December 2003 - cypherpunks-legacy

Re: Assassination Politics 9!
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 2:45 PM 3/4/96, babybell@pacifier wrote: >Most traditional "terrorism" (as least "traditional," by the standards of >the last 20 years) is thought to involve relatively unfocussed attacks >against people and locations, but in situations where attacks against >selected government officials would be far more selective and effective. <...> >Since I propose exactly that kind of replacement, I am presumably not the >most ingratiating figure to these people. Now I understand why you seemed to be "not the most ingratiating figure"--you must've nominated me for assassination. oooo$$$$$$$$$$oooo oo$$$$$$$$$$$$$$$$$$$$$$o oo$$$$$$$$$$$$$$$$$$$$$$$$$$$$o o$ $$ o$ o $ oo o$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$o $$ $$ $$o$ oo $ $ "$ o$$$$$$$$$ $$$$$$$$$$$ $$$$$$$$$o $$$o$$o$ "$$$$$$o$ o$$$$$$$$$ ** $$$$$$$$$ ** $$$$$$$$$$o $$$$$$$$ $$$$$$$ $$$$$$$$$$$ $$$$$$$$$ $$$$$$$$$$$$$$$$$$$$$$$ $$$$$$$$$$$$$$$$$$$$$$$ $$$$$$$$$$$ $$$$$$$$$$$$$$ """$$$ "$$$""""$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ "$$$ o$$ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ $$$o $$$ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$" "$$$$$$oooo$$$$o o$$$oooo$$$$$ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ o$$$$$$$$$$$$$$$$ $$$$$$$$"$$$$ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ $$$$"""""""" """" $$$$ "$$$$$$$$$$$$$$$$$$$$$$$$$$" o$$$ "$$$o """$$$$$$$$$$$$$$$$"$$" $$$ $$$o "$$""$$$$"""" o$$$ $$$$o oo o$$$" "$$$$o o$$$$$$o"$$$$o o$$$$ "$$$$$oo ""$$$$o$$$$$o o$$$$"" ""$$$$oooo "$$$o$$$$$ $$$""" ""$$$$$$oo $$$$$$$$$ """$$$$$$$$$$ $$$$$$$$$ $$$$$

1 0

Re: Diffie-Hellman for Matchmaking?
by Dimitris Tsapakidis 17 Dec '03

17 Dec '03

Ok, I am reposting this, with more detail this time. Hope this answers the two questions I received. I want to design/find some matchmaking protocols. I define matchmaking as follows: Bob must find out whether Alice has declared (commited) her interest in him, if and only if he has declared (commited) his interest in her. Before he does so, he can at most know that a girl is interested in him. Another description: Bob and Alice can have a date if they both commit to each other. If only one commits, nobody will ever find out about it. Below are the protocols I came up with. They all depend on the Diffie-Hellman "common key" as derived in the DH key exchange. - T is the trusted third party. - hash_k() is a keyed hash function with key k. - pseudo(Alice) is a pseudonym for Alice. - n is a large prime. - g is a primitive element mod n. - A is Alice's secret exponent. Her public key would be g^A mod n. - Alice's and Bob's "common key" would be g^(AB)mod n ---- 1. The mediated off-line one: - T selects a secret k (which he uses for the duration of a month, say). - Alice is interested in Bob, so she calculates a=g^(AB)mod n and anonymously and securely sends it to T along with pseudo(Alice). - T calculates c=hash_k(a) and broadcasts c and pseudo(A) to the planet or puts them on a bulletin board. - Bob is ignorant of Alice's actions. If he ever decides that he likes her, he calculates and sends a=g^(AB)mod n to T (plus pseudo(Bob)). T will calculate hash_k(a) which equals c. T broadcasts c plus pseudo(B) so both Alice and Bob will know they have a match. If Bob is not actually interested in Alice, he doesn't perform this step at all, so nothing happens, and Alice just assumes Bob is not interested. Replay is not an issue here. 2. The mediated on-line one: - Alice is interested in Bob, so she calculates a=g^(AB)mod n and ANONYMOUSLY approaches Bob. - Bob calculates b=g^(BX)mod n, where X may or may not be Alice. If Bob is not interested in anyone, he could tell Alice to leave, or select a random X while calculating b. - Alice and Bob want to compare a and b. They generate a random k using some coin-flipping protocol. Then they send (possibly pseudonymously) hash_k(a) and hash_k(b) to T who compares them and announces the result. Using a keyed hash function reduces the trust on T, compared to protocol (1), I hope. Now, T has to conspire with one of the parties to get the "common key". I suspect this can be improved using the Digital Envelopes protocol as described by Fagin, Naor and Winkler in "Comparing information without leaking it" to replace the hashing. 3. Non-mediated on-line one: This third protocol would remove T in (2). Alice and Bob would compare their "common keys" directly. The problem here is fairness i.e. to ensure nobody finds the result of the comparison first. If this was possible, people could "probe" other people's interests and terminate the protocol as soon as they find the answer (i.e. the result of the "common key" comparison). I think ZK protocols would be of use here. I am still working on this one. ---- Assume that in any of these protocols Alice calculates her "common key" with X: a=g^(AX)mod n which means that she is interested in X. The reason a must remain sercet is that if X learns it, he could calculate all possible b(Y)=g^(YX)mod n until he finds a Y such that b(Y)=a, in which case he will find out Alice is interested in him. Note that X will not try all possible values for Y, but will use the public keys of all the girls, instead. I would appreciate any comments on these protocols and on the use of DH "common key". Dimitris -- Dimitris Tsapakidis PGP keyID: 735590D5 dimitrt(a)dcs.rhbnc.ac.uk MSc in Information Security, This space reserved Royal Holloway, University of London for future use. Origin: Thessaloniki, Macedonia, Hellas

