December 2003 - cypherpunks-legacy

Re: Senator Leahy, your public key please?
by Bill Stewart 17 Dec '03

17 Dec '03

Senator Leahy is the first member of Congress to publicize a PGP key. (There are already fake keys for Bill and Hillary Clinton and Al Gore.) A Washington-area Cypherpunk recently visited Senator Leahy's office and asked if he could verify that the PGP key posted to the net for Senator Leahy was correct*, so he could sign it; while it would be difficult to fake responses to the "PGP Public Key" entry on his web page, it could be done, and a fake key could be publicized in other ways. He was told that there's some Congressional silliness about the issue - what's the political implication of having someone sign your key? Postmaster(a)senate.gov is fine, but are there ethics questions if ACT UP, Big Oil or the Christian Coalition signs it, or if Newt Gingrich or your party's Majority Leader refuses to sign it - are those endorsements? Tim May pointed out that you don't _need_ anybody's permission to sign their key; just do it and send to the keyserver. Even if they don't like you. >What if, for example, Sen. Leahy _did_ end up in the web of trust for Aryan >Nation? Even if he never intended it, this could have some severe PR >repercussions. >An exciting new world we're entering. It's really hard to get handed a straight line like this and have to pass it up, but I'm _not_ going to create an Aryan Nations key, and I'm _not_ going to send it to keyserver(a)canopener.worms.mit.edu. Black Unicorn's experience at Senator Leahy's office implies there are too many clueless Congresscritters around who would recognize the political potential and make a Law to Do Something about it, just as Georgia recently made a law against making links to people's web sites without their permission. While the Republicans in Congress, having somehow found themselves on the side of Free Speech with Leahy against Clinton's administration, may be able to pass laws reducing the government's encryption-export and wiretapping efforts, a good scare like this could make it more difficult. Sigh. :-) I haven't Cc:d this to Leahy - Should I? Meanwhile, what should we do about PGP key signatures? PGP 3.x is still being developed, and keyservers can be updates as needed. While I agree that keyservers don't need to validate keys - that's a job for the web of trust, and the keyserver-admin could sign keys if he/she/it wanted to - it may make sense for the keyservers to only accept keys in messages signed by the key itself. (Just signing the key doesn't help much here; you need to sign the key-plus-signatures.) Does it make sense to include some similar capability in PGP itself? Leahy has at least signed his own key... # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

No Subject
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Cypherpunks is not a political newsgroup. From: camcc(a)abraxis.com X-Sender: camcc(a)smtp1.abraxis.com Date: Sun, 19 May 1996 11:40:11 -0400 To: cypherpunks(a)toad.com Subject: News from Burma Sender: owner-cypherpunks(a)toad.com -----BEGIN PGP SIGNED MESSAGE----- ASIA 'Excommunication' An anglo-Burmese businessman friendly with pro-democracy leader Aung San Suu Kyi has been sentenced to thre years in jail for owning unauthorized telephones and fax machines. James Leander Nichols, also known as Leo Nicholas, was punished for having two fax machines and a telephone switchboard with nine lines in his home, a spokesman for Suu Kyi's political party said. In an effort to discourage contact between Burmese citizens and the outside world, Burma's military government requires people to get permission to own a fax machine, satellite dish, or sophisticated phone system. News Services The Atlanta Constitution/The Atlanta Journal Alec

