December 2003 - cypherpunks-legacy

Clipper III.2 paper URL
by Dave Banisar 17 Dec '03

17 Dec '03

Its now up at http://www.epic.org/crypto/key_escrow/wh_cke_796.html -d

1 0

Organized Crime Home Page - Four Horsemen, No Waiting
by Alan Bostick 17 Dec '03

17 Dec '03

Cypherpunks interested in establishment scaremongering are invited to take a look at the Organized Crime Home Page (http://www.alternatives.com/crime/index.html) sponsored by a group called The Committee for a Safe Society, about the world-wide threat of organized crime. Apparently every evil known to post-Cold-War society, even the bad weather in Chicago, is the responsibility of organized crime. Now you know why governments need GAK. Alan-Bob says check it out. -- Alan Bostick | [Spielberg's] latest is TWISTER, a film that mailto:abostick@netcom.com | gives whole new meaning to the phrase "giant news:alt.grelb | sucking sound." -- Patrick Taggart http://www.alumni.caltech.edu/~abostick

2 2

PKI Documents
by jya＠pipeline.com 17 Dec '03

17 Dec '03

http://csrc.ncsl.nist.gov/pki/ ---------- Public Key Infrastructure Pardon our mess. This page is under construction. Additional files, and additional formats, will be added in the near future. Your patience is appreciated! The following documents are products of the Federal PKI Steering Committee's Technical Working Group. Together, they comprise Version 1 of the Technical Specifications for the Federal PKI. + Requirements for the Federal Public Infrastructure (PostScript) [265366 bytes] This is Part A: of the Technical Specifications, the Draft Requirements for the Federal PKI. + Technical Security Policy for the Federal PKI (PostScript) [163543 bytes] This is Part B: of the Technical Specifications, the Draft Technical Security Policy for the Federal PKI. + Proposed Federal PKI Concept of Operations (PostScript) [980672 bytes] This is the Part C: of Technical Specifications, the Concept of Operations for the Federal PKI. + Interoperability Profile (PostScript) [746328 bytes] This is Part D: of the Technical Specifications, Draft Interoperability Profiles for the Federal PKI. Contractor Reports: the following reports were developed by contractors for NIST. These reports do not constitute government positions, but rather detail the advice and guidance provided to the government regarding public key infrastructure. + The 1994 Mitre PKI Study Final Report. [1461396 bytes] This report describes a federal PKI based on a strict hierarchical architecture, using X.509 version 2 certificates. + A Public Key Infrastructure for Unclassified but Sensitive Applications. [946734 bytes] This 1995 report describes a federal PKI based on a network architecture using the X.509 version 3 certificate. [End]

1 0

GIB_ber
by jya＠pipeline.com 17 Dec '03

17 Dec '03

6-13-96. NYP: Markoff: "Clinton Proposes Initiatives On the Scrambling of Data." Under increasing pressure from Congress and the computer industry, the Clinton Administration proposed a series of new data-scrambling policy initiatives yesterday that it said would address the Government's national security concerns while also permitting American companies to compete more effectively overseas. 6-14-96. NYP: William Gibson: "The Net Is a Waste of Time. And that's exactly what's right about it." The Web, in its clumsy, larval, curiously innocent way, offers us the opportunity to waste time, to wander aimlessly, to daydream about the countless other lives, the other people, on the far sides of however many monitors in that postgeographical meta-country we increasingly call home. It will probably evolve into something considerably less random, but in the meantime, in its gloriously unsorted Global Ham Television Postcard Universes phase, surfing the Web is a procrastinator's dream. And people who see you doing it might even imagine you're working. http://pwp.usa.pipeline.com/~jya/gibber.txt (13 kb for 2) GIB_ber (for 2)

