December 2003 - cypherpunks-legacy

Re: CDT Policy Post 2.27 - No New News on Crypto: Gore Restates
by jim bell 17 Dec '03

17 Dec '03

At 10:17 AM 7/14/96 -0700, David Sternlight wrote: >At 7:05 AM -0700 7/13/96, Deranged Mutant wrote: >>This is particularly problematic... if the mainland Chinese gov't >>requested a key from a N.Amercian or European (or even UN controlled) >>escrow agency, who is to say it isn't really for political reasons >>(even though they may claim the persons are drug smugglers)? >> >>Or what if the 'crime' was, say, discussing Mormon beliefs, which is >>illegal in Singapore (and I think Russia as well)? >> >>Or what if some terrorist was using keys escrowed in a country that >>sponsered terrorist acts? > >Your best shot would be to make sure the part about the system being >voluntary was hard-wired into any legislation or rule-making. Wrong. Our "best shot" is to ensure that no "key escrow" legislation is adopted, and moreover export restrictions on crypto are eliminated. _THAT_ is "our best shot." The obvious problem with writing "voluntary" into any legislation (and thinking it actually means something!) is that there is a vast difference between the dictionary definition of the word "voluntary", and the way the USG would like to interpret it. I think most people define "voluntary" as something which is a free choice, devoid of coersion. But that's already damaged when the government's involved. Aside from robbing us of our assets in the form of taxes, the fact that it was able to do things like harass Phil Zimmermann for a few years (when, if there had been a "regulation" concerning writing encryption, it would have said, "writing encryption is unrestricted and VOLUNTARY") clearly proves that the government tries to do manipulate us regardless of friendly terminology like "voluntary." Clipper was always claimed to be "voluntary," but more recently they added to the restrictions, for example saying that a Clipper-type crypto phone can't be allowed to operate when connected to a non-escrow telephone. Again, the government is getting further and further away from "voluntary" as most of us understand the term. More importantly, I believe that the most fundamental right the public has is to be able to REFUSE a benefit. Let's suppose, hypothetically, that we "all" could agree that that GAK would provide net advantages and benefits to the public. I assert that despite this, the public is and should still be completely free to _refuse_ these benefits, and to go without GAK. This position, the truth of which is obvious to most of the readers of CP, would astonish and frustrate government employees and their sympathizers. Today, it appears that the vast majority of those that are paying attention to this issue agree that GAK is NOT desirable, and in any case they don't want it. The simple conclusion is that as long as we aren't supposed to have a dictatorship in this country, the will of the public to _refuse_ the claimed benefit should be respected and followed. Under those conditions, GAK wouldn't and couldn't happen. >Unless and until ITAR is modified by Congress, Congress didn't write ITAR, nor did it approve ITAR. However, the Burns crypto bill will, apparently, negate most if not all of the influence of ITAR on crypto. > the USG has what Mark Twain called "the >calm confidence of a Christian with four aces" on this matter. "A Smith and Wesson beats four aces." And if the government keeps pushing, it'll come to this. > That >is--unless and until Congress acts, the Administration has absolute >discretion with respect to the conditions under which they will liberalize >the administration of ITAR. That's not clear. The _constitutionality_ of the application of ITAR to encryption is challengeable in court, with or without any actions by Congress. So they DON'T have "absolute discretion." Furthermore, regulations must (at least theoretically) conform to law. Jim Bell jimbell(a)pacifier.com

2 1

Re: Markoff on Clipper III
by jim bell 17 Dec '03

17 Dec '03

At 02:33 PM 7/14/96 -0400, Duncan Frissell wrote: >On the Friday "Clipper III" rehash by the Admin: > >Balancing Privacy and Official Eavesdropping > > By JOHN MARKOFF > > "The president and vice president took an oath to protect our >national security," Simon said. "They feel they have to err on the side of >protecting national security." > > The government also said that it did not see an immediate >technical solution to the problems that would result from the global >proliferation of "strong cryptography." > >************** > >Last time I looked, the oath they took was to protect the Constitution -- >not the nation or national security. It's called "mission creep." And they didn't quite tell the truth: Their main loyalty is to "government security" or even "job security." >I don't see an "immediate technical solution" to strong crypto either. Or, >indeed, a long-term solution. Thank heavens for that! Jim Bell jimbell(a)pacifier.com

