December 2003 - cypherpunks-legacy

Another Civil Liberty Group
by Dave Banisar 17 Dec '03

17 Dec '03

Date 9/23/94 Subject Another Civil Liberty Group From Dave Banisar To Cypherpunks List Another Civil Liberty Group Opposes Wiretap Bill The American Civil Liberties Union (ACLU) today wrote to Rep. Jack Brooks, Chairman of the House Judiciary Committee, "to express the ACLU's opposition to the FBI Wiretap Access Bill, H.R. 4922." The organization's position is the latest indication that the legislation is running into serious trouble in Congress for several reasons, including strong opposition from civil liberties and privacy advocates. The bill's proponents had initially hoped to bring it to a vote on the floors of the House and Senate by mid-September. Instead, the bill remains in committees of both houses and is the object of a grassroots campaign to prevent its enactment. Excerpts from the ACLU letter: "The principal problem remains that any digital telephone bill which mandates that communications providers make technological changes for the sole purpose of making their systems wiretap- ready creates a dangerous and unprecedented presumption that government not only has the power, subject to warrant to intercept private communications, but that it can require private parties to create special access. It is as if the government had required all builders to construct new housing with an internal surveillance camera for government use. ... "Moreover, the FBI has not borne the burden of proving why such an extraordinary requirement is necessary. ... "H.R. 4922 proposes a radical and expensive change in our telecommunications structure. The threats it poses, now and prospectively, are real, but the need for it is far less than evident or proven. We urge that your Committee not rush into consideration of this far reaching measure with so little time left in the session." The Electronic Privacy Information Center (EPIC) is urging all concerned individuals and organizations to contact the following members of Congress immediately: Rep. Jack Brooks Sen. Howard Metzenbaum (202) 225-6565 (voice) (202) 224-7494 (voice) (202) 225-1584 (fax) (202) 224-5474 (fax) For more information about the FBI Wiretap Bill, check the Voters Telecomm Watch (VTW) gopher site (gopher.panix.com) or send e- mail to <info(a)epic.org>.

1 0

Re: kerberosV telnet
by Jef Poskanzer 17 Dec '03

17 Dec '03

>> Anyone have any fun diffs for kerberized telnet/telnetd that I could >> play with? An IDEA encryption module? A Diffie-Hellman module? >> Standards not necessary, we're just experimenting here. > >The Cygnus release of Kerberos v4 contains much of what you want. The >4.4 BSD version of Telnet also contains much of what you want. "That turns out not to be the case." The version of CNS that we have doesn't have any encryption beyond DES. 4.4BSD telnet is basically identical to kerberosV telnet, and the only encryption it has is DES. You may have misunderstood my message, assuming I was looking for patches to some random unspecified version of telnet to make it kerberized and give it IDEA and DH capabilities. That would have been a stupid request to make. Thanks for the compliment. Let me be crystal clear this time. We have kerberosV telnet. It has DES encryption, and a few authentication options that do not include Diffie-Hellman. I am curious whether anyone has already started playing with adding new encryption and authentication modules, for example IDEA and DH. --- Jef

2 1

ATT logo wanted
by merriman＠metronet.com 17 Dec '03

17 Dec '03

Has anyone got a copy of the AT&T logo, or know where I could find one? I'd prefer a vector format, but would accept .gif, etc. I'd like to see if I can put the deathstar logo and the "Had your phones tapped...." tagline on a bumper sticker :-) Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

SlapSticks
by merriman＠metronet.com 17 Dec '03

17 Dec '03

Okay, I've printed my first set of bumper stickers, using the W&M bumper sticker stock for laser printers. It prints out *great*, and the "removeable" adhesive seems to have enough holding power to keep in on a car, but not so much as to become a permanent fixture (anyone seen a Bush in '92 bumper sticker of late? :-). I guess I'll find out this winter how well the SlapSticks withstand wind, rain, etc. here in north Texas... Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

