December 2003 - cypherpunks-legacy

Re: NYT on GAK
by Duncan Frissell 17 Dec '03

17 Dec '03

> "If this fails," said a figure familiar with the > Administration's thinking on the proposed change in > cryptographic policy, "it's going to lead to a very > divisive debate. And the irony, for libertarians who oppose > key escrow, is that if it fails, I am convinced that Louis > Freeh cannot be true to his job without proposing domestic > controls on data encryption." > > "He's not going to give up without a fight, and neither is > the Justice Department," said the figure, who spoke on the > condition he not be identified. It worked during WWII but will it work now? After all, locking up Japanese Americans worked during WWII, but would not work now. Note that the NSA abandoned their "born secret" stance on cryptographic technology when it became impossible to sustain. And when R, S, & A together with MIT decided to publish "A Proposal for a Public Key Encryption System" in spite of NSA threats, the Agency folded. That represented a genuine surrender. We'll see if Louis has more balls than the NSA did. Widespread resistance is likely. Court tests will be entertaining. At this point in the discussion, someone always pipes up and says that even if cypherpunks fail to obey a crypto ban, businesses will fall into line like the good sheep they are. This prediction ignores some important facts about modern businesses. First, many small businesses already routinely ignore government mandates in hiring, the use of independent contractors, environmental regulation, and taxation. These entities can be counted upon to resist crypto controls as well (if they feel like using crypto0. Second, a growing number of businesses are headed by explicit libertarians or right wing nuts. These people have already engaged in a lot of resistance to crypto regulation and can be counted on for more resistance. Additionally, if strong crypto confers a competitive advantage on users, use will be encouraged. Does anyone have a handle on exactly how a crypto ban would be carried out. would regulation (if so, which ones) or legislation be used? The exact details will make a big difference in considering avoidance strategies. DCF "Blatant Advertisement --- If anyone needs someone to string 'words in a line' for them, my services are available."

1 0

Re: NSA/NIST Security Lab
by Peter Trei 17 Dec '03

17 Dec '03

Uran233(a)aol.com wrote: > Yes but the NSA really wanted the Skipjack for DOD messsages. As I recall, only for sensitive but unclassified data. >They (probably) monitor all of those anyway. Tessera/Clipper had built-in GAK, so a backdoor would have been redundant. > But Matt did alot of work on his project but did > he show how to brak Skipjack and does this totally trash the Fortezza > program? No. He showed that with a bit of work he could fake the ID of the chip sending the message. He did not 'break Skipjack' in any way. He did show that the protocol (which used Skipjack for bulk encryption) was incompetently designed. Get a spellchecker. Peter Trei trei(a)process.com

1 0

NIST Hat Tricks
by John Young 17 Dec '03

17 Dec '03

Pat, A response to the quote below from your NIST Key Escrow web site: I got the full Discussion Paper #4 with all ten criteria from the main desk, along with others that seemed to be appearing as the day passed. (I'll fax a copies of any of the handouts to anyone wanting hardcopy. We scanned all handouts.) In breakout session B-2, we were also given only that part of Paper #4 that dealt with our session's criteria 3, 4 and 9. It was passed out at the end of the meeting after discussion had ceased. We did not get a chance to discuss the "example potential solutions." Strange procedure: it seemed as if NIST was sleight-of-handing prepared backup papers as if they anticipated resistance. Maybe there would have been more concessions or more rabbits pulled from the KE hat if there had been even louder "brrrrat-GAK." Never too late to ask for those other trapped bunnies. ---------- [Excerpt from Pat's web site]: * During the first breakout session, in the technical discussion of criteria # 5 and #6, an authorless (presumably government issued) "Example Potential Solutions" paper was distributed. It caused a lot of grumbling amongst the attendees, as they were supposed to discuss it, without any prior chance to read or react to it. Here are two versions of it, First, Anonymous Sample Solutions (HTML by PDF) and a simple ASCII version Sample Solutions (ASCII text by John Young) I have not seen an electronic version of the paper that I received. It contains the following paragraph: "Example Solutions to export criteria 5 and 6 are indentified below to help give a better feel for approaches that implementors may take to satisfy the criteria. The information in this paper is not intended to represent fail-sfe, cookie cutter solutions to the criteria, but only to generate more detailed discussions." It is also interesting to note that John Young has an electronic document with all of the sample solutions (a solution for each of the ten criteria. I never saw a paper document with all ten solutions. The one that was handed to me had only two criteria, #5 and #6. I talked to attendees of other breakouts, and they had received nothing.

