1994--The U.S. Postal Service has dramatically increased its commitment to the security of communications on the NII, with the announcement of Postal Electronic Commerce Services ("Postal ECS"), which will offer a nationwide public key certification service for the authentication of digital signatures used in paperless electronic commerce. Richard Rothwell, Senior Director of Technology Integration for the USPS, officially released the news today in Quebec City, in a paper delivered to an international working group of the Information Security Committee of the American Bar Association's Section of Science and Technology, which has been developing guidelines for public key certification authorities. [Speech is all in uppercase] * * * AS MANY EXPERTS HAVE NOTED, INCLUDING MANY OF YOU IN THIS ROOM, DIGITAL FILES AS A RULE ARE NEITHER AS SECURE NOR AS ELECTRONIC COMMERCE CONVEYS. BUT WITHOUT SOME METHOD OF SEALING A DIGITAL FILE TO ESTABLISH ITS CONTENTS, AUTHOR, AND TIME OF TRANSMITTAL, THE BENEFITS OF ELECTRONIC COMMERCE WILL INEVITABLY BE LIMITED TO HIGHLY STRUCTURED TRANSACTIONS BETWEEN PARTIES THAT KNOW AND TRUST ONE ANOTHER. * * * THE POSTAL SERVICE IS USING PUBLIC KEY ENCRYPTION TECHNOLOGY, AND RELATED TECHNOLOGIES, TO DEVELOP A PUBLIC KEY CERTIFICATION AUTHORITY AND A SET OF ASSOCIATED TRUSTED THIRD PARTY SERVICES WHICH WE CALL POSTAL ELECTRONIC COMMERCE SERVICES (POSTAL ECS). WHEN INITIALLY DEPLOYED, POSTAL ECS WILL PROVIDE A BASIS FOR ELECTRONIC ASSURANCES WITHIN AND AMONG GOVERNMENT AGENCIES, AND BETWEEN GOVERNMENT AGENCIES AND THEIR CONSTITUENTS. IN PARTICULAR, THE POSTAL SERVICE HAS DEVELOPED THE ABILITY TO: ISSUE PUBLIC KEY CERTIFICATES AND STORE THEM IN A PUBLIC DIRECTORY; PROVIDE FOR THE "SEALING" OF SELECTED DOCUMENTS OR OTHER ELECTRONIC OBJECTS AND ASSOCIATING THEM WITH A DIGITAL SIGNATURE AND A TRUSTED TIME AND DATE STAMP; PROVIDE SERVICES FOR PUBLIC KEY CERTIFICATE PUBLICATION AND REVOCATION; AND, PROVIDE THE ABILITY TO ENCRYPT CONFIDENTIAL INFORMATION MOVING BETWEEN THE USER ENVIRONMENT AND THE POSTAL ECS MANAGEMENT SYSTEM. FINALLY, PROVIDE NEAR REAL-TIME ACCESS TO CERTIFICATES AND THEIR STATUS. THE CERTIFICATION AUTHORITY WILL ISSUE AND MANAGE X.509 PUBLIC KEY CERTIFICATES CONTAINING A PERSON'S X.500 DISTINGUISHED NAME, PUBLIC KEY, AND OTHER IDENTIFYING INFORMATION. USERS CAN THEN RETRIEVE A CERTIFICATE FROM THE POSTAL SERVICE, AND USE ITS PUBLIC KEY TO AUTHENTICATE A DIGITAL SIGNATURE GENERATED BY THE COMPLEMENTARY PRIVATE KEY. * * * THESE USER AGENTS CONTAIN STANDARD PROGRAMMING INTERFACES THAT LINK USER APPLICATIONS, CRYPTOGRAPHIC ROUTINES, AND ECS SERVICES TOGETHER. OUR INITIAL IMPLEMENTATION IS BASED ON THE DIGITAL SIGNATURE STANDARD (DSS) ALGORITHM SET; BUT OUR PLAN IS TO SUPPORT OTHER CRYPTOGRAPHIC OPTIONS SUCH AS RSA IN THE NEAR FUTURE. * * * IN KEEPING WITH THE PHILOSOPHY I HAVE ARTICULATED, LET ME SAY THAT THE POSTAL SERVICE, IN ANY DEVELOPMENT OF THESE PRODUCTS, INTENDS TO SUPPORT MULTIPLE CRYPTOGRAPHIC PRODUCTS IN THE MARKET PLACE. IN ADDITION, WE WILL NOT COMPETE WITH NETWORK SERVICE PROVIDERS, NOR WILL WE BECOME A NETWORK OR CARRIER. * * * End Quote.

