December 2003 - cypherpunks-legacy

Lucifer & DES
by Jerry Whiting 17 Dec '03

17 Dec '03

Perry My apologies for any misunderstanding in my original post. I was merely trying to point out IBM's historical compliance with govt suggestions for the design of the S-boxes. Please excuse me if my facts are adrift. My point was that this may shed light on IBM/Lotus' acceptance of the 40+24 work force reduction scheme. IBM may be receptive to working with the government yet again. Jerry Whiting jwhiting(a)azalea.com

1 0

Re: What can the judge do to me?
by jim bell 17 Dec '03

17 Dec '03

At 10:21 AM 4/15/96 -0700, Hal wrote: >From: Black Unicorn <unicorn(a)schloss.li> > >> The key to limiting the ability of a court to summarily enter contempt >> sanctions has always been the classification of the sanctions. >> "Criminal" sanctions, may entitle the witness to a trial by jury. >> [...] >> "Civil" sanctions do >> not require such protections and can be imposed on the spot and >> without review. > >I didn't understand what distinguishes civil and criminal sanctions. Is >it the nature of the proceedings, whether it is a civil or criminal case >that is before the judge? Or is it the nature of the contempt charge >itself, where not doing what the judge wants, in broad terms, is civil >contempt? And in that case, what would be criminal contempt? He may answer those questions, but I don't think he'll dare answer the question about if there is a constituional justification for a difference between "civil" and "criminal" in most things the government's courts do. My impression is that the "civil" classification is often simply used to dilute or eliminate the various constitutional protections that the government hasn't yet dared to remove from areas it calls "criminal." Too bad we won't get a straight answer... We also won't get a straight answer about the constitutional justification for "contempt of court" penalties at all! The Constitution defines the powers of government; it does not restrict those of the people. The idea that a judge can punish someone, especially someone not present in court, is bizarre. It is even more odd when such punishment appears to exceed what the government is allowed to do absent any kind of jury decision and conviction. If you're willing to accept NON-Constitutional "justifications," I'm sure you'll get plenty of that. The only hint of a Constitutional obligation to testify comes from an amendment which states that defendants have a right to compel testimony favorable to them; it does not say that prosecution has the right to compel testimony from a third party that incriminates a defendant. If his response is, "Oh, but we've ALWAYS done it that way!", you need to remember that until the American Civil war, slavery was legal in southern states, and until 1920 women weren't allowed to vote, and until 1955 "separate but equal" was the law of the land, until 1972 or so the death penalty was constitutional...and then it wasn't...and then it was again...and so on. Government is never willing to admit it's wrong until it's good and ready. That doesn't mean we can't express our own opinions "prematurely." I'd sure like to hear the "why" behind this stuff, but I won't... Sigh.

2 1

Re: No matter where you go, there they are.
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"hfinney(a)shell.portal.com" "Hal" 11-APR-1996 18:06:18.51 >The method of using authenticated devices which provide timestamped >data from satellites not visible to the authenticating site does not >need to provide that data in real time. Even if it is delayed so it >comes in later than the data from the remote site, the verifying site >can still use it to calculate what the remote site should have been >seeing, and so get the benefit of using timings from all the satellites >visible to the remote site (again, assuming the remote site itself has >a low latency connection to the authenticating site). In regards to these timestamping devices... how do they know the correct time? It looks like that would be distortable, and with that, you could simply simulate the satellites to them via placing the device inside a metal box and piping in the appropriately modified signals. If it's getting its time information from the signals themselves, things get even easier. -Allen

1 0

Re: RC4 on FPGAs (Was: Bank transactions on Internet)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: =?ISO-8859-1?Q?J=FCri_Kaljundi?= <jk(a)digit.ee> >Once someone gets this kind of cracking device ready, I think it would be >nice to make the information freely available, or start selling these for >nominal price. >This would also make an interesting device connected to Internet. In case >of fast device people could use it either for free or pay using ecash for >using it, and crack their SSL sessions. May be Netscape or Microsoft or >someone else (may be even Community Connexion :) lobbying the government >for allowing export of strong encryption could sponsor it. It should not >be so expencive. Much more useful than amazing fish-cam or coke machine on >Internet. It would make it kind of difficult to argue that 40-bit encryption was anything near the required level, yes. Of course, I'd advise setting it up _outside_ the US or any other country with a habit of disliking cryptography - otherwise they'd just find some excuse or another to shut it down. For instance, you'd probably have to set it up if it were in the US to check where a request was from, in order to not violate some arcane ITAR rule or another. -Allen

