December 2003 - cypherpunks-legacy

Is there a lawyer in the house?
by cme＠acm.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Date: Sat, 2 Dec 1995 03:39:00 -0500 (EST) >From: Black Unicorn <unicorn(a)polaris.mindport.net> >Subject: Re: Netscape gives in to key escrow >An individual has no legitimate expectation of privacy in the encryption >numbers in his GAK browser, we reasoned, because he voluntarily conveyed >those numbers to the government when he purchased the software. It could be even worse. I was on a panel last year with Scott Charney (sp?) (I believe from DoJ) during which he commented that if you give your secret key to anyone -- e.g., your own company -- then you have given up the presumption of privacy. That leaves the police open to get that secret without a warrant. This claim should be checked by a real lawyer. +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMdbP1QXJENzYr45AQF64QP/dXHnfLuh6FFwCY2GxKNYC5lHlj/hcFmy KqwWLYVqyr5vf/ZFEA6wlnVRMAARnenfCDmu7XQ9v9YzRjVrpjQMQAFrl9qlBivB 5wFGYSLME9sVtKIIPR0YSV8Xbw613bLmEnKiGrXxPNQ/bkaO30WOxG3N9Oen9DX4 sFfVbA+Ek0c= =CEEO -----END PGP SIGNATURE-----

3 2

(no subject)
by Nicholas Philp 17 Dec '03

17 Dec '03

WE WANT SOME PUSSY PICTURES

2 1

Re: Micro$oft and Java
by leefi＠microsoft.com 17 Dec '03

17 Dec '03

| The interesting thing here is a plan to use digital signatures on | controls and scripts as a means of authentication. There was a press release on this. The PR index on http://www.microsoft.com/corpinfo/pr.htm points to a few Internet-related announcements that were made on 12/7. A brief quote on these signatures: "Microsoft plans to propose the Internet digital signature specifications to the W3C and the IETF as an open Internet standard. The technology will be an open, proposed specification available to the entire Internet community. In addition, as part of the Open Process Design Review, Microsoft will host a digital signature design preview in January to solicit feedback from the Internet community." This week there was also another workshop for ~150 ISVs, and these signatures were one of the topics. The event was not under any NDA, so you should start seeing feedback once folks get home and they catch up with mail (at least two were on Cypherpunks). The folks putting on the event have put lots of docs on the "Sweeper" SDK, on the below-referenced web site. Honestly, I'm not sure if all the stuff from the event this week is up there; if not now, most of it will get added in the next week or so. | Servers and some clients will support end-to-end encryption. No details... I believe SSL in current versions of the web browser and server, PCT around the corner (perhaps PCT is earlier than I'm thinking). | Maybe I'll test the search capabilities of the MS Web site later tonight. The clearinghouse for internet developer info (opened 12/7): http://www.microsoft.com/intdev/ It contains info on various VB Script, OLE Control, etc, as they refer to some of our Internet solutions. A page related to this press briefing (I presume also opened 12/7): http://www.microsoft.com/internet/ Hope this helps, Lee Fisher (wondering if I really should've de-lurked)

1 0

Re: Solution for US/Foreign Software?
by Oliver Huf 17 Dec '03

17 Dec '03

> or rational here.) The issue is that, unless written very carefully, > the crypto-less software is a "component of a cryptosystem", > and therefore still requires permission to export. Thanks for the hint. Oli.

1 0

Secrets (was:Is there a lawyer in the house?)
by Adam philipp 17 Dec '03

17 Dec '03

There seems to be some confusion about what the law of the land considers a "secret." Secrets according to our laws are knowledge one doesn not share without a BINDING legal obligation to keep the secret. Remember R4.C? That was a secret until it was shared, and hence lost its privileged position as a "Trade secret." Your secret key is just as safe, so long as it is always kept out of anyone else's hands. However if you are going to provide it to someone else it should be only through some form of contract. Even this might not be sufficient in some circumstances. The only truly safe possibility would be giving it to your lawyer in the course of your lawyers representation of you. NOTE: NOT YOUR COMPANY'S LAWYER. In house council have their obligation to the company, not to you. As such if they felt your key was unrelated to company business interests and possibly adverse to the company's interest...kiss that secret good bye. Sure, the police still need a warrant to go into your house and get the key, but they do NOT need a warrant to ask anyone else for your key, if you revealed your secret to someone who does not have an obligation of confidentiality to you, then they can reveal it with impunity. The danger of revealing it to a nonlawyer who has a contract with you is that they can be forced to reveal it, and still be liable to you for breech of contract... I am sure you see the dangers...just say no to key escrow...much safer. -Adam [NOTE: I am not an attorney, this is not legal advice, you get what you pay for] --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\ |PGP key available on my home page|Unauthorized interception violates | | http://XXXXXXXXXXXXXXXXX/adam |federal law (18 USC Section 2700 et| |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-|seq.). In any case, PGP encrypted | |SUB ROSA... |communications are preferred for | | (see home page for definition) |sensitive materials. | \-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-+-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-/

