December 2003 - cypherpunks-legacy

No Subject
by Daniel Leeds 17 Dec '03

17 Dec '03

=========================================================================== Daniel Leeds guestdl(a)rand.org RAND cosmos(a)misery.winter.org ===========================================================================

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

> If I understand the reasoning, people beleive it is easier to prevent the > release of strong crypto. techiniques than to remove them once they are > released. The reasons underlying this are what I don't completely understand. > Once a terrorist has strong crypto, why should they stop using it if it > becomes illegal? Use of strong crypto would be a tip off that one is a terrorist. If strong cryptography were unpopular and highly illegal, very few people would be using it. This makes it easy to identify suspects. Peter Hendrickson ph(a)netcom.com

5 4

RE: Information [for new PGP user]
by James A. Tunnicliffe 17 Dec '03

17 Dec '03

Dale Thorn writes: stewarts(a)ix.netcom.com wrote: > >> On Tue, 5 Nov 1996, Edward R. Figueroa wrote: > >> > I'm a new Cyberpunk! > Probably wearing a set of Ono-Sendai eyeballs.... > >> > Last, I would like to know once and for all, is PGP compromised, is > >> > there a back door, and have we been fooled by NSA to believe it's secure? > You can read and compile the source code yourself. [snip, snip] Really? All 60,000 or so lines, including all 'includes' or attachments? I'll bet you can't find 10 out of 1,000 users who have read the total source, let alone comprehended and validated it. Perhaps. But one would presume at least one of those 10 users, upon finding evidence of a back door or implementation flaw, would have alerted the other 990... (Indeed, various folks HAVE pointed out minor bugs, and posted fixes.) Lots of trusted and qualified folks HAVE looked at the source, and this increases one's confidence that there are no hidden trap doors or glaring holes. It's always possible everyone has missed something, of course. (Not to mention the "NSA has subverted everyone's compiler" argument. Anyone looked through the compiled machine code with a fine-toothed comb? :-) Tunny ====================================================================== James A. Tunnicliffe | WWWeb: http://www.inference.com/~tunny Inference Corporation | PGP Fingerprint: CA 23 E2 F3 AC 2D 0C 77 tunny(a)Inference.com | 36 07 D9 33 3D 32 53 9C ====================================================================== begin 600 WINMAIL.DAT M>)\^(B46`0:0" `$```````!``$``0>0!@`(````Y 0```````#H``$(@ <` M& ```$E032Y-:6-R;W-O9G0@36%I;"Y.;W1E`#$(`06 `P`.````S <+``<` M#@`>`"(`! `W`0$@@ ,`#@```,P'"P`'``X`'@`C``0`. $!"8 !`"$```!$ M1$$Y,4$V,S(V,SA$,#$Q.3,P0S P04$P,$$U1C8P1 `-!P$-@ 0``@````(` M`@`!!( !`",```!213H@26YF;W)M871I;VX@6V9O<B!N97<@4$=0('5S97)= M`.8+`0.0!@!(" ``&@````,`)@```````P`V```````>`' ``0```!