December 2003 - cypherpunks-legacy

some discussion of rannos in PGP (was: of a hole in PGP)
by A.Back＠exeter.ac.uk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Fred Cohen <fc(a)all.net> writes on cpunks: : PGP is a product that is specifically disliked by the powers that be : because it provides free access to strong cryptography which is against : the public policy of the US government. That means that people in that : same said government likely feel it is their duty to make certain that : they can still read PGP mail. Certainly granted! Hence persecution of Phil Z. A bit difficult to achieve in the presence of available source code, I (and many others) are using PGP compiled by themselves. That doesn't prove there are no subtle back-doors but it rules out unsophisticated backdoors in distributed executables. (Even such things could be checked if someone got suspicious, things can be reverse engineered). Now to the question of what can be done practically to help further validate PGPs authenticity, and freeness from back-doors. The way I see it the only attack which you could reasonably expect to pull off in terms of being subtle enough to hope to get away with given full access to source is the random number generator. The code which actually generates the random primes, and converts them to PGP output format is reasonably short and well defined. Wouldn't take long to single step that and watch that nothing happened on the way out to file. Encryption is a similarly simple operation, M ^ e % n you could easily check that manually (with a certain small piece of perl even). Same for generation of IDEA keys. I don't really feel qualified to comment properly on the random number generation, but to me (I looked at the source in fair detail) it looks good. I mean there is real entropy being generated (timing key strokes against a high speed clock on PCs lower on UNIX systems typically) and the stirring operation looks good, MD5 + XOR on key. Presuming that the MD5 implementation is correct? Seems a pretty good likelihood to be, it's been given enough real world tests that you could do a very nice probablistic statistical confidence test on it. Which would easily say that it was correct to some huge degree of certainty. The legitimacy of using a high frequency clock to time intervals between key strokes, seems a very good way of generating random numbers. I mean there is most definately *some* entropy being generated, PGP makes reasonably conservative estimates of the amount of entropy generated, and stirs the whole number in (not just the expected entropy). I'm not saying your comments aren't useful; they are, and analysis and critique of the random number generation in particular is very important. Indeed given the sheer cost of factoring a 2048 bit RSA modulus, or of brute forcing a 128bit IDEA key, it is indeed a pertinent question as to whether any kind of brute force attack could be generated on the random number generation, which could be slighly cheaper than either of these. 128bits is a lot to play with. To me it looks good, but then I'm not a cryptographer, and also there is the kind of "NP problem aspect" to it all in that for reasonably complex code it will not be apparent whether a proof is possible with out looking at the specifics. Still I think some analysis of the random number generation code would be useful work. I'm not expecting to see a flaw, but doesn't mean it shouldn't be entered into with an open mind. I think it does not fall in the same league as the apparent difficulty of having a secure sendmail (you said a compromising couple of bugs seem to get found a couple of times a year), for at least two reasons, one is that with sendmail the code being examined must take input from Charlie who is trying to mess the system up. So a deliberate attempt to foul the works, examining the source, looking for any kind of subtle weakness, or weird combination of inputs (which would almost certainly never occur by accident during normal usage) which could cause it to compromise security. For PGP for the section we are talking about (key generation) the only input comes from *you*, the person who is presumably trying to obtain security, not trying to generate a weak key through some tortuous input string. So things like the stack over flow with carefully crafted machine code for the particular architecture