December 2003 - cypherpunks-legacy

Re: The return of the IPG Unbreakable System (fwd)
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 07:24 PM 03/19/96 -0600, you wrote: ... <sniveling excuses deleted> ... >Accordingly, this will be the last letter posted to the entire >cypherpunks list for the time being. If any reader posts something to the >entire Cypherpunks list, do not expect any response to from IPG, there >will be none. Thank you, thank you, thank you! (see? there *is* a God!) Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMU7xkcVrTvyYOzAZAQGCSAQAj3wI2g4R6W8/iEhRaYn1y3SwfhS5g2UT 0BpdsUqNbJXA3Qbj4OlrT2SSWp7Glm4uymlJVM1AjXo36Jjo3XTZilMeTaVed5DW idH8gfV/Wp6DJIPv3RqwtYysBur1pXgqmsEIEovIHhY7uP5yhW7JJL2NrZ/Dht4T 3DvZ/On3cdk= =+acg -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Re: Dorothy Denning attacks Leahy's crypto bill
by jim bell 17 Dec '03

17 Dec '03

At 09:45 PM 3/19/96 -0800, Declan McCullagh wrote: >I may have to adjust my position on Leahy's bill. Any legislation that >Dorothy Denning attacks so virulently must be worth passing. That position would be a serious mistake. Denning knows that she is a negative barometer: Her position will be looked on with contempt by most of us. That, ironically, makes her "useful" to the government should they want to sneak one past us. I think we've already established that this bill sucks, although it could become good with major repairs. Problem is, nothing that Denning wants to do to the bill constitutes an improvement, except not passing it in the first place! ----------------------------------------------------------------- > >Date: Tue, 19 Mar 96 14:53:35 EST >From: denning(a)cs.cosc.georgetown.edu (Dorothy Denning) >To: farber(a)central.cis.upenn.edu > March 14, 1996 > >The Honorable Patrick Leahy >United States Senate >Russell Building, Room 433 >1st and C Streets, NE >Washington, DC 20510 > >Dear Senator Leahy: > >As author, scholar, lecturer, researcher, and consultant to the >government and industry in cryptography and information security, I am >concerned that S.1587, the "Encrypted Communications Privacy Act of >1996," is not in balance with society's needs. By removing practically >all export controls on encryption, the bill will make it far easier for >criminals, terrorists, and foreign adversaries to obtain and use >encryption that is impenetrable by our government. "Far easier"? That's an odd statement, because the export of encryption is easy with or without restrictive laws. How much trouble is a "criminal or terrorist" going to risk by violating a few measly export laws? Besides, Denning hasn't established that encryption will be any better inside the country than without; this means that export controls will have no effect even in the most optimistic scenario. >The likely effect >will be to erode the ability of our law enforcement and intelligence >agencies to carry out their missions. Since when is this news? Freedom costs. But it also pays. > This is not consistent with your >own findings in the bill which recognize the need for a "national >encryption policy that advances the development of the national and >global information infrastructure, and preserves Americans' right to >privacy and the Nation's public safety and national security." > >I am concerned that the proposed legislation responds only to a loud >cry for assistance and is not the reasoned and practiced position of >our multinational corporations. Of what significance is the "practised position of our multinational corporations"? They'd sell us out if it preserved THEIR rights. I'm more concerned with the rights of the individual. > At the International Cryptography >Institute, which I chaired in September 1994 and 1995, our discussions >did not find that this unrestricted distribution of encryption >technology was required to satisfy business objectives. Notice that we've already established that this bill in no way produces an "unrestriction distribution of encryption technology." Wish it did, but it doesn't. [much Denning-crap deleted] >The Commerce/NSA study did acknowledge that the existence of foreign >products claiming strong encryption could have a negative effect on >U.S. competitiveness. However, by allowing encryption services to be >sold separately from the applications software that uses them, CAPIs >will make it extremely unlikely that general-purpose software will be >substantially effected by export controls. That's odd. Most people around here seem to be of the opposite opinion: CAPI's seem to be used by the government to justify controls even on software that has no encryption capability. Even security-specific >products, which are a growing industry, can use CAPIs to separate out >the encryption component from the main product (e.g., firewall). >Moreover, if keys can be held in other countries under appropriate >bilateral agreements as noted earlier, export controls need not >substantially impact encryption products. Notice that she seems to be making policy for the government, yet again. > >Export controls are often blamed for the lack of security in our public >infrastructure. The Commerce/NSA study found "little evidence