\```!) M;F9O<FUA=&EO;B!;9F]R(&YE=R!01U @=7-E<ET```(!<0`!````&P````&[ MS/7;ZF,:J3XX)A'0DPP`J@"E](a)T``.!8LP`#`"X```````,`!A"4;Q>%`P`' M$,$$```>``@0`0```&4```!$04Q%5$A/4DY74DE415,Z4U1%5T%25%- 25A. M151#3TU#3TU74D]413I/3E1512PU3D]6,3DY-BQ%1%=!4D121DE'54523T%7 M4D]413I)34%.15=#64)%4E!53DM04D]"04),``````,`$! ``````P`1$ `` M```"`0D0`0```"\%```K!0``#0@``$Q:1G5E'T5#_P`*`0\"%0*D`^0%ZP*# M`% 3`U0"`&-H"L!S973N,@8`!L,"@S(#Q@<3`H,R,Q,/9C0$1@(`<'*X<3$@ M"%4'L@* ?0J BPC/"=D[%_\R-34"@ <*@0VQ"V!N9S$P,R\4( L*%"(,`6,` M0"!$80= 92!4: 6P`Z!W%040= >0.@J+;&DSOC8-\ M5$O(,`18`;QW *F,% M0',=P'<*P'1S8$!I>"YN$@`%H&W>+B&!'8$@,1WV/B+ (M"*3P.@5 I0+" U M![" ;W8@,3DY-B. %$5D(,%D!_ N($9L:6<*4 -@82'_(M$@/$DG(> E<"%0 M!^!#>8)B!)!P=6YK(2)G2E #8&(!H&QY'8!E&PK "X!G)P$1\2!O9DDC$6\M M!F!N9 MP( AE>64HT&QL<R[S*W$E_$QA() C@"; '8 M"&!L)+ >T&L=$'1O MW"!K*E 'X (@8QT0`'!_)+ "$ 7 *S$LT00`*)!'[% @(8$@$6T$``F +U-9 M)?QT: 20+H$@*-!C\&L@9&\%L". +J(1P/YV'1 I,#) ">$NT0;P"8#C,D I M$$Y302W")Y >T+9E,V$=L"<$(!'P8PAP[&4_"H4B9UD(8"_@`Y']& !A)+ N MHB_R`Q ML3'@GR" "&$N<06@#; @>0AAF1'P;&8KI@J%6W,#`-9P(X [<ETV M;%(I0"M 5'D_+.!!*T @'P`L?C ^`"H`!< Y,"UQ(5!S:R. "X!C"D!D*7,] MH2=K/Q0'D"<^,F$"0 #0:/L'@ (P<S9=)M ]H2>0!4#K.?$WDB<%0&8+@"2P M&R#5*@!U*?,Q/?-U$? 1X/\=@!U ,S0WXSCR+= !D ,@_3DT+ J%'0`%0 = M`B Y@KTP$64QX"J@-%$NHG8'0/YI*K =P"2P'; KIAN_%C#;"H\<#% $D!' M<"M@+.">0D0R2"$M)$B!<W4'@+] P4>A+*%.DRH1,=!O$?#G0^)$\R. =7 " M($.3*7+_-6!)D GP+G$J$3(Y/C('<&T+4&5!,D#0:5'B"V!W_R. +20S0QSQ M`" T43CR(# 5,>$@)! P*W$@*$E_2-$P@DE@!1 (8 0@`A!L0FL$($A!5D5/ M,&\_"X!)PD0B,% J4 7 8G7^9S[A+J)1T""1+L$A( >0="XI-FQ,(# $(%"2 M<N=$\$G"+J)Q=4EQ0Z!;DOM8^!>0;RV@.!$%0#CX,N3_,= O@3\1-^$1\%U! M(5 UP?T%H&Y#H%+$,=!@%#(",@'_*E S,$F04L%=@4X`,I-=07T%P&<+8"EC M'4 =`$XB2?<UL@= (,!Y!"!;40"0`F#['1 U87(Y\$@A$< $(#!1_S!Q.2$' M@&%!&P`C@"H1!:#[.A).,2@CP& A+>!!,E3RW3CR(C2R:))/<&)H$4G"YV@& M8F,XDW(B8^$E($$R^4XQ06YH0U^E,= #8%K _F@XXSAU)+ `P6F1.84#\.<Q MT"<!0Z%E+2W05P(X4[)B/6$Z+5PM(U!N;S"]2]4]=:]VOW?/>-\]2]5H($IA M!X)!).!TXFD;/S &D&8=$"S@?"!7&WP0*Q Z,S "0' Z+_0O=WSP+@N >Z 8 M`"YA\2&R+WYT=/DFP'U&%D'_)[ %L%34>^$OLB4`&P`GH2TI871\8"S@0S30 M,C-+)% 2($:!\$%#@=!$9" P@H W-WH&?B- ?W[W(;-[PX4O+. >$+ -ZT< MT#F&4('P,X*P,Q(@\C6!\#E#=3^(WXGOBO\7>7Y+U1<A`(W `$ `.0"@<^Y* M^\R[`0,`\3$! ```@%'``$````Q````8SU54SMA/2 [<#U);F9E<F5N8V4[ M;#U,04Y$4E4M.38Q,3 W,C(S,#,T6BTQ,38X``````(!^3\!````2@`````` M``#<IT#(P$(0&K2Y" `K+^&"`0`````````O3SU)3D9%4D5.0T4O3U4]3D]6 M051/+T-./5)%0TE0245.5%,O0TX]5%5.3ED````>`/@_`0```!4```!*86UE M<R!!+B!4=6YN:6-L:69F90`````"`?L_`0```$H`````````W*= R,!"$!JT MN0@`*R_A@@$`````````+T\]24Y&15)%3D-%+T]5/4Y/5D%43R]#3CU214-) M4$E%3E13+T-./5153DY9````'@#Z/P$````5````2F%M97,@02X@5'5N;FEC M;&EF9F4`````0 `',)#3L?SYS+L!0 `(,-#&44O[S+L!`P`--/T_```"`10T M`0```! ```!4E*' *7\0&Z6'" `K*B47'@`]``$````%````4D4Z( `````+ M`"D```````L`(P```````@%_``$```!0````/&,]55,E83U?)7 ]26YF97)E M;F-E)6P]3$%.1%)5+3DV,3$P-S(R,S S-%HM,3$V.$!L86YD<G4N;F]V871O 3+FEN9F5R96YC93(N8V]M/@#X?C(R ` end

