December 2003 - cypherpunks-legacy

Re: Certificates/Anonymity/Policy/True Names
by Alan Pugh 17 Dec '03

17 Dec '03

> What about when the CA signing key is stolen, factored, or otherwise falls > into the wrong hands, thereby possibly making every signature made by the CA > worthless, or at least questionable? > > I assume liability will be based on the CA's efforts to ensure the integrity > of the signatures it makes (and therefore the confidentiality of the secret > key components), but what constitutes due diligence? As we all know, > security measures cover a very wide range and can reach ridiculous > proportions on both ends of the spectrum... How much security will be > 'enough' from a legal standpoint...? an excellent point, and one that i'd not seriously considered until i saw your post. given today's legal climate, assuring the confidentiality of a ca's key would be pretty expensive. i suppose burning cd-roms with all transactions would help to document all transactions, but would not be definitive as far as the signatures go. any document signed with the key would really have to be considered valid if the signature itself is to really mean anything in a legal sense. if one were to allege that a signature is not valid, even though it checked out cryptologically, how could one defend against a charge that the secret key had been compromised. you cannot prove a negative. obviously, ianal, but i would think it would be reasonably easy to convince at least one jury member that there is a reasonable dought that the key had been compromised. then again, it might be similar to a claim that a signature has been forged. i think there could be a danger of allowing the confidence in a given piece of crypto to unduly influence a jury of a document's authenticity when the key _had_ been compromised. the 'gee wiz' factor could be fairly significant among juries. given statements like 'you could take all the computers on the planet and let them crunch on it for a billion years would be needed', a jury might miss issues of security. fwiw, my 2 cents... ********************************************* * / Only God can see the whole * * O[%\%\%{<>===========================- * * \ Mandlebrot Set at Once! * * amp * * <0003701548(a)mcimail.com> * * <alan.pugh(a)internetmci.com> * ********************************************* Key fingerprint = A7 97 70 0F E2 5B 95 7C DB 7C 2B BF 0F E1 69 1D

1 0

PGP in UK
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I heard something rather disturbing the other day from someone I do business with. I've been telling this company for 18 months or so about the advantages of PGP and email rather than faxes, and they finally tried it, liked it, and decided to use it a month or so ago. Last week they got a visit from the Department of Trade of Industry and MI5 (or is it MI6?) telling them to stop using PGP or they might find difficulties getting export licences for their products in future. The visitors wouldn't say how they knew this company had been using it. The person who told me about this also said something about a Department of Trade & Industry paper which mentioned that the British Government was going to insist on key escrow for encryption. I had hoped to get a copy of this, but he can't find it at the moment. I'll post the text when I get it if anyone's interested. Anyone else in the UK heard anything about this? - -- B. -----BEGIN PGP SIGNATURE----- Version: 2.6.i iQEVAgUBMFGPfeHVHXeXphJJAQFJ0Af/Svh0ifULgpEuauSBPFreDDJoa/a1gcPe ya3CjOde9kVuN0IkBHFubO18MrAO6WbwlhVa/X/pjG4vbSahonpzmgHHfkVW20Gh qlhBwFLElTmOgspSjHJ74sYNUM2YZ+AKOyNwW4ix6woJ0WL0NP+cV8CZv4tdEH4l EI3/FuoFccbkKMk7QYoRPOyj5FI4GiFxVsg1GFOU3r83bxfJDfU2yZdImEBx/Nlc gteizqFTF/QiKckl6f5NzCBzaoIcMw0VLN8dAGLqzDycJtFqGdOPgvgSt1LwXKBs +zJM5Z/laubYm5SiEPy4oVz9N3lT4EOzEtdMEoiSC6IiSDSaURkEAA== =GiY0 -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.i mQENAi8KzVoAAAEH/2gPfD2Xdw1nDAXtMH/F5iCMrwdXHXolEfOjRP59QP1Yodhb L+NGSNls67+H1us5PP5EpHDbHRy66ExgRK7XdZ/2qz0SsbTG+R6pRIILmMfgd3Nj M6uq1DehdxWPdp4PMC9LNrG2V9QrRGPgpHhr3iDfy+p6JTjW8XCYUXn5POt0wBs2 n/vlowjLf9dVYwUKP58V9gokNsFlGcB08gEbxKa9Y2X7zB3BAlywPVdKVh+BOTCK z1Sofx9Wup0MEXEDEESLDSq/634hzzVx6Kt54cZBbi5nAdPHWlGHZl5vU93A3jPE fh59JXsCZmWKLXMjZtjcIJYkC4hC4dUdd5emEkkABRG0DEIuIERlIExhIFBheokB FQIFEC8g7yzh1R13l6YSSQEBD+4H/ir8R4iw1tWLUuxz6etmV99OhMUYoI5lQnxz 9KARQf4eD3xHPoMw6tHLKOUR8xYS9i2RmkhJrPRzCfD5OKSOBEHuIQEt/+dcbCuw 0fxn9NrU7NjFWwWKQ+0jYikN3hfIWcPmGtyhQ0KSrGfUDo5+rJr5Cy4U6eOooepv gYniecNNVAzQ2KDiWTOZ5zqG3zBAYj6uw8LHvBR1qol2YcJ4s02c4GdAZmzEq49s nDBortKfWUAxZkESBt2tMx8gYq6b38evYJBLXOqEN5Lt/5zf0nG1u0BEWBLaCj55 y8lh1KolVOu808tX9blOrjqwEB12vngjXzf7hHWohrGrrQVT2N4= =5qEt -----END PGP PUBLIC KEY BLOCK-----

