December 2003 - cypherpunks-legacy

Re: Three strikes you're out! for politicians... yeah we wish!
by hal9001＠panix.com 17 Dec '03

17 Dec '03

At 10:27 7/26/95, Scott Brickner wrote: >In message <2751(a)umlaw.demon.co.uk> Michael Froomkin writes: >>> Therefore, the only organization which can hold a >>> senator/representative liable for passing a bad law is the one which >>> passed the law. :( > >>and the voters > >Not in the sense of being able to punish him. The voters may only >withold their support in the next election. Not nearly enough to >deter morons like Exon. Who, unless I'm confusing him with someone-else, is not going to stand for reelection and thus can run amuck with no possible fall-out from the voters.

1 0

Canadian Export Controls
by Richard Martin 17 Dec '03

17 Dec '03

This is a notification of the first creation of a few pages describing Canadian Export Controls. Any one who has read the printed document [Canada's Export Controls] will realise that it's almot word-for-word, but there's some use for that. In any case, they currently live at http://www.io.org/~samwise/crypto/ It may be that they'll move, but http://www.io.org/~samwise/interesting.html#privacy should always have a pointer to them. comments, bugs, spelling errors, contributions to rmartin(a)alias.com The pages were written this evening. Tomorrow morning I'll look at them, scream, wonder what I was thinking, and rewrite them. This is so that there'll be a few more screams. :) frodo =)

1 0

Strategic Invest. on Bad Boys, Blk Net, & Remailers
by gjeffers＠socketis.net 17 Dec '03

17 Dec '03

from: Strategic Investment 824 East Baltimore Street Baltimore, MD 21202 July 25, 1995 ------------------------------------------------------------ ---------- BEHIND THE LINES BY Jack Wheeler BAD GUYS Let's suppose, "just suppose," that the president has placed you in charge of a super-secret spy agency conducting electronic intelligence, the National Security Agency; and suppose that he ordered you to trace the activities of those who have replaced the Communists as official "Bad Guys," "Enemies of the State:" tax evaders, money launderers, and drug traffickers. So you decide to pull one of the great intelligence coups of modern times, by having the NSA become a major provider of banking software. Working through a cutout company skilled in managing money in support of U.S. covert operations, and using a modified version of sophisticated tracking software provided by the Justice Department's intelligence service (OSI, Office of Special Investigations), you sell your product to financial institutions around the globe - not telling them, of course, that what they're buying has an electronic "backdoor" giving the NSA computerized access to the intimate details of their customers' financial transactions. In less than a decade, your client list includes many of the world's leading banks. The banks behind the Visa smart card for the Atlanta Olympics, and those soon to offer Internet banking are your clients too. Yes, now you'll do your patriotic duty and get the Bad Guys - and anyone else you decide is an Enemy of the State. We're just suppposing, you understand. THE BLACK NET A worldwide communications system, accessible to anyone on the Inter- net, of completely anonymous and unbreakable encrypted messages and transactions: That's the vision of the Black Net being created by "crypto-anarchist" computer programmers. Using programs like "MixMaster" and anonymous re-mailer computer servers that nest encryted messages in encrypted envelopes, the Black Net will defeat the NSA's ability to trace communications to their source via traffic analysis or any other method. Black Net banks could offer totally untraceable and anonymous transact- tions with the identity of the account holder unknown even to the bank- - rendering any attempts, such as those imagined above, to get the Bad Guys useless. As economist Richard Rahn puts it: "The information tech- nology of the 80s (cheap faxes & photocopiers, satellite radio, etc.) doomed an government's attempt to have a monopoly on the supply of money." ------------------------------------------------------------ ----------- Beat State!