1 0

HotWired -- "Crypto Storm Warning"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sun, 14 Jul 1996 20:19:33 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship+(a)andrew.cmu.edu Subject: HotWired -- "Crypto Storm Warning" >From Monday's The Netizen on HotWired. Read the full text at the URL below. Gorelick spoke last Friday at the Freedom Forum in Virginia. -Declan --- http://www.netizen.com/netizen/96/29/campaign_dispatch0a.html HotWired The Netizen "Crypto Storm Warning" Campaign Dispatch by Declan McCullagh (declan(a)well.com) Washington, DC, 14 July The Clinton administration escalated its cyber-fearstorm today when a top Justice Department lawyer slammed the Net for "transmitting child pornography into our homes" and for allowing hackers to possibly "shut down the banking system." [...] At the same time, [Jamie] Gorelick edged away from the hard-line rhetoric the administration used to defend the Communications Decency Act. [...] Gorelick's cybercondemnations play against a backdrop of political jockeying inside the Justice Department. Reno disclosed last November that she has Parkinson's disease, and Gorelick is her logical successor if Clinton stays in office next term. [...] After Gorelick completed her speech and sat down, I leaned over and asked her: "Could I have your email address?" She didn't know it. "I don't go into it that often," Gorelick said, adding that the Justice Department doesn't use email much, for "security reasons." "Call me and I'll give it to you," she promised. Gosh, what a surprise: The US government's leading spokesperson on the dangers and the evils of the Net doesn't even log in.

1 0

How I Would Ban Strong Crypto in the U.S.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:18 AM 7/15/96, Dave Banisar wrote: >Its now up at http://www.epic.org/crypto/key_escrow/wh_cke_796.html > Thanks. I took an initial look, and it looks like the same old stuff. The report speaks of an "emerging consensus" (for key escrow). I see just the opposite, unless the report is speaking only of the U.S. intelligence and law enforcement community and its foreign counterparts. Business has made it clear (cf. the several recent reports) that it is opposed to the Administration's plan, and that if a market for some form of key escrow exists (as it certainly does, in specific contexts), that the market can supply the solution. And certainly the civil liberties groups and groups such as ourselves are not part of this "emerging consensus." Ditto for the "average man in the street," as evidenced by opinion polls (I recall 80% opposition reported by one of the newsweeklies, but don't quote me), by anecdotal reports (e.g., Zimmermann's tale of his discussions), and by opposition to Clipper I, Clipper II, and now Clipper III. A bunch of Congressmen, including the axis supporting the Burns bill, obviously are not part of this emerging consensus. The National Research Council report made it clear that a distinguished panel of cryptographers, computer scientists, and policy professionals did not think key escrow is desirable. And the hundreds of folks in attendance at recent SAFE and NRC travelling roadshows were obviously not in support of key escrow. Business, civil liberties groups, professional organizations, and most Net people are opposed to the Administration's key ecrow proposals (such as they are understood to be, in Clipper I/II/III). So, who is in this "emerging consensus"? Moving on to the wisdom of imposing a government solution to what either is or is not a market need, there is great danger in deploying even a nominally (at this time) "voluntary standard." This is a danger many of us have felt for years to be the main danger of nominally (and ostensibly) "voluntary" systems. Imagine a voluntary system supported and funded by the government, using its power to limit exports and to "jawbone" foreign governments. (No time here to examine the obvious issues--cf. the archives for many explications over the past several years.) Once widely deployed, and perhaps mandatory in countries like France, Singapore, Iraq, and the like, it would take very little more to simply pass a law restricting the non-escrowed alternative in the U.S. (Sure, such a law might be unconstitutional, for the reasons we so often discuss. Sure, there are many circumventions possible. Sure. The point is not to rehash these points again but to indicate why Cypherpunks and civil libertarians should NOT support any plan, even a "voluntary" plan, that puts such power to set standards in the hands of the government. Even a "signed promise" is not enough, given the dangers of "flipping a switch.") Is this a plausible scenario, though? Well, were I in the LEA/TLA community, this is what my fallback plan would probably be. Realizing that a full-frontal ban on strong crypto, or crypto without backdoors, would not fly at this time (unless Oklahoma II happens, in which case all bets are off), and realizing that the plans for Clippers I, II, and III have been fizzling, I would push for a relatively harmless-sounding "voluntary key escrow" plan. I would push hard on Netscape, Microsoft, Novell, Sun, Apple, and the other companies (but mainly on Netscape and MS, for obvious reasons) to bundle in "trusted third parties" and all that GAK stuff. Bundle it in, make it easy to use, make it easy to export, make it easy to spread in crypto-hostile countries, and hope like hell that it undermines the push for PGP and S/MIME. I would work closely with Mossad, GCHQ, SDECE, Chobetsu, Savak, and all the other secret policemen of the world to make sure that while America might remain an "island of strong crypto" for a while at least, that the same could not be said of other countries. That is, I would work to help them limit crypto use in their own countries to GAK-only forms. (Those pesky survivalists, militia members, and ACLU folks in America could keep using their Bass-o-matic and PGP tools, but most of the rest of the world would be mostly limited to GAK and New World Order software.) Then, in about 2002 or so, depending on how many more serious terrorist incidents have occurred, I would drop the hammer on strong crypto. Maybe an Executive Order, maybe a state of national emergency, maybe a liberal interpretation of the commerce clause, maybe an Act of Congress.... Once a New World Order-approved GAK system is widely deployed, outlawing of "rogue cryptography" in the U.S. is more manageable. That's what I would do. (But not being on that side of the ideological fence, I will instead fight GAK as I always have. And I will not be fooled by talk of how "Americans will always be free any form of cryptography." Not when those same reports from the Administration, and the testimony of Louis Freeh, etc., is in the same breath taling about the need to stop pornographers from encrypting their files, and so forth. Do they think we're stupid?) Don't be fooled. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

