December 2003 - cypherpunks-legacy

Re: Respect for privacy != Re: exposure=deterence?
by jim bell 17 Dec '03

17 Dec '03

At 12:02 AM 1/14/96 -0500, s1018954(a)aix2.uottawa.ca wrote: >My apologies for responding to a political post. > >On Sat, 13 Jan 1996, Charlie Merritt wrote: > >> I feel that public exposure >> is enough to put fear into these anonymous government employees. >> You will note that when they get the mad_bomber >> some FBI guy jumps right up and takes credit, live, on TV. >> But when the Air Force orders a $300 toilet seat NO ONE is credited. > >It's interesting how we advocate anonymity for ourselves but not for our >opponents. Feeling righteous? Maybe I don't understand your point, but... 1. Individual private citizens acting on their own deserve privacy and anonymity. 2. Government employees receiving paychecks based on tax dollars stolen from members of the public do not. 3. Individuals not harming others deserve privacy and anonymity. 4. Government employees threatening citizens with large fines and jail time, for doing what we consider right and good, do not. Get the picture?

2 1

Re: New! Improved! CryptoLib 1.1 now available.
by David Vincenzetti 17 Dec '03

17 Dec '03

> Announcing CryptoLib - Release 1.1 12/21/95 > Jack Lacy, AT&T Bell Labs > > CryptoLib is a portable and efficient library of primitives > for building cryptographic applications. It runs under most versions > of Unix as well as DOS, Windows and Windows-NT (and 95). > > We are pleased to make CryptoLib source code available without charge > to researchers and developers in the US and Canada. (Because of export > restrictions on cryptographic software, we are only able to make the > software available within the US and Canada to US and Canadian citizens > and US permanent residents.) also available in Europe as: ftp://ftp.dsi.unimi.it/pub/security/crypt/math/cryptolib_1.1.tar.gz Ciao, David

2 1

Fwd: Scrambled software gets an OK
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

This was printed in the San Jose Mercury News this morning. I'd have just posted a pointer to it, except that it was in the "private" part of their web pages... Scrambled software gets an OK -- Exports: Foreign encoding unfair to U.S. firms, Commerce Department says. Bloomberg Business News WASHINGTON -- The Commerce Department will recommend easing export controls on encryption software after a study by the department and the National Security Agency found the restrictions are hurting U.S. firms, Commerce Secretary Ron Brown said. Such a move may pit Brown's department against U.S. defense and spy agencies, however, setting the stage for a White House battle over one of the last computer technologies still covered by export controls. ``I'm interested in promoting American exports,'' Brown said. ``If your foreign competitors are exporting products with encryption capability and you are not, that puts you at a tremendous competitive disadvantage,'' he said. Encryption software turns information, such as files and credit card numbers, into indecipherable material that can be sent across networks without fear of tampering to the recipient, who can then unscramble it. Under current U.S. law, encryption technology that exceeds certain technical thresholds is considered a ``munition.'' Those who would export such technology need explicit permission from the government. The United States justifies the export restrictions by saying law-enforcement agencies would be hamstrung in their efforts to stop terrorists, spies and criminals without them. The computer industry counters that encryption software is available from other countries, and the restrictions simply rob U.S. companies of business. The Computer Systems Policy Project, a joint effort of 13 top technology companies released its own study showing that U.S. companies will lose as much as 30 percent of the $200 billion in U.S. computer system sales expected in 2000 because of federal laws limiting exports of encryption products. Brown said his department will prepare recommendations for easing those controls that should be forwarded to the president ``within a few months.'' It's unclear if the NSA endorsed the Commerce Department's conclusions in the report it jointly prepared. Representatives of the NSA were unavailable for comment. Brown's assertion comes a day after federal prosecutors dropped a three-year investigation of Boulder, Colo., software designer Philip Zimmermann, whose encryption program called Pretty Good Privacy was posted on the Internet, the worldwide computer network. Published 1/13/96 in the San Jose Mercury News. -- Thaddeus Beier thad(a)hammerhead.com Technology Development 408) 286-3376 Hammerhead Productions http://www.got.net/~thad

