December 2003 - cypherpunks-legacy

Re: RC4 improvement idea
by nyap＠mailhub.garban.com 17 Dec '03

17 Dec '03

> For one key in 256, you can tell what eight bits of the state box are. > For one key in 64000 you can tell what sixteen bits of the state box are, > and so on and so forth. > > Such keys are not weak. Any statistical correlation can be used to an attacker's advantage. Maybe your kid sister might not be able to figure it out, but someone else out there will.

1 0

Re: Disclosure of Public Knowledge to Foreigners
by cme＠acm.org 17 Dec '03

17 Dec '03

At 05:33 4/3/96, Timothy C. May wrote: >There is a reasonable chance the Supreme Court would see the overall >absurdity of a situation where the knowledge is freely available to 200 >million adult Americans, with no restrictions whatsover on publication, >discussion, etc., and yet uttering this knowledge in front of a foreigner >is a crime. > >I don't think this would pass Constitutional muster, as the lawyers like >to say. > >(The British at least have an Official Secrets Act. Much as I dislike that >Act, at least they are more consistent in the sense of classifying things >as being secret. How can the U.S. argue that knowledge available in any >large library or bookstore to anyone who wants it, citizen or not, may not >be "disclosed" to foreigners? If it's common knowledge, it's common >knowledge!) This assumes that the purpose of the ITAR restrictions is to keep a secret. To the extent that the gov't argues that, they have no case as you point out. However, the ITAR is there specifically to frustrate US businesses if they should want to sell or give away crypto overseas. The rules, despite their illogic, achieve that goal. I would like to believe that the Supremes would rule that the Gov't has no right to use what amounts to a secrecy provision just for harrassment -- but they might not. I had Mike Nelson say to my face, 1.5 years ago, that he knows good crypto is available to foreigners -- he just wants to make damn sure it doesn't come in shrink-wrapped packages from US companies. I can't judge the constitutionality of that position but it holds together logically. ["don't let American products hurt American interests" the battle cry runs] - Carl +--------------------------------------------------------------------------+ | Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | "Officer, officer, arrest that man! He's whistling a dirty song." | +---------------------------------------------- Jean Ellison (aka Mother) -+

2 1

questions about bits and bytes
by Jack Mott 17 Dec '03

17 Dec '03

This may be a bit of a no brainer, but everything I have read sorta skips over this point. a bit is 1 or 0 8 bits make up a byte (0-255) If I have a 5 byte key, does that make it a 40 bit key? The only reason this doesn't make sense to me is it seems useless to use 5 byte keys, yet that is what companies export since the government limits keys to 40 bits. -- thecrow(a)iconn.net "It can't rain all the time" RSA ENCRYPTION IN 3 LINES OF PERL --------------------------------------------------------- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

1 0

NSA Budget
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

>Is there a public release of the NSA's annual Budget. >If so is there a quarterly release. -Erinn ----- Yes, there are annual and quarterly reports released to the public which describe in meticulous detail expenditures for the agency's program, personnel and equipment: 1. The program of services and information supplied to government and other intelligence organizations, US and foreign, with terms of each client contract. 2. US employees, their organization, skills, duties and longevity of service; their names, ranks, identification codes, secure communication methods and home addresses; the location of workplaces; the continued training each is scheduled to receive; leaves of absence and destinations while absent. 3. Foreign nationals covertly employed worldwide, with information on each as per 2. 4. A comprehensive listing of all types of world-wide equipment operated; its detailed design, function and output; where it is located; its designers, manufacturers and purchase cost; its schedule of amortization; and its schedule for replacement and/or upgrade, with fifteen-year projected procurement. 5. Special short- and long-term contracts with governmental and non-governmental organizations, US and foreign for one-time projects, by goal, personnel and equipment. 6. Special projects with other US and foreign counter- intelligence to issue disinformation about the agency. 7. Special section on world-wide US and foreign cryptology: cryptanalysis, cryptography, steganography, codes, cyphers, glyphs, mimes; each ranked for security and ease of cracking; governmental and non-governmental parties using each; names of cooperative and resistant cryptographers and cooperating pseudo-cryptographers. 8. Sub-section on methods of Internet traffic and language analysis; operation and surveillance of anonymous remailers, bulletin boards and mail lists; lists of cooperative and resistant educational institutions and commercial organizations. 9. Appendices on: black operations; transparent operations; methods for managing cooperative and resistant governmental and non-governmental persons. The public is invited to study and/or download these reports anonymously at: http://nsa.dod.gov/~reports/quarterly.txt

2 1

Re: Bulletin: Cypherpunks say no taxes owed by moneychangers!
by Frank O. Trotter, III 17 Dec '03

17 Dec '03

Lets state it simply, if you make a gain by holding a currency then it must be included in your reported income. At least one writer correctly stated that the IRS likely does not care about small amounts taken on a trip, but they are technically reportable. Same goes for a loss, it is a deduction (with string attached of course) from taxable income. Aside from ecash, helping people to exchange currency is my day job so I see this all the time, especially this month each year. Best FOT Disclaimer: Personal not corporate thoughts.... Frank O. Trotter, III - fotiii(a)crl.com www.marktwain.com - Fax: +1 314 569-4906 --------------------------------------------

