December 2003 - cypherpunks-legacy

OS/2 encryption utilities
by jim bell 17 Dec '03

17 Dec '03

At 10:13 PM 4/20/96 -0400, Black Unicorn wrote: >On Sat, 20 Apr 1996, jim bell wrote: >Perhaps Mr. Bell would have been happier if I had said "bring forth a >motion calling for measures to deal with the defendant's supposed >conduct in bad faith in answering the discovery requests presented by the >plaintiff." Somehow, however, I doubt it. Much better! >> BTW, you seem to have forgotten that this would be an excellent way to deter >> the kind of "knock and smash" warrant service common amongst government >> thugs. Any argument by the cops that "we must break down the door or else >> they'll erase the data!" is rendered obviously silly if the data is ALREADY >> encrypted and inaccessible. > >This requires the assumption that all the data is already encrypted, not >an assumption a prosecutor or private litigant is about to make. They might not make such an "assumption," however it's an issue that must be addressed. I think that search done by COS lawyers last year (can't recall the target; I'm sure somebody recalls it) in which they not only copied data but also erased it from the hard disk...including other material not relevant to the case... is instructive. At least in hindsight, this was an improper search using improper techniques, which improperly allowed the defendant to damage the property searched. Surely you agree that was in error, whether or not you agree that the whole search was wrong, per se. There is certainly a good justification to make it as difficult as possible for those wanting to serve a search warrant in an _abusive_ fashion. Pre-encrypting the data would have ensured that the COS had access to none of the data while appeals occurred, and would have required that they continue to justify the search SUBSEQUENT TO its completion in order to have the judge compel some sort of key. If, arguably, the behavior at the search was wrong, that fact would have been citable as evidence of the abusive nature of their original request. As it is, COS was allowed to run roughshod over Constitutional rights, they abused a court, etc. Moreover, none of this was reversible, in REALITY. You can't turn back the clock and undo the search or the erasure of data, etc. And I think my original conclusion was correct: While most people don't encrypt most data NOW, in a few years just about everybody who has "sensitive" data will be using some sort of system to do this. At that point, the reality will be that search warrants will be issued _without_ any presumption that the evidence in any computer in the place will be identifiable, and thus the argument "we've gotta go in or the evidence will disappear!" will be obviously wrong. Jim Bell jimbell(a)pacifier.com