1 0

Mailing List
by Joseph Halstead 17 Dec '03

17 Dec '03

I would like to be included in your mailing list. jhdeval(a)soho.ios.com

1 0

Re: Digital postage and remailer abuse
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thus bespoke Alan Bostick: > >The very nature of this attack makes me wonder whether it would be >worthwhile to implement a digital postage scheme for remailers that >doesn't happen to be backed by real money. The remailers would continue >to be free to use, and currency exchange hassles would be avoided, but >many of the benefits of abuse prevention would be in place. So would >the infrastructure to upgrade to pay-to-play remailers at a later date. Doing something like this might also further the analogy of email to snailmail; particularly if the remailers were able to issue 'books' of stamps. It might even be possible to have each remailer issue Estamps (tm) of different 'kinds', much as there are different postage stamp 'themes'. Having different stamps from each remailer would also allow some means of tracking spammers and rip-off artists ("hmmm. an 'Elvis' Estamp. That came from hactic; let's see if they can tell us who they sold this book to.....") IF the nature of the offense were sever enough. Too, Estamp-based remailers would be a start on reputation basing: if the email goes through a postage-based remailer, there will eventually be an increased level of confidence that it isn't some kind of scam or other nuisance ("This came through vox, a postage remailer; therefore, someone had to go through some degree of bother; therefore, it's a lot less likely that it's some Frosh playing with his new Internet toy."). Of course, I could be just spitting into the wind, or posting what is blatantly obvious to everyone else :-) Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPcwgcVrTvyYOzAZAQGK7wP+JItfxqHI/JGIKjPu9Yy7v1gVJQJTK+Bh hV/z4C22hoRweo1jnBrO47GSfjB3aJIrufPjzlm94sRyh/EM1AAGbFWEY/M30Oye fEN6paETcrE6W7arxJPZJFm2IggWYNgNrqwxToA3ZLFmC/8Sv1gH0y7PqNHxjFbz MEL/vQGpd54= =Su5o -----END PGP SIGNATURE----- ------------------------------------------------------------- "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." Robert H. Jackson (1892-1954), U.S. Judge <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geocities.com/CapitolHill/1148

2 1

Re: Digital postage and remailer abuse (was Re: Novel use of Usenet and remailersto mailbomb from luzskru@cpcnet.com)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:47 PM 1/13/96, Alan Bostick wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >In article <v02120d02ad1ce02500bc(a)[192.0.2.1]>, >shamrock(a)netcom.com (Lucky Green) wrote: > >> I am not sure that postage would solve this problem. The geeks would >> individually pay for it. Still, nominal postage would solve a lot of the >> problems that plague remailnet. > >Maybe I'm misunderstanding how using digital postage with remailers would >work. I was assuming that the postage stamp would be included *inside* >the encrypted envelope, that what the remailer would do on receipt of >mail would be: (a) decrypt the envelope; (b) validate the postage stamp; >and (if the stamp is valid) (c) forward the message according to the >now-decryped instructions. The basic idea of digital postage means, as Lucky said, that individual users and individual messages would have their own stamps. (Being just numbers, it is certainly possible that multiple messages could have the same exact "stamp," but then only one of them would be valid...in the model I usually think in terms of, the first to "redeem" the stamp gets the money, all others get nothing.) So, each transmitter of a message would have to "pay the freight" with his own stamp. The idea of N different messages all carrying the "same" stamp is inconsistent with how digital postage would operate in practice. >Using this model, if the perpetrator doesn't include a postage stamp, >then the message is ignored. If the perp includes a stamp, the first >horny net geek's message is relayed but subsequent ones get bounced for >invalid postage. Yes. >If the message requires external postage (remailer processing cycle is >process postage *before* decrypting envelope), then at the very least >the horny net geeks have to get their own postage stamps, putting a step >in the way of instant gratification. What's more, doing this would >require *some* understanding of how the remailer network operates. One >should never underestimate the degree of cluelessness present on the >net, but knowing how to use remailers makes it more likely that somebody >could recognize this as a mailbomb rather than a legitimate offer. Yes. >The very nature of this attack makes me wonder whether it would be >worthwhile to implement a digital postage scheme for remailers that >doesn't happen to be backed by real money. The remailers would continue >to be free to use, and currency exchange hassles would be avoided, but >many of the benefits of abuse prevention would be in place. So would >the infrastructure to upgrade to pay-to-play remailers at a later date. I think someone tried this a couple of years ago, offering coupons for remailer use. The idea of "coupons" acting as stamps is the one most often discussed as an alternative to having full convertability to money. A person buys a block of numbers, each can be used once and only once. It's up to the user not to let the numbers out of his possession (as they can be used by whoever gets them). So long as the numbers are in the outer encrypted envelope, packet sniffers and sysadmins won't see them. So long as the remailer operator is honest enough not to claim the numbers have already been used--a reasonable assumption, at least at this time--then this should work. Coupons also get around laws about cash, banking, etc. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: COMMUNITY CONNEXION...
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Mike Duvos: > Congratulations. You win the award for this weeks longest run-on > sentence. And you win this week's ward for best diversionary grammar lesson. I know the difference between *actual* genocide (like, the kind a bunch of my family members died in) and what the SWC does. Is that a grammatical question? > Is there some special reason you had to post this little history > lesson anonymously? Is there any reason I should have done otherwise? I don't especialy *want* a reputation, good or bad, on this list - but that doesn't have anything to do with whether I want to or should *say* something. Tell me: Why do *you* want a name attached to my history lesson?

