December 2003 - cypherpunks-legacy

Need ideas. NFP to monitor law enforcement on the net.
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Dear cpunks, after reading several articles about government sting operations in the US and Bavaria, I'm thinking of starting a not for profit to collect and diseminate information on law enforcement on the net. I know how to register a NFP Corp, and certainly know about mailing lists and web pages, but other problems still remain to be solved. Specifically: 1) Is it better to be a national or state registered NFP? (Given the level of LEA hassling I might experience.) 2) What if I start a mailing list and nobody shows up? Whose participation should I ensure so that the effort is a success. 3) What are some good sources of information for LEA's on the net? Any suggestions would be most welcome. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBgAwUBMFe6MnIf3YegbdiBAQHmeAJYz4bKtqPJvcdyUxcuVEOVgAYNO3sRuUzW lnYnq7o2qBMcePAW8xTVECmwt8DXTbutSTJC10DBHdyjDGdgdwwN3ne0mCWN7Pig uDUk =W0pp -----END PGP SIGNATURE----- Dietrich J. Kappe | Red Planet http://www.redweb.com/ Red Planet, L.L.C.| "Chess Space" /chess 1-800-RED 0 WEB | "MS Access Products" /cobre Web Publishing | PGP Public Key /goedel/key.txt

1 0

NSA on GAK
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

The opening comments here by Admiral McConnell of the NSA appear to parallel the comments of Mr. Michael Nelson at the September 6 NIST Key Escrow meeting on the use of encryption by "spies, terrorists, and criminals." URL: http://csrc.ncsl.nist.gov/secnews/ees_q-a.txt ---------- Note: The following answers were provided by NSA to the Senate Subcommittee on Technology and the Law in response to their follow- up questions to the May 3, 1994 hearings. --------------------------- Senate Subcommittee on Technology and the Law Hearing on the Administration's Key Escrow Encryption Standard Written Questions for Vice Admiral McConnell, NSA *Questions for Senator Pressler: Q: Admiral, as you are aware, critics of the Administration's proposal argue that as a practical matter, no criminal, foreign spy, or terrorist of any sophisticated would be foolish enough to use an encryption device designed by the NSA and approved by the FBI. How do you respond? Why do[n't you] think the people whose telecommunications the NSA and the FBI want most to decode will be the very people most unlikely to use this technology? Answer: From what we know today, the overriding requirement that spies, terrorist, and criminals have is for readily available and easy to use equipment that interoperates. Key escrow encryption is not meant to be a tool to catch criminals. It will make excellent encryption available to legitimate businesses and private citizens without allowing criminals to use the telecommunications system to plan and commit crimes with impunity. We believe it would be irresponsible for government to make excellent encryption broadly available knowing that its use by criminals would make it impossible for law enforcement agencies to conduct lawful wiretaps against them. The Department of Justice credits information gleaned through wiretaps as leading to more than 20,000 felony convictions since the early 1980s. This would not have been possible if the criminals had been using encryption systems the FBI could not break. Without government action, however, this fortunate situation will change. At present most people, and most criminals, don't use encryption. However, there is an increasing public awareness of the value of encryption for protecting private personal and business communications. Increasing demand for encryption by the public will likely lead to the widespread use of some form of standardized encryption on the public telecommunications network. This development would have great benefits for the country. Legitimate businesses an private individuals could use the telecommunications system secure in the knowledge that their private information such as business records and credit card numbers could not be intercepted by third parties. But there is a down side. Criminals, terrorists, and others could also use the system to plan crimes, launder money, and the like, completely secure in the knowledge that law enforcement agencies could not listen to those communications. Just as legitimate businesses operate much more efficiently and effectively using the telecommunications system than they could without it, so will criminal enterprises be able to operate more efficiently and effectively if they no longer have to avoid using the telecommunications system. The United States is faced with a choice. We can sit back and watch as the emerging national information infrastructure becomes a valuable tool for criminals and terrorists to use to plan and carry out their activities with complete security, or we can take steps to maintain the current ability of government to conduct lawful wiretaps so that prudent criminals will have to find other less efficient ways to operate and foolish ones may be caught. Key escrow encryption is the later option. Q: Would widespread use of the Skipjack algorithm harm U.S. exports? Do you think it is unlikely foreign businesses will purchase American encryption technology if the U.S. Government holds a set of the decoding keys? Answer: I do not believe that widespread use of key escrow encryption in the United States will harm U.S. exports. If it has any effect at all, it could increase exports somewhat. Key escrow encryption products provide another option for foreign purchasers that they have not had in the past; to the extent that foreigners doe purchase key escrow encryption products, it