December 2003 - cypherpunks-legacy

(Fwd) Returned mail
by Richard F. Dutcher 17 Dec '03

17 Dec '03

> Date: Sat, 11 Feb 1995 01:41:09 -0600 > To: cypherpunks(a)toad.com > From: dls(a)mcs.com (David Sallach) > > > >"Free" speech has always been a balancing act. The founders > >certainly didn't intend to provide "free" speech for blacks and > >women. > > The Founders created a larger space for free speech than had ever > existed. Slaves were deprived of many freedoms including speech, of course, > but women and free blacks were included in the Bill of Rights and exercised > free speech, frequently compellingly. > And were frequently thrown in jail for their pains - note especially the experiences of the early feminists [anachronistic label alert]. And let us not forget what happened to the Mormons ... > Check out Frederick Douglass' practicing oration while still a > slave, and then winning his freedom to become one of the greatest > abolitionist orators. Consider the appreciation of diversity of thought and > speech manifested by Jefferson, Lincoln and many other American political > leaders. > > And Douglass spent a good portion of his life as a refugee in a protected enclave [Boston] where he had powerful friends to keep him from being arrested. I'm not dissing the Founders, or the Bill of Rights -- just the simplified pap their invocation in most discourse has become. I was trained in high school as a scientist, and in college as an historian, and in both instances to value the messy contingent realities over the tempting simplicities of ideology and theory. And there are few contingent realities messier than the law ... > > . . . "They" have never liked "free" speech ... :-( > > Invoking poitically 'correct' stereotypes does not strengthen your > argument. > > David Sallach Irony-impaired, are we? There's a Polish word, used by most of the populace after the 1979 coup to refer to the army and apparat, that is usually translated as "them." I [probably incorrectly] recall it as "Oni" -- would you prefer it? My own first encounter with the term "politically [in]correct" was among 70's feminists, who used it ironically, to tell people they needed a vacation/to get laid/to get a grip. Would that Newt used it that way ... =================================== Rich Dutcher, San Francisco Greens P.O. Box 77005, San Francisco, California 94107 USA "That's libertarians for you - anarchists who want police protection from their slaves." Kim Stanley Robinson, "Green Mars" Greens, of course, only enslave plants - so weed-whackers work better than cops ... ====================================

1 0

Distributed Key Service for PGP (was: why pgp sucks)
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Matt Blaze writes: > >Doesn't having some kind of central record of keys go against > >the principle of PGP? > > The only "principle" of which I'm aware (and particularly interested > in supporting) is that of having widely fielded, useful and strong > privacy and authentication tools that work properly and transparently. > That means, among a great many other things, flexible protocols > and tools that support remote key distribution services. Another main principle of PGP is that it _has_ to be able to work in a decentralized fashion, so it's usable by > the civilizing forces of Anarchy (PGP?) even if the most common uses are in the centralized wired real-world. Perry and other write: [ lots of things about the need for distributed scalable key servers ] [ particularly the numeric-only IDs. ] There are two main times you need to get PGP keys - encrypting a message to someone, and validating a signature from someone. The former can be distributed easily enough - use something DNS-like to serve keys for joe_user(a)foo.bar.com, and add them to your local keyring if they're not there (possibly with temporary keyrings, if that's easy enough on PGP version N.) Fetching keys needs to be a separate tool from PGP anyway, since PGP should be general enough to work on wired and unwired systems, with different protocols and APIs for using the available networks. (And of course, the fetched keys need to be validated using web_of_trust or whatever, adding yet another step.) Sounds like a job for a shell... The latter problem is more difficult - partly PGP's fault, but partly because the underlying problem is harder. Signed documents _may_ arrive from keyids not on the keyservers, whether they're from non-wired users, users who wish to remain pseudonymous, one-or-two-use keys, etc.... What PGP can be blamed for, which will hopefully be addressed in version 3.x, is that it's possible to have collisions in the abbreviated key_ids, especially for the optional short key_ids that have been requested as an added feature for people who _very strongly_ want to remain anonymous. (There have already been collisions in the 24-bit key_ids, and it's been shown that it's possible to generate arbitrary key_ids if you _want_ to cause a collision, as well as birthday-problem probabilities of random collisions.) One way to address it is to make it easy to loop through a bunch of keys with the same key_id, which is a bit tough given PGP's current MS-DOS-like interface. Another way is out-of-band attachment of the user_id with the message, followed by DNS-like lookup, or attachment of the signature key with the message, accompanied by a lookup to validate it. As Matt said, there's a lot of policy-vs-mechanism issues here; PGP version 3.0 will have some library support that makes it easier to build some of these things. Bill