2 1

Re: Digital postage and remailer abuse
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:47 AM 01/13/96 -0800, Jonathon Blake <grafolog(a)netcom.com> wrote: > >On Sat, 13 Jan 1996, David K. Merriman wrote: > >> snailmail; particularly if the remailers were able to issue 'books' of stamps. >> It might even be possible to have each remailer issue Estamps (tm) of >> different 'kinds', much as there are different postage stamp 'themes'. > > I can see it now. The 1997 Scott Standard Estamp Catalog: > Remailers of the World. > Or perhaps Famous Cypherpunks? So maybe a bad example, but the analogy is quasi-valid :-) >> Having different stamps from each remailer would also allow some means of >> tracking spammers and rip-off artists ("hmmm. an 'Elvis' Estamp. That came >> from hactic; let's see if they can tell us who they sold this book to.....") > > OTOH, if hactic keeps records of who the stamps are sold to, > that sort of defeats the anonymous nature of the remailers. > Perhaps a little, but considering *why* Estamps would be used, I think it would be an acceptable 'hazard'. Of course, it's not any kind of requirement, simply a means of resolving a *significant* problem. Or not. :-) Dave -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMPc9h8VrTvyYOzAZAQHl0wP+LY/Lw9EzM8kH5Eyr7rLRzEFwKSmWIeTf sElMTzxQbTyqXrmzI0nB43Dmx1Cpkb+8mSCFVnXwvZDQzrP8cFidYGlNF/hG00ig d16+D6Le07YgO65pCngNhv11CLKtd/1GZf4r8YXZV7zbMcbslooUHt/mVWkl5zGT AP0ssH0WAI4= =TQ04 -----END PGP SIGNATURE----- ------------------------------------------------------------- "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." Robert H. Jackson (1892-1954), U.S. Judge <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geocities.com/CapitolHill/1148

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

> The U.S. Commerce Department will recommend easing > export controls on encryption software after a study by > the department and the National Security Agency found > that American firms are being hurt.... Avoid the rush, start generating those 42 bit keys now! And don't forget tonight's victory celebration in Shimomura's hot tub!