1 0

Re: 5th protect password?
by jim bell 17 Dec '03

17 Dec '03

At 02:22 AM 4/21/96 +0000, Jonathon Blake wrote: > Jim: > >On Sat, 20 Apr 1996, jim bell wrote: > >> > DOE v. United States, 487 U.S. 201; 108 S. Ct. 2341 (1988) > >> > A defendant can be compelled to produce material evidence that >> > is incriminating. Fingerprints, blood samples, voice >> > exemplars, handwriting specimens, or other items of physical >> > evidence may be extracted from a defendant against his will. >> >> As you might expect, I see a problem (and a pattern!) with even these > > The pattern is that you are again ignoring legal realities. No, I am not "ignoring legal realities." I am NOTING them, and noting that they form a suspicious pattern. I do not deny that these items are currently demanded regularly in certain cases; what I challenge is the appropriateness of that demand by historical and Constitutional standards. >> examples. Notice that with the possible exception of "handwriting >> specimens", the examples above all represent pieces of evidence whose > > Handwriting as a tool used by most people, dates back to > Eighteenth Century. Before that, it was a trade practiced > by scribes, and priests. In Europe, outside of the Clergy, > illiteracy was the standard, till the begining of the Industrial > Revolution. << Remember that John Dee had an incredibly large > library of 200 volumes. >> Yikes! You REALLY need to learn to read! I wasn't referring to handwriting itself , or for that matter to graphology ( the study of handwriting; which goes back perhaps 2000 years) but in fact the _forensic_ use of graphology. The point is that the demanding of handwriting samples is a fairly new concept, at least compared with the writing of the Constitution and the 5th amendment. I'm sure a REAL LAWYER (TM) reading this note will cite the first known example of a handwriting example being demanded by a court. What do you want to bet that it first occurred in this century? > >> or so, etc. I think even graphology (handwriting analysis) for legal >> purposes is likewise comparatively recent, although there is no obvious >> technological reason which this should have been so. The last category, > > Courts have yet to rule that an individual can be forced > to provide a sample of their handwriting, if the purpose > of obtaining such a script is for a graphological profile. Which simply means that they have to have more justification than a shotgun-approach inquiry. > More to the point, courts -- or at least US Courts -- don't > accept graphological profiles, as proof of anything. If that were the case, there there would be no justification for demanding a handwriting sample. Nevertheless, it is apparently done. And while a handwriting sample, ALONE, may not be "proof" of something, like most evidence it is used in conjunction with other evidence to support a conclusion. In any case, the initial reference to handwriting samples came from the Supreme Court, as quoted above, not me. Pay more attention. I was using the commentary of the SC to show that most if not all of the kinds of evidence demanded of defendants were NOT demande until well over a century after the 5th amendment was written. > > I suspect you confusing graphology with questioned document > examination. No, that's a larger issue. Graphology is a tool which can be used, but there are plenty of other technologies which are also useful on questioned documents. Paper analysis, ink analysis, electron microscopy, text analysis, to name just a few. That wasn't the point, however. > Courts have ruled that a person may be forced > to provide a sample of writing, for use in questioned document > examination, without violating the fifth amendment. << You ought > to read the case law, to see why providing such a sample is > not a fifth amendment violation ---- it might help you be a > better armchair lawyer, who spends to much time watching > Perry Mason reruns. >> Question: Let's suppose, for the purposes of argument, the policy was diametrically opposite, and no such samples were taken, ostensibly because that would be in violation of the 5th amendment. Please explain the arguments you would use to convince everybody that this opinion was in error. Remember, you couldn't cite precedent, because all the precedent would come to the opposite conclusion. You would have to explain to people why the precedents were all wrong. See the problem? Lawyers are full of "appeal to authority" arguments, which is what a precedent really is. But precedents can be wrong, are wrong, and are occasionally changed. I pointed out (correctly, I think) that since well over 100+ years after the writing of the 5th amendment, there has been a pattern of allowing prosecutors to demand evidence of a defendant whenever that evidence is considered useful to incriminate that defendant. I pointed out that all of the examples listed in the quotation above represented types of evidence that would not have been collected in 1783, or for that matter 1883, or even a few decades after this. As such, there is a reasonable doubt that the people who wrote the constitution actually intended to allow this sort of thing. After all, the fact that a given technique is, arguably, useful cannot be automatically used to justify its "reasonableness." After all, confessions can be useful to the cops, but that does not automatically grant the cops the right to beat confessions out of their prisoners, does it? Clearly not. And remember, there were a number of examples listed, so I think there is a suspicious pattern. Your response does not address this issue. >> Anyone who denies this should be required to make a list of the kinds of > > Questined Document Examination, which you alluded to, was > first accepted by courts in the United States, at the turn > of the century. And it was only after World War One, that > it was accepted in all courts in the US. I don't think that challeges anything I've already said. And you cut off the part where I challenged people to show the kinds of evidence regularly demanded of a defendant in 1783, which was about when the 5th amendment was written. > jonathon > grafolog(a)netcom.com > > Owner: Graphology-L@Bolis-com Aha! Yet another person who benefits from current government policy! Jim Bell jimbell(a)pacifier.com

