December 2003 - cypherpunks-legacy

Clinton to resign?
by Brad Dolan 17 Dec '03

17 Dec '03

Associated Press reported on August 10, 1995: President Won't Resign But... (WASHINGTON) President Clinton wasn't about to give a serious answer when he was asked Thursday if he might resign. The question came from veteran columnist Sarah McClendon, who asserted that some legislators from the left and right were trying to push him out of office. [...] "Well, if you promise to run off with me I might," Clinton responded, ... "But otherwise, I can't think of any reason." - - - - - - - - - - Repeat after me: There's nothing to those crazy conspiracy theories. There's nothing to those crazy conspiracy theories.....

2 1

Re: This summer's special delivery?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <ac4eb0c9030210046e6c(a)[205.199.118.202]>, tcmay(a)got.net (Timothy C. May) wrote: >I have nothing further to add on this. But recall that it was just about >this time last year--just before Crypto--that the "alleged RC4 code" was >posted anonymously to the list. Do I recall correctly that that RC4 proved to interoperate with the "real" RC4? - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMCr2PCoZzwIn1bdtAQEUPAF/S1arfdr01B+/o5MlEX6F60NHUL6vgEPQ sv3264ZCsJAl7TBqqyi1a6baBF7uuTh+ =jhLU -----END PGP SIGNATURE-----

2 1

Re: "Protect the children" as passphrase to Constitution
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:35 PM 8/10/95 -0700, Tim wrote: >- Clinton's Executive Order today which limits advertising of cigarettes, .... >(Oh, and one amazing detail: the possible issuance of I.D. cards to all of >those under the age of 18. Besides being useful for things like curfews, What!?!?!?! I guess I'm not totally surprised - registration of all children has been high on Clinton's agenda ever since he's been in the White House. One of the more blatant examples was the child vaccination proposals - which first started out as "take over the vaccination system and register all kids so we can remind their parents to get their shots", and gradually included less and less control and funding of vaccination while retaining the registration. Sigh. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- Storyteller makes no choice - soon you will not hear his voice. His job was to shed light, and not to master. RIP, Jerry

2 1

Re: "S1" encryption system (was: this looked like it might
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:13 AM 8/10/95 -6, you wrote: As with Peter and Nathan, I'm also a former tool of the military-industrial complex (:-), and Peter's right that the probably source of this assertion is that there's seldom any "vanilla" TOP SECRET data - anything that's sensitive enough to get TOP SECRET handling rules is usually part of some compartmented project (compartmentalization is a formalized version of Need to Know, where you need to be read into PROJECT X to get PROJECT X data.) Sensitive Compartmented Information is one well-known class of stuff. Codeword projects are identified by words picked off a list of content-free names; some codewords that have been outed in the past are ULTRA and UMBER. In addition to project-specific classifications, some of the kinds of labels on material include variants on INTEL, CNWDI (Critical Nuclear Weapons Design Information), RESTRICTED DATA (less critical nuclear weapons data), FORMERLY RESTRICTED DATA ( a weird classification for material that isn't RESTRICTED DATA any more but they still don't want to let folks see.) And then there's the sort of data that's SECRET by the time the people doing the grunt-work see it, but it's various extracts of REALLY SPOOKY DATA, that only a few people back in some agency know the whole picture, and it's parcelled out so one group of people gets asked to build a laser-scanner like this, and another gets asked to build a computer system like that, or a mirror adjuster like that, and none of the grunts know whether the whole deal is personal teleportation system (the cover project) or a space-based assassination system, much less how they decided on the targets.... #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- Storyteller makes no choice - soon you will not hear his voice. His job was to shed light, and not to master. RIP, Jerry

