December 2003 - cypherpunks-legacy

Re: The problem of playing politics with our constitutional rights
by Lizard 17 Dec '03

17 Dec '03

At 10:05 PM 9/11/97 -0700, James S. Tyre wrote: >So, the last rhetorical question -- how do you convince someone who's >never used a browser (the vast majority of the voting populace, I'd >think) why crypto is important? > "Excuse me, Mr. Man On The Street...would you give an IRS auditor the keys to your house, without him telling you if he would ever use them or if you were being audited?" "Of course not!" "How would you feel about the government requiring that when you buy a lock, you have to give a key to the IRS, and that they ought to be allowed to sneak into your house at will, without you even being notified you've been charged with a crime?" "That's absurd!" "Well, that's what they're trying to do now." "I'll write my Congressman or woman right now!" (Lizard is currently DLing the PGP plug-in for his beloved Eudora. Never let it be said I can't be a nonconformist like everybody else!) <SETH>And here we see more of the cult's recruitment. Note how he always talks about the *GOVERNMENT* and the *IRS*. Why doesn't he talk about Pepsi or GM wanting the keys to your house? More of this 'government bad, business good' propaganda we've all grown so sick and tired of, being shoved down our throats. Small wonder this list has gone to hell!" </SETH>

4 6

[fwd][news] Netscape meets gov't security standard
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

*** Netscape meets gov't security standard Netscape Communications Corporation announced Monday the National Institute of Standards and Technology and the Canadian Security Establishment validated the security code in Netscape Communicator client software and Netscape SuiteSpot server software as meeting Federal Information Processing Standards Publications 140-1, "Security Requirements For Cryptographic Modules." Netscape is the only Internet software vendor to comply with the FIPS 140-1 security standard, the company said. (PR Newswire) See full story at http://www.infobeat.com/stories/cgi/story.cgi?id=4840046-429 -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Web Objects 91 11 2233328 | - PERL Development 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - Networked Virtual Spaces

3 4

RE: Hiawatha Bray's column on key-recovery crypto
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:44 AM 9/11/97 -0400, Hiawatha Bray wrote: >What a cool idea! Why didn't I think of that? > >Hiawatha > >On Thursday, September 11, 1997 9:41 AM, Arnold G. Reinhold [SMTP:reinhold@worl > >> >> Hiawatha, I enjoyed your column (Boston Globe Business Section Sept. 11), >> but why don't you announce that you have a PGP key, print it's signature in >> a column and ask people to use it to send you news tips? This would enable >> a freedom of the press challange to GAK. Further, he could give pointers to Private Idaho, John Doe, etc., and encourage the use of anonymous tips to the newsmedia. Since I operate a cyberspace parking garage (the WinSock Remailer) and since the Lippo Administration is the most Nixonian since Tricky himself, I would think that the major media would be up-in-arms over threats to anonymous communication over the web. After all, which reporter-team doesn't want to be the next Woodward and Bernstein? I can understand (while not agreeing with...) my local rag's opposition to the second amendment, but the total apathy shown to dangers faced by the first is hard to fathom. I read the Herald pretty carefully, yet there has been NOTHING this week on the crypto-controversy. Nothing. While I often disagree with the Miami Herald's reporting decisions (both substance and emphasis) it is rare that I find it this scary. <sigh> JMR P.S. When *Seth* said, "(and wow, do they like to rant on every issue)" about Libertarians, my irony-meter broke its needle. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQEPAwUBNBh3ITUhsGSn1j2pAQF4BQfPZqEWo714dVrd0tQH+fk3jN2nzwUEtlGh wB6ggUbEJ1GX+LaGdEnWlM1xfFYvIB+ej/3PHumw7P3yIYYNt4XI480LVEEFxfWO nohAmIOe19+zt73wTZ1Oa9cNDYdOAbrMS5YW3BeyCY1i6nGkaCqXQteaoEJ4MxE1 V+jRIW9sJAdll4+ATw+xzQafl4K8uFk0soCcaupb05FeJVkLseiBxmLl1kBQwOpr 3Y6O8gO8v+ZmlaWsehlgciM47jkOpaAKNX+4b2mHx0+NrfQcfXNQWQ6JoNbx5NaO L35zof4Ds0bt+t3sIiQG7i7kR5Bbsul4vSfb6R14TtZ6Og== =HOEQ -----END PGP SIGNATURE-----