5 5

Re: OS/2 encryption utilities
by attila 17 Dec '03

17 Dec '03

** Reply to note from mirele(a)xmission.com 04/20/96 2:26pm = Due to the fact that I have been threatened by the Church of Scientology = with legal action if I do not cease and desist posting encheferated = parodies of their secret scripture (per a letter I received from Cult = attorneys via Federal Express today) I am in search of OS/2 disk = encryption programs. = DISCLAIMER: I am not a practicing attorney; I am not offering you legal advice in any form. I personally would be first and foremost concerned with all the ramifications of destroying evidence; and, testing the rules of discovery. In no way am I condoning any action which may be contrary to the rules of justice in any jurisdiction. Keep in mind what "schwarzerPford mit gehornt" said: having asked for help in a public forum, the Co$ attorneys potentially will be going for discovery violations. That said.................. The only way you are going to get automatic disk encryption with OS/2 is to write a driver which would need to distinguish between drives and/or partitions as you would probably not wish to encrypt the operating system and routine files. Secondly, if you have _all_ your files encrypted, you are begging for a contempt citation if you refuse the keys. alternatively, you could reverse engineer one of the disk compress programs (__.sys drivers) and add a stream function for encryption --again begging contempt. A better way from my perspective to preserve some of my first amendment rights would be to use an IOMega optical floppy (flopitcal). IOmega has a new 100+M byte unit for around $200 which can double as a standard 3.5 floppy and runs on SCSI cards like the Adaptec and others (they may have an EIDE version). I believe there is now a version which is bootable. The blank disks are under $20/100MB (quite reasonable). Unless you are storing an enormouse amount of data, 100MB is a lot of space (maybe not on my OS/2 system which has 4G!). Again, if you wish to run the encryption automatically, then you are required to write a new driver. Keep in mind, with a driver, you are immediately faced with the problem of the encrytion keys --particularly if they are embedded in the controller. You could have one of the keys embedded in each floptical and a utility program to enter the second key, password, etc. when the driver started up... however, from my perspective, you would be better off to just convert your encrypted files to plain text to work with your files; then re-encrypting the material when you are done. needless to say, the floptical is not very obvious... and confiscating your system does not give away the keys, etc. However, you would be wise _not_ to involve another individual, etc. Not only is that a weak point, but it puts them in the loop and provides the government with an opportunity to include conspiracy --which carries the same penalty as the "crime" and additional charges of obstructing justice. pgp is available for OS/2, obtainable from Hobbes. BTW, do NOT keep your key ring, particularly the private key king, on the hard disks; keep it on a *separate* floppy. do NOT keep it on the floptical with the encrypted material. we are all concerned with privacy: the first, second, fourth, fifth,etc. amendment rights --what little there is left of them. However, regardless of any anarchistic-libertarian viewpoints, the best advice is not to raise your head --put your helmet on the rifle butt and raise that if you must --and, if you're riding in a helicopter, sit on your helmet. revenge may be a dish best served up cold, but anonymous remailers, particularly the encrypting ones, (do not use penet) are wonderful tools for the underground publishing of unpopular political and/or religious beliefs. There is a long line of court decisions which permit anonymous publishing --despite the fact Bubba certainly intends to take away our rights, particularly in cyberspace. lastly, learn from many who have preceded you: don't stonewall the court --that "fool" in the black robe can ring your bell however he wishes with contempt citations; there is little you can do about it and the local jails are not Club Fed. -- "You're always disappointed, nothing seems to keep you high -- drive your bargains, push your papers, win your medals, fuck your strangers; don't it leave you on the empty side ?" --Joni Mitchell, 1972 cc: Black Unicorn <unicorn(a)schloss.li> Cypherpunks <cypherpunks(a)toad.com>