1 0

Re: Is there a lawyer in the house?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:27 AM 12/8/95, sameer wrote: >> > You mean if you give me your key the police can get it from me without a >> > warrant? What if I don't want to give it up, and you don't? How would the >> > police get it without a warrant? >> >> Yes. Unless it could be shown there their was an expactation of privacy >> in the transfer, or that there was an understanding that you intended this >> to be a confidential matter. Or in the alternative, that the > > I do not understand. > >Alice has Alice gives Bob her key. Cop wants Alice's key. Cop tells >Bob "I want Alice's key, you need to give it to me. I don't have a >warrant." > >How is this different from >Bob has key. Cop want's Bob's key. Cop tells Bob "I want your key, >you need to give it to me. I don't have a warrant." > > > sheesh, what a fucked up legal system. ^^^^^^^^^ EXON WARNING! This message has just exposed the author, the toad.com system, and all those who pass it on to fines of not less than $10,000! But I share Sameer's confusion. If cops show up at my door, they must, it seems to me, present proper warrants before they can _enter_ my premises, or _search_ my premises. Something given to me, whether a letter, a key, a photo, etc., is essentially *my property* and may not simply be taken away from without due process. I hope Black Unicorn is incorrect in his point. --Tim Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

the X.9 Electronic Payments ANSI standard
by sameer 17 Dec '03

17 Dec '03

My inquiries regarding Rich's post of the X.9 informal notes were rather fruitful. The chair of the working group seems interesting in including anonymous token-based payment systems in the standard, "I see no reason, other than interest, for the group to avoid non-account-based payment systems, to complement the account-based payment systems that we are now in the process of standardizing." Someone from Citicorp pointed me to http://www.llnl.gov/fstc and asked for my feedback. These people do seem interested in anonymous systems, they just don't have anyone who knows the stuff to work on it. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

2 1

Re: Cyberia-L Archive [was Re: ERA_sur]
by The user formerly known as Leslie Todd Masco 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.ULT.3.91.951206142028.4575V-100000(a)Networking.Stanford.EDU> you write: >As somebody pointed out to me, Cyberia-L, like cypherpunks, is archived >on http://www.hks.net/ and the public news server nntp.hks.net. !!! As far as I know, Cyberia-L isn't accessable via http from us. Please let me know if it is...if so something's very misconfigured. The nntp part is correct, though. And a bunch of the lists might soon be added to the http archives: cypherpunks is the test message base for it. >Now send them some of the money you're going to make from the stock market. That'd be way nice... Small unmarked bills are preferred. - -- Todd Masco | "life without caution/ the only worth living / love for a man/ cactus(a)hks.net | love for a woman/ love for the facts/ protectless" - A Rich Cactus' Homepage - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMgBryoZzwIn1bdtAQGB3gGA15WO7RLcosT3hrjEJN9d0H6Fk0fMu4lG E/cw+h9YZcB6Nk0jiURfceCkBSz4+JSC =TnoU -----END PGP SIGNATURE-----

