December 2003 - cypherpunks-legacy

Gordon Liddy
by Alex Strasheim 17 Dec '03

17 Dec '03

Gordon Liddy just waved the bloody shirt in a stirring defense of crypto rights. The gist of it was that we can't trust the muderers of waco with our secret keys. He also mentioned PGP. I never how to react to over the top rhetoric that supports something I believe strongly in. -- Alex Strasheim, alex(a)proust.suba.com

1 0

Re: Truelly Random Numbers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:55 PM 3/5/96, Tim Fulbright wrote: >Now I, a lurker for two months, am truelly confused! L. Deitweiler must be >right. Surely one of you cyperpunk fellows could hack together a dongle with >some kind of AD converter and buffer ram to gather a Truelly Random Bitstream >off the environment every couple of milliseconds easier than this raindrop >scheme or recording the fan, you're haviung me on!. Let's go back fifty years >and get a vacuum tube to fitfully flicker? I who know next to nothing about >electronics suspect there is surely enough noise present in electornic devices >to gather a random bitstream that you could chop anywya you needed? Anyway, y Just because someone floats their idea does not mean it is the "list consensus"! That "raindrops falling on my plate" idea was something I deleted as soon as I saw that it wasn't a joke with a nice punchline. (Not all flaky ideas get rebutted...though, as a matter of fact, I did see several quick rebuttals of the raindrop idea as being impractical, too low a data rate, etc.) Johnson noise in semiconductors and alpha particle noise have indeed been discussed _many_ times. Check the archives, or my Cyphernomicon FAQ. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

"Zap part of the CDA" live Capitol Hill news conference on CU-SeeMe
by ISP-TV Main Contact 17 Dec '03

17 Dec '03

ISP-TV Network Presents: Zap the Comstock Law Before It Becomes a Computer Virus on the Internet! [Cybercast using CU-SeeMe (tm)] Representative Patricia Schroeder (D-CO) and Senator Frank R. Lautenberg (D-NJ) will hold a joint news conference at 10:00 AM EST on Wednesday, March 6, to discuss the introduction of a bill to strike a provision of the 1996 Telecommunications Act that criminalizes the transmission and reception of information about abotion over the Internet. The conference will be cybercast live from room HC-6 at the U.S. Capitol in Washington, D.C. Joining Lautenberg and Schroeder will be Kate Michelman, President of the National Abortion and Reproductive Rights Action League, and Kathryn Kolbert, Vice President of the Center for Reproductive Law and Policy. This will be the first Capitol Hill news conference ever to be transmitted live over the Internet using CU-SeeMe technology! See http://www.house.gov/schroeder/cu-seeme.html for more info. Time: 10:00 AM EST Thursday, March 6, 1996 IP: Main ISP-TV Reflector 205.197.247.33 Other ISP-TV affiliates see http://www.digex.net/isptv/members.html To obtain CU-SeeMe software, go to one of these URL's: CU-SeeMe for Windows -- http://goliath.wpine.com/cudownload.htm CU-SeeMe for Macintosh -- http://goliath.wpine.com/moredemos.htm http://www.digex.net/isptv for more information about ISP-TV

