December 2003 - cypherpunks-legacy

EFF on crypto bills
by Declan B. McCullagh 17 Dec '03

17 Dec '03

[In reply to Shabbir's message. -Declan] ---------- Forwarded message begins here ---------- From: Stanton McCandlish <mech(a)eff.org> Message-Id: <199603062155.NAA22301(a)eff.org> Subject: Re: NYT: Encryption compromise bill introduced To: shabbir(a)vtw.org (Shabbir J. Safdar) Date: Wed, 6 Mar 1996 13:55:07 -0800 (PST) Cc: declan+(a)cmu.edu, fight-censorship+(a)andrew.cmu.edu, jim(a)rsa.com In-Reply-To: <199603062014.PAA02169(a)panix4.panix.com> from "Shabbir J. Safdar" at Mar 6, 96 03:14:01 pm > The Leahy bill is actually much better than Stanton lets on. Take a > look at it, it affirms Americans' right to choose whatever algorithm or > technique they'd like, as well as takes great pains to go on record to > say that Congress treaded very carefully to preserve Americans' right > to not use key escrow algorithms, and if they did, not to use escrow > agents. You don't get much more of a guarantee than that. Sure you do: Goodlatte's more direct prohibition on the Exec. branch mandating Key Escrow. What's the problem here? We know Goodlatte's version, on this provision at very least, is better. Why can't we just agree that it is, and support that? Goodlatte's bill isn't competing with Leahy's, they were introduced simultaneously in different chambers, and are intended to get the same message across. I can't see a problem with saying "we like this particular phrasing better, let's have it in both versions." The entire point of all this is to have the same bill on both sides of Congress anyway. It can either happen early, or (on the off chance it ever gets that far) in conference committee. Here we have a large say. In conf. cmte. we have almost no say. Again, what's the problem? What are we arguing about? > Regardless of the ulterior motives of the White House, key escrow > programs are still voluntary as read on the books. The best we can > write into a law is to have our rights reaffirmed. Leahy has given > this to us in spades. I disagree. A better thing we can write into law is to simultanously have rights reaffirmed, and send a more direct message to the Admin that it cannot tread here. > Let's not soft-pedal this legislation. Let's not hard sell flawed parts of it, when fixes are not just available but already introduced as "live" legislation. > Leahy and Goodlatte are going > head to head with the White House to undermine the strongarm export > tactics of Clipper and Son of Clipper. They've stuck their necks out for > us, we need to back them up. Certainly. > Just wait until the White House starts to act in reaction to this. It's > not going to be pretty.... No kidding. I expect either an attempt to mandate escrow, a worsening of the export controls, and/or an all-out assault on American's rights to encrypt at all, or without some kind of worse-than-GAK registry or licensing. If not all of the above. -- <HTML><A HREF="http://www.eff.org/~mech/"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org/"> Electronic Frontier Foundation </A><P> Online Activist </HTML>

