December 2003 - cypherpunks-legacy

The FBI/NSA's new escrow argument, DC crypto panel
by Declan B. McCullagh 17 Dec '03

17 Dec '03

I just came back from the Online Services Industry conference held today in Washington, DC at the Georgetown Four Seasons. It was very much a DC thing, organized by Congressmen Jack Fields and Rick White (of the Internet Caucus). The fourth panel was "Law Enforcement and Encryption in Cyberspace," with this set of characters: * Edward Allen, supervisory special agent/section chief, FBI * Clinton Brooks, advisor to the director, NSA * Dorothy Denning, professor, Georgetown University * Bruce Heiman, attorney, Preston Gates Ellis & Rouvelas Meeds * Jim Lucier, director of economic research, Americans for Tax Reform * Marc Rotenberg, director, EPIC I was expecting fireworks, or at least a few sparks, but the panel fizzled. Both sides recounted the same threadbare policy positions we've heard for years, with one exception: the Administration's new argument against lifting crypto export controls. Allen and Brooks claimed that "there needs to be a balanced approach," arguing that other nations are relying on the U.S. to maintain export restrictions to prevent it from falling into the grasping fingers of overseas terrorists. (And yes, they mentioned child pornographers too.) The FBI's Allen said: "We have talked to our foreign law enforcement counterparts who are concerned with exporting strong crypto. Crime is increasing internationally... There is not an international free market for crypto. To a great degree, other nations have been relying on U.S. export controls to maintain stasis. What bothers me about efforts being proposed legally is that we're moving forward without understanding what we're getting into... The efforts can go to order or chaos. We're in a period where it could go to chaos." Denning recounted the tale of a New York state police bust that seized a computer with PGP, but no files were encrypted: "They hadn't used it. It was too much trouble." She said that if PGP is more "integrated," more criminals will use it. "We need to balance interests and provide for legitimate law enforcement access. Many businesses are supportive of this," said Denning. After Rotenberg and the other half of the panel rebutted, Brock Meeks asked the first question: Isn't it possible that the government may eventually ban non-third-party escrowed crypto, in a compromise move? The FBI's Allen ducked, clumsily. Meeks pressed and Brooks from the NSA allowed: "Over time, if there are advocates and society says we have to go further then we may have to." -Declan

1 0

Re: WWW proxies?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 6-MAY-1996 01:41:12.77 >-- that a model is lacking (I don't mean we don't have some ideas of what's >important, but that we haven't filled in the details, figured out what >sorts of correlations an analyst can make by looking at packet sizes, >sending times, delivery times, etc.) Hmm... I wonder if genetic algorithms would be a good way to analyze traffic. Admittedly, this may be a matter of my having a (potential) hammer and seeing things to bash with it. >-- the real world situation with remailers is that message volume is >probably way too low for comfort (my presentation on remailers at the first >CP meeting outlined a need for about 10 mixes, each mixing at least 10 >messages of the same size before remailing...and 20 mixes each mixing 30 or >more messages is much better...we are most likely far, far below this, for >nearly all remailed messages. Fortunately, most remailed messages are >either not critical or are being done for novelty, harassment, flaming, >etc.). It should be possible, given a model, to add onto existing remailers a routine that automatically forwards random messages through a random string of remailers and back to itself (or into a /dev/null address; I can see advantages and disadvantages in the resulting loss of information) at a random frequency whose bounds are dependant upon current traffic levels at that remailer. This might be supplemented by information based on statistics gotten from other remailers. I would suggest Raph Levien (sp?)'s remailer list as a basis for the random string of remailers. >(PipeNet-type schemes may help, depending on a bunch of details. So would >"local mixes in cabinets," meaning, Web anonymizers with high bandwidth >that do their mixing locally. They have to be "trusted," to some extent, >but would help a lot. There are some gotchas.) There is unfortunately a balance between what an operator will be able to take - in regards to bandwidth - and what is needed for a web anonymizer or remailer to work. For remailers, this requirement is greatly decreased by the lack of immediacy needed. -Allen

