December 2003 - cypherpunks-legacy

key escrow B.S. "cure" for single point of failure
by lcs Mixmaster Remailer 17 Dec '03

17 Dec '03

The feds say that key escrow is not a single point of failure, because private keys will be split between arms of the bureaucracy, and an attacker would have to con three or more independent agencies or agents to gain access to a key. Now, running buffer overflows on three machines with dialup accounts paid for with stolen credit cards and hooked through the payphone in Cloyne hall seems just as easy as running buffer overflows on one. Single point may be worse than three points, but one and three seem almost the same when compared to 250,000,000. -THE LIE

1 0

Re: Cypherpunks write GAK
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

> >Security And Freedom Through Encryption: >======================================= > >This patch adds a Law Enforcement Access Field to PGP 2.6.3i, which >can be used to provide, upon presentment of a court order, immediate >access to plaintext data. > >This tool will frustrate illegal and deadly activity of terrorist >groups that plot to blow up buildings, drug cartels that seek to >poison our children, and those who proliferate in deadly chemical and >biological weapons, and will bring international criminals to justice. > >GAKMonger >~~~~~~~~~ > >diff -u ../pgp263i/src/armor.c ./armor.c >--- ../pgp263i/src/armor.c Wed Jan 17 21:37:20 1996 >+++ ./armor.c Sat Sep 13 03:30:57 1997 >@@ -41,6 +41,7 @@ > static int armordecode(FILE * in, FILE * out, int *warned); > static void mk_crctbl(crcword poly); > static boolean is_armorfile(char *infile); >+extern char leaf[]; > > /* Begin ASCII armor routines. > This converts a binary file into printable ASCII characters, in a >@@ -597,6 +598,13 @@ > 1, noSections); > } > fprintf(outFile, "Version: %s\n", LANG(rel_version)); >+ if (leaf[0]) >+ { >+ fprintf(outFile, "LEAF: "); >+ for (i = 1; i <= IDEAKEYSIZE; i += 3) >+ outdec(leaf+i, outFile, 3); >+ putc('\n', outFile); >+ } > if (clearfilename) > fprintf(outFile, "Charset: %s\n", charset); > if (globalCommentString[0]) >diff -u ../pgp263i/src/crypto.c ./crypto.c >--- ../pgp263i/src/crypto.c Mon Jan 15 22:37:59 1996 >+++ ./crypto.c Sat Sep 13 03:33:19 1997 >@@ -420,6 +420,9 @@ > * The "skip" parameter says to skip that many bytes at the beginning, > * used to generate a random IV only for conventional encryption. > */ >+ >+char leaf[IDEAKEYSIZE+1]; >+ > static int make_random_ideakey(byte key[IDEAKEYSIZE+RAND_PREFIX_LENGTH], > int skip) > { >@@ -445,7 +448,11 @@ > */ > count = IDEAKEYSIZE+RAND_PREFIX_LENGTH; > for (count = skip; count < IDEAKEYSIZE+RAND_PREFIX_LENGTH; count++) >- key[count] = cryptRandByte() ^ trueRandByte(); >+ { >+ key[count] = cryptRandByte() ^ trueRandByte(); >+ leaf[count-skip+1] = key[count]; >+ } >+ leaf[0] = 1; > > /* > * Write out a new randseed.bin. It is encrypted in precisely the >diff -u ../pgp263i/src/pgp.c ./pgp.c >--- ../pgp263i/src/pgp.c Thu Jan 18 19:06:45 1996 >+++ ./pgp.c Sat Sep 13 02:36:44 1997 >@@ -410,6 +410,16 @@ > #endif > stderr); > >+fputs("American citizens have a right to their privacy and their access to the >+freest possible markets. But they also have a right to their safety and >+security. Terrorist groups that plot to blow up buildings; drug cartels >+that seek to poison our children, and those who proliferate in deadly >+chemical and biological weapons are all formidable opponents of peace and >+security in the global society. These bad actors must know that the United >+States' law enforcement and national security agencies, working under the >+proper oversight, will have the tools to frustrate illegal and deadly >+activity and bring international criminals to justice.\n", stderr); >+ > get_timestamp((byte *) & tstamp); /* timestamp points to tstamp */ > fprintf(pgpout, LANG("Current time: %s\n"), ctdate(&tstamp)); > } > > What is this???????????? ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Assault Weapons, Strong Cryptography, And Large Breasts
by Jonathan Wienke 17 Dec '03