1 0

VTW on crypto bills
by Declan B. McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message begins here ---------- From: shabbir(a)vtw.org (Shabbir J. Safdar) To: Stanton McCandlish <mech(a)eff.org> cc: declan+(a)cmu.edu (Declan B. McCullagh), fight-censorship+(a)andrew.cmu.edu, jim(a)rsa.com Subject: Re: NYT: Encryption compromise bill introduced Date: Wed, 06 Mar 1996 15:14:01 -0500 Sender: shabbir(a)panix.com The Leahy bill is actually much better than Stanton lets on. Take a look at it, it affirms Americans' right to choose whatever algorithm or technique they'd like, as well as takes great pains to go on record to say that Congress treaded very carefully to preserve Americans' right to not use key escrow algorithms, and if they did, not to use escrow agents. You don't get much more of a guarantee than that. Regardless of the ulterior motives of the White House, key escrow programs are still voluntary as read on the books. The best we can write into a law is to have our rights reaffirmed. Leahy has given this to us in spades. Let's not soft-pedal this legislation. Leahy and Goodlatte are going head to head with the White House to undermine the strongarm export tactics of Clipper and Son of Clipper. They've stuck their necks out for us, we need to back them up. Just wait until the White House starts to act in reaction to this. It's not going to be pretty.... -Shabbir J. Safdar * Online Representative * Voters Telecomm. Watch (VTW) http://www.vtw.org/ * Defending Your Rights In Cyberspace Stanton McCandlish writes: >> Date: Tue, 5 Mar 96 13:26:39 PST >> From: jim(a)RSA.COM (Jim Bidzos) >> Message-Id: <9603052126.AA19534(a)RSA.COM> >> Cc: cypherpunks(a)toad.com >> >> >> I'm in favor of the Bill because it specifically prevents, by law, the >> US Govt from mandating key escrow. > >This is only true of the Goodlatte bill. The Leahy bill just explicitly >does not mandate GAK. Goodlattes does this, and goes further, preventing >the Administration from doing so. > >Needless to say, we'd like to see the two bills merged, and the better >features of each kept. > >> I anticipate that the Administration, led by the intelligence and law >> enforcement interests, will vigorously lobby against this bill... > >Right. We don't expect it to pass, but it could be an important step in >raising the issues. > > >-- ><HTML><A HREF="http://www.eff.org/~mech/"> Stanton McCandlish ></A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org ></A><P><A HREF="http://www.eff.org/"> Electronic Frontier Foundation ></A><P> Online Activist </HTML>

1 0

Re: Another Motivation for the CDA
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 08:45 AM 3/6/96 -0500, Mutant Rob wrote: >Timothy C. May wrote: >> >> Given that Sen. Fineswine is one of the strongest supporters of gun >> confiscation, and that she had this to say about the Telecom Bill:[..] > >Felons may not own a gun unless granted a waiver by certain judges. They >also lose the right to vote, BTW. > >I think you're reading too much into motives, Tim. I don't think that >most in congress are capable of thinking that elaborately, and besides, >if someone is convicted of violating the CDA for saying "fuck" online, >that is the type of felony that one can get a judge's waiver for... I am NOT relieved at hearing this. If one must have a "judge's waiver," then that means he probably can "request" whatever other conditions he chooses to put on his waiver. The government still has a motivation to make every crime a felony, down to and including jaywalking and speeding tickets. (Don't try to tell me "they can't turn speeding tickets into a felony." The term "felony" is defined, and can be RE-defined, to whatever the legislature wants at any time. Naturally, this won't occur all at once; it'll happen in "reasonable" stages.) All the more reason to adopt a system that will rid us of these parasites forever. KnowhutImean? Jim Bell jimbell(a)pacifier.com Klaatu Burada Nikto Something is going to happen. Something.......................Wonderful! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMT3R4PqHVDBboB2dAQGOKAP/aLqcF1rK+sXHS2rFMHWhtOUw/0Su8J2l Cpk5GhmEJxGnBK4LKszhl/jX982AMDIRRrop5k0z1l4ezs1cnI0fwzniNwYWluG0 qjmcJ/rkEmPrA5cKwj9dqxsKi+lex1pApNOmogICkLdzUZgHrj6wAEmLKzqiNDiU 7XJdtbsMSFY= =7sEd -----END PGP SIGNATURE-----