Re: Laws Outside the U.S.
by Pierre Uszynski 17 Dec '03

17 Dec '03

> From: Phil Karn <karn(a)qualcomm.com> > Okay, how about the text of the French law regulating cryptography? > It's available as http://www.ens.fr/equipes_dmi/grecc/loi.html. It's > in French, and unfortunately my 3 years of high school study aren't up > to the task. Anybody out there fluent in the language who would care > to prepare an English translation? OK, here is a first shot at the translation of the French law articles that were reported to be posted at: http://www.ens.fr/equipes_dmi/grecc/loi.html There are still a few questions I need to ask the original transcriber (who left no email address of course), or others. So, for now, consider this a limited private distribution, for cypherpunk eyes only. I'll repost with the answers later (If and when I ever get them.) Given the latest entertaining news from France, simply translating French law into English may be a crime. American officials would add: "Yeah! That's it!, even for foreigners operating outside their/my/any country!" :-) As to the quality of the translation: I'm not an american lawyer, nor a french lawyer, and any given legal paragraph can usually be interpreted either way. This may not even be my reading tomorrow... To avoid confusing things even further, I'll limit my comments in the translation to remarks concerning the translation itself, in square brackets []. And don't blame me for the quality of the English, the French itself is laughable (although much more understandable than tax law, let me tell you :-) The drastic editing is the responsibility of the previous transcribers. All typos are my computer's fault. I wasn't even there. Pierre. pierre(a)shell.portal.com +++++++++++++++++++++++++++++++++++++++++++++++++++ [French] Law number 90-1170, published in the "Journal Officiel" of December 30, 1990. (The first 27 articles concern the encryption of information transmitted via radio or mail.) Article 28. - By cryptologic services, one means all services aimed at transforming through secret conventions information or clear signals into information or signals unintelligible by third parties, or at achieving the reverse operation, via means, hardware or software, designed to that end. To preserve the interests of defense and internal or external national security, the supply, export, or use of cryptologic means or services are subject: a) to prior declaration when this means or service can have no other use than authenticating a communication or than ensuring the integrity of the transmitted message. b) to prior authorization by the Prime Minister in all other cases. A decree of the "Conseil d'Etat" [President and some ministers, if I recall] determines the circumstances in which the declaration is filed, or the authorization granted, as per the previous paragraph. This decree can make provisions for a simplified system of declaration or authorization for certain types of equipment or services, or for certain categories of users. II. - In addition to the provisions of the customs code, anyone having exported a cryptologic means, or having provided or made to be provided a cryptologic service without the authorization mentioned in paragraph I of the present article, will be punished by a fine of 6000 F [US$1,200] to 500 000 F [US$100,000] and by imprisonment of one to three months or by one of these two sentences only. The court can, in addition, forbid the person from requesting this authorization for a period of at most two years, or five years for subsequent offenses. In case of conviction, the court can, in addition, pronounce the forfeiture of the cryptologic equipment. III. - In addition to police officers and customs officers in their jurisdiction, agents authorized for this purpose by the Prime Minister and sworn in the conditions specified by the "Conseil d'Etat", can investigate and report by a [sworn, whatever] statement any violations of the present article and of the corresponding regulations. Their statements are forwarded within five days to the "Procureur de la Republique" [district attorney ?]. They can enter business locations and transportation means, request the disclosure of any business documents and take copies of them. They can, on location or by convocation, collect information and justifications. +++++++++++++++++++++++++++++++++++++++++++ Decree Number 92-1358 of December 28, 1992, published in the "Journal Officiel" of December 30, 1992. Decision of December 28, 1992 about declarations and requests for authorization relative to cryptologic equipment and services. ... Art. 4 - Require prior declaration, the provision, export, and use of any cryptologic equipment and services ... in particular : - The equipment, hardware or software, susceptible to ensure the confidentiality of communications of any nature, or the confidentiality of data stored in memory; - Cryptologic services that ensure the confidentiality of all or part of a communication, or of data stored in memory; - Cryptoanalytic equipment and services. [This "declaration" article may in fact be an "authorization" article. That would be a pretty major mistake of the previous transcriber, and needs confirmation.] Art. 6 - Smart cards that do not allow, in and of themselves, that is without the need for external cryptologic devices, to ensure the confidentiality of communications, benefit of the same declarations filed and authorizations obtained for the equipment and services with which they are used. Art. 7 - Are not considered cryptologic equipment, the means, hardware or software, specifically designed for the protection of software against illegal copying or use, even if they use methods or devices kept secret, on the condition that they do not allow the encryption, either directly or indirectly of that software package. ... Art. 9 - In case of uncertainty of the requestor, as to whether some equipment or service belongs to the category of cryptologic equipment and services, the central service for the security of information systems is consulted. Paris, Decmber 28, 1992. French version according to Jerome RABENOU Student at the Villetaneuse Law School. Paris - France. (may have been edited by webmaster Florent.Chabaud(a)ens.fr) Tentative translation: Pierre Uszynski. pierre(a)shell.portal.com