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

>Jeremiah A Blatz wrote: >ph(a)netcom.com (Peter Hendrickson) writes: >> It appears to be widely believed that cryptoanarchy is irreversible. >> Everybody believes that the race to deploy or forbid strong cryptography >> will define the outcome for a long time. >> >> I can't think of a reason why this should be so. ><snip> > Well, once I've got my strong crypto and electronic commerce, and 20 > or so virtual identities to do things for me, and the gub'ment can't > tell what money I'm making and spending, so they can't tax me. So if > they can't tax me, and they can't tax lots of folks, then they can't > pay their jack-booted thugs. So the goverment becomes irrelevant. It > can't support a huge police state infrastructure, and certainly can't > but mega-crays to break my crypto, so how're they going to retain > control? > When we say anarchy, we mean anarchy. This only works if there are large numbers of people who think it is a good idea. Otherwise, the resources of the Federal Government may be directed quite effectively against a small number of people. If you can get a life prison term for your strong crypto you may hesitate to use it. If not, then you may get to be an example for everybody else. Peter Hendrickson ph(a)netcom.com

3 2

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 5:37 PM 11/7/1996, Daniel T. Hagan wrote: > On Thu, 7 Nov 1996, Peter Hendrickson wrote: >> If strong cryptography were unpopular and highly illegal, very few >> people would be using it. This makes it easy to identify suspects. > I think the reasons are probably tied closely to your second point. > Unless strong cryptography was easily distinguishable from weak > cryptography without taking the time to break it, then how would they > (law enforcement) recognize that someone was using strong cryptography? > Or suppose that some one uses strong cryptography and then wraps it in > weak cryptography. The outer shell would seem legal, and the authorities > can't go around randomly breaking people's keys (or so one would assume), > and even if they did, it wouldn't necessarily be legal as evidence anyway. In the extreme case, everybody would be sending messages in the clear. In the case of mandatory GAK, it would be easy to open a bunch of messages and see if what was inside looked like cryptography. The privacy violation could be minimized by requiring a Congressionally approved test program to applied without any human reading it. If the test program said it was cryptography, then this could be considered just cause for a judge to issue a warrant to the authorities for the study of the actual message. The laws regarding what is considered legal evidence are easily changed if there is a need for it. Probably they don't need to be changed all that much. If you see a lot of PGP messages coming from somebody, you get a warrant and search their computer for illegal software. When you find it, you lock them up forever. > And finally, you have to consider the possibility of whether a person can > be identified merely by the fact that there is a message that is > intercepted that has strong cryptography in it. I don't know enough about > remailers and internet protocols/servers to say whether this is a > reasonable objection or not, perhaps someone else does? In the absence of strong cryptography, remailers do not offer much anonymity. > So, unless I'm incorrect about one of the above points (and I admit that I > may well be), once cryptography reaches a certain strength, there is no > reason to relinquish that strength, particularly if you are using it for > criminal activity. If the penalties for the use of cryptography are significantly greater than the penalties associated with the crime, you may opt not to use cryptography. Peter Hendrickson ph(a)netcom.com

2 1

[rant]Re: black high heal shoes?
by Sean Roach 17 Dec '03

17 Dec '03

>Clinton wearing black and white shiny vinyl high >heel shoes, and nothing else but a transparent >plastic raincoat. > >Embroided on the back of the clear plastic raincoat >is the bar code for the RSA algorithm. > >He is walking around the RSA Data Security Conference >with the outfit on, trying to hug and kiss the attendees, >but they all ignore and make fun of him! When I think about Clipper. In my personal opinion, Clinton is afraid of unrestricted crypto because when he thinks about all the things he would have done with it when he was (is?) a hippie radical, he shuders, then, he makes the error of assuming that everyone in the U.S. of A. has the same low morals that he has shown. He feels that he must protect us from the monsters, yet, he feels that we are all potential monsters. And when I think about the assualt rifle ban, I think the same thing. In my personal opinion. None of this should be taken for anything but my opinion. Oh the nightmares you must have Mr. President. I am grateful that I don't see the world through your eyes.