1 0

Re: Truelly Random Numbers
by Tim Fulbright 17 Dec '03

17 Dec '03

Now I, a lurker for two months, am truelly confused! L. Deitweiler must be right. Surely one of you cyperpunk fellows could hack together a dongle with some kind of AD converter and buffer ram to gather a Truelly Random Bitstream off the environment every couple of milliseconds easier than this raindrop scheme or recording the fan, you're haviung me on!. Let's go back fifty years and get a vacuum tube to fitfully flicker? I who know next to nothing about electronics suspect there is surely enough noise present in electornic devices to gather a random bitstream that you could chop anywya you needed? Anyway, y would you need a WAN for constant raindrop number generation when you could just set up your random number node out in LaPush or up in Volcano sampling every minute ot so : ) ? My second overall question is, isn't the emphasis on encryption of e-mail and e-mail emposters somewhat shortsighted? What if, for the masses which is all that counts, e-mail migrates to voicemail? The issues aren't the same with voicemail, eg PK validation problems go out the window since voicemail validation could take the form of an PK encrypted voicegram. . Something the matter with that? It might also prevent robots from posing as persons while still allowing aliases.. Please pardon this interruption! I really do admire the frankness and quality of your newslist, its democratic open discussion on the most vital political issues facing our time ; but after reading your mail I think that either I need seriously wising up, or, somebody must know where the real newsgroup is! -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2i Comment: Requires PGP version 2.6 or later. mQCNAzBzoaUAAAEEAKwZn14pn79xPqUJW5SbJqU/B1uEtD29xe4/nXedIlc66yt0 +Zh8t/LZtO8CAQn4N5tqzN+cW0ot4yfB1lV2HYOkLCqtfeGqrZbv0q8auR0OV8fQ NvHRdlK5fbZKtFKzEA1y/eh5BQv6pq9YDsoScNdORuynOFYo60208YzGKULxAAUR tEJUaW1vdGh5IEZ1bGJyaWdodDwxMDAwMjIuMzE2N0Bjb21wdXNlcnZlLmNvbT48 Wys0NCwgMF0gMTc4MjYxMTY1MT4= =gSuk -----END PGP PUBLIC KEY BLOCK-----

1 0

"Physical Reality III"
by Duncan Frissell 17 Dec '03

17 Dec '03

Bad Boys, Bad Boys Whatcha gonna do? Whatcha gonna do when they come for you? Bad Boys, Bad Boys repeat endlessly. We did 3) last Wednesday. Here are some more points. 4) There must be a you. In order for the Bad Boys to come for you, you have to exist in a form that can be "come for." This is tricky in a world in which "processes" can be spawned more cheaply and easily than guppies. Students of military tactics know that the basic tactical reality is the force ratio. This can be looked at in two parts: 1) the ratio of attackers to defenders (or rulers to ruled in the civilian world) and 2) the ratio of soldiers/law enforcement personnel to space. The lower the ratio, the less effective the force will be. As the Bad Boys confront cyberspace, they find both types of force ratios turned against them. As we discuss here, there are more "defenders" to attack and as we shall see under point 5) below, there is much more space to try to rule. Before there was cyberspace, there were front companies. In the wondrous Anglo Saxon legal system; people, sole proprietorships, partnerships, trusts, and corporations all have somewhat equal and independent legal existence. People, sole proprietorships, partnerships, and trusts can all be created without securing permission from any authority. They come into existence by simple act of will. In times past however, the creation and maintenance of these entities took a bit of time. In a practical sense, a person could only create an maintain a limited number of such "legal persons." The wonder of automation is that the creation of entities becomes much easier and cheaper. Software agents are just one of the new sorts of entities that we are capable of creating. There are also the effects of applying automation to traditional entities. "Let a thousand trusts bloom." In addition to entities created for business purposes, the authorities will have to deal with entities created for entertainment and charitable purposes. This leads to a vast increase in the number of entities who act and who may violate laws and who must, therefore, be subject to control by the Bad Boys if they are to control things. But it is much cheaper and easier to create "legal persons" these days than it is to unravel them "pierce the corporate veil(s)" and bring them under the control of "law." If the permissions aren't set right, it will be very difficult for the authorities to pierce the corporate veil of net-based legal persons. Software processes are hard to arrest and harder to coerce. Remember, as long as an entity pays its bills and meets its commercial obligations, it can find a home and continue its "life." Markets don't care much what your nature is as long as they can buy from or sell to you. Official status is not required. In addition to the proliferation of entities, telecommunications lets each of the traditional human actors do more of everything including those things that regulators wish to regulate. And by letting residents from everywhere on earth into everyone's "home" market, telecoms multiplies the number of potential law enforcement targets within popular jurisdiction. As long as jurisdictions are geographically bound, popular jurisdictions (like the US) will find out that they have gained millions of new virtual citizens/residents who must be ruled by US authorities (if that can be done). But with more natural persons "entering" the jurisdiction, with the previous natural residents doing lots more, and a swarm of new artificial persons, the Bad Boys' resources are strained. The more entities to "rule," the less each entity (including natural persons) can be ruled. [If you believe that the control technologies can be scaled up at the same rate as the entity creation technologies, see my later piece in this series: "8) They must have something to do to you when they 'come for you.'"] <More Tomorrow> DCF