that >U.S. export controls have had a negative effect on the availability of >products in the U.S. marketplace," although they "may have hindered >incorporation of strong encryption algorithms in some domestic >mass-market, general-purpose products." There are many factors which >have played an even larger role in the general lack of security we find >on the Internet: the high cost and low demand for security, the >difficulty of designing systems that are secure, pressure to bring new >products to market before their security implications are understood, >the willingness of users to take risks in favor of acquiring new tools >and services, and lack of a public key infrastructure to support >encryption on a national and international basis. Many systems are so >riddled with security holes that any would-be attacker can gain access >to the system itself, and from there access to plaintext data and >keys. Malicious code can be injected into a victim's system through >electronic mail, documents, images, and web browsers; once there, it >can transmit sensitive data back to its owner. Keyboard sniffers can >capture a user's keystrokes before they are ever encrypted. Thus, >while export controls have played a part in the slow integration of >strong encryption into software and systems, they are not responsible >for most of the security vulnerabilities we see today. Moreover, most >of these vulnerabilities are remedied with non-cryptographic controls >(e.g., process confinement, trusted systems engineering, biometrics, >and location-based authentication) or with cryptographic techniques for >authentication, data integrity, and non-repudiation, which are exempt >from State Department export controls. I do not mean to suggest that >encryption is not important. In fact, it is essential to protect >against certain threats. However, it must be kept in perspective. The >use of encryption for confidentiality protection is but one small, >albeit important, piece of an information security program. > >The provisions is S.1587 regarding trusted key holders could have the >benefit of increasing public trust in key holders. However, I have >some concern that the current provisions may be overly restrictive. >Thus far, we have practically no experience with the operation of third >party key holders and the circumstances under which they will be called >upon to provide keys or decryption assistance. It will be extremely >important that the provisions allow enough flexibility to accommodate >legitimate use of the data recovery services of key holders for >criminal investigations, civil litigation, and intelligence >operations. The liability risks to key holders should not be onerous. >The definition of key holder and exact wording in the bill may also >need some refinement in order to accommodate existing and proposed >methods of trusted third party encryption. > >Encryption policy is a difficult and often emotional issue. It's only emotional because of malicious and counter-productive efforts by government, and government suck-ups like Denning. It is >important that Congress work closely with the Administration, industry, >and other interested parties to develop the best legislative strategy >for promoting information security on the national and global >information infrastructure without diminishing the ability of our law >enforcement and intelligence agencies to protect the public safety and >national security. Export liberalization should proceed cautiously, >tied to key escrow or other methods that accommodate the needs of the >government as well as those of users and industry. The >Administration's plans to liberalize export controls on software key >escrow is a good next step. As trust and confidence in key escrow >grows, the export of virtually unlimited strength encryption systems >may be possible. Because export controls are our only lever for >controlling the spread of encryption, they should be used to their full >advantage. Decisions to liberalize these controls must be fully >informed by classified national security information as well as by >economic analysis and market studies. > >Law enforcement agencies are encountering encryption with ever greater >frequency. Excellent! It means they're being held back! > Within a few years, the successful execution of practically >all court-ordered intercepts and searches and seizures is likely to >depend on their ability to decrypt communications and stored >information. If the encryption cannot be broken, it could be >impossible to successfully investigate or prosecute those cases. Bullshit! [more Denning-shit deleted] >I will be pleased to meet with you and the committee for comment and >questioning, or to assist in any way I can with the development of a >balanced approach to encryption legislation. > >Yours respectfully, > >Dr. Dorothy E. Denning >Professor of Computer Sciences >Georgetown University >denning(a)cs.georgetown.edu >http://www.cosc.georgetown.edu/~denning I refuse to be used by Denning. If we make the mistake of supporting this bill merely because she claims to oppose it, we would merely be falling into her (and the government's) trap.