1 0

Australia, EU crypto ill news, crypto wars
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Just read this on comp.risks, by Ross Anderson (via a couple of people). A crypto relevant forward if any is relavent IMO, especially this bit: Ross Anderson <rja14(a)cl.cam.ac.uk> writes: > ... While at the conference, I found out that a classified meeting > took place this March in Germany between the signals intelligence > agencies of the developed countries, plus Australia and South Africa, > at which the assembled spooks agreed to press their governments to > bring in escrow and/or weak crypto. You realise, of course, that this means war, Tatical replies? a) Lobbying - hopeless IMO, they aren't interested in listening, the politicos are just too easy to manipulate and the "masses" aren't clueful enough of what crypto means to understand the implications, or even notice. b) pretty good stego - possible technical solution c) independant states of cyberspace :-) declaration of independence c) enforced or "enabled" by b) looks good to me. Perhaps some literary skilled cpunk would care to compose a suitable reply for PGN to add to risks. Adam ---------------------------------------------------------------------- Date: Tue, 1 Aug 1995 20:36:29 -0400 (EDT) From: "Lance J. Hoffman" <hoffman(a)seas.gwu.edu> Subject: Australia next to ban PGP Date: Tue, 01 Aug 1995 15:29:05 -0400 From: Dave Farber <farber(a)cis.upenn.edu> Subject: Australia next to ban PGP [unverified info ...] From: rja14(a)cl.cam.ac.uk (Ross Anderson) Australia's proposed crypto policy: (1) Banks will get key escrow (2) Other Australian residents will be forced to use weak crypto Source: talk by Steve Orlowski, Assistant Director, Australian attorney general's department, given at the Cryptography Policy and Algorithms Conference, Queensland University of Technology, last month. p 34: `the needs of the majority of users of the infrastructure for privacy and smaller financial transactions can be met by lower level encryption which could withstand a normal but not sophisticated attack against it. Law enforcement agencies could develop the capability to mount such sophisticated attacks. Criminals who purchased the higher level encryption products would immediately attract attention to themselves.' He mentioned that his department considered itself a suitable repository for the government central decrypting unit, which would decrypt traffic for local police forces. He also wants to escrowed keys for banks and other organisations allowed to use strong crypto. Centralising the wiretap capability with the AG is represented as a useful safeguard against abuse of power by local police forces. It would be presented as a `data recovery' facility in order to reassure the voters. Centralisation will enable the AG to acquire the capability to use ``more sophisticated techniques in circumstances where the key cannot, for whatever reason, be recovered from escrow''. So the technical parameters would appear to be: 40 bit keys for the masses, 56-bit escrowed keys for the banks, and a Wiener machine sitting in Orlowski's office. Belt, braces and string. Curiously enough, he quotes a `Review of long Term Cost Effectiveness of Telecommunications Interception' as saying that ``Encryption by targets of their communications (both voice and data) is not considered as a problem for TI at present in Australia'' and goes on to say that ``there has been comparatively little market for voice encryption products, although they have been readily available''. He even produces some good arguments for the EFF, such as that much of the intelligence comes from the call log data and from calls to third parties such as airlines and hotels which are not encrypted. He also says that the OECD countries will hold a meeting on National Cryptography Policies later this year. While at the conference, I found out that a classified meeting took place this March in Germany between the signals intelligence agencies of the developed countries, plus Australia and South Africa, at which the assembled spooks agreed to press their governments to bring in escrow and/or weak crypto. Australia seems rather eager to lick Uncle Sam's boots on this issue. I wonder what the payoff was?

3 2

Re: More "S-1" foolishness
by Hal 17 Dec '03

17 Dec '03

The other thing I noticed that really makes me question this is that G1 only uses 4 of its 8 input bits. As I wrote, it is equivalent to parity(i&0x17). A bit is a terrible thing to waste, and it is hard to imagine why it would do this intentionally. G1 may not be that important an element of the cipher but why throw away four bits? It is possible I suppose that the F and G boxes are not the ones used in the "real" version of whatever cipher this is, so this apparent weakness and the ones which Matt has pointed out may not be that significant. Hal

