December 2003 - cypherpunks-legacy

Re: Return address forgery [was Judge Kozinski...]
by Matthew J. Miszewski 17 Dec '03

17 Dec '03

> Well, in the judge's defense, note that he used the word "perhaps" above. I > like this judge, which (obviously) isn't something I can say about too many > judges...I think he was just trying to sharpen our thoughts and arguments, > and that he DOES agree with us on many, many things. His fears about the > misuse of anonymity in a police state, for example, come from his personal > experience in a former socialist paradise. I think (hope) that being exposed > to "cypherpunk issues" by as many good thinkers as he was, in a relaxed, > non-courtroom setting, has broadened his understanding of the many issues > involved and will help "our" side immensely if these same issues ever do > come before him. Jim, Thank you for doing this. I went to Law School to bring a viewpoint to the bench that was never there. I do so whenever I can. What you are doing is a very important part of moving this country forward. I understand the people who [RANT] about the problems we face, but when people like you hold a civil discourse with officials we overcome the label of extremists. > > I have decided, however, to cease my very enjoyable conversation with him > about these issues, from now until after Judge Patel's Bernstein case has > been decided and appealed, because of this very possibility. I am already > concerned that an ambitious U.S. Attorney, using Alta Vista, could attempt > to argue that "cypherpunk terrorists have been secretly trying to subtly > influence Kozinski's thinking, and that therefore he should be removed from > the case in favor of some judge who has no clue whatsoever about the 'Net, > encryption, anonymous remailers, etc." [I am sure the argument wouldn't be > put quite that way <g> but that's what the U.S. Attorney would mean.] There > is now a judge with some idea of these issues who will IMNSHO probably be > fair to "our" side. It is a rare opportunity, and I don't want to "blow it." Once again, thank you for all you are doing. > JMR > > > Please note new 2000bit PGPkey & new address <jmr(a)shopmiami.com> > This key will be valid through election day 2000. > PGP id.A7D63DA9 98 1F 39 BA 93 86 B4 F5 57 52 64 0E DA BA 2C 71 > Please avoid using old 1024bit PGPkey E9BD6D35 anymore. Thanks. Matt -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzDq+FoAAAEEANM9+JcJmUp4aCSGpdOG4Y1b6m4630XA8H41Utbvr7Tr6wEH CD6tlxZ+k+Pycj4w/f8WQa8fC50skoLjUNeP4lYsR7NYaMGRp6WkqCLMI/3Nohvk pfLDqnzZZdwVL2liB7mfTURoF6doQaVehHmMBjSaVTfD12tzNGm6VvyEc77JAAUR tClNYXR0aGV3IEouIE1pc3pld3NraSA8bWptaXNraUBleGVjcGMuY29tPg== =lkx1 -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 12:29 AM 11/8/1996, Jim McCoy wrote: >Peter Hendrickson writes: >[...] >>> Get a warrant, search my system, find nothing but a bunch of applications >>> and a collection of risque (but definitely legal) pictures which I exchange >>> with a few friends. You may suspect that when the images are concatenated >>> in a particular way the low-order bits form a stego filesystem but no one >>> will be able to prove it in court. >> Are you concatenating these images by hand? If so, the level of entropy >> is probably low enough to recover the information through brute force >> methods or you are hiding a very small amount of information. > I hide the relatively small amount of data within a very large amount of > data which makes it impossible to find. Data from analog sources, like > the "real world" (images, sounds, etc) is noisy. This is a fact of life. > Because this data is noisy I can hide information in the noise. As long > as the information I am hiding maintains the same statistical properties > of noise it is impossible to pull the information out of the data file unless > you have the key. If I am paranoid enough I can make this key impossible > to discover without a breakthrough in factoring. Where will you keep your secret key? Remember, when they go through your house they bring 20 young graduates from MIT who are just dying to show how clever they are and save the world at the same time. > This is the essence of steganography and the nature of signal and noise are > fundemental principles of information theory. The concept of noise is not all that well defined, however. There is no way to look at a signal and say "this is all noise." Sometimes physical theories may lead you to believe that it is all noise. That is fine for many applications, but when becomes less convinced of things if the consequences are severe. >> If you are not doing it by hand, you own terrorist software and will pay >> the price. > Ah yes, terrorist programs like cat and perl and operating systems like > Linux which contain a loopback filesystem that I can hook a perl > interpreter into at compile-time (which is enough for me to rewrite the > program from scratch each time if necessary, unless things like math > libraries are also outlawed on computers :) I think that the crypto > concentration camps are going to be very crowded places. Can you elaborate on this? I am curious to know exactly what you are going to keep in your head and what goes on the disk. Please post the Perl code that you would type in from scratch every time. Peter Hendrickson ph(a)netcom.com

