December 2003 - cypherpunks-legacy

Re: Securing Internet mail at the MTA level
by Stephen Cobb 17 Dec '03

17 Dec '03

At 11:29 AM 8/20/96 -0400, you wrote: > >Hi, > >Recently, I've been looking into securing email at the MTA level, and >would like to get your thoughts on implementation possibilities and >related issues. > >The problems that I'm trying to solve are: > 1. Host authentication > 2. Data privacy > Hmmm, have you thought about how this might fit/mesh/work with the security mechanisms in IPv6? Just a thought...Stephen

1 0

Re: Securing Internet mail at the MTA level
by Erik E. Fair 17 Dec '03

17 Dec '03

SSH, while a quite useful tool, is not the right long-term solution for transport layer security - IP security is. It's also clear to me that for E-mail, you don't want transport level security for the system; you want "object" security, that is, digital signature and encryption of the mail message. That way, no matter how many MTAs the message passes through (and pretty much regardless of how trustworthy they are) you have end-to-end authentication, integrity and privacy. Erik Fair <fair(a)clock.org>

3 3

Re: Taxes on Internet access prediction
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:54 PM 8/20/96, Mike McNally wrote: >Sure, but clearly that's not exclusively the case. (Amazingly enough >to some might be the fact that my for-work e-mail volume far exceeds >my not-for-work volume.) Hopefully I haven't brought too much shame >to my employer. > >In any case, with the IRS it's often less a matter of common sense >than what they happen to decide is The Law. Witness the changes in >laws about what constitutes a "home office". Currently, if you're >(let's say) a freelance plumber who maintains a legitimate office ... Caveat: I'm not a defender of income taxes, of course. Nor am I a defender of the IRS. However, on the "home office" situation, most of the examples I encounter, in talking to friends, are clearly scams to save a thousand bucks (or less) on their tax returns. Most of my friends who try to deduct a room in their house because they've put their computer there are clearly not using "20%" or "25%" or whatever of their house as a business. For those who really do actually use a room in their home for building things, for meeting with clients, for operating a home business of some sort, then I think the IRS will have no problems allowing it. (If the subject even comes up, in an audit. There are some reports that attempting to declare a home office increases ones chances of being audited....) As the saying goes, consult a competent expert. A few books detail the expected amount of work that must be done in a "home office," and whether one is likely to qualify. As one data point, I have derived nearly all of my income over the past 10 years from investments. And yet the "work" needed to be done on my computer is such a tiny fraction of my overall use of it that I don't even try to write off my various computers as "investment expenses." Your mileage may vary. And I certainly have not tried to write off a room in my house as a home office. (As it happens, I need few of the "office" resources, so I have my PowerMac and 17" monitor sitting beside my recliner in the family room of my house, where I can lie back, log in, and bliss out in cyberspace.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: [RANT] Death of Usenet: Film at 11
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:21 PM 8/19/96 -0700, Roger Healy OBC wrote: >ON >> >> At 1:34 PM 8/19/96 -0700, Mike Duvos wrote: >> >Permit me to go off in an orthogonal direction here and say that >> >I think that we should do away with the concept of a pre-ordained >> >newsgroups in Usenet entirely, in favor of an IRC-like dynamic >> >creation of message pools. >> >> Moderated newsgroups gain reputation from their moderation policies and >> probably should not be included in this scheme. > >Moderated newsgroups have very few posts because hardly anyone reads >them. I second the above propsed IRC-like scheme if it only would apply >to moderated groups, because of IRC's bad reputation of moderation. Don't confuse quantity with quality. When I want a FAQ for some area I don't normally follow, I go to news.answers. I know I won't be buried in social good times the way someone who wants to know about cryptography is buried when they go to cyperpunks. I have no such assurance if I were to go to the news group which created the FAQ. The reason there are so many different models on the net is they each serve a purpose. Don't make the mistake of trying to jam everything into one mold. Bill ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0