5 6

House Intelligence Committee Press Release
by Dave Del Torto 17 Dec '03

17 Dec '03

INTELLIGENCE COMMITTEE OFFERS ALTERNATIVE ENCRYPTION LEGISLATION TO ADDRESS SECURITY CONCERNS SEPTEMBER 11, 1997 CONTACT (202) 225-4121 The House Permanent Select Committee on Intelligence (HPSCI) today approved, by voice vote, legislation proposing an alternative to pending encryption legislation, known as the "Security and Freedom Through Encryption Act" (H.R. 695). The HPSCI amendment in the nature of a substitute to HR 695 proposes safeguards in the law to meet national security and law enforcement concerns in the debate over the future of United States Encryption policy. "All members of Congress, and particularly those of us on the Intelligence Committee, have a responsibility to find the proper balance between forward thinking commercial policies and the unquestioned need to protect the security of the American people and America's national interests. We are offering proposals to ensure that we do not plow full steam ahead into the 21st century's information age having seriously weakened our ability to protect the national security, " said HPSCI Chairman Porter J. Goss (Fl-14). "American citizens have a right to their privacy and their access to the freest possible markets. But they also have a right to their safety and security. Terrorist groups that plot to blow up buildings; drug cartels that seek to poison our children, and those who proliferate in deadly chemical and biological weapons are all formidable opponents of peace and security in the global society. These bad actors must know that the United States' law enforcement and national security agencies, working under the proper oversight, will have the tools to frustrate illegal and deadly activity and bring international criminals to justice," Goss said. "The bill referred to the Intelligence Committee attempts to deal with complex issues. The substitute adopted by the Committee addresses the legitimate national security and law enforcement concerns that are simply not addressed in H.R. 695. In that respect, the Committee substitute, in my judgment, furthers the debate on these important matters," noted Ranking Democrat Norm Dicks (WA-6). The main elements of the Intelligence Committee's proposal are: * Requires exports of encryption products to submit to a one-time review and to include features or functions (that need not be enabled by the manufacturer) allowing for immediate access to plaintext or to decryption information; * Requires that encryption products manufactured and distributed for sale or use, or import for sale or use, in the United States after January 31, 2000 include features or functions that provide, upon presentment of a court order, immediate access to plaintext data or decryption information from the encryption provider; * Does not change law enforcement's statutory requirements prior to intercepting oral, wire, or electronic (wireless) communications, or law enforcement's requirements prior to obtaining stored data. Law enforcement will specifically be required to obtain a separate court order to have data, including communications, decrypted; * Allows for law enforcement access with delayed notification requirements, similar to those allowed in current wiretap statutory provisions: * Provide civil remedies and criminal penalties for unlawful access to or disclosure of plaintext or decryption information; * Require US government procurement of encryption technology that includes functions or features allowing for immediate access to plaintext or decryption information. "Our committee has weighed in on these issues in the interest of furthering the important debate now underway about how best to accomplish the multiple goals of a sound encryption policy. Any encryption legislation we consider must take a balanced approach to the national security, law enforcement, public safety and privacy issues at stake. Our action today marks another step in this process, which no doubt will continue to unfold in the days and weeks ahead. I look forward to working with all sides on this debate as we tackle this complex but important issue," Goss said. The HPSCI, which sought and received sequential referral of H.R. 695, is one of five House committees with jurisdiction on this issue. The Committees on Judiciary, International Relations, National Security and Commerce have also considered this legislation. The HPSCI expects to file its committee report with the House tomorrow, meeting its deadline for action set by the Speaker. -30-