17 Dec '03

The excuse used by the government to justify regulation of firearms and cryptography is one of crime prevention: * "We can't let people have machine guns--they might go wacko and shoot a whole bunch of people." * "We can't let people have rifles or pistols with magazines that hold more than 10 rounds--they might go wacko and shoot a whole bunch of people." * "We can't let people have sawed-off shotguns--they are too easy to conceal. Someone might be able to hide one under their coat and then rob a convenience store. * "We can't let people have Nigger Town Saturday Night Specials--they are too easy to conceal. Someone might be able to hide one under their coat and then mug somebody." (This is the original, unabridged version of the term--the sanitized version is just more acceptable to the public. Some of the first gun control laws in the US were passed to prevent black people from defending themselves against the KKK, shortly after the Civil War.) * "If we let people communicate using encryption, then terrorists and pedophiles will be able to run amok." This logic sounds good on the surface, but unfortunately it has a serious flaw. Like the difficulty with the old Mafia "protection" rackets, the problem becomes "Who will protect us from the protector?" Government has a legitimate role in capturing and punishing those who harm others. However, when government attempts to prevent people from harming themselves or others, the "cure" becomes worse than the "disease". One can apply this warped logic just as aptly to body parts as firearms or cryptographic software. Women can use their bodies to solicit sexual services (prostitution), and spread sexually transmitted diseases. Should we require them to license their breasts? (Anyone C-cup or larger must pay a $75 annual license fee per breast, D-cup or larger, $100. Flat-chested women will have to pay $150 for their concealable "Saturday Night Specials", and of course carrying a concealed breast is a felony.) Men can commit crimes with their penises--rape, incest, sodomy, etc. Shall we license penises, too? ($25 annually per erect inch, and any "assault penis" capable of ejaculating more than once per erection will be immediately confiscated.) "Honey, Junior and I are going to go to the range, so I can teach him how to shoot safely." "You know I don't like guns, especially that one you have that looks like an Uzi. I just don't think it's right for Junior to be around such things. Besides, shooting is dangerous." "Guns aren't dangerous, as long as you follow the appropriate safety rules when handling them. That is what I am going to teach Junior today." "But I don't want Junior to be around guns. You have all the equipment you need to be a bank robber or terrorist, and that bothers me." "Well, you have all the equipment you need to be a whore. Should that bother me?" Prohibition was an attempt to prevent people from hurting themselves or others due to excessive alcohol consumption. Agents of the government arrested those involved in the production and sale of alcoholic beverages. Since government cannot change people's desires, the demand for the consumption of alcohol remained. Organized crime moved in to supply the demand, and instead of saving lives, Prohibition cost lives--and freedoms. The drinkers continued to drink, and due to the gun battles that ensued when the government tried to stop them, the government decided to outlaw (for all but a privileged few) private ownership of machine guns. This trend continues today. Purveyors of crack cocaine, heroin, and methamphetamines have replaced bartenders as the boogeymen. "Assault weapons" are constantly reviled in the media as the tools of drug dealers and terrorist criminals. The government continues to strip away our rights because "it needs to in order to be able to fight the War On Drugs". Drugs are the excuse for some of the most onerous asset-forfeiture laws in the civilized world--right here in the USA. If police suspect (they don't need any proof) that you are involved in drug trafficking, your house, car, bank accounts, and other valuables can be confiscated. They do not need to be returned, even if you are never even charged with any crime. (My source for this: ABC's "20/20" news show, which is hardly a bastion of right-wing fanatacism.) As I write this, the House of Representatives is working on a bill that effectively criminalizes electronic communication that does not provide a transcript of the communication to the government. The justification for this Orwellian intrusion is terrorism, drug trafficking, child pornography, money laundering, and various and sundry classified and therefore unspecified "threats to national security". Of course, the justification is utter hogwash. Instead of teenage hackers intercepting financial communications and emptying our bank accounts, it can be done by professionals whose salaries are paid by our taxes. Instead of a few crackheads trying to break into your house looking for cash or valuables to fund their next fix (a situation created by our ridiculous War On Drugs), you can be assaulted by your friendly neighborhood SWAT team searching for your unescrowed encryption keys, equipped with eveything up to and including tanks and armored personnel carriers, which you have the privilege of paying for out of your pocket. The source code for crypto isn't going to evaporate just because 536 politicians pass a law. People still own machine guns, which in addition to being illegal, are expensive to purchase, difficult to manufacture, and difficult to hide from determined searchers. On the other hand, the source code for PGP and other cryptographic software is readily available, and very easy to copy and redistribute, so even if house-to-house searches are conducted, there will be tens of thousands of sources for it. I suspect that Crypto Prohibition will enjoy even less popular support than the original did. Jonathan Wienke What part of "the right of the people to keep and bear Arms, shall not be infringed" is too hard to understand? (From 2nd Amendment, U.S. Constitution) PGP 2.6.2 RSA Key Fingerprint: 7484 2FB7 7588 ACD1 3A8F 778A 7407 2928 DSS/D-H Key Fingerprint: 3312 6597 8258 9A9E D9FA 4878 C245 D245 EAA7 0DCC Public keys available at pgpkeys.mit.edu. PGP encrypted e-mail preferred. Get your assault crypto before they ban it! US/Canadian Windows 95/NT or Mac users: Get Eudora Light + PGP 5.0 for free at http://www.eudora.com/eudoralight/ Get PGP 5.0 for free at http://bs.mit.edu:8001/pgp-form.html Non-US PGP 5.0 sources: http://www.ifi.uio.no/pgp/ http://www.heise.de/ct/pgpCA/download.shtml ftp://ftp.pca.dfn.de/pub/pgp/V5.0/ ftp://ftp.fu-berlin.de/pub/pc/win95/pgp ftp://ftp.fu-berlin.de/pub/mac/pgp http://www.shopmiami.com/utopia.hacktic.nl/pub/replay/pub/pgp/pgp50/win/ RSA export-o-matic: print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

