December 2003 - cypherpunks-legacy

Re: So, what crypto legislation (if any) is necessary?
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: [...] >> However, what if Joe is _also_ one's >> lawyer? Does attorney-client privilege apply here? Perhaps.... and Professor Froomkin responded: >NO IT DOES NOT. Basic rule of thumb: your lawyer can't be used to hide >papers someone else can't hide. Ok, at the margin it gets tricky, but >bascially the privilege is not going to stretch to your key. Professor Froomkin is right (IMO) but I think that the way he puts this understates the size of the margin when it comes to cryptokeys. If I were a US Attorney, I would bide my time and pick a hard case, involving lots of potentially incriminating (and therefore tempting) encrypted files, an available key, and (at least) two horsemen. The unavailability of the key can then be presented as a "technicality," allowing a bad guy to possibly get off. After I get some precedent it can then be streched over those inconvenient provisions in the Bill of Rights. This is how "hard cases make bad law." >> solution is also fully legal at this time: use only offshore key storage. >> A >> U.S. subpoena to Vince's Offshore Key Repository will carry no weight in >> Anguilla. (Can I be compelled to ask Vince to send my key? Sure. But Vince >> and I could have a stipulation that such "duress requests" will not be >> honored, no matter how loudly I squawk.) > >An interesting issue, likely to be addressed in future judicial >assistence treaties... I agree, but if I were sitting at Anguilla's side of the table (I won't be, and I have no idea what they will do) this point would be a *very* expensive one. Anguilla and other tax-haven countries have little to gain and much to lose by becoming less friendly to the financial privacy of the Vince Cates of this world. JMR Regards, Jim Ray <liberty(a)gate.net> "Isn't it true that the exponential and incredible growth of the Internet came about because the government kept their hands off of it?" -- Judge Stewart Dalzell. _______________________________________________________________________ PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Public Key id. # E9BD6D35 -- http://www.shopmiami.com/prs/jimray _______________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMVf2321lp8bpvW01AQGJnQP8DAhTpnU2memnJta0muU1K2d0N7nhgCwK FCR0R5N6VCJbYu4rXovTlSXevWOkCOPasbZ6DKCzDGHFzQc9KUyc1FCbB4tlYqCr taGXcNKkYafQYF9VBGxUcuOhCb04TvOV1r3+QGqQ7OFvNJppF1YEsUBaO3MclFGW nDetMEwEtJI= =Mu5a -----END PGP SIGNATURE-----

1 0

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 12:23 PM 3/25/96 -0800, Timothy C. May wrote: >I don't see any compelling need for U.S. legislation. And given the >pressures to attach all sorts of language to bills, I think it best that no >legislation happen. [stuff deleted] >IMPORTANT NOTE: It is often said, in a correct interpretation I think, that >a third party holding a key (Joe's Key Warehouse) is _not_ covered by the >5th Amendment's protections against self-incrimination, and so must honor a >subpoena. Sounds accurate to me. While this may end up looking like another of Jim Bell's odd interpretations, the only section in the US Constitution that I see as potentially REQUIRING a person's testimony is the section (can't recall which) which says that a defendant must have a process to compel the appearance of witnesses in his favor. The Constitution, as far as I see, says nothing about requiring people to appear for the PROSECUTION. I know that plenty of judges just automatically assume that this requirement is somehow in there, but a literal reading of the Constitution doesn't provide it. If that's the case, the government has and should have no mechanism to force any key escrow agent to reveal a key. >However, what if Joe is _also_ one's >lawyer? Does attorney-client privilege apply here? Perhaps. A better >solution is also fully legal at this time: use only offshore key storage. A >U.S. subpoena to Vince's Offshore Key Repository will carry no weight in >Anguilla. (Can I be compelled to ask Vince to send my key? Sure. But Vince >and I could have a stipulation that such "duress requests" will not be >honored, no matter how loudly I squawk.) I've always been astonished at the assumption that the government seems to be making that key escrow (which is fundamentally done for the benefit of the key holder) will be implemented in a way that could possibly help the cops out, in a way done to the detriment of the key holder. >>I do feel that it should be possible for courts to sub poena crypto keys, >>but that doesn't really need new law either (4th and 5th ammendments >>become _really_ important though (hmmm- there advantages to writing down a >>constitution after all :) > >I agree that subpoenas for keys are legit. While I may dislike giving up my >key, in a criminal matter it seems like "just another document." If they >can subpoena my diary, my phone records, my dentist bills, why not another >this document? Nothing in the Constitution giving it special status. But are subpoenas _really_ constitutional? In any case, one of the effects of the widespread availability of good encryption might be that suddenly the documents that cops have historically thought were subpoena-able will no longer be. That's life, although they won't like it. Jim Bell jimbell(a)pacifier.com