8 7

House panel votes behind closed doors to build in Big Brother
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 11 Sep 1997 23:37:39 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: House panel votes behind closed doors to build in Big Brother Software that protects your privacy is a controlled substance that may no longer be sold, a Congressional committee decided today. Meeting behind closed doors this morning, the House Intelligence committee voted to replace a generally pro-encryption bill with an entirely rewritten draft that builds in Big Brother into all future encryption products. (The Senate appears to be moving in a similar direction.) The new SAFE bill -- titled in a wonderfully Orwellian manner the "Security and Freedom through Encryption" act even though it provides neither -- includes these provisions: SELLING CRYPTO: Selling unapproved encryption products (that do not include "immediate access to plaintext") becomes a federal crime, immediately after this bill becomes law. Five years in jail plus fines. Distributing, importing, or manufacturing such products after January 31, 2000 is another crime. NETWORK PROVIDERS: Anyone offering scrambled "network service" including encrypted web servers or even "ssh" would be required to build in a backdoor for the government by January 31, 2000. This backdoor must provide for "immediate decryption or access to plaintext of the data." TECHNICAL STANDARDS: The Attorney General will publish technical requirements for such backdoors in network service and encryption products, within five months after the president signs this bill. LEGAL TO USE CRYPTO: "After January 31, 2000, it shall not be unlawful to use any encryption product purchased or in use prior to such date." GOVERNMENT POWERS: If prosecutors think you may be selling, importing, or distributing non-backdoor'd crypto or are "about" to do so, they can sue. "Upon the filing of the complaint seeking injunctive relief by the Attorney General, the court shall automatically issue a temporary restraining order against the party being sued." Also, there are provisions for holding secret hearings, and "public disclosure of the proceedings shall be treated as contempt of court." You can request an advisory opinion from the government to see if the program you're about to publish violates the law. ACCESS TO PLAINTEXT: Courts can issue orders, ex parte, granting police access to your encrypted data. But all the government has to do to get one is to provide "a factual basis establishing the relevance of the plaintext" to an investigation. They don't have to demonstrate probable cause, which is currently required for a search warrant. More interestingly, this explicitly gives the FISA court jurisdiction (yes, the secret court that has never denied a request for a wiretap). If they decode your messages, they'll tell you within 90 days. GOVERNMENT PURCHASING: Federal government computer purchases must use a key escrow "immediate decryption" backdoor after 1998. Same with networks "purchased directly with Federal funds to provide the security service of data confidentially." Such products can be labeled "authorized for sale to U.S. government" ENCRYPTION EXPORTS: The Defense & Commerce departments will control exports of crypto. Software "without regard to strength" can be exported if it includes a key escrow backdoor and is first submitted to the government. Export decisions aren't subject to judicial review, and the "president may by executive order waive any provision of this act" if he thinks it's a threat to national security. Within 15 days, he must send a classified briefing to Congress. ADVISORY PANEL: Creates the Encryption Industry and Information Security Board, with seven members from Justice, State, FBI, CIA, White House, and six from the industry. INTERNATIONAL: The president can negotiate international agreements and perhaps punish noncompliant governments. Can you say "trade sancation?" (Other provisions barring the use of crypto in a crime and some forms of cryptanalysis are also in the bill.) Next the Commerce Committee will vote on SAFE, and a former FBI agent-turned-Congressman is vowing to ensure that similar language to this is included. (The committees are voting on the bill in parallel, and a four-person team of Congressmen is working to forge a compromise before Commerce votes.) Then the heads of the five committees that have rewritten the legislation will sit down and work out another compromise. If it's acceptable to the House Rules committee -- and if the FBI/NSA get what they want it will be -- the bill can move to the floor for a vote. That's why the encryption outlook in Congress is abysmal. Crypto-advocates have lost, and lost miserably. A month ago, the debate was about export controls. Now the battle is over how strict the //domestic// controls will be. It's sad, really, that so many millions of lobbyist-dollars were not only wasted, but used to advance legislation that has been morphed into a truly awful proposal. I wrote more about this at: http://cgi.pathfinder.com/netly/opinion/0,1042,1385,00.html -Declan

4 3

Re: The problem of playing politics with our constitutional rights
by Seth Finkelstein 17 Dec '03

