December 2003 - cypherpunks-legacy

Re: Cypherpunks' ideal escrow agent
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- James Childers <ic58(a)jove.acs.unt.edu> wrote: >I've seen the idea of voluntary key escrow discussed before on this list. >(And no, not the government's idea of "voluntary", either.) A question I >would raise is this: What would be the ideal setup for an escrow agency? >If I were to open up an agency for business, what would be some >characteristics you would look for? Exactly what the government *doesn't* want, I'm afraid... I would want them to honor *only* warrants which involve crimes dealing with at least the possibility of an individual, articulable victim. Despite much hot wind about "terrorism" from the FBI to the contrary, the reason for "GAK" [I liked "FUCKED" better] is to allow prosecuting the tax-and-spend drug war to remain possible. Also, the temptation to ignore any warrant requirement and screen *political* e-mail if a "minor" political party started to gain prominence would be nearly overwhelming to any non-angels with "real-time" decryption capability. Political debates these days are (obviously) won by sound bite, and advisors want to be prepared for a sound "byte" such as "tax-and-spend drug war" [Oops, can't use that one now!] :) flying through cyberspace toward an opponent, just as Reagan was (supposedly) prepared for Carter's lines before their debates. <zipping up my Nomex bodysuit now...> JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMDUDZ21lp8bpvW01AQFx0wP/b5c5xTxyGygbTcRJriErK9dD0ahfFXEu SSpqmExn+E+aD6tYNQNEDS50pnT8wOI7IKQjVLGGEZKfmeZRIU7gnT0jttbHV14c QnMGkMsEsVK3R2YkWPGavhPeJwdrwHrvYC/xUFzrtSJHQQ1u7X3LXubjS2vikcVJ mxqfYoUympA= =YEMs -----END PGP SIGNATURE----- Regards, Jim Ray "The important thing is not to stop questioning. Curiosity has its own reason for existing. One cannot help but be in awe when he contemplates the mysteries of eternity, of life, of the marvelous structures of reality. It is enough if one merely tries to comprehend a little of this mystery every day. Never lose a holy curiosity." -- Albert Einstein ------------------------------------------------------------------------ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 ------------------------------------------------------------------------ Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! email: zldf(a)clark.net or visit http://www.netresponse.com/zldf ________________________________________________________________________