1 0

Diana: is tcmay cp's official rep?
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Diana: is tcmay cp's official rep? ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNAuM1r04kQrCC2kFAQFIFQP9E8PiFhEHOnRS6YJMBcJsrznMlEr2wZR/ F4fe3hDCxr0cSF4sHIfg96fIxmXrHHR6rjotz/zxEXmkuQdVlpOQ1Lj7HU0o793G EdBCkEQ5Jo50Evv1hC0LKJzPdU09rSKhBfEwDysuLb2UgVkY2Ln4OELjsW5Pq19Y f5KitV/Fb+c= =eZBb -----END PGP SIGNATURE-----

1 0

remailers
by Alan Pugh 17 Dec '03

17 Dec '03

where can i find a good 'how to' faq on anonymous remailers? i've looked around and found several documents that tell me what they are, but no good information on how to use the various remailers. pointers are appreciated. ********************************************* * / Only God can see the whole * * O[%\%\%{<>===========================- * * \ Mandlebrot Set at Once! * * amp * * <0003701548(a)mcimail.com> * * <alan.pugh(a)internetmci.com> * ********************************************* Key fingerprint = A7 97 70 0F E2 5B 95 7C DB 7C 2B BF 0F E1 69 1D

1 0

PGP in UK and GAK
by John Young 17 Dec '03

17 Dec '03

Responding to msg by anonymous-remailer(a)shell.portal.com () on Sun, 10 Sep 2:8 AM [Snip] >The person who told me about this also said something >about a Department of Trade & Industry paper which >mentioned that the British Government was going to >insist on key escrow for encryption. > >Anyone else in the UK heard anything about this? Picking up the possible mandated use of key escrow in the UK: There was chat at the NIST key escrow meeting that low-bit key escrow may be the global policy in the works among governments. With a blanket outlawing of all non-escrowed systems. And, that US key escrow and 64-bit export policy is a harbinger of domestic regulation. A fed at the B-2 breakout session imperiously barked the mantra chanted by several feds at the general meeting, "64- bit encryption is what industry asked for, why are you now complaining." To the counter-question, "what industry are you referring to?" the answer was always just "industry." The USG's latest key escrow policy, the NIST meetings and the Intellectual Cryptography Insitute's conference "Global Challenges" posted here may be the surfacing of a well- orchestrated government and "industry" collusion on this issue. Note the common ever-present attendees of both NIST and the ICI meetings. Certainly, some "industry" spokespersons like "Daughter of Clipper" Denning presume by their tone of writing that key escrow is on its way to supremacy, with only quibbling left on the criteria for acceptably "competitive" variations. The NIST handouts of industry players seem to bear this out as well, even as some join the public kibitzing. Perhaps their raz, and that of BSA, is just a diverting smokescreen to induce complacency -- or squeaking wheels to get USG attention for sweetheart contracts. Maybe they've already met privately with USG reps to get rewarded with a piece of the PGP/non-escrow clamp-down biz -- more venerable suckling of national security kabooty as advised by smart-varmints like ex-NSA Mr. Stewart Abercrombie Baker, Every-meet-attending-Esq. I wonder if Mrs. Denning and Mr. Baker are advising their sweating crypto clients, "if you can't beat 'em, join 'em, the international escrow train is leaving the station, better get on before it's too late." While fretting of derailment by hackers, or worse, by international security agencies paranoid of gov-biz complicity to take over the "if you knew what I knew" crypto-protected cornucopia. Wonder who's really engineering this GAK Limited runaway? Does anybody know David Kahn well enough to ask what he's finding as NSA Visiting Historian -- in the archives and in the job-insecure-spook resumes heat-seeking crypto fires?

