December 2003 - cypherpunks-legacy

Re: all.net
by thad＠hammerhead.com 17 Dec '03

17 Dec '03

This is the message that I got when I mistakenly typed "telnet all.net" [previously quoted message not repeated...] P.S. At this time, there is what appears to be a criminal conspiracy underway to excersize our detection system. Criminal because it is an attempt to attack a Federal Interest Computer - conspiracy because some of the participants have, after the fact, decided to participate in the criminal activity by refusing to identify the source of the attack. This is a result of a posting to a mailing list by someone who was apparently upset at having their activities detected. A recent threat to break into this site was posted, and we have contacted federal authorities. As this incident quantitatively increases, the level of our work to check out each part of the incident (by administrators such as yourself) may reach a total of $5,000. At that point, the FBI will be called in and participants in this activity may find that they are under federal investigation. Please advise your users to cease and desist and advise them to advise others to do so as well. It would also help us to limit the damage and establish culpability (and innocence) if you could get copies of the posting sent to your users so we can track down the source of the threat and determine what response, if any, is appropriate regarding your users who may be innocent victims of (and accidental conduits for) this attack. March 1996 - FC -- Thaddeus Beier thad(a)hammerhead.com Technology Development 408) 286-3376 Hammerhead Productions http://www.got.net/~thad

2 1

Re: PGP reveals the key ID of the recipient of encrypted msg
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 16:36 3/11/96, John Pettitt wrote: >I can see a case where one would want to broadcast a message (say on usenet) >with *no* indication of the intended recipient (not even a non registered >key-id). It would seem to be easy enough to hack up something that does not >have key-IDs - to know if it's for you try decryption and if it works then >it was for you. This does not scale well as the recipient must trial >decrypt all messages which could use *a lot* (tm) of CPU time. There is also the problem of knowing WHICH key to use (ie: Even when you know the message is intended for you, you must do a test run with each of your keys until one works). Thus you want private keys whose ownership is not publicly linked to your known identity (but is known to your correspondents). So long as you have your corespondent's published Public Key, you can use it to do a one-time transmission of a private Public Key to be used to do anonymous (ie: Not Linked to your Public Identity) transmissions to you.

4 3

Re: frequency of remailer use? (fwd)
by Bill Stewart 17 Dec '03

17 Dec '03

Multi-hop messages are probably more important than cover traffic. If the average message does two hops, then dive your estimates by two, etc. In a real privacy environment, almost nobody would send serious messages by just one remailer hop. On the other hand, for posting minor spam and non-professionally-secure messages to mailing lists, one hop will do. A first step at estimating this would be to check the fraction of mail addresses to known remailers (since most remailers are more likely to track destinations than sources.) Most of pamphlet's bouncemail is from other remailers, but that seems to be more of a configuration issue, or people sending test mail to mixmasters or something. >One could make some attempt to account for all known cover traffic. Given a >known average quantity of cover traffic, the rest is either real or >independent cover. >> > I would be very grateful for pointers to data concerning the number of >> > messages that pass through remailers. (Not anon.penet.fi -- real >> > remailers.) I am currently in a conversation with a journalist who should >> > know better, but claims that secure anonymous remailers are never used by >> > anyone -- just a curiosity. >>Good question. How do we determine this without ourselves being able >>to distinguish between cover traffic and "real" traffic? #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0