1 0

Re: Anonymous Remailer threat: Scientologists may subpoena
by jim bell 17 Dec '03

17 Dec '03

At 02:30 PM 4/13/96 -0400, s1113645(a)tesla.cc.uottawa.ca wrote: > > >On Wed, 10 Apr 1996, sameer wrote: > >> >> Frankly, I'm getting antsy. Is C2 going to get subpoena'd or >> not? I would be very disappointed if we don't. >> (Subpeonas envy!) > >All you have to do is call up CoS's lawyers. Let your fingers do the >walking... > >Seriously though, might it not be nicer (easier?) to establish some court >precedents on remailers vs. CoS rather than the government? Think of it as >a preemptive strike. Sounds like forum shopping/defendant shopping/plaintiff shopping. An excellent idea. The best part is that COS is one of the most unsympathetic organizations that could possibly be chosen, with the possible exception of the American Nazi Party or the KKK. The argument of CoS's religious copyright and trade >secrets don't seem to me be as emotionally effective horsemen as "National >Security Threats" or "Child Pornography". I really wouldn't want to see >Congress get away with legislating on remailers in a legal vacuum. I sure hesitate to "hope" that the COS thing gets turned into an SC decision, because that means that SOME defendant has to get pulled through the ringer until he eventually wins. Great for us; terrible for him. >Go for it Sameer. ;-) (Hope you won't be needing Jim's ISP-Aspol inc. >insurance against them pesky scientologists...[double ;-) ]) It's at this point that somebody usually observes that the COS could use AP to get rid of its critics. However, they're forgetting that with AP, its critics can remain absolutely anonymous and still punish COS. It would be no contest.

1 0

Re: Scientologists may subpoena anonymous remailer records
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: noring(a)netcom.com (Jon Noring) >On Wednesday afternoon, February 8th, three private >investigators visited the Caltech Security Office and the Campus >Computing Organization. The P.I.s wanted to know the identity of >the holder of the account "tc" on the Caltech Alumni Association >computer system (alumni.caltech.edu) They claimed to have >gotten the account name from the anon.penet.fi server via the >Helsinki police. Due to the unusual nature of this request, the >P.I.s were told that Caltech would need more information before >this type of information could be given out. Later that day, an >attorney representing the Church of Scientology called the >campus computing support office demanding the name of the >account holder. The attorney claimed that a document had been >stolen from a CoS computer system, and that the document had >been posted to the a.r.s newsgroup from alumni.caltech.edu via >the anon remailer. (The claim was the document was created on >Jan. 21 and appeared in a.r.s. on Jan. 24). The computing support >staff did not divulge the name of the account holder, and the CoS >attorney was referred to the Caltech General Counsel's office. Given that they didn't have a subpoena at this point, wouldn't the simplest way to solve this problem be to wipe the records? Somehow, I suspect that the judge is unlikely to put Caltech in contempt of court on suspicion that they're lying about the records being wiped. Now, contempt of court out of irritation... -Allen

1 0

Re: PICS
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"frantz(a)netcom.com" 12-APR-1996 22:58:59.49 >I had a chance for a brief look at the PICS protocol, and it seems to have >a lot of cypherpunks relevance. It includes features such as: > Multiple third party rating systems No problem. Although it looks like the CDA-replacement bill would essentially require using one with at least as great anti-minor censorship abilities. > Digital signatures This is a problem, unless one simply deletes the signature on modifying a message, and takes the deny-everything-to-minors approach. -Allen