1 0

RE: Microsoft's "answer" to Java
by Blake Coverett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Commenting on a quote from a magazine about MS's new code-download/wintrust stuff Alan Olsen wrote: >As a web developer, I have some problems with this scheme. Giving Microsoft >access to virtually every OLE control on the Web does not make me more >secure. Sounds like a way to rip off ideas from the rest of the development >world. If someone has a control that might compete with a Microsoft >product, it could be shelved and/or delayed for "further security testing". I think you've been badly misled on this one. I've just been through all of the related specs from the MS INetSDK. While they are still incomplete in places, they look pretty workable to me. In particular the certainly don't suggest that MS would be involved in signing anything. To quote from the beta docs: The present tools therefore allow any user of this development release to authorize themselves as a "Software Publisher" for test purposes and to sign their code, allowing for extensive testing of the tools and code used but not actually providing a secure infrastructure. In future releases, the tools will require software publishers to obtain certificates from companies whose function is to verify the identity of the publishers, providing end-users with a high level of assurance about the authenticity and origin of code that they receive. >Java has a decentralized mechanism for security. No one group controls what >is a "certified" control and what is not. You write the code and compile it >and that is that. Furthermore, you are not stuck with Microsoft approved >platforms. (I wonder if there will ever be a version of Explorer for the Mac.) The current version (2.0) is already available on the Mac and the 3.0 alpha versions appear to be about equally buggy on both the Win32 and Mac platforms. (I haven't, on the other hand, heard any news of Unix versions. Perhaps Bristol and/or Mainsoft will cover that port.) ================ Here's my quick overview of the specifications in question for those interested. Microsoft is providing the following components: - - A generic trust management called (ever originally) WinTrust. WinTrust provides an API to ask whether a given subject is trusted to perform a specific action. The API is extensible in that multiple 'Trust Providers' can be installed and each can define the types of subjects and actions they manage. The docs define the role of a 'Trust Administrator' who can configure the rules used by the trust provider services be neglect the give the details. - - An implementation of a trust provider called the 'Windows Software Publishing Trust Provider' This provider supports subjects which are executable images and the action of 'being published software'. The decision to trust is based on a PKCS #7 embedded within the executable containing a signed digest from the author and a chain of X.507 certs back to some configurable set of CAs. If the executable is not verified the user is prompted with the offer to approve it manually. - - A set of developer tools for creating your certificate and signing executables. Note that the beta includes a hard-coded root CA key and all certs must trace back to it. The existing library for munging executable images has also been enhanced to support adding, removing, enumerating and retrieving certs from an image as well as reading the stream that should be included in digest calculations. - - A single function solution for browsers and other applications to download, verify, install, and create a class factory for an OLE object given an URL. In the web case the HTML <OBJECT> tag is used to embed an OLE object in a page. The browser tries to create it based on the CLSID attribute (which contains a DCE-ish uuid.) If it fails it calls CoGetClassObjectFromURL() passing in the URL from the CODE attribute of the same tag. This function does all the magic including the WinTrust call from above. (Apparently there will also be support for an 'Internet Search Path' if the CODE attribute isn't specified.) Then of course there is the MS CryptoAPI but that's a discussion for another day. - -Blake (who hasn't worked for Microsoft for years now) -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBMU/Dirmr67p11D8rAQGHnQP/YI+EjCIcpBF3HQznruVBUkGsZls1ZVTf SRvPJN7n+HrtvQ4WFSyAawsPnhRH183GTrtWAy+yhmmuzA6/Br/+rNJ/q0jSIlZw w+RUsni9H9a7NsO1Y9xPQq//SHODYC0K+1vB6tU8XE56lZf9F0IZ4iP4El4PUWxD 7kXMboN1Nf0= =5eH2 -----END PGP SIGNATURE-----