10 10

Re: CDT Policy Post 2.27 - No New News on Crypto: Gore Restates
by clark 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: david(a)sternlight.com, jimbell(a)pacifier.com, cypherpunks(a)toad.com Date: Sun Jul 14 23:08:09 1996 > At 4:48 PM -0700 7/14/96, jim bell wrote a typically argumentative > message. > I've gotten wiser over time and don't plan to respond. I think both our > positions are quite clear and readers may make up their own minds. > > This post is a courtesy to others who may have been expecting more. It's > a > one-time statement to this list, which I've just joined, of my current > practice: Silence does not constitute assent. > > David More time required, apparently. Professional liars will put anything in writing. Judas' Sheep, too. Compromise is surrender. ec -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMenELqr9Bm6Zdjx5AQE4XQf+Je9KZ+3sVL+tACTfTxjqmnuzaq4XNvAN oH92/O5f4ilWYomeacqXYuEmc7Owk2bAVIA3IO2ZxbbBBKkb8Gy4xILEVyzVC825 +FDccpwwNETkVWGaLcoo8h7FHuWnNTfVmQ23IyTo7lIYy7g3Fkr4KJPBac4BInv4 GRy5qazCrLMEXHT0VHOrNsi+cCejlGBQAkrwqWNFonNVr3+FpZY9+Yo8AZGWTiPY d7yTWlFbAIANXLshSHatsVAb9uKTIzJeosGM9Hhq6hK9rYBXJhcfHat+7SkOKzJI we6Hgg4D/TVzLmJAo3X8yUPDDDm9YyA2RbdF1FLZg6qzYr+vvSjuTg== =2/4c -----END PGP SIGNATURE-----

1 0

Re: [NOISE, FLAME] Cypherpunk kook slanders
by Alan Olsen 17 Dec '03

17 Dec '03

At 12:23 PM 7/14/96 EDT, Dr.Dimitri Vulis KOTM wrote: [Alot of bullshit deleted] >I remember how someone recently argued on news.groups that Bruce Bough's votes >should be invalidated because he's dying from AIDS. I strongly disagree with >Dan's (?) reasoning, which was, I recall, that someone with only a couple of >months left to live shouldn't be telling others how to run Usenet after his >death. I think we should consider Bruce's opinions as being representative. >After all, a Usenet vote is an interest poll, and the voters are just a sample >of a larger population. Not everyone who thinks like Bruce Bough is going to >die together with him from AIDS within a few months (sigh). Let him vote. I have no idea where you got the idea that Bruce has AIDS. I know Bruce well. He does not have AIDS. You have no clue as to what the hell you are talking about. I understand him being pissed at the accusation. This society does not deal very well with people with AIDS. Bruce has a justifiable concern as to lasting damage to his reputation due to unfounded allegations. (Of course, it is not as bad as accusing someone of being a child mollester, as your friend Dr. Grubor enjoys doing to people he disagrees with...) Bruce *does* have health problems. He has worked DAMN hard to overcome them. They are not a figment of his imagination, nor are they the result of AIDS. They are a very real problem which he is trying to deal with in the best way he can. As for him "dragging outside articles into this group"... You must mean him mentioning your recieval of the "Net Kook of the Month Award". It probably was off topic. After reading your forwards however, it was not undeserved. Another thing that you need to do is learn how to comprehend written english. You stated: >In article 2, Bruce Bough follows up on my article and threatens to prosecute >me under the Americans with Disability Act for misspelling his name. He did nothing of the sort. He threatened to prosecute you for slandering him (by stating he has AIDS when he does not), not for the spelling of his name. He stated: >Further, you might want to read up on the Americans With Disabilities >Act. Slanderous and defamatory statements about the handicapped - and my >government agrees that I do have a real problem, though it's not AIDS - >open you up to interesting liability. I don't understand why you feel the need to cast aspersions on those you disagree with. But you should not be surprised when it pisses people off. Bruce is a very nice guy who has some health problems. I know few people who have met him who have not gotten along with him. Why I should take the word of someone with your attitude over his is unclear to me. Acting like an asshole does not gain any sympathy for your cause. Bruce has killfiled you. I do not blame him. You remade my killfile list as well. Get a life. --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