will mean an increase in exports. Meanwhile, U.S. exporters are free to continue to sell the products they currently sell in foreign markets and to seek license approvals for new products. It is difficult to predict the foreign market for U.S. key escrow encryption technology. Businesses that fear U.S. Government interception of their communications presumably would avoid products for which the U.S. Government hold keys. However, there are a number of reasons why foreign businesses might purchase them. One major reason would be to communicate securely with U.S. businesses that use them. In addition, the superior level of security provided by key escrow products (against all but lawful U.S. Government access) may make them attractive to foreign business that do not view U.S Government access as a major concern. While some prospective users abroad may steer clear of key escrow products because the United States will retain access, there may be many who believe they are unlikely to be targeted by U.S. intelligence in any case or for whom the superior security offered by key escrow encryption products against threats of greater concern may make key escrow products an attractive option. For example, a distributor of pay-TV programming may depend on encryption to ensure that only those viewers who pay for the service can decrypt the TV signal. Such a distributor probably would not be concerned about the threat of access by the United States Government, and might favor suitable key escrow encryption products over competing products that use weaker encryption algorithms. Q: You were present when the previous panelist, Stephen Walker, described how present U.S. laws prohibit his company from exporting encryption products. As I understand it, Senator Murray's bill S.1846, attempts to relax these export controls somewhat. Please give us your views on this legislation. Answer: I support the Administration's position, as announced by the White House on February 4, that current export controls must remain in place and that regulatory changes should be implemented to speed exports and reduce the licensing burden on exporters. The bill you reference appears to be inconsistent with the Administration position. I would be happy to provide you further information on the Administration's reasons for maintaining the current export controls in an appropriate setting. *Questions from Senator Murray: Q: In my office in the Hart building this February, I downloaded from the Internet an Austrian program that uses DES encryption. This was on a laptop computer, using a modem over a phone line. The Software Publishers' Association says there are at least 120 DES or comparable programs world wide. However, U.S. export control laws prohibit American exporters from selling comparable DES programs abroad. With at least 20 million people hooked up to the Internet, how do U.S. export controls actually prevent criminals, terrorists, or whoever from obtaining DES encryption software? Answer: Serious users of encryption do not entrust their security to software distributed via networks o bulletin boards. There is simply too much risk that viruses, Trojan Horses, programming errors, and other security flaws may exist in such software which could not be detected by the user. Serious users of encryption, those who depend on encryption to protect valuable data and cannot afford to take such chances, instead turn to other sources in which they can have greater confidence. Such serious users include not only entitles which may threaten U.S. national security interests, but also businesses and other major consumers of encryption products. Encryption software distribution via Internet, bulletin board, or modem does not undermine the effectiveness of encryption export controls. [Primary written questions for Admiral McConnell] 1. The Defense Authorization Bill for Fiscal Year 1994 has authorized $800,000 to be spent by the National Research Council of the National Academy of Sciences to conduct a study of federal encryption policy. Can we wait to implement the key escrow encryption program until we have the benefit of the NRC's study? Do you think this study is necessary? Should this study be expedited? Answer: We do not believe that we can wait until after the NRC study is completed in 1996 to begin implementation of the key escrow initiative. The information technology industry is dynamic and fast-moving, and to wait another two years or more would, we believe, jeopardize the success of the initiative. Industry demand for encryption products is growing, and the technology is available now to meet that demand with encryption products that provide an outstanding level of security to the user conduct lawful wiretaps. To wait for the completion of the NRC study to other encryption products which would defeat lawful wiretaps. We believe that such a delay would not be in the best interest of the American people. Neither do we believe that the study should be expedited. For our part, we will carefully consider the conclusions of the NRC study. We expect that it will give very careful consideration to the issues, and we would not want the pressure of an unnecessarily short deadline to limit the study group's ability to produce the best report possible. 