2 1

Re: the cost of untracability?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 03:36 PM 4/8/96 -0400, Black Unicorn wrote: >In addition, to prevent funds from being removed to non-resident aliens >or foreign entities where tax enforcement and collection is difficult, >there is a 30% withholding requirement in the event the payee is not a >U.S. citizen or resident (for tax purposes). The withholding tax applies only if the payee is not a resident of a jurisdiction with a tax treaty with the US. Net banking will further muddy the waters on this because of the difficulty of telling the residency of customers particularly in the case of accounts transferred to third parties for profit -- a worthwhile future business activity. DCF

2 1

Re: "Contempt" charges likely to increase
by ddfr＠best.com 17 Dec '03

17 Dec '03

>It is exactly this attitude that we need to change. I presume you saw my >comment from a day ago, when I pointed out that before 1968, local phonecos >were doing wiretaps without any sort of court order, ... >I'm still waiting for somebody to show that the majority of crimes that are >investigated using subpoena power are "malum in se" crimes, as opposed to >"malum prohibitum" ones. > >Jim Bell Have you read _The Hacker Crackdown_? I think it is pretty clear that part of what was going on there involved law enforcement people deliberately punishing BBS operators for behavior that was wicked but not illegal--basically facilitating communications involved in committing crimes (credit card number theft and the like). The punishment consisted of seizing the computer and backups and holding it for a year or so as "evidence"--without ever filing charges. Conceivably the owner could have taken legal action--but doing so would give the law enforcement people an incentive to file charges, thus imposing large costs on the owner even if he was innocent of any crime and could eventually prove it. I suspect that a good deal of this goes on in most law enforcement systems, in one form or another. Charging and convicting people is costly, even if they are guilty--and there is often behavior that law enforcement people want to prevent that is not even illegal. On the other hand, there are lots of things police can do that impose sizable costs but do not require a conviction, such as arresting you, holding you in a cell overnight, but never actually trying you for anything. David Friedman David Friedman School of Law Santa Clara University

1 0

NSA Budget
by zalchgar＠juno.com 17 Dec '03

17 Dec '03

Is there a public release of the NSA's annual Budget. If so is there a quarterly release. -Erinn

4 3

Re: Australia's New South Wales tries net-censorship
by jim bell 17 Dec '03

17 Dec '03

At 01:40 PM 4/8/96 -0400, Declan B. McCullagh wrote: >Excerpts from internet.cypherpunks: 8-Apr-96 Re: Australia's New South >W.. by Mike Duvos(a)netcom.com >> I'd be interested to know if the courts have ever had a case in >> which a person has been declared to have been in "possession" of >> illegal material merely by virtue of its momentary presence in >> their cache, screen buffer, or usenet spool. >> >> There is a case now involving the University of Pittsburgh in >> which the Feds are attempting to prove that an individual was in >> possession of certain child porn images on his own PC during a >> brief span of time in 1993. > >For it to be a crime, I would presume that the courts would require >"guilty knowledge" of the act. (At least I hope they would!) But what is "guilty knowledge"? Let's suppose I'm web-browsing, and I come across something I shouldn't. If I'm aware of caching, I _know_ that the stuff is in my memory or HD or somewhere, and I _know_ it's illegal. Does that constitute "guilty knowledge"? What if a person is unaware of this caching? Does he lack the same guilty knowledge? See, this is the problem with the "guilty knowledge" idea: It really isn't knowledge which should be illegal, intent is vital. Part of the reason "our" system is so screwed up is that police can misrepresent our actions in this way. I have an easy solution for this: _NO_ information should be illegal. None. Jim Bell jimbell(a)pacifier.com

1 0

Re: "Contempt" charges likely to increase
by jim bell 17 Dec '03

17 Dec '03

At 03:23 PM 4/8/96 -0800, david friedman wrote: >Have you read _The Hacker Crackdown_? I think it is pretty clear that part >of what was going on there involved law enforcement people deliberately >punishing BBS operators for behavior that was wicked but not >illegal--basically facilitating communications involved in committing >crimes (credit card number theft and the like). The punishment consisted of >seizing the computer and backups and holding it for a year or so as >"evidence"--without ever filing charges. > >Conceivably the owner could have taken legal action--but doing so would >give the law enforcement people an incentive to file charges, thus imposing >large costs on the owner even if he was innocent of any crime and could >eventually prove it. > >I suspect that a good deal of this goes on in most law enforcement systems, >in one form or another. Charging and convicting people is costly, even if >they are guilty--and there is often behavior that law enforcement people >want to prevent that is not even illegal. On the other hand, there are lots >of things police can do that impose sizable costs but do not require a >conviction, such as arresting you, holding you in a cell overnight, but >never actually trying you for anything. >David Friedman >School of Law >Santa Clara University This is yet another one of the many reasons I advocate a system, AP, that some people around here call "extremely radical." (By today's standards it _is_ "extremely radical," but only in the sense that many sheeple seem ready to continue to tolerate the status quo.) I assert that if there is a mechanism in existence over the medium to long term to allow officialdom to punish people without conviction for things that are not even crimes, then I see nothing wrong with setting up a different system to punish these _officials_, without conviction, for things that THEY would claim are not crimes. If those officials wish to avoid this punishment, they should resign or even better, use their powers to immediately eliminate that unfair and unjustified punishment for ordinary citizens. But I guess this solution is a bit too obvious for some, huh? B^) Maybe we should call it "Contempt of Citizenry." Jim Bell jimbell(a)pacifier.com

1 0