December 2003 - cypherpunks-legacy

fcpunx subscribe
by Wendy Fu 17 Dec '03

17 Dec '03

endWendy Fu, Network Manager St. John's University School of Law 8000 Utopia Parkway, Jamaica, NY 11439 E-Mail Address: wfu(a)sjulaw.stjohns.edu Phone: (718)990-1666

2 1

Re: GAK/weak crypto rationale?
by John Young 17 Dec '03

17 Dec '03

Responding to msg by Andrew.Spring(a)ping.be (Andrew Spring) on Tue, 12 Sep 7:3 PM >A more cautious conclusion would be would be that the >importance (to the LEA's) of the busts made with >crypto is much larger than the numbers suggest. You >could interpret that a lot of ways: I suspect that >high-profile career-enhancing cases are highly >dependent on wiretaps. In response to an audience question about wiretaps and crypto, Mr. Michael Nelson of the White House said at the NIST GAK meeting (paraphrased): We are not concerned with bad people using crypto among themselves, we can handle that. We are more concerned with their using crypto to communicate with regular folks, to make legitimate arrangements -- finance, supplies, travel, and so on -- for their nefarious deeds. It's the intermix of the bad with the good that's the problem. Maybe someone else at the meeting heard this differently and will comment, but this seems to mean that the Feds can track, and maybe crack, the crypto-intercomm of "bad people" so long as it is not buried in a torrent of public crypto use. And not commingled with lawful, ECPA- protected(?), communication. Anybody want to elaborate what Mr. Nelson was implying about wiretaps and crypto?

2 1

Edited Edupage, 29 Feb 1996
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)elanor.oit.unc.edu" 1-MAR-1996 00:53:05.93 >***************************************************************** >Edupage, 29 February 1996. Edupage, a summary of news items on information >technology, is provided three times each week as a service by Educom, >a Washington, D.C.-based consortium of leading colleges and universities >seeking to transform education through the use of information technology. >***************************************************************** The below has some relevance for the discussion on firewalls vs encryption. It seems to give evidence for the needed solution being either firewalls and encryption (external _and_ internal) or encryption alone. >NO SAFETY ON THE NET >A recent survey of businesses found nearly one in four are staying away from >the Internet because they worry about electronic security breaches. For >instance, Merrill Lynch refuses to use the Net for any "value-bearing" >business and has doubts about allowing customers to link up via the >Internet. Meanwhile, if your company uses an Intranet, you're not immune to >security problems -- experts estimate that as much as 80% of all security >losses are committed by company insiders. The technical staff manager at >Bell Labs notes: "Our firewall keeps the bad guys out. But you can't say >there aren't bad guys inside the company." (Information Week 19 Feb 96 p34) The below is worrisome; I am willing to bet that the European governments might try to require it, and that the US might follow suit if the CDA gets tossed out (analogous to the V-chip). I'll send a further message after I've analyzed the rating system in question a bit more. >SELF-PATROLLING THE WEB >The World Wide Web Consortium is pushing the Web page rating system that it >developed in cooperation with the Platform for Internet Content Selection, a >group of 22 online firms. Operators at about 20,000 Web sites have already >coded themselves using the Internet Relay System, which is similar to the >rating system for films. To rate your Web site, go to the SafeSurf site at >< http://www.safesurf.com/ > and fill out the form that helps them come up >with a rating. PICS members plan to pitch the system to European >governments in an effort to avoid continental content restrictions. >(Investor's Business Daily 28 Feb 96 A6) >Edupage is written by John Gehl (gehl(a)educom.edu) & Suzanne Douglas >(douglas(a)educom.edu) Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by the Office of Information Technology, >University of North Carolina at Chapel Hill. >*************************************************************** >EDUPAGE is what you've just finished reading. To subscribe to Edupage: send >a message to: listproc(a)educom.unc.edu and in the body of the message type: >subscribe edupage Thomas Alva Edison (assuming that your name is Thomas Alva >Edison; if it's not, substitute your own name). ... To cancel, send a >message to: listproc(a)educom.unc.edu and in the body of the message type: >unsubscribe edupage. (Subscription problems? Send mail to >educom(a)educom.unc.edu.)