2. The Administration has said that it is continuing to restrict export of the most sophisticated encryption devices, in part, "because of the concerns of our allies who fear that strong encryption technology would inhibit their law enforcement capabilities." Do we really need to help our allies by prohibiting the export of strong American encryption products, since those same countries can simply control the encryption bought within their borders? Answer: Exports of encryption products are subject to review primarily to protect U.S. national interests, including national security, law enforcement, foreign policy, and other important interests. The law enforcement concerns of our allies are a consideration, especially as the ability of our allies to combat terrorism, drug trafficking, and other international law enforcement problems can have direct benefits to the United States. However, foreign law enforcement concerns do not drive our export control policy. We would continue to review encryption exports to protect U.S. national interests even if foreign law enforcement concerns disappeared. 3. Do you know whether foreign governments would be interested in importing key escrow encryption products to which they hold the decoding keys? Answer: Several foreign governments have expressed interest in key escrow encryption technology due to their own law enforcement concerns. There have been some preliminary discussions, but issues such as who would hold the escrowed keys and the circumstances of government access to escrowed keys must be fully vetted. 4. The Government wants the key escrow encryption standard to become the de facto industry standard in the United States. Would the Government abandon the Clipper Chip program if it is shown to be unsuccessful beyond government use? Answer: We do not expect the program to be unsuccessful beyond government. We have developed a sound security product that we expect will find many uses in government information systems and further believe that government use will bring with it a commercial market, particularly in the defense sector. We have developed a sound security product that we expect will find many uses in government information systems regardless of its success in commercial markets. 5. Openly available devices, such as Intel-compatible microprocessors, have seen dramatic gains, but only because everyone was free to try to build a better version. Given the restrictions on who can build devices with the classified skipjack algorithm, how will key escrow chips keep up with advances in semiconductor speed, power, capacity and integration? Answer: Despite the requirements that a firm must meet to produce key escrow encryption chips, we expect that there will be a number of manufacturers competing against each other to produce the best product, and that such competition will drive them to keep up with the latest technological advances. It is worth noting that only a few companies can produce the sophisticated microprocessors you reference, yet the competition in that market has driven them to achieve remarkable advances in that technology. NSA's STU-III secure telephone program provides an example of a cryptographic product line that keeps pace with technology. The presence of a classified algorithm does not preclude keeping pace with technology. Through NSA's use of a competitive, multi-vendor approach, STU-III secure telephone products have continued to evolve in response to user requirements and technological advances despite their use of a classified encryption algorithm and the consequent need for security restrictions on the manufacturers. 6. How well does the Skipjack algorithm work on telecommunications operating at very high speeds. Is NSA working on another algorithm, called BATON, that could be used in high speeds with a key escrow system? Will Capstone be compatible with BATON? Answer: Using currently available microelectronics technology the SKIPJACK algorithm could not be used for encryption at very high speeds. BATON is the name of an algorithm developed by NSA that could be used at higher rates of speed. We have no plans to develop key escrow encryption devices using BATON, however. Instead, we are considering another algorithm for use at high speeds with a key escrow system. A high-speed key escrow device based on an algorithm other than SKIPJACK would not be "compatible with Capstone" in the sense that traffic encrypted by such a device could not be decrypted by Capstone, and vice versa. However, since such a device would be used for much higher-speed applications than those for which Capstone was designed, there would be no need for it to be compatible with Capstone in that sense. 7. Can Capstone be used to encrypt video programming? If so, have cable companies been approached by any government agency to use Capstone to scramble or encrypt cable program? Answer: Capstone could be used to encrypt any digital signal, including video programming, operating at up to about 10 million bits per second. It could be used for encrypting individual video channels but not for bulk encryption of many channels multiplexed together in a single link. NSA is not aware of any government agency approaching cable companies to urge the use of Capstone. Two manufacturers have asked us about the suitability of key escrow devices for this purpose, however. 8. Encryption software is available that can be used with Clipper to encypt a message before after it has been encrypted with Clipper. This "double encrypting" risks bypassing the key escrow feature. If a sender first encrypts the message with software using DES, and then transmits the message "double encrypted" with Clipper, can tell you from looking at the cipher, or encrypted text, that the underlying message was encrypted? Answer: The only way to tell that a message has been "double encrypted" in this way would be to decrypt the "outer layer" of encryption, i.e. that done with Clipper. Only then would one be able to tell that the message had first been encrypted with something else. ----------