1 0

Re: Bernstein ruling meets the virus law
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:50 PM 4/20/96, Computer Virus Help Desk wrote: >At 09:08 PM 4/19/96 -0700, Tim May wrote: >> >>It should be interesting to see what happens when the Bernstein ruling >>(assuming it is further upheld as the court case and appeals proceed) meets >>the proposed law making the writing of virus code a crime. >> >>If crypto software is essentially speech, albeit in a non-traditional >>human language, then virus software is no different. My point. (Also a point made by Mark Neely, I just noticed, when he wrote a couple of days ago: "Well, that puts legislation making virus authoring a crime into a new (and difficult) position.") >To the best of our knowledge simply writing Virus Code including it's >"distribution" is not a crime in the United States. However, the >deliberate, malicious upload or infection of another's computer or system is >a crime in many states. Again, my point. I was not saying such virus writing is currently against U.S. laws, at least not at the national level (the fifty states and various other local governments have their own laws, as the Georgia example about remailers is only the latest example of). >We don't see the "Bernstein" ruling as having an effect in the U.S. one way >or the other. Virus Code seems to be treated just like "speech" right now. >Use "it" to yell "fire" in a crowded theater and see what happens. >Deliberately and maliciously infect another's computer or system with a >computer virus and see what happens. > >What proposed law making writing virus code a crime were you referring to ? I was referring to the general discussion reported here and in places like "Risks" about illegalizing the generation of virus software. (A search of the archives, when they come back up, will reveal debates here on this.) (And I dimly recall at least one state legislature passing a law making "virus software" ipso facto illegal, regardless of being used in a trespass situation. The archives may produce more on this.) I don't think such a law is Constitutional, which is my point. Judge Patel seems to recognize this, as it relates to the Bernstein case. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: spinner entropy
by Jack Mott 17 Dec '03

17 Dec '03

Jeremey Barrett wrote: > > Wei Dai writes: > > Do we have other candidates for portable software RNGs? > > > > > > What is more important, good portable software RNGs or good portable > seeding mechanisms? Seems to me there are good RNGs out there, but > there is virtually no way to portably guarantee a good seed. > > Netscape's RNG was probably good as any, but their seed sucked, so they > got cracked. Take an RC4 state box. grab 30 or so random seeds from a hardware device, use them to mix the state box, and use the rest of RC4 to grab random values. Just an idea, very fast at least. -- thecrow(a)iconn.net "It can't rain all the time" RSA ENCRYPTION IN 3 LINES OF PERL --------------------------------------------------------- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

1 0

Re: Add-in encryption module to Netscape
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:42 PM 4/20/96 -0500, Alex Strasheim wrote: >The best answer for these sorts of problems (at least for those of you not >constrained by ITAR) might be java form processing applets that use their >own crypto routines to submit the data. I have thought about the sources of entropy available to a Java applet, and there aren't many. You should design your protocol so entropy is not needed on the applet side. Entropy is normally used to pick symmetric encryption keys, and Initialization vectors ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

2 1

OS/2 encryption
by mirele＠xmission.com 17 Dec '03

17 Dec '03

I have received a lot of comment about my request for OS/2 encryption...perhaps I didn't make myself clear. I have already taken precautions (have been, for over a year) to protect my private documents and email via use of PGP. I simply wanted to improve the security of my home system overall. I have been alarmed to see how, in the Wollersheim and Penney court cases, the Church of Scientology was able to sue people, take custody of their computers, and basically trash their hard drives. Frankly, I've worked too damned hard on getting my system just right to have some bozo blunder in and erase things, either through stupidity, cupidity, or maliciousness. *That's* why I inquired about disk security. Not because I'm trying to hide something from Scientology...but because I don't appreciate people messing around with something that I've worked very hard on. Deana M. Holmes mirele(a)xmission.com -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GAT d- s++ a C++ U P L E- W++ N++ o-- K++ w--- O++ PS++ PE-- Y+ PGP+ t 5 X-- R- tv-- b++ DI++ D++ G e++++ h+ r* x++ ------END GEEK CODE BLOCK------

3 3

Re: Smartcards are coming to the US
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 22:33 4/20/96, Black Unicorn wrote: >On Sat, 20 Apr 1996, Lucky Green wrote: > >> Years after smartcards have become ubiquitous in such countries as Pakistan >> and Nepal, not to mention Europe, I just saw my first smartcard commercial >> ever on US television. >> >> Way to go :-) > >Have you seen the Visa (mastercard) commercial that shows the finger >print reader and spouts off "Single digit PINs" (Digit, get it?) No, I saw the MC commercial with the Australian pilot. Are you serious? Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Re: HANDS UP!
by Chevelle 17 Dec '03