3 2

Re: Netscape to patch shareware version
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

>| Netscape said it received word last week that the State Department had >| cleared that version for release on the Net, but only within the U.S., >| owing to current export laws banning the export of encryption schemes >| stronger than 40 bits. THe company could provide no details by press >| time on how it would ensure that the 128-bit version wouldn't leak beyond >| U.S. borders. > >Ok, any bet on how long it will take? It's already been exported. Evidently, one of those who bought the commercial version sent it to Europe as soon as it was out. I note the site removed it, however, probably because Netscape Comm. Inc. requested that they do so. Netscape generally objects to anyone else carrying their browser (.edu sites with prior permission excepted).

1 0

Re: art-stego
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Jonathan Rochkind wrote: > So a good steganography algorithm (which I understand > exists) merely changes the values of the noise so that it > now encodes your (random) message. So there's no way to > look for "suspicious bit patterns" > You are assuming that the noise bits have the same statistical properties as cyphertext. I would be very surprised if this were the case. It takes special effort to achieve good random bit streams. Image scanners may do this by accident, but then again, maybe they don't. This uncertainty is, in my opinion, the fatal flaw in image-based steganography. The same reasoning applies to audio-based steganography. Unless the devices were specially designed to insert cryptagraphically useful bits in the output (or, as Tim May suggested, good garbage bits are inserted later), then you should not rely on the pictures or audio files to keep your messages hidden. As an alternative to trying to hide bits, I proposed not hiding them at all, but instead creating an innocent reason for passing around files that contain, in some way or another, obvious random bit streams. The first idea that came to mind was to use the random bit streams to create pretty fractal pictures. I soon realized that any function that produces pretty pictures would do the trick as long as there was a way to recover the random bit stream given only the picture and the function. Perhaps it would be possible to use random bit streams to generate cool BioMorphs (ala "The Blind Watchmaker"). If enough people start passing around pictures generated from meaningless random bit streams, then other people could use this traffic to covertly exchange pictures generated from meaningful random bit streams. > if they can manage to get a cleartext message out of it, > plausible deniability is unlikely to get you far. > You could always claim you didn't know it was there, that you just downloaded the picture out of curiosity. It might help, depending on what country you live in. Tim May wrote: > Just bear in mind that this form of steganography is > getting further away from conventional hiding, and > into "pure plausible deniability." In fact, one need > not even make a serious attempt to hide the encrypted > bits: just call the encrypted file "art" and be done with > it! > Come to think of it, if the picture files were larger than the random bit streams, people very well might send just the random bit streams. "Hey Bob, take a look at the picture this creates when you feed it to the XYZ function (coefficient values A, B, and C)." Jim_Miller(a)suite.com P.S. In case anyone is wondering, the reason there is a large delay between a post from me and a reply from me is that I'm not actually on the mailing list. I read the messages by pointing my news reading at nntp.hks.net

