December 2003 - cypherpunks-legacy

Re:NT remailer
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 21:08 8/16/96, rednax wrote: >Speaking of NT, I downloaded the full version of msie 3.0 the other day but >when I tried installing it, an error message came up saying that it requires >a Win95 or WinNT4.0 build of 1381 or higher. I am currently running NT 4.0b >that has a build of 1314, does anyone know of where is the upgrade or >service packs(if available)? I have tried looking around microsoft.com, but >they neither provided any detail nor did they provide an e-mail. USENET? Just a thought, -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: key escrow idea from David Staelin of MIT Lincoln Labs
by Bill Stewart 17 Dec '03

17 Dec '03

Matt Blaze posted Ron Rivest's summary of Dave Staelin's suggestion for a different type of Government Access to Keys (GAK) policy, and Rivest's proposed variant and analysis, and there's been some discussion on the Cypherpunks list, including the usual "GAK is evil, period", plus commentary on the variations. Below I suggest a variant on Ron's variant that's less evil, though less desireable to the government than Ron's. R(S)>Here is Staelin's idea: R(S)> (1) You can use any crypto you want, but you must keep a record R(S)> of the crypto keys you used. R(S)> (2) The government can ask for the crypto keys later, if they have R(S)> a court order, just as they can ask for any of your other papers R(S)> or documents. You must give the key(s) to them, just as you R(S)> must turn over your private papers in such a situation. For technical reasons, this is a non-starter. Storing keys requires memory, and many practical cryptosystems need to generate large numbers of keys, or run in environments such as cellphones and password-calculators that don't _have_ any available memory. Storing lots of keys implies a high probability of losing lots of keys, and Matt's talked about the difficulty of storing keys securely. Non-technically, as was discussed, US citizens aren't required to keep personal papers or documents, though businesses are required to keep some tax and rule-compliance records, and taxpayers who want to claim deductions need to keep relevant records. Ron's trusted third party variant: R>In a variant of Staelin's proposal (my twist) you could append to each R>encrypted message an encrypted form of the message key. The R>encryption could be with the public-key of a trusted third party who R>will not (and legally may not) reveal the message key without R>notifying you first (or ensuring that you have been appropriately R>served with the corresponding warrant). For example, the ACLU might Stewart's untrusted first party variants: Why a trusted _third_ party? I don't trust third parties with my calls. Have the sender generate, and keep, a Master Key, and append the session key encrypted with the Master Key. As with Staelin's method, the government can subpoena or warrant the master key. (So you can call it a Self-Incrimination Key if you like.) If you use a public key for the SIK, there's the time and space required to do public-key encryption, but the session keys for each session can be decrypted separately by the sender, and verified by the court, without needing to turn over the private key. If you use a secret key for the SIK, it's fast and small, though the SIK needs to be protected and one subpoena decrypts all conversations made with the key (as does a warrant seizing the phone.) (It's basically Clipper with the user instead of NSA generating master keys, and the user instead of the Friends Of The NSA storing them.) An intermediate is to use a secret SIK for a small-to-medium number of sessions, and public-key Master SIK used to generate an encrypted SIK sent with each message as well as the SIK-encrypted session key. It's still bulky, like the full public-key version, but not as slow, since you can generate and encrypt secret-SIK keys off-line. As with Staelin's proposal, mine also doesn't give the government real-time access, only after-the-fact access, but it doesn't have most of the technical difficulties of secure, reliable used-key storage (hmmm - sounds kind of like a sharps-box for used needles :-) R>CONCLUSION R>The fundamental idea is to give the government a right to access R>encrypted communication in return for a guarantee that access may not R>be obtained until there is BOTH proper legal authorization AND proper R>prior notice to (at least one of) the communicants. R>Is this workable?? As Matt says: M>While Ron's twist decreases some of the burden on the user it M>eliminates the main benefit of the Staelin proposal - that one M>cannot obtain cleartext without the knowledge of at least one party. Agreed - while Ron's proposal asserts that the TTP is forbidden to reveal the key to the government without also telling the owner, current government wiretap laws often require just the opposite, and even if the government initially changed their policy to require TTPs to tell users, they could rapidly change back. The only way to guarantee that prior notice (or post-access notice) is for the protocol to require the user's participation, which inherently makes it non-real-time and gives the user the ability to refuse (at whatever cost.) Also, "to give the government a right to access" implies that they don't have that right today (which I agree with but Louis Freeh doesn't), and that we _should_ give them that right when we don't have to (which Dorothy Denning would agree with but I don't) and that a Trusted Government Guarantee (TGG) is a good enough payment in return. And if you retain the word "voluntary", as used by Ron, you need to convince a Bad Guy or an Innocent Guy to believe a TGG or TTP - Bad Guys won't, and Innocent Guys, as Ed Meese said, "usually aren't suspects", so it's still no-win for the government. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