1 0

I sell out
by frissell＠panix.com 17 Dec '03

17 Dec '03

They finally got to me. after fretting for years about how (melanin-rich) hordes of illegal aliens were poised to steal *my* job, I've decided that something has to be done. The turning point came this morning while reading about the report of the Commission on Immigration Reform. They have proposed a brilliant idea -- a national registry of the names and SS numbers of all *Real* Americans (as well as those sneaky legal aliens) so that employers can (would have to) verify that their prospective employees are legal. Since this is such a fabulous idea, I thought that we might help out by creating a Social Security Number Server on the nets to make valid names and SS numbers available to *everyone*. Nice WWW interface with forms support, etc. After all, since it's such a good thing to do, we should *help* the Feds by doing more of it. As you may know, there's a guy on alt.privacy who has been collecting SS numbers for a while (a perfectly legal activity). I will be contacting him to see if he would be interested in contributing the numbers that he has collected. Anyone else interested contact me. DCF Who is among the 2% of Americans (it's actually higher) not covered by the Social Security Act and who will be part of the 5% of Americans (again it will be much higher) not covered by the Health Security Act.

2 1

Re: broadcast encryption
by snyderra＠dunx1.ocs.drexel.edu 17 Dec '03

17 Dec '03

At 5:55 PM 8/3/94, Jonathan Rochkind wrote: >That kind of explains why encryption is not allowed on ham bands, but it >doesn't satisfy me. The difference between ham and other bands, is to use >other frequencies I've got to pay the FCC major money for a license, or >pay some commercial service provider who payed the FCC major money. Not quite. As someone else noted, there are unregulated (except for power and equipment) bands where no license at all is required. >With ham, I don't have to pay no one nothing, except maybe $10 for a ham >license. ham, or some other frequency reserved to work like ham, could easily >serve as a poor man's connection to the internet. Anyone with a desktop >PC can invest another hundred dollars or so, and have a really low >bandwith (2400bps) direct connection to the internet. You can do IP >over ham, although it's really dificult to do so currently without breaking >the law and losing your license. Doing IP over the amateur bands is easy, and is done by many people. Doing a connection to the Internet over amateur bands is hard. >A public ham or ham-like radio band would seem to be something the cypherpunks >would really like. It would definitely facillitate the creation of a sort >of blacknet type thing. The government has given the public citizens band, and >ham radio, if they're not going to open up ham so it can be used in the ways >I'm thinking of, why not take another hunk of spectrum and give it to the >public, specifically intended for digital transmissions (IP or otherwise). >This seems to be something we should be campaigning for, and the EFF >should be lobbying for. I don't object to your goals, but honestly, I think the EFF should be lobbying harder for some more important things, like killing the FBI's wiretap bill and getting cryptological export control lifted. Bob -- Bob Snyder N2KGO MIME, RIPEM mail accepted snyderra(a)dunx1.ocs.drexel.edu finger for RIPEM public key When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

