December 2003 - cypherpunks-legacy

ICE Summary
by cmckie＠ccs.carleton.ca 17 Dec '03

17 Dec '03

Summary of the the 2nd International Cryptogrpahy Experiment (ICE) Workshop, Shape Technical Centre, The Hague, Sept.18-19, 1995 http://www.tis.com/crypto/ice/summary.html

1 0

PGMedia Challenges U.S. Government's Claim To Control Of The Domain Name System
by pgp＠pgmedia.net 17 Dec '03

17 Dec '03

Press Release September 18, 1997 PGMedia Challenges U.S. Government's Claim To Control Of The Domain Name System NEW YORK, NEW YORK: PGMedia, Inc. d/b/a name.space(tm), the New York-based company which sued Network Solutions, Inc. ("NSI") (the holder of the monopoly in commercial Internet Domain Name Registrations) for violations of U.S. antitrust laws in March of this year, has amended its Complaint in that case to join the National Science Foundation ("NSF") as a party-defendant. While PGMedia steadfastly believes that the National Science Foundation has no authority to restrict or forestall the complete opening of the Domain Name Registration market which PGMedia seeks in its case against NSI, over the last three months, the NSF has injected itself into the Domain Name dispute by claiming (on behalf of the U.S. Government) to exclusively control the Domain Name System. The NSF has exerted this control to prevent NSI from acquiescing in PGMedia's demand for access to the market. Again, PGMedia believes that the NSF possesses no such control or authority, but even if it did, such actions have the clear effect of limiting freedom of expression in the first and foremost avenue of speech on the Internet -- the Domain Name. Thus, either the NSF has no authority, and NSI should be allowed to comply with Federal and state antitrust law in settling with PGMedia, or the NSF must, pursuant to the First Amendment to the U.S. Constitution, acquiesce in PGMedia's demand to unlimited and shared Top Level Domain Names. The name.space(tm) Service PGMedia's name.space(tm) service(http://namespace.pgmedia.net) was launched in August 1996 to offer Internet Domain Name Registration Services in competition with NSI under virtually unlimited Top Level Domain names. That is to say, while NSI has forced Internet users to register their names under .com, .net and .org, name.space(tm) offers the full range of expression, in virtually any language, in the top level namespace. In addition, and significantly, name.space(tm) claims no exclusivity with respect to the right to register under any TLD. Indeed, PGMedia has developed software and code to allow multiple registries to register names under the same TLD. Unfortunately, until NSI changes the so-called "root zone file" (or directory of directories) which resides on its root name servers, the name.space(tm) top level domain names will not be universally resolvable on the Internet. Until NSI makes that change, only users who have visited the name.space(tm) web page and downloaded the self-executing application which points their browser to the name.space(tm) servers first can use a name.space(tm) domain name. PGMedia sues Network Solutions to Open the Domain Name Market In March 1997, after NSI refused PGMedia's request that reference to the name.space(tm) name servers be added to the root zone file, PGMedia sued NSI in Federal District Court in the Southern District of New York seeking, among other things, to compel NSI to add the name.space(tm) TLDs and nameservers to the root zone file. Initially, NSI refused, claiming that Dr. Jon Postel, of the so-called Internet Assigned Numbers Authority ("IANA"), was the only person who could add a TLD to the root zone file. However, after several discussions with PGMedia and its counsel, NSI proposed allowing unlimited TLDs, but only if the National Science Foundation had no objection. PGMedia has consistently contended that the NSF has no more of a place in this debate than any other interested party, and could not act to arbitrarily limit speech in the top level name space even if it did. In June and again in August of this year, the NSF informed NSI that the NSF controlled the root zone file, and that the NSF could not allow NSI to comply with Federal and state antitrust laws in granting PGMedia's reasonable request. With today's addition of the National Science Foundation to the case, the issue of who ultimately controls the Global Internet is squarely before a Court of competent jurisdiction. In addition, the arbitrary restriction by the U.S. Government of freedom of expression in the top level name space may soon finally come to an end. For more information, contact: law(a)pgmedia.net Or call (212) 677-4080