1 0

Re: Looking for code to run an encrypted mailing list
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 23:17 1996-03-04 -0800, John Pettitt wrote: >The overal intent was to have a message go from one list member to all >others with a) a signature to provide strong attribution and a measure of >non repudiation b) low probability of interception c) only the gateway has >to have all the public keys. You could avoid alot of encryption by setting up a key for the list and giving both keys (secret and public) to all the list members. To write to the list, you encrypt with the lists public key. Everybody reading the list can decrypt with the secret key. Pros: No hacking of majordomo. You can use any mailing list software. The key and clear text message is never available to a robot, making it harder to compromise security. Cons: When somebody is removed from the list you have to change the key, encrypt the new secret key with everybodys public keys and distribute it. For a big dynamic list where people unsubscribe daily this could be a major headache. But for small or static lists it shouldn't be much of a problem. <matts(a)pi.se>

1 0

My letter to Leahy supporting the crypto bill
by Matt Blaze 17 Dec '03

17 Dec '03

Here is the text of a letter I sent to Leahy supporting the "Encrypted Communications Privacy Act of 1996" being introduced today. I urge everyone to check out the bill (should be online on thomas.loc.gov sometime soon); on balance, I think the bill is a huge step forward and deserves support. -matt Matt Blaze, Ph.D. 600 Mountain Avenue Murray Hill, NJ 07974 March 1, 1996 Hon. Patrick Leahy United States Senate Dear Senator Leahy: Thank you for introducing the Encrypted Communications Privacy Act of 1996. As a member of the computer security and cryptology research community, I have observed firsthand the deleterious effect that the current regulations governing the use and export of cryptography are having on our country's ability to develop a reliable and trustworthy information infrastructure. Your bill takes an important first step toward creating regulations that reflect the modern realities of this increasingly critical technology. Unlike previous government encryption initiatives such as the technically-flawed and unworkable ``Clipper'' chip, your bill re-affirms the role of the marketplace in providing ordinary citizens and businesses with a full range of choices for securing their private information. In particular, by freeing mass-market cryptographic software and hardware from the burdensome export controls that govern the international arms trade, the bill will help the American software industry compete, for the first time, in the international market for high-quality security products. Law enforcement need not fear the widespread availability of encryption; indeed, they should welcome and promote it. Encryption thwarts electronic predators by preventing unauthorized access to private data and computer systems, and the use of strong cryptography to protect computer networks is becoming as natural and necessary as the use of locks and burglar alarms to protect our homes and businesses. While criminals, too, might occasionally derive some advantage from the use of cryptography, the benefits of widely-available encryption technology overwhelmingly favor the honest user. By recognizing that those who hold decryption keys on behalf of others are in a special position of trust, your bill is respectful of the privacy of law-abiding citizens without introducing impediments to the government's ability to investigate and prevent crime. I have also examined the new provision designed to discourage the use of cryptography by criminals in the furtherance of a felony, and hope to see your carefully-worded language reinforced by a narrow interpretation in the courts, consistent with your intent. Again, thank you for your continued leadership in this area, and I look forward to doing whatever I can to help you bring encryption regulations in line with the fast-changing reality of this emerging technology. Sincerely, (s) Matt Blaze

1 0

Banning Explosive Speech
by Duncan Frissell 17 Dec '03

17 Dec '03

"I think that the tax serfs of AmeriKKKa should rise and throw off the chains of their oppression by blowing up their nearest federal office building. Here is how they should do it. Take 16 parts ammonium nitrate and one part fuel oil (that's diesel fuel if you like) mix them together..." Voila. I've just converted a discussion of explosives into protected political speech. I consider it highly unlikely that people will be doing much time for so-called explosive speech. The publisher of Paladin Press *is* being sued civilly in a case of a customer who read his "How to Kill" series a bit too closely and used some of the info contained therein. Civil suits mean little in our medium, however, because the cost of production is so low and there are so many judgment-proof practitioners of net communications. In Sterling's "Hacker Crackdown" (http://www.usfca.edu/crackdown/crack_1.html) he discusses how the seizure of 25 "outlaw boards" by the Secret Service was an electronic example of a Vice Raid bust in which the LE's are not really trying to shut everything down but just trying to "show the flag" and intimidate the rest of the scum. The reason that Vice Raids probably won't work too well in cyberspace is because we are harder to intimidate. There are lots of us, we are spread all over the world, and we can so easily disguise ourselves. Note the ineffectiveness of the recent German crackdown. In addition, we don't think of ourselves as scum. We have friends and a pseudo community, we're not hidden, and we have plenty of support in our own "counterculture." Note too that Lady Di Fi's proposal to ban explosive speech did not try and ban public discussion of same but merely the knowing transfer of such info in criminal conspiracy cases. It would not have reached public web sites or newsgroups. DCF "I think that the American people have the right to see things like this -- Start Marlboro Man Commercial" -- how to beat the Tobacco Ad ban.

