December 2003 - cypherpunks-legacy

CDT on crypto bills
by Declan B. McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message begins here ---------- Date: Tue, 5 Mar 1996 23:12:49 +0100 To: "Declan B. McCullagh" <declan+(a)CMU.EDU> From: jseiger(a)cdt.org (Jonah Seiger) Subject: Re: NYT: Encryption compromise bill introduced Cc: Fight Censorship Mailing List <fight-censorship+(a)andrew.cmu.edu>, jim(a)RSA.COM If you read our statement, you will see that we agree completely with EFF & Jim that the new crime is unnecessary and needs to be addressed. As for the second issue, I understand EFF's concerns, and this is definitely an issue that needs further clarification and discussion. But you should note that the bills do not in any way impose key escrow (and only the Senate bill contains these provisions anyway). In fact,the legislation does precisely the opposite in two ways: 1. The bill explicitly affirms the rights of Americans to use any form of cryptography they choose domestically. 2. By directly attacking export controls, the legislation undermines the only lever the Administration has in imposing Clipper and Clipper II. The Clipper and Clipper II policies are based on the assumption that the market in most cases will support only one version of a particular crypto application. By encouraging only the export of cyrpto w/key escrow mechanisms, the Administration believes that they can force the domestic market to adopt escrow as well. This has not worked yet, but it *has* forced a stalemate that has led to a very little privacy and security for the Net. By undermining the only leverage the Administration has for left to impose key escrow domestically (beyond an explicit effort to ban it outright), these bills effectively remove the current threat of a government imposed domestic escrow crypto policy, and allow the market for strong cryptography to flourish. So again, CDT believes that this legislation represents the best opportunity we have had yet to provide the Internet with the privacy protections and security it desperately needs. There are most certainly areas that we would like to see changed and/or clarified, but that should not overshadow the important opportunity these bills represent. Jonah >Thanks for the clarification, Jonah. I agree the bill will undercut >Clipper II, but I share the concerns outlined in the EFF statement, >which says the bill: > > * Makes it a new crime to "use encryption to obstruct justice", with > 5-10 year sentences, plus fines. In plain language, this is a > extra criminal charge that can be applied when police are frustrated > in an investigation but happen to catch someone breaking the law in > some other way. > > * Provides a legal infrastructure for key escrow, a system in which > all users' keys are copied to permit government access. > >Jim Bidzos is the CEO of RSA Data Security, and he supports Leahy's >bill. His mail is attached below. > >-Declan > >---------- Forwarded message begins here ---------- > >Date: Tue, 5 Mar 96 13:26:39 PST >From: jim(a)RSA.COM (Jim Bidzos) >Message-Id: <9603052126.AA19534(a)RSA.COM> >Cc: cypherpunks(a)toad.com > > >I'm in favor of the Bill because it specifically prevents, by law, the >US Govt from mandating key escrow. Also because it would, by law, >force export control of crypto out of the Dept. of State and into the >Dept. of Commerce, effectively allowing any crypto used in the US and >"widely available" to be exported. (The bill does a few other things. >One, it provides for criminal penalties for key holders who abuse >their role as an escrow agent, assuming anyone *chose* to use key >escrow. Second, it makes the use of encryption -any encryption- a >crime if used in the commission of or support of any criminal >activity. I think the bill would be better off without these >provisions, but I suspect this is an attempt to give the >administration something.) > >I anticipate that the Administration, led by the intelligence and law >enforcement interests, will vigorously lobby against this bill... -- Jonah Seiger, Policy Analyst Center For Democracy and Technology <jseiger(a)cdt.org> 1634 Eye Street NW, Suite 1100 Washington, DC 20006 PGP key via finger (v) +1.202.637.9800 http://www.cdt.org/ (f) +1.202.637.0968 http://www.cdt.org/homes/jseiger.html