1 0

No Subject
by nobody＠replay.com 17 Dec '03

17 Dec '03

At 11:05 PM 8/16/96 -0400, you wrote: >There are many computer companies that are full of Bozos, >Microsoft isn't one of them. Most of the people griping about >Microsoft can't code any better. Gee Phill, as I'm preparing to leave MS after 6 years, I have to disagree with you. Mediocrity and bureaucracy have eatten away at a lot of the core of the company. It is entirely marketing driven now, and the coders have definitely gone down hill since I first started in Apps. The "bozo" factor has steadily increased. Only those new hires without a sense of history think it's a real cool place to work. And, a few egocentric folks totally tripped on power and greed. (Apologies to any MSofties on the list I don't know personally.) Talk to HR about the turnover of people with 5.5 to 8 years under their belts who are bailing with their stock options because it ain't a fun place to work anymore. Testers, developers, UE, you name it. I can gripe because I was there. I never seem to recall seeing your name on any internal e-mail. Oh yeah, this is coming through a remailer, because I'm reading the list at work. And I doubt BillG would appreciate my opinions being sent out over MS resources.

1 0

Orbiting Datahavens
by blane＠aa.net 17 Dec '03

17 Dec '03

With all the recent talk about converted oil-rig DataHavens floating around the oceans, fending off pirates, and Low-Orbit satellite communications, I had a thought. How about an orbiting DataHaven. No jurisdiction to bother with, extremely difficult to get to (except by large governments...). You could put together a couple of Linux boxes with a RAID system, some backups and a large solar panel and have a very nice, secure DataHaven. Granted, you wouldn't have all the fun of floating around the south pacific fending off pirates and navies who are after your data, but it would work. Might even be cheaper than outfitting the oil-ring with the rate that they are tossing satellites into space. If the HAM radio community can get a satellite into space, why not the Cypherpunks/Linux communities? Brian ------- <blane(a)aa.net> -------------------- <http://www.aa.net/~blane> ------- "Extremism in the defense of Liberty is no vice" - B. Goldwater ============== 11 99 3D DB 63 4D 0B 22 15 DC 5A 12 71 DE EE 36 ============

5 4

South Florida Cypherpunks Meeting Reminder
by Joey Grasty 17 Dec '03

17 Dec '03

Y'all: The South Florida Cypherpunks will meet at Hops Grill & Bar in Boynton Beach, FL on Saturday, August 17 at 2:00 PM. As always, our meeting place is at a microbrewery, and this one has some very fine brews. Jim Ray will show off his Snake Oil bottle, signed by Phil Zimmermann, who wrote PGP. I will also hand out copies of my WinSock Remailer to anyone who wants to check it out. Other than that, we have no agenda, other than discussing cypherpunkology and drinking some fine brews. Directions: Take I-95 to Boynton Beach Blvd and go west. When you get to Congress Ave., turn right (north) and go one stoplight until you get to Old Boynton Beach Blvd. Turn left (west) and go behind Longhorn Steakhouse and turn right into the parking lot behind Longhorn Steakhouse. Hops is just north of Longhorn on Congress Ave. Hops Grill & Bar 545 N. Congress Ave. Boynton Beach, FL. In addition, the Cypherpunks Brewmaster, Jim Ray, is brewing up a special "cypherpunks summer dark" brew for the meeting. (I sampled some of the brew before bottling, and BBBUUURP! it was good.) We will enjoy his fine beer at my house following the meeting. I'll pass out maps to my house in Deerfield Beach for anyone who wants to go. Please send me a note if you plan to attend so that I can alert the restaurant on how many will attend. Send me your key and fingerprint for keysigning if it hasn't been signed by any cypherpunks before. Regards, -- Joey Grasty jgrasty(a)gate.net [home -- encryption, privacy, RKBA and other hopeless causes] jgrasty(a)pts.mot.com [work -- designing pagers] "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin." -- John Von Neumann PGP = A7 CC 31 E4 7E A3 36 13 93 F4 C9 06 89 51 F5 A7

