December 2003 - cypherpunks-legacy

Re: Internet Security Review
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 5:36 PM 10/23/95, Doug Hughes wrote: >Just got a copy via mail today. Boy, Dorothy Denning seriously dings >Tim May in this issue. Interesting reading to know what the other side >is up to nonetheless. She uses some reasoning that will be compelling to >many. This makes me laugh out loud. I have Wit Beer coming out of my nose. My poor trackball's going to take a major Windex job now, boy. Denning *doesn't* go for a fellow(?) Certified Cryptographer(tm), probably because her credentials are all but shot now. She *doesn't* go after someone *paid* to go after *her* in the policy arena, like Banisar & Co., who could beat her with "half his brains tied behind his back". She wouldn't *dare* go after the politicians like (sorry again, Rush) Mr. Newt, who *are* thwarting her monomaniacal campaign to sperm^h^h^h^h^h<insert bodily fluid here>-sample the population for biometric purposes, she goes after *Tim* *Freakin'* *May* for chrissake. Gotta watch that "corrupting the youth of Athens" stuff, Tim, 'cuz Big Bad Ol' Dottie D's gonna get ya! Feh. Hemlock anyone? Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

bank wiretapping law
by an224850＠anon.penet.fi 17 Dec '03

17 Dec '03

a law that allows government interception of banking data for intelligence/counterespionage purposes without notification... Date: Sun, 22 Oct 1995 03:11:05 -0400 (EDT) From: The Gate <gate(a)id.WING.NET> Subject: Foreign Intelligence To Become Alien Intelligence To: snet-l(a)world.std.com The following post make me think. What if the goverment could decide to interpret the meaning of the word foreign however they wanted. They could then say that anyone dealing with extra-terrestrials were foreigners, or that anyone not aligned with their thinking was a foreigner. I think that's the direction they're taking. Lee On Sat, 21 Oct 1995, Brad Dolan wrote: > > > ---------- Forwarded message ---------- > Date: Fri, 20 Oct 1995 18:07:35 -0700 > Subject: Lack of secrecy in U.S. Banks > > > I ran across an interesting fragment of the U.S. Code. > > Apparently, the Federal Government may access any banking records > whatsoever if the Director of the FBI (or the Director's designee) > certify that the information is sought for "foreign intelligence > purposes." Further, it is illegal for anybody to disclose that the > records were turned over to the government, or even sought. I do not > know the penalties for disclosure. > > The Attorney General appears to set guidelines for the dissemination > of the information obtained through this law. Note that if banking > privacy is violated for reasons which are not related to > counter-intelligence operations, the victim is unlikely to be in a > position to seek relief from the courts because the privacy violation > is likely to remain secret. > > I've enclosed the law below. I'm not a lawyer, so it raises more > questions than it answers. Perhaps the more skilled readers on the > list will be able to deduce the implications. > > The U.S. Code is available at http://www.pls.com:8001/his/usc.html > > This particular law is available at the improbable URL: > http://www.pls.com:8001/cgi-bin/taos_doc.pl?unix+0+uscode+17566+query+a+Gov… > > Here is the law itself: > > -CITE- > > 12 USC Sec. 3414 01/24/94 > > -EXPCITE- > > TITLE 12 - BANKS AND BANKING > CHAPTER 35 - RIGHT TO FINANCIAL PRIVACY > > -HEAD- > > Sec. 3414. Special procedures > > -STATUTE- > > (a)(1) Nothing in this chapter (except sections 3415, 3417, 3418, > and 3421 of this title) shall apply to the production and > disclosure of financial records pursuant to requests from - > (A) a Government authority authorized to conduct foreign > counter- or foreign positive-intelligence activities for purposes > of conducting such activities; or > (B) the Secret Service for the purpose of conducting its > protective functions (18 U.S.C. 3056; 3 U.S.C. 202, Public Law > 90-331, as amended). > (2) In the instances specified in paragraph (1), the Government > authority shall submit to the financial institution the certificate > required in section 3403(b) of this title signed by a supervisory > official of a rank