1 0

Decoded Version of KODMAIL.MSG
by johnl＠radix.net 17 Dec '03

17 Dec '03

The American Bankers Association is attempting to address the privacy and security needs of banks and bank customers by ensuring that each have access to appropriate cryptographic tools. The ABA Cryptographic Policy will be posted on this list later today. ************************************************ CONTACT: Sonia Barbara FOR IMMEDIATE RELEASE (202) 663-5469 (1995) ABA REAFFIRMS SUPPORT FOR PRIVATE-SECTOR CONTROL OF CRYPTOGRAPHY Association Recommends a 10-year Extension for the Data Encryption Standard WASHINGTON, July 21 -- The Data Encryption Standard (DES) should be recertified for at least 10 more years to allow interested financial institutions adequate time to convert to any new cryptography standard, the American Bankers Association said in a policy statement issued today. Encryption is the process whereby sensitive data communications, such as wire transfers, credit card and automated teller machine transactions, are protected by secret codes to protect their confidentiality. DES, released in 1977, is the primary method used by financial institutions to encrypt information. Critics say that the longer DES is used, the more likely its code could be broken. While realizing this could limit its life span as a government certified standard, ABA warned that requiring banks to convert to a new standard by 1998 (the year DES's certification expires) could be prohibitively costly due to the high level of electronic funds transfers secured by DES. ABA therefore encouraged the National Institute for Standards and Technology (NIST) to continue to endorse DES as a Federal Information Processing Standard (FIPS) for use by the financial community. There has been an ongoing debate regarding who should control the development and support of private-sector computer security standards: the government or the private sector. ABA strongly recommends that the U.S. government work with the private sector and Congress in an open forum to develop a comprehensive policy on the commercial use of cryptography. In its newly-revised policy statement on cryptography, ABA proposed alternatives to DES and outlined other criteria that must be met before changes in cryptographic standards can be accepted by the banking industry. These criteria -- which will be (more) ABA CRYPTOGRAPHY POLICY/P2 presented next week to representatives of the White House, U.S. Department of Commerce, National Security Agency (NSA) and federal banking agencies -- were developed following a two-day meeting held in June of bankers, vendors and crypto experts concerned about the federal government's direction regarding private-sector information security. Specifically, ABA recommended: a The financial services industry be allowed to continue to use DES based on risk assessment (e.g. value of the transaction) and the business application involved. a A security framework encompassing a family of commercially available algorithms, including DES, be developed. This framework should include a process for negotiated algorithm selection based on the level of risk and other business requirements. a Opposition to government mandated key management systems for financial applications where keys would have to be stored outside the financial institution (e.g. key registration/surrender or the mandatory escrow of cryptographic keys). Instead, banks should continue to be responsible for key management and continue to cooperate with government for law enforcement purposes, as required by law. a Export of cryptography for financial applications must not be restricted. a Full participation of Congress and the private sector before establishing a U.S. policy for the commercial use of cryptography, instead of being carried out solely by Executive Order. [Note: These recommendations were summarized. For the full statement, please call Sonia Barbara at 202/663-5469.] The American Bankers Association is the only national trade and professional association serving the entire banking community, from small community banks to large bank holding companies. ABA members represent approximately 90 percent of the commercial banking industry's total assets, and about 94 percent of ABA members are community banks with assets less than $500 million. ### -- John A. Limpert johnl(a)Radix.Net

1 0

Re: RC4
by Wolfgang Roeckelein 17 Dec '03

17 Dec '03

Hi, >I wasn't aware that you could copyright an algorithm. Patent, yes, but not >copyright. Intellectual property meens secret, right? Aren't there any >precendence cases involving propriety schemes that are reverse engineered? Game cartridges (I think sega was involved) Wolfgang --- Dipl.-Wirtsch.-Inf. Voice: +49 261 6509 173 Wolfgang Roeckelein Fax: +49 261 6509 179 WHU Koblenz E-Mail: roeckelein(a)wi.whu-koblenz.de Burgplatz 2 (NeXTmail ok) D-56179 Vallendar WWW: http://www.whu-koblenz.de/~wolfgang/ Germany --rsa--------------------------------8<------------------------------------- #!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL ($k,$n)=(a)ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2% Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*' ,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2) -------------------------------------8<------------------------------------- TRY: echo squeamish ossifrage | rsa -e 3 7537d365 | rsa -d 4e243e33 7537d365 Residents of the USA & France *MUST NOT* include this .sig if following up! *** Residents of France & Russia *MUST NOT* make any use of this -sig ! ***

2 1

Re: Utah Digital Signatures Act
by E.J.Koops＠kub.nl 17 Dec '03

17 Dec '03

> From: "greg pitz" <pitz(a)onetouch.com> > Would someone be so kind as to describe the Utah initiative? I > wasn't able to find a further description in my percursory search of > Mr Froomkin's otherwise very informative home page > > http://www-swiss.ai.mit.edu/6095/articles/froomkin-metaphor/text.html You can find the text at (save typing errors :-)): gopher://gopher.utah.edu:70/77/Off%20Campus%20Information/State%20of% 20Utah/Utah%20Legislative%20Bills/1995/Bills/Senate/SB0082 Bert-Jaap ---------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 66 8101 Centre for Law and Informatization facs +31 13 66 8102 Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------- Postbus 90153 | "We forgot the crackers!" | 5000 LE Tilburg | | The Netherlands | Wallace and Gromit | --------------------------------------------------------------------- http://www.kub.nl:2080/FRW/CRI/people/bertjaap.htm ---------------------------------------------------------------------

1 0

Police computer forensics interview
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

