December 2003 - cypherpunks-legacy

NEXT CHALLENGE...
by aba＠exe.ex.ac.uk 17 Dec '03

17 Dec '03

[Please note mail to me may bounce unless you are very careful with using addr aba(a)exe.ex.ac.uk, or aba(a)atlas.ex.ac.uk, as there are machines out here due to a physical breakin - a "RAM raid", I tried posting this on Sat, but the mailer was already out and mail is buffered, so may come out twice] A break down of Hal's challenge, could someone please check my logic in deriving an Andrew Roo's style config file for brutessl 1.0 and check my interpretation against Hal's interpretation in the previous challenge. Hal's previous challenge is indexed from his home page: http://www.portal.com/~hfinney/ I think the challenge file should look like this: -------------------------------------8<------------------------------------- # SSLbrute 1.0 parameter file for Hal Finney's 2nd SSL challenge as # posted to Cypherpunks on 19 August 1995. # # file checksum (ignoring # comments and whitespace) is 2977 CLEAR-MASTER fbc009916010a6153f8f36 CHALLENGE 07ea7b9d65eb61fabb4174e8453a5fc6 CONNECTION-ID d5e638d68ca8a1aeca2ef8c8e29602a4 SERVER-VERIFY 006599b6d2f2a736 -------------------------------------8<------------------------------------- Below I will give my resoning for each field. Each field as it is derived will be quoted with >>> Could a few people check that I have made no mistakes. Andrew Roos code is on: http://www.brute.cl.cam.ac.uk/brute/ as "brutessl.tar.gz", use "save next link as" in netscape (hold shift key down and click in Netscape 1.1). Could someone with a PC, and a 32 bit MS Visual C++ compiler handy compile a PC executable from the tarred files, some people won't have access to TAR under DOS, and a precompiled binary would be useful. Please send the binary to Piete if you do this (be sure to turn on all optimisations). I tried but my VC++ is not 32 bit, is it possible to produce 32 bit binaries which can be run from DOS with VC++ at all? Are the binaries you get with win 95 / win NT likely to run under DOS ? The keyserver will not be doling yet but please pickup the software ready to start. There is a unix based client, and a windows NT based client both available from that page. ---------------------------------------------------------------------- First message from client 0x80 0x1c 0x01 0x00 0x02 0x00 0x03 0x00 0x00 0x00 0x10 0x02 0x00 0x80 0x07 0xea 0x7b 0x9d 0x65 0xeb 0x61 0xfa 0xbb 0x41 0x74 0xe8 0x45 0x3a 0x5f 0xc6 0x80 0x1c Length field: 28 bytes follow in the packet. 0x01 MSG_CLIENT_HELLO 0x00 0x02 CLIENT-VERSION-MSB CLIENT-VERSION-LSB 0x00 0x03 CIPHER-SPECS-LENGTH-MSB CIPHER-SPECS-LENGTH-LSB 0x00 0x00 SESSION-ID-LENGTH-MSB SESSION-ID-LENGTH-LSB 0x00 0x10 CHALLENGE-LENGTH-MSB CHALLENGE-LENGTH-LSB 0x02 0x00 0x80 CIPHER-SPECS-DATA SESSION-ID-DATA 0x07 .. 