1 0

Re: (Fwd) Gov't run anon servers
by Hal 17 Dec '03

17 Dec '03

From: John Perry <perry(a)vishnu.alias.net> > Well actually... The passphrase in a mixmaster remailer is defined as > an environmental variable at compile time. The passphrase is not > stored in any cleartext fashion but is embedded in the > executable. Additionally the newer Ghio code (Matt's latest revision) > has the passphrase defined as an environmental variable in > remailer.c. Once remailer is compiled, you can delete the passphrase > from the code. I can't speak for the freedom or other remailers as I > haven't tried them. It's a little harder to get the key than just > looking for a cleartext file that contains it. That is, if the > remailer operator is being careful. OK, I stand corrected regarding the operation of mixmaster. However, this does not gain much security, certainly not in comparison to the effort involved to break a key. It will be just as easy to steal the mixmaster executable as to steal a script file containing a pass phrase. And it might even be possible to run the stolen mixmaster directly to decrypt intercepted incoming mail messages, without even having to type in the pass phrase. Failing that the attacker could easily extract the pass phrase from the mixmaster executable file. The other suggestion that was made here, that the operator would have to manually type in the pass phrase every time the computer rebooted, would be a way of avoiding having the information in the clear on the disk. However it would probably not be a practical method of operation given the reliability of at least the Unix operating systems that I am familiar with. And even then the information is in memory. An attacker who could gain root privileges (and let's not pretend that the NSA can't do that) can dump memory and later comb it for the key information. My point remains that strong keys are pointless for remailers which run on Unix systems connected to the net. Now if you have your remailer on a PC at home, and you're not running anything else on it (like http servers), maybe that is safe. I am not familiar enough with security holes in such a configuration to judge. Probably it would depend on what mail-processing software you run, and the nature of your net connection. Recall that my original comments were in connection with the claim that the government was running most of the remailers. As I said, I still think that is absurd when it would be so much easier to simply steal their keys. Hal

