December 2003 - cypherpunks-legacy

Some thoughts on the Chinese Net
by Jon Lasser 17 Dec '03

17 Dec '03

Several people have posted to the list that the Chinese, censored, Internet will fail. Usually, the claim is that the censored network will fail mostly because of technical reasons, namely the inability of the Chinese government to censor everything. The other significant claim made was that the Chinese problem is "behind" the "firewall" leading into the country... Suggestions have been made that RSA is involved with China to implement this censorship. I would suggest that the Chinese solution to these problems is singular, and simple: the total inability to conduct any transaction anonymously. How can this occur? It takes two parts; one simple, one somewhat more difficult. The simple portion is a national (Chinese) database associating true names with key IDs. These keys will be usable only to sign documents, not to encrypt information, similar to the Federal DSS. The more complex portion (from my perspective, at any rate) is a modification of the standard TCP/IP protocol, requiring that each packet be signed by its originating user. This would require lots of software modification on the Chinese end, as well as a conversion process at the National firewall. (This is where the censorship takes place; the censors don't filter out unwanted information, they sign acceptable information. They then store a reference to the bit of information with a hash. If the hash checks out, they don't need to re-sign the data. This allows a ramp-up after a while to provide adequate quantities of information). The real question is who's going to design/implement this protocol? The answer is Western sofware companies which want to do business in China. RSA would obviously be called upon to design the protocol, as well as perhaps provide certain implementations of it. Another likely candidate is Microsoft, whose Windows OS has been declared a National Standard by China. It would hold obvious financial benifits for MS to develop a Chinese TCP/IP protocol for Windows. Any company which wants a monopoly in a country of > 1 billion people could probably get in on this deal. Now that all information has a recognizable source, dissidents in China can be arrested, and unacceptable information never makes it into the country. Can anybody say why this can't be implemented? Or why China wouldn't implement it? This is obviously a worst-case scenario, but one which appears, at least to me, to be technically feasable. I'd love to hear otherwise. Jon Lasser ---------- Jon Lasser (410)494-3072 - Obscenity is a crutch for jlasser(a)rwd.goucher.edu inarticulate motherfuckers. http://www.goucher.edu/~jlasser/ Finger for PGP key (1024/EC001E4D) - Fuck the CDA.

3 2

Re: Spin Control Alert (LI Newsday, 2/12/96)
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

jamesd(a)echeque.com: >> While the religious right clearly supported the push to regulate the >> internet, the main push seemed to me to come from the existing mass >> media, primarily the three big TV channels. At 02:09 PM 2/14/96 -0500, Declan B. McCullagh wrote: >The religious right did not *support* the "push to regulate the >Internet" -- they drafted, defended, and pushed through the damn CDA! Bunkum Name this Christian rightist who drafted or defended the CDA! The primary anti porn activists involved in the effort to regulate the net were Donna Reed, and Marty Rimm, neither of whom are members of the Christian right, and Bill Arms, who is not only not a member of the Christian right, but who in additon is a PC academic. While their campaigns received assistance, encouragement, and free labor from the Christian right, it was not the Christian right that enabled these people to exercise the disproportionate power and influence that they did. It was not the Christian right that obtained totally undeserved publicity for Rimm's spurious findings. Rimm's study had connections both with the right and the left, but the real question is where the big muscle came from. If the big muscle came from the Christian right they would have let us know by now, because they always tend to exaggerate their influence and power. While the effort to regulate the net had *links* to the Christian right, it is simply untrue to say that it was composed of the Christian right, or even to say that the Christian right played a significant role in the effort. Their role is scarcely visible. They were minor foot soldiers. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: Fair Credit Reporting Act and Privacy Act
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:28 AM 2/9/96, Duncan Frissell wrote: >Look, the reason we hate the CDA is because it restricts speech. >Restrictions on credit agencies gossiping about you are also speech >restrictions. If you are out in the world, people are going to talk about >you. The credit agencies are much easier to handle and less intrusive than >the women were who talked about you while beating cloth on the rocks in the >stream back in the old village. Recall that in 1914 America adopted the "Gossiping and Busybodies Fair Reporting Act," requiring all gossipers and busybodies to register their planned speech acts with the typically-named Privacy Ombudsman (now Ombudsperson). The modest registration fee of $75, a lot of money in 1914 of course, appears to have had a chilling effect on this market, as there are few if any gossiping women beating clothes on rocks at the stream. More seriously, what I find useful when thinking "There ought to be a law!" thoughts is to imagine how it might be enforced against _me_. Creative visualization. For example, while I get angry at times with TRW and TransUnion like everyone else, I imagine a welter of laws about the keeping of records and I imagine someone coming to *my* door and announcing that he was there to inspect the contents of my hard drives to determine if I had unlicensed data. (Tim Philp's idea that this would only apply to "corporations" or "businesses" (not clear which he means) misses the point. Am I, for example, a business? Having such laws kick in at some well-defined threshold would simply shift the nature of the information-gatherers...for example, they's subcontract out the record-keeping to a raft of smaller, linked entities. Then you'd have to prosecute people and companies for accessing illegal data banks, etc.) I am willing to support a few laws, about murder, theft, rape, etc., but not busybody laws trying to control what information people collect. If someone asks what the relevance to this list is of this issue, then they really are as dumb as dirt, and as dumb as endangered dirt, too. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