0xc6 CHALLENGE-DATA [16 bytes] CHALLENGE is: >>> CHALLENGE 07ea7b9d65eb61fabb4174e8453a5fc6 first message from server 0x82 0x14 0x04 0x00 0x01 0x00 0x02 0x01 0xf6 0x00 0x03 0x00 0x10 0x30 0x82 0x01 0xf2 0x30 0x82 0x01 0x5b 0x02 0x02 0x01 0x8a 0x30 0x0d 0x06 0x09 0x2a 0x86 0x48 0x86 0xf7 0x0d 0x01 0x01 0x04 0x05 0x00 0x30 0x47 0x31 0x0b 0x30 0x09 0x06 0x03 0x55 0x04 0x06 0x13 0x02 0x55 0x53 0x31 0x10 0x30 0x0e 0x06 0x03 0x55 0x04 0x0b 0x13 0x07 0x54 0x65 0x73 0x74 0x20 0x43 0x41 0x31 0x26 0x30 0x24 0x06 0x03 0x55 0x04 0x0a 0x13 0x1d 0x4e 0x65 0x74 0x73 0x63 0x61 0x70 0x65 0x20 0x43 0x6f 0x6d 0x6d 0x75 0x6e 0x69 0x63 0x61 0x74 0x69 0x6f 0x6e 0x73 0x20 0x43 0x6f 0x72 0x70 0x2e 0x30 0x1e 0x17 0x0d 0x39 0x35 0x30 0x37 0x31 0x31 0x32 0x32 0x34 0x31 0x34 0x35 0x5a 0x17 0x0d 0x39 0x37 0x30 0x37 0x31 0x30 0x32 0x32 0x34 0x31 0x34 0x35 0x5a 0x30 0x7f 0x31 0x0b 0x30 0x09 0x06 0x03 0x55 0x04 0x06 0x13 0x02 0x55 0x53 0x31 0x0b 0x30 0x09 0x06 0x03 0x55 0x04 0x08 0x13 0x02 0x43 0x41 0x31 0x16 0x30 0x14 0x06 0x03 0x55 0x04 0x07 0x13 0x0d 0x4d 0x6f 0x75 0x6e 0x74 0x61 0x69 0x6e 0x20 0x56 0x69 0x65 0x77 0x31 0x26 0x30 0x24 0x06 0x03 0x55 0x04 0x0a 0x13 0x1d 0x4e 0x65 0x74 0x73 0x63 0x61 0x70 0x65 0x20 0x43 0x6f 0x6d 0x6d 0x75 0x6e 0x69 0x63 0x61 0x74 0x69 0x6f 0x6e 0x73 0x20 0x43 0x6f 0x72 0x70 0x2e 0x31 0x23 0x30 0x21 0x06 0x03 0x55 0x04 0x03 0x13 0x1a 0x45 0x2d 0x53 0x74 0x6f 0x72 0x65 0x20 0x54 0x72 0x61 0x6e 0x73 0x61 0x63 0x74 0x69 0x6f 0x6e 0x20 0x53 0x65 0x72 0x76 0x65 0x72 0x30 0x5c 0x30 0x0d 0x06 0x09 0x2a 0x86 0x48 0x86 0xf7 0x0d 0x01 0x01 0x01 0x05 0x00 0x03 0x4b 0x00 0x30 0x48 0x02 0x41 0x00 0xc7 0x24 0x0d 0xbd 0xfe 0x5f 0x21 0x09 0xb4 0x46 0x12 0xbb 0xc7 0x4c 0xbc 0x0c 0x98 0xe3 0x11 0x19 0x60 0x85 0x86 0x0a 0xa2 0xaf 0xae 0x8f 0xf9 0x43 0x86 0x92 0x1f 0xcc 0xd3 0x38 0xcf 0x92 0x14 0xa7 0x8c 0x89 0x07 0x26 0xd4 0x21 0x55 0xa8 0x43 0x2d 0xb4 0xec 0xce 0x24 0x73 0x5e 0x7c 0xe2 0xbe 0x22 0x2d 0xbd 0x96 0xbf 0x02 0x03 0x01 0x00 0x01 0x30 0x0d 0x06 0x09 0x2a 0x86 0x48 0x86 0xf7 0x0d 0x01 0x01 0x04 0x05 0x00 0x03 0x81 0x81 0x00 0x8f 0xbe 0x0c 0xae 0xc8 0xf0 0x22 0xef 0xae 0x83 0xb5 0xb1 0xe3 0xb4 0xd9 0xd6 0xa9 0x4a 0xb6 0x60 0x9c 0x0b 0x00 0x70 0x12 0x88 0x73 0xd1 0xef 0xe2 0x54 0xf6 0x3a 0xc7 0xa5 0xbe 0xe1 0xe0 0xdb 0x4d 0x20 0x10 0x3d 0x68 0x7c 0x8d 0xdb 0x16 0xf6 0x67 0xe7 0x1d 0x51 0xbc 0x19 0xa2 0xf6 0xbf 0x6f 0xa4 0x52 0xc7 0x7e 0x50 0x3d 0xb9 0x3e 0x1e 0x67 0xff 0xf6 0xf2 0x5d 0xe7 0x2b 0x7e 0x3a 0x7e 0x6c 0x40 0xb7 0x04 0x9c 0x2c 0x2b 0x89 0x0f 0x8c 0xb5 0x93 0xd8 0xac 0x94 0xe6 0x5f 0x84 0xe8 0x71 0x75 0x9e 0x10 0x6e 0x36 0xe6 0x14 0xfe 0xba 0xf8 0x11 0x71 0x9d 0x74 0x33 0x48 0x74 0xc1 0xba 0xcb 0xff 0x58 0x86 0x8c 0xba 0x9c 0x08 0xad 0xce 0x8a 0x02 0x00 0x80 0xd5 0xe6 0x38 0xd6 0x8c 0xa8 0xa1 0xae 0xca 0x2e 0xf8 0xc8 0xe2 0x96 0x02 0xa4 This is interpreted as follows: 0x82 0x14 Packet length, 532 bytes follow. 