There is an article on page 122 of this weeks UK PC User (26 July - 22 August) by the head of the technical support unit for Essex Police. Here's a few choice cuts from the article: ... Now, what we do is go out on raids, or at least instruct officers on how to seize computers and bring them back to the computer evidence lab. The first thing we do with a computer is to make an exact copy of the hard disk and any floppies that come with it. It is essential that we have an exact image, rather than just a file copy, so we get everything, like the remaining bits of deleted files. We can interrogate the free space and slack space where there could be important evidence. To do this we've developed our own imaging system. This is basically a bit copier: it just copies every single bit of a hard disk onto either an optical drive or a hard drive, and saves it as a long file. We reconstruct the disk on our own computer, a Vale machine with a 90Mhz Pentium processor, and then we can perform the investigation. ... What we look for depends on the case: if it's a fraudster's machine, we'll be looking for sets of accounts, if we're dealing with a paedophile, we're looking at graphic images. We basically start by looking for erased material, which is always the most interesting, and the slack space. ... One of our biggest problems is getting around passwords and encryption. Not the base passwords -- they're easy to get around -- but the passwords on the applications themselves, and encryption can be very difficult to crack. We do have special programs to get around them, but you need individual ones for each application. The programs can crack most Microsoft applications in minutes, but some, Paradox for example, are a lot harder. The biggest headaches are the pocket organisers from Psion or Sharp. On a PC you have password protection, but you can always get in through the motherboard, but with a Psion you can't get in without the manufacturer's assistance. Interviewer: Ken Luxford Interviewee: Andrew Johnson

1 0

Full text of David Chaum's Congressional speech
by Marcel van der Peijl 17 Dec '03