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

---------- Forwarded message begins here ---------- From: shabbir(a)vtw.org (Shabbir J. Safdar) To: Stanton McCandlish <mech(a)eff.org> cc: declan+(a)cmu.edu (Declan B. McCullagh), fight-censorship+(a)andrew.cmu.edu, jim(a)rsa.com Subject: Re: NYT: Encryption compromise bill introduced Date: Wed, 06 Mar 1996 15:14:01 -0500 Sender: shabbir(a)panix.com The Leahy bill is actually much better than Stanton lets on. Take a look at it, it affirms Americans' right to choose whatever algorithm or technique they'd like, as well as takes great pains to go on record to say that Congress treaded very carefully to preserve Americans' right to not use key escrow algorithms, and if they did, not to use escrow agents. You don't get much more of a guarantee than that. Regardless of the ulterior motives of the White House, key escrow programs are still voluntary as read on the books. The best we can write into a law is to have our rights reaffirmed. Leahy has given this to us in spades. Let's not soft-pedal this legislation. Leahy and Goodlatte are going head to head with the White House to undermine the strongarm export tactics of Clipper and Son of Clipper. They've stuck their necks out for us, we need to back them up. Just wait until the White House starts to act in reaction to this. It's not going to be pretty.... -Shabbir J. Safdar * Online Representative * Voters Telecomm. Watch (VTW) http://www.vtw.org/ * Defending Your Rights In Cyberspace Stanton McCandlish writes: >> Date: Tue, 5 Mar 96 13:26:39 PST >> From: jim(a)RSA.COM (Jim Bidzos) >> Message-Id: <9603052126.AA19534(a)RSA.COM> >> Cc: cypherpunks(a)toad.com >> >> >> I'm in favor of the Bill because it specifically prevents, by law, the >> US Govt from mandating key escrow. > >This is only true of the Goodlatte bill. The Leahy bill just explicitly >does not mandate GAK. Goodlattes does this, and goes further, preventing >the Administration from doing so. > >Needless to say, we'd like to see the two bills merged, and the better >features of each kept. > >> I anticipate that the Administration, led by the intelligence and law >> enforcement interests, will vigorously lobby against this bill... > >Right. We don't expect it to pass, but it could be an important step in >raising the issues. > > >-- ><HTML><A HREF="http://www.eff.org/~mech/"> Stanton McCandlish ></A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org ></A><P><A HREF="http://www.eff.org/"> Electronic Frontier Foundation ></A><P> Online Activist </HTML>

1 0

Re: (Fwd) Gov't run anon servers
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Hal Finney writes: [...regarding mixmaster remailer passwords...] > >The other suggestion that was made here, that the operator would have to >manually type in the pass phrase every time the computer rebooted [...] >However it would probably not be a practical method of operation given >the reliability of at least the Unix operating systems that I am familiar >with. Then you need to start running PC unix systems which were last written or updated during this decade. Keeping a unix system running, _as long as it is running a limited subset of application programs_, is a trivial task in Linux, BSD/OS, FreeBSD, and others. I routinely have server systems which perform specific tasks (e.g. smtp mail services, DNS, etc.) with uptimes of 5-6 months; there is no reason why a host serving as a remailer should not be able to be as reliable. > And even then the information is in memory. An attacker who could >gain root privileges (and let's not pretend that the NSA can't do that) >can dump memory and later comb it for the key information. > "Security is economics" -E. Hughes The point is not to make a system which is absolutely, positively, no doubt about it, secure against any attacker. If cypherpunks could do this they would be working for defense contractors and others who make certified systems. The objective is to make a system which is difficult to attack, one which costs the attacker time/money. After securing a host against the obvious attacks one can turn to the esoteric ones such as you present: move the key to kernel memory and remove tools for accessing or manipulating that area, run the memory-space encrypted and do not let it dump the contents to disk, etc. Systems which have been certified to high Orange book levels already exist, so there are obviously solutions to the problems you present. The tools and tricks of these systems just need to be migrated into systems which people actually use. Then remember that remailers gain strength in numbers. The more remailers you chain your message through the better your chances of passing through a single node which is not compromised, at which point your message has been "mixed." As long as it is easier for someone to create new remailers than to break existing remailers we are winning. >My point remains that strong keys are pointless for remailers which run >on Unix systems connected to the net. "Insisting on perfect security is for people who do not have the balls to live in the real world" -paraphrased from M. Shaefer You give far too much credit to the potential attackers. One advantage that unix systems connected to the net have over your hypothetical PC at home is the advantage of persistence, what is the point of running a remailer if it is never up, or only up when you need to use it? Traffic analysis of that particular node becomes a pretty easy task :) The unix hosts running remailers also have the advantage in that they have been subjected to attack for quite a while now and most of the obvious problems (and some of the non-obvious problems) have been fixed. A strong key on such a host is better than a weak key, so why not make systems as strong as you can? The only way to have a completely secure computer is to encase it in concrete, cut any network connections, and drop it into the ocean; OTOH the only thing you have created in this case is a fairly unique boat anchor. You are beginning to sound like the people who claim that the NSA can crack any encryption system, not because they have any proof but just because they extrapolate their limited knowledge into the unknown and mix in a bit of paranoia. [...] >Recall that my original comments were in connection with the claim that >the government was running most of the remailers. As I said, I still >think that is absurd when it would be so much easier to simply steal >their keys. But the point is that it is _not_ easier to steal the keys. It is much easier to put up a remailer than to attack an existing remailer, this is why the remailer system is winning the battle of security economics. By putting up its own remailers a potential attacker probabalistically diminishes the number of systems which they must break. jim