2 1

Remailer restrictions: coming soon to your burg?
by Robichaux, Paul E 17 Dec '03

17 Dec '03

Josh Quitter recounts the sorry tale of a small-town city councilman whose phone number got attached to one of those phone-sex ads in alt.binaries.*. See <http://pathfinder.com/@@EGI8H7KFBQAAQAGs/time/magazine/domestic/1996/960401 /web.html> for full details. So, what does the councilman do? From the article: >On Feb. 6, at Suponcic's urging, the Willowick city council passed a resolution asking the state >and federal governments to close the "loopholes" that allowed anonymous remailers to operate >outside the authority of U.S. law-enforcement officials. "Once you've achieved one of these >anonymous identities, you're dangerous, and there's no way law enforcement can track it," >Suponcic says. "The animal's out of control." Just like with "communications decency", watch out at the local level. -Paul

1 0

Noise Sphere Plotter in C++ (was Re: Noise sphere graphical tests of randomness)
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Sat, 23 Mar 1996 22:29:52 GMT, I wrote: >I've got a short program for the PC (w/TPascal source) that plots a >noise sphere from a file of (pseudo) random data, if anyone is >interested. Requires a VGA card that handles mode 5Fh (640 x 480, [..] >The source has a brief explanation of what noise spheres are and a >reference to the Pickover article the program was based on. >The source code is not copyrighted, and it would be nice to see it ported to >other systems, or maybe a portable C version that writes the output to a >PCX file in RBG(?). [I'm not that fluent in C to write one...] [..] BTW, check the ftp.funet.fi site... Somebody sent me a C++ conversion of it. It compiles fine with BCC 4.02. Enclosed here (thanks to "James Pate Williams, Jr." <pate(a)mindspring.com>) /* NOISESPH.PAS, A Noise Sphere plotter written in Turbo Pascal (23-Mar-96) Robert Rothenburg Walking-Owl <WlkngOwl(a)unix.asb.com> No copyright is claimed. No guarantees made. Usage: noisesph file This program reads a file of random or pseudo-random data and plots a noise sphere of the data. Poor RNGs or sampling methods will show clear patterns (definite splotches or spirals). The theory behind this is to get a set of 3D polar coordinates from the RNG and plot them. An array is kept of the values, which is rotated each time a new byte is read (see the code in the main procedure). Rather than plot one sphere which can be rotated around any axis, it was easier to plot the sphere from three different angles. This program is based on a description from the article below. It was proposed as a means of testing pseudo-RNGs: Pickover, Clifford A. 1995. "Random number generators: pretty good ones are easy to find." The Visual Computer (1005) 11:369-377. */ #include <conio.h> #include <fstream.h> #include <graphics.h> #include <iostream.h> #include <math.h> #include <process.h> struct Cartesian { double x, y, z; unsigned Color; }; struct Polar { double r, theta, phi; }; int MidA, MidB, MidC, MidY, Scale; double ByteToReal(unsigned char b) { /*note that there will be some gaps since we're only using the equivalent of an 8-bit decimal here*/ return b / 256.0; } //Initialize the graphics screen int InitScreen(void) { int GraphMode, GraphDriver; GraphDriver = VGA; GraphMode = VGAHI; detectgraph(&GraphDriver, &GraphMode); initgraph(&GraphDriver, &GraphMode, ""); Scale = getmaxx() / 6; MidA = Scale, MidB = 3 * Scale, MidC = 5 * Scale; MidY = getmaxy() / 2; if (MidY < Scale) Scale = MidY; return graphresult(); } unsigned int ScaleColor(double) { return LIGHTGRAY; } int Round(double x) { return (int) (x + 0.5); } void Plot(struct Cartesian& C) { putpixel(MidA + Round(Scale * C.y), MidY - Round(Scale * C.z), C.Color); putpixel(MidB + Round(Scale * C.x), MidY - Round(Scale * C.y), C.Color); putpixel(MidC + Round(Scale * C.z), MidY - Round(Scale * C.x), C.Color); } void PolarToCartesian(struct Polar P, struct Cartesian& C) { //No rotation was added. Instead we plot from three angles... C.x = P.r * sin(P.phi) * cos(P.theta); C.y = P.r * sin(P.phi) * sin(P.theta); C.z = P.r * cos(P.phi); //We can assign colors based on x, y, z, r, theta / pi or phi / (2 * pi) C.Color = ScaleColor(C.y); } void main(int argc, char* argv[]) { double X[3]; int error, i, n = 0; unsigned char byte; fstream inp; Cartesian C; Polar P; if (argc != 2) { cout << "usage: noisesph filename" << endl; exit(1); } inp.open(argv[1], ios::binary | ios::in); if (!inp) { cout << "*error*\could not open input file" << endl; exit(1); } error = InitScreen(); if (error != grOk) { cout << grapherrormsg(error) << endl; exit(1); } for (i = 0; i < 3; i++) { inp.get(byte); X[i] = ByteToReal(byte); } do { P.r = sqrt(X[(n + 2) % 3]); P.theta = M_PI * X[(n + 1) % 3]; P.phi = 2 * M_PI * X[n]; PolarToCartesian(P, C); Plot(C); inp.get(byte); X[n] = ByteToReal(byte); n = (n + 1) % 3; } while (!kbhit() && inp); getch(); closegraph(); }

