December 2003 - cypherpunks-legacy

Digest Version???????
by kreidl＠newrock.com 17 Dec '03

17 Dec '03

Anyone know if I can get a digest version of this??? (__) (oo) /--------\/ / | || <-- Moo.(We live in Wisconsin, the dairy state, get it?) / || || * ||-----|| ~~ ~~ Chris (or Richard) Kreidl kreidl(a)newrock.com

1 0

Re: Disclosure of Public Knowledge to Foreigners
by Hal 17 Dec '03

17 Dec '03

From: tcmay(a)got.net (Timothy C. May) > "There is a reasonable chance the Supreme Court would see the overall > absurdity of a situation where the knowledge is freely available to 200 > million adult Americans, with no restrictions whatsover on publication, > discussion, etc., and yet uttering this knowledge in front of a foreigner > is a crime." It would be good if this happened. Yet unfortunately I think it is unlikely. Absurdity is not necessarily sufficient to invalidate a law. Especially in this case, if you read the judge's decision (at <URL: http://www.qualcomm.com/people/pkarn/export/decision.html >) you see that this issue is one which is "hands off" for the judiciary. The question of designating whether items should be on the Munitions List has been found both by the courts and by the legislature to be "non-justiceable", something which the courts can't review. It is strictly in the purview of the legislative branch, which passes the law, and the executive branch, which sets the policy and creates the list. Courts are required to refrain from second-guessing them. Of course this doesn't totally close the door, and if serious constitutional questions arise, the court can consider this. Phil Karn attempted to do so, but did not succeed in this case. Unfortunately there is clear precedent at the appellate court level that First Amendment concerns are not violated by export bans. As long as you can say whatever you want domestically, the government has a lot of latitude to prevent you saying things to foreigners, even though that is illogical in many contexts. I feel, by the way, that this may soon present another line of attack on the restrictions. As the Internet becomes a dominant communications medium, it will become more true than ever that these regulations have a chilling effect on all communications relating to cryptography. I can't, right now, post crypto source code to this list without breaking the law. Nor can I post it to sci.crypt. How then can I participate in discussing these matters in detail on the Internet? Maybe I could put the material on an export-restricted disk somewhere, but that does not allow for the dynamic give-and-take which is so much a part of internet discussion. So, in the context of the net, export controls are de facto content controls on domestic discussion. For now, maybe being unable to speak in detail about crypto on the net isn't that big a handicap. But in a few years, Internet communication will be a big part of everyone's lives (arguably) and being unable to present certain information will produce a stronger First Amendment violation. A couple more comments on Tim's message: > Interestingly, according to a friend of mine (Mike Ward, of San Jose), it > is much cheaper (or was when he did the analysis a couple of years ago) to > have a chunk of text entered two or more times by humans and then XORed for > errors than to OCR the text. This form of error correction--redundant > entry--would presumably work well for Schneier's code, for example. I can certainly believe it after reading about Phil's efforts. And as I point out, he actually did have a secretary type it in. It is disturbing, though, that the book had errors in it. I wonder if it was typeset by hand? Is that possible in this day and age? > What we are really about to run into is the "export of knowledge" issue, > which I think the Constitution will have some pretty important things to > say about. (It has long been the case that certain armaments knowledge, and > atomic secrets as per the Atomic Energy Act, were restricted. But this > knowledge was _also_ not in the public domain. There have not been many > cases that I know of where knowledge was freely discussable within, say, > the United States, by any citizens (and maybe others, such as permanent > residents, foreign students at colleges, etc.) and yet this knowledge could > not be "exported" outside the U.S. > > Except with our crypto laws, and some related Munitions Act laws. Unfortunately, as I noted above, so far no one has been able to come up with a convincing Constitutional argument, especially in the face of the Posey and Edler precedents, which are discussed by the judge in Phil's case, and for which I have some excerpts at <URL: http://www.portal.com/~hfinney/cryp_export2.html >. I think the real solution frankly is to get the laws changed. If the laws are absurd, people should be taught about them, and they should pressure their legislators to change them. This is not an attractive solution because it implies a lot of work and a long, slow process. But in the long run it will be better to establish a national consensus about how to deal with these issues. Then it will be harder for government to place new restrictions in place. I think the recent legislative action reflects the beginnings of this process. It may not succeed this year, but hopefully in a few years, as more people get on the net, it will gain momentum. Ironically, the termination of the case again Phil Zimmermann may hurt progress in this area. Unfair and unjustified as the pending charges against Phil were, they did at least raise people's consciousness about the problems in current policies. Phil did an excellent job of keeping these issues in front of people in all sorts of media. Now that there is no longer an articulate victim of unfair export laws it may be harder to keep people thinking about the problem. Perhaps we need a new volunteer... Hal