6 7

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 12:01 AM 11/8/1996, Timothy C. May wrote: > I don't believe it is as easy to differentiate between unencrypted and > encrypted traffic as Peter believes, and I definitely don't believe the > United States could stand--in the form it is in now, Consitutionally--if > forms of language and speech were to be banned and violators of the ban > were to receive harsh treatments. Maybe we don't differentiate between traffic. Maybe we work on tempest attacks. Think about this right now - do you know for sure that nobody is lurking in a van down the road with eavesdropping equipment? Do you know for sure that nobody is renting a room from one of your neighbors for all the equipment? If cryptoanarchy is unpopular, once you are a suspect - and are "guilty" - it is all over for your career as a cryptoanarchist. What are the benefits of being a cryptoanarchist? Maybe you get to double your income. Most people won't see this as worth the trouble. Peter Hendrickson ph(a)netcom.com

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 3:51 AM 11/8/1996, jim bell wrote: >At 06:25 PM 11/7/96 -0800, Peter Hendrickson wrote: >>At 5:12 PM 11/7/1996, jim bell wrote: >>> BTW, some of your confusion is probably based is the false assumptions in >>> your last sentence above. "..wide use of strong cryptography results in >>> widely unpopular activities such as sarin attacks and political >>> assassinations." >> No, you're confused, but it's probably my fault. We don't really know >> what cryptoanarchy will be like. We all have ideas about it. Some >> we share and some we don't. But we won't really know until we see it >> happen. > Well, uh, with all due respect, but while it's obviously true that we won't > know EXACTLY how it'll be, that doesn't mean that no portion of we imagine > will come true. At last some respect! (I agree with your point.) > This is particularly true on the big issues. For example, you hypothesized > that "wide use of strong cryptography resuts in widely unpopular activities > such as sarin attacks and political activities. I pointed out, almost > certainly correctly, that these are wrong: Yes, I think they are probably wrong. But, not everybody shares our view. Some people claim that we should not be allowed to communicate privately because of the terrible things that would happen if cryptoanarchy were to develop. But, these people want to make it illegal now (a big hassle) long before it is clear that we are going to have these problems. Imagine for a moment that LSD was just invented. Somebody then pointed out that it was possible to randomly dose people without their knowledge. The amounts required are virtually indetectible until it is too late. This is certainly possible, but in practice it almost never happens. I can only think of one incident I have heard about where somebody took a recreational drug involuntarily, and that was an accident. A lot of the things we talk about are that way. If they are not, it is entirely possible to put a stop to them, should there be broad popular support to do so. > 1. To believe that use in cryptography will result in greater numbers of > random attacks on innocent civilians. As I pointed out, the exact opposite > should be true: A greater ability to target the guilty means less reason to > kill the innocent. I imagine the guilty will never figure out that a pre-emptive attack on the innocent would be advisable. > 2. To believe that political assassination will be unpopular even if the > ordinary citizen has an effective say in who's going to die. Why don't you take an off-list poll of core cypherpunks and see how many of them share your view? I suspect not many. If not even cypherpunks are open to the idea, how many voters will be? > In other words, based on my understanding these beliefs are diametrically > opposed to the truth. Not simply a difference in extent, we're talking a > 180-degree change. > Your response is a sheepish, "but we won't really know until we see it > happen." Harrumph! What happened to my "all due respect"? ;-) >> My whole point is based on the proposition that the doomsayers are right. > Which doomsayers? What version of "doom"? Take a look at this essay by D. Denning: http://www.cosc.georgetown.edu/~denning/crypto/Future.html Denning writes: > A few years ago, the phrase crypto anarchy was coined to suggest the > impending arrival of a Brave New World in which governments, as we > know them, have crumbled, disappeared, and been replaced by virtual > communities of individuals doing as they wish without interference. > Proponents argue that crypto anarchy is the inevitable -- and highly > desirable -- outcome of the release of public key cryptography into > the world. With this technology, they say, it will be impossible for > governments to control information, compile dossiers, conduct > wiretaps, regulate economic arrangements, and even collect taxes. > Individuals will be liberated from coercion by their physical > neighbors and by governments. This view has been argued recently by > Tim May [1]. > Behind the anarchists' vision is a belief that a guarantee of > absolute privacy and anonymous transactions would make for a civil > society based on a libertarian free market. They ally themselves > with Jefferson and Hayek who would be horrified at the suggestion > that a society with no government control would be either civil or > free. Adam Ferguson once said "Liberty or Freedom is not, as the > origin of the name may seem to imply, an exemption from all > restraints, but rather the most effectual applications of every just > restraint to all members of a free society whether they be > magistrates or subjects." Hayek opens The Fatal Conceit, The Errors > of Socialism (The University of Chicago Press, 1988, ed. W.W. > Bartley III) with Ferguson's quote. > Although May limply asserts that anarchy does not mean lawlessness > and social disorder, the absence of government would lead to exactly > these states of chaos. Leaving aside Denning's snide (and evasive) remark about Tim, if her assessment of cryptoanarchy is correct, that will become clear in due time. There is no reason at all to think that it cannot be rolled back in the unlikely event that a disaster results. I would comment parenthetically that Denning's understanding of Jefferson is limited. Jefferson once said he preferred a free press to government. Jefferson once said that he thought a revolution every twenty years was healthy for a society. Jefferson was an accomplished mathematician. Jefferson invented a pretty good cipher. Jefferson was a cypherpunk to the marrow! >> I believe D. Denning has suggested that cryptoanarchy will result in >> the breakdown of our society. > I suppose that depends a lot on what a person means by the phrase, "our > society." Used as you (and maybe she, as well) this sounds like a > code-word. To a statist, "society" is basically the stratification system > that has developed to let one group of people control another. By that > standard, cryptoanarchy WILL "result in the breakdown of our society." But > that's all for the good. While I may not have paraphrased Denning and her (few) cohorts as accurately as I would have liked, I think your question is better directed towards them. Presumably when Denning says "social disorder" she is not thinking of disorderly relationships such as choosing your own job, or friends, or spouse, or whatever. Peter Hendrickson ph(a)netcom.com