4 4

VOO_doo
by Adam Philipp 17 Dec '03

17 Dec '03

1 0

Do you feel lucky, punk?
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [from Cypherpunks] Those of you who are confident that the Leahy bill won't be interpreted to punish innocent people (for example, operators of encrypted anonymous remailers) who are not directly engaged in criminal activity should read the following article, that appeared as the George Will column March 10, in my local paper. Maybe it will give you a healthy dose of REALITY (remember reality, fellows?): "Taking Property from innocents doesn't fit conservative ideals" by George F. Will. In 1827, in a case concerning the forfeiture of a Spanish ship used for piracy, the U.S. Supreme Court held that the owner could lose his ship even if he was not even aware of the use of the ship for piracy: "the thing is here primarily considered as the offender, or rather the offense is attached primarily to the thing." That, and a long line of cases in that vein, is why the court last week said Tina Bennis has no right to compensation for her half-interest in the car she co-owned with her husband John and which was forfeited after he was convicted in Detroit of engaging in sexual activity with a prostitute in the car. The court was divided 5-4 in rejecting Mrs. Bennis' contention that the forfeiture violated her 14th amendment right to due process and her Fifth Amendment right not to have property take without just conpensation. Justice John Paul Stevens, joined in dissent by David H. Souter and Stephen Breyer (anthony M. Kennedy dissented separately), condemned the "blatant unfairness" of punishing an innocent person. And Justice Clarence Thomas, although concurring separately in the opinion written by Chief Justice WIlliam H. Rehnquist and joined by Sandra Day O'Connor, Antonin Scalia, Ruth Bader Ginsburg and Thomas, said that what was done to Mrs. Bennis by Michigan law was "intensely undesireable." Because many governments are increasingly agressive in their use of forfeiture as punishment for prostitution, drug, and other offenses, this decision, although supported by the most conservative justices, should trouble conservatives: it involves conflicts between three things they value- deference to states' legislative judgments, fidelity to precedent and respect for property rights. Bennis made his mistake in 1988 in an 11-year old Pontiac he and his wife had recently purchased for $600. The trial court judge had discretion to order payment of half the sale proceeds to "the innocent co-titleholder," but commented that "there's practically nothing left" after deduction of police, prosecutorial, and court costs." Ginsburg noted that the question at issue was not whether compensating Mrs. Bennis would have been fair but whether compensation was a constitutional right. And Ginsburg's concurring opinion suggests that she would have affirmed such a right had not the car belonged as much to Mr. Bennis as to Mrs. Bennis. Although Mrs. Bennis neither consented to nor knew of the misuse of the car, Rehnquist cited the court's language in a 1926 case, that it is common "for the law to visit upon the owner of property the unpleasant consequences of the unauthorized action of one to whom he has entrusted it." That practice, the court had said five years earlier, is "too firmly fixed in the punitive and remedial jurisprudence of the country to be now displaced." Certainly the court should not casually unsettle what it has firmly fixed. Nor should the court relieve Congress of its role in correcting dubious legal practices. the chairman of the House Judiciary Committee, Rep. Henry Hyde of Illinois, has drafted the Civil Asset Forfeiture Reform Act that would, among other things, strengthen protection of innocent property owners. Still, sometimes the court has had to say, in effect, "Well, come to think about it... ." It took four years of carnage and then the 13th amendment to correct what the court did in 1857 in Dred Scott vs. Sanford. But in other cases the court has tidied up after itself. In 1896 in Plessy vs. Ferguson, the court held that "separate but equal" public facilities segregated by race were compatible with the 14th Amendment's guarantee of equal protection of the laws. Later, the court conducted a protracted retreat from that position. In 1905 in Lockner vs. New York, as in similar cases, the court held that a New York law limiting bakers to a 10-hour workday violatedd teh DUe Process clause. By 1963, Justice Hugo Black could assert that the Lochner doctrint of "substantive due process," that the court can overturn laws