1 0

Re: misunderstandings of PICS
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"vznuri(a)netcom.com" "Vladimir Z. Nuri" 6-MAY-1996 15:47:46.22 >but you still don't understand what I stated. the above does not make >any sense relative to the PICS system. it would be like saying, "we >are going to report anyone who doesn't have a SMTP that bans dirty >email". SMTP does not ban dirty email by definition. PICS does not >censor material by definition. please read the PICS proposal (sorry the >URL is not handy, could someone post it?) See below; I had read this _before_ posting on the CyberAngels and PICS. >PICS *doesn't*involve*the*page*designer*. this is an absolutely >key component of its design. it exists indepedent of page creators. >if page creators are suddenly being pressured to format their >pages in some way, then PICS has failed in some of its key design >goals. there are some *optional* ways that page designers can invoke >PICS principles as I understand, but they make no sense to me. (it >would be equivalent to someone rating their own material, something >I think is going to be far from the main use of ratings in the future) From: IN%"frantz(a)netcom.com" 16-APR-1996 20:19:13.88 >From http://www.w3.org/pub/WWW/PICS/iacwc.htm >... PICS specifies three ways to distribute labels. The first is to embed >labels in HTML documents. This method will be helpful for those who wish to >label content they have created. > >The second method is for a client to ask an http server to send labels along >with the documents it requests. The server would most likely offer the >publishers' labels, but a server could also redistribute labels from third >parties that it cooperates with. [Client sends URL of label service to browser >which responds with that service's label. bf] > >The third way to distribute labels is through a label bureau that dispenses >only labels. A bureau could distribute labels created by one or more labeling >services. A client asks the bureau for certain services' labels of specific >resources. This is most likely to be used for third-party labels. In other words, the CyberAngels want to eliminate any pages that contain material they think minors shouldn't see that aren't self-rated with a PICS self-rating (the first of the three types) intended to block minors from seeing it. Yes, this is an abuse of the market oriented variety of PICS; they obviously don't know and/or don't care. If you want to convince them otherwise, start cc:ing your messages (and forwarding mine, on this I give you permission) on PICS and the CyberAngels to angels(a)wavenet.com. Incidentally, their pressure (especially the legal variety - acting as informants) could also include against an ISP that doesn't do the second for material the CyberAngels don't like. -Allen

2 1

Escrowing signing vs. encryption keys
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks ## Date: 05/06/96 06:55 pm ## Subject: Escrowing signing vs. encryption keys. ] >Date: Thu, 25 Apr 1996 21:06:37 -0700 >From: Hal <hfinney(a)shell.portal.com> >Subject: Re: US law - World Law - Secret Banking >Baker's problem was that the keys would be used for signing as well >as for encryption. He said that in the U.S. they had been careful >to separate these functions in their plans. That's why we have DSS >for signatures and Clipper (Capstone, Skipjack, etc.) for >encryption. Only the Clipper keys get escrowed. The DSS keys are >kept private. >Privacy, on the other hand, at least from the point of view of >someone like Baker, is not as important. His people eavesdropped >all the time, and it wasn't that bad. So from his perspective it is >reasonable that a possibly insecure escrow system is acceptable for >encryption, but not for signatures. And that is apparently a >principle behind the US crypto policies as they have unfolded over >the last few years. There is another angle to this. If extralegal key escrow accesses are occurring, it will probably take a long time to come out, if it ever does. There's a good chance that anyone successfully eavesdropping on people by use of the key escrow mechanism will simply keep quiet about it, and while the victim may *suspect* what's happened, they won't be able to prove it. However, forged signatures *will* be noticed directly, and there will be high-profile court cases about them. Even if untrue, serious allegations of forged signatures based on escrowed signing keys will make it into the papers, and cause all kinds of chaos. Presumably, this is seen by the Feds to balance out the downside that, if I have the ability to do secure signatures with certificates, I can always use Diffie-Hellman to establish a secure session with someone else. >Hal --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMY6Vh0Hx57Ag8goBAQHI2gP/bUhtWnIjWX8xKJ44IcmdG9OqbO7PaB1B 9iu7GYFzQXLgsMdc9Opzm64W7F+NrBlE1PjOCj965bK7MC9+Lz176Bo5nBHGMktP pALZcRvm6bmNMls49abvucVr8Xm2SbDOnsp5z4NHVUuNGdXi+J5tDVR2vYqIQjh5 GmZk9fVkQUM= =r6zZ -----END PGP SIGNATURE-----