1 0

Re: Tense visions of future imperfect
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:33 PM 04/13/96 EDT, "E. ALLEN SMITH" <EALLENSMITH(a)ocelot.Rutgers.EDU> wrote: >From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 11-APR-1996 00:21:15.87 > >>Personally, I find the idea that the government could hope to track the >>economy so closely as to notice a $10M/year addition to the money supply to >>be disturbing (though it was done in a science fiction story about >>20 years ago :-) With digital cash, it's also unrealistic - we >>finally have a technology for moving money around _without_ >>them being able to track it all, if we want to deploy it. > > One related question is if the government would notice an underground >fully anonymous digital cash setup - transactions disappearing from their >"radar screen." I wouldn't expect Gov't to notice any individual transaction, of course, but doubtless they would eventually notice that the expected amounts of money weren't where anticipated. At that point, I suspect things would get "interesting" (moreso than now :-) regarding currency tracing. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMW/Ii8VrTvyYOzAZAQEkdgQAqKqqbAAn3GIaW3/pdHKMWj8zN2FPuIa+ UEwJsz0Kjs4Whlt+UzjygJtKX1sXPnNjjf47l8tDQWqknrhxO1SDBlmsk1lHeM24 FPYFSwWH+y/zhlxjfj0mn2LlLngvN5UuWU7UG2Q7lKk0DjHvxqAYdbQDNfs1bXRm pxlXPaz1T2k= =rnwR -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Re: Enforcing the CDA improperly may pervert Internet architecture
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:15 PM 4/13/96 EDT, E. ALLEN SMITH wrote: > Quite. It's interesting in that regard that, as well as differentiating >between homosexual and heterosexual content, the W3C PICS scheme includes a >filtration scheme for attacks on religions. One wonders if they considered that >Scientology is currently (probably unjustifiedly) considered a religion? The more the irrational and indefensible the faith, the more that the proponents of that faith view any sort of debunking attempt as "an attack". (It is not just Scientologists that suffer from this mentality. I have seen those of the more fanatical Christian varieties make the same claim.) What these schemes will do is shield children from anything resembling a "controversial" discussion. (I expect Cypherpunks to be labeled as "could cause criminal behaviour" or some such malarky by the more protective and clueless. (It may be true, but why warn them upfront? ]:> )) You will see the forces of "good" try and protect the little kidlets from anything that might get them to think for themselves. It is already happening in some sectors of public thought, I expect the net to become its next victim. Soon everything will be "Sanitized for your Protection". --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

Re: Lotus Notes 24-bit sellout
by jim bell 17 Dec '03

17 Dec '03

At 09:21 AM 4/12/96 -0700, Jerry Whiting wrote: > >When Ray Ozzie announced the work reduction sellout at the RSA conference, >both he and Ms Denning (whom I spoke with about it later) mentioned that >there was something else in Lotus Notes 4 besides the 40+24 bit compromise. > >My thought is that the NSA gave them something else in exchange for the >mandatory escrow scheme they're all talking about publicly. Perhaps some >other crypto code the NSA had lying around unused. > >So looking for a common 24-bit subkey may reduce Notes' key to a 40-bit >brute force exercise but the 40+24 is probably not ALL that's in Notes 4. > >Definitely a deal with the Devil. Given that we're talking about IBM, not >Lotus none of this surprises me given IBM's Lucifer/DES history with spook >input years ago. Then again to be fair, I don't know if the 40+24 deal >was cooked up before or after the IBM/Lotus merger. What about the following idea, which I think might have been indirectly discussed a few months ago. Let's suppose "you" agreed with the NSA to limit their effort to 40 bits, and put 24 bits at the beginning of the file. The code to do this could be separated and highlighted and identified publicly, and a software patch could be engineered by somebody to NOP this stretch of code to death. The result is that those 24-bits simply don't appear; you've already gotten the export license. The NSA doesn't have any real reason to complain: _ANY_ program can be modified by suitably changing object code bit patterns. An even smaller change would be to put the number of bits to expose ("24") in a byte value ("00011000"), one that will be zeroed by a patch later on. I guess I'm not really suggesting this; I think that even appearing to come to some arrangement with the NSA is wrong. However, it would be an excellent way to give the finger to the NSA, because there is no way that they can ensure that a given program is "finagle-proof."

1 0