December 2003 - cypherpunks-legacy

Re: Some details on RSA Secure
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:48 AM 8/31/95 PST, "baldwin" <baldwin(a)RSA.COM (Robert W. Baldwin)> wrote: >Here are my biased comments on RSA Secure. They are biased by >the fact that I an a techie who works for RSA Data Security. >Neatest Features: >- It is integrated with the File Manager on Windows and the > Finder on Mac System 7. It's an interesting approach - simpler than installing as a file system (I'm not using SecDrv because it needs a separate partition), but so far it seems relatively useable. On the other hand, since there are file types it refuses to encrypt, like DLLs, there are some things it can't protect (like DLLs with passwords embedded in them.) >- A settable list of files can be automatically decrypted (or > encrypted) on system startup (or shutdown). I've got mixed feelings about this - since my password has normally timed out by the time I shut down, it demands a password before shutting down, and if I had any large amount of data there, I assume it would take a while to reencrypt on my 386-box. (Laptops are generally slower than similar-age desktops, and you often want to shut them down quickly, even when they aren't shutting themselves down to save power.) I haven't tried powering it off during this process, but I assume that at best the files would be unencrypted and at worst there'd be one half-decrypted and sitting in limbo to be trashed the next time the system starts up? >Technical Features: >- The user's passphrase unlocks a master key that is used to unlock > the file encryption key for each file. Since the documentation mentions 512-bit and 1024-bit RSA keys, I'd guess that each file has a separate random RC4 key which is stored in the file header, encrypted with the user and escrow RSA keys plus the MD5 hash, plus the encrypted real filename? (The alternative would be that the userpref.!!! file contains an RC4 key encrypted with RSA, which is used to encrypt the file keys, but that would lead to much shorter headers, and cracking that master RC4 key would then allow cracking of all documents on the system, so I'm guessing that's not the approach used.) >Request for Improvements: 1) The "Emergency" menu item in the File Manager is annoying. Could it be combined with the RSA menu item, eliminated, or at least have the option of abbreviating the name? 2) Can keys and files be shared between multiple machines, i.e. the same user keys on a desktop and laptop, so that individual encrypted files can easily be moved back and forth? #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: Canarypunk: Jim Bell in a coalmine
by John Young 17 Dec '03

17 Dec '03

>From the Privacy Act Online via GPO Access [wais.access.gpo.gov] [DOCID:tres_irs-99] DEPARTMENT OF TREASURY Treasury/IRS 60.001 System name: Assault and Threat Investigation Files, Inspection--Treasury/IRS. System location: Office of the Chief Inspector, National Office; Regional Inspectors' Offices; as well as offices of the District Directors. (See IRS appendix A for addresses.) Categories of individuals covered by the system: Individuals attempting to interfere with the administration of Internal Revenue laws through threats, assaults or forcible interference of any officer or employee while discharging the official duties of his position, or individuals classified as potentially dangerous taxpayers, based on verifiable evidence or information that fit the following criteria: (1) Taxpayers who physically assault an employee; (2) taxpayers who have on hand a deadly or dangerous weapon when meeting with an employee and it is apparent their purpose is to intimidate the employee; (3) taxpayers who make specific threats to do bodily harm to an employee; (4) taxpayers who use animals to threaten or intimidate an employee; (5) taxpayers who have committed the acts set forth in any of the above criteria (1) through (4), but whose acts have been directed against employees of other governmental agencies at Federal, state, county, or local levels; (6) taxpayers who are not classifiable as potentially dangerous through application of the above criteria (1) through (5), but who have demonstrated a clear propensity toward violence through acts of violent behavior to a serious and extreme degree within the five (5) year period immediately preceding the time of classification as potentially dangerous; and (7) persons who are active members in chapters of tax protest groups that advocate violence against IRS employees. ...

