December 2003 - cypherpunks-legacy

Trial jurisdiction options
by Jim Choate 17 Dec '03

17 Dec '03

ARTICLE III. Section 2. The judicial Power shall extend to all Cases, in Law and Equity, arising under this Constitution, the Laws of the United States, and Treaties made, or which shall be made, under their Authority; -- to all Cases affecting Ambassadors, other public Ministers and Consuls; -- to all Cases of admiralty and maritime Jurisdiction; -- to Controversies between two or more States; -- between a State and Citizens of another State; -- between Citizens of different States; -- between Citizens of the same State claiming Lands under Grants of different States; -- and between a State, or the Citizens thereof, and foreign States, Citizens or Subjects. In all Cases, affecting Ambassadors, other public Ministers and Consuls, and those in which a State shall be Party, the supreme Court shall have original Jurisdiction. In all other Cases before mentioned, the supreme Court shall have appellate Jurisdiction, both as to Law and Fact, with such Exceptions, and under such Regulations as the Congress shall make. The Trial of all Crimes, except in Cases of Impeachment, shall be by Jury; and such Trial shall be held in the State where the said Crimes shall have been committed; but when not committed within any State, the Trial shall be at such Place or Places as the Congress may by Law have directed. ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: rant on the morality of confidentiality
by Blanc 17 Dec '03

17 Dec '03

Mad Vlad wants to know: >something most anarchists here will deny is the existence of something >that could be called *immoral science*. is there such a thing? ............................................................ No. There are, however, immoral scientists. One way to skew the interpretations of what you write, besides bringing up the subject of morality, is to describe things in ways which do not correspond to their actual manner of existence: "science" does not exist without those individuals who have set themselves to pursue it. They should bear the blame if they practice it immorally. You again have brought up several issues which can be examined separately and do not necessarily coexist: . being a scientist . pretending to be scientific . choosing to pursue science . being smart enough to pursue scientific research . being successful in the scientific pursuit of truths . giving a damn about the consequences of the effects of research as it affects humanity or other living things (as when it is imposed upon them) . responsibility in science . responsibility in science as practiced by mendicants of the State . the regulation of responsibility per se . the regulation of the methods of science . the support of irresponsible scientific methods, by slaves of the State . anarchist cypherpunkery I become exceedingly uncomfortable at the realization that I have to buy an astronomy magazine from the store, paying yet again for info, in order to find out some of what they're doing at NASA. To think that a responsible citizen like myself must go out searching for the info themselves, using whatever resources they can find or pay for, in order to become informed! There are all sorts of things that government employees do not "share" with those who pay the bills. There is a book in Objectivist literature which presents the idea of "context dropping", which is, that in order for some people to function as if things were normal and that what they're doing is consistent with moral principles, they must drop a part of their information out of sight, out of thought, so that their actions appear logically related and make sense - they eliminate elements from the given context, crucial essentials which make the difference in its character. People like these might practice secrecy in keeping information from others, but equally significant, they also hide things from themselves. So that's one thing which would explain some scientist's lack of moral principles in the pursuit of science. Then it must be explained why so many people aren't complaining about it. Are they insensitive to their mistreatment, sitting ducks for opportunists? Or maybe these taxpayers are equally immoral, thinking only about promised benefits, forgetting about the disadvantage of losing control over the quality of their life? It's possible for some people to override the boundaries of decency, even if they're otherwise smart enough to pursue science. But what would you expect cryptographers to do about it? .. Blanc

4 7

Federal govt. & Science - Const. limits
by Jim Choate 17 Dec '03

17 Dec '03

Congress has *no* authority to ban *any* scientific research. In fact they are specificaly enjoined to *promote* it. Section 8. The Congress shall have Power... [text deleted] To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries; [remainder deleted] ARTICLE IX. The enumeration of the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people. ARTICLE X. The powers not delegated to the United States by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people. ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: local vs remote eternity servers (Re: (eternity) Traffic Analysis)
by Adam Back 17 Dec '03