1 0

Re: PICS & CyberAngels
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"vznuri(a)netcom.com" "Vladimir Z. Nuri" 4-MAY-1996 11:59:26.15 >this seems to suggest a misunderstanding of PICS either by you or >the "CyberAngels". PICS does not require any particular action by page owners >and is entirely based on that principle (there is a pretty good >argument it would be unconstitutional, impractical, idiotic, etc. if >it didn't). it defines a standard by >which ratings servers and queries are constructed and formatted. >anyone can rate any information. if the CyberAngels want to rate >all kinds of pages in cyberspace and set up their own rating service, >more power to them. the ratings do not restrict those who do not >choose the restrictions. The instructions in question, at http://www.safesurf.com/cyberangels/#look, are for their "volunteers" to report - including to both the page's ISP and to government - any page with sexual content that doesn't have a PICS such that it can be censored. In other words, they want to try to kick off systems - including potentially via legal action such as nonsense like "corrupting a minor" or whatever - any pages that don't set themselves up to be censored. That would include by government such as China, as well as by fundamentalist parents. Given their approval of Detweiler, you're making it more and more likely that you're him.... -Allen

3 2

Re: CryptoAnarchy: What's wrong with this picture?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"jimbell(a)pacifier.com" "jim bell" 6-MAY-1996 19:08:19.78 >At 01:44 PM 5/6/96 EDT, E. ALLEN SMITH wrote: > >>On Sun, 28 Apr 1996, jim bell wrote: >> >>[...] >> >>>While strong cryptography is powerful, and secure communications >>>liberating, unplugging the phones would about cripple that 'weapon' for a >>>while. Any group rebelling based only on high technology communication is >>>an extremely vulnerable group, both to widespread denial of service, and >>>more specific 'surgical' attacks. (Motorola stock anyone?) >The attribution above is in error. I didn't type those lines above. Whoops. Sorry, I believe that was Black Unicorn. My apologies to both of you. -Allen

1 0

Re: Is the network layer geodesic?
by Erik E. Fair 17 Dec '03

17 Dec '03

The principle problem is that public exchange points do not scale beyond current LAN technology (i.e. half-duplex 100 Mb/s FDDI or Ethernet), and how many DS3 (T3; 45Mb/s full-duplex!) pipes does it take to fill that up? Two. Now, drop a DEC GIGAswitch in there (16 FDDI ports, 3.2Gb/s backplane), and now you can have sixteen peers on the exchange. Last count I saw, there are 1,800 ISPs operating in the USA alone, and *everyone* want to be at the exchange points. Oops. How many exchange points are there? Well: NSF Network Access Points (NAPs): New York (well, Pennsauken, NJ; Sprint), Chicago (Ameritech), San Francisco (Pac*Bell) MAE-EAST (D.C.), MAE-WEST (Mountain View-San Jose), MAE-LA, CIX (San Jose) FIX-EAST (D.C.), FIX-WEST (Mountain View; just for the Feds) SWAB (D.C., but almost no one left there). There are probably a few new ones that are forming that I am unaware of as yet, but the point is that they're small-fry. There are also probably exchange points outside the USA, but I bet they're being held up with PTT B.S. The Internet is amorphous. It ain't a star, exactly, but it still not too far from that. However, to get away from this situation into the rich and more fully amorphous connectivity we used to take for granted in the UUCP network, we're going to have to see a lot more cooperation on the part of the small ISPs in agreeing to talk *directly* to each other to exchange traffic, and more small exchange points, instead of the small number of large ones. Of course, this means that you, Mr. or Ms. Discriminating Internet Consumer, must educate yourself a little, and ask interesting questions like, "why do my packets have to go to California to get across town to the ISP my friend uses?" If the customers ask, the ISPs will serve. They just gotta know what you want (and you have to be willing, of course, to pay for it). Erik Fair