1 0

proxy servers in Singapore
by brendon＠home.net 17 Dec '03

17 Dec '03

Did anyone else catch the AP wire story (it ran here in the SF Chronicle on Thursday) about the Singapore government cracking down on "undesirable" (e.g., sex smut, anti-govt. postings etc.) content on web sites, usenet etc. Their basically forcing, by law, Singapore ISPs to use proxy servers that contain the information that the govt. deems fit. Scary if you ask me. But then they have a govt. that acts like it's the management of Disneyland. "Have a nice ride!" -B ===================================================== Brendon Macaraeg http://www.itp.tsoa.nyu.edu/~brendonm Finger macaragb(a)acf2.nyu.edu for my PGP Public Key

3 2

Re: Triple DES Encryption Now Available For Telephone Privacy Protection
by jim bell 17 Dec '03

17 Dec '03

At 03:04 PM 8/16/96 -0700, Eric Blossom wrote: >Communication Security Corporation > >For More Information: Eric Blossom (707) 577-0409 >Press Contact: Terri Thatcher (408) 265-7703 >Triple DES Encryption Now Available For Telephone Privacy Protection >Santa Rosa, Calif., August 16, 1996, -- The Communication Security >Corporation today announced availability of the CS8191. The first >telephone security device built using uncompromised cryptography, >based on 168--bit key triple DES. > >Triple DES encryption technology provides an uncompromised level of >security (72 quadrillion times stronger against a brute force attack) >than products based on the US Data Encryption Standard (single DES). >In addition, unlike the government's "Clipper" proposal, the CS8191 >does not reveal or "escrow" the encryption keys with third parties. So does this use that previously-announced NTT encryption chip? > >The CS8191 has been designed to work with conventional analog >telephone systems (POTS). The unit connects between your telephone >and the wall. In 'clear' mode, your telephone continues to work as it >normally does. Pressing the 'go secure' button encrypts >conversations. Communication Security has also incorporated a >leading-edge speech coder. Voice clarity is undisturbed whether the >system is in 'secure' or 'clear' mode. Is this some sort of standardized interface? Or are we in for the crypto equivalent of the Tower of Babel? Jim Bell jimbell(a)pacifier.com

1 0

Re: $10K offer if you can break the code
by John Anonymous MacDonald 17 Dec '03

17 Dec '03

Hello! On 16 Aug 96 at 18:04, Mike wrote: > Don't cash the check yet. It's security by obscurity using the > highest quality "unpublished algorithms" and up to a 48 byte > key phrase. In Hong Kong, the Chinaman has the perfect way to describe a situation like this. He will say, "Hey friend, a roach this big won't simply jump in the streets for you to catch." > He's only willing to send out the free version by return snail > mail - no Net access...Snip..snip.... The guys behind PGPn123 tried the same snail mail stuff recently. The response was so bad they gave up after a while. Anyway, let's see what will happen in this case, but it's truly pathetic and ironic to think of snail mail in this cyberonic age. Later... Roach

1 0

Re: Greetings from Whore.com
by Daniel Miskell 17 Dec '03

17 Dec '03

Someone please tell me that was a joke. It's almost a temptation. (falls down laughing and dies) Greetings from <property not found>, Daniel.

1 0

any SF cpunks around next Sat?
by aba＠atlas.ex.ac.uk 17 Dec '03

17 Dec '03

Living in the UK, I really don't have that much idea where the people on the list I've gotten to know over the years live. I will be over in the San Francisco / Redwood City area next Saturday (24th), if anyone I know would like to meet, exchange keys, have a chat about crypto/cypherpunks stuff, mail me. Also if there is any regular cpunks meeting in this area which coincides, let me know! Adam -- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

1 0