which was exploited with finger in the fave old example of the worm of yore, is not the kind of attack you need to be worried about (IMO). The second aspect in which analysing PGPs ran no generation, is different to sendmail or http type problems is that what PGP is doing with it's random no generation is well defined, contained in few lines of code, and only really relying on a couple of assertions: 1) MD5 is itself not inherently flawed 2) the MD5 implementation is correct 3) key stroke timings are a source of a safely conservatively estimatable amount of entropy 4) the key generation method does not narrow the search space 5) there are no other compromising bugs between key generation of the key and it being written to the keyring 1) Heh, not a lot you can do about that. Is it or isn't it? Time will tell. 2) Seems pretty likely to me there are test strings which come with the RFC implemenation, and it would be unbelievably unlikely that it should produce the complete set of tests and yet somehow still be flawed. Given that there are _no_ branches in the algorithm (ie just various permutations and bit twidlings based on the key info, which get mangled into the digest. 3) Pretty good I think, especially on a PC, which has a higher speed timer. Some entropy is surely generated, and with safe entropy estimation, and cryptographically secure stirring, it sounds pretty good to me. 4) For RSA keys, I don't think so, unless you believe that strong primes will agains become important. For current factoring algorithms strong primes are just as hard to factor as a completely randomly generated prime, except for certain primes which are in any have an infinitesimal chance of occurring. For IDEA keys there is little value added over a striaght ran no, as there are no special properties which an IDEA key must have. 5) I would assert is relatively trivial to demonstrate, a couple of hours with a debugger should demonstrate that. You could do testing more rigourously, test every branch, so that you have checked that the outcome is that the key gets written to the keyfile, with various options, not utterly fool proof of course, but pretty darn good given the simplicity. On the more philosophical side, with the idea that you can never be sure that folks aren't NSA agents with hidden agendas etc, well you can't be sure. But the open source and sheer number of folks reading is the best argument against this. That means that at least some true blue cpunks, "live free or die" types will read it in earnest, and examine very carefully. Another philosophical argument against PGP having any cleverly hidden "back-doors" in the form of purposefully weakened ran-no generators or what have you is that the NSA et all hate PGP with such vehemence. Heh if they don't like it, it must be good :-) And remember, say NO to key escrow :-) (It's no good having an ultra carefully validated PGP if you go to jail for being caught with a copy on your HD, welcome to the Land of the Freeh, and all you know. May happens sooner than expected, then the only folks using crypto will be the "live free or die" folks, plus of course the criminals who figure they have more to hide and would get in more trouble for what they are really up to than for a "possesion of crypto" charge.) Adam PS to any folks who may have sent me mail in the last couple of days, note the temporary change of email addr to: A.Back(a)ex.ac.uk due to local hw failure, similarly the same m/c was the WWW server, should all return to normal in a couple of days. (Talk about single point of failure, all the X-terms booted off it too). - -- HAVE *YOU* EXPORTED RSA TODAY? --> http://dcs.ex.ac.uk/~aba/rsa/ - --rsa--------------------------8<------------------------------- #!/bin/perl -s-- -export-a-crypto-system-sig -RSA-3-lines-PERL $m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%Sa 2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*',$_)while read(STDIN,$m,($w=2*$d-1+length($n)&~1)/2) - -------------------------------8<------------------------------- TRY: rsa -k=3 -n=7537d365 < msg | rsa -d -k=4e243e33 -n=7537d365 -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMB9U5ynIuJ1VakpnAQGLcgP/fNe2cBJKNJrKE3iHiFrHgUM4So/Q0nqg GYgJu+gYZIlnQSv6JUXBDWFw/29n/ARN9oENjxmgAs6rTiE9bjPhD8IuftGaENsF ou3v4Y04B/7UFG8sXx9Opdr0G6P+sHM7f+pdwkCW4rtWA1tclUigrkIF/+65Q0a4 iZN1c4Y23tk= =35BY -----END PGP SIGNATURE-----