1 0

Re: CDT POLICY POST No.2 -- X9 TO DEVELOP TRIPLE-DES STANDARDS
by Richard F. Dutcher 17 Dec '03

17 Dec '03

> > One is forced to wonder at the sort of person that can with a straight > face argue that on the one hand an algorithm is cryptographically > unsound, while at the same time posing a threat to national security. > A lawyer, of course ... ;-} =================================== Rich Dutcher, San Francisco Greens P.O. Box 77005, San Francisco, California 94107 USA "That's libertarians for you - anarchists who want police protection from their slaves." Kim Stanley Robinson, "Green Mars" Greens, of course, only enslave plants - so weed-whackers work better than cops ... ====================================

1 0

Re: Is Cyberspace Rich Enough?
by Richard F. Dutcher 17 Dec '03

17 Dec '03

One of the problems commenting on long thoughtful posts is the number of hooks, and limiting oneself to just a few. [delete lots of interesting stuff] > > ... After all, the Soviets > couldn't stop samizdats, the Chinese couldn't stop fax machines, and > the Americans can't stop drug use, so what hope is there in > controlling modems, crypto, cellular phones, satellites, Web links, > stegonography, terabytes of data flowing unobstructed across borders, > and so on. Just to "stop the Net" would disrupt the entire financial > system, which not even Clinton or the next (Republican) President > would be tempted to do....they might as well launch a nuclear war as > try to shut down this "anarchic" ( = high dimensionality) system. > Well, I certainly hope so. But let's remember Poland in 1979, where "they" were desperate enough to shut down the entire phone system. It gained them only an extra 10 years of control, but it cost the Poles a *lot* of misery. But "samizdat" raises an interesting economic issue around security. The Soviets paid just enough attention to the circulation of hand-written or typed copies to make sure people spent a lot of time and energy at it -- time and energy not spent on more obviously dangerous activity. Compare the volume of Solzenhitsen's output before and after exile [let's not debate quality]. That didn't mean samizdat wasn't subversive and long-term dangerous -- but it was very expensive and absorbing to dissidents and potential dissidents. But that's the situation cypherpunks [and friends :] want to put our hypothetical eavesdroppers [government or corporate] in. Not exactly harmless, but spending a lot of time and energy being concerned with the chasing multiple carbon copies of samizdat novellas. > > * Alternative Nets, like FIDONet, are often lost in the discussion of > "the Net," but perhaps we should take much greater interest in these > alternatives. They make a crackdown harder, they lessen the dangers of > a single-point attack, and they provide "genetic diversity" for > building future Nets. (I'm not saying Cypherpunks have the time, > expertise, or incentive to work on this, but just reminding folks that > the Internet is not the end all and be all...) > I find that techno-illiterate Greens have very little trouble understanding FIDONet -- it's the kind of small-scale organizing within larger networks that a lot of progressive activity has always followed. They find it very hard to believe that other kinds of techie nets are really secure in the long run. It is, in fact, the level of activity that the Poles reverted to without the phone system ... > Personally, I think there are fewer long essays and analyses for the > same reason there are fewer large predators than grass-munching > herbivores. > > --Tim May > Geez, I have enough trouble getting card-carrying Greens to use and/or develop good ecological metaphors without some crypto-anarcho-libber punk muscling into the territory! ;-) =================================== Rich Dutcher, San Francisco Greens P.O. Box 77005, San Francisco, California 94107 USA "That's libertarians for you - anarchists who want police protection from their slaves." Kim Stanley Robinson, "Green Mars" Greens, of course, only enslave plants - so weed-whackers work better than cops ... ====================================