1 0

Re: Remailer stuff
by Jonathan Rochkind 17 Dec '03

17 Dec '03

> Sorry if I'm being dense - will someone please E-mail me and tell me > why outgoing-only (or incoming-address-unavailable) remailers are > useful? I'm not sure that they are. The idea is, that some people might want to philanthropically provide a remailing service without revealing their identity. (or, heck, do it for a profit with anonymous ecash). This is currently pretty much unworkable. If a system that provided a reliable decentralized remailer infrastructure (like I _think_ the one I've proposed does), then it might become more workable, but I'm not certain if it would cross the boundry into something actually practical. But it's an interesting idea. > Also, with respect to getting the addresses of working remailers from > a newsgroup - it may not be a good idea to treat any address > advertising itself as a remailer as a useful remailer. Remailer 'x' > may well be run by a remailer-hater who publishes its traffic openly, This is a valid point, but it exists in _any_ remailer system or infrastructure. It's safest to assume that some cypherpunks list members who set up remailers are actually NSA agents. If you chain your message through 15 or 20 remailers, as long as 3 or 4 of them are not "evil", you are probably in good shape. But there's certainly a chance that all 20 are evil; I don't see how the "alt.anonremailer.net" concept changes the odds of getting a chain of all evil remailers. And, yes, I agree that the wise person wouldn't indiscriminately use remailers from this newsgroup, but only use those whose keys are signed by someone he trusts. It's obviously up to the user _how_ to use this hypothetical infrastructure, and there are ways that it could be used that wouldn't give you very much security. But I'm confident that if used properly it wouldn't give you any _less_ security then the current system, which is basically people telling each other about new remailers, and manualy adding them to their PGP rings and such.

1 0

Voluntary Governments
by kkirksey＠world.std.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >The specific point about "imagine if they tied decision making power to >how much you pay in taxes" was tried a while back: only tax-payers could >vote. I'm all in favor of this, but I doubt many of my fellow citizens are. > >(And to some extent we have this, through bribes and influence-buying. >Campaign contributions, etc.) > >Would anyone choose to pay more in taxes for an increased voting share? >Hardly. Do the math on how influential any one vote is in an election. For >specific cases, maybe. Again, that's how influence-peddling arises. Not a >very healthy development, even for a cynic like me. Heinlein suggested something similar (along with a few other "alternative" forms of government) in the afterword to "Who Are The Heirs of Patrick Henry" in _Expanded Universe_. Heinlein suggests: "A State where anyone can buy for cash (or lay-away installment plan) one or more franchises, and this is the government's sole source of income other than services sold competitively and non-monopolistically. This would produce a new type of government with several rabbits tucked away in the hat. Rich people would take over the government? Would the, now? Is a wealthy man going to impoverish himself for the privilege of casting a couple of hundred votes? Buying an election today, under the warm body (and tombstone) system is much cheaper than buying a controlling number of franchises would be. The arithmetic on this one becomes unsolvable...but I suspect that paying a stiff price (call it 20,000 swiss francs) for a franchise would be even less popular than serving for two years." Personally, I favor his government that requires an intelligence/knowledge test before a person can vote. I especially like his "Improving the Breed" variation on this one. :-) BTW, he also suggests the government in Twain's _The Curious Republic of Gondor_, but I've never read this book. Can anyone describe the goverment posited in this book? Ken ============================================================================= Ken Kirksey kkirksey(a)world.std.com Mac Guru & Developer - ----------------------------------------------------------------------------- And the Clinton administration launched an attak on people in Texas because those people were religious nuts with guns. Hell, this country was FOUNDED by religious nuts with guns. - P.J. O'Rourke -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLkD2AusZNYlu+zuBAQHsoQP9F/DcR8QUMpdCz7nfLlsUE1+kbJRDb6FC h3/613tR3IqRcKCj15nIg0QLYGH+OtcgPRskAJypPupZOS7+IZkeUk2bOPg57K0t H8UQbXY/xoc2WOUBKGsnXQnoBYQPvftU/M0V7t9ygVqGVFKIMapoVt+nXxYIsBLa EV54B/+2fsg= =KhXR -----END PGP SIGNATURE-----

1 0

Re: alt.anonremailer.net
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> I'm not sure how big of a problem this is. A remailer which > was there 3 or 4 days ago is _probably_ still going to be > around. The software can look at the date on the article, > and ignore articles that took an enormous amount of time > to get there, like say 2 weeks or something. But I think 3 or > 4 days might be acceptable. What do you think? > It is certainly better than anything we have now. One nice thing about your idea is that it can be brought online in steps. It doesn't require all remailers to suddenly switch over to using alt.anonremailer.net. > I'm not sure what you mean by "ping". Any of the "ping" mechanisms you mentioned would work (some better than others). There's no need to limit the "ping" to a single mechanism. The "I am here" messages could have a field indicating the different "ping" mechanisms the remailer supports. Again, this could start out to by a NULL field, and could be added to incrementally, as remailers get more sophisticated. Jim_Miller(a)suite.com

