December 2003 - cypherpunks-legacy

House panel votes behind closed doors to build in Big Brother
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 11 Sep 1997 23:37:39 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: House panel votes behind closed doors to build in Big Brother Software that protects your privacy is a controlled substance that may no longer be sold, a Congressional committee decided today. Meeting behind closed doors this morning, the House Intelligence committee voted to replace a generally pro-encryption bill with an entirely rewritten draft that builds in Big Brother into all future encryption products. (The Senate appears to be moving in a similar direction.) The new SAFE bill -- titled in a wonderfully Orwellian manner the "Security and Freedom through Encryption" act even though it provides neither -- includes these provisions: SELLING CRYPTO: Selling unapproved encryption products (that do not include "immediate access to plaintext") becomes a federal crime, immediately after this bill becomes law. Five years in jail plus fines. Distributing, importing, or manufacturing such products after January 31, 2000 is another crime. NETWORK PROVIDERS: Anyone offering scrambled "network service" including encrypted web servers or even "ssh" would be required to build in a backdoor for the government by January 31, 2000. This backdoor must provide for "immediate decryption or access to plaintext of the data." TECHNICAL STANDARDS: The Attorney General will publish technical requirements for such backdoors in network service and encryption products, within five months after the president signs this bill. LEGAL TO USE CRYPTO: "After January 31, 2000, it shall not be unlawful to use any encryption product purchased or in use prior to such date." GOVERNMENT POWERS: If prosecutors think you may be selling, importing, or distributing non-backdoor'd crypto or are "about" to do so, they can sue. "Upon the filing of the complaint seeking injunctive relief by the Attorney General, the court shall automatically issue a temporary restraining order against the party being sued." Also, there are provisions for holding secret hearings, and "public disclosure of the proceedings shall be treated as contempt of court." You can request an advisory opinion from the government to see if the program you're about to publish violates the law. ACCESS TO PLAINTEXT: Courts can issue orders, ex parte, granting police access to your encrypted data. But all the government has to do to get one is to provide "a factual basis establishing the relevance of the plaintext" to an investigation. They don't have to demonstrate probable cause, which is currently required for a search warrant. More interestingly, this explicitly gives the FISA court jurisdiction (yes, the secret court that has never denied a request for a wiretap). If they decode your messages, they'll tell you within 90 days. GOVERNMENT PURCHASING: Federal government computer purchases must use a key escrow "immediate decryption" backdoor after 1998. Same with networks "purchased directly with Federal funds to provide the security service of data confidentially." Such products can be labeled "authorized for sale to U.S. government" ENCRYPTION EXPORTS: The Defense & Commerce departments will control exports of crypto. Software "without regard to strength" can be exported if it includes a key escrow backdoor and is first submitted to the government. Export decisions aren't subject to judicial review, and the "president may by executive order waive any provision of this act" if he thinks it's a threat to national security. Within 15 days, he must send a classified briefing to Congress. ADVISORY PANEL: Creates the Encryption Industry and Information Security Board, with seven members from Justice, State, FBI, CIA, White House, and six from the industry. INTERNATIONAL: The president can negotiate international agreements and perhaps punish noncompliant governments. Can you say "trade sancation?" (Other provisions barring the use of crypto in a crime and some forms of cryptanalysis are also in the bill.) Next the Commerce Committee will vote on SAFE, and a former FBI agent-turned-Congressman is vowing to ensure that similar language to this is included. (The committees are voting on the bill in parallel, and a four-person team of Congressmen is working to forge a compromise before Commerce votes.) Then the heads of the five committees that have rewritten the legislation will sit down and work out another compromise. If it's acceptable to the House Rules committee -- and if the FBI/NSA get what they want it will be -- the bill can move to the floor for a vote. That's why the encryption outlook in Congress is abysmal. Crypto-advocates have lost, and lost miserably. A month ago, the debate was about export controls. Now the battle is over how strict the //domestic// controls will be. It's sad, really, that so many millions of lobbyist-dollars were not only wasted, but used to advance legislation that has been morphed into a truly awful proposal. I wrote more about this at: http://cgi.pathfinder.com/netly/opinion/0,1042,1385,00.html -Declan

