December 2003 - cypherpunks-legacy

Re: Crypto '95: Robert Morris
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

So Robert Morris worked for NSA. Does that mean that the infamous 1988 Internet Worm was part of a NSA-sponsored intelligence-gathering mission?

2 1

Response to Time cover on privacy
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 21 Aug 1997 08:18:14 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: Response to Time cover on privacy Attached below is my response to a message criticizing the Time story. As always, I don't speak for Time Inc. These views are mine and mine alone. More info: http://pathfinder.com/netly/editorial/0,1012,1050,00.html -Declan ---------- Forwarded message ---------- Date: Tue, 19 Aug 1997 12:27:59 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> [...] My view is that many so-called "privacy" proposals are in fact censorship in disguise. Society traditionally has allowed people to share information about each other //without// requiring that the speaker seek permission from a third party first. This is a good thing: otherwise, journalists would go out of business. Reporters -- as long as they don't violate common law rights like copyright and defamation -- legally sell personal information about individuals, for profit, all the time. (I've written elsewhere how gossip plays a useful role in every society and is not strictly regulated.) We should extend these same principles and free speech protections to the online world. Yet enemies of freedom argue that as our society becomes more digital, we no longer deserve some of the liberties we have enjoyed in more mundane times. Such arguments led to the diluted free speech protections of radio and TV broadcasting and the passage of the Communications Decency Act. Now we're hearing similar calls for abridged electronic freedoms in the name of preserving them. Some have argued that private firms sharing information about individuals, or recording information your web browser supplies, are such a threat to society that new laws are needed to restrict their actions and muzzle their speech. And, of course, a new Federal Privacy Commission! This schizophrenic approach means trusting the federal government to shield our privacy -- even though the same people are engaged in an increasingly fierce attack on it. (It also ignores the very real differences between government collection and use of databases compared to private ones.) Bill Clinton is the Clipper Chip president, the Digital Telephony guy. His administration's bureaucrats fight harder to maintain crypto export controls than any other. Then there's last year's anti-terrorism bill, the push for roving and multipoint wiretaps, and the FBI's itch to ban nonescrowed domestic crypto. Let's not forget the administration's quest for enormous voracious databanks that will be tied together -- airport security, travel records, national ID cards. These bureaucrats are supposed to protect our privacy? This is the same president whose policies ACLU legislative counsel Don Haines decries as "the Clinton-Gore effort to hardwire Big Brother into the information age." The ACLU even boycotted the June FTC conference, calling it a sham that wouldn't lead to any substantive "privacy protection" rules. THESE bureaucrats are supposed to protect our privacy? I have, I suppose, two more objections to a privacy agency. First, it would be a likely beachhead for those who would restrict free speech in the name of privacy. Second, who would be on this commission? Prof. Westin, whose positions you criticize? The DMA? Could we expect such an anti-privacy president as Clinton to appoint anyone who would do a reasonable job of reining in the Justice Department and other police agencies? Such an office is far more likely to serve as a front for anti-privacy forces inside the administration, much as NIST may front for NSA. In fact, a privacy agency may well //hurt// privacy, for if a co-opted privacy agency backs a bad bill, that endorsement will make it more difficult for others to criticize the measure. As for governments with privacy agencies, you hold up the example of some European countries. But these same countries have unjust policies that restrict free speech in the name of protecting privacy. That's hardly a tradeoff I can accept. Our modern "right to privacy" is a relatively recent invention in the U.S. Many privacy rights mostly date from an influential 1890 law review article co-authored by soon-to-be Justice Brandeis. In it, Brandeis and Warren argued that newspapers went too far and printed offensive information. But absent from their analysis was any consideration of how creating new rights to restrict the press would restrict free speech. Brandeis and Warren wanted to create a new property right in personal information. But this position is no more philosophically coherent -- and consistent with the principles of a free society -- than would be a rule establishing a "property right" in information about your appearance. (Then, presumably, if someone were to talk about you behind your back -- even if the gossipmongering were true! -- you could sue.) Not to mention that it's directly opposed to traditional views of property rights. Don't get me wrong: the government has an important place in society. The state should provide such vital functions as law, police, and courts. Criticisms of a new federal agency are hardly based on opposition to government in principle. You're thinking about anarchism, which I don't support. (Locke had it right: There can be no liberty without law.) Sure, I'm not overjoyed by the databasification of American society. I feel uneasy about Equifax and TRW-type databases. I abhor Safeway's discount card program that links my identity with my shopping habits. But just as I detest holocaust deniers, NAMBLA supporters, and homophobes, I recognize they have a right to speak. So, generally, does Safeway have a right to enact anti-privacy policies. Transactional privacy is not a right but a preference. For example, free speech is a right that strictly limits the government's ability to control what you say. We must demand a similar right of privacy from the government. But I give up my free speech "rights" when I voluntarily attend a college with a wacky speech code or go to work at a company with strict workplace speech policies. Similarly, I give up my privacy "rights" when I voluntarily go to unknown web sites, apply to rent an apartment where a credit check is required, or post to Usenet, etc. I have no general "right" to bar others from sharing informtion about me, even if it's behind my back. (To invent such a "right" would violate their free speech rights.) If consumers //want// privacy -- and I believe they do -- then they'll turn to businesses that provide and protect it. Perhaps I'll take my business from Safeway to Giant since I can get a discount card without giving my true name. In this way privacy becomes one of the many factors -- along with quality of merchandise, reliability, and price -- that consumers consider when they enter into a transaction. In other words: privacy can be protected by contract and common law. Advocacy groups are particularly well-poised to educate individuals and raise consciousness. Privacy flareups like Lexis-Nexis, AOL, and UPS have shown it's possible. Companies often will react to a public outcry by changing policies. If they don't, then privacy-sensitive customers will respond, and the market will remedy its own problems -- without the intervention of bureaucrats or federal privacy agencies. -Declan