1 0

Re: O.J. ObCrypto: Fuhrman's Folly Fans Fakery Fears...
by Bill Stewart 17 Dec '03

17 Dec '03

>I do not think that PGP 2.x can easily (ie: Automatically) use one key for >Signing and another for Encrypting a Message (it does both at the same time >if you ask). If I "Clear Sign" a message and then Encrypt it, then I get >the result but I'm not sure if doing the decrypt on such a message will >automatically spot the signature and verify it (as would occur with a E+S >pass). PGP identifies the key for decryption and signature checking from the message. When you're signing a message or key, you can pick which of your keys to use with the -u option. The difficulty is getting people to use your encryption key instead of your signature key when encrypting stuff for you. Derek mentioned one approach (get people to load the encryption key first); unfortunately, you can't predict their behavior, and if you change encryption keys more often than signature keys, they'll load the newest encryption key last. Another approach is to identify them in the names - my key certification key says "KeyCert-only" in the text. For the problem that started this discussion, though, there's no good solution. Since the Bad Guys _can_ encrypt a message to you with your signature key, and send it to you by anonymous remailer, they can plant a reason to suspect that you may have evidence encrypted with that key. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

2 1

Re: SSL search attack
by rkw＠dataplex.net 17 Dec '03

17 Dec '03

I wrote >>> Assuming that you are multi-threaded--- Simply run two "workers" on the >>> same machine. If there are delays in getting keys assigned, the two will >>> soon get out of phase and keep the cpu busy. >> I kind of like that idea... > To which Piete Brooks replied: >I thought of that, but: >1) for the same server load, it doubles the number of unACKed segments >2) if process A is lagging process B, then when process B finishes and is idle > waiting for the server, process A will run faster and thus reduce the lag. > This will make the processes drift into phase. > I'm not convinced one way or the other. But you forgot that when process A finishes, process B will run faster and re-establish its lead. The real question is what is the parameter that we need to minimize? Assuming that the key is distributed in the keyspace with a uniform probability, then what we need to minimize is the expectation that two or more workers are searching the same keyspace. As long as we never reach the point that all of the keys have been distributed, it does not matter how many or in what method they are assigned. (The "fairness" WRT a prize being ignored) The assignments only become important as we exhaust the space and must prepare to make another pass. Note that we never got to that point on challenge 2. The assignment of the block containing the key was processed on its first pass and the key was found. In this regard, it is probably "best" to first attempt to identify those space assignments that have been lost. If we associate with each key, either explicitly, or by inference, an expected completion time, those segments which are most overdue are certainly good candidates for having been lost. Based on our previous try, and the assumption that we would not have extremely different resources available, the master allocator would not NEED to get reports back for the first say 12 hours. That is not to imply that reports should be delayed that long, but only that there is considerable opportunity to have a hierarcy of intermediate collectors that have plenty of time to adjust their allocation algorithms to match the ability of their workers. Later, more rapid response would be needed. When the required response becomes too small for the "little guys", they could be sloughed off on the next problem, leaving the "big boys" to clean up the last pieces. Of course, the "next" problem might be to resolve the same problem because the correct answer was incorrectly reported as not found. As I see it, except for perhaps the fastest of machines there is little reason to allocate to the workers more than one segment at a time. Their supervisor can quickly respond to requests for work and consolidate the results to be passed up the chain. The only reason that I can see to separate the acks from the assignments is to be able to have "memory-less" nodes. This is certainly unnecessary if there is a web of supervisor servers. I have a lot more thoughts that I will defer to the next missive. Gotta' run... ---- Richard Wackerbarth rkw(a)dataplex.net

1 0

New use for Eternity Server
by kelly 17 Dec '03

17 Dec '03

Maybe someone should feed the pgp 5.0i sources to a c to HTML converter and post the output to the eternity servers.. mmm