3 2

Re: EU Data Protection
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:13 PM 8/11/95, Derek Bell wrote: > I think you miss an important point; your opinion is subjective, but >data can relate to objective facts (e.g. credit records). Would you take the >same stance if a credit bureau claimed that you couldn't pay back half the >loans you took out? Any entity which purports to hold or provide "true" information but which hold flaky or incorrect information will suffer. This is true of credit agencies, advice columns, restaurant reviews, movie ratings, book reviewers, doctor rating agencies, and so on. I won't get into all of the aspects of reputations, but this is what we're talking about. And I'll concede that not all of these examples are equally important, or use the same objective quality of data. A credit rating agency is no doubt more important than a movie review agency--though arguably the damaging effects of Siskel and Ebert trashing "Waterworld" can be many orders of magnitude more than TRW Credit having an incorrect bad debt recorded. The point is that we do not have government to maintain the accuracy of movie reviews, of lawyer ratings, and so forth. Even if one accepts the "Fair Credit Reporting Act" (a U.S. law which I think is unconstitutional, as it tells me I cannot report certain kinds of facts), the European-style data privacy laws are a further step in a wrong direction. Think about it: the name "data privacy" sounds good, at first blush, but what it really means is that my records are not private, that my records are inspectable by government agents to see if I have stored any illegal facts or correlations. > What worries me about the *lack* of some form of data protection >legislation is that is allows someone to build up a database of information >which is a mishmash of truth, misunderstandings and lies. How would you feel if >"Concerned Citizens against Cryptography" compiled a list of all members >of this list, branding them as `dangerous, possibily criminal subversives'? Things like this happen all the time. This is just an opinion they happen to have. Would you make it a crime for "Concerned Citizens against Cryptography" to do a "who cypherpunks" of this list and to think we are "dangerous, possibly criminal subversives"? In the U.S. such judgements are made all the time. Doesn't make the judgements right, but rightness is not the basis of the freedom to hold and express these beliefs. >What if that opinion was spread to other databases? How about the police >investigating you because of this kind of database? "Spreading" the opinion to other databases is no big deal. The police investigating is a separate issue. Many of us think the police should be very careful about investigating for beliefs and opinions, but, in fact, it happens all the time. (It's happened to me, for example.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net (Got net?) | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Re: IPSEC goes to RFC
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> sdw(a)lig.net (Stephen D. Williams) wrote: > > > I really like the idea of using DNS for (public I assume) keys... ghio(a)cmu.edu (Matthew Ghio) wrote: > I don't. > > Public keys in the DNS is a bad idea because it makes it difficult to > update the database, especially in large organizations. When a host's > key is issued or changed then they would have to get the nameserver > admin to change it for them. This could become a major problem/ > inconvenience for many, many people. The host should be able to give > its own key in response to a query. That key could, of course, be > signed by any number of trusted signators to guarentee authenticity. I also like the idea of DNS-based public key distribution, but what Matthew said is true. What about this: Let the DNS-Server export the address of a machine which runs the public-key-database for this domain, similar to the MX record for the mailserver. If you need the public key for a person identified by the email address or for a host identified by hostname or IP address, you could ask the DNS server where to get the public key. The database host could run any program suitable to local requirements and export public keys with a certain protocol... Hadmut

1 0

TIM MAY IS A CYPHERWEENIE
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

I think we ought to just throw TIM MAY out of the list. let's EXCOMMUNICATE HIM. its becoming increasingly clear that he is the source of all our problems. I mean, isn't it obvious that our progress has stalled? who has written any code within the last 3 days? if we got rid of him, it would be EVOLUTION IN ACTION. this is ERIC HUGHES' mailing list, and eric hughes knows how to write some decent code. I mean, TCM's signature doesn't even have any geek code, and he hasn't changed it in 4 years or so, at least since my last grandparent died (and she was considerably more skillful at programming than TCM by knowing how to make toast). get rid of all the pricks who continually spout and spew conspiracy theories. let TCM go and find himself a new mailing list. that would be a fair comeuppance if he found that he couldn't learn to do squish because he doesn't have the slightest clue. he's a leech, a parasite, sucking on the work of others, pretending that he is at the forefront of our cause when he is only at the forefront of maniacal egomania. what has he contributed to the cause? SQUAT. just a lot of ranting about conspiracy theories and his Stock Pick of the Week crap. "the web is really growing. people should focus on it". well, THANK YOU VERY MUCH, MR. BRILLIANT COMMENTATOR AND VISIONARY, T.C.MAY, I would have never have THOUGHT of that in a zillion years, but now that you point it out, I GUESS YOU'RE RIGHT.

1 0

Re: IPSEC goes to RFC
by Peter Trei 17 Dec '03

17 Dec '03

Don Eastlake has actually done a draft RFC on using the DNS for key distribution. It may be found at ftp://ietf.cnri.reston.va.us/internet-drafts/draft-ietf-dnssec-secext-04.txt He briefed the W3C security working group about this recently, and a number of people raised objections, notably * database bloat * zone transfer bloat * increased hits on root servers due to a new class of inquiry. There was some discussion as to whether these were valid objections, and the people running prototype code said they had had no problems. Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

2 1