designated by the head of the Government > authority. > (3) No financial institution, or officer, employee, or agent of > such institution, shall disclose to any person that a Government > authority described in paragraph (1) has sought or obtained access > to a customer's financial records. > (4) The Government authority specified in paragraph (1) shall > compile an annual tabulation of the occasions in which this section > was used. > (5)(A) Financial institutions, and officers, employees, and > agents thereof, shall comply with a request for a customer's or > entity's financial records made pursuant to this subsection by the > Federal Bureau of Investigation when the Director of the Federal > Bureau of Investigation (or the Director's designee) certifies in > writing to the financial institution that such records are sought > for foreign counterintelligence purposes and that there are > specific and articulable facts giving reason to believe that the > customer or entity whose records are sought is a foreign power or > an agent of a foreign power as defined in section 1801 of title 50. > (B) The Federal Bureau of Investigation may disseminate > information obtained pursuant to this paragraph only as provided in > guidelines approved by the Attorney General for foreign > intelligence collection and foreign counterintelligence > investigations conducted by the Federal Bureau of Investigation, > and, with respect to dissemination to an agency of the United > States, only if such information is clearly relevant to the > authorized responsibilities of such agency. > (C) On a semiannual basis the Attorney General shall fully inform > the Permanent Select Committee on Intelligence of the House of > Representatives and the Select Committee on Intelligence of the > Senate concerning all requests made pursuant to this paragraph. > (D) No financial institution, or officer, employee, or agent of > such institution, shall disclose to any person that the Federal > Bureau of Investigation has sought or obtained access to a > customer's or entity's financial records under this paragraph. > (b)(1) Nothing in this chapter shall prohibit a Government > authority from obtaining financial records from a financial > institution if the Government authority determines that delay in > obtaining access to such records would create imminent danger of - > (A) physical injury to any person; > (B) serious property damage; or > (C) flight to avoid prosecution. > (2) In the instances specified in paragraph (1), the Government > shall submit to the financial institution the certificate required > in section 3403(b) of this title signed by a supervisory official > of a rank designated by the head of the Government authority. > (3) Within five days of obtaining access to financial records > under this subsection, the Government authority shall file with the > appropriate court a signed, sworn statement of a supervisory > official of a rank designated by the head of the Government > authority setting forth the grounds for the emergency access. The > Government authority shall thereafter comply with the notice > provisions of section 3409(c) of this title. > (4) The Government authority specified in paragraph (1) shall > compile an annual tabulation of the occasions in which this section > was used. > > -SOURCE- > > (Pub. L. 95-630, title XI, Sec. 1114, Nov. 10, 1978, 92 Stat. 3707; > Pub. L. 97-320, title IV, Sec. 432(b), Oct. 15, 1982, 96 Stat. > 1527; Pub. L. 99-569, title IV, Sec. 404, Oct. 27, 1986, 100 Stat. > 3197.) > > -REFTEXT- > > REFERENCES IN TEXT > Public Law 90-331, as amended, referred to in subsec. (a)(1)(B), > is Pub. L. 90-331, June 6, 1968, 82 Stat. 170, as amended, which is > set out as a note under section 3056 of Title 18, Crimes and > Criminal Procedure. > > -MISC2- > > AMENDMENTS > 1986 - Subsec. (a)(5). Pub. L. 99-569 added par. (5). > 1982 - Subsec. (b)(2). Pub. L. 97-320 struck out ''of'' after > ''financial institution''. > > -SECREF- > > SECTION REFERRED TO IN OTHER SECTIONS > This section is referred to in sections 3402, 3409, 3421 of this > title. > __________________________________________________________________________ > > --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