1 0

Whut it sez
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

Note: downloaded from www.vtw.org so cannot guarentee correctness- "§2804. Unlawful use of encryption to obstruct justice" "Whoever willfully endeavors by means of encryption to obstruct, impede, or prevent the communication of information in furtherance to a felony which may be prosecuted in a court of the United States, to an investigative or law enforcement officer shall-..." Interesting wording - sounds almost like if you impede the *commission* of a felony, you is been had. Keyword would seem to be "willingly". Suspect they meant to say "...obstruct (etc) the investigation of a felony..." "(b) CONTROL OF EXPORTS BY SECRETARY OF COMMERCE.- "(1) GENERAL RULE.-Notwithstanding any other law, subject to paragraphs (2), (3), and (4), the Secretary of Commerce shall have exclusive authority to control exports of all computer hardware, software, and technology for information security (including encryption), except computer hardware, software, and technology that is specifically designed or modified for military use, including command, control, and intelligence applications. This would seem to extend ITAR, not limit it. "(2) ITEMS NOT REQUIRING LICENSES.-No validated license may be required, except pursuant to the Trading With The Enemy Act or the International Emergency Economic Powers Act (but only to the extent that the authority of such Act is not exercised to extend controls imposed under this Act), for the export or reexport of- "(A) any software, including software with encryption capabilities, that is- "(i) generally available, as is, and designed for installation by the purchaser; or "(ii) in the public domain or publicly available because it is generally accessible to the interested public in any form; or "(B) any computing device solely because it incorporates or employs in any form software (including software with encryption capabilities) exempted from any requirement for a validated license under subparagraph (A). Microsoft's CryptoAPI seems OK. PGP would seem to fall under both (i) and (ii). "(3) SOFTWARE WITH ENCRYPTION CAPABILITIES.-The Secretary of Commerce shall authorize the export or reexport of software with encryption capabilities for nonmilitary end-uses in any country to which exports of software of similar capability are permitted for use by financial institutions not controlled in fact by United States persons, unless there is substantial evidence that such software will be- "(A) diverted to a military end-use or an end-use supporting international terrorism; "(B) modified for military or terrorist end-use; or "(C) reexported without requisite United States authorization. Thank you MasterCard/VISA for SET. Note that it does not seem to say that you do not need a license, just that one shall not be witheld without "substantial evidence". "(4) HARDWARE WITH ENCRYPTION CAPABILITIES.-The Secretary shall authorize the export or reexport of computer hardware with encryption capabilities if the Secretary determines that a product offering comparable security is commercially available from a foreign supplier without effective restrictions outside the United States. Same comment except that token & INE vendors will have to demonstrate that a foreign competitor exists. Real lawyers please comment. Warmly, Padgett

1 0

Test
by uunet!in2.uu.net!news.cais.net!nntp.uio.no!ns.ftns.no!news＠warwick.com 17 Dec '03

17 Dec '03

This is a test... -- Live on the edge, push the limits, and go EXTREME... -------------------------------------------------------------------------- Svein Ove Solsvik * E-Mail: sveinove(a)ringnett.no -Our Father, UART in Heaven, I/O'ed by the name...

1 1

test
by uunet!in1.uu.net!news.mathworks.com!tank.news.pipex.net!pipex!warwick!bsmail!mail!lwmdcg＠warwick.com 17 Dec '03

17 Dec '03

1 0

Just testing the post
by uunet!in2.uu.net!news.sprintlink.net!news.utech.net!＠warwick.com 17 Dec '03

17 Dec '03

Post Test -- John G. Jones Director, Computer Services UTDS, Inc. <http://www.utech.net> <mailto:john@utech.net> 1593 E. Chestnut Lompoc, CA 93436 (805) 735-4447

