December 2003 - cypherpunks-legacy

re: LEAF, SS7
by m5＠vail.tivoli.com 17 Dec '03

17 Dec '03

It may be that traffic analysis of Clipper conversations is a question orthogonal to the switching system employed to establish circuits, but the question remains: does the presence of LEAF blocks on circuits simplify the task of traffic analysis? Methinks it does, particularly as the network gets more complicated. While it's tempting to think of this as a clever back-door way of getting some of the FBI "tap-o-rama" proposals implemented, it's not really interesting until nearly everybody is using a Clipper phone. Consider this little flight of fancy: what if, "in the interest of the privacy of the subscribers", Clipper hardware is installed right in each end-office switch? Thus, every phone call is Clipper encrypted as it passes through the network, even if I don't have a Clipper phone. It might even be that Clipper hardware could be installed right at the network interface. Isn't that nice, the phone company is going out of its way to safeguard my privacy. Only thing is, now every circuit I establish is tagged by an LEAF that identifies me... Oh well, enough paranoia for now. -- | GOOD TIME FOR MOVIE - GOING ||| Mike McNally <m5(a)tivoli.com> | | TAKE TWA TO CAIRO. ||| Tivoli Systems, Austin, TX: | | (actual fortune cookie) ||| "Like A Little Bit of Semi-Heaven" |

1 0

I've got the big bro inside postscript
by Matt Thomlinson 17 Dec '03

17 Dec '03

send me mail if you'd like a copy; I assume it'll be up on the cpsr.org ftp site soon, but.. I hadn't previously released it, but I just made a dump from the .cdr file... mt (it is around 60k .ps, 28k .ps.Z). Matt Thomlinson Say no to the Wiretap Chip! University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 548-9804 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

1 0

Detweiler abuse again
by qwerty-remailer＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Eric, could you repeat that in English, after those drugs wear off ;-)? >maxim, Strengthen all parties, opponent model of universal network >monitoring, identity-based, IP-based entry point, server daemons, >reason for use and development, profoundly broken for the long run, >100% completely distributed salience filter, newsgroup topicality, >everybody has to stay on topic, no exceptions. Please. No offense dude, honestly, you obviously are thinking on a great scale, very fast, but could you recapitulate your ideas in the morning so the rest of us can understand what you are trying to say? -=Xenon=- -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLWAeKQSzG6zrQn1RAQHyjwP9F9GYwLQWvjs+Phd0kOsYQseCFjeH/jLj jbQNSLrpOnCm1+jL1hc8Ewv837Bvz/VDcc6Aw/exnemX/8SUw7sZ4V1by7tsKYc+ W2TZTWV0wmfSGyEmrZJrDXUc1issXwKbEgqPoAEbidLbu4ZuqJEbeciaPFb7R7h5 iIjE/3JlDM4= =loKk -----END PGP SIGNATURE-----

1 0

Re: Clipper and Traffic Analysis
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> The reason I ask is, I have this sense that one reason the > government likes Clipper is that the Law Enforcement > Access Field enables agents to draw inferences about > who's talking to whom and what they're saying, even > without decrypting the actual communications. > Is it true that law enforcement can obtain phone records from the phone company simply by asking? Or do they need a supena(sp)? It would not surprise me in the least to hear someday that the government will allow law enforcement to record LEAFs without having to obtain a warrant for a wiretap. If Clipper becomes widespread, and most conversations are encrypted, the government might conveniently redefine the term "wiretap" to mean "decrypting a Clipper conversation". This would open it up for the government to continuously monitor and record LEAFs, probably via the soon to be mandated "wiretap" capabilities the FBI is pushing for. "After all, the LEAF is just the electronic equivalent of your phone record. This new definition of "wiretap" does not give law enforcement any new capabilities. Since the actual contents of the conversation are encrypted, there is no invasion of privicy. We're just trying to keep up with the latest technological advances." Jim_Miller(a)suite.com