1 0

Re: The End of Politics
by Blanc 17 Dec '03

17 Dec '03

Steve Schear wrote: > The End of Politics > >Every 500 years or so Western history seems to reach a turning point: the >founding of democracy (Athens, c. 500 B.C.), the death to Christ, the fall >of the Roman Empire and beginning of the Dark Ages (c. 500 A.D.), the >ascendancy of the Catholic Church and beginning to the Middle Ages (c. 1000 >A.D.) and the Renaissance (c. 1500 A.D.). ........................................................... I'm so curious to know what occasioned this burst of insight and historical perspective from you, Steve? This is because, just by coincidence, I was up into the wee hours of this morning and happened to be perusing the MS Bookshelf Chronology of History. Looking through the dates on which certain events occurred - political, scientific, artistic, etc., I also was noting the changes which took place in 500 yr (or so) measures, just for comparison. I was noting when certain changes occurred in civilization which would mark major points of (to me) "advancement". The Chronology that I was looking at is a very simplified and limited one, so my examination was constrained to the list offered. Depending on which sector of activity one is looking at, it is possible to note areas of progress, discovery, or regression. But in looking at the vocabulary, in the way which many events are described, I also noted that the terms which were used to identify things is permeated with the ideas of politics, of descriptions by reference to relative positions of control in the human context; then, as more facts about the world beyond the proximate social schemas are revealed, concepts and ideas are apprehended in a broader context, to include more extensively the other elements of the Universe, and the descriptive terms change accordingly, becoming more objective (more in terms of "things as they are", rather than so much in terms of human relationships, of comparative positions of social influence). In considering their understanding of things, it is like the expression, "to someone with a hammer everything looks like a nail". To the ancestral evolving minds, the relationships of each to others, the jockeying for the more favorable positions over each other, was paramount. As it becomes easier to pursue the curiosities of Nature, develop artistic interests, and achieve practical solutions to Life's problems, the attention transforms from those earlier concerns to a concentrated pursuit of knowledge and to an increased, augmented perspective on what is Important and what are the Real Problems (and what are the actual working solutions). Existence then takes on a different perspective - it does not seem as dangerous (other people don't seem as threatenting) when a person has achieved mastery over the elements and forces of Nature. And this difference in understanding is reflected in the vocabulary. At least, that is what occurred to me as I was looking at the historical timeline. .. Blanc

1 0

RSA lcensing costs?
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

Adam, I called RSA last week to get information on licensing Diffie-Hellmann for an videoconferencing application. They said that "They provide the BSAFE development toolkit, but don't license the technology" and gave me the number of PKP to license the technology itself. I called a Mr. Fougmer at PKP, (408 735-5893), his message says that he'll be out of town until the 18th of September, and if you want to leave a message, call back after that date. Now, I could be completely confused, it wouldn't be the first (or even the 100th) time. If you can get a standard license by using the BSAFE toolkit, and they had a standard price for that, well, I didn't give Linda De Los Reyes at RSA (415 595-8782) a chance to tell me that. thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-8624

1 0

64 bit crypto
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

Say that we wanted to use 80 bit RC4 for our crypto application, but we were only allowed to use 64 bit crypto because we lived in some police state that enforced its wishes. Couldn't we modify RC4 easily to provide the same security against brute-force attacks by just running the key-setup phase 65536 times instead of just once? That would slow down the key-setup (on my machine) from 50,000 per second to just over 1 second, but so what? It takes ATT more than 1 second to set up a long distance call, I can wait another second to start the conversation. If our breaking of 40 bit RC4 was a one, then this 64 bit RC4-modified would be a 109,951,162,776, well beyond possibilities that I can imagine. You might say that you could save all 2^64 key tables, but that is a huge amount of data, millions of terabyte-capacity tapes. In the GAK proceedings, I have never heard of any limitation on the algorithm, just that it be public and 64 bits or less. And, of course, have GAK. Of course, it wouldn't surprise me for this kind of technical fix to be immediately outlawed by the aforementioned police state. thad -- Thaddeus Beier email: thad(a)hammerhead.com Technology Development vox: 408) 286-3376 Hammerhead Productions fax: 408) 292-8624