1 0

Needed: Dongles and "Crypto Boxes" on Ports
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:56 PM 3/5/96, Hal wrote: ... >It will be just as easy to steal the mixmaster executable as to steal a >script file containing a pass phrase. And it might even be possible to >run the stolen mixmaster directly to decrypt intercepted incoming mail >messages, without even having to type in the pass phrase. Failing that >the attacker could easily extract the pass phrase from the mixmaster >executable file. > >The other suggestion that was made here, that the operator would have to >manually type in the pass phrase every time the computer rebooted, would >be a way of avoiding having the information in the clear on the disk. >However it would probably not be a practical method of operation given >the reliability of at least the Unix operating systems that I am familiar >with. And even then the information is in memory. An attacker who could ... It seems to me that we get some of the advantages of "secure hardware" (and I don't mean in a formal NSA "Orange Book" sense) by having secure dongles attached to serial or other ports on machines. "Dongles" are the much-hated copy protection devices used with some products: they typically are a small plastic-packages doodad plugged into a serial port on a PC. (The Mac versions are less common; don't know if Unix boxes have ever used them.) In the case described by Hal, there might be two imaginable modes of operation: 1. The dongle feeds a passphrase at boot time. This is not very secure, as means could be found to either intercept the supplied passphrase and/or find system commands that would trigger the providing. But at least the passphrase is nominally not stored on a disk accessible to outsiders. (The passphrase is still presumably in memory, as noted above by Hal, and by others. But at least it's not on a disk.) 2. Some sort of zero knowledge protocol in which the dongle possesses the secret knowledge and does part of the decryption, etc. Seen more broadly, this dongle might actually be a separate PC box, 386- or 486-based, and connected to the main Unix box. The main box would still do the usual stuff, but the "secure box" would have a constrained set of operations--maybe running a stripped-down Linux or FreeBSD a la our discussions a few years ago--and would essentially only operate as a crypto box. A separate crypto box could be quite cheap, and one could imagine measures to make it less prone to physical tampering (*) and certainly less prone to network snooping. (* Tamper-resistant vs. tamper-responding. See the FAQ. Basically, there is no such thing as a "tamper-proof box." But "tamper-resistant" can mean PC boards potted in epoxy, locked lids, no floppies, alarms, etc. And "tamper-responding" means there is evidence given that a security barrier has been breached.) A "crypto box" could in fact handle most of the mix functions directly, bypassing the Unix box. The Unix box--the one hooked to the Net in the usual way--would get the incoming packets, send them to the crypto box, then get back the processed messages. If done right, the crypto box could ensure that no records are kept of the mapping between incoming and outgoing messages. A court order to produce the mapping could then be honestly responded to with a "no records are kept, or can even possibly be kept." (Without modification of the software/hardware, something which Digital Telephony II could certainly mandate, but it doesn't exist now.) I think a "crypto box" based on a cheap 486 box, a reduced functionality Linux, and very limited storage capabilities (possibly no disk, only RAM), could be an interesting way to solve both the passphrase-snarfing and LEA-subpoenaing problems. While not as secure as either a Chaumian tamper-responding digital mix (cf. the 1981 paper in CACM) or as a software-based DC-Net, it sure does beat the current model of multiuser Unix boxes running remailers out of user accounts! (A word on separating the functions into a "network box" (what I've also called a "Unix box") and a separate "crypto box." There is no reason one box cannot do both....but by separating the two functions and linking the boxes via a secure connection, one faces less temptation to add more capabilities, storage, and users to the "crypto box." So, I think it better for remailer operators to continue to have their powerful, capable, net connection boxes and then have a stripped-down, possibly RAM-only box that only does limited things. It's also possible to have several boxes, just with different Net addresses, but there might still be the temptation to give the "remailer box" more capabilities. My intuition is that it would be easier and more secure to just have the crypto/remailer box as a slave or dongle to the more capable box.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