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 3:03 PM 11/7/1996, Timothy C. May wrote: > However, if guns are not outlawed, are not hard to get, may be bought and > sold at flea markets and gun shows (which is where most of my guns have > come from, and which is where over the years I bought and sold about a > dozen or so various guns, none of them transferred with any paperwork, > identities asked for, etc.), and once gun ownership reaches some threshold, > later attempts to ban guns, seize them, halt ammunition sales, etc., > require draconian steps. (This is why so many gun owners have schemes to > bury spare guns in plastic pipes deep underground, place them in safe > deposit boxes, etc. And why so many of us reload our own ammo.) > Without taking a stand on the issues of whether guns should or should not > be restricted, the situation is quite similar to the ongoing deployment of > strong cryptography. Once widely deployed and "ingrained" in the habits of > many, later attempts to seize the newly-outlawed items are problematic. > Speech is similar to this. Once mechanisms for free speech are present in a > society, once people are used to having the "right" to speak freely, once > many channels of communication are widely available, and so on, it becomes > well nigh impossible to go back to a non-free-speech situation. > I believe, Peter, that your arguments naively ignore this sort of point. > Those in D.C. actually understand it well, and would laugh at your argument > of "If crypto turns out to be a problem, we can always ban it later." The key here is that in these cases the practice has become widely accepted. By widely accepted, I mean that very significant numbers of people believe that there is nothing all that wrong with the practice. Those who disagree do not feel it is worth the trouble to put a stop to it. If the Four Horseman of the Crypto-apocolypse were real, we could certainly put a stop to cryptoanarchy if we wanted to. Very few people would be willing to tolerate strong cryptography if it meant that it was real easy to have people killed, resulted in many sarin attacks, or widespread kidnappings. I doubt you could find many readers of even this list who would find such scenarios acceptable. You are right that the people in D.C. understand your point quite well. And I am naive for expecting them to honestly discuss their policies. The reason they fear cryptoanarchy is not because it will be something people won't like - quite the opposite. If they are to succeed they have to stop it now before it is widely recognized to not be a problem for people who earn their living. I believe that if the people in D.C. honestly believed that the Four Horsemen were coming, they would wait for the first real evidence of it to rally the society behind their cause and write themselves into the history books as heroes. Today, strong cryptography has caused no noticeable problems. People who want to forbid it can only justify such intrusive and politically risky policies on the grounds that something irreversible occurs after deployment. But, I don't believe I have yet seen any sort of explanation for irreversibility that is not based on "well, it won't be all that bad." > I don't imagine the parallel argument, for free speech, would go over well > in, say, China: "We'll let people say what they want, publish what they > want, set up newspapers, buy whatever foreign magazines they want, use > computers, and gather as they wish to make whatever plans they wish to. If > we don't like the results, we'll just go back to what we had before." This argument would certainly not go over well with the leaders of China. The people of China may have another point of view. Peter Hendrickson ph(a)netcom.com

2 1

Re: Why is cryptoanarchy irreversible?
by Ted Cabeen 17 Dec '03

17 Dec '03

At 02:38 PM 11/7/96 -0800, you wrote: >>Jeremiah A Blatz wrote: >>ph(a)netcom.com (Peter Hendrickson) writes: >> Well, once I've got my strong crypto and electronic commerce, and 20 >> or so virtual identities to do things for me, and the gub'ment can't >> tell what money I'm making and spending, so they can't tax me. So if >> they can't tax me, and they can't tax lots of folks, then they can't >> pay their jack-booted thugs. So the goverment becomes irrelevant. It >> can't support a huge police state infrastructure, and certainly can't >> but mega-crays to break my crypto, so how're they going to retain >> control? >> When we say anarchy, we mean anarchy. > >This only works if there are large numbers of people who think it is >a good idea. Otherwise, the resources of the Federal Government >may be directed quite effectively against a small number of people. > >If you can get a life prison term for your strong crypto you may >hesitate to use it. If not, then you may get to be an example >for everybody else. That's why we have to develop stealth PGP and good stego so that the government doesn't even know that you're using the strong crypto that has been outlawed. If they can't prove that there's actually a message in the picture of the catsgills you just downloaded off of alt.binaries.pictures.nature, you can't get a life sentence in jail. -- ______________________________________________________________________________ Ted Cabeen http://shadowland.rh.uchicago.edu cabeen(a)netcom.com Check Website or finger for PGP Public Key secabeen(a)midway.uchicago.edu "I have taken all knowledge to be my province." -F. Bacon cococabeen(a)aol.com "Human kind cannot bear very much reality."-T.S.Eliot 73126.626(a)compuserve.com