17 Dec '03

Thomas Womack <thomas.womack(a)merton.oxford.ac.uk> writes: > >Thomas Womack <thomas.womack(a)merton.oxford.ac.uk> writes: > >> I can imagine *use* of > >> the service becoming a felony; you're therefore committing a felony > >> merely by connecting to http://www.eternity.to, and acquiring > >> evidence for that is a trivial matter of logging connections from a > >> given user. > > > >One solution is to run eternity on a web server with SSL turned on, > >and which serves lots of other data too. > > It's not completely clear that such an object would exist; in legal terms, > it would seem to be the same as a large and well-respected department store > which happens to possess and tolerate a fence for stolen property. That is, > it's an object which handles stolen property and can be shouted at loudly, > legally, and with very large sticks. Yes, but merely being seen going into this department store is you hope not grounds for prosecution. ie The flow of the discussion being that you said "you're therefore committing a felony by connecting to www.eternity.to" .. my reply being that if we can arrange that there are any number of reasons for connecting to www.eternity.to, any of which are protected by an SSL connection, that this lessens the risks of being seen connecting to said server. We can easily arrange this by offering interesting free services. Certainly turning on SSL does not protect the server operator. There server operator in your analogy was the department store owner. But we were discussing the client (the shopper)'s risks. > >The general problem with the remote server approach is that you have > >to trust the server. You could alternatively use a local eternity > >server, which is easy to do if you have a local unix machine. > > The operating system is immaterial here! Ah, not if you are talking about my eternity prototype, because it only works on the unix platform. Same for Ryan at present I think. The overloading of "eternity service" is not helping here. My point was that talking about my eternity prototype using USENET as a distribution medium, where the `eternity server' is just a convenient way to present an apparently persistent view of transient USENET articles, using a local eternity server reduces the risk of traffic analysis attack. Now all you are doing is reading news. If you already have a full USENET feed, you have no new externally observable traffic. This process would be better termed a `local eternity proxy', in that it would effectively be acting as a local web proxy process, where the eternity virtual web pages were being fetched from a local news spool by the local web proxy. > >Ideally you would like a local news feed also, so that your local > >eternity servers NNTP traffic or file system accesses to read news are > >not available to the attacker. > > That nearly makes sense - but 'running a news feed including the eternal.* > groups' can be phrased such that any sane jury takes it as 'using/running an > eternity server'. Cross-post, and / or post to random newsgroups, threshold secret split your posts so that only N of M are required to reconstruct. If you get shouted at for SPAM, steganographically encode the eternity traffic. Pornographic images in alt.binaries.* would be suitable because there are lots of those already. Because this is a publically readable message an attacker (such as Ryan's system admin he mentioned at MIT) might recognize the message based on successful stego decoding, and purge it from the news feed. We can counter this move by encrypting the original posting, and posting the decryption key a day or two later to ensure we get the full feed before anti-eternity crusaders get to work purging the eternity traffic masquerading as images. USENET carries all sorts of materials which could potentially get you in trouble. I don't know what your news feed is like, but the one at Exeter last time I looked had a healthy selection of dodgy gifs in alt.binaries.* > >Depending on your available resources, you can either operate from a > >local news feed (people are less likely to be prosecuted for the > >contents of a normal full newsfeed IMO), or have SSL access to a > >remote ISPs NNTP server. > > I suspect that, had anyone the least intention of arresting certain of my > acquaintances on a trumped-up charge, they could persuade a jury that a > 'normal' full newsfeed is sanitised, and that a newsfeed containing *warez* > or *erotica* is clearly an Evil Perversion of the Natural Law. We can't do much about the idiotic juries, and corrupt judicial systems ... `they'd indict a ham sandwich if I told them to' -- some US judge. You're probably right too. But I think we need to keep a sense of proportion about opening ourselves to having technical actions misconstrued to a clueless jury: there are easier ways to frame someone once they have decided they don't like you. To truly retain plausible deniability you need to maintain excellent plausible deniability, you have to be squeaky clean: you need to appear to be a model citizen, to not post politically incorrect opinions to non-government approved fora, etc. You must be below the radar belt, you must be essentially invisible to the government, the spooks dossier on you must read Mr Average and be entirely wholesome. Then you must have one or more alter-egos, for your real interests. > >> How can you defend against the felonisation of 'operating an Eternity > >> Server'? > > > >Operate closed eternity servers for small group only, or a local > >server for yourself or local users only. > > But wasn't the point of the eternity service that it was massively > distributed; if you're running a server for a small group consisting of > forty-nine hackers and the deputy director of the NSA going incognito, > you'll suddenly discover that all your servers have been seized, and that > men with intimidating glasses want to ask you a number of searching > questions. The surest way is to run the eternity server for yourself only. The distribution medium is massively distributed, as the distribution medium is USENET. USENET is a broadcast medium. Possibly the most secure way to create one way anonymous communications is to broadcast the messages. Tim May's BlackNet uses this approach. Eternity is doing the same thing. Adam