1 0

Re: question about reputation
by Jonathan Zamick 17 Dec '03

17 Dec '03

Actually about a year ago I was working on a project to help merge electronic tokens and 'reputation'. The idea was to reinforce contributions to the net and acknowledge them in a tangible manner The classic method of gauging respect has become more difficult as the growth of the net has resutlted in a surfeit of citizens who simply haven't learned the idea of contribution and net community, nor how to judge the level of respect that others have. We'd seed a certain # of tokens amongst FAQ maintainers, moderators, and those who are active in helping on lists and forums. A group would be chosen to help decide how to split up the seed tokens. This group would not be eligible for any tokens themselves (they'd be selected from those we felt were the most active, oddly they'd be earning old style respect, that is contributing their time in distributing tokens without being able to earn any.) Still under discussion was how to bring more tokens into the system. One was to continue to distribute tokens based on a standard for certain actions and further nominations as judged by the council (which would change membership itself over time.) The second was to have an actual foundation set up to accept contributions to be distributed to other net related non-profits. Thus for those who don't have the time or knowledge base to contribute to the net, they can actually contribute money to aid net-related groups. The tokens could be exchanged when people answer questions, as favors. Part of the money from the foundation would be to have gatherings which would 'cost' tokens, so those who have put in their time and labor could mix and listen to speakers, enjoy a nice dinner, etc. Anyway, just interesting to see the topic come up now in the Cypherpunk community. At the time, there were still some barriers between the objectives we were given by different people paying our own checks on the matter. Perhaps the idea of 'Friends of the Net' is now more pertinent. Feel free to drop me some email or cc back to the list. If enough people are interested, I'll look into the subject again. Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

1 0

Re: Europe puts pressure on FCC over accounting rate moves
by John Young 17 Dec '03

17 Dec '03

Tim May wrote: >(Note to Greg Broiles: You will undoubtedly claim that I should check my >facts more thoroughly before sending this message. When you start paying me >$150 an hour (cheap by attorney's inflated fee schedules) I will promise to >spend an extra 10-20 minutes per post doing Web searches to verify trivial >details.) Announcing Black-and-WhiteNet (256-Gray, plaid, checkered, houndstoothed) Op Center (B&WOC(256-GPC-fang) which will minutely trivialize the most astoundingly paramountly important tics, quirks and quik-$$$ ever Da Vinced by CCLs of evil-elvis/chemical/dietary/genetic/ethnic/racial/politco-military imbalances (CCLoE-ECDGERP-Mi). The service is Free!, absolutely EARwig-ITARpit authenticatable, sworn on the blorb's newsracks and constitutions for others' genocide and beloved family whack how-tos and inter-related inter-dependent folderol for sanctioned revenge mayhem and It-made-me-do-it salvation and self-rammed lead up hoof-pop and oral rot. Now, read on for the good $tuff: Thanks to limitless contributions from the global media, open and secret Orders, trade and NDA assocs, retired and active members of gov/mil/edu/net/orgs, the service will leap to shell out data-haven-quicksands of unlocateable e-shekels to anon-remailer-informants for information leading to the entrapment and vaporization of the supremely urgently destructive demolishers of all other contenders for impeccable veracity and bottomless shamlessly vainglorious product promo and faithhealing celebrity implanation/enhancement. Exes of orgs specially trained to cheat, lie, steal IP, walk on grannies, etc, and even more so, the double, triple and bypass XXs of all spinoffs and spin labs, are especially welcomed for dangling as irresistable bait for like super-peepees and wannabes seeking Dow-Corninging (D-C Net-neutering, unexpected down migration to nether parts, career redirection to geek show Oprahing). Persons licensed or regulated for betrayal of the public interest for self-shame, that is, all who are licensed, regged, SSed and uniformed, get, believe it, only you, to-the-trade-only discount/stipend/D-C-reimbursement commensurate with the maggot-chewed-brain challenged (degree-ed, credentialed up the kazoo, failed nontheless no matter repetitive public cry and beg for understanding) of the higher prefontal .edu-tree-chewers, arch and anarch contenders with the Grand Order/Temple of My Maggots are Better Than Your Maggot (itself being voraciouly gnawed and underminded by The Terrible Terroristic Termites, Thine Own Enemy Within: Envy Eating Mine Own Soul Food(T5OEW:E2MOSF [not that OSF])).