1 0

Re: cryptography eliminates lawyers?
by dsc＠swcp.com 17 Dec '03

17 Dec '03

Black Unicorn wrote, >On Wed, 13 Sep 1995, Dar Scott wrote: > >> Black Unicorn wrote, [snip} We seem to be having problems with the meanings of words. For example, I make a distinction between certification and licensing. Also, I see violence and coercion as being ultimately related to something physical. I'm not sure what "proper", "competent to practice"... mean. And I see a big difference in a market based monopoly and a government based monopoly. [snip] >Didn't I just say this above? > >A centralized, or several centralized authorities. I had assumed you meant by authority an agent of the state that is able to envoke or otherwise wield the physical force of the state. By a certifying entities I was refering to private organizations that had no similar power or to government organizations that had only the power to provide information. By a licensing entity I was refering to an organization that can coerce to prevent the unlicensed from doing the licensed behavior. By coercion I meant the threat of physical force or the force itself. Though one might think of physical force as applying to murder, kidnapping, slavery, assault, robbery, physical theft, I would also apply it to theft or damage of abstract property that has properties like physical property. I intend for these to apply to many actions of the state. Perhaps I erred in applying "certification" and "license" to these contrasting concepts, but I do think the distinction is important and the observation that there are fuzzy areas in between does not remove that. If I have a license from the local gang to sell drugs and the guy across the street does not, I could encourage the gang to do something and the guy might get shot. Similarly, if I was a PE and my competitor across the street was not, I could encourage the state to do something that--with several stages of his lack of cooperation--results in his finding a gun in his face or worse. >I guess the center of my question is, how can you apply Web of Trust to >e.g. a university degree. Who cares what Bob and Alice think my degree >is in, the client only wants to know from the institution. It does not matter why people would trust a certifying entity. It might have a great earned reputation, it might "borrow" some reputation from bonding or audits, or it might have ties to the Real World. > Licensing can only be done by an >> entity that can use physical force to prevent >> buying and selling legal services. > >I believe you are incorrect, but I guess my main concern is your >characterization of "Physical force." I am assuming you mean coercion, >and not that you will be jailed or such (though this may be the case). > >I would argue that as long as coercion exists (violence of any type, >physical or not) you have a licensing authority. Take the hollywood >blacklist. No one actually pushed around suspected pinko screenwriters >(well, at least, if anyone did, it was incendential) but they certainly >faced a great deal of persuasive motivation. Look at the committee as >the licensing authority here. (Licensing you as a non-communist as it were). It seems I am using coercion in a different sense. Unless blacklisting has physical force at its root enforcement mechanism it is not coercion and is very fragile. >If several governmental and private authorities were in the practice of >certifing that Bob has a law degree from Tremont University, and that he >is competent to practice in D.C., and given that the citizens of D.C. >will look for these credentials, isn't this a license? Afterall, Bob has >to pass some test or requirement to get the signatures. Isn't this >coercion in your definition? No. I apologize for any confusion. >Can't the multiple authorities set common >or near common guidelines? Rather, don't they HAVE to in order to have >their signatures worth the electrons they are transmitted with? In general, No. Under many conditions market forces make