4 3

Re: The problem of playing politics with our constitutional rights
by Seth Finkelstein 17 Dec '03

17 Dec '03

> From: David H Dennis <david(a)amazing.com> > I must confess that I'm wondering what Seth Finkelstein, Pro-Government Warrior, I resent this part of the description, but let it pass. > able to jump over 50 Libertarians in a single bound, able to out-flame 5 or so Libertarians in a single thread is more accurate. > thinks of all this. Crypto restrictions are natural to oppose in a > Libertarian world, due to our fundamental distrust of government. > Where do they fit in a Liberal one? I'm *solidly* against such restrictions. Hey, if *Lizard* recommends me here, you've got to believe it :-). Here's a quick political lesson: Being a Liberal in the US means very roughly ONLY that one believes that the government has some role to play in moderating the excesses of the market. It does not particularly *make* you a civil-libertarian. However, because Liberals think about general social power and the abuse of it, they are very often led to the civil-libertarian view. In the opposite direction, sometimes they just want power themselves. It is with great regret that I must debunk the myth that being a Liberal makes you a saint (it only seems that way in comparison to everyone else around ... :-) ) It also helps that Liberals are *predominantly* drawn from ranks of those who are the targets of both public and private abuses. So they often both favor government action against business abuse, and strong civil-liberties guarantees to keep government power in check. It is *possible* to be a Conservative civil-libertarian, but this much lesser group, and has in the past decades very much been purged from the Republican party by the theocrats and hence from the national scene. The net result of this process: Not all Liberals are civil-libertarians, but civil-libertarian opposition will almost always come from Liberals (read this sentence several times until you understand it. I get so tired of people attacking the strawman that all Liberals are civil-libertarians, nyah, nyah, look at e.g. Dellums). Now, when you comprehend that, we go on to the next lesson: The Fundamental Problem in American politics is GET-A-MAJORITY. It is not "be a constitutional scholar", it is not "construct and defend the most rigorous argument for your position in terms of axiomatics from first principles", it isn't even "know what you're talking about". It is GET-A-MAJORITY. Old joke: After a campaign rally, a supporter told Adelai Stevenson "Mr. Stevenson, you've got every thinking man's vote!". He replied "That's not enough, I need a majority." Semi-digression: Business is "make a profit" - if you do that by throwing widows and orphans out into the street, it still works. What matters is how many dollars are made, not people affected. This is why Liberals view a population-based civil system as a necessary constraint on the imperatives of capital. Because ultimately we're people, not dollars. The goal of GET-A-MAJORITY is in great tension with intrinsically minority-rights, anti-majoritarian concepts such as civil-liberties. Any politician ignores this at great peril. Thus, Liberals who don't have to be elected can be a lot more vocal civil-liberties supporters than those who need to GET-A-MAJORITY. Thus even Liberal, civil-libertarian politicians may *vote against their principles* (do I hear gasps from the peanut gallery) because of electoral imperatives. Corollary 1: Detonating a nuclear device in DC will not solve this problem. The surviving government will just have a very good excuse for crypto-controls. Corollary 2: Repeated Libertarian rantings won't solve it either. Now, personally, you're probably not going to be seeing me on the crypto-barricades in the future. Is it because I'm a Big-Brother-loving government-worshipper? No, not at all. I was thinking today about what I could do on the issue. And I came to the conclusion that I'm basically so crippled and exhausted as a net.activist that I shouldn't do more (general statement, but set off by this particular topic). I can't stand a huge number of the people I'd have to work with, and I just don't have the patience and energy to keep pounding grains of understanding into them, it's like filling a sandbag with tweezers. But don't you dare assume support for crypto restrictions from that, it's rather coming to the point of being completely fed up with the drain of electronic activism on my life. ================ Seth Finkelstein sethf(a)mit.edu

