December 2003 - cypherpunks-legacy

Microsoft CAPI
by Ravi Pandya 17 Dec '03

17 Dec '03

>From today's HotWired Packet http://www.packet.com: "Today Microsoft is using similar technology as part of its Cryptography API: You can't load an encryption engine into Windows 95 or Windows NT unless that engine has been specially signed by Microsoft's corporate key. The reason for this restriction, says the company, is the Clinton administration: Microsoft couldn't have gotten export permission for its operating systems if users could easily plug in crypto engines that hadn't been approved. " This is disturbing, if true, though I suspect there is also a less ominous reason: you certainly want your cryptography provider to be trusted, and you want to be sure the code has not been altered. The implications really depend on Microsoft's policy on signing cryptography engines, and whether they allow a way to delegate signature authority. Ravi

5 4

Re: pgp, edi, s/mime
by ratak 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: jubois(a)netcom.com, cypherpunks(a)toad.com Date: Wed Oct 09 10:19:39 1996 t: > > - S/MIME and PGP are the two leading candidates for encrypting EDI > messages, > S/MIME inside the US, and PGP outside the US where S/MIME is unavailable. > How far along has S/Mime come now, can they offer the same key sizes as PGP...? ___________________________________________________________________ GarGoyle Securities - -Intrusion Assessment Systems - -Security Consultation/Education/Curriculum Development - -Project Management/Research/Analysis World Wide... - -Member of CITDC (Canadian International Trade Development Council) - -Email: ratak(a)GargSec.mb.ca (Jason E.J. Manaigre) - -Web: www.GargSec.mb.ca - -Email for PGP key with phrase 'Get Public Key' as Subject - -2048 PGPKey iD E2 FA 30 E5 F5 AD EC F3 00 9A 9D 33 59 FC DF AD ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMlvCj/qtmO8M92GRAQFNBAf8CVzTxtle7jvTQFq6UM9MpEGjvrnoSHoO NMidciwyht0AqyGNPqNxczU/arpCAQwluwkhtTRor8lYsUWLLLyZB8d2DGs1i/En 3dE4WIXnNSR/G4YjHf8ln/DwE+YbHHFwEve5zSJAf4Gnvt7+LRo+VJPq34MaJgyc 5888BrSMHKTo5pyISAz+LQhDJptWMZwPsldrZctWI0QW/xgFMCmZr8qt2VYWdlZw XO+Px+QadwvNJlL8pR2ZT3l458rzU5B7kS3CKVJDl0iUlVWK2/xHiuRUHfo1Yu1Z VB6jFEw6IsQI8ukrANu90qgDcab3YQpe99BQCd/imZfKWSzO3vsieQ== =Ew/I -----END PGP SIGNATURE-----

5 5

Jewell shows warrants are frauds
by jim bell 17 Dec '03

17 Dec '03

There was yet another item on Richard Jewell today on the national news. If our goal is to return this country to allowing the government to do only the "reasonable" searches that the Constitution allows, we shouldn't miss the opportunity to take the Jewell case and shove it up their...well...use it to our best advantage. The _theory_ is that the only way the government could have gotten a warrant against Richard Jewell ONLY by showing some likelihood that evidence of the crime would be found. The facts, the end result is quite the opposite; the FBI has had a full opportunity to do their investigation and they've found...nothing. Or, at least nothing they're now willing to leak. Nothing, certainly, which they feel justifies filing charges. So they're probably going to just drop the investigation of Jewell. But at this point, we should consider that practically an engraved invitation: The theory behind ALL warrants is that they are granted only upon a showing to a judge of a legally satisfactory reason to grant the warrant. Given the outcome, it is almost certain that no such showing ever occurred. What happened, on the other hand, was probably just another fraud. Some prosecutor or investigator did some magic dance in front of a judge, pretending to tell the truth, and the judge pretended to believe him. The difference with this case, however, is that a few hundred million people heard about it. That's why this case, unlike nearly all others, presents a marvelous opportunity. All of the various Clipper/GAK proposals are based, ultimately, on the same weakness: The idea that we, the people should be able to trust some overpaid government-thug-sympathizer in a black robe to decide whether or not a given set of evidence is sufficient to decide to grant a warrant. Perhaps the best challenge to this idea is to show a clear example of how the system fails, precisely when it's expected to WORK! The Jewell incident is a good test-case, if for no other reason that it was highly publicized and many if not most people know the basics. In addition, unlike a case which was thought insignificant before and only later became well-known, all of the officials who had anything to do with it were, presumably, fully aware how important it was and could be expected to be "on their toes" about ensuring that they do their jobs correctly. Quite simply, the authorities had every reason to get this one RIGHT, as opposed to getting it wrong. They got it wrong. We should insist that the details of this disaster be exposed to show them for the lying frauds they are. Jim Bell jimbell(a)pacifier.com

