December 2003 - cypherpunks-legacy

RFC1984 on Cryptographic Technology
by Loren James Rittle 17 Dec '03

17 Dec '03

FYI, To: IETF-Announce:;@ietf.org Subject: RFC1984 on Cryptographic Technology Cc: rfc-ed(a)isi.edu Date: Tue, 20 Aug 96 08:40:43 PDT Sender: ietf-announce-request(a)ietf.org From: RFC Editor <rfc-ed(a)isi.edu> A new Request for Comments is now available in online RFC libraries. RFC 1984: Title: IAB and IESG Statement on Cryptographic Technology and the Internet Author: IAB & IESG Date: August 1996 Mailbox: brian(a)dxcoms.cern.ch, fred(a)cisco.com Pages: 5 Characters: 10,738 Updates/Obsoletes: none URL: ftp://ds.internic.net/rfc/rfc1984.txt The Internet Architecture Board (IAB) and the Internet Engineering Steering Group (IESG), the bodies which oversee architecture and standards for the Internet, are concerned by the need for increased protection of international commercial transactions on the Internet, and by the need to offer all Internet users an adequate degree of privacy. Security mechanisms being developed in the Internet Engineering Task Force to meet these needs require and depend on the international use of adequate cryptographic technology. Ready access to such technology is therefore a key factor in the future growth of the Internet as a motor for international commerce and communication. [...]

1 0

lambda 2.10 (fwd) -- (ie -- French Consitution censors net)
by <pstira＠escape.com> 17 Dec '03