1 0

Re: Egalitarianism vs. Strong Cryptography
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 08:01 AM 8/4/94 -0400, Perry E. Metzger wrote: > >I'm not certain you understand the tremendous economic pressure that >taxes bring to bear. True enough. Note that untaxed income is worth almost twice as much as taxed income. An efficient market will exert tremedous pressure to shave even 1% off a price spread. Income taxation gives us a juicy 40%+ "price" spread to cut out. Vast profits. >> In a society where taxes were managable, and put to a use all >> citizens felt was worthy, such forces would be much less and >> there would be enormous peer pressure on individual citizens to >> do their fair share. > >And if my grandmother had wheels she'd be a bicycle. It isn't >happening now -- the trend is towards larger taxes, bigger government >and more repression, not less. In a marketing war between private companies and the government in which the government can't use force (because the contest is conducted over the nets), the government loses. It just can't compete. No value added. DCF "Who's proud to be called a social Darwinist by Her Royal Clintoness (HRC)."

1 0

Re: Remailer ideas (Was: Re: Latency vs. Reordering)
by Jonathan Rochkind 17 Dec '03

17 Dec '03

> * Rochkind's stability-from-being-paid and web-of-trust notions I'm not sure I like being credited with the "stability from being paid" notion. I think there _is_ stability from being paid, but I think if the infrastructure depends on it, it's not a good infrastructure. The system should be able to create a stable top-level infrastructure on top of an inherently instable environment, with remailers going up and down, and popping into existence, and dying. It should route around dead remailers, like the internet itself. > Where email is used to transfer messages, the format used should be > a subset of that specified in the SMTP RFCs. Restricting the structure of the headers would simplify the remailer software at little cost to the user. > > The use of alt.x groups to exchange gateway information does not seem > to add anything to this system; in fact it would seem to make it easier > to spoof the system. It _would_ make it easier to spoof the system, but I think it does add several very important things: 1) New remailers can easily announce themselves to the remailernet. [Whether they are to be trusted or not should depend on pgp-signed keys and web of trust, but the newsgroup provides an way to announce yourself to the system, and have that announcment by automatically dealt with by all participating parties] 2) Users (not people operating remailers, people using them) could make use of the newsgroup, to compile a database of remailers, and make long remailer chains. Users could have automated software doing this. [again, taking account of web-of-trust through signatures]. Messages posted to the newsgroup could include information on whether the remailer is free, or whether ecash is charged, and the user's software could automatically take account of this, enclosing ecash certificates in the proper encryption blocks for for-profit remailers. (and reporting costs to user for approval, of course). These are really two facets of the one problem, of allowing a user or remailer who has just arrived on the seen to quickly get a list of remailers, and make use of them, all automatically. That's sort of the super-set problem which encompasses the other two, and whose solution solves the other two. I don't think it's a coincidence that the newsgroup system solves these two problems at the expense of security (the newsgroup makes it easier to spoof). I have a gut feeling that any solution which solves these problems is going to be at the expense of security. But I think these two problems need to be solved if we want to create an easy to use, low-human-maintance, infrastructure in a universe of hundreds of remailers. The fact is, that even remailers exchanging mail _can_ be spoofed, if not quite as easily as the newsgroup idea. It seems to be a premise of cryptographic protocols and schemes, that you've got to assume a worst case and get a system working where even under the worst case, everything works. I think this is a good way to work, and that's why you've got to assume that if it can be spoofed, it will be spoofed. And you've got to build in a web of trust relying on cryptographically secure signatures, instead of relying on false security you get from thinking that it hasn't been spoofed just because it would be a little bit dificult to do so. Once you adopt this frame of mind, the newsgroup method is just as secure as the mail method (both can be spoofed, but you rely on web-of-trust to prevent spoofing from doing any harm), but the newsgroup method solves the two problems I brought up. I agree that it seems a good idea for the SMTP RFCs to be used to exchnage info, and we could post to the alt.remailernet newsgroup with articles that adhere to the SMTP RFCs, even though that isn't exactly what the those RFCs are intended for. Although we almost certainly need some agreed upon standards in addition to the SMTP RFCs, because there is additional information we want to exchange.

