December 2003 - cypherpunks-legacy

Re: Boycott "Applied Cryptography" and AT&T and RSA
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

>Bruce Schnier (Author of applied cryptography) and Matt Blaze (Who >is a crypto bigwig at at&t) have made it clear that they support >key escrow. Both have written letters in favor of the new crypto >law, it creates a key escrow system and also other restricts on >crypto. The letters are on the CDT homepage and i think were >posted here. Whoever wrote this crap is an idiot. In the preface of Applied Cryptography, (Page xx) on the subject of government key escrow, Schneier states: "Some dangerously Orwellian assumptions are at work here: that the government has the right to listen to private communications and that there is something wrong with a private citizen trying to keep a secret from the government. ...this is the first time people have been forced to make themselves available for surveillance. These initiatives are not simple government proposals in some obscure area; they are pre-emptive and unilateral to usurp powers that previously belonged to the people. Clipper and Digital Telephony do not protect privacy; they force individuals to unconditionally trust that the government will respect their privacy. ... The lesson here is that it is insufficient to protect ourselves with laws; we need to protect ourselves with mathematics. Encryption is too important to be left solely to governments." Schneier goes on to state that the purpose of the book is to ensure that people will have access to strong crypto, even if it is outlawed. It is hard to interpret this as support for government key escrow. Check your facts before slandering people. Jonathan Wienke

1 0

crypto ++ where?
by Oscar Boykin 17 Dec '03

17 Dec '03

How can I obtain crypto++, I seem to have deleted the email I had reguarding it. any info would be appreciated. thanks. oscar boykin mailto:boykin@pobox.com http://pobox.com/~boykin home: 404-206-0477

2 1

Re: Jump Start ecash With IPhone
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:26 AM 3/6/96 -0500, "Declan B. McCullagh" <declan+(a)CMU.EDU> wrote: >WASHINGTON, March 4 /PRNewswire/ -- The America's Carriers >Telecommunication Association (ACTA), a trade association of >competitive, long distance carriers today petitioned the Federal >Communications Commission (FCC) to stop companies from selling >software and hardware products that enable use of the Internet to >voice long distance services. .... >CONTACT: Charles H. Helein, general counsel, 703-714-1301, or Jennifer Durst- >Jarrell, executive director, 407-332-9382, both of America's Carriers >Telecommunication Association Their complaint was that Internet time, at $2/hour, is 3.3 cents/minute, far cheaper than the 22 cents/minute many of them are charging. (The real price is, of course, double that, 6.6cents, because both ends of the connection need Internet connections.) I assume they're hoping that the FCC won't know that the "hardware and software products" are the sound cards that almost every new PC sells with and software ranging from $50 down to free, and offers encryption which they don't, as well as voice quality ranging from worse to much worse to better. Some of the software works over the Internet, some chooses to get better voice quality over direct modem connections (which use their services.) They're also sleazing over the issue that many businesses are using low-bit-rate voice on their private networks to squeeze more voice calls into the networks they buy at bulk rates, most of which are billed at rather less that 22 cents/minute. If you're fitting four 16kbps calls into the 64kbps standard voice circuit, and you're paying 12 cents/minute, that's 3 cents/minute/call. And _really_ big bulk-buying customers are paying a lot less than 22 cents - I read in the papers that the Federal Telephone System is under 5 cents/minute. Bill Stewart P.S. Yes, I work for one of their competitors, though I'm not in the voice business, and not speaking for my employer. Aside from being a concerned citizen, and a voice telephone service customer who objects to companies that try to use the government to stomp their competitors instead of competing against them freely, I'm also an Internet user. Yes, the Internet is providing lots of new and exciting communications possibilities, and if you're worried that people are going to use the Internet for low-cost un-wiretappable encrypted phone calls that sound worse than ham radio and allow folks in third-world countries to better afford communications, go into the Internet business yourself. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 #

1 0

Re: art-stego
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- JonWienke(a)aol.com wrote: > Another thing--just a wild idea--test the randomness of encrypted data > storing it in an 8-bit mono .WAV (your choice of sample rates) file and > listening to it. Any correlations or patterns in the data should show > the playback as hums, clicks, squeals, or something. It may even be > to determine the algorithm by the sound patterns--a sort of "audio > cryptanalysis." Has anyone tried this? Are there any .WAV stego > out there? s-tools is an audio stego utility(s), but I've not used it. As for testing methods, noise spheres are an interesting graphical method for testing randomness (check the archives from late Dec/early Jan, I posted a short Turbo Pascal program that implements them). I'm not entirely sure if noise spheres will capture any crypto-relevant correlations, but it seems worth investigating. The reference to the article on noise spheres and other graphical methods for testing PRNGs is: Pickover, Clifford A. 1995. "Random number generators: pretty good ones are easy to find." The Visual Computer (1995) 11:369-377. - --Rob - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTwF5ioZzwIn1bdtAQG/ogF5AdudaHeEb+b2eOWs/XA3ZCIYGKrW1alg abs4UNS5OC2jjqr5UPfrVq5LB8lMwLS7 =OjB4 -----END PGP SIGNATURE-----