it considers unwise, "has long since been discarded." (Actually, it has long since been smuggled into liberal jurisprudence to support a different social policy agenda.) In his obviously uneasy confurring opinion in the court's decision about Mrs. Bennis' car, Thomas says the case "is ultimately a reminder that the Federal Constitution does not prohibit everything that is intensely undesireable." Quite so. So it is time for the political branches of state governments and the federal government to act on the clear signals from Thomas and others concerning the need to protect innocent persons who cannot reasonably be considered culpably negligent concerning the misuse of their property. [end of article] To those suckers who say that they genuinely believe that the operator of an anonymous encrypted remailer will not be subject to criminal or civil penalties for what ends up being the misuse of their system, I would like to re-state a quote from the article above: "Although Mrs. Bennis neither consented to nor knew of the misuse of the car, Rehnquist cited the court's language in a 1926 case, that it is common "for the law to visit upon the owner of property the unpleasant consequences of the unauthorized action of one to whom he has entrusted it." That practice, the court had said five years earlier, is "too firmly fixed in the punitive and remedial jurisprudence of the country to be now displaced." " Does this sound familiar? Doesn't it hit just a bit too close to home? I argue that a person who runs an anonymous encrypted remailer could be clearly claimed to be "entrusting" that "property" to someone else, under the meaning of the above paragraph. At least, that is the position the prosecutors could surely take, especially given this Supreme Court decision. In fact, I would argue that a remailer operator will actually be considered MORE responsible, legally, than Mrs. Bennis: The abuser of _her_ property, Mr. Bennis, was in fact the co-owner of that property, and it is doubtful that Mrs. Bennis COULD have denied to Mr. Bennis, practically or legally, the opportunity to abuse that property. On the other hand, the operator of an anonymous encrypted remailer is, in effect, "giving out the keys" to that remailer (giving authorization to use it) to anyone at any time, with no checking or other specific authorization, to people who have no legal ownership in that remailer. In fact, the system is (at least arguably) helping to cover up after those abuses. If those self-selected people commit crimes using it, who else is responsible? Question: If the Supreme Court is willing to take away Mrs. Bennis' interest in that car under THOSE circumstances, do you really believe that it WOULD REFUSE to allow a prosecutor to decide that the operator of an abused remailer should be prosecuted (or his property taken by government in a forfeiture action)? Frankly, I don't know how rude I must be before reality sinks in to your brains: If you people continue to insist that this Leahy bill won't be abused, you truly do need to wake up before you end up screwing the rest of us "out here." Your foolish endorsements of this Leahy bill play directly into the hands of those who want to ban the EFFECTIVE use of encryption. Go ahead, endorse the bill CONDITIONALLY on the removal of that offending section. But you should make it quite clear that keeping that section should kill the entire bill. You have been warned. Is it any coincidence that we first heard about this Leahy bill much less than a week after the decision that Mr. Will speaks of? Is it possible Leahy was waiting to see if the SC would allow him to misuse the wording of that proposed law? Having gotten the go-ahead, out pops the new bill. As if on cue. "Do you feel lucky? Well, do you, PUNK?" If there are any of you who have doubts as to the need for the "Assassination Politics" idea, I'd say this S.C. decision should clear them up but fast. Anybody out there believe that the decision would have gone this way if we'd all been able to chip in and fix the problem in a few days? Jim Bell jimbell(a)pacifier.com p.s. especially to Tim May: If the issue wasn't so serious, and their blind support of this bill so obviously misguided, I wouldn't be rhetorically "slapping them in the face" as I'm trying to do here. Klaatu Burada Nikto -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMUONFPqHVDBboB2dAQGIMQP/cQ4f7wUm3swBrXFKDgQ+QrzfrKWooDwu 0DVMIS3gRr5AOkXANjXKQmdV0U6Ug2Rf/Wtkh32S8lR+wpizvn9kg7nVhrDLHvKZ pClRAgTFolI5FDctU6J934+XxD5xt83nw15M4yenZAtPDN8OoakMft2cDKUeqEis apuLR5tzyTA= =aPdf -----END PGP SIGNATURE-----