1 0

Re: not a flame please read and think about this
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

i know this is unpopular but i wish someone would respond the the points rather than flaming me. pat farrel is the only one of you with the balz to try to defend himself insead of attacking me. and you attack me for being anon. i love it. cypherpunks yea right. more of the indefensible. ive been keeping a list: janet renos cypherpunk heros: wei dai patents algorithms - for microsoft!!!!. that should fucking help us a lot. whos he gonna sue first? hey i think ill patent xor!!!! and give the patent to the nsa!!! according to sci.crypt mat blaze can prove that clipper has no back door. right. that sure helps us. david sternlights new hero. pat farrel signs up with the nsa to make the key escrow rules easier for us morons to understand. hey thanks. maybe theyll give you a nicer room in the concentration kamp. a whole shitload of socalled cypherpunks jumping over each other to help and defend him. brian davis trys to convinice us that key escrow isnt so bad (who signs your paycheck davie?????) that guy from rand corp tells us words of wisdom from robert morris the nsa guy as if we should write them down and pray three times a day to them. carl elison designs key escrow for tis and acts like hes one of us. bruce schneier is copyrighting crypt programs and threatining to sue people who use it. even phil zimmerman is selling the rights to pgp. what about all the people who contributed code (like me). not a dime for us because phil is famous and your not alowed to say anythingn bad about him. sorry i forgot phil is god. no one dares to complain. ask phil about me and when i asked about sharing profits from the code i conrtibuted. also about the deal with r.f... by the way i am not the anonymous-remailer(a)shell.portal.com person who toold farel to shut up. that was someone else. i dont think anyone should shut up. thats my point. i think we should talk about this in the open. got it perry??? lets get back to being punks. fuck these traitors. do crypto and fuck the nsa. an116512(a)anon.penet.fi

4 3

Re: Hey
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

bennett_t1(a)popmail.firn.edu wrote: > > :: > Encrypted: PGP > > -----BEGIN PGP MESSAGE----- > Version: PGP for Personal Privacy 5.0 > MessageID: yV9u2hakLFv9/SGjemJH0AuGYsBQ1cOE > > hQCMA/HAD1cfk+qpAQQAwuEDcaGfi1QCu84QklmpWe0AtyQUKGvkIuT8cEXt/ePS > G1QAGQBHNRPvsN92ORDxPY5K+JgeS4b8ZpRJ+C9pSFwtzJXyoSaPSWLVLe//GU4y > H+yeO8kMmK2qbbthgDD1D/00sXbrQsqEbIyz2al/bRIFzalS8UHQg4Olg7hTjpGl > AY608e0OyKO78dPdEGeRYH5PwW6BLgppULjR17+Puo0ukIqwcItJlYPx7K2AgNtA > 9sDlymr5h+cMky+BbrFWoi8QZEBrHvhXckXuPWHDlrmxTzd362m2R9G3/4TLlMjK > j6q2TD5DA0CT/g1ETK3J0y+7cFfuGp6oP2PhP27VCBW6maIp1Z35K3yNy7vytrTE > qDuJtcF2lvDAYKBcKr0lk6fBuGfRRZge3ZlAOgo/t5KPSGou/KlkHb2eR20vWqUM > Z2xcTkn5Y+ZJsPb/k9sOe8vKGK38IGYZdv2nj3k7MQvCIIuwAc37XIiC53mWAP8V > mIISGuYa2DgcxkdEy/rW0vd3AbhRzNGHp4u4zpjK/r2kTDGYGBURZFv2dC24KmcT > sgGYqYhYFY2/xmwiQgNKaRlMgrhRJZ8ytLxSCQts1pZhbImf2BFFBNshSIPUiZIn > 4fEPvD0lgJjC7jkkwAjEfN3E8DSCORs7GzKY1/Psr5ZZkEKVezv2blL+5YjYff+H > vfqgXkeGKOgXNUT1lNZZWA== > =wuTx > -----END PGP MESSAGE----- I find this highly unlikely. If you check the archives, you will find that this has been discussed previously on the list, and has been discounted by anyone with a modicum of reason.

1 0