4 5

Key Escrow Workshop agenda & discussion paper 3
by Pat Farrell 17 Dec '03

17 Dec '03

The following message segment: ------------------------------ From: Arlene Carlton <carlton(a)micf.nist.gov> Fri, 01 Sep 1995 15:30:46 -0400 Cc: carlton(a)micf.nist.gov Subject: Key Escrow Workshop agenda & discussion paper 3 September 1, 1995 Dear Participant: Thank you for agreeing to participate in the two-day meeting on software key escrow encryption. We are anxious to work with you and other industry representatives to facilitate development of exportable key escrow encryption in software products. I look forward to the workshop being an important step in that process. [snip] --------------------------------- Was sent to the following folks. I assume that this means that these people are participants. I see Dan W from CDT, Soble from EPIC and Whitfield Diffie, on our side, plus assorted folks with stakes such as tis.com and netscape.com And of course, DERD for the other side. Blank Unicorn had posted to c'punks that he was attending. Of course, while I know what he looks like, I have no idea which nym is his. Pat List of attendees/registered participants follows: 100436.3361(a)compuserve.com, 73167.2027(a)compuserve.com, 73534.3011(a)compuserve.com, 75300.3232(a)compuserve.com, 76225.2603(a)compuserve.com, ablee(a)mitre.org, ads012(a)email.corp.mot.com, ams(a)eit.com, amte09(a)email.corp.mot.com, asteen(a)novell.com, baum(a)world.std.com, bekutz(a)aol.com, bflowe(a)mcimail.com, bill.poulos(a)oga.eds.com, bill.poulos(a)oga.eds.com, branstad(a)tis.com, bsaclu(a)aol.com, c.baggett(a)cablelabs.com, carol.donovan(a)network.com, ccrafton(a)gi.com, charlesabzug(a)acm.org, ckc(a)rfpo1.rfc.comm.harris.com, cmo(a)cohnmarks.com, coallen(a)us.oracle.com, cpadilla(a)attmail.com, cpadilla(a)attmail.com, csmith(a)steptoe.com, davery(a)grci.com, david_rose(a)ccm.fm.intel.com, ddodson(a)nist.gov, denning(a)cs.cosc.georgetown.edu, deyoung(a)rpcp.mit.edu, dinsmore(a)tis.com, djw(a)cdt.org, dkozlay(a)ire.com, dmiller(a)spa.org, Don_Sortor-ads012(a)email.corp.mot.com, ebarker(a)nist.gov, ed(a)tecsec.com, emessmer(a)world.std.com, ezzy_dabbish-amte09(a)email.corp.mot.com, flahavin(a)csmes.ncsl.nist.gov french(a)zeke.enet.dec.com, gomes(a)dockmaster.ncsc.mil, gordon(a)ipower.nsc.com, hoffman(a)seas.gwu.edu, housley(a)spyrus.com, hoydyshd(a)mcln.unisysgsg.com, i.goldsmith(a)nexor.co.uk, infocker(a)megaweb.com, jackk(a)microsoft.com, jag(a)jgvandyke.com, jaltman(a)milchev.com, jamanni(a)missi.ncsc.mil, james.hughes(a)network.com, jdrandall(a)vnet.ibm.com, jean_m_baronas(a)co.xerox.com, jeff.rulifson(a)Eng.Sun.COM, jeff(a)netscape.com, jerry(a)ods.com, jgheiner(a)aol.com, jimmy(a)ipower.nsc.com, jimn(a)calv1.cray.com, jkrauss(a)cpcug.org, john(a)ipower.nsc.com, john_pascatore(a)ivision.com, jroberts(a)cmp.com, js(a)cup.hp.com, jseiger(a)cdt.org, jwinston(a)ota.gov, jya(a)pipeline.com, jya(a)pipeline.com, kandy(a)micf.nist.gov, karen.randall(a)att.com, kawamoto(a)mitre.org, kaye(a)ix.netcom.com, kent_landfield(a)sterling.com, khrose(a)annap.infi.net, klensin(a)mci.net, lc2m(a)andrew.cmu.edu, lcarnahan(a)nist.gov, lhg(a)nrc.gov, lovornj(a)usva8.dyncorp.com, lshomo(a)hqops.hq.nasa.gov, lthrash(a)hqamc.army.mil, lydia.bell(a)tip.navsea.navy.mil, maitgmu(a)aol.com, martin.ferris(a)treas.sprint.com, mary_smolenski(a)ita.doc.gov, mbohannon(a)banyan.doc.gov, mccord(a)nosc.mil, melanie.carter-maguire(a)nt.com, mendelson(a)tis.com, mfa(a)compaq.com, michael.palgon(a)sciatl.com, mignon(a)atc.boeing.com, mikus(a)viacrypt.com, mjl(a)liii.com, mpapillo(a)snap.org, mpapillo(a)snap.org, mppulkk(a)mikropc.fi, mrainey(a)itic.nw.dc.us, murray2(a)vnet.ibm.com, natstrat(a)dgs.dgsys.com, nazario(a)csmes.ncsl.nist.gov, paradise(a)wellsfargo.com, pfarrell(a)netcom.com, pjclark(a)ix.netcom.com, po7114(a)email.mot.com, polk(a)csmes.ncsl.nist.gov, powar(a)visa.com, randy(a)mci.net, ravenis(a)novell.wd.cubic.com, rjg9324(a)glaxo.com, rjoconnor(a)aol.com, rmedlock(a)mitre.org, roberth(a)bsa.org, rolfe.doc.gov(a)micf.nist.gov, rozzie(a)iris.com, rwessman(a)us.oracle.com, sbaker(a)steptoe.com, Schneck(a)mitre.org, Schneck(a)ncsl.nist.gov, sevans(a)csn.com, shabbir(a)panix.com, simona(a)sea.org, sking(a)mitre.org, sltm(a)msg.ti.com, snouffer(a)st1.ncsl.nist.gov, sobel(a)epic.org, squires(a)arpa.mil, stuart(a)bellcore.com, stw(a)atc.boeing.com, sullivan(a)interramp.com, tajalli(a)tis.com, tec.teclgl(a)micf.nist.gov, ted_gerbracht(a)ml.com, tfuhrman(a)ostp.eop.gov, thomas_clare(a)sterling.com, trivers(a)is.ge.com, trstsc(a)tevm2.nsc.com, ttobin(a)atl.ge.com, wafranklin(a)attmail.com, walker(a)tis.com, walt(a)osf.org, walters(a)snad.ncsl.nist.gov, wford(a)bnr.ca, whitehurst(a)vnet.ibm.com, whitfield.diffie(a)Eng.Sun.COM, whpayne(a)abq-ros.com, wmcglone(a)milchev.com, wright(a)dockmaster.ncsc.mil, Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