1 0

URGENT: Please Tell Congress to Allow Encryption Export
by corpuz＠internex.net 17 Dec '03

17 Dec '03

House Intelligence Committee holds key to Crypto Export ask(a)eff.org June 9, 1994 *DISTRIBUTE WIDELY* Today, the U.S. State Department controls the export of most encryption, working closely with the National Security Agency (NSA) to limit products that provide real privacy, from cell-phones to PC software. A bill introduced by Rep. Maria Cantwell would instead give authority over non-military crypto exports to the Commerce Department. Commerce has much more reasonable regulations, with "First Amendment"-style unlimited publishing of publicly available software, including PGP, Kerberos, RIPEM, RSAREF, and mass-market commercial software. The bill also prevents the Commerce Dept. from tightening the regulations even if NSA somehow gets its tentacles into Commerce. A few months ago, you-all sent over 5600 messages to Rep. Cantwell in support of her bill, H.R. 3627. As a result, on May 18, the bill passed the House Foreign Affairs Committee by being incorporated into the Export Administration Act of 1994, H.R. 3937. Now the battle has become more intense. This portion of H.R. 3937 has been referred to the House Intelligence Committee with the intent to kill or severely maim it. We need your help again, to urge the Intelligence Committee to keep crypto export liberalization intact. The House and Senate Intelligence Committees, the only watchdogs for the NSA, tend to follow the agency's wishes when they wave the magic "national security" wand. They need plenty of input from the public that tells them that the nation will be *more* secure with good encryption, even though the NSA will be less happy. Not just computer users, but all users of telephones, cable TV, health care, and credit information systems would benefit from this change. The security of these applications is built on the foundation laid by the operating systems and network protocols on which they run. If this bill is passed, you will see high quality encryption built into Microsoft Windows, into the MacOS, into major Unix workstations, into the Internet, into cellular phones, into interactive television. The software already exists for confidentiality, privacy, and security of local and networked information, but it's not built-in to these systems because of the export ban. Today, each company could build two operating systems, one gutted for international use, but this would be costly and confusing for them and their customers, and would not allow international networks such as the Internet or telephones to be made secure and private. With this bill, these limits disappear. Furthermore, the Clinton Administration plans to permit high volume exports of Clipper products, while continuing to require tedious paperwork for truly secure encryption products. The bill would give Clipper and other crypto software more even-handed treatment. The bill also eliminates a senseless situation on the Internet. Today, crypto software can only be freely distributed from non-U.S. archive sites. It would eliminate that problem as well as the threat of prosecution against U.S. freeware authors of crypto software. This is the dream we've all been working toward. Here's how you can help to make this dream a reality. The Intelligence Committee must make its decision on the bill before June 17, so time is critical: 1) Fax a short letter TODAY to the chair of the Intelligence Committee, Representative Dan Glickman (D-KS). Ask him in your own words to leave the encryption provisions of H.R. 3937 intact. Use a positive tone ("Please support...") rather than a flame or a rant. One paragraph is fine. State your title and organization if you will look more important or better informed than the average citizen. Rep. Glickman's committee fax number is +1 202 225 1991. This is the best option, since individual letters are given the most weight by members of Congress, particularly when sent on letterhead paper. 