0x04 MSG-SERVER-HELLO 0x00 SESSION-ID-HIT 0x01 CERTIFICATE-TYPE 0x00 0x02 SERVER-VERSION-MSB SERVER-VERSION-LSB 0x01 0xf6 CERTIFICATE-LENGTH-MSB CERTIFICATE-LENGTH-LSB 0x00 0x03 CIPHER-SPECS-LENGTH-MSB CIPHER-SPECS-LENGTH-LSB 0x00 0x10 CONNECTION-ID-LENGTH-MSB CONNECTION-ID-LENGTH-LSB 0x30...0x8a CERTIFICATE-DATA [502 bytes] 0x02 0x00 0x80 CIPHER-SPECS-DATA 0xd5...0xa4 CONNECTION-ID-DATA [16 bytes] CONNECTION-ID is: >>> CONNECTION-ID d5e638d68ca8a1aeca2ef8c8e29602a4 Second message from client 0x80 0x55 0x02 0x02 0x00 0x80 0x00 0x0b 0x00 0x40 0x00 0x00 0xfb 0xc0 0x09 0x91 0x60 0x10 0xa6 0x15 0x3f 0x8f 0x36 0x5a 0x19 0x06 0x8e 0x58 0xc4 0xfa 0xd0 0x73 0xd4 0x6d 0x20 0x97 0x2f 0x85 0x95 0xb3 0xa5 0x97 0xb5 0xe0 0x63 0x91 0x61 0xb7 0x76 0x3c 0x4e 0x62 0x8b 0x02 0x2b 0x05 0x98 0xd4 0x14 0x44 0x63 0xf3 0x43 0x7e 0xa0 0xa8 0x3f 0x16 0xb2 0x43 0x4b 0x24 0x76 0xae 0xba 0x8c 0x89 0x71 0xde 0x25 0x6b 0xce 0x89 0x77 0x8a 0x30 0x2a This is interpreted as follows: 0x80 0x55 Packet length, 85 bytes follow. 0x02 MSG-CLIENT-MASTER-KEY 0x02 0x00 0x80 CIPHER-KIND 0x00 0x0b CLEAR-KEY-LENGTH-MSB CLEAR-KEY-LENGTH-LSB 0x00 0x40 ENCRYPTED-KEY-LENGTH-MSB ENCRYPTED-KEY-LENGTH-LSB 0x00 0x00 KEY-ARG-LENGTH-MSB KEY-ARG-LENGTH-LSB 0xfb...0x36 CLEAR-KEY-DATA [11 bytes] 0x5a...0x2a ENCRYPTED-KEY-DATA [64 bytes] KEY-ARG-DATA So CLEAR-MASTER is: >>> CLEAR-MASTER fbc009916010a6153f8f36 Second message from server 0x80 0x21 0x9a 0xc5 0xf7 0xd1 0x6a 0x5b 0x26 0x43 0x57 0x67 0x65 0xb6 0x3f 0x9a 0xe3 0x82 0x00 0x65 0x99 0xb6 0xd2 0xf2 0xa7 0x36 0xa0 0x7d 0xd9 0x94 0xcf 0xe2 0x33 0xb2 0x1b This is interpreted as follows: 0x80 0x21 Packet length, 33 bytes follow 0x9a...0x82 RC4 encrypted MAC [16 bytes] 0x00 RC4 encrypted MSG-SERVER-VERIFY (0x05) 0x65...0x1b RC4 encrypted CHALLENGE-DATA from CLIENT-HELLO message [16 bytes] Plaintext (MSG-SERVER-VERIFY plus CHALLENGE-DATA): 0x05 0x07 0xea 0x7b 0x9d 0x65 0xeb 0x61 0xfa 0xbb 0x41 0x74 0xe8 0x45 0x3a 0x5f 0xc6 Ciphertext (from SERVER-VERIFY packet): 0x00 0x65 0x99 0xb6 0xd2 0xf2 0xa7 0x36 0xa0 0x7d 0xd9 0x94 0xcf 0xe2 0x33 0xb2 0x1b SERVER-VERIFY is the encrypted MSG-SERVER-VERIFY plus the first seven bytes of the encrypted CHALLENGE-DATA: >>> SERVER-VERIFY 006599b6d2f2a736 So the completed challenge file is: -------------------------------------8<------------------------------------- # SSLbrute 1.0 parameter file for Hal Finney's 2nd SSL challenge as # posted to Cypherpunks on 19 August 1995. # # file checksum (ignoring # comments and whitespace) is 2977 CLEAR-MASTER fbc009916010a6153f8f36 CHALLENGE 07ea7b9d65eb61fabb4174e8453a5fc6 CONNECTION-ID d5e638d68ca8a1aeca2ef8c8e29602a4 SERVER-VERIFY 006599b6d2f2a736 -------------------------------------8<------------------------------------- Adam