1 0

Re: Fuhrman needed a digital pseudonym!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:00 PM 9/1/95, Jeff Barber wrote: >I don't see any "surveillance state" issue. Fuhrman openly agreed to >speak to the screenwriter. AFAIK, he had no reason to believe the >screenwriter wouldn't tell anyone else. Nor should he have counted on >that anyway. Any loss of credibility (or other penalty) he receives >is entirely deserved, IMO. By the way, McKinny did not volunteer the tapes, nor did she consent to having them taken from her and used by the Defense. Private property was taken by a court action (the North Carolina lower court ruled that the tapes were the property of McKinny and could not be taken, then an appeals court overruled this decision and ordered McKinny to produce the tapes). (It is not clear how Cochrane and his team learned of the tapes. Speculation is that McKinny's agent or lawyer was doing some freelance shopping-around of the script. McKinny has denied that she was trying to sell the tapes. Regardless, they are her property and should only come in to a court case when directly and centrally involved. This is closely related to the Church of Scientology issue, and is being debated on another mailing list I'm on, the Cyberia list.) This raises serious issues. She was a screenwriter, Fuhrman was helping her to generate a salable script. Neither was speaking for the LAPD. (Kind of like the disclaimers we see on the Net, which I suspect are becoming worthless.) >> Anyway, I am greatly disturbed by this "mining" of ancient comments, made >> to a screenwriter. > >Not me. A few weeks there was a thread concerning the use of >information by private "reputation" bureaus. I can't find the thread >in the archives but I seem to recall you defending the right of >private entities to keep and distribute such information (my apologies >if this was someone else). Anyway, to me, these tapes fall clearly in You're imputing to my comments about what will happen, and what cannot be stopped except by coercion, a conclusion which you think is at odds with my point here. Just because I think people (like me, you, Laura McKinny, etc.) have the "right" to compile records, make notes, make tapes of conversations, etc., does not mean I think that courts can order them given to the court. (This is an issue I have with "discovery" in general, where even peripheral witnesses can be compelled to turn over diaries, journals, letters, tapes, records, financial reports, etc.) >the same domain. This screenwriter isn't a government agency, the >information was freely given, and the screenwriter has every right to >offer it for whatever purpose she deems appropriate, for free or >for money (barring any agreements to the contrary, of which I have >heard nothing). Again, to make it clear, McKinney did not offer the material and fought in the North Carolina courts to have her property kept confidential. The court ordered her to turn it over. (And apparently members of the defense team leaked the most damaging, and out of context, parts, provoking Ito to announce a major investigation of this is to come, with severe sanctions for those who leaked it.) We need a justice system which will not be dragged into spending a full year on this matter, with every indication that a mistrial or hung jury will result. I look forward to a day in which an OJ would get a reasonable, month-long trial...and then, if found guilty, be given an execution date no longer than a month away. As it is, OJ will be guesting on the talk show circuit. He butchers two people--from the overwhelming mound of evidence I've seen--and essentially cuts the head off of his ex-wife, but will likely get off as this trial spins out of control and fragments in various ways. Don't misunderstand my motivations: I'm sort of happy this is all happening. It makes people even more suspicious of governments and lawyers, and it will accelerate the disintegration of the current system. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Nothing Accumulation Separation All
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Thee InterNet is not a collection of machines, but a social relation among people, mediated by *nothing*. Thee InterNet is capital to such a degree of *accumulation* that it becomes a machine. Thee InterNet which eliminates all geographical distance reproduces distance internally as spectacular *separation*. InterNet theory is now the enemy of *all* InterNet ideology and knows it.