3 2

Re: CDT Policy Post 2.27 - No New News on Crypto: Gore Restates
by jim bell 17 Dec '03

17 Dec '03

At 02:06 PM 7/14/96 -0700, David Sternlight wrote: >At 2:37 PM -0700 7/14/96, jim bell wrote: >>At 10:17 AM 7/14/96 -0700, David Sternlight wrote: >>>Your best shot would be to make sure the part about the system being >>>voluntary was hard-wired into any legislation or rule-making. >> >>Wrong. Our "best shot" is to ensure that no "key escrow" legislation is >>adopted, and moreover export restrictions on crypto are eliminated. > >Nope. That's some people's preferred shot, but may not be the best one Okay, "best" by which definition? And don't avoid the question: Am I not free to reject YOUR opinion of what the "best" solution is FOR ME? >or even a realistic one. "Realistic"? Who's definition? >It's certainly a partisan political advocacy (in the >sense that people are partisan about this issue, not in the sense of a >particular political party). Meaningless tripe. All you're saying is that people disagree. People disagree about a lot of things; that doesn't legitimize opposing opinions. > Yet that attitude didn't get any legislation to stop Clipper I. We didn't NEED "any legislation to stop Clipper I." Quite the opposite, anyone promoting Clipper NEEDS legislation to force it on unwilling citizens. >My point was very simple--if the government is going to say a system is >voluntary, make them put it in writing in the rules or legislation. Why have the "system" in the first place? No legislation, no system. Simple. > We >failed to do that with Clipper I (when they said in non-rulesmaking >statements that they had no intention of making escrow mandatory--but >nobody said "OK. Put it in writing as a formal policy.") No, you're misrepresenting the issue: You're trying to subtly suggest that we should have agreed with MOST of the Clipper proposal AS LONG AS it was explicitly made voluntary. (Yet nothing prevents Congress from writing and passing a law which prohibits the executive branch of government from making escrow mandatory; they haven't done this.) Quite the contrary: I don't trust the government to implement any such proposal EVEN IF it is, ostensibly, "voluntary." The voluntary/involuntary aspect is an excellent reason to oppose Clipper, but is by no means the only one. Also, I don't trust the government's definition (and dynamically changeable interpretation) of the word, "voluntary." Since Clipper was funded with tax dollars stolen from the public its very existence is already a violation of the "voluntary" requirement. The fact that Clipper was developed without substantial public (and I mean PUBLIC, not some selected committee of bootlickers) input and debate proves that the government knew it could get no support for the idea. One of the recently revealing aspects of the government's dishonesty concerning Clipper was a clarification which stated that Clipper telephones could not communicate with any crypto telephone that didn't implement key escrow. But as anyone who followed the Beta vs. VHS competition saw, the market generally abhors two mutually incompatible standards, particularly if a certain level of compatibility is required or is at least desirable, and particularly if there is no good reason to maintain BOTH those standads. The main disadvantages to maintaining two tape formats was the inconvenience of sharing tapes with people who had the opposite format, the requirement that retail stores maintain two stocks, and the requirement that rental people support both formats. There were no powerful incentives to maintain two standards, and thus one had to die. Crypto telephones, by definition, need to be far more compatible with each other than VCR machines. They must actually talk to each other. Imagine a world in which there were two different crypto formats, and for stupid political reasons they were entirely incompatible: System "A" couldn't talk to system "B." What would happen? It's obvious: One format would kill the other. People wouldn't tolerate the compatibility. The US Government wanted the surviving system to be Clipper, and to accomplish this they used stolen tax dollars to secretly develop a system that they hoped would nip the potential competing systems in the bud. It didn't work, of course, but it is clear what they tried to do. If, on the other hand, there was no impediment to system "A" talking to system "B", both systems could easily co-exist. A few suckers would buy Clipper phones; the rest of us would insist on good encryption. Clipper would eventually die, just as Beta VCR's eventually did. The government understands this, that's why they inserted the requirement for incompatibility. >. As a result, many >in government even at the higher policy-making levels are still calling for >mandatory escrow. Had it been in the rules, it's less likely they could >have overtly gone against a rules-making covenant/compromise. Hmmmm... I thought Congress made arming the Contras in Nicaragua explicitly illegal. Yet Ollie North got away with it, effectively. What is it that makes you so certain that Government has gotten any more honest in the past 10 years? >It's simple pragmatic regulatory politics. And that's exactly the problem! That's because it's also wrong. We don't need to be "pragmatic" by YOUR definition. >It's how the system works, Actually, in the past the system has "worked" by suckering in the public, in exactly the way you're attempting to do. Tricking them into supporting things that were bad for them. Remember the "Gulf of Tonkin Resolution"? > and >using the system itself to achieve one's goals is one of the more powerful >techniques around. You don't have to like it, but you do have to decide >whether you'd rather be "right" or get the result. In a sense, we ALREADY have "the result," or at least a substantial fraction of it. Development of domestic crypto is ostensibly free. The only thing desired further in the elimination of any residual restrictions, WITHOUT letting the government set up any sort of key-escrow system, voluntary OR involuntary. As far as I can see, cooperation at this point with the pro-GAK forces can only hurt the cause. Jim Bell jimbell(a)pacifier.com