A secure cryptosystem with a 40-bit key?
by Scott Brickner 17 Dec '03

17 Dec '03

I've been reading a bit recently on constructed languages like Esperanto. I came across one that developed out of something called "LOGLAN" that was published in Scientific American in the early sixties. The current active project is called "Lojban". It has one really curious property that gave me an idea for an interesting symmetric-key cryptosystem. All "native" Lojban words are of entirely predictable forms. "Root" words are all five characters containing three consonants and two vowels in one of two patters (CCVCV and CVCCV). "Structure" words have four forms (VV, CV, CVV, and CV'V). "Combining forms" have two forms (CVC and CV'C). All other words are not "native" words (being either proper names or borrowed words). The upshot of this is that there is a fixed limit on the size of the Lojban dictionary of 249500 words (given 17 consonants and five vowels). The grammar of the language is *so* regularized that they are able to give a YACC description for it. A message written entirely using native Lojban words can be encrypted in a codebook fashion where the particular codebook to be used is a permutation of the dictionary represented by an 40-bit number (18 bits to permut the "root word" list, 10 bits for the "structure word" list, and 12 bits for the "combining form" list). This system has the interesting property that *any* plaintext with the same grammatical structure is a potential encryption of a given cyphertext. This is similar to some more usual cryptosystems which operate at the lexical level but which are designed to create this effect, but has the curious side effect that it is *very* easy to determine a false-key which makes the transmitted message say nearly anything you want, thus making mandatory key escrow systems irrelevant. When you want to send the message "attack at dawn", you devise a grammatically identical message, "party 'til you puke" (which is grammatically identical in Lojban), generate a random key, as well as the key representing a similar permutation, but with "attack" and "party" exchanged, "puke" and "morning" exchanged, and so forth. Transmit the message with the false key in the LEAF field (or report it to your government-approved escrow agency) and government eavesdroppers get the wrong message. Other eavesdroppers get a grammatically correct, but apparrently nonsensical message ("drink by brick"). There's still the problem of borrowed words and proper names, which remain problems in any codebook approach, but represents a small portion of the language, and the words which represent individual letters are part of the "structure words" category, and could be sent spelled-out. This works well in Lojban because it never changes word forms based on grammatical usage. Most natural language declensions and conjugations would make the encrypted message ungrammatical, and make it *much* more difficult to determine a false key for the LEAF field. The irregularity of word forms makes the dictionary much more complicated, too. Comments?

3 4

Re: The NSA Visits Compendium
by Rich Salz 17 Dec '03

17 Dec '03

perhaps we can get epic or eff to archive copies of export requests? Perhaps companies would be willing to file copies of "we asked to export this" after the decision was made?

1 0

robo remailer
by ROBO Anonymous Remailer / Mail Server 17 Dec '03

17 Dec '03

robo remailer is functional again sorry for inconveniences my account is back up this remailer will not be shut down anytime in the foreseeable future my thanks to sameer for not deleting the account while it was inactive and for maintaining c2.org -- ROBO Anonymous Remailer / Mail Server <ROBO(a)c2.org> PGP Key = 8717D1DD PGP Fingerprint: 08 A6 47 EB A2 C6 02 36 35 9A 0E C4 D9 A7 94 4D Send mail with subject: HUMAN to have it redirected to the operator Mail with subject: HELP will be replied to with a help file

1 0

Similar Lists
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Looking for recommendations for any other mailing lists which allow one to stay current, on similar topics... Thanks, KTO

1 0

Mark Twain Bank (was: Anonymity: A Modest Proposal)
by cman＠communities.com 17 Dec '03