17 Dec '03

Just passing this on in case it strikes anyone's interest :) ---------- Forwarded message ---------- Date: Mon, 19 Aug 1996 20:10:02 +0100 From: Jerome Thorel <jt(a)freenix.fr> To: thorel(a)netpress.fr Subject: lambda 2.10 netizen's --> Lambda Bulletin 2.10 <-- contents flash bulletin + French Constitution censors Internet control + Singapore and the Censorship Proxy Server + G7 and the EC take strong steps for Key Escrow Encryption * * * * * French Constitution censors Internet control As we speculated in our last bulletin (2.09), the French Conseil Constitutionnel, watchdog of the 1958 Constitution, censored 2 articles in a new telecom act which were intended to establish a kind of administrative control over Internet speech and online services. The nine "Sages" said that the creation of the Conseil Superieur de la Telematique, which would have make guidelines on Internet content, breaches article 34 of the Constitution which states that the Parliament can act alone to dictate rules concerning "civic rights and fundamentals garanties given to citizens for a fair exercice of public liberties". The CST could have undermine these principles, because the law didn't specify clearly how it would have taken its decisions. So the Conseil recognized the particular state of the Internet, which is not a basic medium. Only one section remains in the censored law : it obliges ISPs to give their clients "technical means" to forbid or select access to online services, software that allows a so-called "parental control". * * * * * Singapore and the Censorship Proxy Server A communique from SingNet, Singapore's main Internet Service Provider, states that "ALL SingNet customers will be required to connect to SingNet's proxy server by the deadline September 14th 1996, failing which you would not be able to access the web without the proxy. This applies to all dial-up, ISDN, and leased line customers (STIX customers are exempted). " The proxy server will ease the ISP to "Deny access to blacklisted sites supplied by SBA". SingNet said that "Access to sites banned by the SBA will prompt the message : The site you requested is not accessible For more information on Singapore's Internet regulation, please check http://www.gov.sg/sba/netreg/regrel.htm". On July 11 the Singapore government passed the Singapore Broadcasting Authority Act (Chapter 297) in which it announced a "Class Licence Scheme" aimed "to encourage responsible use of the Internet while facilitating its healthy development in Singapore. It encourages minimum standards in cyberspace and seeks to protect Net users, particularly the young, against the broadcast of unlawful or objectionable materials. ... SBA will focus on content which may undermine public morals, political stability and religious harmony of Singapore. However, SBA recognises that it is impossible to regulate the Internet fully. ... Singaporeans can help SBA in the identification of objectionable sites in order to keep cyberspace clean. SBA welcomes public feedback on objectionable content found on the Internet. Members of the public can write to SBA, call its toll-free hotline ... or post their views on the SBA homepage at http://www.gov.sg/sba. " China, which has created its own Internet regulations aimed at controlic data traffic and urged netizens to declare themselves to the authorities, approved the Singapore Act and an official was quoted as saying, "China has a lot to learn from Singapore's experience" (source : Fight-censorship mailing list). * * * * * G7 and the EC take strong steps for Key Escrow Encryption The European Commission's DG-13 division on information security (Infosec) opened on July 30th a "call for tenders" for "preparatory works" towards regulating encryption procedures. The plan is aimed to test the introduction of the Europe-wide network of Trusted Third Party Services (ETS). Observers saw in this move the so-called "guidelines" the EC was to propose last year, when press reports (Nature, Sept. 28, 1995) argued the Commission and the Council of Europe in Strasbourg were willing to regulate encryption use through the creation of TTPs. The Infosec call for tenders, which will end by September 30, is to "identify, define and verify ... operationnal, technical, regulatory and legal aspects ... to assess the effectiveness, economics and acceptability of Trusted Third Party Services." Other voices in European talks, however, said these "preparatory works" are to push for EU countries to adopt TTPs and the principles of key-escrow encryption. Nordic countries such as Finland, Denmark and Sweden, are said to be opposed to change encryption legislation, as France and Britain took steps in June and July to enforce the creation of TTPs in their own country. On July 30 G7 countries agreed policies that would "accelerate consultations on encryption that allows, when necessary, lawful government access to data and communications in order to prevent or investigate acts of terrorism, while protecting the privacy of legitimate communications". The EPIC, in Washington, DC, said "stronger measures sought by the US to restrict information on the Internet and limit the availabilioty of encryption were apparently not adopted by the G7 countries". Among other industrialised nations, Japan and Australia are said, like Nordic countries in Europe, to oppose key escrow as a mean to regulate the free flow of information. Remember the OECD talks in June, were the US tried to impose key-escrow legislation to the 27-countries' club of the industrial world (see lambda 2.09) ***** Soon archived on www.freenix.fr/netizen ----- Jerome Thorel =-= Journaliste/Free-lance Reporter =-= Paris, France =+= the lambda bulletin --> http://www.freenix.fr/netizen =+=

1 0

How To Subscribe?
by kdf＠gigo.com 17 Dec '03

17 Dec '03

Would someone please netmail me the current subscription procedure? Thanks. JE -- : Fidonet: John Erland 1:203/7707.12 .. speaking for only myself. : Internet: kdf(a)gigo.com

1 0

Re: Netscape 3.0 and encryption choices
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:04 AM 8/20/96 -0700, Ted Cabeen wrote: >In Netscape 3.0, the program allows the user to specify which encryption >standards to allow connections with. It allows encryption with 128-bit RC4, >128-bit RC2, and 156-bit(I think)3DES. Of these three, which would be the >most secure method? The gereral consensus of the experts is that 168 bit 3DES is the best choice. DES has been well studied, 168 bit keys are large enough to be safe, and the ITAR forbids its export. (ITAR also forbids export of 128 bit cyphers as well, but ITAR is the only NSA approved reputation agent for crypto, so we use what we have.) ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0