1 0

Announce: 155mbps ATM 3DES crypto gateway
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Secant Network Technologies announces: The Key Agile Encryption System is an affordable perimeter security system that provides privacy through high speed cryptography for information traversing public Asynchronous Transfer Mode networks. The cryptographic units function as "bump in the fiber" security interfaces between a secure LAN and a public network. As data crosses this interface, the system encrypts each ATM cell's payload without affecting the header. Encrypted cells pass through the public network infrastructure and are decrypted upon arriving at the destination LAN. The benefit is that the user can conduct business as usual within the LAN and only encrypt the data as it enters the non-secure public network (or non-secure area of a LAN). Many individual workstations, servers or other end nodes may be protected by a single encryption unit. The system provides privacy and access control guarantees when using public ATM networks today, eliminating the need to wait for implementation and availability of pending ATM Forum security standards. System operation is transparent to all network and end user systems. Available: summer 1996 Physical interfaces: single mode SONET OC-3c, multi mode SONET OC-3c, T3 carrier, T1 carrier. Key management: proprietary method, transparent to network and end user equipment, compliant with UNI 3.0/3.1 specifications. SVC's handled transparently, PVC support available. Public key based authentication. PKCS and X.509 compliant public key certificates are supported. Dynamic key update based on policy - transparent to end systems. Key agility: up to 65,534 active VC's per cryptographic unit. Each active VC has a unique key. Encryption algorithms used: triple DES for cell payload encryption, triple DES, RSA, and MD5 for key management. DES mode agility: single DES, 3DES ECB or 3DES long cycle chaining. True hardware random number generation (Johnson noise). Performance: full duplex encryption/decryption at the OC-3c (155Mbps) rate. Key management support for up to 35 secure calls per second Approximately 16 microseconds latency. See: http://www.secantnet.com/ for more details and for contact information. Based on over 2 years of ARPA funded research: http://www.mcnc.org/HTML/ITD/ANT/Enigma2.html

1 0

Re: Bombings, Surveillance, and Free Societies
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:41 PM 3/4/96 -0800, Tim wrote: >Let me use the language Bill Stewart used a while back, language which >skirts the issue of "right" and "wrong" even more neatly than I did (when I >said the Jews were "asking for trouble"): > >"If a religious group uses force to expel the current occupants of a desert >region, and expels them to just beyond their borders, it is "unsurprising" >that those expelled, and their children, and their children's children, >will swear a blood oath to drive the group into the sea." That wasn't me, though I've said similar things about terrorism against governments - those that go out of their way to attack and harass people shouldn't be surprised when people attack them in return.

1 0

Re: Looking for code to run an encrypted mailing list
by Bill Stewart 17 Dec '03

17 Dec '03

>John Pettitt <jpp(a)software.net> wrote: >> Poster cryptes mail with pgp using list exploder key. List exploder decrypts >> mail and recrypts with keys for all current list members and then sends the >> mail. At 09:24 PM 3/4/96 -0800, abostick(a)netcom.com (Alan Bostick) suggested having the mailing list handler decrypt the session key using its private key, and re-encrypt with the public keys of the list members, but not do the IDEA decryption and re-encryption N times of the message body. This has the further advantage that the cleartext message body is never sitting around on the server where it might end up in swap space or file system leftover blocks. On the other hand, it really only costs you one IDEA encryption if you want to use the multiple-recipients options to PGP. With the current PGP, this means you don't have to hack your own crypto code; the toolkits in PGP 3.0 will make that easier, though. >> [I don't want all the list members to need to know every other list members >> public key] The multiple-recipients PGP doesn't give away everyone's public keys, only their keyIDs. If you want to remain pseudonymous, just create a public key that you use only for subscribing to the list. (Hmmm - multiple recipient support probably makes stealth-PGP harder to implement...)