1 0

Re: Navajo code-talkers
by Paul_Koning/US/3Com%3COM＠smtp1.isd.3com.com 17 Dec '03

17 Dec '03

>From: grafolog @ netcom.com (Jonathon Blake) @ UGATE > << It's one of the status languages to study, if you are > a new ager --- along with Ancient Mayan, linear B and > Egyptian Hieroglyphics. >> Well, hieroglyphics and linear b are writing systems, not languages. And Linear B is Greek (though it takes effort to read it even if you know your Homer...) paul !----------------------------------------------------------------------- ! Paul Koning, NI1D, C-24183 ! 3Com Corporation, 1-3A, 118 Turnpike Road, Southborough MA 01772 USA ! phone: +1 508 229 1695, fax: +1 508 490 5873 ! email: paul_koning(a)isd.3com.com or paul_koning(a)3mail.3com.com ! Pgp: 27 81 A9 73 A6 0B B3 BE 18 A3 BF DD 1A 59 51 75 !----------------------------------------------------------------------- ! "Be wary of strong drink. It can make you shoot at tax collectors ! -- and miss!" ! -- Robert A. Heinlein, "The Notebooks of Lazarus Long" ! in "Time Enough for Love"

1 0

Re: Canada's ISO standards body?
by mccoy＠communities.com 17 Dec '03

17 Dec '03

At 11:50 AM 4/3/96, Peter Trei is rumored to have typed: > Simon Spero <ses(a)tipper.oit.unc.edu wrote: > > I don't think v3 has been balloted yet - that gives you a chance to > > explore one of the more amusing twists of OSI standardisation- you can > > get copies for free of most drafts from the editor right up until it gets > > standardised. Silly, isn't it. > > Haven't located it yet. ftp://hesiod.communities.com/pub/mccoy/ansi-x9.ps I also have a PDF version of the draft as ansi-x9.pdf, and the certificate DAM in the file certdam.ps. jim

1 0

Re: software with "hooks" for crypto
by John Deters 17 Dec '03

17 Dec '03

At 02:31 PM 4/2/96 -0800, you wrote: >Hello all, > >I'm trying to figure out exactly what the laws are regarding the export of >software which contains "hooks" for PGP. In various forms, I've heard >that it's not the ITAR which prevents this, but more a "suggestion" by >the NSA that we "shouldn't do it." Does anyone have any pointers to >real legislation/laws regarding this? There are a number of "PGP Helpers" (If this is Tuesday, it must be PGP) out there. These are other PGP front end applications such as Private Idaho, PGPShell and others that do NOT include PGP, nor do they contain any encryption code within them. These applications are all billed as "freely exportable". If your software does not contain any encryption code, such that it simply "invokes" the users separately-obtained-and-installed copy of PGP, you are not in violation of ITAR. It sounds like this is what you're doing with your "hooks for PGP". I would recommend you visit a couple of these helper application sites and check out what their authors say about the exportability of their code. You might ask them if they have encountered any legal difficulties because their code is advertised as freely exportable. Private Idaho is available at www.eskimo.com/~joelm and (rats) you'll have to hunt PGPShell down yourself. If you actually include the RSA algorithms, the IDEA algorithm, or any "cryptographic" code in your software, then yes, you could get in trouble for exporting it. Again, remember that I'm not a lawyer and that any legal advice you get from anyone on the net is worth exactly what you pay for it. -j, is anyone else finding it harder to say the "Pledge of Allegiance" to this country these days? -- J. Deters >From our _1996_Conflict_of_Interest_Statement_, re: our No Gift policy: "If you receive any alcoholic beverages, for example, a bottle of wine, you must give the gift to your location Human Resources Manager." This memo is from the Senior V.P. of Human Resources. +---------------------------------------------------------+ | NET: jad(a)dsddhc.com (work) jad(a)pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'33"N by 93^16'42"W Elev. ~=290m (work) | | PGP Key ID: 768 / 15FFA875 | +---------------------------------------------------------+