1 0

STEL b5 released
by Chris Claborne 17 Dec '03

17 Dec '03

Just a FYI :) From: cert-it(a)dsi.unimi.it -----BEGIN PGP SIGNED MESSAGE----- STEL beta5 has been released. 1. WHAT IS STEL? STEL is a free telnet surrogate which provides strong mutual authentication, encryption, secure file transfer, automatic s/Key password generation, centralization and management of s/Key passwords and more. 2. WHERE IS STEL AVAILABLE? STEL is available as: ftp://idea.sec.dsi.unimi.it/cert-it/stel.tar.gz Please note that ftp.dsi.unimi.it is not supporting security stuff anymore. All the security archive has been moved to idea.sec.dsi.unimi.it. 3. WHAT IS THE STATUS OF STEL? The latest version of STEL is beta 5. It has been (quite) extensively tested on the following systems: hpux sunos4 solaris24 solaris25 irix linux aix It has been reported to work (but no testing) on: ultrix freebsd bsdi Bug reports, comments and suggestions should be sent to: stel-authors(a)idea.sec.dsi.unimi.it - -- ******************************************************** ******** Computer Emergency Response Team ITALY ******** ******************************************************** E-mail: cert-it(a)idea.dsi.unimi.it Mailing list: unix-security-request(a)idea.sec.dsi.unimi.it Ftp: ftp://idea.sec.dsi.unimi.it WWW: http://idea.sec.dsi.unimi.it - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQBNAi1eowgAAAECAOTEMFRZHfBb+ndAmdk3vl20EpynEWwB3ZJo/ocZUXgSjBKS op11p19WyyTV9eW2Sosu9GoC4i7VLDiuFRfmKZUABRG0HkNFUlQtSVQgPGNlcnQt aXRAZHNpLnVuaW1pLml0PokAVQIFEC1epVbakBlHrAS41wEBnskB/iXnREAs044y ngOa8uJtYwFaDKc15GUKx9VV2klikcoWKPgaD6WjFs82HmdY86IQL2bFTi8FTKS2 2auGllxW2zaJAJUCBRAtXqV3kbMTtv2Q670BAccAA/sFW+OVkfr8FnClSAlD7fQc /PL0y8qDF4hYx3tIw1utM5zRGlti+KIOpuUIkQpIX4j8f9lIe/cihL5rlusQFsX4 d7cEJWW8GUM3+/mv89jM0ds6IX9KjfJAQPvPFr5rlRgmHdVm9K4ugCTkOzGsv1E4 o5+ZCN5dJW0+EbmjoghwoA== =WPYC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQBVAwUBMY4wESw4rhUX5imVAQFs1gIAuYqr5IAWRoFQzm71sWdBJCOKTCq/G4ti eucdKJ+5FlmyeQUavWseepozKF019KXElfoHkDVdjl8bnyhFIm7u1w== =nQd0 -----END PGP SIGNATURE----- ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. Dreams. They're just screen savers for the brain.