17 Dec '03

Hey guys if there's anything I can do to help Kevin out anything at all please let me know! chevelle out.... 07:14 AM 4/5/96 +0200, THE HIJACK-CREW wrote: >HI THERE! THIS IS etoy! > >"the digital hijack" is NOW running ! > >the internet-underground has decided: it is definitely time to blast SOUND >and ACTION into the net !!! > >our software-agents have invaded the main searchservers... > >++++for more information check out : http://www.hijack.org/++++++++++ > >or get kidnapped live --> go to infoseek (netsearch-button on your browser) >and search for: > >UNDERGROUND - CENSORSHIP - DISCO - XTC - CLINTON - PORSCHE - CRACK - >KRAFTWERK - ELVIS - TERROR - PENTHOUSE - SEGA - MONDRIAN - SEXPISTOLS - >FIREARMS - TARANTINO - DJ - STONES - NETWORKS - BASE - CRIME - WAR - >BUSINESS - WOMEN - NET - SOCIETY - ART - CASTRO - PARADISE - ATHLETICS - >PULP - CYBER - YELLO - PETSHOPBOYS - REM - HUSTLER - BITCH - GUEVARA - >SEVESO - MELODYMAKER - PORNO - GABBER - ROLLERBLADES - REBEL - OASIS - >COMMUNICATIONS - PLAYBOY - BELGIUM - ORB - AND MANY MORE... > >these keywords will all appear on the TOP 10 - LIST. take the link to >hijack.org to get the hijack-experience like millions of bored >internet-users... > >download the hijackers-sound, get the best pictures and help us free our >friend KEVIN D. MITNICK, THE SUPERHACKER (charged for electronic-terrorism, >maximum sentence: 460 years prison) ! > >we would be very happy to welcome you on our site. spread this new >internet-lifestyle to your friends and to internet-freaks + surfers ! > >this is a underground art-project not a bastard-business mail. our grab >robot "etoy.IVANA" got your email-address by cruising the net. > >for the hijack-crew etoy >MARTIN KUBLI > >email mailme(a)etoy.com >fax ++41 1 363 35 57 >_______________________________________________________________________ >http://www.hijack.org/ >for highres-pictures: ftp.etoy.com /press > > >etoy: >leaving reality behind...abusing technology...flashing the net > >

1 0

Re: PGP's +makerandom is broken (was: Re: Article on PGP flaws)
by timd＠consensus.com 17 Dec '03

17 Dec '03

At 10:52 PM 4/20/96, Jeffrey I. Schiller wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >On April 16, 1996 jf_avon(a)citenet.net said: >> I fed the result of >> pgp +makerandom=2000 rnd.pgp >> into noisesphere.exe >> >> Every times, it gives a distribution that looks like a zebra from the >> top view. Any comments? > >This is a bug in PGP. +makerandom doesn't work properly. I discovered >this a few week ago myself when I needed some random numbers for >another project. Due to a programming bug, the idea based random number >generator doesn't get initialized (read: doesn't get seeded at all) >when +makerandom is used. Note: +makerandom is an undocumented feature. > >IMPORTANT: Only +makerandom is effected. In normal use PGP properly >generates random session keys as well as RSA public key pairs. > > -Jeff As true as this may be, it doesn't explain the original posters problem; unseeded IDEA should generate data that looks every bit as random as data which was fully seeded (otherwise IDEA leaks information). This should raise a question regarding the utility of any post-facto measurement of entropy; the stream of bits generate by IDEA encrypting zero values in CBC mode with a key of zero clearly has little, if any, entropy, but the data generated should be indistinguishable from true random data by all statistical and pattern-recognition tests. See the discussion on coderpunks. Basically, to get crypto-quality random numbers: 1) Use a secure generator; any secure block cipher or hash function will do. 2) Seed it well. This is entirely specific to your situation & platform, and is unmeasurable for practical purposes. - Tim Tim Dierks timd(a)consensus.com Consensus Development http://www.consensus.com

1 0