1 0

Have you had your privacy invaded? Be on Oprah!!!
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 8 Oct 1996 15:02:14 -0500 From: marsha-w(a)uiuc.edu (Marsha Woodbury) Subject: Have you had your privacy invaded? Hi-- I am looking for someone who lost a feeling of privacy-- I need a "victim" to tell a story about how he or she had her privacy invaded and how he/she felt about it. The Oprah Show is looking for a real-life example of someone whose name got on a strange list, or whose unlisted phone number was given out, or whose medical records were made known to insurance companies--anything like that. The show is next Wed. and they will pay to get you there if you have a good story to tell (and it had better be a true story!!) Call Dana Newton of the Show if you have story to tell... 312-633-0808 Thanks! Marsha Woodbury, Ph.D. Director of Information Technology Graduate School of Library and Information Science UIUC Chair, CPSR http://alexia.lis.uiuc.edu/~woodbury/ Work: 217- 244-4643 FAX: 217- 244-3302 marsha-w(a)uiuc.edu CPSR's Annual Meeting and Conference, "Communications Unleashed" will be held Oct 19-20 at Georgetown University in Washington DC. For information or to register, see http://www.cpsr.org or e-mail cpsrannmtg(a)cpsr.org

1 0

yellow journalism and Encryption
by Vinnie Moscaritolo 17 Dec '03

17 Dec '03

The following is an example of the asswipe media's attempt to write about encryption. http://www.sfgate.com/cgi-bin/examiner/article.cgi?year=1996&month=10&day=0… icle=BUSINESS2814.dtl Encryption controversy pits life against liberty TOM ABATE EXAMINER COLUMNIST The Clinton administration tried again last week to rally support for an encryption policy that would give the FBI the means to tap any electronic communication, without unduly infringing on civil liberties or impeding software exports. At stake in the policy battle are software exports worth millions, Fourth Amendment rights Americans have enjoyed for centuries, and innocent lives that the good guys say might be saved if they're able to keep snooping on the bad guys. And the reason all of this has become a policy jumble is simple. Computers have made it cheap and easy to create unbreakable secret codes to protect phone calls, e-mail and data files against electronic bugging. That's why this technology, called encryption, means profits in Silicon Valley, more privacy for you and me, and a problem for federal investigators. Because secret codes allow criminals to nullify the fed's favorite tool - the wiretap. "Wiretapping is the main issue," said Stewart Baker, former general counsel of the National Security Agency, the CIA's code-breaking and eavesdroping cousin. "For the administration to abandon the position it started with three years ago would be to say, "We are the administration that is going to give up the wiretap as a law enforcement tool,"" he said. That's why last week the administration tried a new variant in its 3-year-old campaign to require that code-making systems be built with a "spare key" investigators could retrieve, under court order, to crack any code. When the administration first proposed this idea in 1993, it involved a device called the "Clipper chip," which would have deposited spare keys with government agencies. Almost no one outside the FBI liked that idea, so last week the administration floated a compromise: to let U.S. firms export strong code-making products, provided they deposited the spare key with some third party. Exports are the odd piece in this policy puzzle. The U.S. government has no authority to regulate secret codes within U.S. borders. But a law passed after World War II put secret codes in the same category as munitions, products that cannot be exported without a license. The government has used this export-licensing authority to indirectly control code-making software here. Most high-tech firms are unwilling to sell two sets of encryption products, one full- and the other half-strength, so they have sold weak encryption products everywhere. In essence, the administration hopes to use export controls to change the balance of power in a new war. This time the enemy isn't the Japanese or the Germans, as during WWII, or even our Cold War adversaries, the Russians. Instead, the administration fears drug smugglers, organized criminals and terrorists will use code-making devices to evade electronic evidence-gathering techniques, notably wiretapping. "If two criminals are discussing a plot over the telephone and we have a wiretap order, the encryption would negate the wiretap," said Michael Vatis, a senior Department of Justice official. The same would happen if investigators seized the computerized bookkeeping records of a drug-smuggling ring only to find they were saved in an unbreakable code. But as frustrating as it might be to seize a mound of indecipherable evidence, it was the prospect of losing the wiretap that got Vatis most aroused. "For serious investigations involving terrorists or organized crime . . . where you're worried about hundreds of people being killed . . . the whole point is to keep the investigation secret or the whole thing blows up," he said. Having access to a spare set