December 2003 - cypherpunks-legacy

Re: I want to learn!
by Travis Corcoran 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Message-Signature-Date: Wed Oct 18 12:55:39 1995 In article <199510181437.HAA00477(a)jobe.shell.portal.com> anonymous-remailer(a)shell.portal.com writes: > Date: Wed, 18 Oct 1995 07:37:30 -0700 > > >>From: VINCENT810(a)aol.com > >>Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs. > > Me Too, I'm catching on but some help would help ! > > Leo_Martensen_at_~~HEID-DHS(a)ccmail.odedodea.edu > > Okay, places to start. > > Go to the cypherpunks ftp site ftp.csua.berkeley.edu/pub/cypherpunks > and look around. TCMay's "Cyphernomicon" FAQ is a must, although > it's really really big. It's been Weblinked somewhere, but I > fail to recall. relevant sites: Home: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/Home.html Archives: http://www.hks.net/cpunks/index.html Cyphernomnicon: http://www.oberlin.edu/~brchkind/cyphernomicon/ -----BEGIN PGP SIGNATURE----- Version: 2.6 Comment: Auto-signed by mail-secure.el 1.006 using mailcrypt Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMIUxjIJYfGX+MQb5AQGURQP/dLUUkrY8H5cHhP5T4K58R0u5yjpN8qWa 9eX64STHz+MEl7favlTWiGXcAZdI0lV6Z9UMdt1FWfo30DrJne1TK8Zm3e/BIzUQ Vglxr7LbV4GckXIiM6zKXNIOlTipKTq6QLjLzS7n4Al2ElC8F1pPkAZNLUsrn4n5 95sbh0Cv2xg= =5EjT -----END PGP SIGNATURE-----

1 0

Re: YOUR chat with Goeff Greiveldinger
by Willis H. Ware 17 Dec '03

17 Dec '03

-- Folder: YES -- Michael: Your message was forwarded to me and I presume to address this mail list although I would normally not. If you still have time for adjustments to your talk, let me call your attention to what I believe to be an awkward semantic ambiguity in the current dialogue about encryption. I quizzed a few people about usage of "escrow" and "key escrow" so I have some confidence that the following facts and argument are valid. The term "escrow", in the context of cryptography, was introduced by the so-called Clipper Initiative in the United States, April 1993. It had not previously been associated with cryptography. As initially used in association with Clipper, escrow implies [1] a chip-unique key (equivalent to a chip-unique master-key) used only for law enforcement access, [2] splitting of the chip key into parts held by [3] extra-organization trusted third parties, [4] automatic inclusion of the chip key with every use of the encryption but [5] protected with yet another secret key embedded in the encryption chip which is itself [6] protected against reverse engineering or external access to its details. The concept, at the time of its introduction, was oriented solely to communications intercept and hence, [7] a "law enforcement access field" would be a required part of every transmission. The LEAF contains chip identity which in turn allows law enforcement to solicit components of the master key from escrow agents, then to recover the session key and eventually the encrypted traffic. NOTE first that this use of the word violates the common legal usage in which the parties who deposit material with an "escrow agent" themselves have access to it at some point. In the Clipper use, the parties obviously do not have access to what the escrow agencies hold. Subsequently the concept of mimicing the hardware-based Clipper approach in software arose, and the term "commercial key escrow" was applied to it. Some of the details are the same as Clipper; in particular, something is to be held by trusted third parties which, in some proposals, are called Data Recovery Centers. Some proposals plan to replicate Clipper by depositing split master keys with trusted third parties; law enforcement with proper authorization can acquire the parts of the master key, deduce the actual key used for a given transmission (i.e., the session key) and so decrypt the traffic. Other proposals depart from Clipper and plan to store split (or not) actual session keys with the trusted agents. NOTE that the observation above that using escrow in the context of encryption by Clipper violates legal usage is generally invalid for commercial key escrow. The party which deposits keys with a Data Recovery Center obviously can access to them. Inevitably, the concept was extended further to include the possibility that corporations could retain the keys internally in a specially trusted part of the organization. Legal entities, such as corporations, would be subject to extant procedures of the law enforcement court order or subpoenas to provide the keys under authorized circumstances. As to be expected, such intra- organizational protective retention of keys was called by some escrow, or by others self-escrow. However, the departure from Clipper was even more extensive because: o There is probably no need for splitting such keys, o There probably would be no need for a complex master-key approach such as embodied in Clipper, and o There might not need to be a "law enforcement access field" in externally transmitted messages. As so often is the case in computer-related matters, the terminology is not clearly established. One way to clarify it would be: [A] To confine the term "escrow" to situations in which some key, split or not, master or session, will be stored with extra-organizational trusted parties who make keys available only to law enforcement; but [B] For the intra-organizational situation or the extra-organizational situation in which the depositing party can have access to the keys, adopt the term "archive" or "key archive". The term "key backup" might be used in the image of conventional backups of data bases and files; but the term "archive" or "key archive" would hopefully avoid confusion. If one were to follow this taxonomy, then "Commercial Key Escrow", should be called "Commercial Key Archive" and the process of depositing keys therein should be called "key archiving." I would not stand strongly for picking "archive" as an appropriate term but something different from "escrow" is clearly needed to keep the dialogue leading to a national crypto-policy precise, unambiguous, and clean. Obviously it's your call whether you choose to adopt these semantic views in your conversations with Geof. At minimum, you should be alert to loose usage of "escrow" as a concept. Willis