Re: CS First Boston lawsuit
by Greg Broiles 17 Dec '03

17 Dec '03

At 12:03 PM 8/19/96 -0400, Black Unicorn wrote: >On Sun, 18 Aug 1996, Timothy C. May wrote: > >> At 3:29 AM 8/19/96, Alan Horowitz wrote: >> >I suspect they are trying to get a judgement against "John Doe", in the >> >hopes of tracking him down later. >> > >> >Actually, if I had a sizeable judgement against such a John Doe, I could >> >probably find a private detective who would find the dude for a >> >contingent fee. Wow, a whole new class of factoring (commerce definition) >> >opens up. Get me a lawyer.... Sure, there are collection people who do this regularly; it's also possible to sell judgements for a fraction of their face value. >> Lawyers out there can and should correct me if I'm wrong, but I don't >> believe either the criminal or civil justice system has the concept of a >> "John Doe" trial! The ability to have the advice of an attorney, to >> confront one's accusers, cross-examine witnesses, and mount a defense, and >> all that constitutional stuff. Rather hard to do if the trial is in the >> past tense. >> >> Can you cite an example of such a "John Doe" trial in the U.S.? > >Not exactly, but judgements against John Doe's or even "$956,334.34" are >common. Typically they are default judgements where a property seizure is >involved. > >"The United States of America v. $534,444.00" and "The United States of >AMerica v. One Red Porsche" is a common theme. It is possible to name unknown defendants in a suit - the tradition is to name them as, literally, "John Doe" or "John Does 1-6, unknown Washington County Sheriff's Deputies". The idea is that at some point prior to trial you'll learn the names of the defendants and then ask the court for permission to amend your complaint to add the newly found names. (e.g., Oregon Rule of Civil Procedure 20(H): "Fictitious Parties. When a party is ignorant of the name of an opposing party and so alleges in a pleading, the opposing party may be designated by any name, and when such party's true name is discovered, the process and all pleadings and proceedings in the action may be amended by substituting the true name.") But naming someone in a suit is not sufficient to give them notice that they've been sued, so that they know to file an answer and otherwise defend themselves. At least in Oregon (state & Fed courts, since Fed courts borrow the state's rules for service of process, Fed Rul Civ Pro 4(e)(1)), service by publication (as mentioned in another message) is only allowed where the plaintiff files an affidavit that they have tried every other appropriate means of service and they have been unsuccessful, or that they have reason to know it will be unsuccessful. ORCP 7(D)(7). Service by publication is relatively rare. So Tim's correct (at least as far as I know, and I sure don't know everything) when he says that John Doe *trials* are essentially unknown - because if defendant(s) don't appear for trial but have been served, the plaintiff can get a default judgement against them - which makes a trial unnecessary, at least for those defendants. It's also possible (sometimes) for a defendant to overturn a default judgement and ask for a real trial, if they can show that there was a good reason why they didn't respond initially. Bad (or unattempted) service of process is usually a good reason. The John Doe lawsuits are more likely to falter at the service-of-process stage; before you get to ask for a default judgment, you've got to prove that the defendant was served. And if you don't even know their name, it's tough to serve them with the summons & complaint. No service, no judgement. The connection between the service-of-process problem and the in rem cases Black Unicorn mentioned (e.g., "United States v. $405,089.23") is that the owner of the property is supposedly put on notice by the seizure or attachment of the property itself. A court can exercise jurisdiction over *stuff* (e.g., property) and enter a judgement against the stuff even if it hasn't gained jurisdiction (via service of process) over the person who owns the stuff. In the most common seizures, the stuff is seized from one or more people; those people are also given notice of the seizure and their right to contest it. (which is not to say that I'm a fan of forfeiture - I'm not - but the cases I've seen/worked on haven't suggested that lack of notice is a problem. Claimants/owners/possessors don't always understand the notice they're given at seizure, and they don't always bother to act within the awfully short deadlines (10-15 days, in some cases) required to file a claim. But people do get (arguably inadequate) notice.) To some extent, in rem jurisdiction is practically necessary - otherwise it'd be possible to have property in a wrong place, or creating unwanted/harmful effects, which could not be legally moved or changed without service of process on the owner - who may be dead or travelling or uninterested or just hard to find. If cryptoanarchy becomes more prevalent, and it becomes more difficult to trace ownership and control of interesting stuff (e.g., physical or intellectual property, and/or "bots" of one flavor or another), look for more in rem actions, not fewer. (I can't think of an example of a John Doe criminal proceeding, except that I believe grand juries can hear testimony and investigate crimes where a target has not yet been identified. But that's a very early stage of criminal proceedings where the defendant doesn't have many rights even if they are identified; so the lack of notice isn't much of an injury.) -- Greg Broiles |"Post-rotational nystagmus was the subject of gbroiles(a)netbox.com |an in-court demonstration by the People http://www.io.com/~gbroiles |wherein Sgt Page was spun around by Sgt |Studdard." People v. Quinn 580 NYS2d 818,825.