FT on Crypto Cloud
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Financial Times, March 6, 1996, IT Section, p. V. Network Security: Operating under a cloud of uncertainty Companies face a complex web of technical, legal and moral questions The IT security threat has long been depicted in terms of wild-eyed hackers hunched over terminals late into the night. But while there is real cause for concern about criminal activity over computer networks, large corporations are very worried about another threat to their use of electronic communications. Meanwhile, government restrictions on the use of data encryption codes in various countries are limiting the ability of commercial organisations to protect themselves. Cryptography is at the heart of this dilemma. Governments all over the world rely on specialist intelligence units to break down data transmissions from other nations and individuals while encrypting their own messages. The US National Security Agency and the UK's Government Communications HQ are the best-known of these agencies. The NSA is notorious for obsessive secrecy. Meanwhile, in the UK, the GCHQ has lifted its traditional reticence in recent years to offer advice to British companies concerned with data security. Mr Roger James, chairman of Cheshire-based communications software specialist Boldon James, has worked with GCHQ to define data standards for UK government departments. Mr James plays down the cloak-and-dagger imagine of GCHQ, but instead he describes his contact with its staff as "horribly technical". He also portrays the Cheltenham code-breakers as "very down-to-earth people". There are two ways of looking at security, he says "one is the practical approach, which means accepting that perfect security is impossible to obtain. The other is the Ivory Tower approach, which involves dreaming of a world in which security is absolute. There are a lot of 'practicalists' in GCHQ". Mr James, whose clients include the Britannia Building Society and the German Navy, is active in the European Electronic Messaging Association. He is concerned at the lack of a co-ordinated European policy on encryption. And he fears that effective security measures could become illegal with the advent of future legislation curbing the availability of encryption software. It is illegal at the moment to use strong cryptography techniques in France without first depositing the key to unlocking your codes with the French government. UK companies developing sophisticated security programs find their software classified as munitions and subject to tight export restrictions, even within the EC. In the US, the author of strong encryption program, called 'Pretty Good Privacy', found himself facing a Grand Jury and possible charges of exporting prohibited technology. The NSA has proposed that all personal computers made in the US contain the Clipper Chip. This security feature would give easy access to any data communications, however the user chose to encode it. The proposal is currently stalled, having met with ferocious opposition. Both suppliers of information technology and industry at large need to clear a path through this international maze. The legal structure surrounding the use of encryption technology is of particular concern to anyone working in electronic commerce. "The Clipper Chip debate raised a fundamental moral issue," says Mr James. "Software technology means that strong encryption, previously available only to the military, can now be obtained by the public. If governments then find messages hard to break, it leads immediately to a conflict of interest." One company that has confronted this apparent conflict of interest between state and commerce, with its attendant uncertainty, is the Anglo-Dutch oil giant, Shell. Mr Nick Mansfield, a Shell technical consultant specialising in information security, says the company is enthusiastic about the potential for eliminating paperwork across its sprawling global operations -- "we are committed to electronic trading," he says. "We have a vast electronic-mail network. But there is still a section of our business where we have to use paper". Contract agreements are at issue here. Until security can be absolutely guaranteed, bilateral agreements must be seen to be tamper-proofed. Shell is about to deploy technology to secure personal computers and PC servers across the world. This e-mail security system will cost around L1m in software purchasing plus L100,000 a year to run. It will have 4,000 users. Far from escalating costs, Mr Mansfield explains that expenses are falling as security improves. Shell used to run a secure telex network that cost L4m in technology and required L200,000 a year to support 120 sites. This was superseded by a secure fax network costing L1m in systems, plus L100,000 in annual maintenance for 200 sites. The latest system will expand secure messaging beyond the fax network's remit. But setting up this security system involved Shell in a long and involved process. Its chosen security software is subject to close scrutiny by the UK authorities, who worked with Shell to customise the program before it could be released for use overseas. While Mr Mansfield is pleased that Shell's security system is so strong, it required an export licence and he echoes the concerns of EEMA's Mr James -- "it's a cart and horse situation. Until governments agree on policy and relax some restrictions, industry won't be encouraged to development extreme standards of encryption". There needs to be a broad European debate on this issue. Until this complex web of technical, legal and moral questions are resolved, secure commercial data networks will be operating under a cloud of uncertainty. Michael Dempsey [End] Note: Shell's Nick Mansfield was a speaker at the OECD cryptography conference in Paris in December. This issue of FT includes a 22-page special section on Information Technology.

1 0

Returned mail: User unknown
by Mail Delivery Subsystem 17 Dec '03

17 Dec '03

The original message was received at Mon, 4 Mar 1996 17:28:57 -0800 from cmyk.warwick.com [198.102.205.163] ----- The following addresses had delivery problems ----- <majorodomo(a)toad.com> (unrecoverable error) ----- Transcript of session follows ----- ... while talking to toad.com.: >>> RCPT To:<majorodomo(a)toad.com> <<< 550 <majorodomo(a)toad.com>... User unknown 550 <majorodomo(a)toad.com>... User unknown ----- Original message follows ----- To: majordomo(a)toad.com Subject: unsubscribe cypherpunks From: cypherpunks(a)warwick.com Date: Tue, 5 Mar 1996 15:11:06 -0500 unsubscribe cypherpunks

1 0