1 0

News from the Front (July Issue)
by news＠sldc.ffg.com 17 Dec '03

17 Dec '03

An update to our customers and friends on happenings at ----------------------------------------------------------------------- F O R E F R O N T - Taking the Chaos out of the 'Net http://www.ffg.com Newsletter 7/23/97 ----------------------------------------------------------------------- Contents: I. News from the 'Front II. Hot Tip III. Special Offer ----------------------------------------------------------------------- I. News from the 'Front ForeFront enrolls hundreds in FREE e-mail course! ForeFront unveils its Internet Research Course, the first of ForeFront's free e-mail courses helping Internet users become more productive. - http://www.ffg.com/courses/internetresearch.htm WebSeeker Special Editions Released! In addition to searching the Web, WebSeeker Legal Research Edition searches over 35 search engines specific to the Legal Profession. Get your own >online legal assistant now! - http://www.ffg.com/seeker/lre.htm TechSeeker searches over 100 online technical resources, including the popular online press, standard search engines, and Usenet Newsgroups. Let TechSeeker find the technical information you need right now! - http://www.ffg.com/seeker/techseeker.html GrabNet update released online! - http://www.ffg.com/grabnet/ GrabNet, ForeFront's amazing bookmarking tool, allows you to quickly and easily organize everything of interest you come across, web page, graphics, or text! A must have for anyone compiling online information. Brother's newest Printers now come with ForeFront's Internet Products! - http://www.ffg.com/press/05_97brother.html ForeFront Introduces MCSE Self-Study Course! - http://www.ffg.com/press/05_97MCSE.html Now you can easily prepare to become a Microsoft Certified Software Engineer, the hottest certification around! ForeFront Streamlines NetWare Administration with ConsolePro! - http://www.ffg.com/press/5-97ConsolePro.html Tame your Netware Network directly from the Server! ----------------------------------------------------------------------- II. Tip o' the Day Tired of Downloading Lots of Files you don't want with WebWhacker? WebWhacker 3 only downloads what you want! If you are tired of using precious disk space up with useless files downloaded by WebWhacker, then you need WebWhacker 3's Content Filters! With these filters you can choose not to download any files with certain file extensions, files that are too large, or secific MIME types. For example you could choose to only download .WAV files and not .AU if you had Windows 95 and not a Macintosh, and only if the files were less than 100KB in size. There is no end to the filter combinations you can use! To use the Content Filters, click the Content Filters... button on the second step of the URL Subscription Wizard or view the Filters Tab of a URL's Properties. If you don't have WebWhacker 3 then buy it now! - http://www.ffg.com/whacker/ If you have an earlier version of WebWhacker then upgrade now! - http://www.ffg.com/whacker/wwupgrade.html ----------------------------------------------------------------------- III. Special Offer FREE GrabNet! ForeFront would like to offer you, our V.I.P.'s, the new version of GrabNet, for FREE! All you need to do is purchase a copy of WebSeeker! With this dynamic duo you can find and organize everything of interest on the Internet! Take advantage of this opportunity at http://store.ffg.com/seeker_special/ ----------------------------------------------------------------------- This newsletter is only sent to those who requested the newsletter and those who downloaded, registered, or evaluated our software. If you wish to unsubscribe from the ForeFront newsletter mailing list, please visit http://www.ffg.com/press to Unsubscribe.

1 0

Re: Certificates/Anonymity/Policy/True Names
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:47 PM 8/18/95, Michael Froomkin wrote: >I have a question which is of course purely hypothetical. > >Suppose you were designing the legal framework that would govern the >operation of Certification Authorities (the people who issue certificates >vouching for public keys used for digitial signatures), called CAs for >short. The CAs will operate in a hierarchical model (not a >PGP-web-of-trust model), with a state agency being at the root, and >issuing certificates for private CAs. I don't see any basis for having a state agency as the root...lots of things that are grounded in law have no origin/connection to the state. But, I'll assume your hypothetical (though I think the assumption that government = root leads down a dangerous path). >You have decided to allow the private CAs to issue certificates of varying >degrees of corroberation so long as the degree of verification used is >deducible from the certificate. E.g. a certificate might say "we check >the passport"; or "we check driver's license" or "we took blood, hair, >fingprint, retinal scan and first-born child". It might even say "we >checked nothing". You have also decided that a CA may issue a certificate >in the name of a pseudonym, so long as the CA retains information about >the True Name. Now the issue arises as to whether one should allow the CA >to issue certificates to pseudonyms where it has *no record* of the real >identity of the person proffering the key pair. It all depends on what the purpose of certification is in the first place, and whether alternative heierarchies of certification exist outside the one that has government as root. For example, I may instantiate many keys for use in experiments, or as agents in a market microworld, and I may "vouch" for them. These "agents" have no True Name, are not persons, but still have varying levels of certification (to me, at least) A company may even have multiple agents. Multiple departments, multiple users, etc. The web-of-trust model, which, loosely phrased, says "I say I believe this is the key of so-and-so, and you can believe me or not. We don't need no steenking badges!" The beauty of this is that any person or program can generate lots and lots of keys, for experiments, agents, etc. Now if it is desired to have the "legal system" mesh with this certification process, the governemnt is still not needed. Contract law suffices. If the Alice Corporation claims the Bob Company signed a document with a fraudulent key )or whatever the scenario might be), then each side can present in a court what the contracts they agreed to said and what the facts were. This happens all the time, though "I am not a lawyer," in disputes about whether a contract was signed properly, about whether the signer had the right authority, etc. And it is apparently not necessary to have the "state" establish itself, for example, as the keeper of signatures. I concede that there is a path back to the legal "is-a-person" status of parties, such as credentials for identity. In cases involving software agents and "virtual persons" (which is where key certification tends to come in), a stipulation can be made that a Real Person is to be involved in the loop. >Is there any reason why a person would want such a certificate? In other >words, given that the recipient of a digital signature will easily be >able to check the value of the certificate (nil), won't the >transaction/communication be in all ways identical to one where there was >no certificate at all. So is anything of value lost by prohibiting such >a certificate? So long as I am not prohibited from getting together with others (on a list like our, in a corporation, with offshore folks, etc.) and setting up our own system--of whatever nature--then I suppose it doesn't matter. But you ask "So is anything of value lost by prohibiting such a certificate?" Well, why prohibit something unless a real and compelling problem exists? it might turn out to be very useful to have certificates even for keys that belong to entities or agents that have no True Name attached to them. I've given some examples, and can think of more. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Economic Model for Key Cracking
by cman＠communities.com 17 Dec '03

