December 2003 - cypherpunks-legacy

paging nets
by Jeff Ubois 17 Dec '03

17 Dec '03

Interesting recycled bits from Newsbytes concerning a BBC story drawn from Usenet: BBC Blows Radiopager Security Systems Wide Open LONDON, ENGLAND, 1996 OCT 2 (NB) -- By Steve Gold. The British Broadcasting Corporation (BBC) has revealed that radiopaging messages on the UK's paging networks can be read by anyone with a radio scanner and suitable PC software. In addition, the British TV company claims that it is also possible to insert bogus messages onto the paging networks using instructions on the Internet. ... BBC journalists, meanwhile, said that UK radiopaging transmissions were unencrypted and, as such, were insecure when viewed alongside digital cellular phones, where signals are encrypted. ...the BBC claimed it had been shown messages reporting on the activities of Tony Blair, the head of the British Labor Party, along with a message referring to a residence of a member of Royalty. Newsbytes noted that the same system is used in the US.

1 0

Re: Fighting Clipper III
by apteryx＠super.zippo.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- erm, a boycott means not _buying_ a product, as opposed to not _using_ a product. In the case of PGP, I never intended to purchase it from RSA. As for Netscape, there are other browsers out there (or so I heard). Realistically, a boycott is likely to be ineffective. Writing letters to companies and congresshmucks and working with non-US crypto companies to create a standard that can be legally imported into the US (for now) would be more effective, IMHO. Boycotts rely on large numbers of participants, and not enough people understand or care about encryption. We'd be better off trying to change that first. Mark On Thu, 3 Oct 1996 06:37:45 -0700 (PDT), Declan McCullagh <declan(a)eff.org> wrote: >You'll have trouble doing a successful boycott of RSA. What, you won't >use Netscape Navigator or PGP? > >-Declan > > >On Wed, 2 Oct 1996, Jim McCoy wrote: > >> Rich Burroughs <richieb(a)teleport.com> wrote: >> [...] >> >>>On Wed, 2 Oct 1996, John Young wrote: >> >>> >> >>>> The New York Times, October 2, 1996, pp. D1, D8. >> >>>> Executives of the International Business Machines >> >>>> Corporation said late yesterday that they were still lining >> >>>> up the final list of companies in the alliance. Those >> >>>> involved will include Digital Equipment and smaller >> >>>> data-security companies including RSA Data Security, Cylink >> >>>> and Trusted Information Systems. >> >>> >> >>>We are in deep trouble. >> >> >> >>Wouldn't a letter-writing campaign be in order here? >> >[snip] >> > >> >The word "boycott" leaped into my mind. I personally do not believe that I >> >will be buying products from any of these companies, as long as thay >> >participate in this GAK charade. >> >> Such an initiative will need publicity and letter-writing early in the >> campaign will help us set the tone and points of debate on this issue. >> A boycott works best when everyone knows why and there are a few key >> phrases which can be used to get the message across. Something like >> "company X is helping build big brother, boycott their products" or a >> few similar sound bites are needed fast. The big brother inside stickers >> from the last campaign were nice, maybe people can come up with variations >> of various corporate logos or marketting phrases which help get the message >> across? >> >> jim >> >> > > >// declan(a)eff.org // I do not represent the EFF // declan(a)well.com // > > > -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMlQmC936bir1/qfZAQF9dwL/fN1HZhHWbnOa6gZ71WMwf32nuOGS1CGm H2f9MlNvZhYF6TVAwCmfUG4hgeJQLkC97GrR/0hIfNYzir0Eb+qmF2Mptvl5tUiJ I89H2WRVl+BJBoqThGXJx8BqL6uVDX9H =sBVJ -----END PGP SIGNATURE----- Mark Heaney finger snipe(a)starburst.cbl.cees.edu for public key PGP Fingerprint= BB D8 9B 07 51 87 05 AC 47 7B F2 4F A6 AB 1A CD ----------------------------------------------------------------- Vote against government *** Vote Libertarian

2 1

Re: Clipper spin [was Re:Flood Warning]
by jim bell 17 Dec '03

17 Dec '03

At 12:00 PM 10/3/96 -0800, Jim McCoy wrote: >[...] >> >> High-Tech Leaders Join Forces to Enable International >> Strong Encryption >> >> See: http://www.ibm.com/news/alliance2.htm > >The "International Strong Encryption" phrase is something that we >need to become active in stopping. Anything which responds to such >announcements should put a different spin on this phrase. If the >Clipper farce is accepted as "strong" encryption then the battle is >lost; maybe something like "it is _international_ strong encryption >because it is the strongest encryption people like Saddam Hussein [insert >bogeyman du jour] want Americans to have access to" Idea 1: It should be called "International Weakened Encryption." Idea 2: The "alliance" term above in the URL should be replaced with "Axis." Jim Bell jimbell(a)pacifier.com