2 1

Clipper III.2 paper URL
by Dave Banisar 17 Dec '03

17 Dec '03

Its now up at http://www.epic.org/crypto/key_escrow/wh_cke_796.html -d

1 0

Organized Crime Home Page - Four Horsemen, No Waiting
by Alan Bostick 17 Dec '03

17 Dec '03

Cypherpunks interested in establishment scaremongering are invited to take a look at the Organized Crime Home Page (http://www.alternatives.com/crime/index.html) sponsored by a group called The Committee for a Safe Society, about the world-wide threat of organized crime. Apparently every evil known to post-Cold-War society, even the bad weather in Chicago, is the responsibility of organized crime. Now you know why governments need GAK. Alan-Bob says check it out. -- Alan Bostick | [Spielberg's] latest is TWISTER, a film that mailto:abostick@netcom.com | gives whole new meaning to the phrase "giant news:alt.grelb | sucking sound." -- Patrick Taggart http://www.alumni.caltech.edu/~abostick

2 2

PKI Documents
by jya＠pipeline.com 17 Dec '03

17 Dec '03

http://csrc.ncsl.nist.gov/pki/ ---------- Public Key Infrastructure Pardon our mess. This page is under construction. Additional files, and additional formats, will be added in the near future. Your patience is appreciated! The following documents are products of the Federal PKI Steering Committee's Technical Working Group. Together, they comprise Version 1 of the Technical Specifications for the Federal PKI. + Requirements for the Federal Public Infrastructure (PostScript) [265366 bytes] This is Part A: of the Technical Specifications, the Draft Requirements for the Federal PKI. + Technical Security Policy for the Federal PKI (PostScript) [163543 bytes] This is Part B: of the Technical Specifications, the Draft Technical Security Policy for the Federal PKI. + Proposed Federal PKI Concept of Operations (PostScript) [980672 bytes] This is the Part C: of Technical Specifications, the Concept of Operations for the Federal PKI. + Interoperability Profile (PostScript) [746328 bytes] This is Part D: of the Technical Specifications, Draft Interoperability Profiles for the Federal PKI. Contractor Reports: the following reports were developed by contractors for NIST. These reports do not constitute government positions, but rather detail the advice and guidance provided to the government regarding public key infrastructure. + The 1994 Mitre PKI Study Final Report. [1461396 bytes] This report describes a federal PKI based on a strict hierarchical architecture, using X.509 version 2 certificates. + A Public Key Infrastructure for Unclassified but Sensitive Applications. [946734 bytes] This 1995 report describes a federal PKI based on a network architecture using the X.509 version 3 certificate. [End]