17 Dec '03

So far, list members have mostly presented two points of view on the economics of key cracking: o It's free, since it uses spare CPU cycles o It should be priced at the cost of the dedicated computer hardware needed to do it. Both of these approaches are wrong. The first approach fails because it doesn't scale -- there probably aren't enough people willing to crack lots of keys purely for the research interest, hack value, or the goodness of their heart. At the same time, many people and companies have lots of unused CPU time on their hands. Economically, this CPU time is scrap material -- and there are companies out there that do nothing but buy up scrap equipment for pennies on the dollar. Therefore it should be possible to create a market in spare CPU cycles for tasks like this that require massive parallel computing. An earlier suggestion for bounties on keys (basically the Chinese lottery approach) is a step in this direction. I'd also like to point out that a hacker who can sniff out SSL-encrypted packets on a hacked network is going to be vastly harder to catch than someone who trolls through his or her physical community dumpster diving and bribing clerks. The ability to anonymously gather and decrypt credit card numbers has a vastly lower "cost" in terms of likelyhood of prosecution. If it drops down to under $100 per key, it's probably at a good break-even point to do it wholesale. Certainly the out-of-pocket cost of cracking a 40-bit SSL key is less than that right now for a great many people, even without creating a market.

3 2

How Does Fortezza Work?
by Alan Tu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi all, I am writing an article to help people understand the technical and practical issues surrounding the key escrow debate. Can someone tell me how the Fortezza chip works. I have a 1993 document which is incomplete. Is the session key K still encrypted with the unit key U? And is that whole thing encrypted, with the serial number, with the family key F? I'd appreciate some more current info. You will be credited in my article. Alan Tu -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: Requires PGP version 2.6 or later. iQCVAwUBM9zSwZezmBrl2RXhAQEF3AP+Nw3xwRh+fwxXtNDIK8Eo0BiZiyHNnKHo vyPqe/V3OrK6k3U9iHAiajCodpvQpb6uaPE+YiKwymtLdzEqUp2AcxubV9/7XIk1 cKrdsTEvBFMnPV0DN0H3UFqPivsJJ3beRifAjP07xOUiiw7b0dyiDFwPnyNLm40w BRl2Dvxv5Ow= =tDzB -----END PGP SIGNATURE----- Type Bits/KeyID Date User ID pub 1024/E5D915E1 1997/04/27 Alan Tu <atu5713(a)compuserve.com> Alan Tu <102534.2165(a)compuserve.com> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i Comment: Requires PGP version 2.6 or later. mQCNAzNivkwAAAEEALdGUXD3j+RioIirVG46N6LaGD3YMMVVT5Mjwr5JojQsDICy 856I06Ugo/Fqid2A/os7v/gwE+Sj/WhMERgTsTejUZtsucTpS9sae+cc27Fjjq1l hOnqcLZqnHDDNyn3+jesVFPLnRlSoHbmcBK1XDW/SJT1anZz55ezmBrl2RXhAAUR tCBBbGFuIFR1IDxhdHU1NzEzQGNvbXB1c2VydmUuY29tPokAlQIFEDOguk6Xs5ga 5dkV4QEBBF8D/1B0ePqlMavWEUMP0uTmyvWFI7jooAcih6uHZFo2u+u3EzE2Is8X EoLHg39DhjleTHPu6TnGsWIiwDYEslzYeVw/Cglx6eliYIr/qs7peEywuhtZsEFH ln6yR9IE6rX3b3GCvPSQ5uPhXWrd2kWaZvG4rQ4Oj1m3yTrFaPRqCBPvtCRBbGFu IFR1IDwxMDI1MzQuMjE2NUBjb21wdXNlcnZlLmNvbT6JAJUDBRAzyUJWl7OYGuXZ FeEBAc4TBACT8gLtyE0C8NBGs9aDa9kHfeNzN8VbNfUpoOiWi4duAAZFiAt/e+ji J2BUMLIY8kzm2WX4mVzpKYjvea5TtHeQgbESV1HVZ5k7abENMUYz5nSMloOE+bb+ XRzgGgFF3htGXDJNywlLNgoYi5vTMT0pbGlCzOu215Cc4mFls2w1iA== =CM85 -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Netscape security
by adam＠bwh.harvard.edu 17 Dec '03