2 1

Weapons & Hope
by Duncan Frissell 17 Dec '03

17 Dec '03

With all of the folderol about the repeal of the Assault Rifle non Ban and the risks to the polity from Assault Encryption, it is important to note that this is Much Ado About Nothing. If these gals are worried about a few AK's, what's going to become of their peace of mind when confronted with nanotechnology. It is not technologically feasibly to develop a pile of advanced technologies that do not contain weapons or defenses of some kind. Technology gives one the power to do things. The power to "do things" is a superset of the power to attack or defend (the power of weaponry). A weapon is basically an instrument for projecting force or (in the case of defenses) blocking that projection. As technology advances, more and more powerful instrumentalities are placed in individual hands. This is particularly the case with modern machines and markets. Whereas past practice involved mass production of identical products from very specialized production machinery, the current trend is moving towards custom products produced by "general" machines. While it might be barely possible in the mass production age to control weapons by blocking the flow of these specific products (a Streetsweeper, say) into the marketplace, it will clearly not be possible in the age of custom production. General machines will be available to produce specialized products (often under the direct control of the customer, himself). Some of this custom production will be weapons. DCF "Gee, I never knew Chuck Schumer was brave enough to attack another military force armed only with an 'Assault Handgun.' He must be because if he ain't then it ain't (an assault handgun, that is) because no one else would be that crazy."

1 0

Re: So, what crypto legislation (if any) is necessary?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:11 PM 3/26/96, Adam Shostack wrote: >Timothy C. May wrote: > >| My point is that I see no compelling legislation that is needed. If enough >| people in Washington really want increased length in _exported products_ >| (remember the "exported" part), the Congress and the President should find >| it easy enough to get said products on to the Approved List. (I note that >| the Leahy Bill really doesn't change this system anyway...some products go >| on the list, some don't...the law only seems to say that when the horse has >| already left the barn, i.e., when "comparable" products are already in >| fairly wide use outside the U.S., then the products should be put on the >| approved list. Big deal. > > Tim, > > I'm forced to disagree on this point. I think that the >comparable product has the potential to be a very big deal; it means >that any product using IDEA or 3DES may become exportable, because >such products are available outside the US. I certainly don't disagree that if Leahy is passed, which is unlikely, then conventional ciphers like 3DES will become exportable. (And I am forced to add, "Big deal.") What I'm more interested in are not the ciphers which had their genesis in the crypto work of the 70s, but in the new and exciting applications to come. Things such as this list often discusses. I believe Leahy could stall export of these new items until eventually there are offshore equivalents of sufficiently wide deployment that the Leahy clause would get invoked. Leahy does little to confirm basic Constitutional rights, and offers a sop to the export control advocates. And the criminalization of use of crypto in furtherance of a felony (any of the 14,662 felonies now on the books), according to the reading of several analysts who have studied Leahy, is disturbing. Whether it can be used to prosecute operators of anonymous remailers remains unclear, but associating cryptography with criminality more directly and statutorily than it is now is NOT a step in the direction we want to see! --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: So, what crypto legislation (if any) is necessary? (Was List O' , shame)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:20 PM 3/25/96 -0800, Simon Spero wrote: >On Mon, 25 Mar 1996, Bill Frantz wrote: > >> At 1:32 PM 3/25/96 -0500, Black Unicorn wrote: >> to type them. Since storage was limited, and old messages were purged from >> the system it also had the effect that anti-trust discovery would have >> nothing to discover. > >Hmmm - that's another issue; what about diffie hellman with ephemeral >keys? Once the transaction is complete, unless you keep a copy of the key, >even you can't decrypt that session. Would a law requiring you to keep a >copy of the keys be important. It would have the advantage of allowing >a sub-poena to be more restrictive than "just hand over your private >key", but it's a pretty heavy (undue?) burden. With PGP at least, it should be possible to hand over the IDEA key required to decrypt each message in question without having to hand over your private key. Since the court would have your public key, they could verify that the IDEA key you gave them was indeed the correct key. Of course if they are using the subpoena to intimidate you, then they will insist on the private key. N.B. The IBM voice system mentioned above (and the attribution should be to me, and not Black Unicorn) did not use any crypto. Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: Let's *NOT* "Raise their Awareness"
by Michael C. Peponis 17 Dec '03