services alike, but more often competing businesses find particular market niches. I would expect that different certs would cover different levels of expertise, different specializations and different breadths of specializations. Any lawyer might have a dozen certs. I would not expect there to be a single level of certification for all applications. I know of several companies in which the primary product designer has no engineering degree. >If you take the exteme position you seem to, there's an antitrust case here. I don't insist there has to be a variety. I only desire that coercion does not come into play in preventing it. As I said, if a natural monopoly forms at times, I am not worried. >Am I not "licensing" my key signature to people provided they pass my key >signature criteria? Am I not doing violence by withholding my signature >and the benefits it might convey for certain "terms?" [snip] >This is the trap of the licensing argument. I see a big difference in withholding a signature and sending gunmen. There is no violence in withholding a signature. >The evil is not licensing, which I think serves a real purpose, but >created convenience fees, taxation through the withholding of licensing >and the use of other government largess. I wrote a massive piece on this >and sent it to the list about a year and a half ago. With interest I will >repost it. Even if no one else is interested, I'd like to see it. >The real question is how you decide what an authority to license is. Is >it to be dictated by government? Or by market forces (i.e. the >reputation of the licenser). Yes, the government vs. market question is key, but I believe the answer is in that distinction I used in contrasting terms "certification" and "license". The "who" is tied up in what the instrument is. >> >I don't see how the net will eliminate the basic need for highly >> >qualified professionals and the proof that they have credentials. >> >> It won't. The needs might shift a little but they >> will be there. > >Then why will lawyers, or a 'professional monopoly' be broken? The meaning of "qualified professional" and "credentials" will be market-based and multidimensional, not defined by the state or a group already "qualified" using the state for enforcement. [snip] Concerning a market-based monopoly, >> Not so bad if it happens, >> but much more honest, efficient and softer-edged >> than "licensed to practice". > >I'm not so sure. There will be a tremendous amount of corporate power in >these authorities, and if (as you seem to be saying a few paragraphs up) it >is hard to break into the trusted certification business, there is a >monopoly again. I don't really think this is a problem. It is the force-based monopoly and specifically the government-based monopoly I have a problem with. [snip] >Like the several state Bars? The market advantage is slight. [snip] >So you have estentially admitted that a central authority is required? >Or will be more often used? Not required. [snip] >If your defintion of license is simply who does the coercing, I think you >should reconsider. What ever the word used, I see the distinction between 1) the assertion of certain information and 2) the threat of force as being key. Perhaps, I could have use the phrases "non-coercion-based" licensing and "coercion-based" licensing, but I am not comfortable with these--trade licensing invokes too violent of an image. A note to all in government licensed trades: I recognize that licensing is part of the real world we live in. Often one has to be licensed to practice a favorite trade. I do not mean to describe the licensed themselves as violent. Dar =========================================================== Dar Scott Home phone: +1 505 299 9497 Dar Scott Consulting Voice: +1 505 299 5790 8637 Horacio Place NE Email: darscott(a)aol.com Albuquerque, NM 87111 dsc(a)swcp.com Fax: +1 505 898 6525 http://www.swcp.com/~correspo/DSC/DarScott.html ===========================================================