2 1

Re: IPG - newest release of the ABC Encryption Algorithms (fwd)
by John Pettitt 17 Dec '03

17 Dec '03

>IPG Sales wrote: >> Obviously, you meet our requirements for the release of the IPG ABC >> Encryption algorithms. We need no further information from you. though we >> would appreciate your telephone num and snail mail address. > At 08:01 AM 3/19/96 -0600, Mike McNally wrote in reply: >On the other hand, the "algorithm" as presented is so hopelessly >obfuscated by the strange terminology and loose descriptions used >to present it that there's no way I (or anybody else) could seriously >evaluate it. Either publish an algorithm in some accepted format >(a real C program, or even Knuth notation) or cut back your expectations >for public analysis. > IMPORTANT: I have nothing to do with IPG and I don't endorse their stuff, I got the same mail and produced the code below to help me figure out what they are doing. John Here is my take on a C version of their code - note that a[] b[] c[] and the initial d are filled in from the 'one time pad'. The size of a,b,c is not specified it could be 8 16 or 32 bits from the text ... However the initial values of a,b & c are set using 8 bits of the 'random' key. int a[64] /* Random & 0x3500 */ int b[64] /* Randomly selected primes */ int c[64] /* randomly selected primes*/ char d; /* random start value */ int i; /* the arrays b,c are filled in from tables of smallish primes supplied by IPG using 'random' numbers supplied by IPG to select the primes (and the order of same). since all the values are > 8 bits I've assumed a,b,c = int. a[] is filled with 13568 + an 8 bit 'random' number. (13568 = 0x3500 which gets ANDed with the seed value) */ while(1) { for(i=0; i<64;i++) { a[i] = (a[i] + b[i]) % c[i]; d = (d+a[i]) & 0xFF; /* output d as next byte in stream */ /* XOR with plaintext */ } } I would not trust it without spending more time than I have right now to look at it. It arrived with the following text: >The algorithms detailed below are copyrighted 1995 and 1996 by Internet >Privacy Guaranteed, Seymour, TX. All rights are reserved. You may not >provide them to any other party, or parties, by any means or >any media, without the expressed written permission of Internet Privacy >Guaranteed. I have not agreed to this, further I strongly suggest IPG add studying trade secret and copyright law to their todo list. I do not endorse the above code or algorithm and make no comment on it's strength or otherwise.