Re: A lengthy preliminary analysis of the Leahy bill.
by Hal 17 Dec '03

17 Dec '03

From: "Peter D. Junger" <junger(a)pdj2-ra.F-REMOTE.CWRU.Edu> > From the point of view of one who is concerned with first amendment > rights rather than selling cryptographic software as a commodity, the > really unfortunate part is that this provision authorizes export > contols on ``software''. Now the Leahy bill does not define software, > but there is a definition of lying around in the International Traffic > in Arms Regulations (``ITAR'') that I fear Commerce might adopt---it > may even be the language that the draftsmen of the Leahy bill had in > mind. And this definition of ``software'' includes a great deal of > material that cannot constitutionally be controlled. Here is that > definition from the ITAR \S 121,8(f): ``Software includes but is not > limited to the system functional design, logic flow, algorithms, > application programs, operating systems and support software for > design, implementation, test, operation, diagnosis and repair.'' > [...] > Even if that definition is adopted, the fact remains that software is > still nothing but information, and that it is the communication of > information that is protectected by the first amendment to the United > States constitution. (If you aren't convinced that software is > protected by the first amendment, notice that software is > copyrightable as a ``literary work''.) Note that the paradigmatic > violation of the first amendment is a scheme under which the > government requires publishers to obtain a license before publishing. Are you familiar with the Posey case? That decision by the 9th district court (which oversees export cases) explicitly rejected the contention that restrictions on export of written materials violate the First Amendment. Although I am not a lawyer, I wrote some notes on this case at: <URL: http://www.portal.com/~hfinney/cryp_export2.html>. Below is an excerpt from that court decision in which they make it quite clear that the First Amendment doesn't apply. In this case, the item being exported was a technical manual obtained from the US government itself under the Freedom of Information Act. Surely this is even closer to what the framers of the constitution had in mind when they conceived of the First Amendment, yet the constitutionality of restrictions on its export has been upheld. So you should be aware that the status quo is that the restrictions you fear being legitimized by the Leahy bill are already in place. Here is part of the Posey decision [864 F2d 1487] (the AECA is the Arms Export Control Act, which is what currently forbids the export of encryption devices, and the CAAA is the Comprehensive Anti-Apartheid Act, which applied specifically to South Africa, where the materials in this case were sent): VII. FIRST AMENDMENT Appellant's final argument is that the First Amendment bars the government from restricting the export of information that is already available to the public. He insists that the data he sent abroad was available under the Freedom of Information Act, and therefore could be legally obtained by virtually everyone in the world. He contends that the First Amendment prohibits the application of the AECA and CAAA to the export of such publicly available information. Our Court has already considered and rejected this argument. In United States v. Edler Industries, 579 F2d 516 (9th Cir. 1978), we rejected an essentially identical challenge to the predecessor of the AECA. The defendant was convicted of exporting certain manufacturing designs that were on the Munitions List but were not classified. He challenged his conviction on First Amendment grounds, arguing that the government could not constitutionally prohibit the export of techno- logical data that was widely distributed within the United States. In rejecting that claim, we explained that even assuming that the First Amendment offers some protection to the dissemination of technical data, the government has a strong interest in regulating the export of military information: The federal government undeniably possesses the power to regulate the international arms traffic.... As a necessary incident to the power to control arms export, the President is empowered to control the flow of information concerning the production and use of arms. The authority to regulate arms traffic would be of negligible practical value if it encompassed only the exportation of particular military equipment but not the exportation of blueprints specifying the construction of the very same equipment. 579 F2d at 520. We accordingly concluded that the government could permissibly restrict the flow abroad of data included in the Munitions List. 579 F2d at 521. Finally, we held that the government's power to issue such restrictions was not affected by the domestic availability of the regulated data: Given the unquestionable legitimacy of the national interest in restricting the dissemination of military information, the claim of public availability in the United States is not a defense recognized by the Constitution. 579 F2d at 522. Appellant attempts to distinguish Edler from the present case by pointing out that the exported data in Edler was "cutting edge" technology and was not widely used in this country. [Citation]. Whether or not this was factually true of the technology at issue in Edler, however, the Edler decision clearly assumed for purposes of its decision that the material was extensively available in the United States. See 579 F2d at 518, 522. Moreover, we believe Edler should not be read as permitting the govern- ment to restrict the export of only that information which is not widely available domestically. Under appellant's reading of Edler, if the government wished to prevent technical data from being sent to foreign powers, it would be required to suppress the information alto- gether, at home as well as abroad. This outcome would blur the fact that national security concerns may be more sharply implicated by the export abroad of military data than by the domestic disclosure of such data. Technical data that is relatively harmless and even socially val- uable when available domestically may, when sent abroad, pose unique threats to national security. It would hardly serve First Amendment values to compel the government to purge the public libraries of every scrap of data whose export abroad it deemed for security reasons necessary to prohibit. We conclude that appellant's conviction does not violate the First Amendment.

1 0

Re: Do you feel lucky, punk?
by jim bell 17 Dec '03

17 Dec '03

At 05:54 PM 3/11/96 -0500, Black Unicorn wrote: > > >[rant including some very dubious abstracts of legal opinions deleted] > >Not only is your law poor and badly reasoned, Just what George Will said about this recent Bennis SC decision. > your mastery of the jurisprudence of forfeiture law flawed, Ditto, and I notice you give no specific examples. Why is that? > and your rhetoric twisted, Again, you give no specific examples. And what is "twisted rhetoric", at least as you've used it here? >but you don't seem to know the difference between dicta and holdings. I didn't use either term. Neither did George Will. Maybe you read that item too rapidly to notice that most of it was George Will's column, not my wording. BTW, I get particularly suspicious when people "respond" to my posts and quote NOTHING that I have said. This seems to be a pattern: The person clearly disagrees with my position in general, but can't cite specifics and in fact studiously avoids them. Padgett Peterson is an expert at this, it appears you're trying to emulate him. What, then, was the point of sending me the note, as well as wasting bandwidth on CP to share your unhappiness? Jim Bell jimbell(a)pacifier.com

3 2

all.net
by anonymous＠extropia.wimsey.com 17 Dec '03

17 Dec '03

Has anyone else received one of these? > From: root(a)all.net (root) > > A user at your site has just attempted to telnet into our site without > proper authorization. We consider this inappropriate behavior and would > like an explanation of this action as soon as possible. > > This message is generated automatically at the time of the attempted > entry and is sent to our administrators and the postmaster at the > machine making the attempt. We have included any information provided > by your ident daemon (if in use) on the subject line of this message. > We also do a reverse finger for future reference. > > Fred Cohen - fc(a)all.net - tel:US+216-686-0090