1 0

No Subject
by editor＠cdt.org 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 9 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 9 March 5, 1996 CONTENTS: (1) Bills To Relax Crypto Export Controls Introduced by Leahy, Burns, Goodlatte, Others (2) Subscription Information (3) About CDT, contacting us This document may be redistributed freely provided it remains in its entirety ** Excerpts may be re-posted by permission (editor(a)cdt.org) ** ----------------------------------------------------------------------------- (1) BIPARTISAN BILLS TO EASE ENCRYPTION CONTROLS AND PROTECT INTERNET PRIVACY INTRODUCED IN SENATE AND HOUSE A bipartisan group of members from both houses of Congress today introduced legislation to lift many export controls on strong encryption hardware and software and affirm the rights of Americans to use whatever form of cryptography they choose. The bills, sponsored by Sen. Leahy (D-VT), Sen. Burns (R-MT), Rep. Goodlatte (R-VA), Rep. Eshoo (D-CA), and others, represent a major step towards breaking the stranglehold on encryption technologies which for years has denied computer users access to vital privacy-protecting applications. The "Encrypted Communications Privacy Act of 1996" represents a rejection of the Clinton Administration's invasive and unworkable "Clipper Chip" and "Clipper II" key escrow policies. Under the guise of promoting so-called "voluntary" encryption standards, these Administration efforts have sought to use export controls to compel the adoption of key escrow encryption domestically, and have left Internet users without adequate privacy and security. By relaxing export controls on "generally available" cryptographic applications such as PGP, popular Web browsers, and other programs, the Encrypted Communications Privacy Act of 1996 would encourage the development and use of strong privacy protecting technologies. Major provisions of the legislation would: * Ease export controls on encryption products, allowing the export of 'mass market' or 'generally available' cryptography. This would include products such as PGP or many of the popular Web browser programs. * Affirm the right of Americans to use any encryption domestically. The bills explicitly prohibit the government from imposing any limits on the domestic use or sale of encryption. * (Senate version only) Provide protections to those who choose to store their encryption keys with third parties by creating criminal and civil penalties for the unauthorized disclosure of keys and strict requirements for law enforcement access. The bill does not in any way affect the ability of any person to use encryption without a key escrow function.. The legislation also contains several provisions which CDT believes require further clarification and consideration, including controversial language that would create a new federal crime for the use of encryption to willfully obstruct a law enforcement investigation. CDT will work with Senators Leahy and Burns and Representatives Goodlatte, Eshoo, and other interested members to address these concerns as the bill makes its way through the legislative process. The full text of both the House and Senate versions of the bills, along with other relevant background information, is available on CDT's Crypto Issues World Wide Web page: http://www.cdt.org/crypto/ CDT believes that the House and Senate encryption bills are an important step forward in the ongoing attempts to build better security into the information infrastructure through the widespread availability of encryption. Congressional action is particularly welcome as the Administration has continued to impose a flawed approach to encryption based upon export controls, key length limits, and key escrow policies all aimed at slowing the adoption of strong cryptography in the U.S. and throughout the world. While CDT believes improvements can be made in both bills, they establish a solid framework for building a comprehensive, global cryptography policy. CDT believes the bills deserve careful consideration and support. We look forward to working with Senator Leahy, Senator Burns, Rep. Goodlatte, Rep. Eshoo, individual Internet users, public interest advocates, and the computer and communications industry to develop a cryptography policy that protects privacy, security, and competitiveness on the Global Information Infrastructure. SUMMARY OF THE LEGISLATION: WHAT THE BILLS WOULD DO The House and Senate bills both modify Title 18 of the U.S. Code to clarify the status of encrypted communications, access to those communications by law enforcement, and the liability of third-party key holders. The bills would: * SIGNIFICANTLY EASE EXPORT CONTROLS: The bills would remove all export restrictions on "mass market" or publicly accessible encryption software and similar hardware -- that is, products that are generally available to the public and sold for installation "as is," or that are in the public domain such as PGP or some popular web browsers. (For example, products commercially available "off the rack," or freely available to the public via the Internet, would all be exportable.) Other encryption hardware would be exportable to countries where hardware with similar capabilities is already commercially available. The bills also allow export of other encryption software if it is currently exportable under law for use by foreign financial institutions. * PROHIBIT ANY RESTRICTION ON THE DOMESTIC USE OR SALE OF ENCRYPTION: The bills would affirmatively prohibit any government restrictions or attempts to mandate the domestic sale or use of any type of encryption. * IMPOSE CIVIL AND CRIMINAL LIABILITY FOR UNAUTHORIZED KEY DISCLOSURES: (Senate Version Only) The Senate bill would lay down privacy guidelines to protect those users who choose to store their keys with third parties. The bill would impose civil and criminal penalties for the unauthorized release of decryption keys or other decryption assistance by third parties who individuals have entrusted with their keys. No privacy protections and only limited restrictions for law enforcement access currently exist for those who choose to store their keys with trusted third parties. * PROVIDE LIMITS FOR ACCESS TO KEYS BY LAW ENFORCEMENT: (Senate Version Only) The Senate bill would also spell out limits and guidelines for law enforcement access to the keys of those users who have chosen to store their keys with third parties. Today, encryption keys held by third parties could be released to law enforcement with nothing more than a subpoena. Under the Senate bill, third parties could only provide assistance to law enforcement in decrypting communications if presented with a court order. The bill also limits the scope and duration of such assistance. Decryption keys for stored communications could be disclosed with a proper court order or subpoena. * ESTABLISH A BROAD "PERSONAL USE EXEMPTION" FOR U.S. TRAVELERS: The bills would allow U.S. persons to use any form of encryption in a foreign country, establishing a less restrictive form of the "personal use exemption" recently published by the State Department. The provision is intended to accommodate "U.S. citizens and permanent residents who have the need to temporarily export encryption products when leaving the U.S. for brief periods of time". While the intent of this provision is clear, CDT believes that the language of the bill should be further clarified. * PROHIBIT THE USE OF ENCRYPTION TO CONCEAL THE COMMISSION OF A FELONY: Finally, the bills would criminalize the use of encryption to willfully obstruct justice. Anyone who "willfully endeavors" to use encryption for the purpose of obstructing, impeding, or preventing the communication to a law enforcement officer of information relating to a Federal felony would be subject to criminal penalties. CDT believes this new federal crime is unnecessary since it duplicates obstruction of justice crimes that are already available to prosecutors, and is unwise since it might be interpreted to discriminate against users of encryption. BACKGROUND - BILLS ADDRESS LONG-STANDING FRUSTRATIONS WITH U.S. ENCRYPTION POLICY Congressional action comes as Clinton Administration encryption restrictions continue to jeopardize the security of computer users. Encryption tools, which scramble electronic communications and data, are widely viewed as the key to providing security and privacy and encourage commerce on the Global Information Infrastructure. Individuals need encryption in order to trust the GII with confidential data such as financial transactions, medical records, or private communications. Businesses need encryption to provide individuals with privacy protections they need and to protect their own proprietary information as it flows across vulnerable global networks. The lack of good encryption today has left computer users vulnerable to the prying eyes of hackers, corporate competitors, and even foreign governments. Current Administration policy restricts the export of "strong" encryption hardware or software products with keys greater than 40 bits long. (The length of encryption "keys" is often used to indicate the security of a system.) Export controls actually influence the entire GII -- both domestically and internationally -- due to the difficulty of distributing and interoperating products with different strengths of encryption. The level of security permitted under the export controls, and hence the level of security largely available to domestic users as well, has been judged woefully inadequate by many experts. Even the most recent Administration "Clipper II" proposals would only allow the export of moderately stronger encryption, and then only with "key escrow" restrictions to guarantee U.S. government access to individual keys -- restrictions which raise real Constitutional issues and are bound to fail in the competitive international marketplace. In recent months, groups from across the political spectrum have increasingly criticized the Clinton Administration's restrictive export controls. In November 40 companies, trade associations, and public interest groups wrote to Vice President Gore calling the latest Administration proposals flawed and inadequate. Last month a report by the CEOs of 13 leading U.S. technology companies found that U.S. industry stands to lose up to $60 billion dollars per year by the year 2000 due to restrictions on the export of cryptography. And several weeks ago a group of noted computer security experts released a report calling for the deployment of dramatically longer encryption key lengths of at least 75 to 90 bits. The House and Senate bills give voice to this growing drumbeat of criticism demanding a radical departure from the flawed approach of the Clinton Administration's current encryption polices. CDT looks forward to working with members of Congress to push for a more comprehensive U.S. encryption policy that reflects the privacy and security needs of computer users. FOR MORE INFORMATION More information on the cryptography policy debate, including the text of the Senate and House bills, is available on CDT's Cryptography Issues Web Page: http://www.cdt.org/crypto/ For More Information Contact: Center for Democracy and Technology +1.202.637.9800 Daniel Weitzner, Deputy Director <djw(a)cdt.org> Alan Davidson, Staff Counsel <abd(a)cdt.org> ----------------------------------------------------------------------- (2) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by more than 9,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (3) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.9 3/5/96 -----------------------------------------------------------------------

1 0

(INFO) Leahy/Goodlatte introduce crypto bill
by Voters Telecommunications Watch 17 Dec '03

