December 2003 - cypherpunks-legacy

Re: Optimism re NRC Cryptography Report
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 07:40 AM 5/31/96 -0700, Timothy C. May wrote: >This should be enough to ensure our victory. (Not that I think that even >fairly repressive legislation would've been enough to defeat us, but a new >breathing spell can only help.) Actually, I felt this upon reading the general recommendations, but then in reading the expansion of the recommendations, I could see a lot there for the continuance of the "status-quo" type of attitude. After talking about it with other people, my feeling is that the document might be all things to all people...? Pro-crypto will be happy with it and point to this para and that, "anti"-crypto (law enforcement type) could also be happy with it and point to that para and the other. The question then is, how will it be read/perceived by its audience (which I suspect is legislators.) Given the way the press is reporting, it is being received as a pro-crypto report, congress might pick up on it. Unfortunately, it might pick up on it with respect to publicity and posturing, and a fair amount of "the briefing" back door stuff will continue. Can't say though. _______________________ Regards, If it weren't for the last minute, nothing would ever get done. Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: opinions on book "The Truth Machine"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:06 AM 5/31/96, Timothy C. May wrote: >It sounds like a "make.money.fast.by.promoting.this.book" scam to me. ... >In any case, I decided to waste a few minutes skimming the opening parts of >this "online media event novel" and discovered at the URL you cited: > >"Complete this brief survey and receive the first two and a half chapters >of the book free! Upon submission, you will be given access to these >chapters of The Truth Machine......" > >Utter bullshit. If the book was any good it would have a real publisher, >not an opinion survey. I confess to eventually yielding to temptation and answering the "survey" questions (though I just made up some semi-random answers so as to get Chapters 1-3, then 4-12, etc.). It was truly bad stuff. Terribly written, confusing, no character development except in a cartoonish way. One correspondent chided me for saying that if the book was any good it would have a real publisher, citing the opportunities for using the Web to self-publish. Well, the book is coming out in _printed_ form, for $20 or somesuch, from a press I've never heard of. If more than 500 copies are sold to actual paying, third-party customers, I'll be surprised. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Fight-Censorship Disp
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-=> Quoting In:declan@eff.org to Harka <=- In> 4.1 -- Products providing confidentiality at a level that In> meets most general commercial requirements should be easily In> exportable. For they are easily breakable... In> 4.2 -- Products providing stronger confidentiality should be In> exportable on an expedited basis to a list of approved In> companies if the proposed product user is willing to provide In> access to decrypted information upon legally authorized In> request. Sounds like a "Clipper VI" proposal. In> Recommendation 5: The U.S. government should take steps to assist law In> enforcement and national security to adjust to new technical realities In> of the information age. See 4.1 and 4.2. Harka ___ Blue Wave/DOS v2.30 [NR]

1 0

Re: Where does your data want to go today?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:25 AM 5/31/96 -0400, David F. Ogren wrote: >> > > What problems does compression before encryption have? It at least >> > >seems to work for PGP. >> > > >> > Most compression schemes put a header/index on the front of the >> > compressed data. >> > This makes recognizing the correct decryption very simple. >> > >> > Call it a limited "known plaintext" situation. >> > >Using a random IV also limits the effectiveness of using known >headers for "known plaintext" attacks. Also note that a good block >cipher isn't that vulnerable even to "known plaintext" attacks. I don't think this is true given a brute force attack. Let me assume DES-CBC as a specific system. Let us assume that the plaintext is: IV || PKZIP2.1 || <compressed data> Where IV is the 8 byte initialization vector. The brute force system decrypts the first, and second blocks (8 bytes each) of the cyphertext, XORs them, and compares the result with "PKZIP2.1". If the comparison is equal it has the key. If we eliminated the header and just started with the compressed data, then the brute force system would have to decrypt and decompress enough of the data to run statistical tests. The cost of the additional decryptions, decompression, and statistical tests substantially raise the cost of the brute force attack. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: someone to "educate"
by rick hoselton 17 Dec '03

17 Dec '03

At 07:31 PM 5/30/96 -0700, you quoted someone: >> Corporate policy dictates that we do not offer anonymous >> accounts. It is corporate belief that there should be no >> reason anyone needs anonymity on the net Perhaps you could ask whoever sent you that message for their home phone number, address, and Visa Account number, to be posted to this newsletter. After all, if they are sure this is a good policy, and they are not ashamed of it, then the individuals who authored it have nothing to hide! If they really believe what they say, then they won't mind. I, for one, am waiting.