1 0

New Mailing List (encrypted)
by John Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello everyone, I have installed PGPdomo on vishnu.alias.net. I've also created a new mailing list that you can join if you wish. It's a closed mailing list, so subscriptions must be approved. What makes this mailing list different is that all submissions are encrypted and all outbound messages are encrypted to the PGP key of the recipient. This means you can discuss whatever you wish without fear of discovery or retribution. The name of the mailing list is cypher-list and it's home is vishnu.alias.net. The theme of the mailing list is basically anything one might discuss about cryptography, crypto-politics, remailers, government, Kevin Mitnick, etc. It's kind of like cypherpunks but accepts a wider discussion base. The difference is encryption. As mentioned above, the list is handled in a secure fashion. I've included the help file for PGPdomo below to assist in subscribing to the list. Here is the simplified for for subscribing: Send email to cypher-list-request(a)vishnu.alias.net In the body of the message specify: subscribe cypher-list [your PGP public key in ascii-armored format] You will be added to the mailing list and emailed the welcome message. Here's the help file: You have reached the J. P. and Associates "Majordomo" mailing list manager, version 1.93. This is a modified version of Majordomo 1.93 that includes PGP support. Majordomo's public key is available at: ftp://vishnu.alias.net/pub/majordomo.pgp Additionally, the public key for Majordomo(a)vishnu.alias.net can be found on the PGP keyservers. Majordomo(a)vishnu.alias.net will accept the following commands in clear-text (i.e no encryption): help; lists; info; and which. All other clear-text commands must be sent to the specific list using the email address: <listname>-request(a)vishnu.alias.net Where <listname> is a valid listname without the <> characters. In the description below, items contained in []'s are optional. When providing the item, do not include the []'s around it. It understands the following commands: subscribe <list> [<address>] [-----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzBoq Your PGP version 2.6.2 EKOUFKNl+Ytk+O QphsZ8zNU compatible Public Key u0SDZVbcTP7lt6 mP+fZPdMq in ASC format goes here izFrag5L4ZAAUR tDxNYWpvc use pgp -kxa my_pubkey.asc to create pvcmRvbW9AaGF3 d3cuaGEub3NkLm1pbD4= =l3kH -----END PGP PUBLIC KEY BLOCK-----] Subscribe yourself (or <address> if specified) to the named <list>. subscribe commands should always be sent in clear-text to <listname>-request(a)vishnu.alias.net. Only include your PGP public key for PGP protected lists. We prefer (but not require) 1024 bit key lengths. We reject Public keys with less than 512 bits. If subscribing to a PGP protected list, include contact information such as DSN or commerial phone number. unsubscribe <list> [<address>] Unsubscribe yourself (or <address> if specified) from the named <list>. get <list> <filename> Get a file related to <list>. index <list> Return an index of files you can "get" for <list>. which [<address>] Find out which lists you (or <address> if specified) are on. who <list> Find out who is on the named <list>. info <list> Retrieve the general introductory information for the named <list>. lists Show the lists served by this Majordomo server. help Retrieve this message. end Stop processing commands (useful if your mailer adds a signature). Commands should be sent in the body of an email message to <list>-request(a)vishnu.alias.net. Commands in the "Subject:" are line NOT processed. If you have any questions or problems, please contact Majordomo-Owner@vishnu.alias.net@vishnu.alias.net. Additional PGP information: When submitting entries to a PGP protected list, please comply with the following: o encrypt the entire submission for Majordomo(a)vishnu.alias.net (-e option of pgp) o use Transport Armor (.asc, radix-64, the -a option of pgp) o sign your submissions (-s option of pgp) o use the linefeed conversion option (-t option of pgp) 'pgp -east submission Majordomo(a)vishnu.alias.net' where submission is your file should work nicely. John Perry - KG5RG - perry(a)vishnu.alias.net - PGP-encrypted e-mail welcome! Packet Radio - KG5RG(a)WA4IMZ.#SETX.TX.USA.NA WWW - http://www.alias.net PGP 2.62 key for perry(a)vishnu.alias.net is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMPgLL6ghiWHnUu4JAQHB5gf/RAwOwOdFGNGLhdQUE1z4VrAl1jYb3efg a/C9nEAIb59VKZ3IwbehBzYqUxSDSXoarPQldoHfcKBJxfJahfu5U+09mMBbZ9VT WYnQ1+KQiltQmAP8hcOdOazs0JrlTTOQJxoX095T8ZInJ904OuXA+V3sd8Tg/Nyc Id/yfyfOeXndULj4UJxLWCsVGHSwx+CCa5Ct7g/yHZPQf7QtOPkDKF33vfsrQ+0d 04KemYL6PYLXPuLcgnOT1FiKccqR/q5340mUJBfs2yz7bx9UwFkexKuu/rkFDeno wTjvUavyPpvV17eCEQMDaUggW6hZbQz7C72NHQ8NPi2XG/QrOCZZhA== =kKgj -----END PGP SIGNATURE-----

1 0