I've just unsubscribed from cypherpunks
by Rich Salz 17 Dec '03

17 Dec '03

Normally, when people post notices proclaiming "Jim, I'm putting you in my killfile" or "I can't take it, you've ruined this list, I'm leaving!" I think it's among the worst kind of petty egotism. (To date myself, Chuq's old "goodbye" postings are still the pinnacle of this for me.) It makes me very uncomfortable to write the Subject line, but it is clear and to the point; it makes things easier for would-be readers to decide what to do. And who said writing is supposed to be asy, anyway? :) Pot, kettle, guilty as charged, I suppose. In my defense, however, I want to explain that I've had many public exchanges with people on this list, and this seems the most effective way to let them know that they will now have to send me email directly. In particular, if anyone has a rational reply to my MS CAPI export issue, please Cc me. Later, /r$

2 2

Carrying the Bible an Offense?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:41 PM 2/14/96, Sten Drescher wrote: >"Declan B. McCullagh" <declan+(a)CMU.EDU> said: > >DBM> (I assume your Bible argument is just posturing. No >DBM> U.S. Attorney, political appointees they, ever will prosecute >DBM> someone who puts the complete text of the King James Bible >DBM> online.) > > You assume wrong. While I certainly agree that no >U.S. Attorney would voluntarily prosecute such a case, what happens >when an athiest files charges against someone for carrying the Bible? >IANAL, but couldn't the U.S. Attorney be forced to prosecute? I'm also not a lawyer, but no prosecution is possible in this situation. Not in this country. A case must be presented to a grand jury (remember the Zimmermann case?) and no grand jury in the United States would do this. There are two further points which need clearing up: 1. Private citizens (the atheist in this case) do not file criminal charges. They may swear out a complaint ("I witnessed John Doe carrying a Bible"), but they do not file criminal charges. 2. The "carrying of a Bible" is not covered by the CDA. No prosecutor can be "forced" to prosecute, absent approval by a grand jury. (And if a prosecutor doesn't want to indict a ham sandwich, it won't be indicted.) --Tim May [This Bible excerpt awaiting review under the Communications Decency Act] And then Lot said, "I have some mighty fine young virgin daughters. Why don't you boys just come on in and fuck them right here in my house - I'll just watch!"....Later, up in the mountains, the younger daughter said. "Dad's getting old. I say we should fuck him." So the two daughters got him drunk and screwed him all that night. Sure enough, Dad got them pregnant....Onan really hated the idea of doing his brother's wife and getting her pregnant while his brother got all the credit, so he pulled out before he came....Remember, it's not a good idea to have sex with your sister, your brother, your parents, your pet dog, or the farm animals, unless God tells you to. [excerpts from the Old Testament, Modern Vernacular Translation, TCM, 1996]

4 3

Re: PING packets illegal?
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Some entity that called itself "Mark M." appears to have said: > On Tue, 13 Feb 1996 anonymous-remailer(a)shell.portal.com [me] wrote: >> that ...... but if those ping packets contained little pieces of something >> like PGP ...... would the host being pinged be breaking the law? Would > Exporting encryption to the U.S. from another country is not illegal, only > exporting from the U.S. is. The method of transmissioni is irrelevant. It > does not matter if TCP packets or ICMP-ping packets are used to transmit the > data. That wasn't my point. I was talking about the host being pinged. Would that host be breaking ITAR regulations by sending those evil PGP-containing packets *back* to the foreign host? > the destination are violating the law. Since it is impossible to monitor the > contents of every packet being transmitted over a network, I seriously doubt > that any intermediate host would be considered to be in violation of ITAR. Impossible, maybe. But that doesn't mean it can't be illegal. Take the CDA, for example. Fuck. Oops, Exon will be displeased. Am I going to be taken to jail? Most likely not. Was it illegal? Technically, yes. Thanks, Michael Ellis <mellis(a)alpha.c2.org> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMSKhUQqs/Oe38tFJAQGPLgP/WDwoyj9qNZp7BznEyvQ8tdiGwZUb7xY0 HvfopqkD9p2oLHqRTBIbBZnSfGnQxmBwj/nTOaoWRWb8SvEWYmgT9AIVaOtNd2BW dqHoHGbc100o1yNUgY1YC5i09jQW668Np7zr82Vdt8uNnFIROH7Tl9wXO6uxYnGw Wd041hx3PrM= =25Ah -----END PGP SIGNATURE-----