2 1

Fuhrman needed a digital pseudonym!
by terrell＠sam.neosoft.com 17 Dec '03

17 Dec '03

> >From: tcmay(a)got.net (Timothy C. May) >Subject: Fuhrman needed a digital pseudonym! >Before you folks jump on the "racist" Mark Fuhrman, think about the >"surveillance state" issues. While it was not any government organization >that taped Fuhrman's comments, there are some real issues involved in how >deeply and how far back we want to "mine" comments made by people. Some >real issues of privacy. > >The Mark Fuhrmans of the future may be interested in using technologies to >protect their privacy, to give them "plausible deniability" should their >recorded words come back to haunt them. > ... >* And the issue of "mining" of ancient records, especially as technology >makes the recording of sounds, the taping of sights, and the archiving of >electronic messages so much easier. > ... >What really bothers me, as it relates to the pro-privacy themes of this >list, is the reaching back many years to comments made by a witness--Mark >Fuhrman--to a screenplay writer. Because she kept audiotapes, going back 10 >years, these comments may likely strongly influence the verdict in this >"trial of the century." > >Anyone in favor of heading off the "surveillance society" should be alarmed >at this development. As tape recorders and video cameras proliferate, >comments may be compiled, taken out of context, and used as evidence. ... > >--Tim May > If you've ever watched Not_at_all_Funny Home Videos or any of the American Urinal school of tabloid television, you soon start feeling that the real threat to privacy is not the guvmint, but all of the yoyos with their little cam corders running around pointing them at people. Security cameras in ATMS and at airline ticket counters do more to threaten you privacy than do FIBBIE wiretaps, and PGP won't protect you from them. (and usually neither will the courts). Buford C. Terrell 1303 San Jacinto Street Professor of Law Houston, TX 77002 South Texas College of Law voice (713)646-1857 terrell(a)sam.neosoft.com fax (713)646-1766

1 0

Re: CIA & Espionage
by syrinx＠c2.org 17 Dec '03

17 Dec '03

'Tatu Ylonen' was reported to have written: > I do find it rather shocking that the most powerful country in the > world sets industrial espionage as the primary task of their > intelligence services. Well, I have a letter from a United States Senator which was received last year in response to my phone call in opposition to the Digital Telephone Act of 1994 (S. 2375). Here's the interesting part: "According to the director of the Federal Bureau of Investigations (FBI), Louis Freeh, the number one law enforcement, public safety, and national security issue facing us today is preserving the ability to conduct court approved wiretaps." In other words, retaining the ability to monitor citizen communications is their greatest concern. This should be more than shocking to anyone who cares about privacy. It appears as though the primary function of the FBI and the "intelligence services" are similarly directed. One significant distinction is that the FBI's stated mission is directed toward the "owners of the country" (to borrow a term from Perot).

1 0