1 0

Boylovers, NAMBLA, and Net-vigilantes, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 29 Jul 1997 10:03:46 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Boylovers, NAMBLA, and Net-vigilantes, from The Netly News ----- http://pathfinder.com/netly/opinion/0,1042,1222,00.html The Netly News (http://netlynews.com/) July 29, 1997 This Boy-Lover's Life by Declan McCullagh (declan(a)well.com) Anne Cox is nothing if not determined. For months the Net-vigilante has been unwavering in her crusade against pedophiles, undaunted by insults, threats and even the "horrible things" done to pictures of her as a baby that she had digitized and placed online. She fought back with just about every possible tactic: argument, public humiliation and sometimes-spurious threats of legal action. Now, the war is escalating. It started in May, after Cox launched an assault on "boy-lover" web sites in an attempt to force them offline. But she and her allies ran into a serious obstacle: the sites aren't illegal. They're filled not with child pornography -- which is banned by federal law -- but, instead, photos of boys in swimsuits. "They shouldn't be doing these things with the children's pictures," Cox says. [...] Some argue that Cox and her allies have gone too far. Besides boy-pix sites, this team of Net-vigilantes has attacked a group of gay teens organizing "to fight against" discrimination. They've tried to take down a consensual spanking page for gay adults, and even an archive of sexually-explicit stories that specifically rejects tales about pedophilia. Then there's the murky Children's Protection and Advocacy Coalition, which Cox claims to run -- yet she refuses to name its member organizations. [...]

6 7

Why 64 bit keys?
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Sat, 19 Aug 1995 15:13:35 -0400 >From: shamrock(a)netcom.com (Lucky Green) >Subject: Re: 64 bit keys breakable by the NSA or just some random key length? >I think the obvious conclusion would be because 64bits is crackable >if need be and if you have the resources the goverment has. Not for >routine monitoring of undesirables, but for those special cases >where they don't want to expose their activities by requesting a >warrant. I think it's much more important to the powers that be (and that eavesdrop) that a key of up to 64 bits includes DES, which means that lots of system designers will use DES instead of (say) 3DES, IDEA, or Blowfish. It's virtually certain that NSA and others have built keysearch machines for DES. This gives NSA, et. al., a way around the key escrow scheme when they want it. Better yet, NSA can tell the FBI and BATF and such agencies where to find the technical papers on how to build one, without releasing any highly-classified information--those agencies can hire someone to build them one. This also keeps NSA from having to dirty its hands with law-enforcement surveilance. Of course, it will be interesting to see whether pressure is applied to keep people from offering "nonstandard" ciphers, especially things like Blowfish and SEAL, which have key scheduling algorithms that need a lot of memory and time. It's really only practical to build keysearch machines for very commonly used ciphers, and even then, it may be complicated. (For example, imagine a DES variant whose key schedule required several exponentiations modulo some 1024-bit prime.) >- -- Lucky Green <mailto:shamrock@netcom.com> > PGP encrypted mail preferred. --John Kelsey, jmkelsey(a)delphi.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMDgfl0Hx57Ag8goBAQFa0gP/azECjB06onhSYTvLjkM2I7y2tOpC2BaB RACVMQn+Z5kVGaDM47eIM1TlRnIMlnEucuLryvqR3fMDCt6g90oDXe3rziWJedbH PxXYqgkPu1MmRfep+JWrtQ4wWsXxbPa10spTDFa8vKlGDcoohWU0W5ypgr454tlh KKPaC345vqQ= =td/F -----END PGP SIGNATURE-----