6 5

Re: Whitehouse "dissident" web site monitoring?
by lindat＠iquest.net 17 Dec '03

17 Dec '03

>To: cypherpunks(a)toad.com >From: an215712(a)anon.penet.fi >X-Anonymously-To: cypherpunks(a)toad.com >Organization: Anonymous forwarding service >Reply-To: an215712(a)anon.penet.fi >Date: Tue, 12 Sep 1995 17:17:15 UTC >Subject: Whitehouse "dissident" web site monitoring? > >- ---------------------------------------------------------- > > WHITE HOUSE MONITORING OF DISSIDENTS ON THE INTERNET > > > The National Security Agency presumably can monitor >subversive communication on the Internet without leaving any >trace by "sniffing packets" at traffic nodes. For purely >political purposes, however, the White House may be forced to do >the monitoring in-house, which means that they leave traces >everywhere they go. > > With just a superficial search for such traces, The >Washington Weekly has uncovered intensive monitoring of >"dissident" Internet sites by the White House. > > It turns out that computers from inside the White House have >kept pretty good tabs on information available on Whitewater, >Vince Foster, and Mena at a few key repositories on the World- >Wide Web, a subset of the Internet. > > Just three such sites: "The Washington Weekly, "The >Whitewater Scandal Home Page" and "Whitewater & Vince Foster," >were accessed 128 times by four computers from the Executive >Office of the President between August 28 and August 31. If the >White House is showing a similar interest in other sites on the >World Wide Web, that would amount to a monitoring operation of >considerable magnitude. Tim Brady of the Yahoo! World-Wide Web >index says that his company alone has indexed approximately 725 >political sites. That monitoring effort would be nothing, >however, compared to the effort required to follow all anti- >Clinton discussion on the Usenet, another subset of the Internet. > > The White House did not respond to an inquiry (attached >below) asking for an explanation and asking whether this >constituted "casual browsing." > > Interestingly, the week after the White House snooping of >files, which included a series of articles by J. Orlin Grabbe on >Vince Foster's ties to the NSA, the following little piece >appeared in Newsweek Magazine: > > "Conspiracy theorists perked up when Deborah Gorham told Senate > Whitewater investigators in June that her boss, the late deputy > White House counsel Vince Foster, asked her to put two secret > notebooks from the National Security Agency in a White House > safe. The suggestion that Foster dealt with the NSA sparked > feverish speculation on the Internet that he was involved in > espionage. The reality appears more prosaic. The White House > won't give details, but sources say Foster's files dealt with > legal questions about national emergencies...." ==================================================== During the Waco Hearings, Charles Schumer said he'd seen Foster's missing file and all it had in it was a memorandum about "Linda Thompson and THAT tape." Now, put that with the "sources say Foster's files dealt with legal questions bout national emergencies . . . ." and I will presume that "THAT tape" and I constitute a "national emergency." Harumph. At any rate, we've (AEN News) had a number of military-based sniffs here. -- Linda ================================================ > Does the White House follow anti-Clinton discussion on Usenet >newsgroups just as closely? The White House posts press releases >to Usenet in collaboration with the Artificial Intelligence Lab >at Massachusetts Institute of Technology. But MIT System >Administrator Bruce Walton says that the White House does not use >the same server for reading netnews. It would be difficult - >although not impossible - to find the server that the White House >uses for reading or receiving netnews and check for traces on >that server. > > Readers may be tempted to post a threat to the President on a >newsgroup just to see if they get a visit from the Secret Service >the next day. That experiment is not advisable. It is a criminal >offense. But Usenet just might be a faster conduit for getting >the attention of the administration than the email address that >the White House has published for the president. > >Attachment: > > > THE WASHINGTON WEEKLY >_________________________________________________________________ > >August 31, 1995 > >Virginia M. Terzano >White House Office of the Press Secretary >The White House > > >Dear Ms. Terzano: > > It has come to my attention that several dissident sites on >the World Wide Web have been visited by White House computers >this week. Apparently, all information regarding Whitewater, >Foster, and Mena has been transferred to White House computers. > > Specifically, the sites, > >"Washington Weekly" (http://www.federal.com) >"The Whitewater Scandal Home Page" >(http://www.cs.dartmouth.edu/~crow/whitewater/) >"Whitewater & Vince Foster" >(http://www.cris.com/~dwheeler/n/whitewater/whitewater-index.html) > >have been visited by White House computers ist1.eop.gov, >ist6.eop.gov, ist7.eop.gov, and gatekeeper.eop.gov between August >28 and August 31, and a total of 128 files have been transferred >to those White House computers. For all sites, this constitutes a >significant increase over previous access by White House >computers. > > In light of this information, I have the following questions: > >(1) Does this constitute "casual browsing" by White House staff, or > is it, in light of the considerable time and effort spent during > regular business hours, part of a monitoring or intelligence operation? > >(2) For what purpose is the information transferred to the White House used? > >(3) Does the White House keep information from these web sites on file, > and does the White House keep a file on the persons responsible for > these web sites? > >(4) Is the April 9 statement by David Lytel of the White House Office of > Science and Technology to Amy Bauer of Copley News Service that the > administration does not monitor anti-Clinton activity on the web still > operative? > > > Thank you very much for your cooperation in this matter. > >Sincerely, > >Marvin Lee >The Washington Weekly > >Copyright (c) 1995 The Washington Weekly (http://www.federal.com) > > > Linda Thompson American Justice Federation Home of AEN News and "Waco, the Big Lie" "America Under Siege" 3850 S. Emerson Ave. Indianapolis, IN 46203 Telephone: (317) 780-5200 Fax: (317) 780-5209 Internet: lindat(a)iquest.net "When even one American -- who has done nothing wrong -- is forced by fear to shut his mind and close his mouth, then all Americans are in peril." Harry Truman

2 1

Re: [NOISE] Cable-TV-Piracy-Punks
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:36 PM 3/31/96, Mike Duvos wrote: >We aren't talking about IC masks here. We are talking about >electrostatic charges which would instantly leak away if the >insulation around them were in the least bit compromised. The surface layers above the active portion of a chip can be stripped away and chip remains functional. This includes the outer packaging layers (epoxy, or of course, ceramic with metal lids) and parts of the so-called "scratch protection," usually a type of silicate glass. The active capacitors are not affected by removal of these layers. >Such data wouldn't even survive the preparation for scanning >microscopy, much less the actual inspection process. Actually, we did it all the time in my lab at Intel, and I understand from my former co-workers that the technology has only gotten better. (This does not mean voltage contrast is easy. For one thing, modern chips have 3-5 metal layers, due to spectacular advances in chem-mechanical polishing, and each metal layer acts as a ground plane shielding the lower layers from visibility and inspection with electron beams. And EPROM and EEPROM cells are effectively impossible to analyze, for various reasons.) This does not mean I think reverse-engineering of smart cards or satellite boxes is easy. SQUIDs won't do it, either. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1