17 Dec '03

======================================================================== __ _________ __ \ \ / /_ _\ \ / / Voters Telecommunications Watch (VTW) \ \ / / | | \ \ /\ / / (We're not the EFF) \ V / | | \ V V / URL:http://www.vtw.org/ \_/ |_| \_/\_/ Mar 5, 1996 (expires Apr 5, 1996) SEN. LEAHY (D-VT) AND REP. GOODLATTE (R-VA) INTRODUCE "ENCRYPTED COMMUNICATIONS PRIVACY ACT" TO THWART CLINTON ADMINISTRATION'S FLAWED CLIPPER PLAN Please widely redistribute this document with this banner intact ________________________________________________________________________ CONTENTS The Latest News Analysis of Leahy bill What You Can Do Now Chronology of Leahy bill Press Contact Information A few questions and answers Our policy on financial donations ________________________________________________________________________ THE LATEST NEWS In the opening round of what promises to be a no-holds-barred fight with the Clinton Administration and the Intelligence community over cryptography policy, Senator Patrick Leahy (D-VT) and Representative Robert Goodlatte (R-VA) presented bills today that intend to: -decontrol the export restrictions on mass-market and publicly available software such as Phil Zimmerman's "Pretty Good Privacy" (PGP), -affirm Americans' right to use cryptography of their own choosing, -affirm Americans' right to *not* use key escrow systems, -make it a crime for an authorized key escrow agent to disclose a key recklessly or intentionally, and -create a crime of using cryptography while committing a felony for the express purpose of thwarting an investigation. The topic of cryptography exports is crucial to the continued growth and security of the Internet and online commerce. The success of the information economy in many cases hinges on the ability to employ strong encryption techniques to protect confidential data. The two bills come at a crucial time after the Clinton Administration has put forth two flawed encryption proposals, Clipper and Son of Clipper. A third plan, this time in the form of legislation, is in the works if one is to believe the rumors in the press. So far the only reason the Clinton Administration's flawed "Clipper" plans have been paid any attention to at all is because they offer relaxed export controls in return for storing your keys with government agencies or quasi-government agencies. The best part of the Leahy bill, though, is that you can use the encryption export provisions without ever thinking about using escrow. Leahy's bill will ensure that few consumers, if any, ever consider another Clinton-mandated encryption scheme ever again. The Leahy/Goodlatte bill allows the export of most of the cryptographic products you and I would would like to use, without any of the Clipper requirements. Without the lure of relaxed export for "Clippered" products, nobody will pay attention to Clipper products. This will surely be the deadly blow to all present and future "Clipper" plans that rely on the Clinton Administration's strongarm export policy tactics. A new Clinton proposal on encryption is rumored to be in the works. However, judging from the way they've bungled the first two proposals, VTW believes the newest Clinton proposal will be created with a similar process, with little regard for the concerns of business, industry and the public. One thing is certain; there will be movement on encryption policy this year. It may be legislative or it may be regulatory; we're in a far better position driving legislation we endorse, rather than lobbing bombs at legislation being driven past us. VTW believes this legislation is an excellent initiative. We have long advocated the decontrol of cryptography export laws based on the following principles: -The public and businesses have the right to use the strongest cryptographic products they (not the government) feel are necessary to ensure the confidentiality of their private communications. -The public and businesses should never be compelled to use software with escrow functionality, escrow agents, nor escrow agents that do not have the public's confidence. -If the public and business should choose to use escrow agents, the agents' primary responsibility should be to key owners, not to law enforcement. They should be mostly unregulated, and in an ideal world, there should be hundreds, if not thousands to choose from. -Current export controls are outdated, don't work, are endangering the worsening the problem of security of the Internet, and are damaging the competitiveness of US companies in the global marketplace. The way Leahy/Goodlatte addresses export of cryptography is consistent with our principles. VTW will keep you informed of its progress. As anyone familiar with the legislative process knows, a bill rarely ever looks the same at the end of the process as it did at the beginning. This bill is good for the Internet, and we intend to monitor it like the watchdogs you expect us to be, to ensure that it does not significantly deviate from the basic principles outlined above. In doing this, it will be crucial for the Internet community to speak up. Big business will weigh in on this bill to protect their rights to sell products with encryption in them. However nobody will speak up for your right to have a private conversation except you. We're counting on you to find that voice, and use it over the next few months to ensure that your present right to use encryption *of your choice* isn't amended out of the bill. There are some powerful forces out there that will be lobbying heavily on this legislation. The White house is rumored to have their bill ready. The law enforcement and intelligence communities, who would rather you couldn't use strong encryption, will be employing their usual scare tactics. Worst of all, the Clinton Administration, particularly Vice President Al Gore, who should be a voice of reason for these issues, will, if the example of Clipper and Son of Clipper is any indication, pander to law enforcement and the anti-crime vote in an election year. We predict that the White House will do everything in their power to prevent Senator Leahy from liberating PGP. He will need your help to push forward. Over the next few months, VTW will be coordinating a coalition of names, many of which are already familiar to you. This coalition will ask you to call and write to Congress, expressing your opinion, and threatening to back it up with the ultimate legitimate weapon of democracy, your vote in this election year. We're counting on you; we know you're up to it. We urge you to visit our homepage at http://www.vtw.org/, where we'll keep you updated on current events involving the bill. If you haven't already, you may want to subscribe to our vtw-announce list, no discussion, low-volume email