1 0

Majority in house support SAFE encryption bill, from SPAlert
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 29 Jul 1997 10:19:36 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: Majority in house support SAFE encryption bill, from SPAlert [From an alert put out by the Software Publishers Association. (I skipped the press conference.) --Declan] ---------- Forwarded message ---------- Encryption --------------- MAJORITY IN HOUSE SUPPORT PASSAGE OF ENCRYPTION BILL Rep. Bob Goodlate (R-Va.) and Rep. Zoe Lofgren (D-Calif.) will hold a press conference in room HC7 in the U.S. Capitol today to announce that a majority in the House of Representatives have signed on as co-sponsors of H.R. 695, the Security and Freedom through Encryption (SAFE) Act. SPA today called on the Clinton administration to immediately cease its opposition to the SAFE Act, which allows the free export of encryption products while providing American businesses with the tools needed to protect corporate data. "Forty years ago, John F. Kennedy wrote 'Profiles In Courage' on political leaders with the moral and political courage to resist the easy path and, instead, make difficult choices in the national interest. Today, members of the House passed this test of courage with flying colors," said Ken Wasch, SPA president. "On the other side of Capitol Hill, however, the ghost of J. Edgar Hoover lurks in the cloakrooms of the Senate. Rather than taking a courageous stand for America, some Senators would rather follow the administration's play book, trading personal freedoms for what they themselves admit is only marginal improvement." "House members have clearly studied the issue and recognize that burdening high-tech industries with oppressive regulation and restrictive export controls will only harm America and law enforcement in the long run. Law enforcement concerns cannot be addressed by mandating technology but by adopting policies ensuring technical progress and innovation occurs in the United States." The SAFE Act now proceeds to the Commerce, Intelligence, and National Security Committees, all of which have until September to vote on the legislation. For full text of the release, visit http://www.spa.org/gvmnt/releases/hmajority.htm. For access to Rep. Goodlatte's Web page regarding the SAFE Act, visit http://www.house.gov/goodlatte/encryption.htm. For full text of SPA's statement following the SAFE Act's passage by the House Committee on International Relations, visit http://www.spa.org/gvmnt/releases/encryptpr.htm. For further information, contact Lauren Hall at (202) 452-1600, ext. 313, or lhall(a)spa.org.

1 0

Sorry about accidental spamming
by Tom Helenius 17 Dec '03

17 Dec '03

Dear Security Professional, We apologize for the annoyance and confusion we might have caused to you due to human error in our email addressing. As a result some of our internal emails about the newly announced F-Secure VPN v1.1 software were erroneously emailed to your attention. It is definitively not our company policy to contribute to spamming on the Internet, and we do hope that you'll still want to receive the otherwise unbiased information sent to the members of our press list. Yours sincerely, Tom Helenius Data Fellows -- Tom.Helenius(a)DataFellows.com, World-Wide Web http://www.DataFellows.com

1 0

ALERT: Show Your Support for Privacy on the Net During August
by Jonah Seiger 17 Dec '03

