December 2003 - cypherpunks-legacy

The New GAK-Clipper Thing will Fail
by Timothy C. May 17 Dec '03

17 Dec '03

Comparing the latest GAK/Clipper III (or is it Clipper IV?) thing to the original Clipper announcement in April 1993, I sense a lot more confusion, a lot more thorny issues, and a lot more vagueness. They just seem more disorganized and less committed than the last time around. Each iteration of Clipper gets less focussed and seems to last a shorter time before the next version is being talked about. A good thing, of course. Some random points: * Unlike with Clipper, where a specification existed and was available within a few weeks for analysis, and where hardware existed (the Mykotronx chips, the AT&T phone), what has been publically presented so far is just a vague commitment to participate. * There seem to be many ways around the new GAK: --superencryption is essentially impossible to stop (e.g., use PGP on text messages, then use the officially-approved GAK--how could this be outlawed?) --the large pool of _existing_ crypto products means people will be using these products for years to come (possibly within GAK wrappers, as just noted)...unless the New World Order (tm) somehow locates, seizes, or otherwise makes criminals out of those who use a once-legal product, how could this be stopped? --the "degrees of freedom" for messages have sharply increased in the last several years: messages inside Web accesses, messages "sent" by posting to message pools (*), direct phone calls, the Net, etc. (* Will posting encrypted messages to the Usenet or world-readable Web sites become a crime? Or will attempts be made to limit distribution of Usenet and access to Web sites? Neither of these seems feasible, but how else could the stated goals of the Administration ("stopping terrorists, etc. from conspiring") be stopped?) (On this point above, yes, I know that there has been no talk of illegalizing the sending of mere encrypted data, only the export of non-GAKked programs. But I think it likely that the LEAs will realize that "criminals" are still conspiring with crypto. One thing they may try is to require that any communication with a non-U.S. site involve GAK. This then raises the Usenet/message pool directly. Since such sites have world-distribution, currently, posting encrypted messages to alt.anonymous.messages or to a mailing list like this necessarily involves export of the messages. It gets complicated to enforce, naturally.) * The Cabal itself seems confused as to what's involved. They seem to be counting on IBM and/or TIS to deliver the solution, and may be just signed on for what they think are reasons of political expediency. * As the IBM scheme gets attacked (in the way Matt Blaze attacked Tessera), as questions are raised about the Key Authorities and their cooperation, and as the _costs_ are revealed....well, I expect further crumbling. (On the "costs" issue, running these Key Authorities, staffing them, complying with subpoenas (and who will _fight_ the subpoenas?), etc., will not be cheap. For software products like Navigator and Explorer, that are either free or very cheap, just who will pay for this infrastructure? Someone at the EPIC Pro-CODE conference in Palo Alto a few months ago--I forget whom--presented calculations of just how expensive a "key recovery" infrastructure could be. Will it cost $50 to send a message to a foreign site? Better to use message pools! :-}) I apologize for the random nature of my comments here. I just see so many points of attack, so many ways to skirt the intentions of GAK, and so much ambivalent commentary from the companies involved, that I am convinced this whole thing will crumble. Unless a "major terrorist incident" galvanizes the effort, it looks to start falling apart almost immediately under the onslaught of Cypherpunks, hackers, other governments (think France wants the USG having access to their traffic?), and the "crypto anarchy" of nations whose borders are not even speed bumps. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: The Right to Keep and Bear Crypto
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:29 PM 10/2/96 -0700, azur(a)netcom.com (Steve Schear) wrote: >>T[i]m May wrote: >>I've argued since 1992 on Usenet and here that "crypto as arms" is a >>potentially dangerous tack to follow. (Others, including legal experts, >>have also argued this point.) >> >>Given that it is well-established, whether we agree or not, that the USG >>may restrict private ownership of atom bombs, nerve gases, CBW weapons, >>machine guns, switchblade knives, nunchuk sticks, and various other "arms," >>the association of crypto with armaments is potentially *DISASTROUS*. > >Unless we get the strong support of the gun lobby and NRA. The gun lobby and NRA are generally against handgun registration, but haven't stopped it. We're against crypto key registration. The gun lobby and NRA are generally against machine gun licensing requirements, but haven't stopped it. We're against strong crypto licensing requirements. The gun lobby and NRA are generally against firearms dealers' licensing, but haven't stopped it. We're against crypto dealers' licensing. The gun lobby and NRA are generally against assault weapon import laws, but haven't stopped them. We're against strong crypto import laws. The NRA supports Instant Background Checks (because it thinks they're less bad than N-Day Waiting Periods). We're against central government permitted-users databases, and we're against Key "Escrow" even if some people think it's less bad than an outright ban. The NRA supports the politically incorrect hunting enthusiasts. We (generally) support politically incorrect tax evasion, black markets in recreational pharmaceuticals, and free speech for people we dislike. If your lobbyists lose and you have to register your gun, it still works. If your lobbyists lose and you have to register your crypto keys, you lose; that means the government or anybody who can get your keys can crack your stuff. If your lobbyists lose and you have to get permission to make guns, most of the interesting guns can still be made. If your lobbyists lose and you have to get permission to write crypto, many of the interesting crypto applications won't get written - we not only depend on the free flow of ideas, but on people doing applications as a hobby or a small business that can't afford to become Registered International Arms Dealers, don't want to wait the months that such registration takes for background checks, and don't want to give up all the privacy involved just so they can write a bug report for somebody else's code or suggest an improvement. Face it, as much as the Gun Lobby has slowed down the growth of anti-gun laws, they've still lost step by step, law by law, against a government that's succeeded in scaring the public about threats to public safety and in convincing the public that only the military needs strong weapons and that registering everyday-use weapons is just fine. I support much of what they do, and I'd be happy if they supported us, and it's probably easier to get their support on crypto than drug rights, but we can't _depend_ on it. Also, getting public support for crypto is a hearts-and-minds deal; the press generally dislikes guns, and generally approves of free speech, and press support is important - especially since the press's default behaviour is to believe government press reports about crypto-narco-porno-terrorists using assault remailers. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com America's Open Presidential Debate - Beyond Dole and Clinton! <A href="http://gate.net/~bdcollar/bbe/debate.htm">Tuesday, Oct. 8th 8:00 PM EDT</a>