17 Dec '03

First of all, those who have looked over the MT Bank stuff all know that they are clearly off to a very shaky start. I know of three guys that could have done a _much_ more professional job, almost a year ago. Unfortunately we were rejected by Chaum as insufficiently respectable. So now we get a service that is lame, confusing and expensive -- at least at the bank end. Chaum apparently continues to suffer from the belief that he needs a real bank to issue e-cash. Well, MT Bank is a real bank, but they have managed to violate at least one major Federal Reserve requirement (accounts in the ECash mint are clearly demand deposit accounts -- it would have been trivial to define them differently but somebody apparently wasn't thinking.) A technically-oriented NBFI could have done a much better job, without a lot of the "real bank" baggage, such as minimum deposits ($250, not $2,500, but still pretty steep for someone wanting to spend $.10 on something.) My understanding is that the _bank account_ is FDIC insured, but not the ECash. I could be wrong -- their materials are extremely confusing and hard to follow. As one of my co-workers said today, "It will be interesting to sit back and watch them take regulatory mortar fire." Indeed. I'm really hoping that they pull their act together -- I've already sent in my account application -- but things look really grim at the moment. There are certainly a lot of projects list members are working on that would be greatly enhanced by functioning, popular e-cash. I encourage everyone to give them lots of helpful feedback so that they can turn this around. On another note, I'm hoping that some of you will also bite the bullet, get accounts, and join me attempting to win valuable prizes in Sameer's "Hack Digicash" promotion. I'd rather see one of us find holes in this than see the whole thing melt into the ground. This extremely unprofessional, bungled launch does, I admit, make Mondex (with scads of beautiful marketing literature) look better all the time, although based on some conversations on Sunday, it appears that they may have _extremely serious_ architectural security problems. We'll see how things play out. Later, Doug > With the release of digicash I hope that we can soon make this >stuff for-pay and much of the spam problem will be fixed. (Not all of >it, of course.) > (I am rather hesitatnt to setup an account with Mark Twain >though.. $2,500 min balance and not FDIC insured?)

6 6

Re: Info: Elementrix POTP
by tcmay＠got.net 17 Dec '03

17 Dec '03

I just saw a glaring error in this article which Dana forwards to us which needs correcting: At 9:19 PM 10/23/95, Dana W. Albrecht wrote: >Forwarded from sci.crypt: > >In article <45t9oh$6vd(a)newsbf02.news.aol.com>, whmurray(a)aol.com (WHMurray) >writes: >> In article <45qkp5$8rh(a)netaxs.com>, grendel(a)netaxs.com (Michael Handler) >> writes: >> >OTOH, I saw a press-release on Cypherpunks a week or two back that >> >claimed Whitfield Diffie and David Kahn had both examined the algorithm >> >under NDA, and both were blown away by it. OTOOH, I don't know how much >> >Diffie and Kahn know about TCP/IP. >> >> Diffie knows enough; Kahn less. However, both are geniuses and know what >> they need to know. As to their being "blown away," I tend to doubt it. >> The idea is useful but not revolutionary. It was Winn Schwartau, not Whit Diffie, who gave the rave review. Schwartau wrote the book "Information Warfare," as well as a novel about hacking, and is not a professional cryptologist. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Anonymity: A Modest Proposal
by tien＠well.sf.ca.us 17 Dec '03

17 Dec '03

s1018954(a)aix2.uottawa.ca wrote: >On Wed, 18 Oct 1995, t byfield wrote: > >> At 9:42 AM 10/18/95, Hal wrote: >> >> Of course. The problem is that protocols as implemented permit >> header-forging: it's a practical fact of the net, and one that maybe >> shouldn't be overlooked on (basically vague) 'moral' grounds, any more than > >The courts can't overlook it either. There goes liability. If I posted >pirated software from this account, according to what you're saying, I could >claim a forgery and show reasonable doubt. How difficult is it to forge headers? How difficult is it to trace a message to the actual sender if the header is forged? Is there a way to quantify traceability on a simple scale, for rough purposes? Lee Lee Tien Attorney tien(a)well.sf.ca.us (510) 525-0817 voice (510) 525-3015 fax

2 1

Re: PA Remailer Concerns
by tien＠well.sf.ca.us 17 Dec '03

17 Dec '03

What is the cite for this statute? Lee >At 11:47 PM 10/14/95 -0700, anonymous-remailer(a)shell.portal.com wrote: >>Has anyone examined the legislative history associated with this statute? >> >>I would be surprised if they were singling out anonymous remailers. They >may have had other concerns regarding phone abuse, e.g., long distance fraud. >> >>Then again, I could be full of it... >> >> >Doesn't necessarily matter what the legislative history was. When some >prosecutor trying to make a name for himself hooks onto this language to >prosecute an anonymous remailer or other perceived miscreant, nobody will >remember what the intent was. The casebooks are full of perversions of >original intent. >Jon Goldberg Lee Tien Attorney tien(a)well.sf.ca.us (510) 525-0817 voice (510) 525-3015 fax

1 0