1 0

using pgp to make an otp
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- -----BEGIN PGP SIGNED MESSAGE----- greetings c-punks, i may have posted this at some time in the past, as i have asked it elsewhere and gotten different responses. i'm interested in that the folx here think about it though, so here it is... i want a source of data for use as a otp. i don't want to have to hook up any external devices to my pc to do it. (although some of the methods mentioned in the past few days are quite interesting.) i'd like to know if there was a reason not to use the output of pgp to do it. i've been playing with the following method. i take a file and encrypt it to a key with the '-a' flag on. this generates an ascii file that is easily editable using simple, standard rexx calls. i strip the first 20 or so lines and the last 20 or so lines and put the resulting file aside. then i perform the same operation again and append the file to the previous result. i repeat until the file is sufficiently large for my purposes and then give the resulting file to the person(s) i want to have it. i still need a program to make use of the otp i've produced, but havent gotten that far as this is still pretty much a thought experiment and something for me to waste time with. once i'm ready to make use of it i'll either find a program or attempt to write something to use to make the data i've generated useful. i would think that the output of pgp should be pretty darn random. if it isn't, then it's usefulness is less than its reputation imo. as you can tell if you've read this far, i'm not a cryptographer. i just like the stuff and am working to become more proficient in its use as i think it is important if we are to maintain our privacy in an increasingly digital world. what are the holes in this? why would it be unadvisable to do it? otoh, would it be a good basis for a otp? amp <0003701548(a)mcimail.com> <alan.pugh(a)internetmci.com> PGP Key = 4A2683C1 November 5, 1995 1:16 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMJxWxigP1O9KJoPBAQFzxggAmRyJlfZVt8s6shqkkvFxmSpJdyZvaSEw O/hQEb5fJK4FuxZaIyw2Enp4Ca1/vGeEaw1Zc8JM2wSk2Km4Vjl7zlJjmIpOJ6Nw QAJfpHwwz77NMpMiWLj/m9nwkBeQs3IPcgDywIBu2Hfw6o79bndUS+GbEoG0f/+L jH7y0bZ+pNX/fLYaPZRnPPGVDqPn7VkfuvByT5Op5rNbHU56kSneW3bC79M1SO3K sYXpdGYU6mWC5xbYq1eQI9sCpkdB4pftMC3cizvKdueXGTMnXbngwBnu+Hk7GONz KOx9x6rWPJ/NBTJONiz4Scg28XelnziBP5OYXSWzBNFBoauZpcK0MQ== =8lYe -----END PGP SIGNATURE-----

5 5

Re: alt.anonymous.messages considered harmful
by loki＠obscura.com 17 Dec '03

17 Dec '03

I will feed alt.anonymous.messages to ANYONE who asks. I will accept a feed of that one group from any news server which is used by a remailer. -Lance At 1:13 PM 11/2/95, Futplex wrote: >Name Withheld by Request writes: >[re: problems with the Usenet newsgroup model of pseud/anonymous message pools] >> Denial of service attacks could be made somewhat less feasible by >> making the pool accessible as a mailing list and via http. > >Mailing lists of course suffer the problem of strictly limited participation. >The web approach might work better, in some future with better privacy- >protecting infrastructure in place. Specifically, if HTTP transactions with >a popular web server were routinely encrypted, then all reasonably long >visits to that site would act as cover traffic for a message pool on that >server. As a bonus, you could have a spiffy form on the web page that >searches the pool for you. > >In any event, the server could log your exploration. This returns us to the >issue of strongly anonymous web proxies. (And we could imagine >countermeasures, like daemons that search for randomly selected pseudonym tags >to muddy the waters. As Tim might say, lots of issues.) > >Also, the mention of "as a mailing list _and_ via http" is significant. Making >the pool available in multiple forms seems to be an unconditional benefit. > >-Futplex <futplex(a)pseudonym.com> ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: The great GAK crack (making GAK economically impossible)
by geeman＠best.com 17 Dec '03