17 Dec '03

On Tue, 26 Mar 1996 , David K. Merriman wrote: >Regrettably, I must disagree with Mr. May on the matter of speaking >in whatever language one chooses. It seems that here in Texas >(specifically, here in Amarillo), a local judge informed a Hispanic >family that they were prohibited from speaking _only_ Spanish to >their child at home. The rationale was that since English is the >(ostensibly, in this area) Public Language of the school system here, >failure to encourage use of English would adversely impact the >child's education, and was thus a form of child abuse. If need be, I >can provide excerpts from the local snoozepapers coverage of the >issue. The judge is correct in this matter, most people view it from the rights of the parents, but what about the child who, because of his/her parents egotism and ignorance, grows up not being able to compete effectivly? My rights, even parental rights, end when their exersize directly impact someone else(the child) in a negative way. Regards, Michael Peponis PGP Key Available for MIT KeyServer

1 0

Call for Papers: Internet Privacy and Security
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Sorry if this has been on here before. -Allen From: Phil Agre <pagre(a)weber.ucsd.edu> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Tue, 19 Mar 96 12:09:20 PST From: RISKS List Owner <risko(a)csl.sri.com> Subject: RISKS DIGEST 17.91 RISKS-LIST: Risks-Forum Digest Tuesday 19 March 1996 Volume 17 : Issue 91 ---------------------------------------------------------------------- Date: Fri, 15 Mar 1996 12:17:23 -0500 From: "Joseph M. Reagle Jr." <reagle(a)mit.edu> Subject: Internet Privacy and Security, Call for Papers CALL FOR PAPERS INTERNET PRIVACY AND SECURITY WORKSHOP Haystack Observatory, MA May 20-21, 1996 Privacy and Security Working Group Federal Networking Council Research Program on Communications Policy Center for Technology, Policy, and Industrial Development Massachusetts Institute of Technology INVITATION The Privacy and Security Working Group (PSWG) of the Federal Networking Council (FNC) and the Research Program on Communications Policy of the Center for Technology, Policy, and Industrial Development at the Massachusetts Institute of Technology will hold an invitational workshop at the Haystack Observatory outside of Boston, MA, on May 20-21, 1996. This workshop is intended to bring Federal, academic and private sector participants together in collaboration to develop strategies and potential solutions related to Internet privacy and security. Though a principal focus of the workshop will be on the Federal portion of the Internet, the FNC recognizes that the Federal Internet is tightly coupled with the Global Internet, whose security policies, practices, and goals are complementary to those of the Federal Government. To define those practices, procedures and goals, the PSWG has undertaken two major initiatives: - The Federal Internet Security Plan (FISP), which was developed as a scalable, continual improvement process, based on common principles and mechanisms compatible with Internet community values and needs; and - The Collaborations in Internet Security (CIS) project, an effort aimed at testing the strength of agency approaches to security and moving these technologies beyond individual agency networking environments and into both inter-agency and agency-commercial sector communications. The CIS will result in the development of a new and sustainable process for developing, integrating, and deploying security technologies that are interoperable at all levels of the Federal government and within the commercial and academic sectors. These initiatives are intended to highlight the critical interface between Federal and commercial users and developers of Internet services and technologies. OBJECTIVES This workshop will bring together principal players in the Federal and overall Internet community to discuss the problems and challenges of privacy and security on the Internet, and will: - Identify critical issues, requirements, and recommendations related to future Internet privacy and security research and development efforts; - Describe "best practice" approaches to Internet privacy and security; - Develop specific strategies for implementing Internet Security programs involving all sectors of the Internet community; - Extend the Federal Internet Security Plan (FISP) by defining specific implementations; and finally, - Develop specific strategies for the migration of technologies from the individual RFC unit test stage to the integration of a complete functional managed system in the CIS test/demonstration/pilot projects. SUBMISSIONS Abstracts or complete paper drafts related to the topics listed above are welcome. Accepted papers will be a part of the published record of the workshop. All points of view on Federal policies affecting Internet privacy and security are welcome. Please make all electronic submissions in ASCII format. For further information or to submit an abstract or paper contact: Internet Security and Privacy Workshop c/o Joseph Reagle Research Program on Communications Policy Massachusetts Institute of Technology One Amherst St. (E40-218) Cambridge, MA 02139 Voice: (617) 253-4138. Fax: (617) 253-7326 papers(a)rpcp.mit.edu SCHEDULE and DEADLINES Call for papers - March 14, 1996 Abstracts Due - April 14, 1996 