1 0

Can you spell 'Stoopid'? Sure you can... / Re: thought for the day, and my IRS Investigations report
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

"David D.W. Downey" <Webmaster(a)CyberSpaceTechnologies.com> wrote: > Zooko Journeyman wrote: > > My interaction with Jim Bell pretty much amounted to condemning > > him and telling him to go to hell, CC'ed to cypherpunks. And > > I haven't received any IRS Investigations notes, so perhaps my > > e-mail address wasn't included in Jim's little black book. > Why does it always seem like there has to be someone out there that just > HAS to be an idiot. Dear Dave, Why does it always seem that it is the idiots who ask this question? Are you by any chance of fate related to the David Downey who spammed the cypherpunks list with an announcement of his attempt to "get a number of the other cypherpunk lists together under one umbrella," then sent several copies of his "Welcome to my fascist, censorous, pseudo-cypherpunk mailing list." message to the cypherpunks list (and subsequently displayed his lack of knowledge as to how to unsubscribe to a mailing list, let alone try to run one)? > From: "David Downey" <digital_matrix(a)hotmail.com> > To: cypherpunks-unedited-outgoing(a)toad.com > > unsubscribe cryptography-politics-pgp-l Welcome to The Privacy Channel's Cryptography-Politics-PGP-L. As you've probably guessed from the list title, this list is dedicated to the open, friendly, and intellegent discussion of Cryptography around the globe. "Open, friendly, and intellegent discussion." ???!!!??? Sounds like my "CypherPissing" mail folder would starve to death if it counted on your list for its sustenance. All are welcome here Thank God! I was afraid I wouldn't be able to discuss my pictures of the Pope with his dick in the mouth of children being held down by Mother Teresa. Now, let's get a few things out of the way. The Rules! I'm starting to smell leather. Is it 'Jackboot' leather? 1) ABSOLUTELY NO SPAMMING ALLOWED!!!! I'll can ya in a heartbeat, as well as speak to all the server owners that you traveled on. Are the capital letters meant to indicate shouting, a thick Nazi German accent, or both? And are you intending only to 'inform' on and 'cause trouble for' *bad* people? Will there be 'spankings' involved (or does this cost extra)? 2) You keep it kind of clean. Keep the swearing and such down to a minimum. Ex-fucking-cuse me? Is there a swearing 'minimum' which is *required*, or only a 'maximum' which is *allowed*? Do Tourettics require a note from their doctor to call someone who sucks dick a cocksucker? You can get your point across just as well without cussing. Right. Like there is a phrase other than "lying, fucking criminal, god damn, rat-bastard Nazi motherfuckers" that could possibly come close to describing our beloved legislators. Flaming others is also considered bad karma here. I'd like to see folks help each other around here. "Why can't we all just get..." "... along." - Rodney King "...a long nightstick and just beat the fuck out of a nigger." - L.A. Chief of Police After all, we are all we got! And "Wherever you go, there you are." And "Patience comes to those who wait." And "If God is Love and Love is Blind, then Ray Charles must be God." Will we be singing "Michael row the boat ashore." a lot on your list? 3) You try to keep as much as possible to the point, and to the content of this list. OK, but it's going to make it a lot harder to sell my '67 Chevy station wagon. (It's an "anonymous" automobile with stolen plates. Perfect for a cypherpunk.) If you really want to talk about something else, let me know. I'll get another list going. Great! Now I know who is in charge of giving me permission to talk and is willing to control the forum in which I do it. Up until now I have had to bear this terrible burden myself. 4) Respect others!!! Does the "!!!" imply "or else..."? 5) Finally, HAVE FUN!!!!! How? By telling you to stick your "rules" up your ass? "FUN" in a manner that meets your approval? Does your shouting "HAVE FUN" and the multiple exclamation marks mean that having fun is 'required'? If so, will Jim Bell be allowed an exception to this rule, or will he have to learn to enjoy being buggered by Prisoner #32289723? I'm done. Talk to you on the List. You were done before you even got started. And shouldn't you have said, "SHOUT AT YOU ON THE LIST!!!!!!!!!!!!!!!!!!!!!!!!!!!"? I think I'll join the "Miss Manners Cryptography List," instead. It teaches proper oppression etiquitte, such as which fork to stick in the eye of the Jackboots who kick in your door to demand your secret key, and how to choose the proper wine to go with the shit that the government dishes out. !have !fun, TruthMonger

1 0

Re: There's a hole in your crypto...
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

Phil Fraering writes: >Why are the arguments on either side so emotional? I'm rather hesitant to jump into this thread, but I think that one reason is that Fred's concerns have been misunderstood a bit. (If I'm wrong, I'm sure he'll correct me.) It seems that there are many people who are ready to leap to the defense of the honor of the programmers behind PGP, when they feel said honor is being impugned. I get the impression (as much from what I know of his background as from what he's said) that Fred is at least as concerned about PGP being a correct implementation of the various algorithms it involves as he is about back doors inserted by nefarious individuals. As I understand it, it is impossible to demonstrate the correctness of any program the size of PGP. And it would also not be possible to validate the compiler or the operating system. One thing I'm not sure of, though, is this: Would it be possible to verify a much smaller program, say, the RSA-in-3-lines-of-Perl? (Of course, you still would be left trying to verify the Perl interpreter, and the OS again.) And is there any way to build trusted system out of small, verifiable pieces? Since the way they're connected could also be questioned, I suspect that when you put enough of them together it's just as bad as the case of a single, monolithic program. But this isn't my area, so I don't know. Would it be possible to formally verify at least some parts of a large program like PGP? And would that add to the trustworthiness of the overall program? (Keeping in mind Fred's earlier remark about a seemingly-unrelated portion of the code overwriting the key.) -- David R. Conrad, ab411(a)detroit.freenet.org, http://web.grfn.org/~conrad/ Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 No, his mind is not for rent to any god or government.