17 Dec '03

============================================================================== ___ _ _____ ____ _____ _ / _ \| | | ____| _ \_ _| | Visit Your Member of Congress during the | |_| | | | _| | |_) || | | | Month of August - Help Support Privacy | _ | |___| |___| _ < | | |_| and Security on the Net!! |_| |_|_____|_____|_| \_\|_| (_) Posted July 29, 1997 Please forward where appropriate until September 2, 1997 This alert brought to you by The Voters Telecommunications Watch, the Center for Democracy and Technology, the Electronic Frontier Foundation, EFF-Austin Americans for Tax Reform, and Wired Magazine _____________________________________________________________________________ Table of Contents What's Happening Right Now What You Can Do To Help Privacy And Security On The Internet - Meet Your Member of Congress, Tell Them How You Feel Background On The Encryption Policy Issue and HR 695, the SAFE bill What's At Stake in this debate About This Alert _____________________________________________________________________________ LET YOUR VOICE BE HEARD... The government is demanding that you provide guaranteed law enforcement access to your private online communications and business transactions. Your Congressman will be heading home for the month of August. Now is a great time to let him or her know that privacy on the Internet is important to you. Please read the ALERT below and find out what you can do to help. ________________________________________________________________________ WHAT'S HAPPENING RIGHT NOW The FBI, CIA, NSA and other law enforcement agencies are pressuring Congress to pass legislation to force anyone who wants to protect their privacy on the Internet to use programs with built in "key recovery" features -- virtual back doors which would allow law enforcement (and anyone else sophisticated enough to find a weakness) access to your private communications. This effort by the Clinton Administration to force the domestic use of government approved "key recovery" encryption represents a very real threat to your privacy and security in the Information Age. Fortunately, a bill known as the "Security and Freedom Through Encryption Act" (HR 695) is making its way through the House of Representatives. The bill, known as SAFE, would help protect privacy and security on the Internet by: * Prohibiting the government from imposing key recovery or key escrow encryption inside the United States or abroad. * Allowing Americans the ability to use whatever form of encryption they choose. * Encouraging the widespread availability of strong, easy-to-use encryption technologies by relaxing cold war-era export restrictions. SAFE enjoys support from a bi-partisan majority of 250 Members of the House of Representatives, and has been endorsed by civil liberties and public interest groups from both sides of the political spectrum, as well as a broad cross section of the computer and communications industries. The SAFE bill has recently cleared two key House committees and is expected to be voted on by the full House of Representatives in September. As your Representatives in Congress head home for the August recess, now is a great time to let them know that the folks back home care about protecting privacy on the Internet. Please read the instructions below to find out what you can do to participate in "Meet Your Member Month," and join the fight to protect your right to privacy online. ________________________________________________________________________ WHAT YOU CAN DO NOW Between August 1 and September 2, Congress will be in recess and your Congressman will be in your area meeting with constituents at large town hall meetings and individual appointments. These meetings are a great opportunity to show them that the folks back home care about privacy on the Internet. If you can't make a meeting, consider sending a letter or making a phone call to your Congressman's home office. Whatever you can do to show your support for privacy and security on the Net will make a big difference when the issue is voted on by the full house in September. Instructions: 1. Visit http://www.crypto.com/member/ Simply enter your Zip Code to: * Find the name and contact information for your Representative * Sign up to join the Adopt Your Legislator Campaign; * Learn about your Congressman's voting record and positions on the encryption issue; * Tips on how to set up a meeting and contacting your Congressman; * Links to background information on the SAFE bill, and more. 2. Forward this ALERT to your fiends and colleagues. Urge them to join Adopt Your Legislator campaign at http://www.crypto.com/adopt/ Two years ago, the Internet user community responded in overwhelming numbers to the threat of censorship and joined together to defeat the Communications Decency Act. The ongoing debate over US encryption policy reform is no less important, and will determine the future of privacy and security in the Information Age. Now is the time to join the fight, before its too late. ________________________________________________________________________ BACKGROUND ON THE ENCRYPTION POLICY ISSUE Complete background information, including: * A down-to-earth explanation of why this debate is important to Internet users * Analysis and background on the issue * An analysis of the Risks of Key-Recovery by leading cryptographers * Text of the Administration draft legislation * Text of Congressional bills to reform US encryption policy, includig SAFE * Audio transcripts and written testimony from recent Congressional Hearings on encryption policy reform * And more! Are all available at http://www.crypto.com/ ________________________________________________________________________ WHAT'S AT STAKE Encryption technologies are the locks and keys of the Information age, enabling individuals and businesses to protect sensitive information as it is transmitted over the Internet. As more and more individuals and businesses come online, the need for strong, reliable, easy-to-use encryption technologies has become a critical issue to the health and viability of the Net. Current US encryption policy, which limits the strength of encryption products US companies can sell abroad, also limits the availability of strong, easy-to-use encryption technologies in the United States. US hardware and software manufacturers who wish to sell their products on the global market must either conform to US encryption export limits or produce two separate versions of the same product, a costly and complicated alternative. The export controls, which the NSA and FBI argue help to keep strong encryption out of the hands of foreign adversaries, are having the opposite effect. Strong encryption is available abroad, but because of the export limits and the confusion created by nearly four years of debate over US encryption policy, strong, easy-to-use privacy and security technologies are not widely available off the shelf or "on the net" here in the US. A recently discovered flaw in the security of the new digital telephone network exposed the worst aspects of the Administration's encryption policy. Because the designers needed to be able to export their products, the system's security was "dumbed down". Researchers subsequently discovered that it is quite easy to break the security of the system and intrude on what should be private conversations. This incident underscores the larger policy problem: US companies are at a competitive disadvantage in the global marketplace when competing against companies that do not have such hindrances. And now, for the first time in history, the Clinton Administration and members of the US Senate have proposed DOMESTIC RESTRICTIONS on the ability of Americans to protect their privacy and security online. All of us care about our national security, and no one wants to make it any easier for criminals and terrorists to commit criminal acts. But we must also recognize encryption technologies can aid law enforcement and protect national security by limiting the threat of industrial espionage and foreign spying, promote electronic commerce and protecting privacy. What's at stake in this debate is nothing less than the future of privacy and the fate of the Internet as a secure and trusted medium for commerce, education, and political discourse. For more information on this issue and the various legislative and administration proposals to reform US encryption policy, visit http://www.crytpo.com/ ________________________________________________________________________ ABOUT THIS ALERT This message was brought to you by the following Internet advocacy groups who have joined togther to educate Congress and the public about the importance of encryption policy reform: * the Center for Democracy and Technology -- http://www.cdt.org/ * the Voters Telecommunications Watch -- http://www.vtw.org/ * the Electronic Fronter Foundation -- http://www.eff.org/ * EFF-Austin -- http://www.eff-austin.org/ * Americans for Tax Reform -- http://www.atr.org * Wired Magazine -- http://www.wired.com/ For more information, visit http://www.crypto.com/about/ _____________________________________________________________________________ end alert 07.29.97 ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ HOW TO REMOVE YOURSELF FROM CDT'S POLICY POST LIST: To unsubscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: unsubscribe policy-posts ----------------------------------------------------------------------------