messages that will keep you updated directly as we issue alerts and newsletters. In the wake of the Telecomm Bill protests, over 3,000 of you have subscribed in less than a month. Use the one-line form on our home page. P.S. We don't count our WWW page hits; we have better things to do. ________________________________________________________________________ ANALYSIS OF ENCRYPTED COMMUNICATIONS PRIVACY ACT The Leahy and Goodlatte bills are not exactly alike. For the moment, we will concentrate on the Leahy bill for purposes of analysis. We find it to be fleshed out in many areas. AFFIRMS OUR RIGHT TO USE CRYPTOGRAPHY OF OWN CHOOSING The bill affirms that "Americans should be free lawfully to use whatever particular encryption techniques, technologies, programs, or products developed in the marketplace they desire in order to interact electronically worldwide in a secure, private, and confidential manner". The bill also affirms our right to use cryptographic products that do not have key escrow functions in them, or to choose not to use such functions. If we do choose to use escrow holders, the bill affirms our right to use key holders of our own choosing. DEREGULATION OF PUBLICLY-AVAILABLE CRYPTOGRAPHIC TECHNOLOGY The bill addresses the "PGP problem" by making software that is "generally available", "publicly available", or "public domain" exportable with NO LICENSE REQUIRED, unless it is "specifically designed for military use". CREATES CRIMINAL PENALTIES FOR MALICIOUS KEY HOLDERS If I designate a local business to be my key holder, it is important that they take that responsibility seriously. The bill creates criminal penalties for key holders that behave recklessly with my decryption keys. Recently the Administration suggested that such individuals must be licensed by the US Government, and in some cases, be required to possess security clearances. This would make them little more than puppets of law enforcement. The bill creates criminal penalties with monetary fines if a key holder releases a key recklessly or inappropriately. Reasonable rules for an escrow agents conduct are described in the bill. These are discussed further below. RAISES THE STANDARD FOR A COURT TO OBTAIN YOUR DECRYPTION KEY Currently a court needs to only issue a simple search warrant to obtain a copy of your key for decryption of your communications. This bill raises the requirement to be equivalent to that of a court-ordered wiretap. ENCOURAGES KEY HOLDERS TO SERVE THE INTERESTS OF KEY OWNERS WHEN PRESENTED WITH A COURT-ORDER If you have chosen to use a key holder, they may find themselves in a curious predicament if presented with a court order at some point in the future. They really don't want to simply hand over your decryption key, since once it is divulged, it might be used to decrypt more information than what is required under the court order. The bill instructs a key holder to provide law enforcement with as little information as possible, in order to satisfy a warrant request, while still protecting as much of the key owner's confidentiality as possible. The bill accomplishes this by instructing a key owner to attempt to deliver decrypted communications only for the times specified by the warrant to law enforcement as a first step. If the key holder is unable to produce the decrypted communication for law enforcement, only then, as a last resort, should a key holder relinquish your key. This allows a key holder to work to protect the confidentiality of your decryption keys, while still fulfilling both the spirit and letter of the court order. DISCOURAGES THE USE OF ENCRYPTION TO THWART A FELONY INVESTIGATION This is probably the one provision we wouldn't have put in the bill, were we drafting it. Clearly added to appease law enforcement, it creates a new crime to "willfully" attempt to thwart a law enforcement investigation by using encryption. VTW feels that such a crime is unnecessary, but we're happy to see this is a fairly narrowly-tailored statute. It only applies to individuals who are engaging in a felony and using encryption to communicate information while in the commission of the felony, and whose intent, in using encryption, is to foil a law enforcement investigation. If you and a friend are talking with an encrypted phone, and you mention that you think some mutual friend is cheating on their taxes, you are not liable under this provision. If you are planning the Million Man March using encrypted email, and fear that you may be investigated because your cause in unpopular in some law enforcement circles, you are not liable because you are not committing a felony, even though law enforcement may find it annoying that they cannot read your mail. This provision only applies to you if you are using encryption to specifically foil a law enforcement investigation AND the communication relates to a felony AND you are using the communication to commit the felony. VTW feels this is a fairly narrowly drawn statute that is not likely to be easily abused. Although this bill is the best thing we've seen in Congress on this issue since ex-Rep. Maria Cantwell's (D-WA) export-of-encryption bill was introduced to the 103rd Congress two years ago, there are still some issues in the bill that bear further examination. Let it be understood that we think the balance of this bill right now will help the net far more than hurt it and the net should step forward and help Leahy and Goodlatte in their fight against the Administration over this issue. Nevertheless, our suggestions for tuning this bill are included below. BILL SHOULD INCLUDE AN EXPLICIT SUPPRESSION PROVISION Although the Fourth Amendment is the law of the land, it is important to note that it a applies to communications decrypted after an erroneous warrant has been issued. VTW feels that such a provision should be enumerated in the bill, just to clarify any concerns a court might have about such evidence. It is also clear, however, that such a provision is nearly impossible to obtain in the current Congressional climate, though we will continue to urge the bill's sponsors to add it. THE BILL SHOULD CLEARLY INCLUDE ENCRYPTION PRODUCTS FOR STORED DATA The bill addresses encryptions products used for wire or oral communications, per the Electronic Communications Privacy Act. Since many encryption products are built for just this purpose, it includes many of them. However, we think it is appropriate to specifically include products that are used only for encrypting stored data. THE BILL SHOULD INSTRUCT ESCROW AGENTS TO REPORT DISCLOSURES AS WELL The bill currently requires law enforcement to notify the Office of the Courts as to the number of court orders served on key holders and for what crimes the court orders were obtained. The Office is required