1 0

NRC Report, 4, 5, 6
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Part II Policy Instruments Chapter 4 Export Controls http://pwp.usa.pipeline.com/~jya/nrc04.txt (163 kb) Chapter 5 Escrowed Encryption and Related Issues http://pwp.usa.pipeline.com/~jya/nrc05.txt (144 kb) Chapter 6 Other Dimensions of National Cryptography Policy http://pwp.usa.pipeline.com/~jya/nrc06.txt (85 kb) --------- Tomorrow: Part III Policy Options, Findings and Recommendations Chapter 7 Policy Options of the Future Chapter 8 Synthesis, Findings and Recommendations 14 Appendices

1 0

Re: Statistical analysis of anonymous databases
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:53 PM 5/31/96, David Wagner wrote: >In article <v01540b02add1fc6e4658(a)[193.239.225.200]>, >Clay Olbon II <Clay.Olbon(a)dynetics.com> wrote: >> In medical research (this particular application - there are others I am >> sure) it is desirable to have a large database of individual medical >> histories available to search for correlations, risk factors, etc. The >> problem, of course, is that many individuals want their medical histories >> kept private. It is therefore necessary to maintain a database that is not >> traceable back to individuals. An additional requirement is that people >> must be able to add additional information to their records as it becomes >> available. > >How about a simple non-technical solution? Each patient picks a >random pseudonym; the database is keyed off that pseudonym, and the >person's True Name(tm) never appears in the database. Patients >should remember their pseudonym (or write it down); then they can >add information to the database. This "leaks" too much information. It is not hard at all to figure out that the only 32-year-old white male with appendicitis is Sidney Jackson. And so on, for enough of the patients to effectively identify most or even all of them. Blinding only the true name while leaving the essentially unique parameter sets unchanged pretty much makes the name blinding moot. I have a hunch it's possible to blind the individual parameters in some way so as to make analysis possible, but I don't have any approaches in mind. I recall that Joan Feigenbaum was working on "computing with encrypted instances" for her Ph.D. work at Stanford (she's now at one of the AT&Ts now). The idea being quite similar to this application: transform a set of data for analysis by a party which is not to know the nature of the work being done, then transforms back the answers obtained. And there is another angle discussed a few years back in connection with AIDS testing. Specifically, for door-to-door polls asking if a person has been tested for AIDS (or whatever). One effectively "confuses" the answer by flipping a coin or rolling a die and "switching" the answer depending on the results. This allows any particular person to, for example, say "Yes" to the question "Have you been tested for AIDS?" without this actually being the case. (The tosses have to be skewed so that statisticians can still extract/deconvolve useful information.) I think of this as "plausible deniability." Of course, this is confusing to the average person, and maybe even to folks like us, so this proposal (by I don't recall whom) has not gone very far. But it shows that some semi-cryptographic protocols could be used to get some sensitive information. I don't know if something like this could be used for the medical database problem, but it's interesting. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