3 2

(Fwd) Re: TCM: mafia as a paradigm for cyberspace
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Sorry Vlad Z. Nuri, but this message was intended for Cypherpunks, to be cc'd to you. Unfortunately, I wrongly addressed it. To CPunks: the reply that should have hit CPunks: ============================================================ To: jf_avon(a)citenet.net Subject: Re: TCM: mafia as a paradigm for cyberspace Date sent: Sun, 19 May 96 19:52:45 -0700 From: "Vladimir Z. Nuri" <vznuri(a)netcom.com> there is no ethical basis for killing. please kindly keep your trash out of my mailbox I've evaluated all sides of the story, and am not influenced by corrupt machiavellianism ============================================================= -------Original Message Follows ------- From: Self <Single-user mode> To: "Vladimir Z. Nuri" <vznuri(a)netcom.com> Subject: Re: TCM: mafia as a paradigm for cyberspace Reply-to: jf_avon(a)citenet.net Date: Sun, 19 May 1996 01:59:00 On 18 May 96 at 12:43, Vladimir Z. Nuri wrote: > maybe talk to Jim Bell some more. perhaps > eventually you will perfect the method of perpetrating the perfect > killing!! I really do admire you, because killing people without > getting caught is surely a great unrecognized art, and one of the > most unappreciated and misunderstood. something that has only been a > dream to the blighted wretches prior to our glorious new phases of > cyberspatial technology, which makes human morality completely > obsolete. I think that you are writing way out of context. First, wether or not the AP scheme is used for the control of government, as Jim Bell pushes it, does not mean that it will not be implemented for other purposes, such as killing successful businessman or your neighboor's son who is screwing your wife (noticed that she smiles all the time since a while? ) . Second, everybody like Jim Bell who is pushing the AP scheme is doing so on ethical basis: that the coercion the government imposes on to the individuals by regulations, and guns backed taxation justifies the killings. I have to see yet any cypherpunks who seems to agree with AP that envision another use than govt control. Third, you will notice that even Jim Bell discusses issues of anonymous transactions and businesses that, if conducted properly, makes the AP scheme irrelevant. So, it seems that AP is only a tool instead of being an end in itself. Fourth, you lack some basic psychological insight: intrinsic murderers do enjoy the knowledge of the details of their actions and the derived perception of power. AP prevents that by anonymising everything: a donator cannot know if he caused the death of somebody (unless he spends several tens of grands himself, but then, there are other, more satisfying ways for a power seeker to fullfill his passions...) . You seems to oppose the proposed violence entailed by AP but you positively blank out what everybody who reflected on AP put in the opposite pan of the balance, i.e. the ethical standards of contemporary govt actions. And you'll also note that the anonymity issue generate more interest from more CPunks because it (hopefully) will acheive the same goal without any killing. Until you accept to evaluate both side of the story, your recriminations opinions are as evident as the magnetic monopole... jfa DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal JFA Technologies, R&D consultants; physists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