1 0

Re: AMEX and Netscape
by ethridge＠Onramp.NET 17 Dec '03

17 Dec '03

>American Express Platinum card holders might want to look at the bottom >of their statement: > >CARD USE ON THE INTERNET -- Cardmembers should only conduct transactions > >(Any Gold or Green card holders have the same notice?) Green - yes. allen

1 0

Re: Remailer passphrases
by Bill Stewart 17 Dec '03

17 Dec '03

>Bill Frantz writes: >> One of the reasons classical (government) crypto users change keys >> frequently is to minimize the amount of data compromised by a broken key. >> We keep hearing about NSA decrypting 20 year old cyphertext and showing >> more of the workings of the atomic spy rings operating in the 40s and 50s. The NSA's decryption of old cyphertext that's been publicized, other than World War II cyphers such as Enigma and Purple, has primarily been Russian "One Time Pads". OTPs are perfectly secret - if they're made with real random numbers and only used once, which the Russians were sloppy about. Minimizing exposure is good. perry(a)piermont.com replied >Signed Diffie-Hellman key exchanges have the property known as >"Perfect Forward Secrecy". Even if the opponent gets your public keys >it still will not decrypt any traffic for him at all -- it just lets >him pretend to be you. Thats one reason why protocols like Photuris >and Oakley use the technique. DH key exchange is really only Exponentially Good Forward Secrecy, and in its primary use (exchanging keys for symmetric-key algorithms) the system is at best Good Enough Forward Secrecy. The difference between exponentially good and perfect is exponentially small, which is fine if your keys are long enough. On the other hand, cracking a symmetric-key algorithm is generally the weak link, unless you're using 112-bit or better secret keys, and even 112s might be crackable during the lifetime of the current universe. How much information leaks if you reveal (say) 128 bits of a 1024-bit Diffie-Hellman key? Does it tell you anything at all about any of the remaining 896 bits? Is it safe to use 8 slices of the 1024-bit key if 7 are revealed? Does RSA have the same problem? This is partly an efficiency hack (cutting the number of big slow calculations by 8) and partly a question of other uses one might make of the bits, such as stealthing PGP headers. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

2 1

Re: Crypto Exposure
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:05 AM 3/13/96 UTC, an534774(a)anon.penet.fi wrote: >A few questions concerning the access to crypto >software from foreigners living in the US: > >- Suppose that an ISP (or a University) provides an account to >a foreigner (i.e. the foreigner can access a few UNIX machines >that are property of the ISP). Suppose now that PGP (for >example) is installed on these machines, then the ISP expose >the foreigner to crypto software, right? Is the ISP (or >University) punishable by law? There isn't a good answer to this, but it's probably a bad idea for any US-based school or ISP that permits foreigners to access its files to provide crypto capability, unless it limits it to Yankees (e.g. though Unix group permissions.) It's certainly a bad idea for any _small_ organization, or organization with a small legal budget, to do so. >- Which version of PGP is the foreigner allowed to use in the >US? He would violate export restriction if he uses the US >version and he would violate the RSA copyrights if he uses >the internation version, right? No - this one there _is_ a good answer to :-) US Law doesn't restrict use of encryption by foreigners located within its borders (except maybe special circumstances like agents of foreign governments; I'll pass on answering that) - only on whether US persons can give them munitions, and of course patents. The clean approach is for the foreigner to bring a copy of the US version of PGP into the US, either on magnetic media or by downloading from ftp.ox.ac.uk or other free-world site. >- What if the foreigner actually write crypto code while in >the US? Does he (or the Uni/ISP) violate export restrictions each >time he access the source code or execute his program if they are >stored on a public (Uni/ISP) machine? The foreigner isn't a US person, so he doesn't violate the law by reading the code himself. If the Uni or ISP knows that it's providing encryption software to the foreigner, it may be liable, but without scienter it's tough to have guilt. Probably the foreigner should not keep encryption software on University or ISP machines - floppy disks should do just fine :-) Encryption material used only for authentication, of course, is just fine, at least unless the foreigner is from a country the US State Department considers to be an enemy, like Cuba. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

2 1

Beat Remote Monitor Snooping?
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

I know that monitors emit RF signals that can be detected and decoded for a considerable distance. I have a question about this. Obviously, the difference between black and white (white text on black background, or vice versa) would be the most detectable, because the difference in signal levels would be the greatest. Would it be possible to reduce or prevent this kind of snooping by using color schemes that all use the same signal levels? For example, the color purple uses the red and blue color guns, and yellow uses the red and green color guns. Would purple text on a yellow background be able to be read by a remote snooper? If not, then perhaps these color schemes could be used to echo pass phrases--assuming the user isn't worried about someone looking over their shoulder. Any comments? Jonathan Wienke

5 4