December 2003 - cypherpunks-legacy

Legality of Cash Transactions
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:05 AM 9/8/95, Tobin T Fricke wrote: >>letting it happen, and using cash instead of credit, is the smart answer > >I'm somewhat surprized at how much of an issue this is. The >federal government prints up nice green paper for us to pay for >things with. It's annonymous (to a large extent), univerally >accepted (most of the time), fairly untracably (unless you >really want to), easily available, doesn't collect interest, >free to use, etc. No one is forcing anyone to use credit >cards, etc.. Then again, being a kid, I have never bought >anything with anything other than cash on the spot... I agree with what I think your sentiment is, but bear in mind that "cash transactions" are in fact limited by various laws and regulations about reporting cash payments. Try buying a car with cash, especially a car costing over $10,000. Black Unicorn posted an account a while back (sometime last year) of his efforts to pay cash for a new car. The restrictions on cash are mostly oriented toward ostensibly stopping "drug profits" from being used to buy expensive items. The usual cash figure that invokes special laws is $10,000, with "structuring" of sub-$10K cash transfers an additional issue. I foresee more restrictions coming, not fewer. Several of us have written extensively on this subject. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

VOLUNTEERS NEEDED for keying in Bernstein docs
by Stanton McCandlish 17 Dec '03

17 Dec '03

Our copies of the Bernstein case docs are too low-quality to scan, so we're asking for volunteers to help key them in. Most of you all can type fast and could probably spare a few minutes. If you'd like to help with a page or more please drop me a line and tell me how many pages you'll do, and I'll assign you some page numbers. We have images of the docs from a captured fax at http://www.eff.org/bernstein/Legal/970825_decision.images/ and http://www.eff.org/bernstein/Legal/970827_stay_motion.images/ Thanks for any help! -- Stanton McCandlish mech(a)eff.org Electronic Frontier Foundation Program Director http://www.eff.org/~mech +1 415 436 9333 x105 (v), +1 415 436 9333 (f) Are YOU an EFF member? http://www.eff.org/join

1 0

NIST notes available
by pfarrell＠netcom.com 17 Dec '03

17 Dec '03

Thanks to John Young, I have placed the test of the handouts from Wedensday's and Thursday's meetings on my Nist pages. url: http://www.isse.gmu.edu/~pfarrell/nistmeeting.html It is my belief that this meeting was a staged presentation. Nearly every industry representative said that this was a fatally flawed idea. It was "a non-starter." The government representatives said that they heard the comments, but insisted on proceeding. The most depressing presentation was Thursday morning, made by a high level Dept of Justice flack. I'll have to dig out my notes, his name was Geoff G... He presented the usual drug dealer, pedophile and terrorist line, and added corrupt government officials. He pretended to talk about foriegn bad guys. Nearly all were domestic. He clearly wants weak GAK so that he can decrypt anything domestically that he wants. It is clear to me that the government intends that industry provide crippled encryption "for export" with the never stated expectation that since industry has repeatedly said that they want only one version of products, capable of being sold worldwide, that Domestic products will be crippled. It is equally clear from representatives of IBM, Compaq, DEC, Lotus, and others that I talked to, that crypto product development will simply move offshore. Ireland, Israel, and Germany already have significant experience in developing commercial software. It is depressing to hear our Commerce department chasing technology and jobs overseas. GAK is bad enough. Weak GAK makes me gag. Pat Pat Farrell grad student http://www.isse.gmu.edu/students/pfarrell Infor. Systems and Software Engineering, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer

1 0

Re: fast modular reduction (proof?)
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Oops, sorry for sending it twice. After the first mail I got an error message which said the mail wasn't delivered because it contained control characters. I thought the first mail didn't go out. Hadmut :-(