2 1

(NOISE) Re: White House M
by damion.furi＠the-matrix.com 17 Dec '03

17 Dec '03

|> Maybe so, but we don't have to like it. And I don't. But |> it's not so much their access, per se, that I object to. F|Why the hell do you care ? Someone has a home page for something on the Web. |Someone at the White House looks at it. So what ? You object to the fact |that somebody in the government has a Web browser and *gasp* uses it to read |stuff on the WWW ??? What did I just write? It's not so much their access... |> It's their potential intentions, F|You take moral offense to what you think someone else _might_ be thinking ? Not normally, no. But I've found a number of reasons to take offense at more overt government actions, and I see no reason not to take offense at obscure government actions. Especially when it involves spooks (NSA, DOD, military branch agencies, CIA, FBI, DEA, alphabet soup agency of choice). |Sounds like you believe in thoughtcrime. Banned any good books lately ? I _DO_ believe in thoughtcrime. I think it's a goddamned crime when some dickhead with more power than sense attempts to limit the actions of private citizens, in complete disregard for the idea of "presumed innocent until proven guilty." If someone so much as THINKS this, I have a problem with them. Now, go fuck yourself. F|> all things considered, and |> the fact that they aren't at all open about such monitoring. F|This is absurd. You expect the White House to issue a press release every tim |a staffer clicks on a URL ? No. I want to know what they're monitoring on a general basis and why. It's my tax money, too. But they aren't open about the monitoring. Half the time they deny doing it at all, and the rest of the time they come up with a few dozen specious excuses. furi(a)the-matrix.com pgp-public-key(a)demon.co.uk C1225CE1 RADical 1 Systems - Multi-Platform Custom Programming, Service, & Support

1 0

Re: Whitehouse "dissident" web site monitoring?
by Rich Salz 17 Dec '03

17 Dec '03

>Seriously folks I'm very pissed about the abuse of log file information. The What abuse? Is there an expectation of privacy in Web-world, such that all users can honestly expect that a site is compelled to keep its "visitor log" private? Surely not.

4 3

Re: An opportunity not to be missed
by Frank Stuart 17 Dec '03

17 Dec '03

>It has occurred to me with the approach of the presidential campaign >in the US (and its attendant press frenzy), that there is an an >unprecedentedly vast opportunity to bring certain items on the >cypherpunk platform into the public spotlight. [...] > Candidate Posturing Required Spin > ----------------------------------------------------------------- > Pro-business, tough on crime anonymous crime tip e-mail > a la Fed whistleblower stuff, > and the SPA [...] Now that you mention it, it seems to me that completely anonymous tipsters with the ability to receive ecash rewards would likely be a bigger boon to law enforcement types than would easily tappable communications lines. Is anyone in a position to set up a cypherpunks CrimeStoppers mailbox (for use through the remailers)? You could set up a web-page with instructions and a list of crimes for which there are rewards. Perhaps some civic organiztions would be willing to donate money for tips leading to arrests and convictions of any crimes. Even if it doesn't catch any bad guys, it'd be great PR for strong crypto, anonymity, ecash and whoever runs it. | (Douglas) Hofstadter's Law: Frank Stuart | It always takes longer than you expect, even fstuart(a)vetmed.auburn.edu | when you take into account Hofstadter's Law.

1 0

Re: Software vs Money Laundering
by madden＠mpi-sb.mpg.de 17 Dec '03

17 Dec '03

Duncan Frissell's email (Sep 13 17:52:55), in reply to John Young, gives some problems regarding an AI screening program for detecting illicit electronic money transfers: > Not the least of which [problems] is that money launderers can use "AI > Software" to generate a stream of real and dummy money transfers that > emulates "normal" money transfers. Not to mention the fact that > monopoly money transfer networks that can be surveilled by the Feds > (FEDWIRE and SWIFT) are not long for this world. They will be > replaced by encrypted, open, net-based systems. There are also more basic problems. An essential initial stage in the development of such AI programs, a kind of expert system, is the analysis of the behaviour of the human "experts". In this case the experts being the willy money launderers. The program can then, aledgedly, spot all those trademark traits of the money launderer and nab him/her. Trouble is, the program therefore represents a kind of blue-print of what the aspiring money launder should *not* to do when making illicit electronic money transfers. Any "expert system" that operates by recognizing, and acting upon, human behaviour (regardless of whether or not that be on the net) can be foiled by altering, or disguising, that behaviour (the "dummy money transfers" mentioned by DCF would be one way of duping the system). Of course, the officials at law will claim rousing successes and cite numerous convictions -- but as with the drug trade, that will only be the tip of the ice-berg with no real clues as to the size of the base. The tip of the ice-berg will simply be what the AI program has succeeded in formally "capturing". Pete ================================================================= Dr Peter Madden, Email: madden(a)mpi-sb.mpg.de Max-Planck-Institut fuer Informatik, Phone: (49) (681) 302-5434 Im Stadtwald, W-66123 Saarbruecken, Germany. Fax: (49) (681) 302-5401