17 Dec '03

This seems to ignore a possible worst-case scenario, in which the only products which are ultimately approved wrap the key using a special law enforcement key, for example. If the Powers that be can mandate "escrow" --- really GAP, Gov't Access to Plaintext --- then it can be mandated to take a particular form that is defined to be tractable. At 05:25 PM 9/15/97 -0700, Tim May wrote: > >At 8:41 AM -0700 9/15/97, nospam-seesignature(a)ceddec.com wrote: >>If I have to GAK my keys, and there then exists a pgp-gak, then we simply >>recruit the same CPU power that generated the millions of DES keys to just >>run pgpk-gak with the shortest keylength and send billions of keys to the >>GAKserver each week. Many from out of the US if pgp-gak becomes available >>there. >> >>My test software uses a loop that generates a new pair every few seconds >>on a pentium (and found some very obscure bugs). I would be required to >>send all those to the gak.gov. If they really want them... >> >>What it probably means is the govenrment will issue keys or have to >>license people to create them. > >"There ain't no such thing as free escrow." > >Some fee will be collected to register keys. "To defray costs" (never mind >that the government is the party _requiring_ the damned escrow!). > >This will stop the "flooding attacks" which a free key escrow system would >generate. It will also, sadly for us, put an end to many applications where >keys are generated quickly, transiently, and on an ad hoc basis. There >simply will be no time to register the keys, and the $10 (or whatever) >processing fee will be unacceptable for these applications. > >--Tim May > >There's something wrong when I'm a felon under an increasing number of laws. >Only one response to the key grabbers is warranted: "Death to Tyrants!" >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Higher Power: 2^1398269 | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." > > > > > >