5 7

HEY_now
by John Young 17 Dec '03

17 Dec '03

8-02-95. NYPaper: "Pattern Emerges In Bomber's Tract: F.B.I. Says Attacker Stayed Close to a Few Campuses." In what was described as an important advance in the hunt for an elusive serial bomber, the Federal Bureau of Investigation said yesterday that it had traced a years-long pattern of academic involvement that took the self-described anarchist from the Chicago area to Salt Lake City to Berkeley, Calif. By matching his 17-year record of carnage against an analysis of a densely argued 35,000-word tract he sent to The New York Times in June, Government officials say they have concluded that the bomber is a student of the history of science who may have taken classes at or hovered around major university campuses from the late 1970's to the mid- 1980's. FCU_stu "Excerpts From Manuscript Linked to Suspect in 17-Year Series of Bombings." Role of Scientists: The system HAS TO force people to behave in ways that are increasingly remote from the natural pattern of human behavior. For example, the system needs scientists, mathematicians and engineers. It can't function without them. So heavy pressure is put on children to excel in these fields. FCX_txt Twofer: HEY_now

1 0

NYET--attempted formal specs (again)
by Nathan Zook 17 Dec '03

17 Dec '03

I hope I'm not becoming Detweileresqe about this, but I've had some requests for these. Since not even I was satisfied with my original notation, I thought I'ld try again... (donning gear) -----BEGIN PGP SIGNED MESSAGE----- Copyright 1995, Nathan Zook. All rights reserved. NYET-- Non-Youths Exhibit Temperance. This is a rising, legitamate concern among parents that their children have all-to-easy access to porn on the internet. Last year, there were numerous proposals for various voluntary self-rating systems. AOL and Prodigy heavily censor their systems in various ways. This year, Senator Exon advanced his own proposal. Of course, this occured just about the time that SurfWatch came out. But none of these proposals can ultimately succeed. Here I restate my NYET proposal from last year for your consideration. The system is of necessity ISP-based. Home-based systems are subject to attacks at home. Since many (most?) children are better with computers than their parents, these attacks can be expected to succeed. Any ISP-based system requires that the ISP determine which customers are not of majority age and who is legally responsible for them. There are technical solutions to this problem which are part of the basis to the proposal. The elements of NYET are as follows: the ISP, monitoring software, the parent/guardian of the minor, and one or more ratings services. A NYET-ISP does not grant access priveleges to minors without prior contact with the (generically) parent of the minor. This contact includes explaining and helping configure the NYET software in accordance with the parent's wishes. The NYET-software runs as superuser on the ISP's machine. All minor accounts have a corresponding configuration file sitting in their account owner's parent's directory, which is locked with read/write by owner only flags. The correspondence between minor and parent accounts sits in a file owned by root and similiarly locked. The parent sets the configuration file to permit and deny access to various parts of the net. Since it is unreasonable for the parent to personally "rate" the net, it is expected that various organizations will form ratings services. The parent could then select various combinations of ratings criteria from these agencies as default. It is expected that the services would charge for their information. It is likely that these charges could be added to the monthly bill that the parent receives from the ISP. And the role of government? Right now--none other than to encourage parental involvement. Any attempt to force this, or almost any other, type of restriction by legislative "I say so" (fiat in Latin) will meet with fatal opposition. Until the legislature understands the net, the combined efforts of the millions who use the net will swamp any efforts to control it. Speaking of government, school internet access is the bane of any attempt by parents to control the access that their kids have to the net. Anyone seeking to limit children's access should look carefully at this experimentation. I post this proposal because I believe it to be one of the few stable attractors in this problem. I believe that Prodigy and SurfWatch amount to first iterations, and that the market will push them towards NYET. When it does so move, and a majority of ISPs provide or nearly provide NYET service, and ONLY then, the government might mandate the NYET standard. As a somewhat earlier measure, the government could offer to hold harmless ISPs that adhere to these standards--but only when the market has already handled the technical hurdles. I feel it necessary to reiterate the importance of the government waiting for a market solution to this problem. By its design, the net appeals to libertarians and anarchists. For many years, it has been accessible almost exclusively by people demographically predisposed to a libertarian or anarchist world view. The net.gods, when angered, can produce no end of michief. And since they designed the system, they won't be stoppable. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMB73X34gWvtXVTwZAQFKsAP9E/NOfKrt7WwcvNdMlWzg8jneyVa19hL+ 9Ot7Ir4SigZJDDQ7hjxS2elJourCZpFWpBXFdKMbTGqTXMtmELZJu5qYidXDmV1i BAWHYI0RW2E6MszGSgAh1MDfUpY7/RO89CjsuP8M3aGVF44FOWpIoTRZnNhXRO9q xnA2tErpz+A= =NpaG -----END PGP SIGNATURE-----