1 0

Ignore
by uunet!in2.uu.net!news.cais.net!news.cais.com!news＠warwick.com 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 9 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 9 March 5, 1996 CONTENTS: (1) Bills To Relax Crypto Export Controls Introduced by Leahy, Burns, Goodlatte, Others (2) Subscription Information (3) About CDT, contacting us This document may be redistributed freely provided it remains in its entirety ** Excerpts may be re-posted by permission (editor(a)cdt.org) ** ----------------------------------------------------------------------------- (1) BIPARTISAN BILLS TO EASE ENCRYPTION CONTROLS AND PROTECT INTERNET PRIVACY INTRODUCED IN SENATE AND HOUSE A bipartisan group of members from both houses of Congress today introduced legislation to lift many export controls on strong encryption hardware and software and affirm the rights of Americans to use whatever form of cryptography they choose. The bills, sponsored by Sen. Leahy (D-VT), Sen. Burns (R-MT), Rep. Goodlatte (R-VA), Rep. Eshoo (D-CA), and others, represent a major step towards breaking the stranglehold on encryption technologies which for years has denied computer users access to vital privacy-protecting applications. The "Encrypted Communications Privacy Act of 1996" represents a rejection of the Clinton Administration's invasive and unworkable "Clipper Chip" and "Clipper II" key escrow policies. Under the guise of promoting so-called "voluntary" encryption standards, these Administration efforts have sought to use export controls to compel the adoption of key escrow encryption domestically, and have left Internet users without adequate privacy and security. By relaxing export controls on "generally available" cryptographic applications such as PGP, popular Web browsers, and other programs, the Encrypted Communications Privacy Act of 1996 would encourage the development and use of strong privacy protecting technologies. Major provisions of the legislation would: * Ease export controls on encryption products, allowing the export of 'mass market' or 'generally available' cryptography. This would include products such as PGP or many of the popular Web browser programs. * Affirm the right of Americans to use any encryption domestically. The bills explicitly prohibit the government from imposing any limits on the domestic use or sale of encryption. * (Senate version only) Provide protections to those who choose to store their encryption keys with third parties by creating criminal and civil penalties for the unauthorized disclosure of keys and strict requirements for law enforcement access. The bill does not in any way affect the ability of any person to use encryption without a key escrow function.. The legislation also contains several provisions which CDT believes require further clarification and consideration, including controversial language that would create a new federal crime for the use of encryption to willfully obstruct a law enforcement investigation. CDT will work with Senators Leahy and Burns and Representatives Goodlatte, Eshoo, and other interested members to address these concerns as the bill makes its way through the legislative process. The full text of both the House and Senate versions of the bills, along with other relevant background information, is available on CDT's Crypto Issues World Wide Web page: http://www.cdt.org/crypto/ CDT believes that the House and Senate encryption bills are an important step forward in the ongoing attempts to build better security into the information infrastructure through the widespread availability of encryption. Congressional action is particularly welcome as the Administration has continued to impose a flawed approach to encryption based upon export controls, key length limits, and key escrow policies all aimed at slowing the adoption of strong cryptography in the U.S. and throughout the world. While CDT believes improvements can be made in both bills, they establish a solid framework for building a comprehensive, global cryptography policy. CDT believes the bills deserve careful consideration and support. We look forward to working with Senator Leahy, Senator Burns, Rep. Goodlatte, Rep. Eshoo, individual Internet users, public interest advocates, and the computer and communications industry to develop a cryptography policy that protects privacy, security, and competitiveness on the Global Information Infrastructure. SUMMARY OF THE LEGISLATION: WHAT THE BILLS WOULD DO The House and Senate bills both modify Title 18 of the U.S. Code to clarify the status of encrypted communications, access to those communications by law enforcement, and the liability of third-party key holders. The bills would: * SIGNIFICANTLY EASE EXPORT CONTROLS: The bills would remove all export restrictions on "mass market" or publicly accessible encryption software and similar hardware -- that is, products that are generally available to the public and sold for installation "as is," or that are in the public domain such as PGP or some popular web browsers. (For example, products commercially available "off the rack," or freely available to the public via the Internet, would all be exportable.) Other encryption hardware would be exportable to countries where hardware with similar capabilities is already commercially available. The bills also allow export of other encryption software if it is currently exportable under law for use by foreign financial institutions. * PROHIBIT ANY RESTRICTION ON THE DOMESTIC USE OR SALE OF ENCRYPTION: The bills would affirmatively prohibit any government restrictions or attempts to mandate the domestic sale or use of any type of encryption. * IMPOSE CIVIL AND CRIMINAL LIABILITY FOR UNAUTHORIZED KEY DISCLOSURES: (Senate Version Only) The Senate bill would lay down privacy guidelines to protect those users who choose to store their keys with third