1 0

RE: It's MEME time!!!
by Allen Robinson 17 Dec '03

17 Dec '03

On Fri, 23 Sep 1994, merriman(a)metronet.com wrote: > How 'bout: > Dorothy Denning: Clipper > [clip her] > > TLA's are AFU > > Dammit, it's *my* net, too! Very good. If I could offer one minor change, how 'bout: Dorothy Denning? Clip 'er! No intent to nitpick on my part. I think they're all deserving of meme-hood. They would make darn fine bumpersticker copy, too. AR

7 7

Re: National Research Council
by iris!CN=Ray_Ozzie/O=Iris＠uunet.uu.net 17 Dec '03

17 Dec '03

You shouldn't immediately dismiss the establishment as being unsympathetic; many of us are working toward common goals, but in different ways. In my case, since '84, through mass commercial distribution of strong crypto. While you can obviously trust no one to represent your interests with 100% accuracy, I've been here for a while and will most definitely be trying to represent CP viewpoints through my perception of those expressed in this forum. Ray

1 0

OTA releases report on Encryption
by Doug Shapter 17 Dec '03

17 Dec '03

>From the Washington Post, Sept. 23. (please ignore typos) ---- _Delay Urged on Encryption Technologies_ by Elizabeth Corcoran WP Staff Writer The Office of Technology Assessment, in a report to be released today, suggests that Congress consider stopping the Clinton administration from using some the data encryption technologies that have aroused public criticism until legislators can review the policies. Industry and public policy groups have continued to critize he adminstrations plan to rely on specific technologies for encrypting phone and computer messages since it was made public in early 1993. Studies by the OTA, which reports to Congress, usually outline a spectrum of public policy recommendations. In contrast, those familiar with this report say it takes an unusually strong stand. It suggested that legislators take an active role in issues such as "key excrow" encryption, a technique that would let the government crack scrambled phone and computer messages by putting the means for unlocking such communications into the hands of a designated grou, such as a government agency. "It's essential to have an open debate before putting key escrow into place," said Joan Winston, who directed the OTA report. "Given the government's track record so far, the only place that debate can take place openly is in Congress." Ray kammer, deputy director at the National Institute of Standards and Technology, said the OTA reports fairly portrays both sides of the encryption debate and that the adminstration "expects and welcomes" additional discussions. Even so, he added, " the administration needs to move adhead with the key escrow system on a strictly voluntary basis." With recess only a few weeks away, Congress is unlikely to act on the adminsistration's encryption policies this year, sources said. Sen William V. Roth (R-Del.), who requested the OTA study, said in a prepared statement that he intends to call for hearings and offer admendments to the Computer Security Act, which comes up for review next year. --- Doug Shapter dps(a)kafka.atinc.com