2 1

Re: Anonymity: A Modest Proposal
by s1018954＠aix2.uottawa.ca 17 Dec '03

17 Dec '03

On Wed, 18 Oct 1995, Hal wrote: > Modemac proposes sending messages to remailers via newsgroup postings. > A fair amount of alt.test postings seem to be pgp'd (though a lot were Detweiler Blacknet tentacles, not that I've checked since Tim's Blacknet key was factored ). There was also an alt.anonymous.messages or something along those lines. Bad propagation. It seems to me that receiving messages through newsgroups (sent through remailernet) and having them retrieved automatically by your newsreader might be a better method of defeating traffic analysis. Sounds like Vinge's piece in True Names about downloading the entire world bbs. All you'd need to do here would be to scan your local feed of alt.test . While this would work in the short run, with a low level of users, in a high usage scenario, you'd post a destinated pseudonym (you might want it encrypted) in alt.test along with the name of the specific newsgroup the actual message would be posted to. Saves computing power.

2 2

(no subject)
by dawg＠frontier.wilpaterson.edu 17 Dec '03

17 Dec '03

hi. i'd like some info. thanks.

1 0

Munition Code?
by Rob.Lowry＠on-ramp.ior.com 17 Dec '03

17 Dec '03

Ok.. not a real brainbuster here.. where can I get a copy of the code that is classified Munitions, as per the T-Shirts? I don't need the shirt <g>, I just want to see the code.. Thanks to all who will point me in the right direction.. RobL ------------------|----------------------------------------------------------- Rob Lowry | PO Box 288 | Rockford Wa 99030 | ral(a)otc.mhs.compuserve.com robl(a)on-ramp.ior.com