1 0

load balancing web proxy and server networks
by Adam Back 17 Dec '03

17 Dec '03

We might also think about adding hot spot avoidance to distributed web hosting mechanisms. A distributed web space which distributed itself to meet demand would be useful. (An example of hot spots being perhaps Dan Farmer's web site after he released Satan ... he switched the web server off to stop his T1 being saturated, until the deluge subsided). An automatic load balancing distributed web server would be a kind of next generation web proxy cacheing and mirroring scheme, dynamically replicating and cacheing data to meet demand. Robustness could be improved also by the redundancy introduced. Those browsing documents would pay for their web accesses at the service rate they desired. A market in web data would then give web proxies / mirroring agents an economic incentive to automatically replicate and migrate data. Web caches already have some protection from various laws. One other idea for an eternity service host we could leach off was suggested to me by Ian Brown <I.Brown(a)cs.ucl.ac.uk>. His suggestion was that it would be nice if we could con proxy caches into cacheing eternity web space for us. One way to do this for example would be to actually host our own web pages, but to configure our web server to only serve to a list of web proxies -- anybody else would get access denied. The .htaccess mechanism would be sufficient for this purpose. Adam

1 0

Tales of the Crypto
by Anonymous 17 Dec '03

17 Dec '03

Tales of the Crypto U.S. government works to replace Data Encryption Standard By Jim Kerstetter, PC Week Online 01.12.98 10:00 am ET The days of DES, which for the past 20 years has been the foundation for government and commercial cryptography around the world, are numbered. The U.S. government has embarked on an expansive project to replace the Data Encryption Standard. By the end of this year, a panel of cryptographers, headed by the National Institute of Standards and Technology, is expected to pick a new cryptographic algorithm to replace DES as the government's standard. The changeover to the new algorithm, to be called the Advanced Encryption Standard, won't happen overnight. In fact, the selection process could end up taking years. But whatever AES ultimately becomes, one thing is clear: The new standard will force major change for both the IT and developer communities. Anyone selling the government software that uses encryption for security will have to support the AES algorithm, which could become the standard for decades to come. Corporations conducting secure transactions with the government over the Internet will also have to rely on software that supports AES. And, in several years, AES could replace DES for private-key encryption in most commercial security algorithms. "Right now, I'm using PGP [Pretty Good Privacy] for some things. But the bulk of what we use here is with DES," said Paul O'Donnell, security manager at an Illinois manufacturer. "Should I be paying attention to what they [NIST] are doing? I suppose so." It's a change many say is overdue. DES was developed by IBM and the government in the 1970s. It was intended to last five to 10 years, said Dennis Branstad, an early DES developer for NIST's forerunner, the Institute of Computer Sciences and Technology. "It was a good algorithm. It turned out to be better than we thought," said Branstad, now director of cryptographic technologies at Trusted Information Systems Inc., in Glenwood, Md. "But it took longer to be accepted than we thought it would. There was no demand for it." DES is a symmetric, or private, key algorithm in which both the sender and receiver of a message must have a copy of the private key. It also can be used to encrypt data on a hard disk. It is found in an array of security protocols in the corporate world, ranging from secure E-mail software to virtual private network technology. DES' 56-bit private keys were unhackable until last year, when a nationwide network of computer users broke a DES key in 140 days--hardly an easy