No Subject
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

The snow-monster saw a peppercorn through the vacuum-packed keyhole, it's extra mouth kissing the fresh fruit and chewing the rough. The blizzard continued to whip the darkness, while the snow-men sunned in the warm glow of particle fear and unicity gaps. It remained as cold it as and hot. - A'Tak A'Tdorn

1 0

CONGRESS CALLS FOR TIMEOUT IN HEATED ENCRYPTION DEBATE
by Bill Stewart 17 Dec '03

17 Dec '03

"Consensus. How quaint." >> CONGRESS CALLS FOR TIMEOUT IN HEATED ENCRYPTION DEBATE - With the congressional debate over computer encoding policy headed for a major showdown, lawmakers Thursday decided to slow the process and spend two weeks looking for a consensus approach. [Reuters [BR], 439 words]

1 0

Supreme Court Case on language choice
by Bill Stewart 17 Dec '03

17 Dec '03

Mark Eckenwiler posted this to Cyberia-L, with Subject: Re: House panel votes behind closed doors to build in Big Brother chris mohr writes: + Suppose that the use of particular languages other than English or + a few other common ones, such as Spanish or French, was forbidden over the + telephone Interestingly, there is some Supreme Court case law arguably on point. In _Yu Cong Eng v. Trinidad_, 271 US 500 (1926), the Supreme Court considered the validity of a Philippine statute that prohibited the keeping of business records in lanuages other than English, Spanish, or "any local dialect." (I'll omit an explanation of why the Court was analyzing Philippine law under the U.S. Constitution.) The Court found that in charging the petitioner (who kept his books in Chinese), the Philippines had deprived him of liberty and property w/o due process and had deprived him of equal protection under the laws. (I should add that the legislation, which would also have technically applied to records in German or Urdu, was known locally as the Chinese Bookkeeping Act.) Note, however, that the Court observed in the same breath that "the Philippine government may make every reasonable requirement of its taxpayers to keep proper records of their business transactions in English or Spanish . . . ." 271 US at 525. -- "This case presents the perhaps unprecedented situation of a court, as litigant, petitioning itself, as court, for relief." In re Skupniewitz, 73 F.3d 702 (7th Cir. 1996) Mark Eckenwiler eck(a)panix.com

1 0

InfoWar 7 (Part III of 'The True Story of the InterNet')
by Kent Crispin 17 Dec '03