1 0

Re: Boylovers, NAMBLA, and Net-vigilantes, from The Netly News
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

> From: Declan McCullagh <declan(a)well.com> > To: fight-censorship(a)vorlon.mit.edu > Subject: Boylovers, NAMBLA, and Net-vigilantes, from The Netly News > ----- > http://pathfinder.com/netly/opinion/0,1042,1222,00.html > It started in May, after Cox launched an assault on "boy-lover" > web sites in an attempt to force them offline. But she and her allies > ran into a serious obstacle: the sites aren't illegal. They're filled > not with child pornography -- which is banned by federal law -- but, > instead, photos of boys in swimsuits. "They shouldn't be doing these > things with the children's pictures," Cox says. ROTFLMAO! I checked out the "Sewer" site and followed the links. It seems that the threat of "boylover" porno on the Internet is so slight that dear Ms. Suques-Cox's list of "evil" sites is mostly links to the sites of child actors and actors-guild types of sites which are for the purpose of highlighting their careers, promote fan clubs, etc. In addition, she demands that these sights post (or email her) some type of "disclaimer" in order to be removed from her sewer list, despite the fact that the "dirt" seems to be entirely in her twisted little mind. No doubt Ms. Suques-Cox is raking in the dough in her efforts to "fight the good fight" against the demons in her mind, by projecting them into an outside threat to her world-view. I was thinking that perhaps I might be able to ride this fascist trend to the Big Buck$ by attacking web sites which contain perverted pictures of such things as cantalopes, cucumbers, valleys, caves, obleisks--pretty much anything that is longer than it is wide, or deeper than it is flat. TruthMonger

1 0

Re: y2k problem *serious*
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Ray Arachelian wrote: > Ah, so "Toto" is still with us (if only shadowed by the cloak work of the > lurker...) Ray, Prying open my 3rd eye. So good to see you once again. I thought you were hiding. And you thought that I had run away. Chasing the tail of dogma. I opened my eye and there we were.... "Woof" <wag-wag> "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix "WebWorld & the Mythical Circle of Eunuchs" http://bureau42.base.org/public/webworld "The Final Frontier" http://www3.sk.sympatico.ca/carljohn