effort, but a harbinger of things to come as processing speed increases. Some experts now argue that it could take less than a week to break DES, with less than $100,000 worth of hardware. According to John Callas, chief technology officer of the Total Network Security Division of Network Associates Inc., a good hacker, with about $50,000 worth of specialty hardware, could crack a DES key in an hour. "Anybody who can afford a BMW can afford a DES cracker," said Callas, whose hypothesis will be tested in DES Challenge II this week at the RSA Data Security Conference, in San Francisco. Since most experts agree it's time to replace DES, the question becomes, Just what will AES be? Last summer, NIST released a 30-page document outlining its recommendations for a DES replacement and asking for submissions. There are three minimum technical criteria: The algorithm must be symmetric, or private, key. Public algorithms, such as elliptic curve (see related story) and Diffie-Hellman, though useful for authentication and the initial handshake between users, are considered too slow. The algorithm must be a "block cipher." Within the realm of symmetric keys there are two basic types of ciphers, block and stream. A block cipher, like DES, encrypts specific chunks of data. A stream cipher, like RSA Data Security Inc.'s RC4 algorithm, encrypts a steady flow of information. RC4 is the base encryption engine for Secure Sockets Layer, the security technology used in browsers. Some cryptographers are pushing NIST to consider stream ciphers because of their growing popularity. The algorithm has to be capable of supporting key lengths ranging from 128 bits to 256 bits and variable blocks of data. AES must also be efficient. Triple DES, a later version of the government's algorithm also developed by IBM, is far more secure than DES, running the 56-bit encryption three times. But that strength is also its weakness, because the repetition cycle slows it down considerably. Finally, the AES algorithm has to be made public and royalty-free. That could prove to be a sticking point for RSA, of Redwood City, Calif., which has traditionally held on to the royalties of its cryptographic creations. A conference at which cryptographers will present their algorithms is scheduled for this summer. And although NIST officials hope their analysis will be completed in 1998, many think it may take years to review the submittals, which are due by April 15. Major security vendors are noncommittal on proposing an algorithm. IBM, which created DES, with help from the National Security Agency, is hedging on whether it will participate. Triple DES is considered a likely entry, but its inefficiency could make it a difficult sell. Another IBM algorithm, DES/SK, could be in the running. RSA, if it decides to enter, could submit either its RC4 algorithm (the stream cipher) or RC5, which is a block cipher. Other likely competitors include Cast, a royalty-free algorithm controlled by Entrust Technologies Inc., or the unpatented Blowfish algorithm, created by Bruce Schneier. "It will be a standard for 20 to 30 years, in legacy systems for at least another 10, securing data that might need to be secured for at least another 20," Schneier wrote in a letter to NIST. "This means we are trying to estimate security in the year 2060. I can't estimate security 10 years from now, let alone 60. The only wise option is to be very conservative." A Data Encryption Standard primer What is DES? It was designed by IBM and endorsed by the U.S. government in 1977. What kind of encryption key does DES use? A symmetric, or private, key in which both the sender and the receiver know the key. It can also be used to encrypt data on a hard disk. What key length does DES use? 56 bits. Is DES safe? For most purposes, yes. But DES was hacked for the first time last year, and cryptographers worry that improved processing speeds will spell its demise.

1 0

HP BBS's? Telnet?
by Wardemon 17 Dec '03

17 Dec '03

Does anyone have any elite HP BBS's that I could telnet to ???? Thanks wardemon(a)erols.com