Invitations to Participants - April 20, 1996 Revised/Completed papers due - May 19, 1996 Workshop - May 20-21, 1996 PARTICIPANTS Participation in the workshop is by invitation, based primarily on submitted papers and abstracts. Additional individuals may be invited to ensure that participation reflects a broad cross-section of the Internet community. PROGRAM COMMITTEE Dennis Branstad - Trusted Information Systems (TIS) Rich Pethia - Computer Emergency Response Team (CERT) Jeffrey Schiller - Massachusetts Institute of Technology (MIT) Richard Solomon - Massachusetts Institute of Technology (MIT) Rick Stevens - Department of Energy /Argonne National Labs (DOE) STEERING COMMITTEE Stephen Squires, DARPA (FNC/PSWG Co-Chair) Dennis Steinauer, NIST (FNC/PSWG Co-Chair) Tice DeYoung, NASA Phillip Dykstra, Army Research Laboratory (ARL) Mike Green, NSA George Seweryniak, Department of Energy (DOE) Walter Wiebe, Federal Networking Council (FNC) BACKGROUND Federal Internet Security Plan: In September 1995, the PSWG published the draft Federal Internet Security Plan (FISP). The FISP is oriented toward a scalable, continual improvement process, based on common principles and mechanisms compatible with Internet community values and needs. See <http://www.fnc.gov/SWG.html>. The plan addresses Internet security requirements, including interoperability, from the perspective of the goals and objectives outlined in the National Performance Review (NPR), http://www.npr.gov/. The Federal Networking Council developed this framework in conjunction with its Advisory Committee which represents industry, academia, and non-profit sectors. Action Items, from the FISP, to be addressed during the Workshop: Internet Security Policy and Policy Support Activities * Establish overall Internet security policies * Address security in all Federally supported NII pilots * Coordinate Internet community involvement * Establish an ongoing Internet threat database and assessment capability * Identify legal and law enforcement issues Internet Security and Technology Development * Develop an Internet security maturity model * Develop Internet security architecture * Enhance Internet security services and protocols * Develop a "Secure-Out-of-the-Box" endorsement * Enhance application security Internet Security Infrastructure * Establish a set of Internet security interoperability testbeds * Support privacy, authentication, certificate, and security services pilots * Establish Internet security testing and evaluation capabilities * Improve security incident handling capabilities * Develop security self-assessment capabilities * Establish effective secure software and document distribution mechanisms Education and Awareness * Compile Internet user and site profiles * Encourage use of available security technologies * Establish an Internet security information server * Establish an Internet security symposium/workshop series * Establish an Internet security fellowship program Collaborations in Internet Security: With the Federal government's ever-increasing dependency on computers and distributed systems, there is great urgency for it to develop and employ enhanced information system security technologies and practices. At the same time, these Federal technologies must interoperate with those of the broader Internet community (encompassing the private and academic sectors, along with the Federal sector). In recognition of these needs, the Federal Networking Council's Privacy & Security Working Group (FNC/PSWG) has been awarded a National Performance Review (NPR) Innovation Fund grant to compare and validate agency approaches to security. This Collaborations in Internet Security (CIS) project aims to test the strength of these technologies beyond individual agency networking environments, emphasizing the inter-agency and agency-commercial sector communications. The CIS will result in the development of a new and sustainable process for developing, integrating, and deploying security technology that is interoperable at all levels of the Federal Government and within the commercial and academic sectors. The governing principles behind the Security Testbeds include: employment of an open process (with the activities and results open to participation and comment by both public and private sector participants); a focus on multivendor technologies; an emphasis on testing and experimentally deploying security technologies emerging from research and private sectors as well as security technologies currently in use in the commercial environment; and an underlying objective to ensure interoperability among the broad Internet community (federal, private, and academic). Initial tests will include demonstrations of Kerberos v.5, testing of single-use passwords, and digital signatures. For more information, please see (http://www.fnc.gov/cis_page.html)

1 0

Crypto CD UpDate
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

The idea of putting together a CD with crypto stuff is an excellent IDEA, and one which I very much welcome. However a question .. are you (Ben) located in the US? If so... that rules out overseas buyers unless you fancy messing with ITAR... Is it possible that you could come to some arrangement with some one outside the ITAR fence who has a CD writer (any one reading have one?) put together the same CD for those outside the US? Adam

1 0