1 0

Re: NYT on IBM GAK
by jim bell 17 Dec '03

17 Dec '03

At 07:51 AM 10/3/96 -0500, Adam Shostack wrote: >Rich Burroughs wrote: > >| The word "boycott" leaped into my mind. I personally do not believe that I >| will be buying products from any of these companies, as long as thay >| participate in this GAK charade. > > Folks, > Lets be reasonable. Its time to jump on board the GAK >bandwagon. After all, where better to disrupt the music? We need to >start writing GAK software, and it better be up to the high standards >that the NSA sets for itself. > > Once we've written it, and its being distributed, we can say >'See, another broken bit of GAK software. Not even the NSA could get >it right. Our data is too important to be using broken software to >protect us.' > And we have 56 bit exportability in hand. >Adam The problem is that the appearance of defeat could easily guaranteee the real defeat itself. Jim Bell jimbell(a)pacifier.com

1 0

RE: The Right to Keep and Bear Crypto
by Mullen Patrick 17 Dec '03

17 Dec '03

[Assumptions: Crypto is arms. We have the right to bear arms. Therefore: We have the right to bear crypto.] Following along with the news stories, it would seem the USG doesn't disagree with this logic. What they are attempting to do is limit world distribution, *not* internal distribution. Even with the new key recovery idea, crypto which remains in the US will continue to be unregulated. Another fear is that the administration is using export limits to control domestic use of encryption. While Gore directly stated yesterday that domestic use of encryption will remain unregulated, the double standard for domestic ^^^^^^^^^^^^^^^^^^^^^^^ and international products might discourage U.S. companies from developing two different versions, leaving U.S. and Canadian customers with the same products that the federal government has deemed safe to ship overseas. [_GAK_Rat_Pack_, John Young, 3 Oct 96] This may (will?) limit the products which are produced by large corporations, as their need for a single, globally distributable product is respected. However, smaller companies who have neither the desire nor finances to distribute their product on a global scale will be unaffected. Shareware/ freeware products will also be unaffected (unless someone from another country pulls it off a website, or similar means). However, all of this is irrelevant, because I must say, Tim May has the proper idea -- We may have the right to bear crypto, but the government has the right to limit the types/amounts of crypto we bear. ** Success in this matter is classifying crypto as speech ** I read somewhere (probably here) about a case which was (was destined??) to be a precedent for crypto as speech. All I can remember was something about the code being classified as speech, or something like that. Sorry I can't quite remember what it was. Anyone have any suggestions/references? Patrick