3 4

Consumer Report: RSA T-Shirt
by Harry S. Hawk 17 Dec '03

17 Dec '03

I got my RSA tee-shirt the other day.. It came promptly and both of the shirts I ordered came. It was oddly shipped in a near see-through pouch. I'm happy over all with the shirt, the quality of the printing, and the construction of the Tee (all cotton, name brand tee).. I have only one complaint. THat is the "machine readable" rsa barcodes. TO my eye the printing job there is rather poor. I doubt it is machine readable (althought I don't have a 128 barcode reader to try it out with).. I'm disappointed as I doubt that the 4 line RSA code is NOT exportable since text books have been allowed previously to be exported. Machine readable materials have been called into question. My thoughts are that if it is not machine readable the shirt is much more a novelity then an munition (which is sorta why I bought it to begin with.. to be fair..).. Of course I hoped to be the first one on my block to own one. But when I went into the drug store the clerk asked me where I got it, noting someone else was just in there wearing one... /hawk -- Harry Hawk Manager of Computer Services Warwick Baker & Fiore 212 941 4438 habs(a)warwick.com

2 1

Re: Provably Correct Crypto
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

Those interested in this discussion of verification of PGP etc. might also find it worth reading some recent traffic on the firewalls list, regarding the viability of "trusted systems" and formal evaluation methods. Look for messages from Marcus Ranum (ex-TIS), Ray Kaplan, and some others in the past few digests (e.g. #458 and #459, and a few prior ones). You can find them in ftp://ftp.greatcircle.com/pub/firewalls/digest/ with filenames like v04.n458.Z, v04.n459.Z, etc. (Only digests through #457 are there now, but I'm sure the latter ones will appear soon.) Use majordomo(a)greatcircle.com if you want to subscribe to firewalls or firewalls-digest. -Futplex <futplex(a)pseudonym.com>