2 1

Clueless "Attachment converted" uses
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:48 AM 7/15/96, Gregory A Empey wrote: >On Thu, 20 Jun 1996 10:55:29 -0800 jim bell <jimbell(a)pacifier.com> >writes: >>At 10:59 AM 6/20/96 -0400, Intense wrote: >>> >>>does not matter - it will be renewed in the interest of the >>government >>>The goverment want's there backdoor... would you expect less? >> >>As far as I know, patents can't be "renewed." I've heard they can be >>"re-issued," amended, but to my knowledge that doesn't extend their >>term. >> >>Jim Bell >>jimbell(a)pacifier.com >> > > >Attachment converted: Macintosh HD:UUE.DOC (WDBN/MSWD) (0000FAD8) OK, I _usually_ delete these "Attachment converted" messages, which (fortunately) deletes the attachment in my "Attachments" folder, but for some reason this time I fired up my word processor and opened the attachment. All I found was this crap: "Hey, im ready to seriously f*ck-up MCI for no apparent reason, and im also giving credit card (and calling card) #'s away for no apparent reason, just reply to skitzo(a)juno.com." I urge people to NOT use attachments when ordinary plain text will obviously work. There's a time and a place for richly formatted messages, a la MIME, but not on a mailing list with heterogeneous platforms, mailers, and varying graphics capabilities. Think of our mailing list as being like Usenet, where graphics messages and oddball formats are frowned upon (except in the binaries groups, and a few of the non-English language groups). And especially not clueless nonsense like this call for "fucking up MCI." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3

Re: Reasonable validation of a software package
by frantz＠netcom.com 17 Dec '03

17 Dec '03

I expect this problem can usually be handled without formal CAs. If you publish your PGP key fingerprint in your advertising and make the key available on your web page, then your users have a way of independently verifying your key. As the finger print appears in more and more places (letterhead, product packaging, etc.), it is less and less likely that your attacker can reach them all to modify them. The important thing is diverse paths. If you include your key in the package with the product and print the fingerprint on the outside, it becomes relatively easier for your attacker to replace the whole thing as part of an attack. At 11:33 AM 7/13/96 -0400, Michael Froomkin wrote: >This illustrates the need for and role of certification authorities. > >See http://www.law.miami.edu/~froomkin/articles/trusted.htm for some >info. > >On Sat, 13 Jul 1996, Lyal Collins wrote: > >> This touches upon a favourite rant of mine. >[...] >> So, now you need to ensure that you can get your public key >> (to verify the digital signature with) in the hands of all >> your possible, or intended, recipients. >> >> Now the race is on for as many people as possible to generate >> PGP public keys/certificates bearing your name, or variations >> of it. Once that occurs, there is a fair chance that one of >> these keys will verfiy the digital signature on a piece of >> software purportedly from you. Still, not many people will have >> your true PGP public key/certificate, but, them's the breaks. ------------------------------------------------------------------------- Bill Frantz | The Internet may fairly be | Periwinkle -- Consulting (408)356-8506 | regarded as a never-ending | 16345 Englewood Ave. frantz(a)netcom.com | worldwide conversation. | Los Gatos, CA 95032, USA

1 0