17 Dec '03

> From: David H Dennis <david(a)amazing.com> > I must confess that I'm wondering what Seth Finkelstein, Pro-Government Warrior, I resent this part of the description, but let it pass. > able to jump over 50 Libertarians in a single bound, able to out-flame 5 or so Libertarians in a single thread is more accurate. > thinks of all this. Crypto restrictions are natural to oppose in a > Libertarian world, due to our fundamental distrust of government. > Where do they fit in a Liberal one? I'm *solidly* against such restrictions. Hey, if *Lizard* recommends me here, you've got to believe it :-). Here's a quick political lesson: Being a Liberal in the US means very roughly ONLY that one believes that the government has some role to play in moderating the excesses of the market. It does not particularly *make* you a civil-libertarian. However, because Liberals think about general social power and the abuse of it, they are very often led to the civil-libertarian view. In the opposite direction, sometimes they just want power themselves. It is with great regret that I must debunk the myth that being a Liberal makes you a saint (it only seems that way in comparison to everyone else around ... :-) ) It also helps that Liberals are *predominantly* drawn from ranks of those who are the targets of both public and private abuses. So they often both favor government action against business abuse, and strong civil-liberties guarantees to keep government power in check. It is *possible* to be a Conservative civil-libertarian, but this much lesser group, and has in the past decades very much been purged from the Republican party by the theocrats and hence from the national scene. The net result of this process: Not all Liberals are civil-libertarians, but civil-libertarian opposition will almost always come from Liberals (read this sentence several times until you understand it. I get so tired of people attacking the strawman that all Liberals are civil-libertarians, nyah, nyah, look at e.g. Dellums). Now, when you comprehend that, we go on to the next lesson: The Fundamental Problem in American politics is GET-A-MAJORITY. It is not "be a constitutional scholar", it is not "construct and defend the most rigorous argument for your position in terms of axiomatics from first principles", it isn't even "know what you're talking about". It is GET-A-MAJORITY. Old joke: After a campaign rally, a supporter told Adelai Stevenson "Mr. Stevenson, you've got every thinking man's vote!". He replied "That's not enough, I need a majority." Semi-digression: Business is "make a profit" - if you do that by throwing widows and orphans out into the street, it still works. What matters is how many dollars are made, not people affected. This is why Liberals view a population-based civil system as a necessary constraint on the imperatives of capital. Because ultimately we're people, not dollars. The goal of GET-A-MAJORITY is in great tension with intrinsically minority-rights, anti-majoritarian concepts such as civil-liberties. Any politician ignores this at great peril. Thus, Liberals who don't have to be elected can be a lot more vocal civil-liberties supporters than those who need to GET-A-MAJORITY. Thus even Liberal, civil-libertarian politicians may *vote against their principles* (do I hear gasps from the peanut gallery) because of electoral imperatives. Corollary 1: Detonating a nuclear device in DC will not solve this problem. The surviving government will just have a very good excuse for crypto-controls. Corollary 2: Repeated Libertarian rantings won't solve it either. Now, personally, you're probably not going to be seeing me on the crypto-barricades in the future. Is it because I'm a Big-Brother-loving government-worshipper? No, not at all. I was thinking today about what I could do on the issue. And I came to the conclusion that I'm basically so crippled and exhausted as a net.activist that I shouldn't do more (general statement, but set off by this particular topic). I can't stand a huge number of the people I'd have to work with, and I just don't have the patience and energy to keep pounding grains of understanding into them, it's like filling a sandbag with tweezers. But don't you dare assume support for crypto restrictions from that, it's rather coming to the point of being completely fed up with the drain of electronic activism on my life. ================ Seth Finkelstein sethf(a)mit.edu

3 2

Re: More on House Intelligence committee on crypto
by Mike Duvos 17 Dec '03

17 Dec '03

Declan McCullagh <declan(a)well.com> writes: > So I'm reading through the 43-page amendment to SAFE that > the House Intelligence committee approved today. It > includes: > * Ban on sale of crypto without a backdoor. Five year & > fine (maybe $250,000?) if violated. Prosecutions can be held > in closed-door courtrooms, publishers of info about case to > be held in contempt of court. [snip] Clearly the entire House Intelligence Committee should be "suitcased" immediately. -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

