December 2003 - cypherpunks-legacy

Exportable if Escrowed Changes Nothing!
by Joey Grasty 17 Dec '03

17 Dec '03

C-punks: This "change" that encryption software can be exported if the keys are escrowed means nothing. PGP still couldn't be exported, since it can generate its own keys. You can be sure that any program that generates its own keys couldn't be exported. How are you going to escrow 2^100 possible keys (or whatever it is that PGP can generate)? Thus, this regulatory change means diddly-squat. The only crypto that could be exported would be something like Clipper, and they already said that could be exported. Governments: can't live with 'em, can't shoot 'em. Regards, -- Joey Grasty jgrasty(a)gate.net [home -- encryption, privacy, RKBA and other hopeless causes] jgrasty(a)pts.mot.com [work -- designing pagers] "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin." -- John Von Neumann PGP = A7 CC 31 E4 7E A3 36 13 93 F4 C9 06 89 51 F5 A7

2 1

Article in Time Magazine
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

In the Time Magazine of this week there is an article about a new way to make war. Instead of sending bombs, tanks, and soldiers, the enemies computers and communication networks are attacked by sending viruses and worms and by using backdoors to sabotage the infra structure. How many exported software products might have backdoors, vulnerabilities, and hidden procedures which are harmfull if ever activated? Any opinions? Hadmut

1 0

Re: Non-News Govt Announcem
by Dave Banisar 17 Dec '03

17 Dec '03

It seems more likely that the opposite will occur: Clinton has been pandering for the police vote so strongly that he's more likely to come up with more draconian proposals to curry their favor. -d -------------------------------------- Date: 8/17/95 11:47 PM To: Dave Banisar From: Timothy C. May At 9:49 PM 8/17/95, Dave Banisar wrote: >The White House and NIST annouced today that they were planning to hold two >open meetings next month to develop standards for "acceptable" software key >escrow. The standards will then be made into a FIPS. The programs cannot >have keys larger than 64 bits. > >Its great to see that it only took them 18 months (since Feb. 94) to come >up with a call for public meetings for something that nobody really wants >anyway, expcept for the officals who plan to make it mandatory by slipping >it through bit by bit and a couple of vendors. (sorry, sarcasm mode >off...) One thing I'm hoping for is that Clinton will, as he contemplates his last year and a bit in office, have an attack of "liberalism." That is, I am hoping he realizes that any mandatory key escrow system is not only a massive infringement on the right of people to speak and communicate as they wish, it is also handing the keys to the Surveillance State to the likes of Bob Dole, Jesse Helms, Alonse D'Amato, Newt Gingrich, and William Bennett. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway." ------------------ RFC822 Header Follows ------------------ Received: by epic.org with SMTP;17 Aug 1995 23:40:49 U Received: from [205.199.118.202] (tcmay.sensemedia.net [205.199.118.202]) by buckeye.sensemedia.net (8.6.9/8.6.9) with SMTP id UAA05708; Thu, 17 Aug 1995 20:47:55 -0700 Date: Thu, 17 Aug 1995 20:47:55 -0700 X-Sender: tcmay(a)mail.got.net Message-Id: <ac595a311502100481c2(a)[205.199.118.202]> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-Priority: 1 (Highest) To: banisar(a)epic.org (Dave Banisar), cypherpunks(a)toad.com From: tcmay(a)got.net (Timothy C. May) Subject: Re: Non-News Govt Announcement on Key Escrow _________________________________________________________________________ Subject: RE>>Non-News Govt Announcement on... _________________________________________________________________________ David Banisar (Banisar(a)epic.org) * 202-544-9240 (tel) Electronic Privacy Information Center * 202-547-5482 (fax) 666 Pennsylvania Ave, SE, Suite 301 * ftp/gopher/wais cpsr.org Washington, DC 20003 * HTTP://epic.digicash.com/epic

1 0

Rant Generator
by Tom Gillman 17 Dec '03

17 Dec '03

Anybody have the URL of that rant generator that was mentioned here a couple of weeks ago. Due to unforeseen circumstances, all my annotations got lost :( Thanks, -- Tom Gillman, Unix/AIX Systems Weenie |"For a privacy advocate to determine Wells Computer Center-Ga. State Univ. |the best way to do key escrow is like (404) 651-4503 syshtg(a)gsusgi2.gsu.edu |a death penalty opponent choosing I'm not allowed to have an opinion. |between gas or electricity"-D.Banisar key to UNIX: echo '16i[q]sa[ln0=aln100%Pln100/snlbx]sbA0D4D465452snlbxq'|dc