1 0

Want to help put Judge Patel's decision on the web?
by John Gilmore 17 Dec '03

17 Dec '03

We tried running it through OCR software and the results were worse than just typing it in. So we're asking for your help. Please pick a random page of the document and type it in as ordinary text. We'll proofread it and fix up the strange characters and such. Mail the result to me (gnu(a)toad.com) and post a one-line note to cypherpunks that says "Patel decision page XX handled". If a few get typed twice, it'll be useful for proofreading anyway. The document is on the Web at http://www.eff.org/pub/Legal/Cases/Bernstein_v_DoS/Legal/970825_decision.im… We reworked the original fuzzy images so they're much easier to read now. But that's still no substitute for real, searchable, small, ordinary text. Please type it like this: * Break the lines in the same place as in the original text. * That funny "S-like" squiggle translates as "Sec." (for section). * That funny "P-like" squiggle translates as "Para." (for paragraph). * Any other stuff you don't understand, do your best, then add "XXX", which we'll search for and fix up. Thanks to everyone who helps! John

3 13

Cypher Rant II: Why Private Cryptography should not be regulated.
by Paul Elliott 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- CypherRant V2: Reasons why private cryptography should not be regulated. Paul Elliott is solely responsible for this document. Please distribute widely. FBI director Freeh has been going around pushing his stupid plans for cryptography regulation. Usually, these plans take the form of some kind of mandatory key escrow. Mandatory key escrow schemes are requirements that encryption keys be given to government agencies with the promise that the keys will not be used without a warrant. Now let me give some reasons why Freeh's requests should be ignored. 1) It is unconstitutional! a) First amendment. Electronic communications are a form of speech and the cryptography regulations try to regulate this speech to a form the government understands. Congress shall make NO LAW ....or abridging the freedom of speech or of the press; ... They really meant it! b) Second amendment. Cryptography is arms. Even U.S. government ITAR regulations admit this. Therefore cryptography is protected by Second amendment. c) Ninth & tenth amendments. Article I section 8 does not give congress the power to tell us what computer software we can run on our computers. Therefore that power remains with us, and we should be able to run whatever cryptography software we want the displeasure of congress not withstanding. d) The power to search, if a warrant exists, which is mentioned by the fourth amendment, does not grant the government the right to succeed in finding what the it is looking for. In other words the power to search, is not a power to guarantee a successful search. It is not a power to require citizens to run their lives in such a manner that any government search will be successful. For more information on this, see the following World Wide Web url: http://www.clark.net/pub/cme/html/avss.html Since all Senators and Congressmen take an oath to preserve and defend the constitution of the U.S., this should be the end of the argument. However, watching some of the stupid laws that have come out of congress in past years, tells me I should supplement the above with additional argument. I am not a lawyer and I am not trying to be one. I have no opinion as to whether private cryptography regulations will be found unconstitutional. There are a number of cases where out courts have made decisions which do great violence to the plain meaning of the text of our constitution. Knowing what the courts will actually do is the business of lawyers. Understanding the constitution so that one may know what the courts should do should be the business of every citizen. 2) The excellent NRA argument "when guns are outlawed only outlaws will have guns" applies with equal force to cryptography! Professional criminals will circumvent with ease any government regulations on cryptography. Billions of bytes travel the internet yearly. The techniques of steganography make it absolutely trivial for any motivated person to conceal any encrypted messages. The Big Brother cryptography regulations will affect only ordinary citizens. 