1 0

This PROMISes to be odius
by Brad Dolan 17 Dec '03

17 Dec '03

PR 10/18 0809 ORACLE INTRODUCES SOFTWARE TOOL FOR LAW ENFORCEMENT Tool Helps Federal, State, Municipal Agencies Stop the Criminal Element Enables Agencies and Departments To Build Data Warehouses of Intelligence To Better Manage, Analyze and Solve Cases MIAMI, Oct. 18 /PRNewswire/ -- Oracle Corp. (Nasdaq: ORCL), the world's leading information management software company, today announced immediate availability of Oracle Special Investigative Unit Support System (SIUSS) Release 1.0, a Microsoft Windows-based software tool designed to help law enforcement investigators more effectively manage and solve cases. Oracle SIUSS uses Oracle's industry leading information management technology to yield new insights into criminal activity and significantly reduce the time needed to bring cases to their successful resolution. The software was introduced at the International Association of Chiefs of Police Conference in Miami, FL. Oracle SIUSS represents a major step forward in the collection, storage and analysis of case intelligence information for complex conspiracies, violent crimes such as rape and murder, drug trafficking, and other major cases. The tool combines traditional analytical concepts with job-specific information collection and lead generation analysis features. For example, Oracle SIUSS receives input from various investigative sources -- a surveillance team, forensics expert, wire room operator, citizen tip -- and makes the data available to agency management, analysts and investigators in the form of leads on their cases. Oracle SIUSS offers advanced capabilities beyond traditional law enforcement systems which simply gather and store factual information such as name, birthdate, or time of a call. Oracle SIUSS develops leads the way a real investigator works, by starting with known facts and combining them in a way that generates further insight and leads. Built upon Oracle7, the most popular relational database management system in use by U.S. law enforcement personnel, Oracle SIUSS allows investigators to uncover crucial criminal patterns by linking subjects, vehicles, locations, businesses and other entities, within a case or among several cases. Designed in cooperation with federal, state, military and municipal investigators working on real cases, Oracle SIUSS manages a comprehensive array of investigative intelligence, including telephone information (toll, pen/DNR, Title III), assets, financial data, arrests, seizures, credit card data, surveillance, mail covers, trash pickup, and incidents. Because Oracle SIUSS is able to store information from multiple cases in a single database, information can be cross referenced to uncover obscure relationships. Oracle SIUSS also helps the investigator build and document case information as it moves towards prosecution. "Oracle has a long history of partnership with law enforcement," said Jay Nussbaum, senior vice president and general manager, Oracle Government. "Oracle software is the foundation of important programs within the FBI, INS, Department of Justice, Customs, ATF, New Mexico Dept. of Public Safety, and many other agencies at the federal, state, and local level. We are proud to introduce Oracle SIUSS to the law enforcement community, a tool designed with a specific capability in mind -- stopping the criminal element." Capturing Data to Capture Criminals With Oracle SIUSS, Oracle for the first time delivers a commercial- off-the-shelf software tool that layers the features and functionality investigators require on top of industry-standard information management technology. The Oracle7 architecture provides a secure, flexible, easy- to-use and administer environment in which law enforcement systems, including Oracle SIUSS, can be incorporated. Case information can be shared or kept separate to any degree desired depending on the needs of the investigators. Through the course of an investigation, information shows up in hundreds of bits and pieces at different times and places. With Oracle SIUSS, once this data is captured, the odds that it will be lost or overlooked are significantly reduced. Using Oracle SIUSS's automated link analysis, the time it takes to generate and chase down leads is reduced by 20 to 100 percent. The law enforcement community as a whole benefits by this combination of functionality and information management technology. Large agencies and small departments alike can standardize on one underlying architecture for all of their information processing needs. Concerns such as connectivity, security, and portability, are now non- issues. The net result is a significantly enhanced investigative capability integrated into the overall law enforcement operation. Oracle SIUSS uses a sophisticated pattern analysis process for analyzing the timing and sequence of phone calls made by the target. This gives insight into how the target and his associates work together within a possible conspiracy. For example, Oracle SIUSS generates a conspiracy index based upon the relationship of calls made by the target to a set of phone numbers, which reveals the degree of probability that the subscriber for a phone number is involved in the conspiracy. Joint investigative operations between agencies or departments are possible, if authorized, ensuring a high degree of control over what information is available to which individual, department, or agency. Oracle's secure database, networking, and encryption technologies control the flow and accessibility of intelligence data outside the supplying agency. A typical Oracle SIUSS configuration consists of Windows PCs connected to virtually any type of file server. The price starts at $6,900, which includes the Oracle7 database. For more information about Oracle SIUSS, please call (301) 633-0584, Ext. 7192. Oracle Corp., a $3 billion company, is the world's largest supplier of software for information management, and the world's second largest software company. The company offers its database, tools and application products along with related consulting, education and support services, in more than 90 countries around the world. For more information about Oracle, please call (415) 506-4000. Oracle's World Wide Web address is http://www.oracle.com/.

1 0

Oh to be a mouse in the corner...
by Brad Dolan 17 Dec '03

17 Dec '03

PR 10/17 1720 ABA: TERRORISM EXPERTS TO SPEAK Why is domestic terrorism on the increase? How serious a problem is it? Do we have international terrorism under control? These and other questions will be the focus of a two-day conference sponsored by the ABA Standing Committee on Law and National Security at the Hotel Washington in Washington D.C., October 19 and 20. The conference, entitled "National Security Law in a Changing World: The Fifth Annual Review of the Field," features experts in the field of terrorism, including former CIA Director William Colby, former FBI Director William Sessions, and Oklahoma Governor Frank Keating, whose state was the site of the worst domestic terrorist attack in U.S. history. Program highlights include: "The Press and National Security," 10:30 a.m. Thurs., Oct. 19 Panelists: Timothy Weiner, New York Times; Peter Rodman, National Review; Carl Robert Zelnick, ABC-TV; and Carl Stern, Department of Justice. "Reinventing the Intelligence Community," 2 p.m., Thurs., Oct. 19 Panelists: William Colby, Former Director of the Central Intelligence Agency; William Sessions, Former Director of the Federal Bureau of Investigation; and Admiral William Studeman, Former Acting Director of CIA. "Addressing the Threat of Domestic Terrorism," 8:30 a.m., Fri., Oct. 20 Panelists: Bradley Buckles, Bureau of Alcohol, Tobacco and Firearms; Howard Shapiro, General Counsel FBI; and Professor Stephen Sloan, University of Oklahoma. Luncheon Address, 12 p.m., Fri., October 20 Speaker: The Honorable Frank Keating, Governor of Oklahoma All Conference events will take place in the Ballroom, Lower Lobby Level at The Hotel Washington, 15th St. and Pennsylvania Ave., Washington D.C. For a complete listing of conference programs, please call Holly McMahon at 202-662-1036. CONTACT: Christine Lanier of the American Bar Association, 202-662-1792, or E-Mail: clanier@@attmail.com. -0- 10/17/95