1 0

gack vs. key escrow vs. key recovery
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

cpunks, a note about recent developments in "key recovery" initiative. I think cpunks as a group should reconsider very seriously their own positions on cryptography and come up with something more sophisticated than "any government bill or plan associated with crypto is evil" which is the functional equivalent of the ideology behind many recent posts. what is the precise difference between gack, key escrow, and key recovery? TCM has argued that the administration is muddying the issue by manipulating the terminology. perhaps so, but I feel that cpunks are equally guilty, by branding anything that emanates out of the government as inherently orwellian. do you always have to have an enemy? is the government always going to be your enemy, no matter what they do? I have posted here before that many companies find the concept of "key recovery" highly acceptable and even desirable. the basic question is, what does this mean to wiretapping and search warrants and subpoenas? it is clear we are coming to a fork in the road at this moment. there are going to be two types of cpunk opinions based on recent developments. 1. those who feel that wiretapping was illegitimate from the start and are working to make wiretapping impossible. confronted with a legal search warrant/subpoena etc. for personal data, they would not hand over keys. they would "superencrypt" in systems that do etc. 2. those who feel that there is such a thing as a legal warrant or subpoena for information protected by cryptography keys, and would agree that this logically means that governments will be getting access to "key recovery" infrastructures. personally I am leaning toward 2, because I feel that we already live in such a society, and that it is not orwellian. companies are going to lean toward (2). I do agree that the gov't has the potential to twist this process to evil ends, but that has always been true of everything about democratic government, and the recipe for 200+ years has always been and remains "eternal vigilance". in other words, I am in favor of some kind of mechanism by which the government can obtain keys via subpoenas/warrants. cpunks, I think we should try to clarify our terms and come to some conclusions. those who continue to pursue (1) are going to be perceived as more and more radical and extremist, because arguably it is not even a system we have today or one that was ever devised. remember, the constution guarantees freedom from *unreasonable* search and seizure, but never prohibited search and seizure in the first place!! apparently at least our found fathers believed that "reasonable" search and seizure was a wholly legitimate function of government, based on this wording. regarding (2): the government may actually help bring crypto to the masses via the post office and other routes. are cpunks going to continue to hold the simplistic, reactionary, knee-jerk, black-and-white opinion that "anything with the word 'government' in it is evil"? "if the government is doing something, then we must sabotage it"? I'll be watching the debate closely, as the true extremists incapable of compromise (and thereby living in a fantasy world) show their colors....

6 6

How to fight GAK by obeying the law
by Ernest Hua 17 Dec '03

17 Dec '03

It seems that the best method for fighting GAK is to accelerate wide-spread domestic use of freely redistributable non-GAK crypto. The Lynux automatic firewall concept that John Gilmore is pushing is a great idea, but it is still brewing, and he's shooting for developing an exportable ... er ... importable version. That will take much time to develop, and time is what we don't have much of. We need to work on applications, API's, flexible software modules, etc. and the primary reason we cannot do it so easily is because we cannot redistribute the software so easily. First thing we definitely need is a way to determine with fairly good accuracy, whether a host is in the U.S. This MUST be an automagic mechanism ... no person involved so there is little delay in getting the goodies. The best implementation would automatically set the group of an incoming anonymous FTP session daemon to a special group if there is a high degree of certainty that the originating host is within the U.S. Second thing we definitely need is a convenient way and universal way to clearly notify the recipient of the current export restrictions of such software, so that the recipient knows what he/she is in for. Basically, we have to do our best to NOT violate the law, no matter how much we hate it. What the government wants to happen is that everyone will get hooked on GAK, and it will be too inconvenient to use something else. A good counter-strategy is to get everyone hooked on the good stuff. Right now, the FBI/NSA is looking for an excuse to prosecute anyone not jumping on their bandwagon. We have to avoid give them an excuse to prosecute us while still enabling rapid application development. Communication and distribution are key. Ern