3) Cryptography is already in use by legitimate business. Any government regulation of cryptography will probably cost huge amounts of money for software and hardware costs for existing systems to be changed to a form that the government approves. The existing ITAR regulations probably cost the U.S. economy large amounts of money because U.S. companies can not market cryptography software internationally. For information, see: http://www.eff.org/pub/Crypto/ITAR_export/tis_walker_export_101293_hr.testi… By discouraging private cryptography, the ITAR regulations probably enables a large amount of computer crime since it makes it difficult for people to protect themselves. The ITAR regulations have not and can not prevented strong cryptography from making it outside the U.S. How many tons of cocaine illegally enter the U.S. every year? Yet the government ITAR regulations propose to regulate the export of software that can fit in a shirt pocket, or travel by wire concealed with billions of bytes of data that leave the U.S. every year. It is time for the U.S. government to start living in the real world! According to an article in the August 17, 1995 Wall Street Journal, ITAR regulations have required Netscape to use inferior encryption methods in the international version of its World Wide WeB browser software. This inferior encryption method has actually been broken by a French Hacker! Because of its computational intensity, this weakness in the encryption method does not represent an immediate danger. However as more powerful computers continue to develop, this and similar vulnerabilities will present a danger for those who wish to use the internet for commerce. For more information, see: http://pauillac.inria.fr/~doligez/ssl/ 4) These regulations make it impossible for an individual to have greater privacy than the U.S. government. The Adlrich Ames case makes it clear that the U.S. is incompetent to keep a secret. 5) The proposed regulations require the American people trust the government, but on the contrary, the government should be required to trust the American people. Recent news stories (Waco ect.) make it clear that it is common for government agents to lie to get a search warrants. Government should be viewed as George Washington did as "a fearful servant and a dangerous master". A recent poll conducted by the Americans Talk Issue Foundation said 76% of the people questioned responded that they rarely or never trust "government to do what is right". This mistrust is well founded. At the same time as administration sources were saying that key escrow schemes would remain voluntary, FBI, NSA, and DOJ experts were saying that the schemes must be made mandatory if they were to be at all effective. If the government is willing to lie to establish a key escrow key system, what makes us believe that the government will not lie when applying for warrants to use that system? For more information on this, see: http://www.efh.org/pgp/fbilie.html If any key escrow system is adopted, the secret FISA court will undoubtedly be given the power to issue warrants for decryption keys. The FISA court has granted over 7,500 wiretap requests in complete secrecy with only one refusal. The secrecy of this court creates a great opportunity for abuse. If the court is lied to, the lie is not exposed, because the people with an interest in exposing the lie do not know the lie exists. If the court grants legally unwarranted warrants, there is no one to appeal or to try to stop the practice, because no one knows about the problem. For information, see: http://MediaFilter.org/MFF/CAQ/caq53.court.html 6) It is too humiliating to require a free people to participate in the establishment of their own surveillance prisons. This is what key escrow requires. Consider the words of our revolutionary heritage: Those who would sacrifice essential freedoms for temporary safety deserve neither. Benjamin Franklin If ye love wealth greater than liberty, the tranquility of servitude greater than the animating contest for freedom, go home from us in peace. We seek not your counsel, nor your arms. Crouch down and lick the hand that feeds you; and may posterity forget that ye were our countrymen. Samuel Adams Do you think that these men would approve the government's key escrow requests? This information can also be found at the following url: http://www.efh.org/pgp/rant.html - -- Paul Elliott Telephone: 1-713-781-4543 Paul.Elliott(a)hrnowl.lonestar.org Address: 3987 South Gessner #224 Houston Texas 77063 -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBMFA5K/BUQYbUhJh5AQGOjAP+OyDEtAJGL32S8IK+HGAfaOTkpCI18SCL QvSTaknPd5J2m+yzamGD88Z2YJKwW1M+2GgqGqsclCpI+KCvSp2Z9h1KXWT6ANGR MXTuK3fjVmlvp5lqZAwHb133qL97e60MIq+5lK26FPaGzBCr7ckPMF0cvM+mm4dW dyc1uuXaZg0= =bVzd -----END PGP SIGNATURE-----