1 0

WebTV a "munition"
by Eric Murray 17 Dec '03

17 Dec '03

Page 3 of the San Jose Mercury News has a small blurb about WebTV's browser/set-top box that "uses computer-security technology so powerful that the government is classifying it as a weapon that will require a special export license before it can be sold overseas". "Few industry experts expect such a licsense to be granted, meaning the companies are unlikely to begin selling current versions of the US-made devices next year in Eurpoe and Japan as they had planned". [fluff about export laws] "We're the guinea pig" says Steve Perlman, chairman and CEO blah blah. So what's the story here? It's a web browser, so they're probably talking about SSL. SSL (both versions) already has mechanisims for allowing "export" level encryption, and although you still need to get a Commodities Jurisdiction, it's been done before so it shouldn't be too difficult. If they didn't use the "export" level SSL CipherTypes, then what're they up to? Are they fighting crypto export laws (for which they should be congratulated and supported) or are they just looking for free publicity? -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

8 9

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 11:39 AM 11/8/1996, Timothy C. May wrote: >At 9:50 AM -0800 11/8/96, Peter Hendrickson wrote: >>At 11:29 AM 11/8/1996, Jeremiah A Blatz wrote: >>> Furthermore, terrorrim and etc do not depend upon secure >>> communications to work. People tend to be able to talk face-to-face in >>> isolated environs, this is just as effective as a good public-key >>> cryptosystem. Crypto won't suddenly protect the types of people who >>> are professional killers/terrorists from scrutiny. It meerly would >>> allow them to communicate securely over distances of more than 10 >>> feet. This, IMO, is not much of a win for them. >> Face-to-face communications in isolated environs does not a cryptoanarchy >> make. > Yes, but you're the one talking about bombings, mass killings, Sarin gas > attacks, and other such examples of "terrorism." You cite the presence of > these things as why the Constitution will effectively be suspended and why > neighbors will cheerfully conduct vigilante raids on their suspected > terrorists. > Crypto anarchy is not the same thing as terrorism. Calling terrorism > "crypto anarchy" does not make it so. I could not agree with you more. What I am working with is the hypothetical Four Horsemen scenario which you have described above. I am not endorsing that scenario. If that were the outcome of cryptoanarchy, and some people think it will be, would it be a manageable problem or would the technology just sort of get away? I believe it would be easily managed if there were broad public support. Jeremiah correctly pointed out that you don't need strong cryptography to commit terrorist acts. That just puts us where we are today - not in a cryptoanarchy. I don't think that strong cryptography helps terrorists much. Let's face it, biowarfare and sarin gas don't have anything to do with cryptography, no matter how much the GAKers will try to show that they do. But, if I am wrong and for some reason the availability of strong cryptography leads to these scenarios - as the GAKers say - then there would be broad public support for the suppression of strong cryptography. This effort would be successful. It would not dramatically erode the structure of the Constitution or our legal system in the short term. The effect of strong cryptography and the Net is that it makes it possible for people with common interests to find each other more easily and to develop long distance relationships. That's fine when we are talking about scientists, mathematicians, or cypherpunks. But, it also brings together people with less savory interests. It's undesirable for serial killers to find each other and trade notes on how to evade capture. (I think this usually happens now through the prison system.) Strong cryptography makes it harder for governments to manage ideas and relationships between people. There are many implications of this and I think they are almost entirely good. The Constitution may not survive GAK in the long run. If the world were to stay in 1996 and we outlawed strong cryptography this would not necessarily be the case. But the world won't stay still. Computer assisted population management technologies have been getting more effective and cheaper all the time. In the past it was hard to give everybody unforgeable internal passports and ear tags. In a GAKed future that is unlikely to be the case. Segments of the USG probably have the doctrine worked out. We've heard a lot about "the responsible use of cryptography" from the GAKers. In fact, it is highly irresponsible to propose GAK at this time when there is no evidence whatsoever that it is needed. These people may have moved beyond any concern with ideas such as "responsibility." Right now there is a tremendous opportunity to the elites of the world to enslave everybody else. Once you know everywhere somebody goes, everything they read, and everybody they talk about, you can manage their behavior quite effectively. Only a small number of people would be needed to tweak the "justice" computers to punish indiscretions, such as meeting a cypherpunk on the street. Many people would be happy to enslave their fellow citizens if it meant tremendous wealth, power, and prestige for themselves and their children, possibly for a long time. Peter Hendrickson ph(a)netcom.com

1 0