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 12:58 AM 11/8/1996, stewarts(a)ix.netcom.com wrote: > Strong vs. weak crypto isn't the real issue - for most business use, > weak crypto is obviously unacceptable, but strong crypto with GAK > is ok as long as it doesn't interfere with use (and as long as the > government bureaucrats don't sell too many keys.) We often say that the government is a security weak point and that this makes GAK impractical. However, this is not true. If the holders of the government keys were individually responsible for their release, they would not be released very often. That is, in order to use cryptography you must purchase an expensive encryption license. That pays the salary of a certified "key escrow agent" who is the only person who can decrypt your messages. What stops him from revealing your keys to unauthorized parties? It's his business. If that's not enough, you back it up with criminal penalties for disclosure. And, hiring this person is no different from hiring an employee for your company. There are already similar activities. Lawyers are nominally employees of the state. Employees of Swiss banks can go to jail for violating their secrecy laws. > The government might be able to stop new Netscape versions from > using strong crypto - threatening to confiscate the company's > ill-gotten gains from aiding and abetting money launderers might help, > and threatening to confiscate PCs that use unapproved crypto. > But it's tough to use a widespread threat like that on popular > software once it's out there. I agree, if the software is popular. But, if the fears of the GAKers and the dreams of certain cypherpunks are real, such software will not be popular. Peter Hendrickson ph(a)netcom.com

1 0

His and Her Anarchies
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

Copyright c 1996, The Globe and Mail Company r U.S. election reveals his and her politics Educated women have different agenda By Graham Fraser Washington Bureau WASHINGTON - Bill Clinton's re-election has shone a spotlight on a widening difference in views between men and women in the United States, particularly among those with a university education. "Men and women, if college educated, agree about very little," Celinda Lake, a Democratic pollster, told a conference organized by the Brookings Institution yesterday. "Men and women would have elected a different president, a different Senate, and a different House of Representatives," Ms. Lake said. She pointed out that "men and women are coming to some pretty different conclusions" about the role of government and the importance of social programs. Polling has shown that women believe the government can play a positive role in solving social problems, while men feel that government is a problem, and that it is a good day when they have not been hurt by it, Ms. Lake said. "On our side of the aisle, we're beginning to wonder what a college education does for a man," she said. ... http://web.theglobeandmail.com/web/cgi-bin/ DisplayPage?SITE=web&KEY=961108.GlobeFront.UGUYSM