to make this information public annually. VTW feels that accountability should never be in short supply. Requiring key holders to notify the Office of the Courts whenever they are ordered to disclose a key will allow the public yet another way of making sure that appropriate procedures are being followed to protect the public. We suggest an inexpensive reporting method such as registered mail so as not to burden key holders needlessly. Presumably, when the Office of the Courts totals up its numbers every year, the number of disclosures reported by law enforcement will add up to the SAME number reported by key holders themselves. Should there be a discrepancy, the public will be grateful for the additional accountability. NEW CRIMES ARE NEEDED TO DISCOURAGE MISREPRESENTING YOURSELF TO A KEY HOLDER Currently the bill relies on existing laws that cover police misrepresentation to punish law enforcement officials that misrepresent themselves to a key holder with an improper or forged warrant to obtain a key or a decrypted communication. The majority of law enforcement officials are good people that would never consider such an act. Consequently, they should have nothing to fear from such a statute. VTW believes that a new statute is needed to dissuade those few over-zealous law enforcement officials from violating the public's trust in these matters. On the whole, we believe that this bill is a win for the Internet public and Internet businesses that require strong market-driven cryptography. VTW urges you to become familiar with it and support Leahy and Goodlatte in their efforts. ________________________________________________________________________ WHAT YOU CAN DO NOW 1. It's crucial that you familiarize yourself with this bill. You can find links to it at http://www.vtw.org/ If you are an ISP or run a WWW page, we urge you to place a pointer to the bill on your homepage or in your message of the day. Here's a sample paragraph you can use: A bill has been introduced in Congress today that will decontrol many types of encryption products so they may be sold abroad, including the world-famous PGP. To learn more about this legislation, see VTW's home page at http://www.vtw.org/ Please remove this notice after a few days. 2. If you are an Internet Small Business, signon to VTW's Internet Small Business Coalition at http://www.vtw.org/help/ We'll likely be assembling a coalition of Internet small businesses in the next few weeks and will solicit your input on ways of carrying your message to Congress. 3. Join our vtw-announce mailing list by sending mail to majordomo(a)vtw.org or by signing up straight through our WWW page at http://www.vtw.org/. We'll be following this issue closely in the coming months. Note that vtw-announce is not a discussion list. It's VTW announcements, with little repeat content from other sources. ________________________________________________________________________ CHRONOLOGY OF THE 1996 LEAHY/GOODLATTE CRYPTO BILLS Feb 26, '96 Sen. Leahy (D-VT) and Rep. Goodlatte (R-VA) introduce the Encrypted Communications Privacy Act. Cosponsoring this legislation on the Senate side at Sen. Burns (R-MT) and Sen. Murray (D-WA). On the House side are the following cosponsors: DeLay, Campbell, Eshoo, Moorhead, Doolittle, Barr, Ewing, Mica, Everett, Bono, Lofgren, and McKeon. ________________________________________________________________________ A FEW QUESTIONS AND ANSWERS Q: Does this require, or even urge individuals to use third parties to hold their decryption keys? A: No way. You can use the liberal export provisions in this bill with out ever allowing your keys to leave your "cold dead fingers". Q: Does this advance the Clinton Administration's Clipper scheme in any way? A: No, in fact this bill cuts out the very heart of the Clipper program. The two Clipper programs had the potential to be adopted because Clipper products were intended to receive preferential export treatment. This allows the export of non-Clipper products. In the global marketplace, the Clipper products will not be able to compete. This bill is probably the final nail in the coffin of the Administration's flawed Clipper proposals. Q: Bills change during Congressional deliberation. Could this bill change in such a way that VTW would no longer support it? A: Absolutely. In fact, we consider it our mission to monitor the legislation to ensure that it isn't amended to act against the right of Internet users and businesses. Q: Wasn't Goodlatte one of the bad guys on the Communications Decency Act? Why is he sponsoring this bill, and can we trust him? A: Goodlatte did indeed introduce the fatal amendment that made the House version of the Telecomm Bill unsupportable. Nevertheless, VTW has found that a Congressperson's vote on one sort of bill is little indication of his or her stand on others. VTW wil closely examine any change in the language of the bill throughout its Congressional life. Q: Does this create a requirement for key holders to exist, or for me to use programs that store keys with third parties? A: No. The bill affirms your right to use encryption without such a feature, and if you do use software with such a feature, to self-escrow the keys. In fact, key holders can exist today. Q: Does this create a new obligations for key holders to disclose keys that they wouldn't have to comply with before? A: No. In fact, this bill makes it harder for a law enforcement official to retrieve a key from a key holder, by requiring a wiretap request instead of a simple search warrant. ________________________________________________________________________ PRESS CONTACT INFORMATION BY EMAIL (if your deadline is more than 24 hours away) Send mail to vtw(a)vtw.org with "press deadline" in the subject line if you are on a deadline. BY PHONE (if your deadline is in less than 24 hours) Call 718-596-2851 and follow the directions for contacting Steven Cherry or Shabbir J. Safdar quickly. ________________________________________________________________________ OUR POLICY ON FINANCIAL DONATIONS We do not accept unsolicited financial donations for our work. If you want to help further VTW's work, we urge you to register to vote. Check the Blue Pages of your local phone book for "Board of Elections". You should be able to obtain voter registration forms from them. ________________________________________________________________________ Copyright 1994-1996 Voters Telecommunications Watch. Permission is granted to copy and distribute this document for non-commercial purposes only, provided that the above banner and this copyright notice appear in all copies. For other uses, see our Copyright Policy at http://www.vtw.org/copyright.html ========================================================================

1 0