3 2

Hmmm
by eggplant＠inlink.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >(Lots of stuff deleted) > >>I attended last weeks "Information, National Policies, and International >>Infrastructure" Symposium at Harvard Law School, organized by the Global >>Information Infrastructure Commission, the Kennedy School and the >>Institute for Information Technology Law & Policy of Harvard Law School. > >>During the presentation by Paul Strassmann, National Defense University >>and William Marlow, Science Applications International Corporation, >>entitled "Anonymous Remailers as Risk-Free International Infoterrorists" >>the questions was raised from audience (Professor Chaarles Nesson, >>Harvard LAw School) - in a rather extended debate - whether the CIA and >>similar government agencies are involved in running anonymous remailers >>as this would be a perfect target to scan possibly illegal messages. > >>Both presenters explicitly acknowledged that a number of anonymous >>remnailers in the US are run by government agencies scanning traffic. >>Marlow said that the government runs at least a dozen remailers and that >>the most popular remailers in France and Germany are run by the >>respective government agencies in these countries. In addition they >>mentioned that the NSA has successfully developed systems to break >>encrypted messages below 1000 bit of key length and strongly suggested >>to use at least 1024 bit keys. They said that they semselves use 1024 >>bit keys. > >>I ask Marlos afterwards if these comments were off or on record, he >>paused then said that he can be quoted. > >>So I thought I pass that on. It seems interesting enough, don't you >>think? > >(more stuff deleted) > > I don't know about everyone else, but I consider this, if true, to be a >MAJOR worry. It never ceases to amaze me how lightly the government takes >lying to the people. Unfortunately I don't have the contacts or resources >to do any further investigation, I hope this thread is resolved one way or >another soon. > >nobody@unimportant Ther is always the posibility of disinformation. That is one of the governments specialties. I'm not saying the posibility isn't there, I'm sure there are anon remailers run by the government. An I remember from a show on PBS I watched months ago in which someone from inside the CIA said that the government does actively monitor the Internet and has for a long time. The thing to remember is to PGP your important mail and sign everything.... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMTvIw4WnykIBM1nhAQEnpAgAjVDhjgKrLQWxzRIL6nc8WQLCOLxTkGI7 ybr6cse/ARbdhNv+FD+XHEEtXngxA+p45jJHUE4OHyIKUTy6AVa3wi1U5DlBmTB8 XbFHF4YwTwpMhBpBnGl5iBMwO3ZYrtQ/3SE4mIi99DhVzpQHywlJeo0DbHAdrPJU UunZF0nhZyz0ycCQWMJ8yZL6iVkuZXnCkZfMjNtMIttEgh+I/R3hRiGNisZPJQvX krbrJsRZhpYv7Fk72zXD9YxqizczJuom63jPQNqkUK/XqfuulQD4b632BS1gmhNc jHwLw9tUkV5bne2digLe5FDL2Jxhi7TsZ56MzAgB8D8SDBf/I6Dphw== =XBqQ -----END PGP SIGNATURE----- -- "... In Germany they first came for the Communists and I didn't speak up because I wasn't a Communist. Then they came for the Jews, and I didn't speak up because I wasn't a Jew. Then they came for the trade unionists, and I didn't speak up because I wasn't a trade unionist. Then they came for up because I wasn't a trade unionist. Then they came for Catholics, and I didn't speak up because I was a Protestant. Then they came for me-and by that time no one was left to speak up..." Pastor Martin Niemoller ++++++++++++ ************************************** * Matthew Murphy ------------ eggplant(a)inlink.com * ---------- * http://www.inlink.com/~eggplant * The Web page is under construciton at this time though.. * Please don't mind the mess.... * ************************************** ++++++++++++ finger eggplant(a)inlink.com for my PGP key.

1 0

Another Motivation for the CDA
by tcmay＠got.net 17 Dec '03

17 Dec '03

Given that Sen. Fineswine is one of the strongest supporters of gun confiscation, and that she had this to say about the Telecom Bill: "Sen. Feinstein (D-CA) Mrs. Feinstein: Mr. President, I rise in support of the conference report for the Telecommunications Act of 1995. This legislation establishes real progress on important issues and I am pleased to provide my support. Senator Exon's provisions to control access to indecent materials will require the operators of computer networks, like America Online, to screen out indecent materials for children." I think we need to look at another motive, or at least another effect, of the CDA's felonization of "indecent" speech (uttering the words "fuck" or "shit," or doing a large number of other such things, where any minor could possibly see these words, is a felony. Not a misdemeanor, a _felony_. No felon may own a gun legally in California, for some period of time after conviction. I presume similar laws apply in other states. (Of course, a lot of real criminals own all sorts of guns, but at least the "indecent speakers" will have their existing guns removed from them and will be unable to buy new ones for some number of years after their convictions.) Therefore, one think to think about is that a felony conviction for violation of the CDA will result in one being disarmed (of the ones they know about). Duncan Frissell frequently regales us with tales of how he has made himself "judgment-proof." More power to him, but it doesn't make me feel any better. Fineswine, Schroeder, and similar such vermin have probably figured out that by felonizing dirty words they have another tool to use in the disarming of America. When nearly everyone is a criminal, in the eyes of the law, then the populace is well and truly under their thumbs. The good news is that I can probably get off of jury duty pretty simply by saying "But I'm a felon." (Even if they ask for details, about my conviction, merely by explaining why I answered this way I'll doubtless be excused.) Of course, I haven't been called for jury duty and actually had to report for selection since 1973, so I must be in their file of Undesirables already. --Tim May, a fucking felon Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: new netscape servers
by Duncan Frissell 17 Dec '03

17 Dec '03

At 01:29 AM 3/7/96 -0500, Michael Froomkin wrote: >Oh boy are there liability issues. Talk to me if you seriously want to >know a lot more. (My paper on this will be out soonish....) > However, a CA operating outside the licensing structure of current CA's would have very low costs and hence no investment to lose in litigation. Costs would be almost entirely marketing related and as long as you stayed out of jurisdictions with some of the new CA law, no regulatory costs or barriers. DCF

2 1