2 1

Detweiler remailer abuse
by qwerty＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I can't take life seriously enough to censor old Larry. I can't take the IDEAL of the First Amendment lightly enough to do so either. And afterall, he wasn't the one who wrote that "Blacknet" blurb. I find it amusing to see uptight fuck-wads from specialized narrow minded Usenet groups yelling about someone sending something to their precious little group that upset them. Abuse away Larry. Show us that we really DO need dumb optical fibers between laptops instead of this tight-assed RFC standardized World Wide Wiretap we call our playground. We need a new net guys. -=Xenon=- <qwerty(a)netcom.com> -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLWA4nQSzG6zrQn1RAQE1ygQAhOXiq/M11xIMNHxfdQUjgC+qBtWVx6IL WklpjXroNgb2mc4Xjqh2i/Pw4PZ39ecZYsdeIs7BViWw3FuAE+GAvqCAL8+tI5Hv Il5NxyNj/k8NqRhZY9YjWv7zzFZ9VKl1ifj4/eScEKcF6ZkbyaCrUAVJTXkJlcyx nTRfsFFYFLA= =Fbyt -----END PGP SIGNATURE-----

2 1

RE: REAL WORLD ENCRYPTION
by Pierre Uszynski 17 Dec '03

17 Dec '03

Sandy writes: > I want to know what the > people on this list intend to do with cryptography in the "real > world." I want to move many of the transactions I do today via snail mail, credit cards, and cash, to electronic medium. Receive bills in email (authenticated and encrypted), pay them in email (e-checks) on a digital bank. Receive statements from the bank in email (authenticated and encrypted). Track the complete transaction in the same medium, mostly automatically, via my email agent. In what can be done now, the systems are disparate, ad-hoc, non-integrated, insecure, expensive, incompatible, etc... in short: junk. And none of the existing systems apply to transactions between individuals. I want transactions between individuals to become practical. I want a complete and usable electronic commerce setup usable not only between me and utilities (phone, electricity, internet), but between me and most other entities (employer pay and expense refunds, rent, other individuals), including across borders, of course. Not only do I want it "integrated" and "open" so I can use it with whoever I damn well please, but I want it light-weight, so payments in pennies become routinely feasible. Efficient payments in pennies allow stuff like routine digital postage, and routine remuneration of authors "as I read", as in shareware books, magazines, and newsgroup postings. I strongly disagree with people who lightly dismiss what they call "digital postage". I think that allowing for digital pennies as part of a general digital payment system would open the door to many useful applications in, yes, pay-per-use ftp, and generally individual pay-per-use access to databases. But both PGP and e-momey won't work until people's mailers and newsreaders allow them to use them easily (that is, until people quit getting stuck with Microsoft's stuff). Even the Unix mailers and newsreaders are not getting updated anywhere quickly enough. That means the first commercial crypto-applications may have to provide the hooks themselves, or rely on what others like General Magic are doing. A pointer to how far we are is that many people still get spooked by 50 messages a day list traffic, and desperatly try to unsubscribe quickly. This means they don't even have a mail preprocessor (procmail, deliver, etc...) A pointer to how close we are is that 3 years ago, this discussion would not even take place, and these pre-processors did not exist yet. Also that people are now opening commercial MUDs. BTW, none of the applications I'm interested in would require IP-level transactions, all would work fine with email-level transactions. That's good, because little of the windows market is going to get IP connectivity anytime soon, whereas most will get email and fax connectivity. The stuff that is being done now is in the right direction, but frankly, it's still too fragmented and impractical to see much use (and that's why I'm not bothering to sign this message). Anonymous posting is the only "application" that sees much use, and even then, I guess it's not fully understood by many users (na vs an, "identity leak", etc...) Pierre Uszynski, pierre(a)shell.portal.com

1 0

Hardware Random Numbers
by arif＠stat.fsu.edu 17 Dec '03

17 Dec '03

I am looking for a source for Harware Random Numbers for a PC. I would like it to be a simple plug-in, but need it to be fast (at least 100K, preferrable 1 Meg bytes/sec), and good (in randomness properties). Any FAQ, pointers, adresses, phone-numbers, e-mail addresses, etc... would be apreciated.