3 2

Clipper III questions
by Eric Murray 17 Dec '03

17 Dec '03

The recent CDT policy post sez of Clipper III: >* Access to keys internationally "would be provided in accordance with > destination country policies and bilateral understandings." This reminds me of the understanding between CIA/NSA and their counterparts in British Intelligence. Both sides are prohibited from spying within their own countries borders but are encouraged to spy in other countries. Both would very much like to spy on their own citizens (for legitimate law encorcement/national security reasons only, of course). So, they have a simple system in place. The British spy on the American citizens that the Americans want spied on and then turn over the intercepts. The Americans do the same for the British in Britain(*). Sometimes they lie to each other or withhold material, but that's what spy organizations do all the time. If Clipper III passes and the OECD gets their member nations in line with what the American miliary wants, I predict a similar system will evolve. "Destination country policies" will allow decryption of incoming GAKked messages from non-citizens. After all, they have no rights, do they? Cooperating intelligence agencies will then exchange intercepts. Presto Chango, pesky privacy rules vanish right before your eyes! Of course this is in our best intrest, we must fight against terrorisim with all methods possible. The ends justify the means. A question: What happens if a company decided not to go along with Clipper III? Can they still ship the "old" 40-bit-style GAKware unimpeded? Or will there be a slow tightening of the rules to force compliance? The existing way of doing things depends to a large degree on a set of "common practice" which the NSA doesn't have written down. For example you won't find the 40 bit limit written anywhere in ITAR, and if you want to export something that's already been approved elsewhere (i.e. another implementation of SSL) you still have to go through the approval process. (*) this comes from "The War Aginst the Jews" which is worth reading. Sorry I can't find my copy at the moment, maybe someone who's got it handy will provide authors/ISBN. Capsule review: covers government dirty dealing from the early 1900s on, mostly British and American. Concentrates on Jews and Israel of course but they seem to have been the brunt (sometimes the instigator) of a lot of the dirty pool that governments have played. -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

3 2

DESCrack keyspace partitioning
by geeman＠best.com 17 Dec '03

17 Dec '03

What about the heuristics of partitioning the keyspace? Seems to me that a _subset_ of all possible keys is much more likely to appear than a random selection from an equidistributed population 0..2^56. (P)RNG's just aren't that likely to produce a key of 010101010..... nor 001100110011... etc etc and I have been thinking about how one might formalize and exploit this randomness property to increase the probability of finding the key sooner. So a keysearch strategy should be something other than a partitioning of 2^26 into N bins with a linear search within each bin. I realize that it is POSSIBLE that a key of 1010101010... was used, (excluding weak keys from consideration) ---- but I have seen "certifiable" RNG's and, God Bless 'em, they just dont ever produce anything with any predictability. Is not the lack of predictability a predictable, and therefore exploitable, attribute? Any thoughts here? ----------

9 9

Re: Fw: Re: ITAR satellite provision
by jim bell 17 Dec '03

17 Dec '03

At 02:05 PM 10/3/96 -0400, Michael Froomkin - U.Miami School of Law wrote: >Alas, a common fallacy. > >You have committed a prohibited export when the stuff lands outside the >USA....It's not illegal when it goes up ("by reason of the launching" and, >e.g. *stays up* in orbit) but it is illegal when it comes down abroad. Sure about that? The regulation said something like "launch vehicle" or "launch," apparently indicating that a "launch vehicle" could actually be exported, THEN launched, etc, without violating ITAR. And since the regulation does not go into any detail about the "launch", other than it is a "launch" (and does not explicitly prohibit landing subsequent to launch) the implication is that there is no prohibition. I still think the regulation was just written sloppily. Jim Bell jimbell(a)pacifier.com

2 1

EzStego in Java!: Now Disappearing At A Site Near You
by romana＠glamazon.com 17 Dec '03

17 Dec '03

EzStego, my tool for "steganography made easy", now has its own web site at http://www.fqa.com/ezstego/ EzStego is currently alpha software. Use it at your own risk. It is a reimplementation in Java, with much improvement, of my notorious shareware product, Stego. EzStego is also shareware. I have made the source code available for peer review and verification. EzStego and EzSteggy are (C) Romana Machado 1996. All rights reserved. Romana Machado romana(a)fqa.com http://www.fqa.com/romana/ http://www.glamazon.com/

1 0

Re: support for "crack DES"
by jim bell 17 Dec '03

17 Dec '03

At 01:26 PM 10/3/96 +0000, Omegaman wrote: >Considering the situation -- considering that RSA has even signed on >to this scheme -- I'd have to say that I don't give a rat's ass what >Bill Gates claims. If Micro$oft bucks the system, I'll gladly >applaud their stand. > >The situation is not good at all. > >Cracking DES (whether distributed or through a hardware crack, or >both!) seems critical at this point. Just remember that it would be far better to make the crack look easy, than to make it look hard. quantity 9000+, $1,000 Pentiums for a year (plus maybe $500,000 in electricity) looks "hard." 1000 dedicated chips (whether they be FPGA or custom or...) for 1.5 months or so looks "easy." The latter crack looks far more likely to be repeated. The former is OBVIOUSLY a stunt. Jim Bell jimbell(a)pacifier.com

2 1