2 1

[political NON-noise] Re: Crypto & Taxes
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:03 AM 11/4/95, s1113645(a)tesla.cc.uottawa.ca wrote: >Not that I want to get into a big political discussion, but David Friedman >has a nice, calm and rational book called The Machinery of Freedom, 2nd ed, >which argues anarchism/libertarianism from an economist'spoint of view. >The argument is not cased in terms of ethics and morals but rather >economic efficiency and utility. Slim, easy to read and cheap. He also >has a good sense of humor. Unfortunately the book is currently on back order. >I'm holding on to my library copy until they ship one to me. David Friedman is now teaching law at Santa Clara University, over in Silicon Valley. We've been in contact, and expect to meet for dinner sometime soon. (He attended a special Cypherpunks meeting a few years ago.) >You can butt heads with him and Tim on the cyberia list (I don't remember >the address but they have it at news://nntp.hks.net ) Ah, but the Cyberia list is a _law_ list, and political discussion is discouraged. >I gather from the cyphernomicon that someone recently converted him to >cryptoanarchy. His "Machinery of Freedom" and many other articles clearly establishes him as a leader in this area. He didn't previously know a lot about strong crypto, but now he sees that this makes many of the abstract ideas of "Machinery" near at hand. Vernor Vinge believes the same thing. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Many Topics are Appropriate for Discussion Here
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:35 PM 11/3/95, hallam(a)w3.org wrote: > Just a calibration point. The libertarians on the list do not seem >to shrink from expressing their political views. Indeed the entire discussion >on the NSA is a political thread pure and simple. My post related directly >to the question of personal privacy rights in a democratic, plural society. >I do not regard that it was off topic in any sense. I was not aware that >any agreement was in effect as to the method by which goals might be >achieved. I chose to persue goals by the means most likely to succeed. In >that I am a pragmatist. Government regulation often provides social benefits >it is not by definition an evil to be avoided. In any case regardless of the >rhetoric government regulation increases, I prefer to press for some >regulations I like rather than dream about there being none whatsoever. I for one have no problem with left-leaning (that is, nonlibertarian :-}) folks expressing views. That libertarians tend to be the most vocal and perhaps most articulate advocates of strong crypto is only a trend: I know of several left-leaning folks who strongly push crypto. We happen to disagree on some points, but agree on others. On this list, Dave Mandl and Rich Dutcher (probably no longer subscribed) have represented somewhat leftist views. The late John Brunner was a particular favorite of mine, whose "Stand on Zanzibar" was an utter masterpiece, and whose "The Shockwave Rider" was of course a major influence on many cyberspace privacy advocates. And yet he called himself a leftist and was strongly opposed to the corporate state. As I am, by the way. Much of the power of very large corporations comes from the power of the State enforcing certain franchises and monopolies granted to them. (Intellectual property laws are largely such franchises---if one doubts this, imagine a return to the era of the guilds, where the silversmith's guild could physically block other people from smithing silver, and so on for all of the guilds. Modern intellectual property law works mostly the same way, giving to Apple or Sun or Intel the control a "truly free" market certainly would not.) > I do not separate the question of politics from technology. My >reasons for working on the Web have from the start been explicity political. >I regard the persuit of technology without consideration of the political >consequences to be unethical. I agree. And though I have been called an "ethical monster" for pushing my agenda for crypto anarchy, I agree that one must always consider ethics and politics in technological matters. (I suspect we disagree about many conclusions of this view, however.) > I am only in a position to influence the political process if I >understand the position of the administration and can demonstrate an >appreciation of their concerns. As Sun Tsu said "you must build a golden >path along which your enemies may retreat". The problem with government >is not that it is a conspiracy, it is an interlocking series of >beuraucracies which all seek to avoid responsibility. I view governments as just another example of an organism or system which perpetuates itself. It's in the genes. Evolutionary game theory, etc. > If you want to get Phil Z. off the hook or foul up the governments >escrow scheme plans you have tobe prepared to step into their mindset >and walk about on the inside a bit. somewhere inside the government there is >a jobsworth who is deciding to hassle Phil Z., this person will be a civil >servant, not a political appointee. Ie the dregs which get left behind each >time there is a new administration. What we need to do is to identify that >person and nail their ass to the wall. It has to become apparent to the >administration that that individual has created an unnecessary source of >embarassment. This I think we have been already been doing a pretty good job at. I have been on panel discussions with Stewart Baker, former chief counsel of the NSA (and now with Steptoe, a D.C. law firm, and still active in pushing crypto legislation), and Ron Lee, the current chief counsel. And I spotted Dorothy Denning's deep involvement several years ago. Ditto for key escrow. And of course John Gilmore, Phil Karn, and others have been very active in "nailing their asses to the wall," so to speak. > If somone makes contiuous political spiels themselves but object when >I make one they disagree with (as one person has done) I am not going to take >their objection as indicating anything other than an inability to argue their >case. As this post should make clear, I certainly don't object. I doubt I'll have any energy to argue things I argued for the first time almost 30 years ago, but I'm very interested in the nuts and bolts of how strong crypto will affect institutions and policies. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Sources of randomness
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:04 AM 11/4/95, Peter Monta wrote: >Perhaps there ought to be a couple of standard random-bit-source >implementations, say at the CMOS-standard-cell and board-subsystem >levels, that are widely vetted and trusted (and used!). But it's >mostly a solved problem, seems to me. This is something John Gilmore called for when he wrote: At 9:50 PM 9/20/95, John Gilmore wrote: >Software-generated random numbers are likely to be of poor quality. >There just isn't that much true randomness visible to computers. >Several ways to build good hardware random number generators are >known. But before hardware random number generators can be >incorporated into common desktop computers, someone will have to put >them into a small fraction of a chip. > >Currently, random number generators are chips or larger circuits. >Nobody will pay to put these on a motherboard. But if a random number >generating circuit occupied 1/1000th of a CPU chip or "multi-function >I/O" chip, cost would not be a reason to leave it out. > >You probably can't build a hardware random number generator out of >existing "gate array" gates or "standard cell" cells, because all the >existing gates and cells are designed to behave completely >predictably! It will take designing a new circuit structure. > >Do we know any solid state physics / circuit design experts who think >this might be a fun thing to do? I bet you could get a paper out of >it. And probably improve the world a few years later, when companies >used your paper to close another hole in their computer security. > > John There were several other posts in this thread, so interested folks might want to check the archives for this time period. Continuing on with Peter Monta's post: >A radioactive source might be okay at the board level (though probably >costlier than its electronic counterpart), but it'd be a pain to >integrate, and it might disturb the rest of the chip. (I'd like to >have a get_random_bit instruction as part of a microprocessor, for >example.) Also if you want a high rate of random bits, you need many >decay events, whereas for electronic sources the corresponding >bandwidth is free---Johnson and shot noise are flat to 1 THz or so. I agree, for several reasons. First, I agree that electronic noise sources are easy to build, easy to get licenses for use (basically, no licenses, unless the ITAR boys decide random number generators are munitions--maybe the "This t-shirt is a munition" could have "export-controlled dice"? Second, the ease of integration as a standard library module. However, getting the chip companies to do this will not be easy. They generally don't see the need (hey, even _we_ don't, given the diverse opinions on what is needed). This is why many of us favor an external dongle that plugs in somewhere. Then it could be sold cheaply and not have to get "buy-ins" from industry and committees. One idea is something that superficially looks like a modem, as everyone has modem software and ports (though I suppose many people use internal modems and so can't easily access it.) One would attach the "RNG-modem," a little dongle, and grab noise into a buffer for processing (hashing, filtering, etc.), or as ASCII garbage. (Before anyone jokingly asks about "1-800-RANDOMS," I've thought of it. Not practical, for obvious reasons.) A purer approach would be just a noise source dumped into dev/random, or whatever one wishes to call it. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: alt.anonymous.messages considered harmful
by futplex＠pseudonym.com 17 Dec '03