2 1

chaining remailers
by scottb＠aca.ca 17 Dec '03

17 Dec '03

Can someone point me to where I can get software to take advantage of chaining remailers for Windows 95?? Actually, can this be done through a Windows enviroment, or do I need to run Linux? /sb

1 0

Re: support for "crack DES"
by Omegaman 17 Dec '03

17 Dec '03

> NetScape might not hawg the glory, but Bully Billy will trumpet > to the world that HE devised the means, HE directed the breakers, > and MicroSlop is the "benevolent" [read greedy, vicious, corrupt, > threatening predator] organization which "pulled freedom loving > Americans clear from the *very* mouth the the beast." Considering the situation -- considering that RSA has even signed on to this scheme -- I'd have to say that I don't give a rat's ass what Bill Gates claims. If Micro$oft bucks the system, I'll gladly applaud their stand. The situation is not good at all. Cracking DES (whether distributed or through a hardware crack, or both!) seems critical at this point. me -------------------------------------------------------------- Omegaman <mailto:omega@bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send a message with the text "get key" in the "Subject:" field to get a copy of my public key. --------------------------------------------------------------

1 0

Flood Warning
by jya＠pipeline.com 17 Dec '03

17 Dec '03

BSDI To Share "SYN-Flooding" Protection Software This code is freely available via BSDI's Web and FTP sites at www.bsdi.com and ftp.bsdi.com. TIS will license its encryption key recovery technology to Atalla The agreement comes on the heels of two other recent developments: a new Administration policy regarding export controls on strong encryption, and TIS and Atalla's participation in a new computer industry alliance to promote adoption of a worldwide standard for encryption key recovery. RecoverKey supports the Administration's new policy by allowing emergency recovery of an encrypted message or file. This technology, patented by TIS and first approved by the U.S. government for export in January 1996, is fundamental to approaches now being considered as the basis for a new global standard. For more on RecoverKey, see: http://www.tis.com/docs/products/cke/index.html High-Tech Leaders Join Forces to Enable International Strong Encryption See: http://www.ibm.com/news/alliance2.htm ----- http://jya.com/floodd.txt ftp://jya.com/pub/incoming/floodd.txt

2 1

Re: The New GAK-Clipper Thing will Fail
by jim bell 17 Dec '03

17 Dec '03

At 11:11 AM 10/3/96 -0800, Timothy C. May wrote: > >Comparing the latest GAK/Clipper III (or is it Clipper IV?) thing to the >original Clipper announcement in April 1993, I sense a lot more confusion, >a lot more thorny issues, and a lot more vagueness. They just seem more >disorganized and less committed than the last time around. Each iteration >of Clipper gets less focussed and seems to last a shorter time before the >next version is being talked about. A good thing, of course. Sort of like a "political" version of Zeno's paradox? B^) > >Some random points: >--the large pool of _existing_ crypto products means people will be using >these products for years to come (possibly within GAK wrappers, as just >noted)...unless the New World Order (tm) somehow locates, seizes, or >otherwise makes criminals out of those who use a once-legal product, how >could this be stopped? And I suspect that there will be large numbers of people using non-GAK simply as a protest. Trying to convict even one of them will be difficult; the government has to admit that they're not doing anything illegal, etc. Yet, if the gov't FAILS to prosecute them, that'll destroy an law requiring GAK. [snip] >(On the "costs" issue, running these Key Authorities, staffing them, >complying with subpoenas (and who will _fight_ the subpoenas?), I think it would be appropriate to contact each of the companies which have publicly signed on to this most recent propsal (Clipper 3.XX? Clipper IV?) and point out that (if they still won't revoke their approval) they should publicly and irrevocably commit to challenge each and every key subpoena with a full legal challenge (to the SC if necessary), INCLUDING informing and participation of the key owner/user, with all of his attorney fees paid for by an insurance policy issued specifically for the purpose. This process would probably take at least months, if not years. (This is important, because I believe that wiretaps have set a false precedent: AT+T (before breakup) and local telcos afterwards, being monopolies, had no motivation to challenge wiretap orders, and the practice was to not inform those tapped, perhaps not even after the tap was removed. There is no reason to assume, however, that key-escrow systems should follow that precedent, because the relationship between AT+T and government was not an "arm's length" one. Presumably, key-escrow companies should be entitled, no REQUIRED to verify the legitimacy of any key-release. "It's only fair!" ) The resulting legal atmosphere would become so distasteful to the Dept. of Injustice that it would make key escrow useless as a practical tool, even though it would exist as a technicality. If the DOI objected, companies need merely say the magic words "Richard Jewell" and all ordinary citizens would recognize the problem. The point, of course, is NOT to encourage these companies to support Clipper IV. Rather, goal is to suggest to them a "poison pill" which would make their cooperation meaningless in the end, while at the same time giving them a 2-year free 56-bit export. Think of it as a monkey-wrench they can throw into the works. We can use such a proposal as a sort-of "loyalty to freedom and their fellow citizens oath" because any company which refused such a REASONABLE protection to ordinary citizens would be, in effect, giving their middle finger to the public. Jim Bell jimbell(a)pacifier.com