1 0

Re: EPIC to Debate Exon on CNN
by skaplin＠mirage.skypoint.com 17 Dec '03

17 Dec '03

>On Mon, 13 Feb 1995, Samuel Kaplin wrote: >> A sellout was offered a >> la EFF and DT. Mr. Rotenberg seemed ill prepared and not really >> interested in the issue. > >You expected something different from "EPIC"? > >Cypherpunks are supposed to be paranoid. You are >not paranoid enough. > I don't think paranoia has anything to do with it. I just expect people to do the job that they are supposed to do. IMHO Mr. Rotenberg didn't do his job as well as he should have. I saw numerous opportunities to score salient points and he didn't. What Senator Exon says and what the bill says are two different things. I got the feeling that Senator Exon didn't even understand the ramifications of the bill. The unfortunate part is Joe Blow on the street isn't going to read the bill. He's going to rely on what he has heard. In my opinion Mr. Rottenberg didn't correct Senator Exon forcefully enough. The consumate politician triumphed. Sam

1 0

Internationalism no panacea
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Two recent news stories cast doubt on the principle that the international aspects of the nets will prevent governments from enforcing their laws "in cyberspace". One is the possible trade war between the U.S. and China over that country's continued support of intellectual property piracy, in video, audio, and computer software. Apparently the U.S. is very serious about imposing sanctions because of this problem, while China is threatening retaliation. It is quite amazing to me to see these two big countries going to the mat over "just bits" but as we know bits are big business now. Think of our recent discussions of putting data havens offshore. If the U.S. is willing to turn the screws on a nuclear power like China, how much protection will some dinky Caribbean country offer when people make Windows 96 and Jurassic II available for download for $5 ecash? IMO the trend is going to be toward international enforcement efforts, a general movement towards uniform information laws. The other story related to the idea that individuals can evade laws by moving from country to country as tourists. Apparently in the recent budget bill was a little-publicized change in the tax treatement of people who renounce their U.S. citizenship. (The change would be retroactive to last week and was kept quiet until then to prevent a surge of people leaving.) Since you earned all your assets as a citizen of the U.S., naturally when you leave the grasp of that country you will not longer get to take it all with you. Instead you will apparently have to pay capital gain taxes on some substantial fraction of your assets. The article I read went on to discuss the problems many countries are having with people playing citizenship games. The implication was that this may be just one step in a crackdown to close many of the loopholes that allow people to travel under one flag or another. My take on this is that human ingenuity is sufficient that there will always be new loopholes found, and that a sufficiently energetic and motivated person will probably be able to stay one step ahead of the enforcers. However, this will not be a lifestyle that can be turned into a cookbook; as soon as some trick became widely known, the loophole would be closed. So this is something which will be available to an elite but not to the masses. Hence I don't see "perpetual tourism" as something which will be a serious threat to government power. My views are somewhat iconoclastic for this list; I don't see cryptography as bringing about a libertarian/anarchist state. I continue to believe that the best and only way to achieve freedom for the mass of people is to convince them that it is a good idea. A small elite can and will continue to be able to avoid many laws, and crypto will no doubt be useful to them. But IMO it is not going to change the shape of society. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBL0BQchnMLJtOy9MBAQGJaAH/WTtd0bYeqKy89AUOSaSdraxN7YNZ2z42 +rJCQH0NS8x3ILT8VT8XtSIuYltBGsQkPagUqYtn3vM/rp3ssPhr/w== =JFan -----END PGP SIGNATURE-----