of code-breaking keys "is not a shift in the balance of power," Vatis said. "It's preserving the status quo." Not so, argued Daniel Weitzner, an attorney with the civil libertarian Center for Democracy and Technology inWashington, D.C. Forgetting encryption for a moment, Weitzner said, a wiretap is unlike any other tool in the investigator's arsenal. "To get documents sitting on my computer, the FBI has to come into my office with a search warrant," Weitzner said. "I have to know about it." Exactly the reverse is true for a wiretap. To be effective, the subject must be ignorant of the tap. Weitzner said this notion of a "secret search" went against a central principle of the Fourth Amendment, which protects people from unreasonable search and seizure. "When wiretapping was allowed in 1968, Congress basically said they were going to create an exception to this rule," Weitzner said. But in the three years since the Clipper debate began, the FBI has enlarged its interest beyond preserving phone taps and has asked for spare keys to the codes used to protect Internet traffic and stored computer files, Weitzner said. "If the FBI is able to transfer its wiretap authority to the Internet, it would give the bureau access to a new realm of activities," Weitzner argued. Using the spare keys to Internet transmissions could give the agency access to medical records, charge card receipts or other data stored or transmitted on the global network. Moreover, the agency might be able to tap some of this information in transit, without the knowledge of the person being investigated, whereas today agents would have to visit the doctor's office or bank, potentially alerting the target. "If all things in the digital world are open to wiretap-type scrutiny, then we have lost the protection against secret searches," Weitzner said. "What is on the way to happening is that the exception could swallow the rule." The temptation to tap wires is as old as wired communication itself, according to Clifford Fishman, law professor at Catholic University's Columbus School of Law in Washington, D.C., and author of a textbook on wiretapping. During the Civil War, both sides tapped telegraph lines to spy on troop movements. Wiretaps were common in the early days of the telephone, and Supreme Court decisions during the 1920s said this was no invasion of privacy because the tap was on a public telephone pole and not inside a home. In response, Congress made wiretaps illegal at the federal level as part of the Communication Act of 1934. But Fishman said state investigators kept right on using wiretaps, as did the feds, who sometimes used unauthorized taps on Mafia and political figures during the long reign of former FBI director J. Edgar Hoover. Congress legalized federal wiretaps in 1968 at a time when Richard Nixon was campaigning against the liberal Earl Warren Supreme Court. "The mood in Congress was to defang the Republicans on law enforcement," Fishman said. "Lyndon Johnson, with palpable reluctance, signed this bill to permit federal officials to obtain a court order to do a wiretap or a bug and use this information in court." Fishman, a former New York City district attorney, considered wiretapping essential to investigating the most dangerous crimes and called the administration's latest spare-key proposal a good compromise. But civil libertarians fear that giving investigators the keys to unlock any coded phone call or electronic document will greatly expand the realm of secret searches and tempt them to abuse a power that was denied them in the days when ensuring privacy meant putting wax seals on envelopes. Much of the coverage of the encryption controversy has centered on the complaints of Silicon Valley firms that they are losing hundreds of millions of dollars in exports to foreign competitors who don't have to limit the strength of their encryption products. Though that may be the case, there's more at stake here than money or jobs. Our wired society is about to decide how easy it should be for investigators to figuratively climb up the telephone pole to put alligator clips on our secrets, whether innocent or criminal. To give investigators the keys to every code might be too much temptation and a threat to civil liberties. To deny investigators the keys may handcuff them in the fight against increasingly sophisticated and deadly forms of crime. That is the nature of the choice on encryption policy, and that is why there is no simple compromise. Tom Abate's column appears every other Sunday. You can reach him this fool mailto:tabate@examiner.com Vinnie Moscaritolo http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A ------------------------------------------------------- "...and by the way, Mr.Speaker, the Second Amendment is not for killing little ducks and leaving Huey and Dewey and Louie without an aunt and uncle. It's for hunting politicians, like in Grozny, and in the colonies in 1776, or when they take your independence away." --- Rep. Robert (B-1 Bob) Dornan (R-CA) responding to Bill Clinton's "State of the Union" address, January 25, 1994

3 2

Not content with the CDA, Sen. Exon derails Pro-CODE
by declan＠well.com 17 Dec '03