5 6

Re: Senator, your public key please?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:38 PM 5/18/96, bryce(a)digicash.com wrote: ...(my points elided)... >All of these are products of misconceptions between using the >WoT to certify identities, versus using it to certify how much >you trust a person to certify someone else's identify, versus >using it to certify arbitrary other qualities about a person. Bryce, we've differed several times before about the web of trust, especially "man-in-the-middle" issues. This looks to be the same sort of issue. I personally don't see key-signings as mainly useful for verifying the "true name" of someone whose key I sign. (I don't check birth certificates, passports, driver's licenses, etc.) Rather, I view _my_ key signings as forms of vouching, or endorsement. Not of all views, naturally, but as a statement that the person whose key I am signing is someone I know and "trust" (in the sense that the key belongs to the person I "know." Thus, I know Eric Hughes, even though he may actually be Fritz Kacynski, drop-out math student. > >For example, there is no reason why the hypothetical racist "Tom >Metzger" would sign no black people's keys. A key signature >(PGP style) is just an assertion about the identity of someone. >Haven't racists engraved markings on people's clothes, >buildings, land, bodies and other belongings in order to >identify the owners? So why not do the same for keys. Sure, he could do it. I'm saying that there's also a significant chance he has no black friends or no blacks he deals with on a regular enough basis to even be _asked_ to "vouch" for them, much less _agree_ to sign their keys. (This is the way it really does work in the real world, at least for many of us. People who ask me to sign their keys from afar will get no response from me. I don't even care if they fax me their birth certificates, etc. Only people I have met or interacted with directly, or who seem to be known by enough of my friends, get their keys signed.) Now I can certainly see other folks signing keys on a different basis: upon presentation of a valid passport, comparison of footprint with that on birth certificate, etc. Such "credentialling agencies" will be valuable players (to some) in the ecosystem of key-signers. I'm just saying that I'm certainly not in the business of checking credentials for free, and hence only sign keys for people I know fairly well, or who know my own friends fairly well. >This is illustrative of how much confusion reigns about keys, >certs, nyms, signatures and cetera right now. > > >I hope that TCMay is pointing out how _most_ people lack a >proper understanding of the differences, rather than reflecting >his own lack of understanding. Bryce, I respect your views on this and MITM issues, but the fact that we view things differently (and that Phil Z. views things differently from you, and perhaps from me) should not always be ascribed by you as "reflecting lack of understanding." >Phil Zimmermann was confused about this, I think, when he wrote >"Trust is not transitive.". Some kinds of trust _are_ >transitive (with a coefficient, of course). Hm. I wonder if >there are kinds of trust whose transitivity coefficient is 1? Well, I wrote up my thoughts on how work on "belief networks" is less confusing that the term "web of trust." I believe different agents will use these belief networks in different ways. Some will be focused on the issue of True Names and will calculate beliefs on the basis of how much they think the key-signers are being diligent enough in checking identities. Others will use belief networks to convey trust that one is not a government agent (a practical example being the use of PGP and webs of trust in the jungles of Burma, where I am quite sure the "keyrings" did not deliberately include government agents, regardless of how well they "proved" their identity! There is no single ontological interpretation of belief networks. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Is Chaum's System Traceable or Untraceable?
by bryce＠digicash.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- You know, even though current ecash uses on-line clearing, it is only necessary for the _payee_ to be on-line at that time. Thus it is entirely possible with current ecash for a payer to load his portable computer up at home with e-coins and then make a purchase a convenience store on the way to work _without_ having a networkable computer. Well-- I mean the computer needs to communicate with the convenience store, but it doesn't need full-scale Internet access. Does anyone on cpunks or ecash have an Apple Newton? I know that they come with infrared-- what are the specs on that communications device? And about the Newton itself: can it compile ANSI C code? How much RAM? Permanent storage? Speed of crypto operations? Thanks, Bryce #include <stddisclaimer.h> /* I don't speak for anyone but myself. */ - -----BEGIN GOODTIMES VIRUS INNOCULATION----- Copy me into your .sig for added protection! - ----- END GOODTIMES VIRUS INNOCULATION----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMZ4wY0jbHy8sKZitAQG/TAMAlF1WftbM8UT1+AUvZJBuX7BimZUOtRqg 2vWYVW2ADuKvntXdsDV0NqSq05/sqDZmhh/iOUmB6bWl22FUrwBbzk2gedUbB1w2 330B6pa1IU1Q5IluNIE2IKFkMZ/KHJ9m =5W5l -----END PGP SIGNATURE-----

3 2

Re: Interactive Week exclusive - White House to launch "Clipper III"
by tcmay＠got.net 17 Dec '03