1 0

Cypher_punks standards, again.
by M00012＠kanga.stcloud.msus.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Cypherpunks, Q. What do I mean, standards? A. A set of specifications that will allow encryption modules to be incorperated into receptacle encryption interface programs easily. The advantages of programs that comply with the CP standard might be illustrated with an example. Suppose Alice wants to use an interface program, say, GENPGP.EXE, to encrypt a message to Bob. Suppose that GENPGP is an interface encryption receptacle program that allows users to add and use their own encryption modules of choice. If Alice were a command line freak, she could type: GENPGP -RSA_encrypt_the_session_key \ -random_session_key_source ISA_Johnson_Noise_ADC \ -chainsession \ -blowfish -rounds 18 -keylength 2048 \ -idea \ -3descfb \ -compress pkzip \ -plain_text_file topsec.doc -receipient bob Or, suppose Alice is a GUI freak. In this case she could use her entcrypt_lab schematic interface to design and save her encryption scheme for topsec.doc, and simply drop the icon for the doc into her block diagram's input icon. Bob, in either case, is still able to use his own program of choise, GNU_safe_mail, to automatically decrypt Alice's message to him, so long as Bob has incorperated all of the latest modules availible. Q. What are some advantages? A. There are numerous advantages. Some programmers are good at writing user interfaces, and others are better at implementing algorithms. Currently, many programmers of the second type make all sorts of encryption algorithms available, but these are not always easily understood by programmers of the first type, and more importantly, coded algorithms are not easily incorperated into existing programs. Another problem that may arise is that existing programs, and programs that may come out in the next year or two, may gain widespread use (e.g. PGP.EXE), but may at some time in the future become practically worthless, for example, if widely used interface programs rely on encryption algorithms that are discovered or perceived to be weak. If a standard such as the one I am proposing is released and gains acceptance, more programmers will comply, and this will allow the users of their interfaces to painlessly adapt the interface programs. More importantly, such interface programs that make use of CP complient encryption modules will allow users to encrypt as insecurely or securely as their parinoia dictates. Also, as new encryption algorithms are invented and coded, hackers who like to optimize may take the extra step and make their code CP complient. And command line Alice will be able to type: GENPGP -add_module BlowFish.mod Q. What are the disadvantages? A. At first blush, one disadvantage is options, like PGP's -m, (for your eyes only) are not practical for a standard such as the one I am proposing. But then again, even using the command: PGP -em susan.doc is little more than a suggestion to the recepient of the letter to not keep the plaintext around. Q. Why should we? A. If we don't, IEEE or some other organization is bound to, and IEEE seems to be getting more politically correct as the years pass, and this doesn't seem to be compatible with the purpose of an encryption module standard. Consequently, I believe that such a task should be initiated and taken to completion by a renegade group such as the cypherpunks, by committe if possible, with the hopes that government moles will not weaken our effort. Mike Morgan -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBMNBuvbwEeVpjJyiBAQEi5QP/T9FmRS2nwWq0lr9iT+cQWMEMV1++Hpf3 u0OWnYYFlRjgJPxTa5vT549tgGeRGV+CB+TI6N3Aj96+LTWb34qS5Y0W2x7R5FEg +XnACQRs9G5qIK4Zn114KlWXyx7Mj0QQCeo4h86gISdrWkfSJiYkwEoGgzcf6ocF gp45YZLznnk= =cMFk -----END PGP SIGNATURE-----

1 0

URL for Crypto Hearing Transcript
by John Young 17 Dec '03

17 Dec '03

We've put the dox at: http://site108240.primehost.com/hir-hear.htm (97K hearing transcript) http://site108240.primehost.com/crypto-law8.htm (11K Reno letter)