2 1

Re: Anonymous Remailer threat: Scientologists may subpoena anonymous remailerrecords?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:37 PM 4/10/96, Jim Byrd wrote: >The story is weirder than that. The first poster of church secrets (with >lots of commentary) was Dennis Erlich, an ex-scientologist. Dennis was >raided and sued, and is awaiting trial. His ISP, Tom Klemesrud, refused His ISP was Netcom. Klemesrud respresents Netcom. >to find the identity of -AB-. This turned out to be an alumni account at >Cal Tech. The poster has never been heard from again. This was without a doubt just a user of one of Hal Finney's remailers he runs out of an account at Caltech. (There's a tiny chance it was someone else, but it fits the description of Hal's "alumni" remailer exactly, and is almost certainly just that.) This is a Cypherpunk-style remailer, and Hal is one of the original Cypherpunks. The concept of "The poster has never been heard from again" is essentially meaningless, unless he or she or signed the message and established a persistent personna. Sorry to sound picky, but I've just seen several messages all of which copy a long dialog from some Finnish guy named Kaj. Some of the messages then confuse the issues by confusing the types of remailers. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3

Re: NSA Budget
by Perry E. Metzger 17 Dec '03

17 Dec '03

"JR Weaver" writes: > http://www.fas.org/pub/gen/fas/irp/commission/budget.htm > > This page reveals the FY96 NSA budget at $3.6 billion. It doesn't give any details, though. The general size of the NSA budget was known for a long time based on inference -- see "The Puzze Palace". In any case, they are not now making a habit of releasing budget numbers, but you can find out how much they in general spend. Certainly the original poster's request for detailed quarterly reports isn't going to be met... Perry

1 0

Bank information protected by 40-bit encryption....
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

If you are the worring sort (or are looking for a ripe target) point your browser at: https://www.diginsite.com/clients.html There is a list of 23 Credit Unions - some (or all) of which allow transactions to be done over the net. A brief once over shows that it requires Netscape 2.0 or better so you will have encryption, but it does not warn you when you are using only a 40-bit session key vs. a 128-bit key. (Netscape wizards - is there a way that the server can detect this so that a warning message could be put up?) They also have some other information about their security at: http://www.diginsite.com/security/security.html I think it is GREAT that this kind of functionality is coming. I also think that the pioneers like this had better be prepared to be targets as I am sure they will be. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

7 11

[NOISE] Federal Bureau of Indigestion
by Dave Del Torto 17 Dec '03

17 Dec '03

[forwards mercifully elided] The following is a direct quote from the Center for Strategic and International Studies report on GLOBAL ORGANIZED CRIME; the author who introduces the story swears it's true. FBI agents conducted a raid of a psychiatric hospital in San Diego that was under investigation for medical insurance fraud. After hours of reviewing thousands of medical records, the dozens of agents had worked up quite an appetite. The agent in charge of the investigation called a nearby pizza parlor with delivery service to order a quick dinner for his colleagues. The following telephone conversation took place and was recorded by the FBI because they were taping all conversations at the hospital. Agent: Hello. I would like to order 19 large pizzas and 67 cans of soda. Pizza Guy: And where would you like them delivered? Agent: We're over at the psychiatric hospital. PM: The psychiatric hospital? Agent: That's right. I'm an FBI agent. PM: You're an FBI agent? Agent: That's correct. Just about everybody here is. PM: And you're at the psychiatric hospital? Agent: That's correct. And make sure you don't go through the front doors. We have them locked. You will have to go around to the back to the service entrance to deliver the pizzas. PM: And you say you're all FBI agents? Agent: That's right. How soon can you have them here? PM: And everyone at the psychiatric hospital is an FBI agent? Agent: That's right. We've been here all day and we're starving. PM: How are you going to pay for all of this? Agent: I have my checkbook right here. PM: And you're _all_ FBI agents? Agent: That's right. Everyone here is an FBI agent. Can you remember to bring the pizzas and sodas to the service entrance in the rear? We have the front doors locked. Pizza Guy: I don't _think_ so... >click<

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 06:29 PM 4/10/96 -0700, Simon Spero wrote: >No, bytes are no always 8 bits - some machines use(d) 9-bit bytes. I notice you gave no examples. Why is that? Jim Bell jimbell(a)pacifier.com

4 3