1 0

DD, pedaphiles, and Terrorists, oh my
by Pat Farrell 17 Dec '03

17 Dec '03

Today's Washington Post (9/14) has a front page article on a bust of 12 computer using pedaphiles. NBC news is saying that Janet Reno will have a news conference later this morning. Tomorrow near NIS&T, the workshop on the Federal Key Escrow Standards will be held. Coincidence? Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

3 2

WAS_tem
by John Young 17 Dec '03

17 Dec '03

9-14-95. NYPaper. "Use of Computer Network For Child Sex Sets Off Raids." The Justice Department today announced a dozen arrests in a two year investigation into the use of America Online, the country's largest computer network, to distribute child pornography and to lure minors into sex. The culmination of the inquiry by the Federal Bureau of Investigation comes at a time when the agency has needed some favorable attention to offset a string of incidents that have cast it in a negative light. "Scientologists Lose a Battle on the Internet." Upholding free speech on the Internet, a Federal judge has ordered the Church of Scientology to return computers and files seized here last month from two men who used a computer bulletin board to disseminate information critical of the church. The equipment belongs to Factnet, an anti-Scientology bulletin board run by two Boulder men, Lawrence Wollersheim and Robert Penny. 2x: WAS_tem (16 kb)

1 0

Re: Scientology tries to break PGP - and
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- re: >[snip] >> When the safety is finally removed from the gun at your head (sorry for >> the drama) you hand over your alternate secret key. If decrypted with the >> "alternate" or "fake" secret key, the encrypted file is wiped until it >> reaches a marker; the remainder of the file is displayed. If you use your >> "primary" or "real key", the extraneous text is simply stripped. Instead of stripping, how about adding an offset to the start and end of the ciphertext to each encoded idea key. This way, I can send text A to key A, text B to key B, C to C and so on. As long as the recipient and I have agreed in advance on which key to use to exchange the real message, who can say otherwise? If code words are used in all the messages to refer to any illegal acts, ("ship me 30 kilos of smack" might be a tad incriminating) how can anything be proved even if the recipient is compelled to divulge their key? An added advantage to this scheme is that if properly used it should help throw a monkey wrench into traffic analysis by the nosy. If I regularly exchange encrypted messages with several different recipients, I can enclose a seperate plaintext for each, make one massive combined cyphertext and send it to all of them. The ones I have no instructions or trade secrets for today will each receive "Ignore this message," followed by a randomly selected random number of fortunes or other random data (so each message to be ignored will have different length different plaintext to further thwart analysis). This may be combined with stealth PGP headers to make it difficult for LEAs to determine all recipients for the purpose of getting a subpeona for their keys. Joseph Block <jpb(a)miamisci.org> "We can't be so fixated on our desire to preserve the rights of ordinary Americans ..." -- Bill Clinton (USA TODAY, 11 March 1993, page 2A) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMFek8mGnwFiC3O2NAQGx0QgArERNVabtUY3MMDaDfjFn+Jg4ZGQcV4oD 47qJDFqW4riQ6LtQW3YiptkVl/jGJcwzEyRTAb4v6mYeIXwaQi4Or0C041ADLGMo RzB/tIIQSsF+oQYEI/lHL1t8jYi4737oU2BJrUJvgahsNS0V7TBTEtGhdDWFDjk9 bd74f//lJCmnvq/gqV02KqB0zL1YGAXoXLzzhZEMk3T2cxm9n5oRZX82zT4tCV0Q Cw1jW7ZT+Bsaa099RJ7HvLQI4fqMeI7+NoBwhhtpZ/Iy8OWmEhaOz4Z50cZcbxf1 Ol6xMKXdHBVqK41cm7lyoH7Tpt7Zw1bSq4svONm6v2urwn9R9JHn+Q== =8BlI -----END PGP SIGNATURE-----

1 0