parties. The bill would impose civil and criminal penalties for the unauthorized release of decryption keys or other decryption assistance by third parties who individuals have entrusted with their keys. No privacy protections and only limited restrictions for law enforcement access currently exist for those who choose to store their keys with trusted third parties. * PROVIDE LIMITS FOR ACCESS TO KEYS BY LAW ENFORCEMENT: (Senate Version Only) The Senate bill would also spell out limits and guidelines for law enforcement access to the keys of those users who have chosen to store their keys with third parties. Today, encryption keys held by third parties could be released to law enforcement with nothing more than a subpoena. Under the Senate bill, third parties could only provide assistance to law enforcement in decrypting communications if presented with a court order. The bill also limits the scope and duration of such assistance. Decryption keys for stored communications could be disclosed with a proper court order or subpoena. * ESTABLISH A BROAD "PERSONAL USE EXEMPTION" FOR U.S. TRAVELERS: The bills would allow U.S. persons to use any form of encryption in a foreign country, establishing a less restrictive form of the "personal use exemption" recently published by the State Department. The provision is intended to accommodate "U.S. citizens and permanent residents who have the need to temporarily export encryption products when leaving the U.S. for brief periods of time". While the intent of this provision is clear, CDT believes that the language of the bill should be further clarified. * PROHIBIT THE USE OF ENCRYPTION TO CONCEAL THE COMMISSION OF A FELONY: Finally, the bills would criminalize the use of encryption to willfully obstruct justice. Anyone who "willfully endeavors" to use encryption for the purpose of obstructing, impeding, or preventing the communication to a law enforcement officer of information relating to a Federal felony would be subject to criminal penalties. CDT believes this new federal crime is unnecessary since it duplicates obstruction of justice crimes that are already available to prosecutors, and is unwise since it might be interpreted to discriminate against users of encryption. BACKGROUND - BILLS ADDRESS LONG-STANDING FRUSTRATIONS WITH U.S. ENCRYPTION POLICY Congressional action comes as Clinton Administration encryption restrictions continue to jeopardize the security of computer users. Encryption tools, which scramble electronic communications and data, are widely viewed as the key to providing security and privacy and encourage commerce on the Global Information Infrastructure. Individuals need encryption in order to trust the GII with confidential data such as financial transactions, medical records, or private communications. Businesses need encryption to provide individuals with privacy protections they need and to protect their own proprietary information as it flows across vulnerable global networks. The lack of good encryption today has left computer users vulnerable to the prying eyes of hackers, corporate competitors, and even foreign governments. Current Administration policy restricts the export of "strong" encryption hardware or software products with keys greater than 40 bits long. (The length of encryption "keys" is often used to indicate the security of a system.) Export controls actually influence the entire GII -- both domestically and internationally -- due to the difficulty of distributing and interoperating products with different strengths of encryption. The level of security permitted under the export controls, and hence the level of security largely available to domestic users as well, has been judged woefully inadequate by many experts. Even the most recent Administration "Clipper II" proposals would only allow the export of moderately stronger encryption, and then only with "key escrow" restrictions to guarantee U.S. government access to individual keys -- restrictions which raise real Constitutional issues and are bound to fail in the competitive international marketplace. In recent months, groups from across the political spectrum have increasingly criticized the Clinton Administration's restrictive export controls. In November 40 companies, trade associations, and public interest groups wrote to Vice President Gore calling the latest Administration proposals flawed and inadequate. Last month a report by the CEOs of 13 leading U.S. technology companies found that U.S. industry stands to lose up to $60 billion dollars per year by the year 2000 due to restrictions on the export of cryptography. And several weeks ago a group of noted computer security experts released a report calling for the deployment of dramatically longer encryption key lengths of at least 75 to 90 bits. The House and Senate bills give voice to this growing drumbeat of criticism demanding a radical departure from the flawed approach of the Clinton Administration's current encryption polices. CDT looks forward to working with members of Congress to push for a more comprehensive U.S. encryption policy that reflects the privacy and security needs of computer users. FOR MORE INFORMATION More information on the cryptography policy debate, including the text of the Senate and House bills, is available on CDT's Cryptography Issues Web Page: http://www.cdt.org/crypto/ For More Information Contact: Center for Democracy and Technology +1.202.637.9800 Daniel Weitzner, Deputy Director <djw(a)cdt.org> Alan Davidson, Staff Counsel <abd(a)cdt.org> ----------------------------------------------------------------------- (2) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by more than 9,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (3) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.9 3/5/96 -----------------------------------------------------------------------