1 0

RE: The Right to Keep and Bear Crypto
by jim bell 17 Dec '03

17 Dec '03

At 11:39 AM 10/3/96 -0400, Mullen Patrick wrote: >This may (will?) limit the products which are produced by large corporations, >as their need for a single, globally distributable product is respected. >However, smaller companies who have neither the desire nor finances to >distribute their product on a global scale will be unaffected. Shareware/ >freeware products will also be unaffected (unless someone from another >country pulls it off a website, or similar means). > >However, all of this is irrelevant, because I must say, Tim May has the >proper idea -- We may have the right to bear crypto, but the government >has the right to limit the types/amounts of crypto we bear. > >** Success in this matter is classifying crypto as speech ** >Patrick While I agree we shouldn't push the crypto/arms connection, on the other hand I think we can push BACK: If the government tries to equate crypto with arms,take the position that while we disagree with this equation, to the extent the government is using it, it must take the good with the bad and accept the "keep and bear arms" interpretation literally. Jim Bell jimbell(a)pacifier.com

1 0

Re: [FACTS] Mountain Meadows Massacre
by Deana Holmes 17 Dec '03

17 Dec '03

On 3 Oct 96 at 8:58, attila wrote: > AFTER THIS POST, ALL RELIGION MUST GO OFF THE LIST! see banner below attila, if you wouldn't post propaganda from the Church, then I *might* agree with you. But you can't do that and expect those of us who know better to keep quiet. <snip Dmitri Vulis nonsense> > Now, concerning the completely ignorant, erroneus, and slanderous > comment of Dimitri, the facts will follow the usual disclaimer: > > *************************************************************** > I am neither an authority of nor a representative of "The Church > of Jesus Christ and the Latter Day Saints" of which our current > living Prophet, President Gordon B. Hinckley, is the sole authority > to this world. Love your CYA statement, dude. It's terribly doubtful that Hinckley knows the details of Mountain Meadows, or that he would want to discuss them, if he did. > I do not speak for the Church, nor am I a recognized > historian and/or spokesman for the Church. Any opinions stated > herein are my viewpoints as discerned from my studies of religion, > in particular the historical aspect of the Church, and I accept all > responsibilty for same. Very good. You know, of course, that if you say the wrong thing in public, that your fate will be that of D. Michael Quinn, the excommunicated Mormon historian, who lost his Church membership because he would not stop telling unpleasant truths about the Church's early history. Just so the other c-punks know that speaking truth has consequences. ******************************************************************* > If some of the list wish to either ask questions RESPONSIBLY or > conduct a shared learning experience of the Mormon religious, > community, and work ethic, please drop me a personal note, and > I will both answer reasonable questions, and serve as moderator > of a list if there is sufficient interest. I think the libertarian faction > in particular might be both surprised and *stunned* by many of > the actual conditions in Utah versus preconceived views. > ******************************************************************* If anyone wants a more jaundiced view of Utah, please drop me a line. I can be a Utah cheerleader if I want (there are many good things about living here) but the fact of the matter is that we live in a Church State. I resent the fact that the dominant religion seems to want to tell *everyone* here how to live their lives. > > now, back to our regularly scheduled programming <g> > > the following is a compilation of information which is as > reasonable a representation of the foul deed as I could assemble. <snip> I would suggest two books, both by historian Juanita Brooks: "The Mountain Meadows Massacre" "John D. Lee" Before the days of Boyd K. Packer, historians weren't excommunicated. Mrs. Brooks' punishment for writing these two books was to be shunned in her southern Utah community. But they remain *the* sources on Mountain Meadows and the general attitude of the people at the time. I notice that attila didn't mention these sources. Deana (who doesn't really approve of the pap that passes for history in orthodox LDS circles) Deana M. Holmes April 1996 poster child for clueless $cientology litigiousness alt.religion.scientology archivist since 2/95 mirele(a)xmission.com

2 1