December 2003 - cypherpunks-legacy

Swan song...
by Perry E. Metzger 17 Dec '03

17 Dec '03

Well, folks, after four or five years here, I'm finally leaving. I've picked this moment for two reasons. First, the signal to noise ratio here is now too low to be measured without expensive lab equipment -- as bad as Usenet, or even worse. Second, I now have two candidate sites to host a new cryptography & cryptography politics mailing list to replace this one. The new list will be run very tightly. Some people will doubtless label me a fascist and say I'm impinging on their ability to be "free". Those that feel that the best use of their freedom is to urinate into their own drinking water are entitled to their beliefs -- but they will not be welcome on the new list.* It is time to get back to cryptography. You all remember cryptography, don't you? Its the "cipher" in CYPHERpunk. Years ago, on cypherpunks, Phil Karn noted, after Stuart Baker of NSA named his nightmare vision of strong crypto embedded in every $20 phone and every fax machine, "Gentlemen, I believe we have our design specification." One cannot imagine that sort of thing being said here now. Four years ago, PGP 2.0 was released, and the first shot was sent across the bow of those that would stop us. It is more than time to fire off another round or two. Cypherpunks file lawsuits! Cypherpunks develop protocols! Cypherpunks write RFCs! Cypherpunks start companies! Cypherpunks WRITE CODE, damn it! Cypherpunks don't wait for the administration to move -- they move first! They move FASTER! Cypherpunks don't wait for someone else to deploy cryptography -- they deploy it themselves! Cypherpunks do not sit on their asses and pull their puds while discussing warmed over theories about personal freedom. Cypherpunks BUILD THE TOOLS TO IMPLEMENT THE THEORY! Cypherpunks don't fantasize, they create! In short, CYPHERPUNKS DO! They don't live for blather. Cypherpunks Mark I used to be a glorious place. Son of Cypherpunks may fail, but we must make the attempt to create it. In short, Cypherpunks is dead, Long live Cypherpunks! I will post pointers to the new list within ten days -- on or before October 20, 1996. Perry * Those that feel that peeing into their own drinking water is a good idea are directed to http://www.envirolink.org/orgs/coe/snuffit2/living_water.jpg and http://www.envirolink.org/orgs/coe/snuffit2/lifewater.html where you will find others who agree with you.

6 6

AW: Binding cryptography - a fraud!
by Eric Verheul 17 Dec '03

17 Dec '03

> >>The idea is that any third party, e.g., a network or service provider, >>who has access to components 2, 3 and 4 (but not to any additional >>secret information) can: >>a. check whether the session keys in components 2 and 3 coincide; >>b. not determine any information on the actual session key. >> >>In this way, fraud is easily detectible: a sender that attempts to >>virtually address a session key to the TRP (component 3) that is >>different from the real one he uses on the message (or just nonsense) >>will be discovered by anyone checking the binding data. If such >>checking happens regularly, fraud can be properly discouraged and >>punished. > >I am at the same time dismayed and disgusted at the tendency of some people >to want to "detect fraud" on the part of ordinary citizens, as this paper >appears to want to do, but says _nothing_ about preventing fraud >_by_government. How is the average citizen to know if keys are being given >out to government agents for valid reasons? First of all, that (and the legitimacy of "wiretaps" in general) is something that should be regulated in national law (including procedures, checks and balances, penalities). Maybe you have the opinion that that is impossible to achieve, [or at least that making wiretapping as such by government impossible is the only satisfactory way of doing it (-; ]. Our concept assumes that it is possible and acceptable, although legislation (and especially appliance of it) in some countries might be improved.. Second, the concept is flexible in the choice of Trusted Retrieval Parties; we have the opinion that if you don't trust the existing TRPs then, hey, setup your own TRP. We believe that should be possible (and forsee serveral "privacy-protecting" organisations doing so). However, as you don't want to have criminals setting up TRPs, some legislation on this point should be made... Finally, as said in the announcement: "In [VKT], we explain how we envision the framework in which the binding concept could present a security tool in the information society." > >I am further enraged by the last portion of the paragraph above where he >says, "fraud can be properly discouraged _and_punished_" Why "punished"? >Why call it "fraud"? Why should sending the "wrong" bits become a crime? >The US government, for example, has repeatedly claimed that key-escrow >systems should be "voluntary." Presumably, except for authoritarian and >totalitarian countries, no other country should force their own citizens or >others to use any sort of key-escrow/GAK system. Wait a minute. It is a *voluntary* system, but it has some rules that apply. The whole idea here is: if you don't like it, use your own system. "Fraude" refers to using the system without sticking to its rules, maybe fraude has a wrong connotation. > >Maybe I'm biased: I'm a libertarian who believes that sending the wrong >bits shouldn't be considered a crime. The problem we have is with the Depends, it might be childrens pornography. The information society is *not* about bits, but about information. >politicians, NOT primarily the criminals. Giving the government the ability >to punish people merely for sending the wrong bits (absent some other, REAL >crime) is an enormous step backward. And if they're guilty of a real crime, >why bother about the bits? In a democratic country one needs evidence to convict someone. > >Even if I believed in GAK, which I don't, I don't think governments or >anyone else should be able to determine whether the "correct" code is >included with the data until and unless the government has a valid warrant, Code is checked (on protocol compliance) by third parties all the time. They should not get any wiser from it, that is the point. > > >Jim Bell >jimbell(a)pacifier.com > > Thanks for the feedback, Eric Verheul