1 0

Re: Digital Fingerprinting
by cman＠communities.com 17 Dec '03

17 Dec '03

Hal Finney writes: >I'm not sure how to do it for software, but for novels it should be easy >to fingerprint. Every couple of pages the author writes a sentence twice >in different forms. This would not take a great deal of extra effort on >the part of the author. Software can then choose from the alternative >variations in different patterns to produce a unique fingerprint for >every copy. > One of the points that I'm exploring is "what kind of transformation makes for an un-fuzzable fingerprint bit." This example seems to fall into the same bin as the "two cameras" approach; the two sentences come out of the author's head in the same way that the two cameras are pointed at the same piece of reality. >There would seem to be two approaches to removing the fingerprint. >One would be re-writing every sentence in the novel. The other would be >to collect enough copies to identify all of the sentences which have >variations. Most of the mathematics of fingerprinting research is >oriented around figuring out how many different points of variation there >must be to be secure against a certain number of copies of the >fingerprinted item being compared. Right. All of these approaches, however, assume unforgeable bits, either by obscurity of insertion, or by means that are analagous to the "two cameras" approach. I'm trying to come up with a robust definition of "two cameras-ness", any suggestions appreciated. > >Perhaps a similar approach could be applied to software, where in many >cases a couple of statements could be trivially interchanged, or other >kinds of simple transformations could be manually generated. Those >could be marked by the programmers without too much extra work. > The problem with changes like this is that if they're trivial enough not to require retesting, etc., then once hackers know the accepted range of modification, they can completely fuzz them up. Various other schemes such as reordering object modules fall into this as well. The problem with software is that it can be reverse-compiled, then compiled again. Unless you're willing to define a series of branches that really do different things (and are not so trivial to be expressed as algorithmic variants), then bits can be fuzzed. If you _do_ write these branches, you are in for a rough time when it comes time to do quality assurance on your software.