1 0

Re: Why I Pay Too Much in Taxes
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:16 PM 5/5/96 -0700, Sandy wrote: >Actually, no. When I used to edit a magazine, I commissioned an >article about how much "tax" slaves, serfs, etc. paid. That is, >how much of what they produced, did they get to keep; how much >went to their masters. The surprising, cross-cultural answer my >researcher/writer found was that they got to keep everthing they >produced except 5-10%. That's a lot better, percentage-wise, >than for modern "tax slaves." It was fairly common for serfs to have to provide direct manual labor on their landlord's farm for 1-2 days per week, depending on the lord, plus of course if there was a war you often got drafted (depending on how much you were needed as a farm laborer.) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

INFO: Transcript of crypto chat with Sen. Burns at www.crypto.com
by shabbir＠vtw.org 17 Dec '03

17 Dec '03

------ ======================================================================== __ _________ __ \ \ / /_ _\ \ / / Voters Telecommunications Watch \ \ / / | | \ \ /\ / / (vtw(a)vtw.org) \ V / | | \ V V / May 6, 1996 \_/ |_| \_/\_/ Redistribute only until 5/28/96 TRANSCRIPT OF ONLINE CHAT WITH SENATOR BURNS (R-MT) AVAILABLE AT ENCRYPTION POLICY RESOURCE CENTER (HTTP://WWW.CRYPTO.COM) SENATOR BURNS IS SCHEDULED TO APPEAR AT HOTWIRED: MONDAY 5/13/96 9PM EST Please widely redistribute this document with this banner intact until May 28, 1996 ________________________________________________________________________ CONTENTS The Latest News Schedule of upcoming chats related to encryption About VTW and Whistlestop96 ________________________________________________________________________ THE LATEST NEWS Senator Burns went online tonight and discussed encryption and his new bill, PRO-CODE, with Internet users in America Online's News Room auditorium. The full transcript of this session is available at http://www.crypto.com/. Some highlights from the fifty minute discussion: Question : Senator Burns, As a small business in Montana that provides web-space to local Montana businesses, I'm concerned that the lack of privacy and security on the Net will keep many of my potential customers from purchasing online. How will this bill help? Sen Burns : That's exactly why I introduced this bill. Right now I don't think any of us feel safe transmitting our credit card numbers over the Internet, and many companies who have workers around the nation or world are worried about how they can safely send sensitive information back and forth between them. If we can raise their level of security, we can guarantee that that information will be sent without unwanted eyes looking in. Question : What do you think the Administration, FBI, and NSA reaction to your bill will be? Have you already heard from them? (I run an ISP in Missoula, Montana.) Sen Burns : We expect them to have some concern with this, and we will work with them but we have to undertsnad that the people we are concerned with can already gain encryption that is already longer than 40 bits on teh international market. The transcript is the property of America Online, who retains the copyright. ________________________________________________________________________ SCHEDULE OF UPCOMING CHATS RELATED TO ENCRYPTION Sen. Burns Hotwired: Monday May 13, 9pm EST Sen. Leahy America Online: date not yet available Hotwired: date not yet available You can connect to AOL over the Internet through a SLIP/PPP connection or by dialing up one of their services. Download the AOL client software from URL:ftp://ftp.aol.com/ and install it. HotWired's Club Wired is easy to reach. Go to the WWW page URL:http://www.hotwired.com/club/ and follow the instructions. ________________________________________________________________________ ABOUT VTW AND WHISTLESTOP96 VTW (Voters Telecommunications Watch) is an Internet-based grass-roots advocacy group concentrating on issues of civil liberties and telecommunications. Whistlestop96 is VTW's project to bring more members of Congress and Congressional candidates to online chats to talk about core Internet issues with net users. We do not accept unsolicited donations at this time. If you want to help, register to vote at URL:http://www.vtw.org/ivoter/ . For more information on encryption policy, please see the following resources: Encryption Policy Resource Page: http://www.crypto.com/ Internet Privacy Coalition: http://www.privacy.org/ ...run by these fine organizations: Center for Democracy and Technology: http://www.cdt.org/ Electronic Frontier Foundation: http://www.eff.org/ Electronic Privacy Information Center: http://www.epic.org/ Voters Telecommunications Watch: http://www.vtw.org/ ________________________________________________________________________ Copyright 1994-1996, Voters Telecommunications Watch ========================================================================

1 0