1 0

(DBWORLD) Massive Digital Data Systems
by nwosuck＠harpo.wh.att.com 17 Dec '03

17 Dec '03

Birds of a Feather Session on the Intelligence Community Initiative in Massive Digital Data Systems To be held in Conjunction with the 1995 ACM SIGMOD International Conference on Management of Data in the Crystal Room at The Fairmont Hotel, San Jose, California on Tuesday, 23 May 1995 from 7 pm to 9 pm ******************************* Massive Digital Data Systems (MDDS) will require effective management, retrieval, and integration of databases that may be heterogeneous. Achieving this concept of massive intelligence information systems will require new technologies and novel approaches for data management. While several advances have been made in database management technology, the complexity and the size of the database coupled with the unique needs of the Intelligence Community (IC) require the development of novel approaches. The MDDS Initiative has been started by the Community Management Staff (CMS) of the IC to identify the data management issues and challenges as well as to develop possible solutions for managing massive databases., The purpose of the Birds of a Feather Session is to provide an overview of the MDDS program, solicit input toward developing a testbed /framework for the initiative, and to have technical discussions on novel methods for managing massive databases. Tentative agenda for the session is as follows: 1. Overview of MDDS Initiative 2. Overview of MDDS Research Projects 3. Discussion on testbed/framework 4. Discussion on techniques for massive database management Information on the MDDS Initiative can be obtained from : http://www.nml.org/other_programs/mdds/mdds.html For more information contact: Dr. Bhavani Thuraisingham K329, The MITRE Corporation, Burlington Road, Bedford, MA 01730 email: thura(a)mitre.org; Phone: 617-271-8873; Fax: 617-271-2352 ------------------------------------------------------------------------------- The dbworld alias reaches many people, and should only be used for messages of general interest to the database community. Requests to get on or off dbworld should go to listproc(a)cs.wisc.edu. to subscribe send subscribe dbworld Your Full Name to unsubscribe send unsubscribe dbworld to change your address send an unsubscribe request from the old address send a subscribe request from the new address to find out more options send help ------------------------------------------------------------------------FOOTER-

1 0

(DBWORLD) MDDS Session Time Change
by Bhavani Thuraisingham 17 Dec '03

17 Dec '03

5/15/95 5:17 PM MDDS Session Time Change Birds of a Feather Session on the Intelligence Community Initiative in Massive Digital Data Systems Held in Conjunction with the 1995 ACM SIGMOD International Conference on Management of Data in the Crystal Room at The Fairmont Hotel, San Jose, California on Tuesday, 23 May 1995 from 7:30 pm to 9:30 pm ******************************* Massive Digital Data Systems (MDDS) will require effective management, retrieval, and integration of databases that may be heterogeneous. Achieving this concept of massive intelligence information systems will require new technologies and novel approaches for data management. While several advances have been made in database management technology, the complexity and the size of the database coupled with the unique needs of the Intelligence Community (IC) require the development of novel approaches. The MDDS Initiative has been started by the Community Management Staff (CMS) of the IC to identify the data management issues and challenges as well as to develop possible solutions for managing massive databases., The purpose of the Birds of a Feather Session is to provide an overview of the MDDS program, solicit input toward developing a testbed /framework for the initiative, and to have technical discussions on novel methods for managing massive databases. Tentative agenda for the session is as follows: 1. Overview of MDDS Initiative 2. Overview of MDDS Research Projects 3. Discussion on testbed/framework 4. Discussion on techniques for massive database management Information on the MDDS Initiative can be obtained from : http://www.nml.org/other_programs/mdds/mdds.html For more information contact: Dr. Bhavani Thuraisingham K329, The MITRE Corporation, Burlington Road, Bedford, MA 01730 email: thura(a)mitre.org; Phone: 617-271-8873; Fax: 617-271-2352 ------------------------------------------------------------------------------- The dbworld alias reaches many people, and should only be used for messages of general interest to the database community. Requests to get on or off dbworld should go to listproc(a)cs.wisc.edu. to subscribe send subscribe dbworld Your Full Name to unsubscribe send unsubscribe dbworld to change your address send an unsubscribe request from the old address send a subscribe request from the new address to find out more options send help ------------------------------------------------------------------------FOOTER-

1 0