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

[In reply to Shabbir's message. -Declan] ---------- Forwarded message begins here ---------- From: Stanton McCandlish <mech(a)eff.org> Message-Id: <199603062155.NAA22301(a)eff.org> Subject: Re: NYT: Encryption compromise bill introduced To: shabbir(a)vtw.org (Shabbir J. Safdar) Date: Wed, 6 Mar 1996 13:55:07 -0800 (PST) Cc: declan+(a)cmu.edu, fight-censorship+(a)andrew.cmu.edu, jim(a)rsa.com In-Reply-To: <199603062014.PAA02169(a)panix4.panix.com> from "Shabbir J. Safdar" at Mar 6, 96 03:14:01 pm > The Leahy bill is actually much better than Stanton lets on. Take a > look at it, it affirms Americans' right to choose whatever algorithm or > technique they'd like, as well as takes great pains to go on record to > say that Congress treaded very carefully to preserve Americans' right > to not use key escrow algorithms, and if they did, not to use escrow > agents. You don't get much more of a guarantee than that. Sure you do: Goodlatte's more direct prohibition on the Exec. branch mandating Key Escrow. What's the problem here? We know Goodlatte's version, on this provision at very least, is better. Why can't we just agree that it is, and support that? Goodlatte's bill isn't competing with Leahy's, they were introduced simultaneously in different chambers, and are intended to get the same message across. I can't see a problem with saying "we like this particular phrasing better, let's have it in both versions." The entire point of all this is to have the same bill on both sides of Congress anyway. It can either happen early, or (on the off chance it ever gets that far) in conference committee. Here we have a large say. In conf. cmte. we have almost no say. Again, what's the problem? What are we arguing about? > Regardless of the ulterior motives of the White House, key escrow > programs are still voluntary as read on the books. The best we can > write into a law is to have our rights reaffirmed. Leahy has given > this to us in spades. I disagree. A better thing we can write into law is to simultanously have rights reaffirmed, and send a more direct message to the Admin that it cannot tread here. > Let's not soft-pedal this legislation. Let's not hard sell flawed parts of it, when fixes are not just available but already introduced as "live" legislation. > Leahy and Goodlatte are going > head to head with the White House to undermine the strongarm export > tactics of Clipper and Son of Clipper. They've stuck their necks out for > us, we need to back them up. Certainly. > Just wait until the White House starts to act in reaction to this. It's > not going to be pretty.... No kidding. I expect either an attempt to mandate escrow, a worsening of the export controls, and/or an all-out assault on American's rights to encrypt at all, or without some kind of worse-than-GAK registry or licensing. If not all of the above. -- <HTML><A HREF="http://www.eff.org/~mech/"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org/"> Electronic Frontier Foundation </A><P> Online Activist </HTML>