1 0

Re: Is there a lawyer in the house?
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Timothy C. May wrote: > Sameer Parekh writes: > >How is this different from > >Bob has key. Cop want's Bob's key. Cop tells Bob "I want your key, > >you need to give it to me. I don't have a warrant." > > > But I share Sameer's confusion. If cops show up at my door, they must, it > seems to me, present proper warrants before they can _enter_ my premises, > or _search_ my premises. Something given to me, whether a letter, a key, a > photo, etc., is essentially *my property* and may not simply be taken away > from without due process. What's important here is the difference between things and information - if the cops want to get *things* in your possession, they need a warrant or consent or exigent circumstances or whatever. If they want to get *information* in your possession, they can subpoena you and make you talk (or show them the papers/records/whatever, modulo the Fifth amendment, modulo immunity). Either way, the standard for due process (essentially nothing for a subpoena - "more likely than not will lead to the discovery of fruits of/evidence of a crime" for a warrant) is pretty minimal. But, it's worse than that: as a matter of federal law, if I write "I, Greg Broiles, killed Jimmy Hoffa and hid his body in one of the concrete columns used to construct Giants Stadium", and give that piece of paper to you, and cops search your house illegally and find that scrap of paper, the information on the paper (if not the paper itself) can be used against me, even though it was found in an illegal search. I wouldn't have "standing" (e.g., a legal basis to contest the search) because federal law doesn't think I have a privacy interest in the stuff in your house. I think that's the tricky bit behind the idea that there's no (personal) expectation of privacy where a key is given to an escrow agent - the standing requirement. State constitutions and statutes may provide a higher level of protection - Oregon's constitution, for example, is interpreted to be more generous re who's got standing to contest the legality of a search. It occurs to me that the owner of the key might have a good argument that they've got "third party standing", where they can essentially adopt the position of the key's owner, because the key's owner is in a position such that they can't do a good job of representing their own interests, and the third party will. (e.g., the doctor(?) in _Eisenstadt v. Baird_) The owner of the key (at least if they're anonymous, and the key server is served with a subpoena to "disclose the 'true name' of the owner of key 0x58ddf30d") may wish to avoid revealing hirself. Hmm. That, of course, assumes that the escrow holder feels like fighting the subpoena - perhaps that's something to look for when you go escrow shopping. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMgNC33YhjZY3fMNAQGPPQP+M7IFM/DgfEf6z5f8YUoBHo+aXPfTzwtf xee1SPkJOxfH7dYaUIKs7JDAKxOGTaNdrlJjrMno7yHVFVHq6R7wRw8jOPUXhJ3C VZ94LpTqNF6OPPoD+pr2MFG+SaFLl7JyS16Kbe9ilUE5cG6N2hToUibSjwyz3BKc R95RR9TkRzs= =4jN1 -----END PGP SIGNATURE-----

1 0

Re: PGP
by john.ellis＠wmcmail.wmc.ac.uk 17 Dec '03

17 Dec '03

Does anyone have the source code for PGP (DOS) not Unix, ______________________________ Reply Separator _________________________________ Subject: PGP Author: Daniel 'genius' Charpentier <drcharpe(a)hamlet.uncg.edu> at internet Date: 06/12/95 18:29 -----BEGIN PGP SIGNED MESSAGE----- I've tried to find out the answers to my questions myself but I haven't been very successful. Actually, I haven't been successful at all. First of all, I've been using PGP on my computer but when I tried to port it over to my unix account it didn't work. I took the source code and tried to compile it using the unix g++ compiler but it gave me all of these errors. Where can I find PGP that is already compiled for unix or at the very least will compile for unix? Secondly, if I create a program that makes using PGP more user friendly can I let other people have it ( for FREE )? Lastly, what is considered overkill with cryptography? I don't believe anything is. My programs accept what the user inputs for how large prime numbers should be ( my public key programs ) but I make them able to accept values that go up to 30720 bits ( I don't believe a number can ever be large enough ). You can never be to safe...never. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMMXVhDMGe42brZbVAQEo/Qf7BSshqKJAmxVzyGSyAp2Qkj+/dqh1Zon1 xDqMnvU6ihLimHZ/uXGiQE2jM6N8FRbYu7psQ/iPJ+gX5/VKfrxlxjCfDM0Jx2s9 vucgMQz1KYbELA8Fo1QUEsDuTMzJ80VoTicXfZZmILhr7cBJH4pHa5RgkgrS2Lun iodQ+F7BXdio86TnctQgoKJ+78qOYDuV4Vfha/a290ZoZmPRcqArYv7tU6X3KMjf DGxqgugiwpHnkTO1B9wypoePbbJZSNzFYYvZKMI8Ntg7yFkMl/lSxcLh6oYq0ACe R9NfZR9x11H/fIrn8HZlq0Q86OptWhZz53p77VNN+sVZJOktHJIWqg== =WK6x -----END PGP SIGNATURE-----

2 1