1 0

crypto confrontation
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

regarding the NIST policies on cryptography being shaped at this moment, an idea occurred to me. one of the most important aspects of protest is getting the public to be on your side. right now the american public is pretty indifferent about the cryptography issue, but there could be some very graphic situations that would help bring it out into the limelight even more than it is at the moment, and make anyone promoting government key escrow seem like the bad guys. the minor protest going on with the Perl t-shirts is really fantastic (last count, ~700 shirts out the door), but what really brings an issue to the forefront of american consciousness (i.e. the media) is *confrontation*. picketers in front of buildings clashing with police is almost guaranteed to get a little media coverage, almost no matter what the issue. now, some day we might reach this point with crypto rights. it would be quite a spectacle. (I'm sure people would argue against it here, but IMHO even a simple demonstration of a few dozen people might do more for widespread public consciousness of the issue than a million lines of code on an FTP site..) -- in the meantime here's another possibility: suppose that a software company intentionally set up a situation where they are exporting a cryptographic algorithm out of the country. and they have filming crews on hand when the bad-guy customs agents or whoever stop the truck at the border and confiscate the software. have the reporters asking questions like "why are you confiscating this"? "answer: this is classified a munition". this could really be a fantastic segment for Hard Copy or any of the other trashy tabloid shows. just a confrontration for confrontation's sake, with nothing resolved, just a lot of people pissed off at each other, and the end result the viewer coming away saying, "what a disgrace!! somebody should do something!!" I mean, imagine a segment where you see the customs officers pointing guns at a truck driver or whatever (that would *really* be optimal), and them breaking into the truck to pull out the software. the reporter could say, "what's so deadly that's in the box??" and pull out a computer disk. sound bites of people outside the country saying how they want to use the crypto. a nice businessman in a tie, in the middle of an office with hardworking suits and ties. "we're not criminals!! we're trying to *protect* ourselves from criminals!! but your government won't let us!!" other sound bites: joe sixpack goes and buys crypto package from Germany because he doesn't have to put up with illegality and uncle sam. shots of massive Microsoft and an executive or programmer complaining how they can't put the code they want to in their programs, that users *want*, that would solve these horrible hacker problems that the country is having, because uncle sam is interfering. other scenes: businessmen calculating how much the U.S. software market (which, BTW, we are premiere in the world in) has already lost in sales, or could potentially lose on the information highway. "my company personally had [x] ready but could not release it. [y] was delayed [z] years for approval. we estimate we have lost [a] and have had to hold off hiring as much as [b] people". (the actual numbers should be as close to reality as possible, but from a PR point of view don't even matter!!) much made of how the Internet committees are now ignoring the US recommendations that require escrowed crypto. "the U.S. may ironically become only a inconsequential rest stop on the information superhighway of the future" much FUD about how the US could become a "backwater in cyberspace" because of these policies. etc!! lots of hype about how cyberspace will become the very basis of future global economies, and that anybody who opts out will be slitting their own throat. also, crypto being absolutely essential to secure transactions. in fact, if we play this right we could even get a new kind of semi-conventional wisdom into that easily-manipulated thing called the public consciousness: "hackers can be foiled by good crypto. the government is killing good crypto. therefore hackers are proliferating because of the government!!" plus, you could throw in the Phil Zimmermann thing too, although that might be overdoing it. as for all the bill of rights angle and those kinds of things, those could be put in there, but remember that people generally hate lawyers <g> -- actually, I'm actually rooting for PRZ to be indicted. an acquittal would be extremely costly, but it could really bring the key issues to the forefront of the american or even world consciousness. hell, it would beat the OJ trial any day in my book!! and in fact it might be just the ticket to the kind of mainstream journalism that could really tip the balance of public opinion. (the press is pretty sleazy, I admit, but it is a *monster* machine that one might be able to trick into working for you!! in fact, I would consider that quite the ultimate hack in social engineering!! any weenie hacker can con a phone repairman, but can you trick the whole U.S. media system into telling the public what you want it to hear? sounds like a real challenge to me!!) and BTW, I am aware of how DJBernstein and others have various lawsuits and FOIAs against the government. but I don't think these are really penetrating Joe Sixpack's brain, when that is really where the battle lies. and Joe Sixpack doesn't understand esoteric things like the bill of rights, the constitution etc.-- but he does understand pictures of police confronting someone who doesn't seem to be doing anything wrong and is arguing in favor of something good for america. you might think, "what does public opinion have to do with government?" answer: a lot. if in a public poll, a large majority were in favor of releasing crypto regulation, you can bet that the "which way is the wind blowing NOW?!?!?!" politicians (that is, all of them, <g>) would be scrambling to appease the public. even Clinton has a long record of merely going with what is politically expedient. I can fully imagine him defying key law-enforcement agencies if the public was more in support of good crypto. and, if we can get scenes like what I'm talking about, that day may become a reality. I continue to believe that the way to really hammer the issue and get what we want may amount to a kind of "psychological terrorism": "propaganda" on television that promotes our cause to joe sixpack, and simply honestly tells what is at stake. (that's the beauty of our position, is that even the simple truth is very powerful propaganda-- in fact that's how you can generally tell if you are on a side that is likely to win in the long run!!). there are many here who will argue for less confrontational approaches, about not getting anyone upset, about not trying to paint anyone as a bad guy, about just opting out of a "hopeless" political process, about how the whole US system is so screwed up anyway that we're all pretty much screwed when it comes down to it, etc. ad nauseaum, ... but IMHO a pound of nonconfrontration is worth a feather of confrontation in the long run. and I continue to believe the confrontation, while a bit messy and unpleasant at times, will really get the ultimate result that we want: (1) widespread public consciousness on the issue, (2) widespread support of our side. again, the code distribution is great, but in the long term, I continue to believe that public opinion is ultimately what runs a government, and a tyrannical government cannot exist without the tacit support of the population. I applaud the Perl t-shirt sellers for their great victory but suggest that greater victories lie in waiting. how about a demonstration of a bunch of people wearing the shirts, for starters? --Vlad Nuri

2 1

Re: Europe puts pressure on FCC over accounting rate moves
by John Young 17 Dec '03

17 Dec '03

So-called John Young wrote: >Tim May wrote: >Announcing Black-and-WhiteNet (256-Gray, plaid, checkered, houndstoothed) >Op Center (B&WOC(256-GPC-fang) which will minutely trivialize the most Not that it matters, but this is not mine. But not sure how to prove it, probably best to not try to be serious and thereby reify parody self-parody, self-parody, self-parody.

1 0

More NIST presentations available
by pfarrell＠netcom.com 17 Dec '03

17 Dec '03

I've collected more presentations and comments for last week's NIST GAK meeting. I've got CDT's presentation and new policy response, VTW's presentation, and David Lesher's post from talk.politics.crypto. htpp://www.isse.gmu.edu/~pfarrell/nistmeeting.html is the starting point. If you seem more, please forward it to me. Thanks Pat Pat Farrell grad student http://www.isse.gmu.edu/students/pfarrell Infor. Systems and Software Engineering, George Mason University, Fairfax, VA PGP key available via finger or request #include standard.disclaimer

1 0

itar question
by Todd Ackman 17 Dec '03

17 Dec '03

Hi. please excuse if this is an inappropriate place to ask this, but what the hell... If I create a set of patches to a PD or GNU software package (i.e. telnetd, httpd) to support encryption (in particular SSL), can i put the patches up on an ftp site, Or would i be in violation of itar, and therefore risk getting hauled off by the feds? (i'm a us citizen living/working in the states). Thanks. -TA

1 0