1 0

GIB_ber
by jya＠pipeline.com 17 Dec '03

17 Dec '03

6-13-96. NYP: Markoff: "Clinton Proposes Initiatives On the Scrambling of Data." Under increasing pressure from Congress and the computer industry, the Clinton Administration proposed a series of new data-scrambling policy initiatives yesterday that it said would address the Government's national security concerns while also permitting American companies to compete more effectively overseas. 6-14-96. NYP: William Gibson: "The Net Is a Waste of Time. And that's exactly what's right about it." The Web, in its clumsy, larval, curiously innocent way, offers us the opportunity to waste time, to wander aimlessly, to daydream about the countless other lives, the other people, on the far sides of however many monitors in that postgeographical meta-country we increasingly call home. It will probably evolve into something considerably less random, but in the meantime, in its gloriously unsorted Global Ham Television Postcard Universes phase, surfing the Web is a procrastinator's dream. And people who see you doing it might even imagine you're working. http://pwp.usa.pipeline.com/~jya/gibber.txt (13 kb for 2) GIB_ber (for 2)

1 0

HotWired -- "Crypto Storm Warning"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sun, 14 Jul 1996 20:19:33 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship+(a)andrew.cmu.edu Subject: HotWired -- "Crypto Storm Warning" >From Monday's The Netizen on HotWired. Read the full text at the URL below. Gorelick spoke last Friday at the Freedom Forum in Virginia. -Declan --- http://www.netizen.com/netizen/96/29/campaign_dispatch0a.html HotWired The Netizen "Crypto Storm Warning" Campaign Dispatch by Declan McCullagh (declan(a)well.com) Washington, DC, 14 July The Clinton administration escalated its cyber-fearstorm today when a top Justice Department lawyer slammed the Net for "transmitting child pornography into our homes" and for allowing hackers to possibly "shut down the banking system." [...] At the same time, [Jamie] Gorelick edged away from the hard-line rhetoric the administration used to defend the Communications Decency Act. [...] Gorelick's cybercondemnations play against a backdrop of political jockeying inside the Justice Department. Reno disclosed last November that she has Parkinson's disease, and Gorelick is her logical successor if Clinton stays in office next term. [...] After Gorelick completed her speech and sat down, I leaned over and asked her: "Could I have your email address?" She didn't know it. "I don't go into it that often," Gorelick said, adding that the Justice Department doesn't use email much, for "security reasons." "Call me and I'll give it to you," she promised. Gosh, what a surprise: The US government's leading spokesperson on the dangers and the evils of the Net doesn't even log in.