17 Dec '03

Here's the full text of the speech David Chaum gave in his Congressional hearing. I will also make it available for online reading on our web server in the publications section. --- cut here --- Mr. Chairman, Members of the Committee: As an American who is regarded as the inventor of electronic cash, who has worked over the last dozen or so years to make the technology viable, and who is now CEO of a leading company pioneering in its commercialization, I am very pleased by the interest being shown here and to be here today. We are being forced to decide between two very different kinds of electronic payment technology. The core values we as a nation have fought for, and continue to stand for, are at stake. As a consequence of choosing one of the two directions, these values will be profoundly eroded; by choosing the other direction, however, they will be preserved and likely extended. Wise decisions at this critical juncture may also allow us to avoid certain other pitfalls and to realize economic leadership and growth. I think my limited time before you is best used to briefly explain the fundamentally different approaches to security, before coming to privacy, privacy technology, and its implications. Security Security is simply the protection of interests. People want to protect their own money and banks their own exposure. The role of government is to maintain the integrity of, and confidence in, the whole system. With electronic cash, just as with paper cash today, it will be the responsibility of government to protect against systemic risk. This is a serious role that cannot be left to the micro-economic interests of commercial organizations. In order for those in government to make informed decisions, it will be necessary for them to understand the basic ways to secure transactions in different situations. One basic form is tamper-resistance, exemplified by the chip in a chip card. It is designed to be hard to modify or to read secrets from. Such tamper-resistance is needed for "off-line" payments--those in which the reader device receiving payment from a card, validates payments by contacting a central system only at the end of each day. (Incidentally, this and the other basic form must rely for security on cryptography, sometimes refereed to as encryption, which is fundamental to all information security.) The other basic form is where the individual uses their own computer, whether a desk-top, lap-top, or palm-top device. Such "software only" is all that is needed in an "on-line" system--a system in which the party receiving payment communicates over a network during each payment. The trend is toward a convergence of these two forms into a hybrid--since people don't want incompatible forms of money and since it offers the best of both worlds in terms of convenience; in other words, you will put a chip card into a user-friendly electronic device of your own choosing, whether on your desk, in your living room, or in your pocket. I have brought some examples of this to show you... The problems I see in the industry today reflect a lack architecture. And architecture is essential when building infrastructure, which is what we are embarking on. In my view, a sound architecture must: (i) include the two basic forms of security, and allow for their integration into the hybrid; (ii) prevent the vulnerability of system-wide secrets from being stored in every card or, nearly as bad, every off-line point of payment; and (iii) address privacy concerns effectively, since they cannot be addressed as add-ons or afterthoughts. Today, DigiCash systems are alone in having any of these three attributes, and their architecture has all three. Privacy Let me now turn to this issue of privacy... A recent Harris poll of the American public began by introducing respondents to all the consumer benefits of the information superhighway. Then respondents were told that in order to make such systems economically viable, payment transaction data would have to be gathered and used for purposes such as making special offers to them. But the majority of respondents still objected to any use, other than consummation of the payment, and they gave privacy as the primary reason. Fully 82% of Americans today expressed concern over privacy of computerized data. That fraction has been growing steadily ever since the "first wave" of privacy concern was triggered when Americans saw their names punched into computer cards or printed on computer generated forms. When people are exposed to the information superhighway, which provides an awesome glimpse of the power of modern information technology, with dropping transaction costs leading to finer granularity of payments (which we will be hearing more about later), concern will reach new levels. Privacy Technology "Privacy technology" allows people to protect their own information, and other interests, while at the same time it maintains very high security for organizations. Essentially, it is the difference between, on the one hand, a centralized system with disenfranchised participants (like the electronically tagged animals in feedlots); and, on the other hand, a system where each participant is able to protect its own interests (like buyers and sellers on a town market square). Take ecash as an example of privacy technology. It provides a fully digital bearer instrument--a number that is itself money, just like a bank note is money. On the Internet, once someone downloads the requisite software, which takes only a few minutes, they are ready to send and receive ecash in payments. Security of ecash is superior to that of paper cash. If it is stolen, it cannot be used; if someone refuses to give you a receipt, you have proof that they deposited it; and if it is lost, you can get your money and records back. Counterfeiting ecash poses the same cryptographic challenge as breaking the most sophisticated codes used to protect nuclear materials, military secrets and large-value wire transfers. Therefore, ecash is certainly not the target of opportunity. Ecash is already being experimented with on the Internet in a worldwide monopoly money trial with tens of thousands of participants. Related card technology has been extensively tested, by DigiCash licensee Amtech, for highway-speed road tolls and road pricing, offering privacy instead of dossiers on everywhere people drive. And, CAFE, the European Commission sponsored trial, at its headquarters buildings in Brussels, of chip cards that can be inserted into electronic wallets (that I have already shown you), allows privacy in payments and the electronic ECU. Such "privacy technology" was even successfully used by the participants at the most recent international meeting of data protection commissioners. Ecash has received substantial media coverage; consequently, the public is beginning to realize that the coming of electronic payments need not mean an obliteration of privacy. And the superhighway will give consumers unprecedented mobility to choose it. Some concern about ecash, however, has been raised by various parties over possibilities it might open for illicit payments. But there is simply no legitimate basis for these allegations. Ecash, even when it achieves significant scale, is considerably less dangerous to society than automatic teller machines. For one thing, like cash, the amount withdrawn and deposited is on record; but, for another, unlike cash, the amounts of money that pass through each person's hands are also on record at the bank. Ecash itself is less prone to abuse than paper bank notes, because privacy is "one-way," which means that an extortionist, a seller on a black-market, or the acceptor of a bribe is forever vulnerable to being irrefutably incriminated by the party that paid them. National Leadership Governments who stifle the new technology while it is still in its infancy, before its has had a chance to develop and harmonize with our institutions; who don't pro-actively support needed infrastructure; or who fail to establish confidence by protecting against systemic risk--will be left behind in global competition. Countries who take clear positions based on understanding of the technology, however, and encourage needed developments, stand to gain enormous economic growth and market leadership. Privacy technology, whether used for electronic payments, voting, or other public expression, is the electronic equivalent of a free market and democracy. People will come to insist on it as an informational human right. Dr. David Chaum, DigiCash --- cut here --- // Marcel van der Peijl, DigiCash bv // http://www.digicash.com/~bigmac/ // There is no signature like no signature!

3 2

Re: NRC panel wants questions for Law Enforcement on crypto policy
by Michael Froomkin 17 Dec '03

17 Dec '03

ask them if their policy allows them to purport to run an anonymous remailer, e.g. as part of a sting operation. In message <9507261951.AA23210(a)toad.com> John Gilmore writes: > I collated all the questions into a large ungainly message and sent it > to Herb Lin. He has been after me to go back over it and make a more > useful set of questions, which I haven't done yet. He says they are > meeting with the FBI in September and want to get questions to them in > August (incorporating our ideas). I've promised him I will get him the > formatted list of questions by the end of next week. > > John > -- Michael Froomkin until Aug 6: michael(a)umlaw.demon.co.uk U.Miami School of Law London, England mfroomki(a)umiami.ir.miami.edu <-- this will still find me PO Box 248087 Coral Gables, FL 33124-8087 "Rain in parts, then dry" --BBC See http://www-swiss.ai.mit.edu/6095/articles/froomkin-metaphor/text.html

1 0

Crypto: ride from SF on Saturday
by Bruce Schneier 17 Dec '03

17 Dec '03

Is anyone driving from the SF area to Crypto (in Santa Barbara) on Saturday? If so, I would like a ride. Bruce ************************************************************************** * Bruce Schneier * Counterpane Systems For a good prime, call 391581 * 2^216193 - 1 * schneier(a)counterpane.com **************************************************************************

1 0