1 0

Good news for Canadians, I think...
by Martin Janzen 17 Dec '03

17 Dec '03

On the mailing list for the "Electronic Frontier Canada" (similar to, but not a part of EFF), David Jones (djones(a)insight.dcss.McMaster.CA) writes: > > Feds want encryption; Police opposition ignored. > >The federal government wants its employees, and Canadians in general, >to use strong, public-key encryption. Yes, the same encryption methods >that American law enforcement is so uptight about. The same encryption >that Canadian cops want to avoid, so they can continue to eavesdrop. > >It's summarized in a recent Ottawa Citizen article: > > gopher://insight.mcmaster.ca/00/org/efc/media/citizen.13feb96 > >You may recall the Canadian Association of Chiefs of Police (CACP) >have voiced their opposition to any encryption of communications unless >police had access to a "backdoor" last summer. > > gopher://insight.mcmaster.ca/00/org/efc/law/cacp.24aug95 > >In Canada, it looks like the right to privacy of telecommunications >might take precedence over the police interest in snooping to catch >criminals. I won't repost the entire article here, but here are some highlights: - The system is initially intended to secure email between federal government employees. Deployment is expected to begin next year. - Key management is decentralized; each department hands out its own keys. - Top-secret messages will be encoded using "palm-sized computer cards" (presumably some kind of PCMCIA device). - The Communications Security Establishment (~= NSA) helped to design the system, and claims that it's "more sophisticated than existing public versions". (This is the part that still worries me a bit, even though EFC's David Jones is quoted as saying that he has no concerns. Will the algorithms be published? Also, why develop a new, untested system -- why not just buy the thing from RSA, Viacrypt, etc.? Stay tuned...) - There's a great quote from Bob Little, deputy secretary of financial and information management for the Treasury Board: "[The CSE] don't have access to the keys . . . and never will. We did it to avoid the American experience with the Clipper Chip." - The RCMP (~= FBI) is not amused. All in all, it sounds like a positive development for once. -- Martin Janzen janzen(a)idacom.hp.com