2 1

anonymous age credentials, sharing of
by Michael Froomkin 17 Dec '03

17 Dec '03

Suppose Alice is a CA who issues anonymous age credentials. Bob is 15 Carol is 25 Carol gets a legitimate anonymous age credential from Alice bound to an anonymous public key generated for this purpose. Carol then gives the key pair to Bob. Bob uses to do things only adults are legally permitted to do. (It's not bound to Carol's everday keypair because that's not anonymous....) What can stop Bob and Carol from subverting a scheme that relies on anonymous age creditials in this manner? If the answer is "nothing" this might mean that purveyors of "adult" material might have no defense against a law requiring that they collect a True Name + age creditential.... A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

3 2

Re: Patents suck
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

>I take some disagreement with that. > >With patents, there is a problem of large companies owning them yet >doing nothing with them except suing other companies or individuals. If you reject that possibility, you imply that the result of your work for yourself might not be your own property. It does not matter if the idea patented was originated be the patent holder of was purchased by the patent holder. Money is equivalent to personnal work. And the property rights *are* fundamentals (even if not implemented in Biiieauuuutifull Canada...). You can not have your cake and eat it too... >Patents would be better if there was a good-faith attempt on the >part of the holder to "use it or lose it". Somebody sitting on a >patent and doing nothing with it deserves to lose it after a number >of years. AFAIK, such clause already exists in Canada. But again, I am not a layer. JFA **** NEW PGP 2.6.2 KEY ********* This key is actually suspended, as of Feb, 16 1996, was never distributed, and might be subject to deletion. Sorry for the trouble my mis-management might have caused. 2048 bits Key ID:24201BA1 1996/02/13 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 23 B6 24 31 86 67 FB 35 C7 A7 AF 12 A1 61 E9 3D **** OLD KEY: DO NOT USE ANYMORE UNLESS FOR VERIFYING SIGNATURES **** 1024 bits Key ID:57214AED 1995/10/04 Jean-Francois Avon <jf_avon(a)citenet.net> Key fingerprint = 84 96 76 AE EB 7C AB 15 88 47 87 B0 18 31 74 9F

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

> From owner-cypherpunks(a)toad.com Mon Feb 19 17:50:19 1996 > Date: Mon, 19 Feb 1996 17:17:52 -0600 (CST) > From: IPG Sales <ipgsales(a)cyberstation.net> > We are not currently revealing all the details of our system because of > patents in process, and other relat6ed matters. We are offering the > software. You should be able to readily decompile it and determine the > algorithms used andf how they are used to generate random number sequences > for very long files. For short messages, a true OTP is used directly. Marketing Fluff - read "we don't *want* to revel it". Patent stuff doesn't take long to get the initial disclosures filed. Cypherpunks are generally engineers and are immune to such crap. > If you are aware of encrtypting technology, you recognize that hardware > prime number cycle wheels for the basis of some of the most secured > hardware systems employed for encryption. We simply expand that technogy > using software to set an intial setting, an adder, and a limit for 64 > such wheels, using large random prime numbers for each of those settings. > The total number of possibilities is over 10 to the 1690th power and can > be much larger. So. Large "random" prime numbers are generated. From what? How? Obviously these act as keys to your "OTP". Figure out how to match this prime and you can generate the same "OTP". > Thus we can eliminate the need to have the length of the OTP to be equal > to the length of the file - if you do not belive that it works, try it > and see - it takes inly a few hours to set such a trial up. We generated > over 790 gigabytes of charcaters, on multiple backups, and tested. Our > standard deviations, chi squares, Delta ICs for bits, characters, sets, > and the entire set were random. The sets are random, and you can take > that to the bank. So the data coming out appears random. Big whoopie. Lots of algorithms can generate the same thing. The key is how do you seed that random number generator? This isn't even close to being a OTP. A OTP by definition has a random set of data that is transmitted to the receipient over a seperate secure channel from the actual message to be sent. The actual message and the OTP are XOR'ed together and sent. The receipient then XORs the OTP and the encrypted message to get plaintext. That is pretty simple - even a marketing drone should be able to figure that one out. Now - explain how (in generic terms) your system acts as a OTP. > Someone, will decompile it and discover that it is truly random, at least > from the practical usage basis. But we need that time to file patents, > cvopyrights and the like. Yes - hopefully someone will take the time and money to decompile it. .... but if you are so sure of yourself, why not give away some demo copies. Why not source of the security functions? (Shove that patent crap someplace - you wouldn't be selling it if your disclosures weren't already filed) > The IPG system solves the key management problem and produces a truly > unbreakabkle system. We make no apologies for not currently revealing all > of the methodologies andf algorithms, but they will be revealed with > time, by us or others, and you will discover that it is indeed a simple, > easy to use, easy to install, truly unbreakable system. "unbreakable" - Bullshit - you obviously don't know crap. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

14 25

Off-topic, but pertinent...
by Ed Carp 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sun, 18 Feb 1996 01:00:06 -0800 From: Sun Angel Innovations <webmaster(a)sun-angel.com> To: quotes(a)sun-angel.com Subject: Daily Quote for Sunday, 18 February 1996 If you resist reading what you disagree with, how will you ever acquire deeper insights into what you believe? The things most worth reading are precisely those that challenge our convictions. unknown -- Sun Angel Innovations | http://www.sun-angel.com/ | info(a)sun-angel.com

1 0