1 0

How I Would Ban Strong Crypto in the U.S.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:18 AM 7/15/96, Dave Banisar wrote: >Its now up at http://www.epic.org/crypto/key_escrow/wh_cke_796.html > Thanks. I took an initial look, and it looks like the same old stuff. The report speaks of an "emerging consensus" (for key escrow). I see just the opposite, unless the report is speaking only of the U.S. intelligence and law enforcement community and its foreign counterparts. Business has made it clear (cf. the several recent reports) that it is opposed to the Administration's plan, and that if a market for some form of key escrow exists (as it certainly does, in specific contexts), that the market can supply the solution. And certainly the civil liberties groups and groups such as ourselves are not part of this "emerging consensus." Ditto for the "average man in the street," as evidenced by opinion polls (I recall 80% opposition reported by one of the newsweeklies, but don't quote me), by anecdotal reports (e.g., Zimmermann's tale of his discussions), and by opposition to Clipper I, Clipper II, and now Clipper III. A bunch of Congressmen, including the axis supporting the Burns bill, obviously are not part of this emerging consensus. The National Research Council report made it clear that a distinguished panel of cryptographers, computer scientists, and policy professionals did not think key escrow is desirable. And the hundreds of folks in attendance at recent SAFE and NRC travelling roadshows were obviously not in support of key escrow. Business, civil liberties groups, professional organizations, and most Net people are opposed to the Administration's key ecrow proposals (such as they are understood to be, in Clipper I/II/III). So, who is in this "emerging consensus"? Moving on to the wisdom of imposing a government solution to what either is or is not a market need, there is great danger in deploying even a nominally (at this time) "voluntary standard." This is a danger many of us have felt for years to be the main danger of nominally (and ostensibly) "voluntary" systems. Imagine a voluntary system supported and funded by the government, using its power to limit exports and to "jawbone" foreign governments. (No time here to examine the obvious issues--cf. the archives for many explications over the past several years.) Once widely deployed, and perhaps mandatory in countries like France, Singapore, Iraq, and the like, it would take very little more to simply pass a law restricting the non-escrowed alternative in the U.S. (Sure, such a law might be unconstitutional, for the reasons we so often discuss. Sure, there are many circumventions possible. Sure. The point is not to rehash these points again but to indicate why Cypherpunks and civil libertarians should NOT support any plan, even a "voluntary" plan, that puts such power to set standards in the hands of the government. Even a "signed promise" is not enough, given the dangers of "flipping a switch.") Is this a plausible scenario, though? Well, were I in the LEA/TLA community, this is what my fallback plan would probably be. Realizing that a full-frontal ban on strong crypto, or crypto without backdoors, would not fly at this time (unless Oklahoma II happens, in which case all bets are off), and realizing that the plans for Clippers I, II, and III have been fizzling, I would push for a relatively harmless-sounding "voluntary key escrow" plan. I would push hard on Netscape, Microsoft, Novell, Sun, Apple, and the other companies (but mainly on Netscape and MS, for obvious reasons) to bundle in "trusted third parties" and all that GAK stuff. Bundle it in, make it easy to use, make it easy to export, make it easy to spread in crypto-hostile countries, and hope like hell that it undermines the push for PGP and S/MIME. I would work closely with Mossad, GCHQ, SDECE, Chobetsu, Savak, and all the other secret policemen of the world to make sure that while America might remain an "island of strong crypto" for a while at least, that the same could not be said of other countries. That is, I would work to help them limit crypto use in their own countries to GAK-only forms. (Those pesky survivalists, militia members, and ACLU folks in America could keep using their Bass-o-matic and PGP tools, but most of the rest of the world would be mostly limited to GAK and New World Order software.) Then, in about 2002 or so, depending on how many more serious terrorist incidents have occurred, I would drop the hammer on strong crypto. Maybe an Executive Order, maybe a state of national emergency, maybe a liberal interpretation of the commerce clause, maybe an Act of Congress.... Once a New World Order-approved GAK system is widely deployed, outlawing of "rogue cryptography" in the U.S. is more manageable. That's what I would do. (But not being on that side of the ideological fence, I will instead fight GAK as I always have. And I will not be fooled by talk of how "Americans will always be free any form of cryptography." Not when those same reports from the Administration, and the testimony of Louis Freeh, etc., is in the same breath taling about the need to stop pornographers from encrypting their files, and so forth. Do they think we're stupid?) Don't be fooled. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

10 10

Re: CDT Policy Post 2.27 - No New News on Crypto: Gore Restates
by clark 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: david(a)sternlight.com, jimbell(a)pacifier.com, cypherpunks(a)toad.com Date: Sun Jul 14 23:08:09 1996 > At 4:48 PM -0700 7/14/96, jim bell wrote a typically argumentative > message. > I've gotten wiser over time and don't plan to respond. I think both our > positions are quite clear and readers may make up their own minds. > > This post is a courtesy to others who may have been expecting more. It's > a > one-time statement to this list, which I've just joined, of my current > practice: Silence does not constitute assent. > > David More time required, apparently. Professional liars will put anything in writing. Judas' Sheep, too. Compromise is surrender. ec -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMenELqr9Bm6Zdjx5AQE4XQf+Je9KZ+3sVL+tACTfTxjqmnuzaq4XNvAN oH92/O5f4ilWYomeacqXYuEmc7Owk2bAVIA3IO2ZxbbBBKkb8Gy4xILEVyzVC825 +FDccpwwNETkVWGaLcoo8h7FHuWnNTfVmQ23IyTo7lIYy7g3Fkr4KJPBac4BInv4 GRy5qazCrLMEXHT0VHOrNsi+cCejlGBQAkrwqWNFonNVr3+FpZY9+Yo8AZGWTiPY d7yTWlFbAIANXLshSHatsVAb9uKTIzJeosGM9Hhq6hK9rYBXJhcfHat+7SkOKzJI we6Hgg4D/TVzLmJAo3X8yUPDDDm9YyA2RbdF1FLZg6qzYr+vvSjuTg== =2/4c -----END PGP SIGNATURE-----

1 0