1 0

Clipper and Traffic Analysis
by Mike Godwin 17 Dec '03

17 Dec '03

Does anyone here have any thoughts as to whether Clipper enables traffic analysis or tracing more easy than it normally is under Switching System 7? The reason I ask is, I have this sense that one reason the government likes Clipper is that the Law Enforcement Access Field enables agents to draw inferences about who's talking to whom and what they're saying, even without decrypting the actual communications. What do you think? --Mike

4 4

Re: Detweiler abuse again
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From: Derek Atkins <warlord(a)mit.edu> > > tcmay said: > > > I support Hal's proposal that as many remailer operators as possible > > attempt to filter Detweiler's postings. All it will take for Detweiler > > to get through is one who doesn't filter, and who supports encryption, > > but this will still make it harder for folks like Detweiler to abuse > > the system. > > I disagree. While I can honestly say that I don't like most Detweiler > posts, I feel that he is showing us the possibility of how remailers > can (and are) being abused. I think censorship is the wrong answer. > I think there needs to be some accountability, even if it is anonymous > accountability. I disagree that this is censorship. This is an issue that comes up again and again in anarchist circles. Censorship is understandably a thorny issue, especially among anti-authoritarians. However, I'm certain that this isn't it. Anarchy is all about decentralization (I'm trying to give a definition that all the different types of @'s on this list can agree with). When some central authority like the state tells you you can't publish something or say something in public, that's censorship. When I as a small publisher say "You're a Nazi, and I'm not going to publish your stuff" (something like this came up with a book I recently edited), that's me telling you that I'm not going to let you use my resources to print your shit. In a free, decentralized "economy" people get to decide how they want to make use of their own facilities. We are not obligated to let any lunatic in the world use the network that we've painstakingly set up and nurtured to trash that network or smear our names. We can argue among ourselves about policies, etc., but I don't think we need to show how anti-authoritarian we are by putting out a welcome mat for saboteurs, provocateurs, or whoever. All in all, I think people have been pretty tolerant of LD. --Dave.

1 0

Stealth PGP
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Several people have talked about the possibility of doing a stealth PGP by writing a filter to strip off the headers and another one to restore them. It's an obvious approach, but depending on how good a job you want to do, doing this independently of PGP is non-trivial. Several issues: - Doing a halfway job is pretty easy, but won't fool much of anyone rich and serious enough to de-steg every GIF or JPEG floating across the net, especially in countries that most need it, where telecommunications is narrowly controlled and legal procedures are irrelevant. On the other hand, deleting the PGP-ENCRYPTED-STUFF headers is enough to get you through a No-Encryption-Permitted BBS mailnet. - Each block of stuff starts with a Crypto Block Type byte and length info. For some blocks, including the first one or two, you know the block type (at least for the interesting cases), and could force the length to some standard length by assuming a maximum and doing a fixed format. Applying this to the multiple-recipients case is harder. - The public key block includes a 64-bit Key ID to tell PGP which key to use and whether to bother decrypting (if it's not for you.) You could omit this information, and on receipt put your own key in, but that does lose the ability to tell whether it's for you. I'd have to look at the PGP code a lot more to see if it would really mind. The right way to solve this problem would be to include a string easily recognized if you have the right public key and meaningless otherwise, such as a 64-bit random number repeated twice, encrypted with the recipient's public key, but at that point you need to involve the PGP code itself, since the sender needs to know the recipient's public key and how to encrypt with it, and the receiver needs to scrounge the private key out of the secret-key-ring with the passphrase. - The other block-types have similar problems, but once you've incorporated the new format with PGP, you could include any needed masking info in the first block. Hiding the block type and length is probably enough. - The formats are of course all different for non-encrypted messages with signatures, etc., ascii-armored or not, and other problems. - At one time somebody had said there was work going on about a new version of PGP somewhere outside the US patentspace, and had said that they were thinking about solving this problem as well as integration with MIME. That make this a Somebody Else's Problem, and, uhh, I forget what the rest of the problem was... :-) Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0