17 Dec '03

> >Specifically, if HTTP transactions with > >a popular web server were routinely encrypted, then all reasonably long > >visits to that site would act as cover traffic for a message pool on that > >server. > > Qua? The "length" of the visit is just the time to download a document. > Leaving a page in the browser window doesn't generate traffic... You're absolutely right. I wasn't thinking sensibly about HTTP. I wanted to make an argument about the time it would take to search the pool and serve a results page. But upon reflection, I don't think that even holds up under my HTTP delusions of yesterday, let alone a realistic view. Please ignore the "reasonably long" part of my previous statement. Thanks for pointing that out. -Futplex <futplex(a)pseudonym.com>

1 0

Re: FBI Wants to Wiretap One of Every 100 Phones in Urban Areas
by clarkm＠cnct.com 17 Dec '03

17 Dec '03

Thanks for this item! Two little excerpts jump out at me. They follow: > Last year, federal and state courts authorized 1,154 wiretaps, of which 48 > percent [snip] > "People are starting to say that seems awfully high," Dempsey said, noting > that > the overall level of such surveillance activity is now a total of 20,000 > to 25,000 > intercepts nationwide over an entire year. So what is it? 1,154 wiretaps? Or 20,000? FBI Director Louis Freeh testified under oath to 1,157. The FBI was asked for the data to support those numbers. The FBI refused to release them until the year 2002. The FBI is being sued under FOIA to support Freeh's sworn testimony. (Of course, he used different numbers at different times....) One last thing. What's so special about the year 2002? .---. .----------- * :::::::::::::::::::::::::::: / \ __ / ------ * clark.matthews(a)paranet.org / / \(..)/ ----- * :::::::::::::::::::::::::::: ////// ' \/ ` ---- * //// / // : : --- * PERMISSION TO \\/ / * / /` '--* COPY / REPOST \*/ * //..\\ x-x-UU----UUx-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x '//||\\` N E M O..M E..I M P U N E..L A C E S S I T x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x-x

4 3