3 4

Re: US Taxes on X-Pats (getting off topic)
by Stephen Cobb 17 Dec '03

17 Dec '03

At 05:32 PM 8/19/96 -0400, you wrote: >It sounds unfair, for sure. However, the whole thing is a fraud based >upon a myth. FICA witholding is NOT credited to an individual's account, >or even to Social Security benefits in general. By statutory law, all >such receipts go into the Treasury's general fund. > >So, they are NOT "social security contributions". Period. > Very true...what I am saying is that, as far as my reading goes, LEGAL aliens are going to be required to pay social security "taxes" while not having any "entitlement" in return. They pay income taxes and get certain things, like law and order, in return. They will be paying soc sec money to the government without getting anything in return. This sounds not only unfair but wrong, part of an isolationist, "we killed the natives so this land is our land and the rest of you f@*k-off" revival that includes the recent posting about requiring proof of citizenship before issuing drivers licenses. Stephen

4 4

Re: CS First Boston lawsuit
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:29 AM 8/19/96, Alan Horowitz wrote: >I suspect they are trying to get a judgement against "John Doe", in the >hopes of tracking him down later. > >Actually, if I had a sizeable judgement against such a John Doe, I could >probably find a private detective who would find the dude for a >contingent fee. Wow, a whole new class of factoring (commerce definition) >opens up. Get me a lawyer.... Lawyers out there can and should correct me if I'm wrong, but I don't believe either the criminal or civil justice system has the concept of a "John Doe" trial! The ability to have the advice of an attorney, to confront one's accusers, cross-examine witnesses, and mount a defense, and all that constitutional stuff. Rather hard to do if the trial is in the past tense. Can you cite an example of such a "John Doe" trial in the U.S.? (There may be trials "in absentia," more so in other countries than in the U.S., but not when no persons have been identified at all!) --Tim May, who hopes he is never identified as the "John Doe" indicted, tried, convicted, and sentenced in 1979 in Washington County, Oregon, for the crime of unlawful foddering in a public place. Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4

Re: Indonesia detains democracy activist after post to mailing list (fwd)
by Sean McGrath 17 Dec '03

17 Dec '03

> ...llike the Berkeley administration's reading student email ... This was a paranoid fantasy that became a rumor and is on its was to an urban ledgend. The UC administration does not have the inclination, interest or resources to monitor email. Sean McGrath

2 1

Re: Key Length Correlation
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:02 PM 8/20/96 -0700, Jeff Davis wrote: >I've read Blaze and diffie's paper on Semetric Key Length. I'm currious >how semetric key length correlates to public key cryptography length. Does >public key length have to be much longer, (assuming the algorithms are strong), >to provide the same level of security as a shorter semetric key? TIA According to Applied Cryptography V2, Symmetric and Public-key Key Lengths with Similar Resistances to Brute-Force Attacks Symmetric Public-key Key Length Key Length 56 bits 348 bits 64 bits 512 bits 80 bits 768 bits 112 bits 1792 bits 128 bits 2304 bits Regards - Bill ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0

cryptoanalysis 002
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

I agree on expanding the symbols to represent the alphabet. For example, if the crypto-alphabet for e is 23, 45, 190, 200, etc, one can remove some of the frequency for a letter. This definately makes it harder to attack with the frequency analysis method because the "resolution" of the distribution for the letter is lessened to a near randomness. (So it looks, there are still clues, eh?)

1 0