1 0

Re: Recent Web site cracks [CIA & DOJ sites]
by William Knowles 17 Dec '03

17 Dec '03

Igor Chudov asked after stewarts(a)ix.netcom.com wrote: >> The DOJ and CIA sites were actually cracked; don't know the mechanisms. >> The dole-kemp96.com and dole-kemp96.org domains were spoofs - they >> have similar names to the real site, and people reach them by accident >> or by hearing about them. According to today's San Jose Mercury News, >> the web designer who registered them did so just before Dole announced >> Kemp as his VP, and tried to sell his design services to the campaign. >> They didn't buy it, and the names were sitting around with nothing >> better to do anyway, so he decided to have a good time with them. >> Supposedly he's gotten about 40,000 hits and the "real" >> site got 1,000,000. > > Anyone got a copy of the cracked CIA page? Try: http://www.dis.org/se7en/hacktrash/index.html Both the CIA and the DOJ sites are mirrored there. Cheers! William Knowles erehwon(a)c2.net -- William Knowles <erehwon(a)c2.net> PGP mail welcome & prefered / KeyID 1024/2C34BCF9 PGP Fingerprint 55 0C 78 3C C9 C4 44 DE 5A 3C B4 60 9C 00 FB BD Finger for public key -- Vote Harry Browne for President -- http://www.HarryBrowne96.org

1 0

Re: FCPUNX:ABA Likes GAK
by roy＠sendai.scytale.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- jya(a)pipeline.com forwards: > 10-03-96 at 19:09 EDT, American Banker > > > Banks Like Export Plan for High-Power Encryption > > By Drew Clark [snippo] > Banks were heartened by the announcement because many > view the widely used Data Encryption Standard - a > low-level form of data scrambling - as inadequate > protection against the rising computer power of so-called > hackers. > > Though banks can use a complex 56-bit data encryption key > for financial transactions, sensitive communications with > overseas branches are limited to a less powerful 40-bit > standard. Wow... in two successive paragraphs, DES is first called inadequate and then lauded as "complex [...] encryption" (as though it were the weapon of choice). Who's clue-impaired here? Clark or the ABA (or both)? - -- Roy M. Silvernail [ ] roy(a)scytale.com DNRC Minister Plenipotentiary of All Things Confusing, Software Division PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMlznpRvikii9febJAQGu9gP/R6MAE4SbJTyiXFjXGBRIrQTNnn9KDO0P +K1GpRd2dLRjnPnsZekYokSailm2ga7Q/UPwIs8PXHbtTUFYL2nlwzcxfMG4gE6m PWCfLWBhbQ3p22F8M9OlivbR7a+sLzo0ZwItDUa5vAJv5kMFhuHegNvtYE2Qnpr2 H9SW6Vc07UE= =rJ99 -----END PGP SIGNATURE-----

1 0

MISTY Algorithm
by John Young 17 Dec '03

17 Dec '03

Nikkei Industrial Daily, October 08, 1996 Mitsubishi publicizes MISTY encryption algorithm Mitsubishi Electric Corp. said it has released the design principles for its data encryption algorithm MISTY. In doing so, the company can enlist third-party users to evaluate the integrity and power of its encryption algorithm and gain wider name recognition for MISTY. To make evaluations easier, the company is also providing a sample program. The existing de-facto world standard encryption algorithms DES and RSA were both developed in the U.S. But MISTY has advantages of its own and Mitsubishi would like encryption experts around the world evaluate the program. [End] No information given on the source for the algorithm or sample program. Anyone with the info care to share?