1 0

Net Censorship bill
by rhoz＠sna.com 17 Dec '03

17 Dec '03

This showed up on The Spiderwoman list. Seems accurate. I endorse it as much as I endorse PGP. I know most of you filter me out, but for those that don't, THEN please read this just for me. For if this tiny amendment fails, I do predict there won't be any discussions of PGP by about 2005. Simply because PGP will be outlawed by then. The wheels of Washington grind slowly. But once started almost never stop. Love Always, Carol Anne ---- Begin Forwarded Message Return-Path: <owner-policy-posts(a)cdt.org> Received: from cdt.org by ix4.ix.netcom.com (8.6.12/SMI-4.1/Netcom) id UAA27278; Tue, 1 Aug 1995 20:05:43 -0700 Received: (from majordom@localhost) by cdt.org (8.6.9/8.6.9) id QAA30972 for policy-posts-outgoing; Tue, 1 Aug 1995 16:37:15 -0400 Received: from [204.157.127.4] (whale.ctd.org [204.157.127.4]) by cdt.org (8.6.9/8.6.9) with SMTP id QAA30921 for <policy-posts>; Tue, 1 Aug 1995 16:34:55 -0400 Message-Id: <199508012034.QAA30921(a)cdt.org> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Tue, 1 Aug 1995 17:43:34 -0400 To: policy-posts(a)cdt.org From: editor(a)cdt.org Subject: ALERT: House to Vote This Week on Net-Censorship Bills Sender: owner-policy-posts(a)cdt.org Precedence: bulk HOUSE TO VOTE THIS WEEK ----------------------- The House of Representatives will vote late Thursday or Early Friday (Aug 3 or 4) on whether to add the Cox/Wyden Internet Freedom and Family Empowerment Act as an amendment to the House Telecommunications Reform Bill (HR 1555). The Cox/Wyden amendment is a direct attack on the Exon/Coats Communications Decency Act (CDA). House passage of the Cox/Wyden amendment is the last chance we have to defeat the Exon/Coats CDA. If the House fails to pass Cox/Wyden, the Exon bill will likely become law. We must act now to head off this possibility. Please take a moment to contact your member of Congress and urge them to support the Cox/Wyden legislation (described in the alert below). The attached alert is from a coalition organized by the Voters Telecommunications Watch (VTW) which includes CDT, EFF, EPIC, and other online advocacy organizations. This may be your last chance to make your voice heard on this critical issue, so please call before Friday August 4. ======================================================================== CAMPAIGN TO STOP THE EXON/COATS COMMUNICATIONS DECENCY ACT (SEE THE LIST OF CAMPAIGN COALITION MEMBERS AT THE END) Update: -Latest News: House vows to vote on Telecomm bill (which includes the CDA) this week before recess! -What You Can Do Now *** THIS IS YOUR LAST CHANCE TO MAKE A DIFFERENCE. *** *** THE HOUSE WILL VOTE ON THE COMMUNICATIONS DECENCY *** *** ACT THIS WEEK. IF WE LOSE, IT WILL BECOME LAW. *** CAMPAIGN TO STOP THE UNCONSTITUTIONAL COMMUNICATIONS DECENCY ACT July 30, 1995 PLEASE WIDELY REDISTRIBUTE THIS DOCUMENT WITH THIS BANNER INTACT REDISTRIBUTE ONLY UNTIL August 14, 1995 REPRODUCE THIS ALERT ONLY IN RELEVANT FORUMS Distributed by the Voters Telecommunications Watch (vtw(a)vtw.org) ________________________________________________________________________ CONTENTS The Latest News What You Can Do Now What is Cox/Wyden? (HR1978) Chronology of the CDA For More Information List Of Participating Organizations List of the House of Representatives ________________________________________________________________________ THE LATEST NEWS This week the House of Representatives will choose between ANTI-FREE-MARKET PRO-CENSORSHIP LEGISLATION (the Exon/Coats Communications Decency Act) and ANTI-CENSORSHIP PRO-PARENTAL-CONTROL LEGISLATION (the Cox/Wyden Internet Freedom and Family Empowerment Act - HR1978). THIS IS YOUR LAST CHANCE AS A CITIZEN TO MAKE A DIFFERENCE. IF WE LOSE THIS VOTE, THE COMMUNICATIONS DECENCY ACT, ALREADY PASSED BY THE SENATE, WILL BECOME US LAW. The vision of a cyberspace ONLY FIT FOR CHILDREN will become reality. The Communications Decency Act will be offered by supporters of conservative pro-censorship groups THIS WEEK. They will try and amend HR1555 to include the Communications Decency Act and remove any other net-friendly language such as the Leahy/Klink study. ________________________________________________________________________ WHAT YOU CAN DO NOW 1. THERE'S NO TIME FOR EMAIL OR SNAIL MAIL. CALL OR FAX YOUR REPRESENTATIVE NOW. 2. Find your rep (instructions below) and urge them to oppose the Communications Decency Act and support parental control legislation (the Cox/Wyden "Internet Freedom and Family Empowerment Act" HR1978) Figure out who