1 0

Mail to mail.cypherpunks "newsgroup" echoes to list
by Michael Froomkin 17 Dec '03

17 Dec '03

I have been getting a load of duplicate mail from this group; not all messages are duplicated, only those cc'd to mail.cypherpunks as well as sent to the toad.com address. I don't know if this is a gateway to a local newsgroup or what, but I wish the duplication would stop. Thank you. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | mfroomki(a)umiami.ir.miami.edu U. Miami School of Law | P.O. Box 248087 | It's hot here. And humid. Coral Gables, FL 33124 USA | See (experimentally & erratically) http://viper.law.miami.edu/~mfroomki ---------- Forwarded message ---------- Date: Sun, 03 Sep 1995 08:38:54 -0600 From: Piete Brooks <Piete.Brooks(a)cl.cam.ac.uk> To: lyal collins <lyalc(a)ozemail.com.au> Cc: cypherpunks(a)toad.com, Piete.Brooks(a)cl.cam.ac.uk Newgroups: mail.cypherpunks Subject: Re: A bold ssl idea ? > I understand that setting up RC4 keys is slower that testing for the correct > key (I may have misuderstood this bit). For pure RC4, Yes. However, SSL is not pure RC4. > Is it considered practical to modify the brutessl code to have multiple > message data, and test each against a key from allocated key space ? You are the third person I've heard think of this. [ The first did quite a lot of calculations before spotting the problem ! ] > If so, this may mean that perhaps 3 message can be tested against a single > in the time two single keys could be tested against one message. Well, the original suggestion I heard was to try 64K at a time :-))

1 0

Looking for NII IP "White Paper"...
by Brian A. LaMacchia 17 Dec '03

17 Dec '03

According to an article in Sunday's _Washington Post_ the final draft of the "Intellectual Property and the National Information Infrastructure" report is going to be released Tuesday morning. You may recall the premilinary draft of this report, a.k.a. the "Green Paper", and its proposed changes to U.S. Copyright Law. Does anyone on the list have a copy of the final draft/"White Paper"? The administration is evidently keeping it under pretty tight wraps, probably because of the intense criticism the Green Paper received. Personally, I expect the White Paper to be just as bad. --bal References: The Green Paper/Preliminary Draft is available at: http://www.uspto.gov/niiip.html Pam Samuelson's critique, which appeared in _Communications of the ACM_ and which you should definitely read, is available at: http://www-swiss.ai.mit.edu/6095/articles/samuelson-nii-cacm-dec94.html

1 0

WEB pointers for NIS&T Key Escrow meeting
by pfarrell＠isse.gmu.edu 17 Dec '03

17 Dec '03

To save list bandwidth, I've put the agenda, attendee list, and the three discussion topic papers for this week's Key Escrow meeting on my web. url: http://www.isse.gmu.edu/~pfarrell/nistmeeting.html I'll add anything else I get from NIS&T, and any pointers folks send my way. Pat Pat Farrell grad student http://www.isse.gmu.edu/students/pfarrell Infor. Systems and Software Engineering, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer

1 0

Soon the neighbor's dog will be in the act...(Was Re: book talktoday)
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-PGP-Key: <http://www1.shore.net/~sable/info/rltkey.htm> X-Sender: rodney(a)pop3.pn.com Date: Thu, 21 Aug 1997 09:25:50 -0400 To: dcsb(a)ai.mit.edu From: Rodney Thayer <rodney(a)sabletech.com> Subject: book talk today Mime-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Rodney Thayer <rodney(a)sabletech.com> I was in SoftPro in Burlington (the bookstore) last night and saw they are having an "Internet Cryptography Seminar" today at 6pm, "featuring Dr. Richard E. Smith, author of "Internet Cryptography". I wonder if he'll be digitally signing copies of the book :-) For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: Dumb Question: PGPfone over Appletalk
by Richard.Johnson＠Colorado.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Can someone tell me how to run PGPfone over Appletalk ? The >documentation says that support has been added for this release, and >there's a preferences box to check to use it, but there's no information >I can find in the documentation on how to initiate a call over >Appletalk.. it just says to enter a telephone number to dial. If I >press 'Connect' without entering anything it hangs up the Mac. > >How do I tell it which machine I want to connect to ? > > Mark "Don't know much about Macs" Grant My guess is that you're on a network with multiple AppleTalk zones. The "PGPfone 1.0b4 README" file mentions a known bug that causes PGPfone to freeze when trying to bring up its AppleTalk Browser. The Read Me file then goes on to explain how to connect anyway. Be sure to use a semi-colon, not a colon, between the zone name and the macintosh name... Richard -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMEn+T/obez3wRbTBAQHG7gP+J8It6kZTRYhte2ffTSzflQB8ff14a2pR VR81PD0HIjE5cyNTrAlA6FdVGguy21BIK+tUz5rmQBRuZP46OWynBqk4y551M+fg JjnEOk2jXNBZDFdwT9fy5hWc3g38os6vto5/4vsj5Vhw0+6EoVojzJ8AU99ibG7z pKnPhQnpISI= =8lQJ -----END PGP SIGNATURE-----

1 0

ASN.1 and Kerberos version 5
by jis＠mit.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Perry E. Metzger writes: >I've heard people associated with the decision to use ASN.1 in >Kerberos V say it was a mistake. Frankly, I think ASN.1 is a blight >which should be exterminated from the planet. I'll say it. I was the person who pushed for the use of ASN.1 in Kerberos version 5. I had this disease at the time that made me think that ASN.1 was a good idea. I got better, unfortunately we have been living with the results of my braino for quite some time now... poor Ted. However, the problem with ASN.1 isn't its waste of space (which actually isn't that bad for a mechanism for encoding arbitrary objects). The problem is that it is the product of a standards making process that didn't (and doesn't) value interoperability. Adherence to the ISO specifications does not guarantee interoperation. Instead regional "workshops" negotiate aspects of implementations to obtain interoperation. What does this mean for ASN.1? It means that the definition of ASN.1 is a bit abstract (as its name implies). Problems result when two organizations (say MIT and OSF!) attempt to implement from the specification in ASN.1 but use different ASN.1 compilers and things then don't work. Arguments then ensue about whose compiler (or manually written parsing code) is "correct" in terms of doing the right thing with ASN.1. This is particularly so when using DER (for Distinquished Encoding Rules) which is itself an after-thought added to ASN.1 later in the process. It is required in order to verify digital signatures (which have to be computed on the "encoded" form of an object because there is no good way to calculate a signature on an "abstract" object). If the Kerberos specification said: "pub this byte here and that one there" none of these arguments and problems would happen. -Jeff -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMEiaf8UtR20Nv5BtAQFzNAP/Q/LuIMbxAPAp64Kn2PSPd600TYlRAUJh QbsuL/iRhGXWrxSjsFzkcr6e3sIpSFggxglFU38TJT/DG2AD8MOid3Uj4pRJVbyo z7Au0Vp1NiotmRBHq2udItzJ7LLPM0j38FHQenqPs9mkX2Cq5kVgGUBO94HabEuE S9XPCgV8E1Q= =kTyw -----END PGP SIGNATURE-----

2 1

SSLRef (SSLtelnet)
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have been looking at a number of SSLTelnet/FTP programs (available from utopia.hacktic.nl by the way) and they would seem to all require Netscape's library. Anyone know about this? I found the following link for SSLRef but I was just wondering if it was the only way to implement SSL telnet&ftp. I would hate to see people not be able to use them simply because there's no illegal copies available. URL: http://home.netscape.com/info/sslref.html If anyone knows of any clones or foreign sources please speak up. Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMElX4cLa+QKZS485AQERIQL/SBZAOAdAWSzfl/W9GNfDEU7e+3pBua5s z84iGGuT5CfCGM4X5rYGKV4DuRVfFPyNQc++bn8SpPgyenbvBK+gc6400FHVskr3 Y4HAlBTqSSoyfOUHlhnEAs63nsjDGdFM =ihYg -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://bert.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Death threats ALWAYS pgp signed * This user insured by the Smith, Wesson, & Zimmermann insurance company * PS: my failure to lament violations of ITAR should not be confused with actual involvment in criminal activity. Heh heh heh. Catchyalater

2 1

NIST attendee list
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

The dangers of public attendee lists. Some Cypherpunk might match the list against east cost lawyers and break Black Unicorn's nym. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1