Re: phoneco vs x-phones
by Brian D Williams 17 Dec '03

17 Dec '03

Disclaimer: The opinions expressed are my own, I do not speak for Ameritech or it's alliance partners. I wrote: >>One point that seems to be missed here is the very high cost of >>compliance with government regulations. If the internet phone >>people have to comply with the same regulations it will drive up >>their costs dramatically, and if the regulations are lifted for >>all, the RBOC's think they can out compete them. Jim Bell replies: >If that is the main difference in costs, then we should abandon >those regs. Another big cost is billing, which could be eliminated >if usage were unmetered. In any case, I tend to agree: Make >these changes, eliminate the LD/local subsidy, and the LD >companies would have no problem (at least domestically) competing >against Internet phone. (International may be a different story, >because foreign telcos tend to be owned by countries.) Yes compliance costs are a sore subject. Billing costs are actually very cheap,(the mainframes are on the floor above me) the difference between sending a metered bill or a flat rate bill is tiny. Really tiny (NDA). The local/long distance subsidy was eliminated at breakup, but long distance companies do have to pay to use local networks, but as competition heats up these rates are dropping and new players (competitors) join the table, Or they can build their own. ;) One of the fun turns of events might be that the threat of x-phones might lead the RBOC's to actually turn into an ISP's! We could pull this off at amazing speed. (if you can't beat them, join them!) We are after all one of the four major nodes of the Internet...... Heh heh heh....... Brian "Zazen? Well it beats sitting around on your ass all day doing nothing."

1 0

RFC1984 on Cryptographic Technology
by Loren James Rittle 17 Dec '03

17 Dec '03

FYI, To: IETF-Announce:;@ietf.org Subject: RFC1984 on Cryptographic Technology Cc: rfc-ed(a)isi.edu Date: Tue, 20 Aug 96 08:40:43 PDT Sender: ietf-announce-request(a)ietf.org From: RFC Editor <rfc-ed(a)isi.edu> A new Request for Comments is now available in online RFC libraries. RFC 1984: Title: IAB and IESG Statement on Cryptographic Technology and the Internet Author: IAB & IESG Date: August 1996 Mailbox: brian(a)dxcoms.cern.ch, fred(a)cisco.com Pages: 5 Characters: 10,738 Updates/Obsoletes: none URL: ftp://ds.internic.net/rfc/rfc1984.txt The Internet Architecture Board (IAB) and the Internet Engineering Steering Group (IESG), the bodies which oversee architecture and standards for the Internet, are concerned by the need for increased protection of international commercial transactions on the Internet, and by the need to offer all Internet users an adequate degree of privacy. Security mechanisms being developed in the Internet Engineering Task Force to meet these needs require and depend on the international use of adequate cryptographic technology. Ready access to such technology is therefore a key factor in the future growth of the Internet as a motor for international commerce and communication. [...]

1 0

Key Length Correlation
by Jeff Davis 17 Dec '03

17 Dec '03

I've read Blaze and diffie's paper on Semetric Key Length. I'm currious how semetric key length correlates to public key cryptography length. Does public key length have to be much longer, (assuming the algorithms are strong), to provide the same level of security as a shorter semetric key? TIA -- According to John Perry Barlow: *What is EFF?* "Jeff Davis is a truly gifted trouble-maker." *email <info(a)eff.org>* *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** US Out Of Cyberspace!!! Join EFF Today! *email <membership(a)eff.org>*

2 1

lambda 2.10 (fwd) -- (ie -- French Consitution censors net)
by <pstira＠escape.com> 17 Dec '03