1 0

re: monsters et al
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

On Mon, 18 Mar 1996 jamesd(a)echeque.com wrote: > > Those who defend totalitarianism, regardless of the brand name of > > totalitarianism, simply lie. It is as uncomplicated as that. At 02:21 PM 3/18/96 -0800, Charles Bell wrote: > Not very good point. > > Monsters come in many hues and `totalitarianism' is rarely total. > Simplicity is in the mind of the beholder. George Bernard Shaw, leader of the Fabian socialists, visited the Soviet Union during Stalin's artificial famine and said "Where do you see any food shortage", gesturing around. He was sitting in a restaurant reserved exclusively for foreigners at the time, and there was indeed excellent and abundant food in the restaurant. Monsters, plain enough. Very simple. The complications only exist in the clouded minds of those who employ doublethink. Shaw also visited the Gulag, as did many famous English leftists: Here is his report on it: "Whereas in Britain a man enters prison a human being, and leaves prison a criminal type, in Russia he entered prison a criminal type and would come out an ordinary man but for the difficulty of inducing him to come out at all. As far as I could make out they could all stay as long as they liked. " >From which I reasonably conclude that if people like him gained power, they would murder everybody like me. I have heard many very similar tales from folk on Usenet concerning Cuba and the like. In addition to eradicating everyone like me, they would also eradicate their dupes, their useful fools, such as H.G. Wells, who wrote of Stalin: "[...] never met a man more candid, fair and honest, [...] no one is afraid of him and everybody trusts him. " Since they did not give H.G. Wells a tour of the Gulag, I guess they suspected that he might not have approved. Such a suspicion would doubtless have proved fatal had his pals amongst the Fabian socialists gained power. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Free Flight
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

>The latest Wired and last week's news reports covered the FAA decision to >sloooowly move from the current Positive Control ATC system to one called >Free Flight in which aircraft pick there own routes and separation is >maintained by GPS, computers, and telecommunications. It's about time! JFA Public Key at http://w3.citenet.net/users/jf_avon Jean-Francois Avon <jf_avon(a)citenet.net> 2048 bits key ID:C58ADD0D 1996/03/01 fingerprint=52 96 45 E8 20 5A 8A 5E F8 7C C8 6F AE FE F8 91

1 0

Re: DESCRIBE
by David K. Merriman 17 Dec '03

17 Dec '03

At 09:23 PM 03/18/95 -0800, you wrote: >undescribe cypherpunks(a)toad.com cyber(a)ronet.com.br > Well, we're not organized, for starters..... Dave Merriman------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Win95 Remailer update
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've generated a full installation package for RemailerBot, so that it now includes all required .DLLs, .OCXs, et al. Also includes the source code. It replaces the remailer.zip available through my web page. Simply unzip it to the directory of your choice, and run the setup132.exe file. Alternatively, you can use the MS expand utility to uncompress selective files. "We apologize for the inconvenience" Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMU0tz8VrTvyYOzAZAQGS7QQArcKCBJKrzv9X/qZTaGGoPb1/46LKCKfe hehMiGlc50llJ/J5EqH86CPsGhX2W3DgUE+G/IPG+hD7HLCMrc06dDcO5XkO1Y+9 FNhCkmeA/XhoiDF61cjZ8IWO5oZx0iKsHFBhd4WhkirVRyGREXnveQA0txZmH1JA shzfa1XwqHo= =3gkt -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