1 0

Re: Truelly Random Numbers
by Mutant Rob 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mark Allyn 206-860-9454 wrote: [..] > Take a piece of non conducting board, say about six by six > feet. Put electrodes on it; say a pair of electrodes every > quarter inch or so across and down. > > Each pair of electrodes would be connected to logic so that > it generates a unique number. When the electrodes are shorted, > the number would be generated. Quite elaborate. And unless you live in a rainy part of the world, not very useful. Better off using those contraptions where little steel balls fall around the electrodes. There's some entropy there... but still, it's too elaborate for RNG generation. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMTooTyoZzwIn1bdtAQFXIwF/cjzvAfNJMOn9Pw6VSztPKCHUc/dmuwZ1 bOAEKnlQmwhRKOxpNmBr+EpM3zoRIWWP =8nb+ -----END PGP SIGNATURE-----

1 0

DoubleSpeak
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

> In addition they >mentioned that the NSA has successfully developed systems to break >encrypted messages below 1000 bit of key length and strongly suggested >to use at least 1024 bit keys. They said that they semselves use 1024 >bit keys. Is there anyone her who has *not* "developed systems to break encrypted messages" ? One is called brute force and can run on any PC. The two pieces missing from the statement is the *cost* and *time* involved in breaking keys of X length & would suspect the algorithm might have something to do with the answer. (Can generate a LOASDR key of 1024 bits real easily, breaks just as fast). I use a PGP key of 1024 bits simply because I am too lazy to go to 2048 so why was this turkey posted twice ? Lacking meaningful parameters, it does not really say anything. Warmly, Padgett

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

On Thu, 7 Mar 1996, cjs wrote: > > > > BTW, did you hear that IO got on the SurfWatch "bad list" because there > > were more than 25 complaints about objectionable material in the io.com > > domain. (Apparently, when SurfWatch hears more than 25 complaints > > against a particular domain, the just deny access to the whole domain > > rather than particular URLs.) > > So.. whats the number to call? Microsoft has material on their site I > object too. =) And let's not forget the really objectionable stuff at http://www.buchanan.org/pjbindex.html (the Buchanan Campaign web site). ------------------------------------------------------------------------- | Liberty is truly dead |Mark Aldrich | | when the slaves are willing |GRCI INFOSEC Engineering | | to forge their own chains. |maldrich(a)grci.com | | STOP THE CDA NOW! |MAldrich(a)dockmaster.ncsc.mil | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

1 0

No Subject
by Gallicchio, Florindo 17 Dec '03

17 Dec '03

Most humble apologies from a lurker for posting this question to the whole list. I couldn't find the reference in the archives... About a month or two ago, someone posted some information on that little piece of code attached to MS Mail messages alongside the file attachment. I need to find out the vulnerabilities of that code, such as susceptibility to virus, spoof, attack, etc. Not crypto related, but important to me nonetheless. Please send responses to me via e-mail. Thanks in advance. Florindo Gallicchio fgallicc(a)ncsus.jnj.com "I don't speak for my company yadda yadda yadda..."

1 0

Re: PGP backdoor? (No, I'm not paranoid.)
by David Weiss 17 Dec '03

17 Dec '03

jf_avon(a)citenet.net wrote: >perry(a)piermont.com wrote: >> [...] >>Your informant is taking extremely good drugs. You should find out who >>his connection is should you want to get any. >> >>Perry > >Dear Perry, > [interesting statement of why nothing one hears should ever be discounted] > >So, why waste bandwith with a post that apparently mainly seems to be aimed >at dismissing somebody but brings *absolutely no* new knowledge to >the discussion? Please, next time, post privately. Sure it does; Perry's opinion. And what that is worth, depends on the reader's opinion of Perry. >Funny jokes are, IMHO, welcome because they have some life-enhancing value. > >So please, at least be funny... I thought it was pretty funny (more so than your post, anyway). David (I feel another really silly and pointless thread starting...)