3 2

Re: Netscape rewards are an insult
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Jeff Weinstein <jsw(a)netscape.com> wrote: > David A Wagner wrote: > > I do think their ``bug bounty'' system is an improvement -- at least > > they're showing some concern for security, and beginning to admit > > that outside review of security-critical code is...well...critical. > > The whole bug bounty thing is an experiment. We have no idea how > valuable it will be, but we thought it would be worth trying. As we > gain more experience with it, we will probably evolve it. Mr, Weinstein: Is your comment about the "Bugs Bounty" program an official comment, that you have "no idea how valuable" it will be?? Shall I give you a clue, as to how valuable the discovery of a flawed algorithm might be?? How valuable do you think the ability to download an entire geo-physical company's 3-D seismic data base is, while some company temp is looking at a pretty picture of Moo Goo Gai pan, or downloading a recipe for goat-cheese salad with ginger and macadamia nuts?? Why not admit that the whole Bugs Bounty program was a sham. Nothing more than a quickly slapped together public-relations program, that tried to create an appearance that Netscape had a pro-active business plan. Is it because there WAS no plan, whatsoever?? Why not admit that you were forced to take action and show that you were "doing something" following the crack of the Netscape browser that was supposed to protect sensitive information such as credit-card transactions. And why not admit that what you did was raid a couple of left over press kits, and take out some shirts and cups and throw together a damage control program. Your so-called "Bugs Bounty" program. Is it because, a program that says that anyone who reports a "bug" in your two billion dollar software wouldn't be rewarded -- no, they would be entered into a draw where they _might_ could get a chance to win a cup or a shirt?? Or they might receive a $1,000 reward as long as they agree to a waiver of all their rights, and agree that by reporting the problem to Netscape and entering the "Bugs Bounty" contest, that their report would: "become Netscape's property to be used at Netscape's sole discretion" Is it because, this simply doesn't pass the giggle test?? And is demonstrative of such a cavalier internal attitude and approach to security that it can only be characterized as the grossest of misconduct? I'm certain that even the marketing people must have burst into peals of laughter at that one. Why not admit that Netscape never thought that anyone would find anything at all?? Why not admit that Netscape thought that they could weasal out of the Berkeley crack, with a nice little pat on the head to the kids who found it?? Why not admit that not only did Netscape not have an action plan for "bugs" prior to the "Berkeley crack", but doesn't have any action plan following it. Why not admit that none of the cocky boys at Netscape had even considered what would be done if there was an easily exploitable critical design flaw in the algorithm. And now that someone took Netscape up on its challenge, and simply said that the emperor has no clothes, now that someone hasn't just discovered a "bug" like the "Berkeley crack" but has demonstrated that the Netscape algorithm is fatally flawed, by posting the exploitation algorithm, now what?? Good God, I asked for clarification from Netscape last Thursday, and Netscape hasn't bothered to even return my email from almost a week ago. And, after posting the exploitation algorithm last week -- on Friday the Thirteenth -- there has been nothing but public relations huff-and-puff. Clearly, no one performed adequate top-down / bottom-up analysis at Netscape. And both the internal and external review process were woefully inadequate. Or to steal a line from Jonathan Swift, in Gulliver's Travels. Are you, "a most ingenious Architect who had contrived a new Method for building Houses, by beginning at the Roof, and working downwards to the Foundation ..." and then done nothing else, but issue press-releases to hype and promote Netscape stock in some self-centered attempt to help out your "friends" on Wall Street. >> Still, I do agree that they really oughta be employing true experts >> to carefully evaluate their system, if they wanna claim anything about >> its security. > > We are doing that to. We are paying outside consultants to review >everything related to security. Oh yep, I bet you're paying them. I wonder ... are you paying them in shirts or migs, for their white-wash review?? And will the report from the external review become "Netscape's sole property to be used at the sole discretion of Netscape". Which consultants are you going to get, Mister (unofficial, off the record speaking personally, not speaking for the Company) Netscape spokesperson?? Who? AT&T?? AT&T has security people. The phone company, has very good security people. And the phone company is supposed to have good quality control, (ISO-9000 or TQM or something ...) yet AT&T's own internal security review missed this gaping gash in Netscape browser software. Even now, AT&T is using this software internally within its business units and is ACTIVELY recommending a co-branded version of it to its worldwide customers. Has Netscape informed AT&T about this?? I'm sure that Netscape has piled their best people into their Falcon and are busily jetting them around the world signing confidentiality agreements and retaining every possible outside consultant. Entering into agency agreements to keep the lid on the biggest international news story since the Tylenol or Perrier poisoning. I wonder who Netscape will get to sign?? Who's going to lend their name, so that Netscape can say that "we're working closely with Jerry Lewis" or something similar to solve our security problems. But Mr.Lewis can't go public with what he knows, can he?? Even if he knows that Netscape is fatally flawed. Mr. Lewis will be a Netscape agent at that point, won't he?? And he'll be bound by the terms of his confidentiality agreement, even if the company is actively strategically misrepresenting his confidential report. Who's going to be left after Netscape hires all these outside consultants?? Who do you hire?? Euro-Mickey, Minny and Donald Duck?? Captain Kangaroo?? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