[Off-Topic] "Curfews"
by tcmay＠got.net 17 Dec '03

17 Dec '03

Cypherpunks, This is off-topic for the list, but I want to share it anyway. It touches on issues of increasing police surveillance, and also touches on the issue of "age credentials" (in the sense that how else is a cop who stops a young person for "curfew violation" to determine if a violation has occurred when most 14- and 15-year-olds carry no driver's licenses?) The "curfew" meme is spreading quickly, with Clinton calling for a federal curfew, at least in cities, and Dole trying to outdo him with even more draconian curfew laws. Many communities already have them, including San Jose, New Orleans, and other large cities. And my own community, Santa Cruz County, ironically begins a curfew program on Saturday, tomorrow. I wrote this item for our local newsgroup, scruz.general, announcing that "my household" will not abide by this law. I didn't come out and say "my kids" would not abide by it, inasmuch as I have no kids. So I elliptically referred to "parents and guardians"...after all, my sister visits with her husband and son, and in theory I could be the guardian of this kid. And friends bring their kids. My point is to send a "warning" to the Sheriff's office that at least some households think this crackdown on the movements of children is unacceptable. Children have the right to travel, especially as the parents permit it, without being stopped, questioned, forced to state their destinations, and, if the answers don't satisfy the cop, taken into detention at some children's equivalent of a "drunk tank." (Some purists claim that children are exempted from normal constitutional protections, such as the right of free association, the right to be free from unwarranted searches and seizures, the right of free speech, etc. Especially this comes up in debates about rights in public schools (speech, locker searches, movements are controlled, etc.). But I think a public school environment is a dramatically different situation, whatever one thinks of these claims about rights, from a kid walking on a public street. To claim that such a child may be stopped, interrogated, taken to a detention center, without a crime having been committed, is a clear violation of his or her rights.) As I said, should such curfews become widespread, children will of course need forms of age identification, and this opens yet another door for universal I.D. cards. And for "travel papers." Maybe it would be easier to just put a tattoo on their arms--especially as the younger generation is so into tattoos these days. "Pappieren, bitte. Macht schnell!" Here's what I sent in to scruz.general tonight: So Santa Cruz begins its own fascist crackdown on the free movements of persons. The "curfew" begins Saturday night. Allegedly these persons are children, but it is up to parents and guardians to control the movements of their children or charges in public places, NOT the function of the police to detain these children or charges. (Initially a "warning," but the child's name is recorded in police data bases....if the child is detained a second time, he or she may face detention time, community service, fines on the parents or guardians, and so forth.) ANNOUNCEMENT: I am responsible for the children in my household or in my custody or guardianship. Not the cops. Not the Sheriff. Not the CAMP helicopters. Not the narcs. Not the vice squad. Not anyone but me. I am instructing those in my household or who visit to IGNORE all interrogations by cops. I am telling them not to let the cops search their bags, not to let the cops ask where they are going, not to let the cops demand that they give a reason for being out. If they pick up people from my household, I expect the children to remain silent and to just fill up the god-damned jail cells until I eventually raise a ruckus and (maybe) pick them up. If some kids are out and about and making mischief, the cops should concentrate on catching _those_ children! Don't immobilize all kids for the sake of supposedly cutting down on the activities of the perps. As with so many do-gooder laws, the effect will largely be felt on the "good" kids and will be ignored or evaded by the "bad" kids. As to the claims that children have no valid reason to be out after 9, or 11, or whatever, this is not for anyone but the parents and guardians to decide. The god-damned cops are not the ones to decide what a valid reason for being out is. (I have heard that "religious worship," a la "Midnight Mass," is one of the valid reasons for a child to be out after curfew. Fine, religion is then the stated reason those in my household are out! I will tell them to tell any nosy cops or Sheriff's Deputies that they are worshippers of Baal, and Baal requires them to be out to appreciate the darkness. If the cops claim this is "not a valid religion," I will recite to them the First Amendment of the U.S. Constitution, where it says: "Congress shall make no law respecting the establishment of religion or prohibiting the free exercise thereof.") I moved to the rural part of Santa Cruz, Corralitos, to escape this fascist and socialist nonsense, and now I find it primarily the Sheriff-dominated parts of this county which will now claim to tell parents and guardians they no longer control their children. Fuck this. --Tim May -- Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

"Anonymity is bad," says a source who wishes to remain anonymous
by tcmay＠got.net 17 Dec '03

17 Dec '03

I'm not going to dig up the exact quote, but I was struck by a couple of "comments" on crypto policy recently. One involved some crypto news of several days ago, and one was reported yesterday in the "San Jose Mercury News," in an early glimpse of what the NRC report would say. In both cases--and these were not the first such cases I've seen--a source "who wishes to remain anonymous" is announcing just how bad and dangerous crypto, anonymity, remailers and stuff like that are. "But the official, speaking on condition of anonymity, insisted that any computer system that did not include a way for authorities to decipher data would 'pose very costly and time-consuming problems' for law enforcement officials." [SJMN, C1, 1996-05-30] ""Anonymity is bad," says a source who wishes to remain anonymous." The definition of irony, I'd say. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Statistical analysis of anonymous databases
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 15:53 5/31/96, David Wagner wrote: >How about a simple non-technical solution? Each patient picks a >random pseudonym; the database is keyed off that pseudonym, and the >person's True Name(tm) never appears in the database. Patients >should remember their pseudonym (or write it down); then they can >add information to the database. In medical research, third party audit, i.e., the Department of Health and Human Services, is often required. A simple pseudonym picked by the patient won't do. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1