2 1

Day 2, nist GAK meeting
by pfarrell＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Date: Fri, 8 Sep 1995 09:32:43 -0400 (EDT) From: "Pat Farrell" <pfarrell(a)127.0.0.1> To: cypherpunks(a)toad.com Cc: BCc: Subject: Day 2 NIST meeting notes X-NUPop-Charset: IBM 8-Bit Thursday's GAK Export meeting started with reports from the prior afternoon's breakout meetings. I reported on the session I was in, saying what I posted to the list yesterday (about National Semi's product, etc.) The other breakout groups reported their problems with the criteria, again asking that #9 be dropped, longer, keys, etc. The presentation for Group "A" was different. It was a speach. It asked that the process be stopped to let industry develop market-driven solutions. It was greeted by applause from the vendors and privacy advocates, with no reaction from the government representatives. Randy Williams of Commerce, and Dan Cook of State, described the current export approval process. Lots of talk of jurisdictions and types of liscenses. I quickly got lost in the jargon. The moderator wisecracked that the official language of the session was English. You couldn't tell from some of the exchanges. They were questioned on import restrictions. Both Williams and Cook said that there are no import restrictions into the US. They also pointed out that Treasury, not State or Commerce, has jurisdiction over imports. An engineer from Compaq asked a question: He said that his company buys liscenses to software, and bundles it as "value added" to their systems. They are interested in bundling in security features. He asked if his computers would then be subject to export restrictions. The answer was yes. He asked if he could purchase security software overseas and import it. The answer was again yes. He asked if he could install that software on his computers, again yes. And export the computers, NO. They didn't even seem to think that this was illogical. So Commerce, State, and the rest of the government are activly encouraging the development of competing software industries in Israel, Germany and other counrties. I hate to think what they'd do if they tried to hurt US industry. And interesting tidbit came up after the session. In an offline conversation, the topic of "personal use export" came up. A reliable source said that revised regulations are being developed, and will, be avaialble soon. I explicitly asked if this meant "PGP on a notebook computer" and was told, Yes, that will be allowed; with the usual rules that it can't be for export, you can't be attempting to sell it, etc. Personal use, carry out and carry back. The "source" was asked if they had read Matt Blaze's personal use disaster story. The name didn't ring a bell, but the story was well know and considered a nightmare. Penny Brummitt of NSA was to talk about Clipper's key escrow agents, but called in sick. I didn't catch the name of the replacement. He talked about Clipper's process, not as an example of what will be required for GAK agents, but as an "existance proof" that some agents can be found. The essence was that Clipper escrow facilities are strong, and staffed with people cleared to the "Secret" level. They also tosed out the phrase "US Person" in regard to the corporate entity that is responsible for the contract. Geoff Greiveldinger, of the US Department of Justice, gave a frequently inaudible recounting of the evils of strong encryption in the war on D, P, & T, and also corrupt mayors. He was very personable. He also sounded like a fascist. Throughout the meeting, all sides tried to have a civil discussion, even though we disagreed. It was impossible to stay civil through his drivel. Ruby Ridge and Furman had been unmentionable up until his speach. Mr. Greiveldinger said that acceptable escrow agents will be in the US. This caused considerable concern among vendors trying to sell in the International market. Dan Weitzer of CDT (the EFF spinoff) gave a short, rousing speach. It was a call to arms. He said that since NIS&T was ignoring the consistant input from industry to stop this silly and stupid GAK, that we need to immediately contact our congresscritters. Ken Mendelsen [sic?] of TIS gave a great speach. He suggested that the critera for escrow agents be the same as the form to export tanks and other munitions. Then he showed the one page form used by State. He argued that legislative solutions to the escrow agent approval process will take too long and kill the effort. I'll try to get copies of his presentation. F.W. Gerbracht, Jr a VP Merril Lynch, represented the Securities Industry Association. He said that they are willing to work with the government, but they need long keys, strong ciphers, and international escrow agents. He used the phrase "unlimited algorithms and keyspace" as a requirement. They also need buy in from their regulators, and presented a long list of SEC, CFT, NYSE, NASDealers, and 50 state regulators, all who have to sign off. Nanette DiTosto of Bankers Trust gave a short, to the point presentation. She said that BT has a commercial key escrow service, but that was not what she wanted to get accross. She said that multinational banks demand strong encryption and non-US escrow agents. And that they would settle for nothing less. A speaker from VTW gave a nice presentation. VTW is something like voter's telecommunications watch. They have a mailing list, at listproc(a)vtw.org. He said that escrow was doomed to failure. That there is no middle ground. I'll try to get his slides too. Jack Wack of TECSEC gave a pitch for his shrinkwrapped product. He said it is exportable now, they've jumped through all the hoops. He also gave a great crack from his son. It want roughly like: "Dad, if you own the data before you encrypt it, how come the government says you don't own it after you encrypt it?" It brought down the house. (if someone has a more accurate quote, please let me have a copy). Professor Hoffman of George Washington gave a great speach. He listed the Al Gore to Maria Cantwell letter's criteria, as a matrix. He then filled in the matrix with the Export GAK's criteria. It was painfully obvious that the NIST/NSA propsal didn't come close. He recommended that they focus closly on the Gore criteria, and come up with an approach that meets all the the criteria. While I planned on staying for the remainder of the meeting, a crisis came up at my day job. I can't say I was looking forward to more, a day and a half was enough for me, and I wasn't the only person leaving early. Attendance was down visibly Thursday relative to the first day Pat -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAwUBMFBGEbCsmOInW9opAQEfQgP+P/P0MRGe3EOElzM0UPQy+xce0XGe3wex gfQdTrGWhL+FbYt/7taj6jgtcRg9zih1yQ3W+kN/VUXY9J4I1b6dw+j0sb6MkCjT pShnflDI5OPQmmUq9KZlmy50u2yXuBqfWSdXd9NypjDsh7XDrWIqvqIcuT1cc/di quNZ3u7aymw= =oJC7 -----END PGP SIGNATURE----- p.s. please let me know if this one's pgp sig is better than yesterday's Pat Farrell grad student http://www.isse.gmu.edu/students/pfarrell Infor. Systems and Software Engineering, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer

1 0

Cylink Withdraws Claims in RSA v, PGP
by John Young 17 Dec '03

17 Dec '03

VM has pointed out that RSA put a letter on its Web site yesterday from Caro-Kann withdrawing its claims in the RSA v. PGP suit. The letter is a GIF file, and VM has made a transcript of it and provided commentary on the case and what is now in the offing: http://jya.com/rsavpgp-ckc.htm

1 0

Re: ON OFF-TOPIC
by Arve Kjoelen 17 Dec '03

17 Dec '03

On Thu, 7 Sep 1995 yihchun(a)saul3.u.washington.edu wrote: > > Poor you, the only major political party to come out with a pro crypto > > statement is a socialist party. >I think the libertarian position is inherently pro-crypto. >Besides, the French are socialist, and well, as far as crypto goes... Wrong! First of all, Jacques Chiraq (French President) and the majority of the French parliament are conservatives. Secondly, a statement like "the French are Socialist" is a (untrue) generalization. You are probably thinking of Francois Mitterand ("socialist"), who became French President in the 80's, and the first French Socialist President ever. Chiraq, by the way, is the genius behind the recommencement of Nuclear testing in French Polynesia "Test them in France if there's no risk of radioactive leakage" -Arve Kjoelen Southern Illinois University at Edwardsville

1 0

Jimmy Upton's T-shirt (NIST's 9/6-7/95 meetings)
by Carl Ellison 17 Dec '03

17 Dec '03

The meetings included break-out groups, each of which had a moderator (mine was from NSA -- were they all?) and each of which had a recorder who would then report to the entire assembled group. Jimmy was a recorder once -- one of the last to report on the second day. Nearly every person speaking from industry started his remarks with the same disclaimer: My comments on these criteria should not be taken as an endorsement of the concept of key escrow Jimmy Upton, rather than start his report with that disclaimer, suggested that perhaps we should have T-shirts made for conference attendees stating: "My comments on these criteria...." The crowd broke up in laughter and applause. Speaking of applause -- the assembled audience was relatively passive through most of the presentation -- but whenever someone expressed opposition to the whole concept of GAK, the entire auditorium applauded. Specifically -- I was sitting near the civil liberties group (ACLU, EPIC, VTW, ...) and they applauded but it came from all over the auditorium. There were some who didn't -- the gov't folks, a few industry folks, .... - Carl P.S. I've put a few additions on my home page, in response to this meeting. +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme/home.html | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +----------------------------------------------------------- Jean Ellison -+

1 0