4 3

Re: Anonymity: A Modest Proposal
by doug＠cdsnet.net 17 Dec '03

17 Dec '03

Eli Brandt <eli(a)UX3.SP.CS.CMU.EDU> writes: >If you >split the message into shadows, you avoid having anyone in this >position. Hal Finney <hfinney(a)shell.portal.com> responds: >...If the end user is >responsible for reassembly, then that is tantamount to voluntarily >agreeing to receive anonymous messages, and that is no problem... >...And of course anonymous news >postings via shadows would also have the reassembly problem. It seems that there could at least be a hierarchy of shadowed newsgroups, e.g. alt.freespeech.*, requiring the enduser to use special software to reassemble actual postings. This could even be integrated into the newsreaders, or even at a local newserver level. To post to these groups, something like the current Mixmaster remailer network might be used, with extensions for posting "shadows" to these newsgroups. So posting would require slightly more enduser sophistication,and the ability to encrypt. The client posting software would hit ITAR, but presumably not the client reassembly software (newsreader extensions, etc.), since it doesn't need the ability to encrypt. Then the newsgroup hierarchy itself would become the target of control fervor. Perhaps this could be fought with an emphasis on freedom of speech and creation of newsgroups for "political expression", e.g. alt.freespeech.talk.politics, etc. It's unfortunate, but good soundbites can be as important as good protocols: "Freedom of Speech in Cyberspace: Feds want to eliminate so-called "freespeech newsgroups" on the new information superhighway..." I haven't done my homework on protocols for distributing shadows. Are there problems with this, other than the obvious one of actually doing all the work? Doug Cutrell _____________________________________________________________ Doug Cutrell General Partner doug(a)cdsnet.net Open Mind =============================================================

2 1

Re: Anonymity: A Modest Proposal
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 9:42 AM 10/18/95, Hal wrote: >I think a remailer which forged headers would get people even angrier >than one which was up front about what it was doing. Forging headers is >really considered antisocial by a lot of people on the net. If you could >do it safely, you wouldn't need remailers. Since you need them, it's not >safe, hence the message will probably get traced back to the remailer. >This is prima facie evidence to get an account yanked at a lot of places. Of course. The problem is that protocols as implemented permit header-forging: it's a practical fact of the net, and one that maybe shouldn't be overlooked on (basically vague) 'moral' grounds, any more than Netscape should say, "Well, you just _shouldn't_ screw someone with a foo.foo.foo.foo... URL." Of course people shouldn't overflow your stack intentionally--but they _can_, and the implications of that fact are shaping the net as we speak. If the headers were forged in such a way as to falsely and _credibly_ attribute a transmission to an actual uninvolved third-party, that's one thing; but the existence of headers that are forged so incompetently as to be traceable to their actual origin suggests that forged headers might be worth meditating on. For example, what if two or three dozen independently maintained Mixmasters in three or four countries randomly forged headers (maybe even actually badly, or maybe craftily "badly") so as to make the last link in a chain look like one (or "one") of the other remailers; how would the Co$ cope with that? Anyway, you get the drift. Ted

3 2