1 0

Fwd: Anonymous Long Distance Phone Calling
by Matthew J Ghio 17 Dec '03

17 Dec '03

I thought this might be of interest to cypherpunks. Especially the part about encryption... I would also be interested to know if anyone has dealt with this company (reputation and so on). ---------- Forwarded message begins here ---------- Return-path: <LeslieR2(a)aol.com> From: LeslieR2(a)aol.com X-Mailer: America Online Mailer Sender: "LeslieR2" <LeslieR2(a)aol.com> Message-Id: <9409241357.tn28073(a)aol.com> Date: Sat, 24 Sep 94 13:57:47 EDT Subject: Re: Anonymous Long Distance Phone Calling TRACELESS CALLS. Call the U.S. and most of the world withoutmaking a permanent record on your telephone bill of whom you are calling. When you utilize these phone cards (debit calling cards), you take the first step in achieving complete privacy in your long distance phone or fax calling. OVERVIEW: The phone card is used like any other phone cards, instead of making a permanent record of your call with either a calling card or charged to your home phone, you use a pre-paid debit card. Useage is very simple:You first call a toll-free 800 number, and then you will be instructed by the computer to enter your PIN number. The computer will notify you of how many $ worth of calls you have left. Then you will be able to call your long distance number (U.S. or worldwide) with complete anonymity. The card can be used from any touch-tone phone, at home, the office or on the road from any pay phone without needing any coins. The computer will notify you when you have only one minute left on your card. HOW TO PURCHASE YOUR CALLING CARD: You send a $50 or $100 blank Cashier's check, or cash, to the address stated below. I have purchased a pile of PIN cards and I randomly select one and send it to you. The company I buy these cards from, keeps no records, if they did, all records of sales are to me in my name unfortunately. I keep no records of addresses or PIN numbers who I am sending to. After you receive your card you go about making your calls and then when you want to add more time to your calling card (recharge the card), This is where you gain another level of privacy, because I step out of the loop and you will communicate with Traceless, the providing company, directly. You send a money order or cash and your PIN number to the address provided on the card and they will recharge the anonyous PIN number with the amount sent. You put no name or return address on the envelope. Since all they did was send a pile of cards to me and I sent them out they have no way of knowing who what or where the cards went to. Alternatively, for those who have an offshore Visa, MasterCard or American Express accounts, you can set it up so that your PIN account can be credited by certain amounts when you hit a certain key while making phone calls to the special 800 number. If this option is appealing to you, let me know and I can send some more information. Also for those that need voice encryption that option is available. Again if you want more info on this let me know. THE COST: When making long distance calls the charge will be 35 cents per minute anywhere in the United States. If you make calls to Canada the charge is 70 cents. Prices to other parts of the world depend on where. If you need the list of the countries and their charges let me know, most countries of the world except some third world countries. If you have anymore questions please let E-mail me and I will try to answer them.Otherwise mail your checks and take your first step towards greater telecommunications privacy. Reach out and call without your telephone bill reaching back and haunting you. R & L PO Box 1492 Yakima, Wa. 98901

2 1

Re: kerberosV telnet
by Jef Poskanzer 17 Dec '03

17 Dec '03

Perry Metzger: >Jef Poskanzer says: >> "That turns out not to be the case." The version of CNS that we have >> doesn't have any encryption beyond DES. 4.4BSD telnet is basically >> identical to kerberosV telnet, and the only encryption it has is DES. > >The 4.4 telnet is NOT identical. Its much better code, has lots of >neat new capabilities that you probably want, is more modular, and the >versions I saw had hooks for D-H and the like, which is where most of >the work is -- you can get the D-H code from RSAREF and steal the IDEA >code from PGP; from there the changes are small. I just did a diff -r between the Kerberos V telnet/telnetd/libtelnet and the 4.4BSD version. From 1.5 MB of source code I get 40KB of diffs. In my book a 2% difference qualifies as basically identical. Plus 90% of the diffs were memcpy/bcopy changes. I know there are nice hooks in the code for adding new encryption and authentication modules. I know it would be relatively easy to add IDEA and DH. That's why I'm asking whether anyone has already done it. Do you get it this time, or should I go for four? Perry, why don't you let someone else reply this time? --- Jef

2 1