December 2003 - cypherpunks-legacy

Re: Crippled Notes export encryption
by rah＠shipwright.com 17 Dec '03

17 Dec '03

> The problem is that the government refuses to publish the rules. >They make people ask for approval for every piece of code that is >exported. This gives them lots of wiggle room so that they can keep >changing the rules in the face of technical, legal, or political >innovation. In the legal trade, this is what's called an unpromulgated (secret) law. It's a no-no in the philosophy of law, but a nation state can do whatever it wants and still call it "legal". At least our esteemed congress doesn't do retroactive legislation, like the 1KY reich did. Well, we only do tax hikes that way, anyway. We had a revolution to stop crap like in 1776, but we resurrected unpromulgated laws with the advent of the ICC at the end of the last century, and the IRS at the beginning of this one. It's encouraging to note that the ICC has finally been "sunset". Too bad we can't do the same for the IRS, and maybe even State Department. Maybe in some future world of instant full-sensorium telepresence, encrypted, of course... ;-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Netscape and NNTP
by stephen_albert＠alpha.c2.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've got a question that I feel like I *should* know the answer to, but don't. Say I configure Netscape to point through an open http proxy, and then connect t an open NNTP server. I don't know much about how proxies work. Does the NNTP connection go through the proxy or directly from my machine? As I understand it if it does the first, then I don't have to worry about the NNTP server's log file, if any. But if it does the second, I do. Am I in the ballpark here? ObCrypto: Not-readily-traceable posting with less hassle than a mail-to-news gateway seems to have some privacy relevance, even if it's not directly crypto. Stephen "To NNTP Serve Man" Albert stephen_albert(a)alpha.c2.org <*> PGP key on request and on servers -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMQbVikimCtQtWVIdAQEjZgf+KFK8AzLY8ndSBAmWzQAwqMCmbA3IR8yl TU/c2f/FAMRypAGf+IcKIgmLAPxjbOBSvCmYv8cSXBtb/hhOFbmzIf5EY5QyfcMt OVsMk80gHJxBiUaSYetwklkRub1dqan0R2fUfQq1ey2ZUZk3OvUB4gTW5XPKNpND HxLINjJ2Ph6SH4AqCZ0hNwFkk3gtZsLGTgUHhdrkhaAKnEBSXWN9mMvkNHngScRq A0SlVehxwj8yFLF5rf1G82AM3fdZrdWhMDlWmVCkgpo5mr5AXtYpfHKa9ZsesM8O eRVvlVzXU+w4Y1B5swM5QDpezsPqxBtTn0JEb78mGM4gCoVyEi06Ow== =gwrx -----END PGP SIGNATURE-----

2 1

Re: Why is blowfish so slow? Other fast algorithms?
by James A. Donald 17 Dec '03

17 Dec '03

At 07:32 PM 1/23/96 -0500, David A Wagner wrote: >If you want authentication, you must use a crypto-strength MAC. >Encryption (be it RC4, DES, etc.) is not enough. Not so: If the message is encrypted and checksummed with a simple not non cryptographic checksum, this gives you everything a MAC gives you, plus the message is secret. MACs are only useful in the strange and unsual case where you want authentification using a symmetric key, but you want to transmit in the clear. I cannot see any reason why anyone would ever wish to use a MAC except perhaps to obey government bans on encrypted messages. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

3 2

Re: NSA advanced knowledge
by koontz＠MasPar.COM 17 Dec '03

17 Dec '03

received from John Young <jya(a)pipeline.com>: > >Responding to msg by rsalz(a)osf.org (Rich Salz) on Wed, 24 Jan >7:34 PM >>Is there any indication that the NSA knew about >>public-key before it entered the open literature? > > > Fred B. Wrixon writes in "Codes and Ciphers," under the > "Public Key" entry: > > ... This Hellman-Diffie proposal was apparently > anticipated by a similar version developed by the > National Security Agency (NSA) a decade earlier. > (p. 164) > > No citation or elaboration is given for this claim. > > Wrixon's book is a simply written compendium: > > Codes and Ciphers: An A to Z of Covert Communication, > from the Clay Tablet to the Microdot. > Fred B. Wrixon > Prentice Hall, 1992. Paper $18.00 > ISBN 0-13-277047-4 It was originally called FIREFLY or somesuch thing. I may have some of the early papers. (The same ones leading to the statement in the book). This should predate the STU-II to STU-III transition.

2 1

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 18:01 1/24/96, Jeff Weinstein wrote: > I don't think that the TLAs are concerned about people at >foreign universities using kerberos. They are much more worried >about mass market products. If we did the same thing as was done >for kerberos, then exported the code to a foreign subsidiary, I >believe that the government would try to make a case against us >that we had participated in a conspiracy to circumvent the >export restrictions. I think the only reason why the NSA has been getting away with this garbage is because they convinced others that challenging the party line will destroy you. I also think that they are bluffing. It is time that some party with financial resources and public credibility makes a test case out of themselves. An educational institution would be suited best. Any takers? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Crypto Exports, Europe, and Conspiracy Theories
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:12 1/24/96, Michael Froomkin wrote: >If you are a government strategist, you might think, Why not make people >strictly liable for, e.g., any crimes planned with their remailers? And >make ISPs strictly liable for crimes panned or executed on their systems? No doubt in my mind that will happen within the next few years. Remember from past posts that remailers already are technically illegal in a few states, though the legislators probably didn't think of remailers, when they wrote the laws. A law making remailer operators responsible for their traffic will pass by a margin customary for similar bills in the past (>90%). Remailers in the US and most of Western Europe will be outlawed or shut down on their own once a few of their owners are held liable for some Four Horsemen traffic flowing through. It is precisely because remailers, and by extension future encrypted TCP redirectors, are a much greater danger to the statist than 128 bit Netscape will ever be. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Signing nyms' keys (Was: Report on Portland Cpunks...)
by jim bell 17 Dec '03