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

This came from Associated Press (27th Feb) : ============================================================================ Europe pushes Asian weapons sales KUALA LUMPUR, Malaysia - Russia is doing it. So are Britain, France, Germany and Spain. Even neutral Sweden has joined the race to sell warplanes, missiles, tanks and warships for Asia's rapidly expanding arsenals. The Europeans, fighting an uphill battle against dominant U.S. competitors, are offering what the Americans sometimes won't - the newest, deadliest technology with no political strings attached. While post-Cold War budget cutting devastated the arms trade in the rest of the world, military spending in Asia is still rising. >From 1991 to 1994, Asian sales by Britain, France, Germany and Italy totaled $3.4 billion - a 30% increase over their sales in the 1987-1990 period, according to figures compiled by economist Digby Waller of the International Institute of Strategic Studies in London. By contrast, American weapons sales in the region were $5.4 billion in 1991-1994, a 7% decline from the previous three-year period. Despite widespread agreement that U.S. weapons makers are technologically superior, European producers have signed a flurry of deals with nearly every Asian country. According to military analysts, buyers were attracted by Europe's lower prices, equipment - like submarines - that the United States doesn't sell and - perhaps most important - the chance to avoid becoming dependent on American suppliers in case the United States cuts back future arms exports. In one of the most powerful signs of the Asian market's allure, Russia tossed out ideological considerations in favor of cash, selling its former Chinese rivals high-performance Sukhoi 27 jet fighters and the technology to make more. Thailand bought an aircraft carrier from Spain. Taiwan bought six frigates and 50 fighter jets from France. South Korea bought three German cruisers and Malaysia bought two British frigates. Sweden sold diesel-electric submarines to Thailand and Singapore. The United States no longer manufactures such vessels, partly in an attempt to halt their proliferation. Such submarines are very quiet and almost impossible to detect, even with sophisticated equipment. Some military analysts argue the unprecedented weapons buildup will ignite an arms race in a region crisscrossed by territorial disputes. They point to the growing military might of Japan, China and India and a series of smoldering regional disputes, including those between Taiwan and China and between North and South Korea. Asian governments counter that they're entitled to defend their territory. "It is wrong to see the purchase of defense equipment by countries in the region as an arms race,'' Singapore's defense minister, Tony Tan, said in a TV interview in January. "We and our ... neighbors are proceeding with plans to modernize our armed forces, now that our economies have grown and we have the resources to pay for better weapons and equipment.'' The biggest potential source of conflict in the region is China's feud with its Southeast Asian neighbors over oil and gas riches in the South China Sea. China has declared the entire region its territory, and sent warships to enforce the claim. While European governments try not to fuel arms races, they may sell to buyers who are refused American weapons for political reasons, said Paul Beaver, a military analyst for Jane's Information Group. Beaver pointed to the example of Britain's $35 billion deal to supply Tornado fighters and other weapons to Saudi Arabia after the United States balked at selling warplanes that could be used to attack Israel. "That has been seen by the Muslim countries in Southeast Asia as a strong sign that Britain doesn't attach the same political conditions to its sales as the United States does,'' he said in a telephone interview from London. Thailand wants to buy advanced American AMRAAM missiles to arm its new F-18 fighters. But because no other country in the region has a missile that sophisticated, the Clinton administration is hesitating for fear of sparking competition among Thailand's neighbors to match it. "If the United States did not want to sell AMRAAM missiles to Thailand, I wouldn't be surprised if France would be willing to sell a similar missile,'' said Pieter Wezeman, a researcher for the Stockholm International Peace Research Institute. Asian governments also appear to be buying European weapons to diversify their arsenals in case Washington shuts off their supply. "The United States has shown several times that they don't want to sell weapons to everyone, and so at any moment they might start an embargo,'' Wezeman said. In one of the region's biggest recent sales, Taiwan bought 210 fighter jets, splitting the order between French Mirage-2000s and U.S.-made F-16s after Washington first refused to sell and then approved fewer planes than Taiwan wanted. Pakistan, blocked by U.S. law from buying F-16s because of evidence it has built nuclear weapons, is reported to be shopping for French or Russian warplanes to fill the gap. By The Associated Press ============================================================================= no_one@unimportant.

1 0