17 Dec '03

| > > There is no word as to how to become a KSA. Netscpe has | > >ignored the question on several occaisons. | > | > I'm fairly sure that I remember Taher saying at the W3C security | > meeting that they intend to do this, and that hardcoding the CA's | > into the library was as quick hack. I also have the impression | > that they don't know how to do it, but my recollection is fuzzier there. | | It has been stated publicly several times that we do plan to allow | user configurable certificate authority and server trust. A user | will be able to configure their browser to talk to servers that have | certificates signed by any CA they choose to trust. But I think I can work cheaper than Verisign. What do I have to do to get set up as a KCA today? Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

How Does Fortezza Work?
by Alan Tu 17 Dec '03

17 Dec '03

Please send replies to atu5713(a)compuserve.com -----BEGIN PGP SIGNED MESSAGE----- Hi all, I am writing an article to help people understand the technical and practical issues surrounding the key escrow debate. Can someone tell me how the Fortezza chip works. I have a 1993 document which is incomplete. Is the session key K still encrypted with the unit key U? And is that whole thing encrypted, with the serial number, with the family key F? I'd appreciate some more current info. You will be credited in my article. Alan Tu -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: Requires PGP version 2.6 or later. iQCVAwUBM9zSwZezmBrl2RXhAQEF3AP+Nw3xwRh+fwxXtNDIK8Eo0BiZiyHNnKHo vyPqe/V3OrK6k3U9iHAiajCodpvQpb6uaPE+YiKwymtLdzEqUp2AcxubV9/7XIk1 cKrdsTEvBFMnPV0DN0H3UFqPivsJJ3beRifAjP07xOUiiw7b0dyiDFwPnyNLm40w BRl2Dvxv5Ow= =tDzB -----END PGP SIGNATURE----- Type Bits/KeyID Date User ID pub 1024/E5D915E1 1997/04/27 Alan Tu <atu5713(a)compuserve.com> Alan Tu <102534.2165(a)compuserve.com> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i Comment: Requires PGP version 2.6 or later. mQCNAzNivkwAAAEEALdGUXD3j+RioIirVG46N6LaGD3YMMVVT5Mjwr5JojQsDICy 856I06Ugo/Fqid2A/os7v/gwE+Sj/WhMERgTsTejUZtsucTpS9sae+cc27Fjjq1l hOnqcLZqnHDDNyn3+jesVFPLnRlSoHbmcBK1XDW/SJT1anZz55ezmBrl2RXhAAUR tCBBbGFuIFR1IDxhdHU1NzEzQGNvbXB1c2VydmUuY29tPokAlQIFEDOguk6Xs5ga 5dkV4QEBBF8D/1B0ePqlMavWEUMP0uTmyvWFI7jooAcih6uHZFo2u+u3EzE2Is8X EoLHg39DhjleTHPu6TnGsWIiwDYEslzYeVw/Cglx6eliYIr/qs7peEywuhtZsEFH ln6yR9IE6rX3b3GCvPSQ5uPhXWrd2kWaZvG4rQ4Oj1m3yTrFaPRqCBPvtCRBbGFu IFR1IDwxMDI1MzQuMjE2NUBjb21wdXNlcnZlLmNvbT6JAJUDBRAzyUJWl7OYGuXZ FeEBAc4TBACT8gLtyE0C8NBGs9aDa9kHfeNzN8VbNfUpoOiWi4duAAZFiAt/e+ji J2BUMLIY8kzm2WX4mVzpKYjvea5TtHeQgbESV1HVZ5k7abENMUYz5nSMloOE+bb+ XRzgGgFF3htGXDJNywlLNgoYi5vTMT0pbGlCzOu215Cc4mFls2w1iA== =CM85 -----END PGP PUBLIC KEY BLOCK-----