1 0

MARCH BAY AREA MEETING
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, For the second (and last) time, the Bay Area Cypherpunks meeting will be held at the offices of Simple Access, fourth floor, 388 Market Street, San Francisco. The meeting will be from noon to 6pm (or so) on Saturday, 9 March. As of this notice, there is no agenda. (Funny, we never seem to be at a loss for words.) Street parking is scarce, garages are expensive; consider public transit. If anyone wants BART, CalTrain or bus information, let me know. Otherewise, here are driving instructions: PENINSULA --North on 101 (or 280 to 101) to Golden Gate/Bay Bridge fork. --Right on 80 (Bay Bridge, Oakland) to 4th St. exit. --Take 4th St. exit. --At the bottom of the ramp, go sort of straight (soft left) onto Bryant (parallel to 80, towards Bay). --Take Bryant about 4 blocks to Fremont. --Take Fremont about 5 blocks to Market. --Follow instructions under "END GAME," below. EAST BAY --Take 80, west across the Bay Bridge to Fremont exit. --Take exit and turn left on Fremont. --Take Fremont about 2.5 blocks to Market. --Follow "END GAME" instructions. END GAME --The building on the far-right corner is 388 Market. --Find a place to park. --Sign in at lobby desk. You are going to visit Simple Access on the 4th floor. --Take the elevator to 4 and follow the signs. --The phone number is: 415-296-2544. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Boycott "Applied Cryptography" and AT&T and RSA
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Bruce Schnier (Author of applied cryptography) and Matt Blaze (Who is a crypto bigwig at at&t) have made it clear that they support key escrow. Both have written letters in favor of the new crypto law, it creates a key escrow system and also other restricts on crypto. The letters are on the CDT homepage and i think were posted here. WHAT THE FUCK?????????????????????????????????????????? EFF, EPIC, VTW and almost everyone else (except for Bizdos at RSA, hmmmm) have all come out against this piece of shit. But with these so called experts baking it it could pass anyway. Maybe the ltrs are a forgery? We should ask them, and if this is true, LETS SEND THEM A MESSAGE!!!!!!!! SWITCH YOUR PHONE SERVICE AND TELL AT&T WHY!!! STOP RECOMMENDING APPLIED CRYPTO (THERE ARE EASIER BOOKS ANYWAY). DEMAND THAT THESE PEOPLE STOP GIVING AWAY YOUR RIGHTS!!!!!!!!!!!!!!!!!!!!!!!!!!! their addresses are schneier(a)counterpane.com mab(a)crypto.com jim(a)rsa.com