17 Dec '03

At 06:49 PM 1/24/96 -0800, Alan Olsen wrote: >Person X commits treasonable act A. All of the persons who are signed on to >his key could be considered to be co-conspirators. The same applies to >nyms. The difficulty with prosecuting nyms is finding the link to the real >world individual. Anyone associated with him/her/it will be considered to >be guilty by reason of key signage or a way of determining who the real >person is... > >The only way I see getting around this is only signing nyms with nyms or >having some sort of zero knowlege proof on a key signing authority. >Something where you can issue some sort of proof to the signing authority >that you are who you say you are without giving any information about your >"real" identity. I know of no foolproof way of doing this... > >I guess we are stuck with the "Web of Guilt"... Doesn't all this stuff give you a headache <G>?

1 0

Re: V-chip?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:33 AM 1/25/96, Mike Duvos wrote: >As I understand it, the basic concept behind the V-Chip is to >allow selective blocking of material a particular viewer might >find offensive based on content information transmitted along >with the program. As long as the program material itself is >transmitted unaltered, and there are multiple non-governmental >providers of content descriptions catering to the spectrum of >human likes and dislikes, this sounds like ideal Cypherpunk >technology. > >Concerned Parent can set the V-Chip to read from the Children's >Television Workshop content service, available for a small >monthly fee, and be certain that graphic violence and sex are >pixelated on screen, and that bleep words that the child might >practice in front of Grandma are garbled. > >Mr. Islamic Fanatic can filter out all blasphemy against Allah >and his one and only prophet, pork commercials, and women showing The V-chip described heretofore is considerably less nuanced than this, having only a few states (roughly corresponding to MPAA movie ratings). No switch settings to block Democrat programs, or Feminist programs, or Mormon programs. Just your basic "indecency," with "violence" as lagniappe. And most Cypherpunks would tend to reject it because it is not voluntary (unless you think "so don't buy a television" is a viable voluntary choice). It will add to the cost of t.v.s and VCRs, and possibly interfere with the computer-based options to come. And it's easily defeatable. For one thing, most households have multiple t.v.s or VCRs, any one of which without the V-chip will defeat the system. Also, it is likely that the households "most in need" of this chip--using the logic about unattended children watching violent programs while their parents are away--will be the least likely to buy the brand-new sets and VCRs that have this chip. (I would guess that most families will have existing sets and VCRs for at least the next decade or more.) >What are the dangers of this new technology? > >First, the government might want only one description of content, >which it controls. My notion of what is offensive probably >differs greatly from that of Jesse Helms, for instance. This is mostly the case. My objection to ratings systems imposed by government is a general one. If video and music is to be rated, why not articles and Usenet posts? The principle is the same. Anyone telling me I have to rate my work, or submit it to a ratings agency, is aggressing against me. Now, if others rate my work (which is already happening with digest services such as "CP-Lite"), this is their business, not mine. But the V-Chip precedent is a precedent for the government to insist that all sorts of content be rated. This should be fought in a free society. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: German home banking (fromn RISKS)
by jim bell 17 Dec '03

17 Dec '03

At 07:34 PM 1/24/96 -0600, Andrew Loewenstern wrote: >> Don't high speed modems transmit and receive on the same frequencies, >> using echo cancelation to decode the receive signals? Does that >> make it impossible to eavesdrop on high-speed (i.e. V32bis) modems? > >No, and a lot of crackers and phone phreaks found out the hard way. You can >buy protocol analysers off-the-shelf that will give a dump of the entire >communication by just passively listening in (or possibly playing back a >recording). Assuming it were possible, it would have to have a rather good quality, although DAT should be adequate, I should think. > I have seen units that could decode all of the popular Blue Book >protocols for consumer equipment such as faxes and high-speed modems as well >as ISDN, T1, DS3, ATM, Hey! Justa sec! ISDN is basically digital (broadband), so (obviously) is T1, likewise DS3 and ATM. Except for ISDN, unidirectional signals (at least at one time...), I think. This is NOTHING compared to the difficulty of doing simultaneous bidirectional analysis in a 3 khz bandwidth of 28 kbps each way! Maybe you're far more familiar with what equipment is available for telephone analysis than I am, but I have serious doubts that the capacities you list above are even close to what the other guy asked about. etc... Most are programmable and some are full-blown >computers running stripped down versions of Unix and can also be controlled >over the network from RealComputers. With multiple analysers and a little >custom software you could easily perform MITM attacks. The hardest part is >getting in the middle. > >Modulation, comm-protocols, and compression techniques are not a replacement >for honest to goodness crypto. Agreed, but let's not underestimate the amount of effort involved. This is important, because of that "Digital Telephony" bill crapola they're trying to foist on us. Their argument will be, we presume, that "we've gotta be able to bug all these lines because of all the drug dealers talking on the phone. Well, unless the government is proposing installing the capability of bugging data the vast majority of data calls (including those that, hypothetically, use Clipper) then they're NOT going to get any traffic they claim to want to hear. We should ask, "How much will it cost to even UNDERSTAND a data phone call, let alone decrypt it, and if it's too high let's give up while we're behind."

1 0

Re: Crippled Notes export encryption
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 13:06 1/24/96, Andrew Loewenstern wrote: >Why not just print out all of the source code to Navigator (crypto and all) >in a nice OCR font? Paper is exportable. Then you would 'only' have to scan >it back in and debug it. That would be giving away the store to the competition. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

3 2