17 Dec '03

Bottom Line: In a way, I am hoping that "Clipper III" is proposed, as it will energize us once again. Historically, the "Cypherpunks antibodies" have had their most vigorous growth when faced with a government antigen. At 8:09 PM GMT 5/18/96, Will Rodger wrote: >The White House is about to answer recent attempts to liberalize encryption >exports with a proposal of its own. > >Documents obtained by Interactive Week show the Ciinton Administration has >been lobbying key Republican committee members to compromise on encryption >through a policy that looks very much like previous commerical key escrow >efforts. ... >The URL for the complete article is: >http://www.zdnet.com/intweek/daily/960518y.html > >Will Rodger >Washington Bureau Chief >Interactive Week Many thanks to Will for passing this on the Cypherpunks list. Our opposition to Clipper I and Clipper II was strong and, I expect, will continue with CIII. A question for Will Rodger: Is this "White Paper" ("The newest proposal is contained in a 24-page White Paper, a draft of which hit Capitol Hill earlier this week") related in any way to the one being prepared by Herb Lin and a bunch of other folks? It was due out about this time, and the topic seems similar. A bunch of us gave input to Herb and his panel at the CFP in '95...if this is the same White Paper, looks like we might just as well have saved our breath. I read the stuff at the URL, and at first blush it looks to say nothing about _domestic_ (within the U.S. and Canada) encryption. I'll be anxious to see what the White Paper says about domestic encryption. (To be clear, there are currently _no_ laws whatsoever about the types of crypto a citizen (or resident alien, or, for all intents and purposes, anyone) may use, nor about the key length, nor about any form of GAK, etc. Even Clipper I did not actually mandate allowable forms of crypto, though many of us thought that this was the desired end-state, down the road. So, I am tentatively assuming that Clipper III, if passed, will not diretly impinge on domestic encryption policy, about which the government currently says nothing.) However, as with other proposed crypto laws and "trial balloons," there are several questions which arise: 1. Will there be pressures put on the browser companies (Netscape, Microsoft, etc.) and the e-mail companies (Qualcomm, Microsoft, Claris, Lotus, etc.) to produce a "world version" that meets export standards with a single shrink-wrapped package? (Recall that last fall some of the various companies stated as their goal having a single package that could be shipped worldwide. Some of them claimed having two versions, a domestic U.S. version and an international version, was too onerous. I am skeptical of this, given that they have multiple platforms to support, multiple operating systems, etc. But they claim it is.) 2. Interoperability. How will U.S. users exchange messages with international users? Will a U.S. user have to register with the Authorities to get the proper credentials, protocols, etc.? Will the U.S.-sold versions of Netscape or Explorer, for example, contain the international GAKed versions for use with international users? 3. With products like PGP, there are already international users (lots of them). Thus, no "export laws" are involved. So, will I be able to communicate with them using my existing PGP methods? (If not, then my right to use an encryption product is in fact being limited, contrary to the putative wording of what Clipper III is supposed to be. To make this clear, I'm _already_ communicating with PGP, so no "export version" is needed.) And if U.S. users can continue to interoperate with international users as they are now doing, this puts the lie to claims about how key escrow will be useful for law enforcement. 4. And of course there is always the issue of _superencryption_. How a GAKked program can detect that superencryption is being used has never been adequately explained (to my satisfaction at least). Entropy measures won't do it, and forbidding any encryption of messages already containing "BEGIN PGP" will clearly just be a klugey bandaid. 5. What about U.S.-based corporations with offshore offices? Is a company supposed to replace its entire intranet corporate network with a GAKked system if even a single user is outside the U.S.-Canada? (I fear that this is indeed the proposal. The effect will then be to make all corporations GAKked.) 6. What about U.S. persons travelling abroad? 7. What about packets zinging around the world? Lots of complications if GAK is insisted upon. And lots of new avenues for "packet laundering." 8. The issue of why other countries would insist that their citizens GAK their keys when U.S. citizens don't have to!! ("Yes, Herr Glomlutz, we are insisting that all Germans using Netscape 4.0 must deposit their keys mit der Key Authority. No, we are not requiring our own citizens to do this." I don't think this will fly too well.) I can't see how other countries will go along with this. And what about the usual problem of "rogue nations" like Iraq, Iran, North Korea, Israel, and Liberia? 9. Many other issues. (They never answered the similar questions raised the last time, so I doubt they will this time.) Clipper III, if it turns out to be another worthless proposal which is laughed out of Washington, will be no real threat. If Clipper III actually outlaws or places limits on domestic use of crypto (as I think it must, else it can be too easily circumvented completely), then it will be a rallying cry which will likely see our membership increase still further, the anti-Washington rhetoric escalate, and likely some new developments in the war. In a way, I am hoping that "Clipper III" is proposed, as it will energize us once again. Historically, the "Cypherpunks antibodies" have had their most vigorous growth when faced with a government antigen. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Toastmasters? Incorporating
by remailer＠2005.bart.nl 17 Dec '03