1 0

Re: rant on the morality of confidentiality (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Mon, 12 Jan 1998 19:14:05 -0800 > From: Blanc <blancw(a)cnw.com> > Subject: Re: rant on the morality of confidentiality > >something most anarchists here will deny is the existence of something > >that could be called *immoral science*. is there such a thing? > ............................................................ > > No. There are, however, immoral scientists. According to who? The scientist who is supposedly immoral? Obviously their actions aren't against their beliefs. The observer who is claiming it is immoral because they *believe* it to be immoral? Morality is a function of human psychology and not a fundamental result of existance. The relationship is similar to that between A, T, C, G, U and the genome. > actual manner of existence: "science" does not exist without those > individuals who have set themselves to pursue it. They should bear the > blame if they practice it immorally. Who is so moral that they may decide what is immoral? If you're a Christian the answer is simple 'judge not lest ye be judged'. Jesus stopped the stonning of an adulteress by saying that he who was without sin could throw the first stone. Since he was the only one without sin (by defintion in Christianity) he should have been the one to throw the first stone. What did he do? He sent everyone home with the admonishment to sin no more. > . being smart enough to pursue scientific research It doesn't necessarily take smarts. > . being successful in the scientific pursuit of truths What truths? Science isn't involved in 'truth' let alone 'Truth'. > . giving a damn about the consequences of the effects of research as it > affects humanity or other living things (as when it is imposed upon them) So you propose that ignorance of the consequences will some how protect us? > . responsibility in science Responsibility to who? The person(s) paying the bill, your fellow scientist, the society you live in, the world you inhabit, the generations to follow? > . responsibility in science as practiced by mendicants of the State Don't confuse working for the state as something that somehow mediates the basic tenents of science. If to get the job you may have to give up some scientific practices then at that point you aren't practicing science anymore. > . the regulation of the methods of science That's easy, the theories work when applied in experiments. > I become exceedingly uncomfortable at the realization that I have to buy an > astronomy magazine from the store, paying yet again for info, in order to > find out some of what they're doing at NASA. Try: www.nasa.gov jpl.nasa.gov or simply send email to Ron Baalke at JPL (you could call him on the phone if you don't mind paying the bill) > To think that a responsible > citizen like myself must go out searching for the info themselves, using > whatever resources they can find or pay for, in order to become informed! Why do they have a responsibility to drop it on your doorstep? > There is a book in Objectivist literature which presents the idea of What book? > "context dropping", which is, that in order for some people to function as > if things were normal and that what they're doing is consistent with moral > principles, they must drop a part of their information out of sight, out of > thought, so that their actions appear logically related and make sense - > they eliminate elements from the given context, crucial essentials which > make the difference in its character. People like these might practice > secrecy in keeping information from others, but equally significant, they > also hide things from themselves. Everyone is like that. It is one of the reasons science requires public dialog on its results. You can fool some of the people most of the time, most of the people some of the time, but you can't fool all the people all the time. Sooner or later somebody will notice the king (theory) is butt naked (doesn't work when applied in experiment). > It's possible for some people to override the boundaries of decency, even > if they're otherwise smart enough to pursue science. But what would you > expect cryptographers to do about it? Cryptographers are scientist also. ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

HP BBS's? Telnet? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > From: "Wardemon" <Wardemon(a)erols.com> > Subject: HP BBS's? Telnet? > Date: Mon, 12 Jan 1998 22:37:34 -0500 > Does anyone have any elite HP BBS's that I could telnet to ???? > Thanks I usualy use ftp.hp.com What version of HP/UX are you running? ____________________________________________________________________ | | | Those who make peaceful revolution impossible will make | | violent revolution inevitable. | | | | John F. Kennedy | | | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Talk of Banning Research into Human Cloning
by Brian B. Riley 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 1/12/98 3:32 PM, Tim May (tcmay(a)got.net) passed this wisdom: >Any implications for crypto? If Congress can successfully make >certain types of science illegal, felonizing the search for truth, >why not a ban on certain types of mathematics research? I think many of us are understandably nervous about the mistakes that could be made in the process of perfecting human cloning. But Tim's point is well taken, yet another potential 'slippery slope.' It also begs the question again of 'are we getting too paranoid?' I think the nanswer is still "no, not yet", as the Klinton administration proves to us almost every day it seems. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQEVAwUBNLroFD7r4fUXwraZAQF9Cwf6AtGeZgKDN3nwY0FMsxoTgwXgalRmjGJT gqliyEIdYfqcQK/kGTFYvBbcGd0xl1dr+XpmJXvr7ItQ8lrsyyqEozGC2KJGYpJe 7C8nMl/nf49Pd4UcJRNZb86qAdwAB7wERW7nL8aGB5Bzm46tKEeaAS2jrzxVOgIt z7ysxDd+VNoU2czWrergrhvDjbtnXKjPVcIfwkN0M57SJgdWqIlX/fo5HLuiw8IZ i/Qg8JsLXJgnWr5ZDgrSRSNgVqmwAaV8980piBGyqY0X9ytOcYdjV197+rz55Hkh iqzIQm6aQa5BJuDy3p8B44LlICtxFB0XZP1UdgvRCbFWO3YD8P3mOA== =O6Dk -----END PGP SIGNATURE----- Brian B. Riley --> http://members.macconnect.com/~brianbr For PGP Keys <mailto:brianbr@together.net?subject=Get%20PGP%20Key> "It's what you learn after you know it all that counts" John Wooden

2 1