4 3

EFF Statement on Leahy/Burns/Murray Crypto Bill
by John Gilmore 17 Dec '03

17 Dec '03

New "Encrypted Communications Privacy Act" - Enabling Electronic Envelopes ========================================================================== FOR IMMEDIATE RELEASE ELECTRONIC FRONTIER FOUNDATION +1 415 436 9333 ask(a)eff.org March 5, 1996 http://www.eff.org The Electronic Frontier Foundation (EFF) is encouraged to see Congressional support for lifting restrictions on encryption and affirming privacy rights for U.S. citizens. The bill introduced today by Senators Pat Leahy (D-VT), Patricia Murray (D-WA) and Conrad Burns (R-MT) is an important step in reclaiming privacy and encryption rights for society and business. The bill would legalize wide use of "electronic envelopes" to protect private information. Today this information travels on "electronic postcards" which can easily be altered or intercepted. However, the bill also includes key escrow and obstruction of justice provisions which would cause problems if enacted. "The bill provides a new opportunity to bring reason into the crypto policy debate," said EFF co-founder John Gilmore. "We support the Senators for bringing their energy into the process. The bill is a good start, and with healthy debate and modification, it could become acceptable legislation." Electronic privacy and encryption policy is extremely complex because it intertwines our constitutional rights of free speech, publication, association, and protection from self-incrimination and unreasonable search, with issues of wiretapping, spying, military security, personal privacy, and computer security. This bill would pick a new balance among these competing interests, with long-term impacts on our society and economy. EFF is committed to working with government, industry and public interest organizations to raise the level of understanding and debate in resolving these complex issues. Export Control Liberalization ----------------------------- The Encrypted Communications Privacy bill would make long-overdue changes to the export restrictions currently hampering the deployment of privacy and security "envelopes" for Windows, Unix, the Mac, and the Internet. The bill: * Moves export control of all non-military information security products, incuding encryption, to the Commerce Dept., whose rules protect constitutional rights and reflect market realities. * Requires that no license be required to export generally available mass-market software, public domain software, and computers that include such software. * Requires that export be authorized for non-military encryption software to any country where similar software is exportable from the U.S. to foreign financial institutions. * Requires that export be authorized for encryption hardware if a comparable product is available overseas. The above changes would significantly improve the nation's crypto policy. But they make detailed changes in a very complex section of the law and regulations. There is a significant risk that they will be implemented by the Administration in a different fashion than Congress intended. This happened in 1987, for example, when Congress tried to eliminate NSA meddling with civilian computers by passing the Computer Security Act. It was subverted by a series of Presidential directives and agreements among Executive Branch departments. The result today is that NSA is still in control of domestic security and privacy policy. We would encourage futher deregulation as a simpler, more effective, and far more reliable solution. The bill should simply eliminate all export controls on non-military encryption. Criminalization of Encryption and Encouragement of Key Escrow ------------------------------------------------------------- The following provisions raise serious concerns about the imbalance between the rights of the people and the desires of the goverment. EFF feels that the impact of these provisions must be closely considered, and will work to modify or remove them to better serve the public interest. The bill: * Makes it a new crime to "use encryption to obstruct justice", with 5-10 year sentences, plus fines. In plain language, this is a extra criminal charge that can be applied when police are frustrated in an investigation but happen to catch someone breaking the law in some other way. It's like Adding an extra ten-year jail term if you close your curtains while committing a crime. Americans have the right to protect their own privacy by any nonviolent means, and we expect that encryption will soon be built into all computers, phones, and networks. * Provides a legal infrastructure for key escrow, a system in which all users' keys are copied to permit government access. The Clinton Administration has been pushing key escrow to replace its failed "Clipper chip", out of fear that if Americans have real privacy they will abuse it. These provisions in the bill would encourage people to use the flawed key-copying system. Clarification and Refinement ---------------------------- The are a number of areas of the bill that would benefit from additional debate and clarification. Specifically, where the bill: * Explicitly does not mandate key escrow, but fails to prohibit the Administration from attempting to impose it with regulations. * Outlaws disclosure of others' keys except to the government, with 1-2 year sentences, plus fines, but includes a broad "good faith" exemption for when the government does something illegal or unconstitutional. * Requires disclosure of other peoples' keys to the government, under the same procedures currently used for wiretaps, searches of online records and backup tapes, and fishing expeditions in billing records. The provision does not always require adversary legal process, in which citizens can argue for their privacy before a judge, but instead relies solely on the integrity of prosecutors. * Legalizes the use any encryption "except as provided in this Act...or in any other law". EFF's Proposed Crypto-Privacy Principles ---------------------------------------- EFF's Cryptography and Privacy Policy Principles, which were originally written during the Clipper Chip debate, are the touchstone by which we measure privacy legislation and policy issues: * Private-sector access to encryption technology must not be hindered, either by regulation of what crypto may be used domestically, or by restriction on what may be exported. * Government policy on encryption usage and standards must be set in open forums with proper attention paid to public input. Secret hearings and classified algorithms have no part to play in a democratic process. * Encryption must become part of the "information infrastructure" to protect personal, commercial and governmental privacy and security. Cryptographic tools must not be crippled or weakened for the convenience of government agents, and users must be free to choose what encryption they prefer and whether and to whom they will reveal encryption keys. Law enforcement must obtain court orders, not simply administrative subpoenas to seize keys or decrypt and search encrypted information. * Government policy regarding emerging technologies like encryption must not erode Constitutional protections. In particular, any such policies must be compatible with the rights to freedom of speech, press and association, freedom from coerced self-incrimination, and freedom from unreasonable search and seizure. * Encryption will be built into all next-generation Internet, communications and computer technology. There must be no government policy equating use of encryption with evidence of criminal behavior, nor the creation of any new crime category that holds encryption users liable for making criminal investigation more difficult. * Government at all levels should explore cryptography's potential to replace identity-based or dossier-based systems - such as driver's licenses, credit cards, social security numbers, and passports - with less invasive technology. The Encrypted Communications Privacy bill at this time passes some of these tests, and we are committed to working with industry, government, and public interest organiations to address the remaining issues. Background: EFF and Crypto-Privacy Policy ----------------------------------------- The Electronic Frontier Foundation (EFF) is a nonprofit public interest organization devoted to the protection of online privacy and free expression. EFF was founded in 1990, and is based in San Francisco, California. The International Traffic in Arms Regulations (ITARs), administered by the State Department, and in the background by the National Security Agency, unreasonably treat encryption software and hardware as if they were weapons of war, like rockets and bombs. It has proven very difficult to deploy U.S.-made encryption products in an increasingly important global market due to these regulations, at a time when the need for online security systems for personal and commercial use has never been more keenly felt. EFF has for several years led efforts to fend off governmental attempts to restrict the development and public availability of secure privacy technology. In 1993-4, EFF and other civil liberties organizations successfully opposed implementation of the U.S. Administration's "Clipper" or "Skipjack" system - hardware encryption for voice and data communications in which all encryption keys are held by government for the convenience of law enforcement and intelligence agencies. In 1994, we helped ensure that crypto export became a major legislative topic, laying the groundwork for eventual liberalization of the ITARs. In 1994 and 1995 EFF opposed implementation of and helped defeat funding for the FBI's "Digital Telephony" scheme, in which up to one person on every city block could be simultaneously wiretapped. In 1995, we filed an ongoing federal lawsuit with mathematician Daniel Bernstein, challenging the constitutionality of the export control laws. Online Resources for More Information ------------------------------------- Please see EFF's Internet archives for more details on this and other issues. EFF Privacy & Encryption Archive: http://www.eff.org/pub/Privacy/ EFF Legal Issues & Policy Archive: http://www.eff.org/pub/Legal/ Action Alerts: http://www.eff.org/pub/Alerts/ Topical Index of the EFF Archive: http://www.eff.org/links.html Contact Information ------------------- The Electronic Frontier Foundation 1550 Bryant St., Suite 725 San Francisco CA 94103 USA +1 415 436 9333 (voice) +1 415 436 9993 (fax) Internet: ask(a)eff.org John Gilmore, Co-founder and Member of the Board gnu(a)eff.org +1 415 221 6524