1 0

PRZ Wins One
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

John Young <jya(a)pipeline.com> writes: > PRZ is awarded a 1995 Chrysler Award for Innovation in > Design, says a $40,000 full-page ad in The NYT today, with > a brief citation: > > Philip Zimmermann is the designer of Pretty Good Privacy > (PGP), an E-mail encryption software. Thanks to the > algorithms of PGP, which was released to the public as > free software in 1991, E-mail messages can be sent > securely all over the world without the risk of > interception by any third party. > > No mention of the free-world leader's sword poised to > decapitalize the public-spirited designer to protect IC > hegemony. No need. The implied vote of support is quite clear. -- WebCasters(tm) James C. Grubs jgrubs(a)voxbox.norden1.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programming, Information brokering

1 0

Re: Export policy change
by David K. Merriman 17 Dec '03

17 Dec '03

>Ok, let's escrow our keys with Julf :-) > >Seriously, there might be a market for somebody to become a professional >escrow agent.... > >(tongue partially in cheek) > I will cheerfully escrow keys for 1$ ecash/key. Please be advised, however, that key storage will be on an old 40M RLL drive on an 8088 machine, so retrieval may be a bit slow and unreliable....... Yes, I'm really serious about the fee and storage medium. Dave Merriman This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

3 2

Re: Cost to Crack Keys
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

This is how you can crack SSL RC4-40 sessions for $1000 each: Go to your bank and get a $250,000 loan over 10 years. Assuming a 10% interest rate, you will have to pay about $40,000 per year. Use the $250,000 to buy 50 low-cost high-speed pentium PCs. Don't bother with a screen, keyboard or mouse. Get the minimum of memory. Get a huge discount (you're a really good client). Pay $10,000 for the electricity bill, the real-estate rent, etc. The machines will crack 50 keys per year on average. They cost you $50,000 per year. That's $1,000 per key. Does anyone see any hole in the above plan ? It seems to me that Netscape's estimate is one order of magnitude too high. -- Damien

2 1

Re: Netscape security
by harveyrj＠vt.edu 17 Dec '03

17 Dec '03

On the subject of Netscape: Now that Netscape is making the Commerce Server available for free to students, faculty, libraries, etc. (i.e., groups with limited ability to cough-up $290 to RSA to get the 1-year digitially-signed certificate needed to make it operate in "secure mode"), does anyone know of alternative methods for producing such certificates? rj ------------------------------------------------------ R. J. Harvey email: harveyrj(a)vt.edu WWW site for job analysis & personality research: http://harvey.psyc.vt.edu/ PGP key at http://harvey.psyc.vt.edu/RJsPGPkey.txt

4 3

BUK_guv
by John Young 17 Dec '03

17 Dec '03

8-18-95. W$Japer: "Encryption-Software Plan Presented Using 'Keys' Held by Escrow Agents." [This is a variation on the Markoff article today, with a bit more.] Companies hoping to start selling stronger encryption products will have to wait a few months, since the administration has yet to sort out important details. For instance, one unresolved issue is how to certify escrow agents to keep fly-by-night operators and organized-crime figures out of the business. And the administration's emerging policy doesn't deal with data-security hardware -- products that wire the encryption schemes right into chips or other devices. Even with the export restrictions, U.S. officials haven't been able to stop widespread international distribution of an encryption program, called Pretty Good Privacy, that is nearly impossible to crack. "Seizure of Electronic Messages In Obscenity Case Raises Questions." Users of a small computer bulletin board in Ohio sued local authorities who seized their electronic mail and other materials as part of an investigation into obscene postings. In their lawsuit, which appears to be the first of its kind, the plaintiffs contend that the Hamilton County Regional Computer Crimes Task Force and other authorities violated their rights to free speech and privacy by seizing their messages during a June raid of five bulletin boards. The plaintiffs also allege that, by seizing their private electronic messages, the authorities violated the Electronic Communications Privacy Act. Double yolk: BUK_guv (about 11kb)

1 0

28M_dip
by John Young 17 Dec '03

17 Dec '03

8-17-95. FPeach: "Russian 'in $2.8m Citibank computer fraud'." Citibank New York fell victim to a $2.8m fraud after a Russian computer hacker penetrated the bank's security system in Wall Street and removed the money from the accounts of corporate clients, it was claimed in a London court yesterday. The alleged fraud was carried out by a 24 year-old mathematics graduate using a computer in his office in St Petersburg, claim the US authorities, which are seeking his extradition from the UK. 8-17-95. NYPaper: "Russian Accused of Citibank Computer Fraud." A judge set another hearing for Sept. 15 after Mr. Levin's lawyer argued that the Government has not shown that any computer in the United States was involved. Stereo: 28M_dip (about 6kb)

1 0