17 Dec '03

Just passing this on in case it strikes anyone's interest :) ---------- Forwarded message ---------- Date: Mon, 19 Aug 1996 20:10:02 +0100 From: Jerome Thorel <jt(a)freenix.fr> To: thorel(a)netpress.fr Subject: lambda 2.10 netizen's --> Lambda Bulletin 2.10 <-- contents flash bulletin + French Constitution censors Internet control + Singapore and the Censorship Proxy Server + G7 and the EC take strong steps for Key Escrow Encryption * * * * * French Constitution censors Internet control As we speculated in our last bulletin (2.09), the French Conseil Constitutionnel, watchdog of the 1958 Constitution, censored 2 articles in a new telecom act which were intended to establish a kind of administrative control over Internet speech and online services. The nine "Sages" said that the creation of the Conseil Superieur de la Telematique, which would have make guidelines on Internet content, breaches article 34 of the Constitution which states that the Parliament can act alone to dictate rules concerning "civic rights and fundamentals garanties given to citizens for a fair exercice of public liberties". The CST could have undermine these principles, because the law didn't specify clearly how it would have taken its decisions. So the Conseil recognized the particular state of the Internet, which is not a basic medium. Only one section remains in the censored law : it obliges ISPs to give their clients "technical means" to forbid or select access to online services, software that allows a so-called "parental control". * * * * * Singapore and the Censorship Proxy Server A communique from SingNet, Singapore's main Internet Service Provider, states that "ALL SingNet customers will be required to connect to SingNet's proxy server by the deadline September 14th 1996, failing which you would not be able to access the web without the proxy. This applies to all dial-up, ISDN, and leased line customers (STIX customers are exempted). " The proxy server will ease the ISP to "Deny access to blacklisted sites supplied by SBA". SingNet said that "Access to sites banned by the SBA will prompt the message : The site you requested is not accessible For more information on Singapore's Internet regulation, please check http://www.gov.sg/sba/netreg/regrel.htm". On July 11 the Singapore government passed the Singapore Broadcasting Authority Act (Chapter 297) in which it announced a "Class Licence Scheme" aimed "to encourage responsible use of the Internet while facilitating its healthy development in Singapore. It encourages minimum standards in cyberspace and seeks to protect Net users, particularly the young, against the broadcast of unlawful or objectionable materials. ... SBA will focus on content which may undermine public morals, political stability and religious harmony of Singapore. However, SBA recognises that it is impossible to regulate the Internet fully. ... Singaporeans can help SBA in the identification of objectionable sites in order to keep cyberspace clean. SBA welcomes public feedback on objectionable content found on the Internet. Members of the public can write to SBA, call its toll-free hotline ... or post their views on the SBA homepage at http://www.gov.sg/sba. " China, which has created its own Internet regulations aimed at controlic data traffic and urged netizens to declare themselves to the authorities, approved the Singapore Act and an official was quoted as saying, "China has a lot to learn from Singapore's experience" (source : Fight-censorship mailing list). * * * * * G7 and the EC take strong steps for Key Escrow Encryption The European Commission's DG-13 division on information security (Infosec) opened on July 30th a "call for tenders" for "preparatory works" towards regulating encryption procedures. The plan is aimed to test the introduction of the Europe-wide network of Trusted Third Party Services (ETS). Observers saw in this move the so-called "guidelines" the EC was to propose last year, when press reports (Nature, Sept. 28, 1995) argued the Commission and the Council of Europe in Strasbourg were willing to regulate encryption use through the creation of TTPs. The Infosec call for tenders, which will end by September 30, is to "identify, define and verify ... operationnal, technical, regulatory and legal aspects ... to assess the effectiveness, economics and acceptability of Trusted Third Party Services." Other voices in European talks, however, said these "preparatory works" are to push for EU countries to adopt TTPs and the principles of key-escrow encryption. Nordic countries such as Finland, Denmark and Sweden, are said to be opposed to change encryption legislation, as France and Britain took steps in June and July to enforce the creation of TTPs in their own country. On July 30 G7 countries agreed policies that would "accelerate consultations on encryption that allows, when necessary, lawful government access to data and communications in order to prevent or investigate acts of terrorism, while protecting the privacy of legitimate communications". The EPIC, in Washington, DC, said "stronger measures sought by the US to restrict information on the Internet and limit the availabilioty of encryption were apparently not adopted by the G7 countries". Among other industrialised nations, Japan and Australia are said, like Nordic countries in Europe, to oppose key escrow as a mean to regulate the free flow of information. Remember the OECD talks in June, were the US tried to impose key-escrow legislation to the 27-countries' club of the industrial world (see lambda 2.09) ***** Soon archived on www.freenix.fr/netizen ----- Jerome Thorel =-= Journaliste/Free-lance Reporter =-= Paris, France =+= the lambda bulletin --> http://www.freenix.fr/netizen =+=

1 0

How To Subscribe?
by kdf＠gigo.com 17 Dec '03

17 Dec '03

Would someone please netmail me the current subscription procedure? Thanks. JE -- : Fidonet: John Erland 1:203/7707.12 .. speaking for only myself. : Internet: kdf(a)gigo.com

1 0

Re: Netscape 3.0 and encryption choices
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:04 AM 8/20/96 -0700, Ted Cabeen wrote: >In Netscape 3.0, the program allows the user to specify which encryption >standards to allow connections with. It allows encryption with 128-bit RC4, >128-bit RC2, and 156-bit(I think)3DES. Of these three, which would be the >most secure method? The gereral consensus of the experts is that 168 bit 3DES is the best choice. DES has been well studied, 168 bit keys are large enough to be safe, and the ITAR forbids its export. (ITAR also forbids export of 128 bit cyphers as well, but ITAR is the only NSA approved reputation agent for crypto, so we use what we have.) ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0