1 0

Re: Netscape does the right thing (fwd)
by David Lesher / hated by RBOC's in 5 states 17 Dec '03

17 Dec '03

Lucky Green sez: > Egghead has 128 bit Navigator 3.0 on sale for $29. You heard me right. The > clerk at Egghead, speaking broken English, failed to ask me for my passport. Good Point. If Peter Junger is supposed to maintain a chain of custody in his class; must not the bookstores, ComputerLands, you name it, ALSO do the same -- restricting not just customers, but non-AmCit employees' access...? -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

2 1

Future of Money Hearings
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Wed, 9 Oct 1996 19:49:50 PT From: "Paul Lampru, Marketing Manager, Electronic Commerce Products, Strategic Marketing, ATL, 770-640-3688" <PAUL_L2(a)sfov1.verifone.com> Subject: Future of Money Hearings To: e-payments(a)commerce.net Organization: VeriFone X-PS-Qualifiers: /FONT=Courier-Bold/LINES=66/LEFT_MARGIN=36/CALCULATE/TOP_MARGIN=36/BOTTOM_MARGI N=36 MIME-version: 1.0 Sender: owner-e-payments(a)commerce.NET Precedence: bulk +--------------------------------------------------+ Addressed to: e-payments(a)commerce.net +--------------------------------------------------+ All: Last June, Denis Calvert, VP for US Sales for VeriFone presented testimony to Rep Castle's Banking Subcommittee. This testimony suggested a strategy that would enable Internet payment schemes...that develop naturally for the Internet over the next couple of years...to be used by merchants who have store fronts or cash register sales systems. This strategy touches chip cards, public key certification authorities, Stored Value Cards, and the migration away from magnetic stripe technology toward chip cards or PC Cards or whatever electronic token is appropriate. This strategy also touches on the potential use of the Internet by US Treasury to distribute welfare payments and other Federal Transfer Payments. This strategy is a hypothetical scenario that leverages the MC/Visa SET payments protocol, but does not effect the protocol or its use for credit card payments on the Internet. This strategy is gaining the attention of a number of Federal agencies. Before this gets too far down the road...PLEASE review this testimony and critique the strategy. The testimony may be found at the following URL: http://www.house.gov/castle/banking/calvert.htm Please suggest a forum that these ideas may be presented and explained in more detail than they can be explained in Mr. Calvert's testimony...or this Email message. Thank you...pdl ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This message was sent by e-payments(a)commerce.net. For a complete listing of available commands, please send mail to 'majordomo(a)commerce.net' with 'help' (no quotations) contained within the body of your message. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: [Noise] Re: Missionaries (was: "Mormon Asshole?" re: GA
by Ross Wright 17 Dec '03

17 Dec '03

On or About 10 Oct 96 at 8:16, Dr.Dimitri Vulis KOTM wrote: > Lucky Green <shamrock(a)netcom.com> writes: > > > Would you folks *please* cut this thread? It has gone on long enough. Too > > long, in fact. > > Yes. Timmy May started it, but flaming the mormons. No. But I am Fucking sick of reading about this LDS shit. Iheard enough as a kid raised in the church. KILL THIS THREAD > > --- > > Dr.Dimitri Vulis KOTM > Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps > > =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

Bill Gates Comment on White House crypto proposal (fwd)
by Z.B. 17 Dec '03

17 Dec '03

[This just came over the fight-censorship list.] ---------- Forwarded message ---------- Date: Thu, 10 Oct 1996 11:20:47 +0000 From: Jim Rapp <InfoCker(a)postoffice.worldnet.att.net> To: declan(a)well.com Subject: Bill Gates Comment on Crypto Posted at 11:03 AM PT, Oct 9, 1996 NEW YORK -- Microsoft Corp. Chairman and CEO Bill Gates pitched the Windows NT operating system here Wednesday as more similar to Unix than different during a keynote address at Unix Expo. Gates also used his time on stage in the packed auditorium to comment on the encryption battle which U.S. companies are currently fighting with the federal government. The "U.S. government is making it fairly difficult for companies like Microsoft who want to use strong cryptographic techniques," Gates said. Two weeks ago, the Clinton administration announced that U.S. companies would be allowed to export products encrypted with a 56-bit key, up from the 40-bit-based key currently permitted, but Gates characterized this improvement as "tiny." A 56-bit key "is not nearly good enough," Gates said. InfoWorld Publishing Company

1 0

LET'S MEET DIMITRI
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Bay Area Cypherpunks, I am hereby pledging US$100 towards a fund to fly Dimitri to the SF Bay area for a Cypherpunk meeting. I certainly would like to meet a real cryptographer, and I'm sure many of you would too. We should throw in a hotel room and local transportation as well. I want Dimitri to be our featured speaker--his choice of topic, of course. I am ABSOLUTELY serious in this offer, but I will need donations from other Cypherpunks. If I get sufficient pledges to cover Dimitri's travel expenses, I will coordinate with Dimitri and make the necessary travel and hotel arrangements. Dimitri, what say you? Are you willing in flying to California to address the Mother of All Cypherpunk Meetings? I hope so. I'm sure it would be one of our most highly attended meetings. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

12 18