17 Dec '03

1 0

Re: Monetary Economics (fwd) [amusement]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From owner-traveller(a)Phaser.ShowCase.MPGN.COM Sat Sep 13 07:01:15 1997 > To: traveller(a)MPGN.COM > X-Original-Article-From: Scott Ellsworth <Scott_Ellsworth(a)alumni.hmc.edu> > Subject: Re: Monetary Economics > From: shadow(a)krypton.rain.com (Leonard Erickson) > Message-ID: <970913.000519.9C4.rnr.w165w(a)krypton.rain.com> > Date: Sat, 13 Sep 1997 00:05:19 PST > In-Reply-To: <3.0.3.32.19970912130653.007c83c0(a)mail.deltanet.com> > Organization: Shadownet > X-Newsreader: rnr v2.20 > Sender: owner-traveller(a)Phaser.ShowCase.MPGN.COM > Reply-To: traveller(a)MPGN.COM > > In mail you write: > > > For this to work, the entity doing the credit management needs to have the > > highest technology available, which I assume the Imperium has for a very > > long time. The techniques are likely known to those who want to find them > > out, because someone would have defected. Thus, you need a scheme that is > > robust, even knowing the algorithm and some of the keys. > > Old rule of cryptology. No code/cipher is secure unless it can provide > protection against someone who knows the algorithm, but not the key. > This is because it is *inevitable* that the algorithm will either leak, > or worse, be guessed. > > If a key is known, that key is blown. But again, knowledge of one key > should not compromise others. If it does, the code system is a piece of > junk. > > Theoretically, one time pads will *always* be secure. The only trouble > is key distribution (well, key generation is tedious, but that's > relatively minor). > > Public key ciphers are subject to mathematical advances. Not > *computational*, because if you have faster computers, then you can use > bigger keys. But if someone comes up with a new mathematical technique > that greatly decreases the work required to carry the mathematical > operation that "secures" the cipher, then you are toast. For example, a > whole bunch of public key schemes went down the tubes a few years back > when somebody came up with a better solution to what's known as the > "knapsack problem". The remaining schemes are based on the difficulty > of factoring large numbers. So if a breakthrough is made in algorithms > for factoring large numbers, they go away. > > But for game purposes, we can assume that factoring is inherently hard > (or that some new trick is found). So public key ciphers would be > usable, though the keys may be a small book's worth of digits (stored > in a tiny bit of storage). > > Given the fact of there being higher tech cultures, one time pads will > be used for military and diplomatic stuff as well as anything that you > are afraid might be trouble if someone with higher tech shows up. > > But for generic business purposes, you just use the highest TL > available for the public key ciphering gear. That way, it's unlikely > that anybody can crack things soon. Sure, if a TL 16 race is found, > they can crack your ciphers in weeks instead of years, but they aren't > likely to *bother* with most commercial stuff. > > -- > Leonard Erickson (aka Shadow) > shadow(a)krypton.rain.com <--preferred > leonard(a)qiclab.scn.rain.com <--last resort >

1 0

SSZ Move Downtime - Tuesday - Reminder
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Just a quick reminder that SSZ will be going down Tuesday morning and could be down for several hours. Please make appropriate plans for this outage. We will try to make it as quick as possible contingent upon SWBT getting both the POTS and ISDN installers on site within a reasonable time frame. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Any talk of limiting _existing_ crypto?
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

> --------------------------------------------------------------------- > This mail is brought to you by the e$pam mailing list > From: Tim May <tcmay(a)got.net> > Subject: Any talk of limiting _existing_ crypto? > Integration with mailers and browsers may not even be such a good idea, as > the evolution of such products will cause obsolescence. What about add-on package to current e-mail packages that does not contain crypto but makes the interface between crypto programs and e-mail client (pgpjn for pegasus, Private Idaho, etc) ? Are they regulated too? -- Jean-Francois Avon, Pierrefonds(Montreal) QC Canada DePompadour, Societe d'Importation Ltee Finest of Limoges porcelain and crystal JFA Technologies, R&D consultants physicists and engineers, LabView programing. PGP encryption keys at: http://w3.citenet.net/users/jf_avon http://bs.mit.edu:8001/pks-toplev.html ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C

1 0