1 0

No Subject
by Harry Tuttle Remailer 17 Dec '03

17 Dec '03

someone wrote: >>A. It's unsolicited spam. Not a big deal. >>B. The way they gathered the list of addresses is questionable, >> and likely off Jim's HD. Its pretty straightforward for interested perties to get a list of everyone on a mojordomo mailinglist even if the who command is disabled as long as we have our old friend sendmail and his trusty sidekick expn. nc toad.com 25 220 toad.com ESMTP Sendmail 8.7.5/8.7.3; Tue, 29 Jul 1997 12:59:12 -0700 (PDT) expn cypherpunks 250-<"|/u/majordom/bin/wrapper resend -p bulk -l cypherpunks -f owner-cypherpunks-unedited -h toad.com -s cypherpunks-unedited-outgoing"@toad.com> 250 </gnu/mail/cypherpunks-in(a)toad.com> expn cypherpunks-unedited-outgoing 250-<jxx(a)pipeline.com> 250-<sxxxxx(a)slecrs2.sbc.com> 250-<sxxxxx0(a)laf.cioe.com> 250-<wmxxx(a)direct.ca> 250-<toxx(a)sk.sympatico.ca> 250-<zacxx(a)netcom.com> 250-<waxx(a)mls1.HAC.COM> 250-<dm+cypherpunks-unedited(a)amsterdam.lcs.mit.edu> 250-<paxxx(a)fatmans.demon.co.uk> ------ more addresses cut ---------- I have xed out the names but you get the picture. no need to go through the effort of watching a list for posts or searching through someone's old mail. If you have any complaints email: expn owner-cypherpunks-unedited 250 Cypherpunks Admin <cpadmin(a)toad.com>

2 1

Re: Libertarians for whom Jim Bell tolls...
by EFF 17 Dec '03

17 Dec '03

-------Fwd: Private Email (Identities XY'ed)------- Subject: Re: Libertarians for whom Jim Bell tolls... Date: Tue, 29 Jul 1997 11:32:11 -0800 From: XXXXXXXX To: YYYYYYYY >> "In the plea agreement, BELL also admitted that on March 16, 1997, he >> conducted a chemical "stink bomb" attack on the IRS office in Vancouver, >> Washington, using the noxious chemical mercaptan. ... > This is interesting, since they had no evidence that he did so. >However, they managed to get him to "confess" by illegally holding >without bond for crimes which they never intended to charge him with >in the first place. > I hope that Jim's lawyer is suitably rewarded for his part in selling >Jim down the river. Nancy Lord has had a lot of success in cases like this, and was interested in helping Bell's public defender file briefs challenging a lot of the IRS' charges and behavior, on First Amendment grounds. She tells me the public defender never even returned her calls. >> "IRS Inspectors indicated that the mercaptan attack may have been linked >> to the Feb. 20, 1997 seizure of BELL's vehicle by the IRS for unpaid taxes. > In effect, they are saying that since they didn't have any evidence >against Jim for the crime that they wanted him to "pay" for, that they >used the threat of major criminal charges to convince him to "confess" >to the crime, and held him without bail to let him know that the Justice >system is under the control of the IRS, and not the defendant. More or less. The big fuss, and the reason for holding without bail, was supposedly that his web postings constituted evidence he was planning to assassinate IRS agents. Yet, curiously, he was never charged with anything like "conspiracy to solicit murder." Instead, people go to jail for years for the equivalent of pouring skunk urine on someone's welcome mat, and for "using false SS numbers." Funny, I thought the folks who gave us SS numbers swore they'd always be confidential between us and our SS retirement fund manager, and would "never be used as a national ID number." Since I'm sure the SocSec Administration would never confirm or deny for the IRS Mr. Bell's REAL SS number, I wonder who they knew which ones were bogus? Are we to believe SocSec has never made a mistake, and issued one person two numbers? Anyway, was Mr. Bell accused of using the bogus numbers to fraudulently extort wrongful benefits from the SocSec Administration? Apparently not. So. since money will be withheld from your paycheck no matter WHAT SS number you file, the only possible "fraud" can have been to work different jobs under different numbers -- with no chance of ever collecting any "benefits" from the "bogus" accounts. An odd kind of "fraud," that pays money to the government with no hope of ever getting any back. >Vin, > Did you know that the IRS used the information gleaned from Jim Bell's >hard drive to send the "chilling" details of Jim Bell's plea agreement >to the individuals and mailing lists he corresponded with? > Did you know that when he arrested, there were no Assassination Bot's >in existence, and that there are now at least six prototypes currently >in operation? > > God Bless AmeriKa. > >XXYYZZMonger Hi -- It would probably be considered (by overzealous pro-government extremists) a violation of some bogus new enactment if I proposed that it would be a good idea for someone to widely and publicly post the names and home addresses of every employee of the IRS ... and possible the FBI, DEA, and ATF, to boot (after all, those people have no problem accessing the intimate details of OUR personal lives, on a moment's notice. We all live in more or less constant fear of THEIR midnight knock on the door.) So I won't suggest that. I don't suggest that. I hope no one ever does that. And if anyone ever does, I CERTAINLY hope such lists are not widely downloaded and disseminated. X.Y.

1 0