your Rep is; feel free to use the following sample. ** See Instructions Below On How To Obtain Your Rep's Phone and Fax Number ** SAMPLE PHONE CALL (Y=You, S=Rep's Staffer) <ring ring> S:Rep. Snark's office, may I help you? Y:Hi, As your constituent I'd like to urge Rep Snark to oppose Internet censorship legislation such as the Exon/Coats Communications Decency Act and support parental control bills such as the Cox/Wyden Internet Freedom and Family Empowerment Act - HR1978. S:Anything else? Y:Yes, where does Rep. Snark stand on this issue? S:Rep. Snark supports HR1978. Y:Thank you! Take the response you get and mail it to vtw(a)vtw.org. We'll be totalling up the responses and counting votes. Send it to us with the subject line of "house call". $ Mail vtw(a)vtw.org Subject: house call I live in Ohio and I called Rep Snark. Snark's staffer said he favors HR1978 too! . Mail sent... $ SAMPLE FAX Dear Representative Snark, As your constituent I'd like to urge Rep Snark to oppose Internet censorship legislation such as the Exon/Coats Communications Decency Act and support parental control bills such as the Cox/Wyden Internet Freedom and Family Empowerment Act - HR1978. Sincerely, <your address> 3. Ask your Internet Service Provider or Sysop to put the following message into their "message of the day". We also encourage you to forward the following short announcement to relevant mailing lists where a copy of this alert would be too long for the list. 8/1/95: The Communications Decency Act (CDA) will be voted on by the House of Representatives this week. IT IS CRUCIAL THAT YOU CALL YOUR REPRESENTATIVE NOW. To get a copy of the alert, send mail to vtw(a)vtw.org with "send alert" in the subject line, gopher -p 1/vtw/exon/alert gopher.panix.com, or URL:gopher://gopher.panix.com:70/00/vtw/exon/alert 4. Forward a copy of this alert to your friends until the "freshness date" above. THIS IS CRUCIAL. WE NEED TO GENERATE CALLS OF SUPPORT OR THE COMMUNICATIONS DECENCY ACT WILL BECOME LAW. 5. Congratulate yourself! You've done your part to save cyberspace. ________________________________________________________________________ HOW TO FIND YOUR REPRESENTATIVE'S PHONE AND FAX NUMBER: 1. If you don't remember your representative's phone number, send email to reps(a)cdt.org You will automatically receive a list of all 435 members of the House of Representatives with phone and fax numbers. 2. OR, call the Capitol Switchboard (+1.202.225.3121) and ask to be connected to your Rep's office. If you don't remember who your Rep. is, the operator can tell you when provided with your zipcode. ________________________________________________________________________ WHAT IS COX/WYDEN? Cox/Wyden (HR1978) is legislation intended to prevent the Federal Communications Commission (FCC) from imposing content regulations on cyberspace and encourage private sector development and deployment of parental control technologies. Throughout HR1978's history, civil liberties advocates from ACLU, CDT, EPIC & PFAW have examined the bill and recommended modifications to ensure that the bill does not negatively impact your privacy or civil liberties. Although several questions still remain, Representatives Cox and Wyden are committed to addressing these concerns. As the legislation moves to the House/Senate conference committee, civil liberties advocates will continue to submit changes to the Representatives' staffers throughout the conference process where the House bill and the Senate-approved Communications Decency Act are reconciled. ________________________________________________________________________ CHRONOLOGY OF THE COMMUNICATIONS DECENCY ACT House vote to occur before Friday August 4, 1995. Jun 30, '95 Cox and Wyden introduce the "Internet Freedom and Family Empowerment Act" (HR 1978) as an alternative to the CDA. Jun 21, '95 Several prominent House members publicly announce their opposition to the CDA, including Rep. Newt Gingrich (R-GA), Rep. Chris Cox (R-CA), and Rep. Ron Wyden (D-OR). Jun 14, '95 The Senate passes the CDA as attached to the Telecomm reform bill (S 652) by a vote of 84-16. The Leahy bill (S 714) is not passed. May 24, '95 The House Telecomm Reform bill (HR 1555) leaves committee in the House with the Leahy alternative attached to it, thanks to Rep. Ron Klink of (D-PA). The Communications Decency Act is not attached to it. Apr 7, '95 Sen. Leahy (D-VT) introduces S.714, an alternative to the Exon/Gorton bill, which commissions the Dept. of Justice to study the problem to see if additional legislation (such