1 0

Vacation
by Hal 17 Dec '03

17 Dec '03

Sorry to be bugging out at such an interesting time, but I will be on vacation from Aug 19 through Aug 26. Hope to see a lot of CPs at Crypto - Hal Finney

1 0

Re: Netscape security
by John Young 17 Dec '03

17 Dec '03

Responding to msg by altitude(a)cic.net (Alex Tang) on Fri, 18 Aug 2:52 PM >It seems that one of the problems with Damien's >cracking job was that it was "not sanctioned". Look >at the WSJ article, they didn't mention his >name...they just called him "a hacker". It shows how >public opinion still sees groups like the cypherpunks >as just that, a bunch of punks. > >With some "respected" business on our side, it may make >a much bigger impact (better publicity, better >leverage, etc.). While the WSJ story mentioned no names, other than the esteemed CypherName and our cypheragent who lured the reporter, later stories have given individual credit and amplified the "mainstream" impact of the cabalistic hacker culture crack. This segue may be due to the PR-mad corporations and the LEA's seeking to profit by the drama given to outsiders to get their safety-products approved, to pose themselves as being more devoted to the public weal than the devil- punks (liars or inadverdent truthsayers?). Or, it may just be a more interesting (lucrative) to pump the outsider, hacker aspect. Reporting on hackerdom has been oft used to boost a shrewd wannabe-an-insider's rep in the mainstream -- no names now, you know who they are, most are doing quite well, Zarathrustra bless their complicit Guccioni-success. So, hackers, punks, cypherpunks, up all night, right, watch them come calling for an interview when you misbehave in outrageous and wondrous and techno-magical ways. Gotta get lurid stories to allure the customer/advertiser/voter. Damien, Hal and the SSL-non-anonymous hackers, watch your backs, think of Kevin and his oh-so-admiring, trust-me provocateurs. Just my Time-averse sensor-jigger, sensing threat models.

1 0

Re: WhiSSLing in the Dark
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

>Netscape Encrypted Data Cracked > >Tokyo, Japan, Aug. 18 (NB) -- ... > >Many companies working on secure transaction systems hope >the much more secure 128-bit code version of the system >will be available for export eventually. This is said to >be almost unbreakable, requiring a trillion times more >processing power to crack than the 40-bit version. ... Notice how the "over a trillion times more" has devolved into simply "a trillion times more" -- and we all know that the former statement was a gross underestimate, reminiscent of the claim of "over 3 billion combinations" on Ideal's packaging for Rubik's cube. Of course the real reason the media have standardized on trillian for this is that they know it is the biggest number the bulk of their audience is familiar with, and that if they said 3e26 or even "three times ten to the twenty-sixth power" they would snow most of their readers/viewers. (To be fair, I think the WSJ did say 10^26, with a brief explanation of what that meant. I congratulate them for not "talking down" to their readers.) -- David R. Conrad, ab411(a)detroit.freenet.org, http://www.grfn.org/~conrad Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 Jerry Garcia, August 1, 1942 - August 9, 1995. Requiescat in pace.

1 0