PGP and Human Rights
by Philip Zimmermann 17 Dec '03

17 Dec '03

Recently, I received the following letters by email from Central Europe. The letters provides food for thought in our public debates over the role of cryptography in the relationship between a government and its people. With the sender's permission, I am releasing the letters to the public, with the sender's name deleted, and some minor typos corrected. This material may be reposted, unmodified, to any other Usenet newsgroups that may be interested. -Philip Zimmermann Date: Sat, 09 Mar 1996 19:33:00 +0000 (GMT) >From: [name and email address deleted] Subject: Thanks from Central Europe To: Philip Zimmermann <prz(a)ACM.ORG> Dear Phil, This is a short note to say a very big thank you for all your work with PGP. We are part of a network of not-for-profit agencies, working among other things for human rights in the Balkans. Our various offices have been raided by various police forces looking for evidence of spying or subversive activities. Our mail has been regularly tampered with and our office in Romania has a constant wiretap. Last year in Zagreb, the security police raided our office and confiscated our computers in the hope of retrieving information about the identity of people who had complained about their activites. In every instance PGP has allowed us to communicate and protect our files from any attempt to gain access to our material as we PKZIP all our files and then use PGP's conventional encryption facility to protect all sensitive files. Without PGP we would not be able to function and protect our client group. Thanks to PGP I can sleep at night knowing that no amount of prying will compromise our clients. I have even had 13 days in prison for not revealing our PGP pass phrases, but it was a very small price to pay for protecting our clients. I have always meant to write and thank you, and now I am finally doing it. PGP has a value beyond all words and my personal gratitude to you is immense. Your work protects the innocent and the weak, and as such promotes peace and justice, quite frankly you deserve the biggest medal that can be found. Please be encouraged that PGP is a considerable benefit people in need, and your work is appreciated. Could you please tell us where in Europe we can find someone who can tell us more about using PGP and upgrades etc. If you can't tell us these details because of the export restriction thing, can you point us at someone who could tell us something without compromising you. Many thanks. --- [ I sent him a response and asked him if I could disclose his inspiring letter to the press, and also possibly use it in our ongoing legislative debates regarding cryptography if the opportunity arises to make arguments in front of a Congressional committee. I also asked him to supply some real examples of how PGP is used to protect human rights. He wrote back that I can use his letters if I delete his organization's name "to protect the innocent". Then he sent me the following letter. --PRZ ] Date: Mon, 18 Mar 1996 15:32:00 +0000 (GMT) >From: [name and email address deleted] Subject: More News from [Central Europe] To: Philip Zimmermann <prz(a)ACM.ORG> Dear Phil, I have been thinking of specific events that might be of use to your Congressional presentation. I am concerned that our brushes with Governments might be double-edged in that Congress might not like the idea of Human Rights groups avoiding Police investigation, even if such investigations violated Human Rights. However we have one case where you could highlight the value of PGP to "Good" citizens, we were working with a young woman who was being pursued by Islamic extremists. She was an ethnic Muslim from Albania who had converted to Christianity and as a result had been attacked, raped and threatened persistently with further attack. We were helping to protect her from further attack by hiding her in Hungary, and eventually we helped her travel to Holland, while in Holland she sought asylum, which was granted after the Dutch Government acknowledged that she was directly threatened with rape, harrassment and even death should her whereabouts be known to her persecutors. Two weeks before she was granted asylum, two armed men raided our office in Hungary looking for her, they tried to bring up files on our computers but were prevented from accessing her files by PGP. They took copies of the files that they believed related to her, so any simple password or ordinary encryption would eventually have been overcome. They were prepared to take the whole computer if necessary so the only real line of defence was PGP. Thanks to PGP her whereabouts and her life were protected. This incident and the young woman's circumstances are well documented. We have also had other incidents where PGP protected files and so protected innocent people. If the US confirms the dubious precedent of denying privacy in a cavalier fashion by trying to deny people PGP , it will be used as a standard by which others will then engineer the outlawing of any privacy. Partial privacy is no privacy. Our privacy should not be by the grace and favour of any Government. Mediums that ensured privacy in the past have been compromised by advances in technology, so it is only fair that they should be replaced by other secure methods of protecting our thoughts and ideas, as well as information. I wish you well with your hearing. Yours most sincerely [name deleted] --- [end of quoted material] ------------------------------------------------------------------