as the CDA) is necessary. Mar 23, '95 S314 amended and attached to the telecommunications reform bill by Sen. Gorton (R-WA). Language provides some provider protection, but continues to infringe upon email privacy and free speech. Feb 21, '95 HR1004 referred to the House Commerce and Judiciary committees Feb 21, '95 HR1004 introduced by Rep. Johnson (D-SD) Feb 1, '95 S314 referred to the Senate Commerce committee Feb 1, '95 S314 introduced by Sen. Exon (D-NE) and Gorton (R-WA). ________________________________________________________________________ FOR MORE INFORMATION Web Sites URL:http://www.panix.com/vtw/exon/ URL:http://epic.org/ URL:http://www.eff.org/pub/Alerts/ URL:http://www.cdt.org/cda.html URL:http://outpost.callnet.com/outpost.html FTP Archives URL:ftp://ftp.cdt.org/pub/cdt/policy/freespeech/00-INDEX.FREESPEECH URL:ftp://ftp.eff.org/pub/Alerts/ Gopher Archives: URL:gopher://gopher.panix.com/11/vtw/exon URL:gopher://gopher.eff.org/11/Alerts Email: vtw(a)vtw.org (put "send alert" in the subject line for the latest alert, or "send cdafaq" for the CDA FAQ) cda-info(a)cdt.org (General CDA information) cda-stat(a)cdt.org (Current status of the CDA) ________________________________________________________________________ LIST OF PARTICIPATING ORGANIZATIONS In order to use the net more effectively, several organizations have joined forces on a single Congressional net campaign to stop the Communications Decency Act. American Communication Association * American Council for the Arts * Arts & Technology Society * Association of Alternative Newsweeklies * biancaTroll productions * Californians Against Censorship Together * Center For Democracy And Technology * Centre for Democratic Communications * Center for Public Representation * Citizen's Voice - New Zealand * Cloud 9 Internet *Computer Communicators Association * Computel Network Services * Computer Professionals for Social Responsibility * Cross Connection * Cyber-Rights Campaign * CyberQueer Lounge * Dutch Digital Citizens' Movement * ECHO Communications Group, Inc. * Electronic Frontier Canada * Electronic Frontier Foundation * Electronic Frontier Foundation - Austin * Electronic Frontiers Australia * Electronic Frontiers Houston * Electronic Frontiers New Hampshire * Electronic Privacy Information Center * Feminists For Free Expression * First Amendment Teach-In * Florida Coalition Against Censorship * FranceCom, Inc. Web Advertising Services * Friendly Anti-Censorship Taskforce for Students * Hands Off! The Net * Human Rights Watch * Inland Book Company * Inner Circle Technologies, Inc. * Inst. for Global Communications * Internet On-Ramp, Inc. * Internet Users Consortium * Joint Artists' and Music Promotions Political Action Committee * The Libertarian Party * Marijuana Policy Project * Metropolitan Data Networks Ltd. * MindVox * MN Grassroots Party * National Bicycle Greenway * National Campaign for Freedom of Expression * National Coalition Against Censorship * National Gay and Lesbian Task Force * National Public Telecomputing Network * National Writers Union * Oregon Coast RISC * Panix Public Access Internet * People for the American Way * Republican Liberty Caucus * Rock Out Censorship * Society for Electronic Access * The Thing International BBS Network * The WELL * Voters Telecommunications Watch (Note: All 'Electronic Frontier' organizations are independent entities, not EFF chapters or divisions.) ________________________________________________________________________ End Alert =======================================================================

1 0

Are there free implementations of DSS available?
by Enzo Michelangeli 17 Dec '03

17 Dec '03

Thanks for any pointer.

1 0

Re: Pat Robertson Fears E-cash?
by Peter Trei 17 Dec '03

17 Dec '03

The relevant verses are in Revelations 13, where some of the actions by which The Beast can be recognized are given. Among them are: 16 And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads: 17 And that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name. Millenialist Christians tend to regard this as a method by which the faithful will be shut out of the economy, since the pious will refuse such a 'mark'. E-cash is a bit of a reach from this, but some of them (eg, Robertson), extend the verses to cover all forms of trackable transactions. I suspect that if someone could get him to realize the privacy aspects of true anonymous ecash, he'd like it. Just don't propose an implantable cryptographic token :-). Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

3 2