1 0

[NOISE] A modest :-) proposal
by Derek Bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To make things more crypto-relevant, I suggest a new source of noise should be analysed for crypto-security: this list. Of course, this should be done with an *un*filtered version of the list as filtering decreases noise. Derek http://www.maths.tcd.ie/~dbell/key.asc <- my public key available here -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQCVAgUBMoNp+FXdSMogwMcZAQFt3gP/WzfxzkOvc7gcTS2RL6Eiv3/hztGzdg6n PCC8xroKl+UZ6U9w/5EioB2GrEexc7QpcfWozqYqIeEfy8ZJlvKLU25/1cpWZrCe NrWWi+lsUanMUWn1JdkdjKFyEuHZl/E4FLjp9Fyy6C15scWJzeoISPKlSjru1qv7 A8pp3lyG/84= =u5Gn -----END PGP SIGNATURE-----

1 0

RE: WinKrypt
by James A. Tunnicliffe 17 Dec '03

17 Dec '03

By way of JYA: > >"WinKrypt's marriage of highly sophisticated technology -- such > >as the advanced, not-for- export 256-bit GOST encryption > >algorithm contained in the KeyMail program -- with a > >user-friendly interface virtually redefines the PC security > >category," said Syncronys. >> >> http://www.syncronys.com. ROTFL! Marvelous. This from the folks who brought us SoftRam95, arguably the most blatant fraud ever perpetuated on the software buying public. For that, they recently got off with a remarkably soft slap on the wrist from the FTC. (See http://ftp.uni-mannheim.de/info/OReilly/windows/win95.update/softram.htm l for the story.) I wouldn't buy a _screen saver_ from these folks, let alone a mission critical piece like email encryption! Tunny ====================================================================== James A. Tunnicliffe | WWWeb: http://www.inference.com/~tunny Inference Corporation | PGP Fingerprint: CA 23 E2 F3 AC 2D 0C 77 tunny(a)Inference.com | 36 07 D9 33 3D 32 53 9C ====================================================================== >

1 0

Rush disses anonymity
by Robert Hettinga 17 Dec '03

17 Dec '03

I'm sitting here listening to Rush, and he's talking about Pierre Salanger's recent "discovery" ;-) of the anonymously posted friendly-fire TWA800 internet message of a few months back. In the process of discounting the story, and praising FBI pal Kalstrom, he bemoans the anonymity of the net, calling it a "nest of kooks", (mixed in with all the other "right thinking people", of course...). Given this, and, of course, our own fun and games with anonymous, er, slander, on this list, I'm frequently tempted to agree with him. After all, if someone says something wrong about you, how do find them and punish them? How do you know what the truth is, unless you know who said it? (What? An appeal to authority? Moi? I'm *shocked* you would assert such a thing...) Until, of course, I remember that anonymity is unpreventable, and, frankly, economically necessary for true internet commerce. Remember what agrarianism did to try to stop industrialism (up to, and including, socialism <he said, trolling for leftists>), and expect the worst, folks. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

5 10

RE: Validating a program
by James A. Tunnicliffe 17 Dec '03

17 Dec '03

>Adam Shostack <adam(a)homeport.org> wrote (regarding PGP's security): >> In short, if you're paranoid, feel free to look over the >>source. But the fact that most people have never peeked under the >>hood is not a strike against pgp at all. Ed replies: >Maybe you missed my point, or I miss-communicated. My question is as >follows: If PGP and DES are as secure as thought to be, then why is it >not ruled illegal software, just as they do with silencers, narcotics, >certain type weapons, etc..... My opinion is "NOT A PARANOID VIEW, BUT >RATHER A REALITY". I find it impossible that software that could be a >National Security Threat, being shared by the masses! I believe >either people are nieve, or ignorant of the capability of the NSA. If >there are "back-doors to the algorithms, you can bet your life you and no >one else will find out. The conceivability that encryption on the Net >is safe, is ludicrous! > >Just my thoughts, and not paranoia. > > >Ed Why does it follow that these must be crackable, or the government would have outlawed them? Despite recent moves to limit encryption, there are currently NO domestic (U.S.) restrictions on crypto. Nothing prohibits you from using a true One Time Pad, which is mathematically proven to be unbreakable, now and forever, even against infinite resources. If this is not prohibited (and it isn't), doesn't that refute your argument? You may find it impossible that the masses are allowed to use truly unbreakable crypto, but it's true -- for the time being, anyway. Tunny ====================================================================== James A. Tunnicliffe | WWWeb: http://www.inference.com/~tunny Inference Corporation | PGP Fingerprint: CA 23 E2 F3 AC 2D 0C 77 tunny(a)Inference.com | 36 07 D9 33 3D 32 53 9C ======================================================================

2 1