17 Dec '03

How do corporations work, in terms of liability? If the cost of incorporating isn't forbidding, I would think a remailer operator might consider incorporating a company, and making the remailer a function of that company. That way, any losses are restricted to the total value of the corporation; that is, nothing. Any flaws? There must be something wrong with it somewhere. Thanks.

5 5

Re: anonymous companies
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"unicorn(a)schloss.li" "Black Unicorn" 18-MAY-1996 11:16:57.48 > At 06:42 PM 5/16/96 -0700, Wei Dai wrote: > > Solution: smart contracts. This is Nick Szabo's idea of building > > contractual obligations into cryptographic protocols so that the parties > > have no choice but to fullfil them. But again we don't know whether this > > will actually work for this problem. >But what happens when there are nuances or circumstances which contracts >do not anticipate? This "complete" reliablity is also a curse for >flexibility which fast moving entities need to survive. That's an argument for combining them with escrow agencies. If the escrow agency is less likely to need to intervene, then they'll charge less... the principle of insurance company risk estimation. -Allen

2 2

Interactive Week exclusive - White House to launch "Clipper III"
by rodger＠interramp.com 17 Dec '03

17 Dec '03

The White House is about to answer recent attempts to liberalize encryption exports with a proposal of its own. Documents obtained by Interactive Week show the Ciinton Administration has been lobbying key Republican committee members to compromise on encryption through a policy that looks very much like previous commerical key escrow efforts. This time, however, the administration has proposed a new, licensed network of certification authorities and escrow agents to control access to strong encryption abroad. The newest proposal is contained in a 24-page White Paper, a draft of which hit Capitol Hill earlier this week. Much of the administration's "key management infrastructure" assumes a similar network of certification authorities abroad. CAs would link public keys to their owners, and could serve as escrow agents for users' private keys, as well. The two would not have to be under the same roof, however. An overarching "Policy Approving Authority" would supervise all subordinate CAs and escrow agents. Since US escrow of exported products pose well-known problems for privacy and business concerns, the US is proposing foreign governments get into the act as well. If other governments acted as escrow agents, the Clinton White House argues, interlocking agreements among governments would protect all their common security concerns while giving non-US citiczens access to US encryption products. The ultimate goal, the White House says, is to allow export of anything at all, so long as keys are escrowed with an agent of its approval. The White House is evidenty relying on OECD initiatives for much of this to happen. Specifically, the "Clipper III" paper says that: U.S. companies can export software programs that use keys that are 64 bits of data long, if they agree to escrow keys that unlock the encryption in the U.S. or with an appropriate agency abroad. Manufacturers can export hardware that use 80-bit keys to encrypt data, if keys are escrowed. Large U.S. companies can escrow keys and not rely on third parties. Reaction is as before. Civil libertarians are already denouncing the White Paper, while pro-escrow forces are praising it. Staffers to Commerce and Judiciary committee call it the same old proposal, but with a large bureaucracy behind it. Quoted in the Interactive Week article: David Sobel of Electronic Privacy Information Center, Dorothy Denning og Georgetown U. and Stewart Baker, former NSA counsel. Hill staffers also quoted on background. The URL for the complete article is: http://www.zdnet.com/intweek/daily/960518y.html Will Rodger Washington Bureau Chief Interactive Week

2 1

Re: SEVERE undercapacity, we need more remailer servers FAST
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

What countries are noticeable for being anti-Scientology? They would appear to be good locations for special-purpose remailer ultimate-output ends. -Allen

2 2