3 2

Re: SEAL cipher info requested (something actually list related!)
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

> > Christopher Allen writes: > > At 4:27 PM 1/27/96, Anonymous wrote: > > >Anybody have info on the SEAL cipher? I can't find any > > >descriptions or analysis of it. Refs, proceedings or URLS > > >would be a good thing. > > > > I also am interested in references to it. > > > > I'm told that it was invented by a cryptographer at IBM, and that it > > patented, so that should help in the search. > > Its a Don Coppersmith creation. It is blazingly fast. I believe it is > patented. > > Perry > Get Applied Cryptography!!! - Page 398 in issue 2. Source code on page 667 Brief - steam cipher. Phil Rogaway and Don Coppersmith @ IBM. uses "pseudo-random function family". Fast. Patented. ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

4 3

Re: Jump Start ecash With IPhone
by clarissa_wong＠alpha.c2.org 17 Dec '03

17 Dec '03

Adam Shostack <adam(a)homeport.org> mentioned: > The big problem with this is that net phones can be subject to > delay & drop out, and I don't want to deal with that when I'm talking > on the phone. Adam, Yes, and that's good news. We can claim, while we are building up our infrastructure, that we have a low-quality service that cannot compete with the current LD carriers. Meanwhile, several companies and committed enthusiasts are solving IPhone's technological problems. Also, ATM and other high-bandwidth technologies that the LD carriers are deploying can bring them profits when IPhone users request the _fast_ Internet. But the real money is in the billing system. And an efficient, decentralized ecash infrastructure will change the world. A cheap telephone-to-telephone long distance and international voice service, which people do want to buy, could provide the cash flow to jump start it. CW

1 0