1 0

Re: Keep the pressure! Cryptographers Against Cryptography EXPOSED!
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Some people have wondered why I am anonymous and attack me. I am not ashamed of my views. I write this thread anonymous as a form of protest. The 10 PEOPLE on the LIST OF SHAME have their shields. The whole government will come to their aid in helping them spread their lie and is behind them. I have an acount and post regularly under my real name. I am not ashamed of my views. I am proud of them. I write this anonyously as a form of protest because they have there shield and we have our remailers. I WANT TO KEEP IT THAT WAY! THEY MUST NOT BE ALOWED TO TAKE OUR SHIELD AWAY. BOYCOTT THE SELLOUTS AND DO WHAT YOU HAVE TO DO

2 1

First encrypted online backup service?
by John Gilmore 17 Dec '03

17 Dec '03

Actually it looks like they're set up for modem access, but I presume that if there's any serious demand they'd do it over the Internet. Of course, Would You Trust Your Backups To This Man? If the random key generated for it was later found to be not random enough, or if any of a dozen other bugs or breakthroughs make the encryption penetrable, would you want to have transmitted every bit of data in your computer, to a site you don't know very well, and to all interested eavesdroppers? Using proprietary and unverified software? Or even using free software? Maybe some reliable cypherpunk should run such a service. Examine what comes through and gets written on tape. Superencipher it yourself before writing it on tape, and keep your own keys securely; maybe with a secret sharing scheme, and a tree of keys that requires going offline to other backup tapes to recover the key for a particular backup tape. And as you look at your customers' data, remember Robert Morris's #1 piece of advice to cryptanalysts: "Look for plaintext". It shows up in the darnedest places where it shouldn't. A c'punk backup service would warn you if you tried to push plaintext into it. Though it'd store it for you regardless: the customer might care a lot more about being able to retain a copy of their data than they care about whether anyone else could see it. I hope they find a market and some workable solutions to these issues. It'd be nice to have automatic backups of my data kept securely in a few spots around the globe for some reasonable price. John Gilmore Forwarded-by: Stanton McCandlish <mech(a)eff.org> From: Alan Brown <abrown(a)usaor.net> Newsgroups: comp.org.eff.news Subject: Protect your computer data with remote tape backup. Date: 13 Mar 1996 01:37:12 GMT Organization: National Computer Company Message-ID: <4i58s8$r65(a)news.usaor.net> X-Mailer: Mozilla 1.1 (Windows; U; 16bit) Content-Transfer-Encoding: quoted-printable FACT In the Next 3 Months Another 30 Million Computers Will Crash and Lose Data ***************** This Year Alone Over $1 Billion Worth Of Computers Will Be Stolen ********** Each Month 10 Million In-House Accidents, Operator Error, Viruses & Equipment Failure Will Cause Loss Of Data ***************** With National Computer & Data Back-up Company=92s technology we can safel= y,=20 confidentially and automatically encrypt your data, download to our=20 server and store in our offsite water and fireproof vaults. Our proprietary software is loaded on your computer and at a time that=20 you select, normally after business hours, your computer will=20 automatically call our server, compress and encrypt your files and=20 download the days work. We then download your files to tape and store in=20 our vaults in case of future need. Your files are encrypted and only you=20 have the password so noone but you can see your data. It is quick, safe,=20 reliable and you don=92t have the time consuming chore of doing backups.=20 For those outside the 412 area code we have an 800# for you to use to do=20 your backups so you won=92t have a toll charge. Let us help you For As Little As $2.00 Per Day FOR MORE INFO EMAIL US AT abrown(a)usaor.net OR CALL US TODAY 412-934-0912

1 0