3 2

Pro-censorship lobbyist calls for AOL boycott
by Declan McCullagh 17 Dec '03

17 Dec '03

CHEYENNE, Wyo. (AP) - Marc Klaas, whose daughter Polly was abducted from her bedroom and killed in 1993, is calling for a boycott of American Online until it stops allowing access to a Florida woman who posts writing and art by serial killers on the Internet. Klaas particularly objects to the work of Keith Hunter Jesperson, who is serving three life sentences in Oregon for killings in the Northwest and is charged with one murder in Wyoming. "America Online is hiding behind freedom of speech in allowing this monster to have a public forum," said Klaas, who was in Wyoming this week to promote the Klaas Foundation for Children, which he established after his daughter's slaying. Officials for the nation's largest Internet access provider said Thursday that some material from the home page of Sondra London of Jacksonville, Fla., would be removed within 24 hours. "We find the information that is in this site and in some of the (associated AOL sites) offensive and objectionable and we did not wish to have our name associated with it," said AOL spokeswoman Tricia Primrose. London said she had removed from her home page one part of Jesperson's material - the "self-start serial killer kit" - on the urging of an AOL attorney who said he was investigating the site. In a letter to Wyoming Gov. Jim Geringer, AOL Senior Vice President and general counsel George Vradenburg III said the material was removed and that none of it was "authored, sponsored or condoned by AOL." "They missed the point," Geringer said. "They failed to acknowledge the remaining material, such as Jesperson referring to his victims as piles of garbage." Geringer, who has asked Oregon officials to extradite Jesperson to Wyoming so he can stand trial in a 1995 slaying, said he supports Klaas' call for a boycott. He also asked AOL on Thursday to remove the rest of Jerperson's material. He called London's Web page "a direct pipeline for his rantings and ravings and advocacy of serial killing." London has said she feels it is important to post such information to gain insight into how serial killers think. Polly Klaas' killer, Richard Allen Davis, is on death row in California. None of his work has appeared on London's Web page.

2 1

Re: in defense of Lon Horiuchi
by Zooko Journeyman 17 Dec '03

17 Dec '03

When I posted "in defense of Lon Horiuchi" I had intended not to follow up on the thread, but the several responses I've read (which were more reasoned and polite than I had expected-- thanks guys) indicate that I didn't explain myself clearly. It was not my intention to argue that Lon Horiuchi is a good guy, that he fulfilled his responsibilities with appropriate care, that he's a good shot, that he worked in an honorable profession, that he is blameless in the death of the child, or such. (I may or may not _believe_ some of these propositions, but I'll spare you for you the full littany of my opinions.) All I intended to assert was that Lon Horiuchi is almost certainly not the malicious baby-killing murderer that Anonymous portrayed. There are many issues one could legitimately argue regarding a policeman who accidentally kills a non-combatant bystander during a fight. But comparing such a policemen to a terrorist who deliberately targets non-combatants with a bomb is beyond the pale. That, but for my interruption, this comparison would have passed unremarked among the cypherpunks crowd is damning. Why I'm posting: I don't expect that merely because of my contradiction the more rabid cypherpunks will suddenly throw off their twin blinders of ideology and hatred. Neither do I desire that they retreat into closed conversation where they can continue their self-inflaming rants without fear of interruption. My motivation in posting critical articles like these is primarily because there are a great number of silent readers of the cpunks list, and some of these people, perhaps being young or inexperienced, may consider such vile slanders to be self-evident truths if they continually see them pass unchallenged. Regards, Zooko

5 4

Re: netscape bug
by David_A Wagner 17 Dec '03

17 Dec '03

In article <199509201855.LAA17261(a)netcom16.netcom.com> you write: > > none of the articles mention that the cracker must have login access > to the computer that the random numbers are generated on. is this true? > does the code require knowledge of the PID etc. that can only be obtained > by a login to the system that the netscape session is running on? > No, the time, pid, and ppid often leak to a remote adversary too. The attack probably requires a bit more sophistication when the cracker doesn't have login access, but I believe it's still possible. See my recent post to sci.crypt for some comments from Ian & I about this.

1 0