2) If you are unable to fax a letter, send an e-mail message to Rep. Glickman at glickman(a)eff.org. Software or staff at the Electronic Frontier Foundation will either fax it in, or print it out and hand-deliver it for you. 3) Send a copy of this message to everyone you know in Kansas, and personally urge them to write to Rep. Glickman today. Letters from constituents get a lot more weight, since they are from people who could actually vote for or against him in the next election. 4) If your own Representative is on the Intelligence Committee, send him or her a copy of what you sent Rep. Glickman. There's a list of all such Reps. below. Even if we lose this battle, you will have started educating your own Rep. about crypto policy. 5) Become a member of EFF. Our strength comes from our members' strength. Send a note to membership(a)eff.org asking how to join. Thanks again for your help! You can check at any time on the current status of the campaign at the location below. Send any comments on this campaign to campaign(a)eff.org. John Gilmore Chairman, EFF Crypto Committee EFF Board of Directors Member of Computer Professionals for Social Responsibility Member of International Association for Cryptologic Research House Intelligence Committee Members ------------------------------------ Subcommittee phone: +1 202 225 4121 Subcommittee fax: +1 202 225 1991 <== send your fax HERE <== p st name phone fax ___________________________________________________________________________ D KS Glickman, Daniel +1 202 225 6216 private Chair D WA Dicks, Norman D. +1 202 225 5916 +1 202 226 1176 D CA Dixon, Julian C. +1 202 225 7084 +1 202 225 4091 D NJ Torricelli, Robert +1 202 224 5061 +1 202 225 0843 D TX Coleman, Ronald D. +1 202 225 4831 +1 202 225 4831 D CO Skaggs, David E. +1 202 225 2161 +1 202 225 9127 D NV Bilbray, James H. +1 202 225 5965 +1 202 225 8808 D CA Pelosi, Nancy +1 202 225 4965 +1 202 225 8259 D TX Laughlin, Gregory H. +1 202 225 2831 +1 202 225 1108 D AL Cramer Jr, Robert (Bud) +1 202 225 4801 private D RI Reed, John F. +1 202 225 2735 +1 202 225 9580 D MO Gephardt, Richard A. +1 202 225 2671 +1 202 225 7452 R TX Combest, Larry +1 202 225 4005 +1 202 225 9615 R NE Bereuter, Douglas +1 202 225 4806 +1 202 226 1148 R CA Dornan, Robert K. +1 202 225 2965 +1 202 225 3694 R FL Young, C. W. (Bill) +1 202 225 5961 +1 202 225 9764 R PA Gekas, George W. +1 202 225 4315 +1 202 225 8440 R UT Hansen, James V. +1 202 225 0453 +1 202 225 5857 R CA Lewis, Jerry +1 202 225 5861 +1 202 225 6498 R IL Michel, Robert H. +1 202 225 6201 +1 202 225 9461 The full text of this alert is stored at: ftp.eff.org, /pub/Alerts/export.alert gopher.eff.org, 1/Alerts, export.alert http://www.eff.org/pub/Alerts/export.alert BBS (+1 202 638 6120, 8N1): "Alerts" file area, export.alt The actual text of this part of H.R. 3937 is at: ftp: ftp.eff.org, /pub/EFF/Policy/Crypto/ITAR_export/hr3937_crypto.excerpt gopher.eff.org, 1/EFF/Policy/Crypto/ITAR_export, hr3937_crypto.excerpt http://www.eff.org/pub/EFF/Policy/Crypto/ITAR_export/hr3937_crypto.excerpt BBS: "Privacy--Crypto" file area, hr3937.crp For current status on the bill: ftp.eff.org, /pub/Alerts/export_alert.update gopher.eff.org, 1/Alerts, export_alert.update http://www.eff.org/pub/Alerts/export_alert.update BBS: "Alerts" file area, export.upd A general Web page on crypto export policy is at: http://www.cygnus.com/~gnu/export.html ----- End Included Message ----- ************************************ Chris Corpuz * InterNex Information Services, Inc.* 1050 Chestnut St., Suite 202 * Menlo Park, CA 94025 * v.(415) 473-3060 * f.(415) 473-3062 * ************************************

3 2

Censorship/protecting children is not on topic...
by Tommy the Tourist 17 Dec '03

17 Dec '03

This debate about protecting children from censorship, et al is great, but arn't we veering off the charter/topic of this mailing list? ------------ To respond to the sender of this message, send mail to remailer(a)soda.berkeley.edu, starting your message with the following 8 lines: :: Response-Key: the-clipper-key ====Encrypted-Sender-Begin==== MI@```%E^&2?(E<U9BPG1]W7L'=&KH_PWY8"RO>+Y2-*'0G?5^"B<Y9[>%&EG M0_U[L1(6_(\$"))OK>(OA8H+I%T@3K;%1ON[7^#@]3[:`$.O0\]*<1^R&ZKY $R7JWF@`` ====Encrypted-Sender-End====

1 0