3 2

Re: More on House Intelligence committee on crypto
by Mike Duvos 17 Dec '03

17 Dec '03

Declan McCullagh <declan(a)well.com> writes: > So I'm reading through the 43-page amendment to SAFE that > the House Intelligence committee approved today. It > includes: > * Ban on sale of crypto without a backdoor. Five year & > fine (maybe $250,000?) if violated. Prosecutions can be held > in closed-door courtrooms, publishers of info about case to > be held in contempt of court. [snip] Clearly the entire House Intelligence Committee should be "suitcased" immediately. -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

3 2

Pro-censorship lobbyist calls for AOL boycott
by Declan McCullagh 17 Dec '03

17 Dec '03

CHEYENNE, Wyo. (AP) - Marc Klaas, whose daughter Polly was abducted from her bedroom and killed in 1993, is calling for a boycott of American Online until it stops allowing access to a Florida woman who posts writing and art by serial killers on the Internet. Klaas particularly objects to the work of Keith Hunter Jesperson, who is serving three life sentences in Oregon for killings in the Northwest and is charged with one murder in Wyoming. "America Online is hiding behind freedom of speech in allowing this monster to have a public forum," said Klaas, who was in Wyoming this week to promote the Klaas Foundation for Children, which he established after his daughter's slaying. Officials for the nation's largest Internet access provider said Thursday that some material from the home page of Sondra London of Jacksonville, Fla., would be removed within 24 hours. "We find the information that is in this site and in some of the (associated AOL sites) offensive and objectionable and we did not wish to have our name associated with it," said AOL spokeswoman Tricia Primrose. London said she had removed from her home page one part of Jesperson's material - the "self-start serial killer kit" - on the urging of an AOL attorney who said he was investigating the site. In a letter to Wyoming Gov. Jim Geringer, AOL Senior Vice President and general counsel George Vradenburg III said the material was removed and that none of it was "authored, sponsored or condoned by AOL." "They missed the point," Geringer said. "They failed to acknowledge the remaining material, such as Jesperson referring to his victims as piles of garbage." Geringer, who has asked Oregon officials to extradite Jesperson to Wyoming so he can stand trial in a 1995 slaying, said he supports Klaas' call for a boycott. He also asked AOL on Thursday to remove the rest of Jerperson's material. He called London's Web page "a direct pipeline for his rantings and ravings and advocacy of serial killing." London has said she feels it is important to post such information to gain insight into how serial killers think. Polly Klaas' killer, Richard Allen Davis, is on death row in California. None of his work has appeared on London's Web page.

2 1

Re: in defense of Lon Horiuchi
by Zooko Journeyman 17 Dec '03

17 Dec '03

When I posted "in defense of Lon Horiuchi" I had intended not to follow up on the thread, but the several responses I've read (which were more reasoned and polite than I had expected-- thanks guys) indicate that I didn't explain myself clearly. It was not my intention to argue that Lon Horiuchi is a good guy, that he fulfilled his responsibilities with appropriate care, that he's a good shot, that he worked in an honorable profession, that he is blameless in the death of the child, or such. (I may or may not _believe_ some of these propositions, but I'll spare you for you the full littany of my opinions.) All I intended to assert was that Lon Horiuchi is almost certainly not the malicious baby-killing murderer that Anonymous portrayed. There are many issues one could legitimately argue regarding a policeman who accidentally kills a non-combatant bystander during a fight. But comparing such a policemen to a terrorist who deliberately targets non-combatants with a bomb is beyond the pale. That, but for my interruption, this comparison would have passed unremarked among the cypherpunks crowd is damning. Why I'm posting: I don't expect that merely because of my contradiction the more rabid cypherpunks will suddenly throw off their twin blinders of ideology and hatred. Neither do I desire that they retreat into closed conversation where they can continue their self-inflaming rants without fear of interruption. My motivation in posting critical articles like these is primarily because there are a great number of silent readers of the cpunks list, and some of these people, perhaps being young or inexperienced, may consider such vile slanders to be self-evident truths if they continually see them pass unchallenged. Regards, Zooko

5 4

Access to Plaintext: An Obvious Consequence
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: Somebody Date: Tue, 16 Sep 1997 10:12:47 -0400 (EDT) To: rah(a)shipwright.com Subject: Access to Plaintext: An Obvious Consequence Bob, If no encryption product can be sold that can't decrypt everything it encrypts, then no public key systems can come to market. That would effectively eliminate the entire range of encryption products of interest to you. Surely, this is clear? <Somebody's .sig> --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

`Random' seed.
by Richard Martin 17 Dec '03

17 Dec '03

Vaporware which I heard around CFP '95, and have been sort of wondering about ever since... Some one told me that some one else [possibly Matt Blaze] had been looking at how much randomness could be got by forking two child processes which would just run as asynchronous clocks: whenever the parent program needs a little `random' bit, it queries both and gives (clock(A) + clock(B) % 2) or something. Questions about this [to the list]: * who has done any [the?] work on this? * was it found to be useful/good or not? * what would be the drawbacks to adding this [Yet Another Source Of Entropy] to the Netscape scheme? frodo =) -- Richard Martin Alias|Wavefront - Toronto Office [Co-op Software Developer, Games Team] rmartin@aw.sgi.com/g4frodo@cdf.toronto.edu http://www.io.org/~samwise Trinity College UofT ChemPhysCompSci 9T7+PEY=9T8 Shad Valley Waterloo 1992

3 4

Re: Defense against a class of programming bugs
by Rich Salz 17 Dec '03

17 Dec '03

>Unfortunately, strdup is not posix compliant. If you want to use >it and maintain portability, you'll have to write your own. Er, you're kidding, right? drand48 isn't in Posix either, for example. Someone who runs on Motif and Mac has strdup as the least of their worries. But just in case it's stopping anyone: char *strdup(const char *x) { char *p; return (p = malloc(strlen(x) + 1)) ? strcpy(p, x) : 0; } (Deliberately written too-cleverly. Lame compilers will need to cast to 0)

1 0

real randomness for netscape - user clicking mouse
by Vincent Cate 17 Dec '03

17 Dec '03

Jeff Weinstein <jsw(a)neon.netscape.com> >If anyone has specific suggestions I would love to hear them so that we >can do a better job. Why not just do something similar to what PGP does? For netscape you could have a user make circling motions with the mouse and clicking at random times. For each click of the mouse you could get a few bits of randomness from the time, the X position, and the Y position. You could get random bits really fast this way. You only need to do this the first time a user uses encryption, or you might just go ahead and force all users to do this as part of starting up netscape the first time. On subsequent times you use your encryption algorithm to make your next seed. To be safe you could make up two seeds, encrypt each of them to mix them up a bit, and then XOR the results together. A random bit XORed with a non-random bit still produces a random bit. Actually there is probably a better way to just encrypt each input whole (padding to block size) and XORing as you go along - that way you would get whatever randomness was there to be had. Anyway, do something so you have as many or more bits of randomness in your seed as there are bits in your key or it will still be a weak link in your security chain. You could even get the randomness during regular mouse use. Unless the first thing a user did was try to use encryption I am sure you would have enough by the time he did use encryption (keep track). You must get the random bits from something that nobody else could watch. Network packets, process IDs, date, time, etc are not secure. On the other hand, an attacker would have to have broken the machine to get the mouse info used above, in which case netscape would have no security no matter what. -- Vince PS I want a free netscape server site license if you use this idea! :-)

5 5

John Deutsch
by Rev. Ben 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Is coming to Yale tomorrow and I'm going to get the opportunity to have tea with him(and about 10 other folks). Is there anyone here that has anything that they want me to ask the man? Ben. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed with Bryce's Auto-PGP v1.0beta3 iQB1AwUBMGYm+r5ALmeTVXAJAQFeIQL9FmuCB93W4XANBdyQBOg224WW/sVetRI8 AZhM3HHjvNJ41YT7LCnRjLeRU1nUeBX1cI5MWBLNmKQXqR8+XmqboVU/k3jOxndy bNhH4rqb/zgH1cD65lo7IbTsVOJoHeDe =18Lm -----END PGP SIGNATURE-----

1 0