17 Dec '03

********* Date: Tue, 8 Oct 1996 17:54:52 -0500 To: fight-censorship-announce(a)vorlon.mit.edu From: declan(a)well.com (Declan McCullagh) Subject: Not content with the CDA, Sen. Exon derails Pro-CODE When the White House wanted to derail pro-encryption legislation, they knew where to turn: to the infamous author of the even more infamous Communications Decency Act. Last month Sen. Jim Exon (D-Nebraska) wrote the attached letter to Sen. Pressler, chair of the commerce committee, days before the ProCODE pro-crypto bill would have cleared its last hurdle in committee then moved to the floor of the Senate for a vote. Because of Exon's threatened "several amendments" that would defang the bill, the markup never happened. Thanks to Exon, it didn't have a chance. But don't blame the retiring senator from Nebraska. Not only are your electrons wasted, he's not the true culprit. It was the White House, in thrall to the Justice Department: Gore advisor Greg Simon made the calls to Exon's office that prompted this letter to Pressler. -Declan http://fight-censorship.dementia.org/top/ Background: http://www.hotwired.com/muckraker/96/36/index4a.html ****** September 9, 1996 The Honorable Larry Pressler Chairman Senate Commerce, Science and Transportation Committee 243 Russell Senate Office Building United States Senate Washington, DC 20510 Dear Senator Pressler: I understand that the Senate Commerce Committee may have a markup this week to consider the so-called Pro-CODE computer encryption bill. As you know, the computer industry has had a series of high-level discussions with the President, Vice President, and the government's national security experts. I am hopeful that these discussions will produce substantial and meaningful reform in the current export regime for encryption software. Given the national security and law enforcement implications of the proposed legislation, to rush into a mark-up before these concerns are resolved would be a mistake. If the measure is taken up on Thursday, I would expect that there would be several amendments. With best wishes, Sincerely, Jim Exon United States Senator cc The Honorable Fritz Hollings ###

1 0

Government Denial of Service Attacks
by Duncan Frissell 17 Dec '03

17 Dec '03

Those who read this list or watch the news of the "Wired Curtain" that is attempting to be drawn across the Net know that there is a theory out there that government Denial of Service Attacks (GDOS) are a real threat. The GDOS theory holds that if government legislates or even threatens litigation against the provision of a particular service, the providers of the service will fold and the public will be unable to obtain the banned service. In the case of the net this is the "Do Not <--'Enter" theory. The governments claim that by threat, deception, or nuclear weapons, they can keep millions of us from hitting the <--'Enter key and thus transmitting banned material. That is a very fine control regime indeed. (Original meaning of 'fine' of course.) If the governments had this GDOS power; this Do Not <--'Enter power, then the article on the front page of today's New York Times could not have been written. "Behind a Suburban Facade in Queens, A Teeming, Angry Urban Arithmetic" is the annual NYT article on the spread of illegal apartments throughout the Region. From the humblest urban ghetto to the swankiest suburbs, denizens of the TriState area are converting one- and two-family dwellings into two- three- or four-family (and denser) dwellings. These illegal apartments are commonplace and illegal. This has been true (and written about) for years. Here we have a physical service (apartment rental), difficult to hide, and illegal which is offered by hundreds of thousands of property owners in this area. The GDOS theory holds that this can't happen. "All they have to do is pass a law." Note that the GDOS theories that involve our activities say that once the government passes a law, no one (or hardly anyone) will offer an anonymous Net account, or an uncensored ISP connection, or an un IDed financial account, or an uncensored news server, etc. That all government has to do is pass a law and all transactions will be carried out in rigid conformity to its dictates. I say nonsense. If the government can't keep thousands of property owners (with their physical property at risk) from offering it for rent illegally, in an "open, notorious, and continuous" manner; then they aren't going to be able to keep very many of us from hitting <--'Enter. DCF "During Fiscal 1996, the Government of the United States collected more taxes from the American people than any government had ever collected before in the history of mankind. During Fiscal 1997, the Government of the United States plans to collect more taxes from the American people than any government has ever collected before in the history of mankind. And still it's not enough."

3 2

Re: Put up or shut up!
by azur＠netcom.com 17 Dec '03

17 Dec '03

>At 12:44 AM 10/7/96 -0700, James A. Donald wrote: > >>The reason that no one publishes "How to" step by step instructions for >>discretely expatriating your money is exactly the same reason as the reason >>that nobody publishes "How to" step by step instructions for buying dope. >> >>For example one ever popular method of expatriating money, (or repatriating >>it to preferred politicians), is by means of a friendly cattle futures >>broker. > After establishing your offshore banking account you can move moderate amounts of money there from the U.S. by using private money order or travellers checks. Most money transmitters and banks won't ask for ID or that you fill out the payorpayee in the process. If you live in a large city there should be enough outlest to enable you to transport $10,000s/month without seeing the same merchant twice in same month. It'll just look like you don't have a checking account and are paying you're monthly bills. The advantage of these instruments, of course, is that they are relatvely safe from loss. As was pointed out earlier on the list, you can use FedEx to send int'l parcels w/o providing identification. -- Steve

2 1

BBS generator
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

Does anyone here know the approximate ammount of output from a BBS PRNG needed to predict with some certainty the next bit or bits? - is the generator totally secure, ie. do you need to factor to predict or is there an attack using the output? Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

2 1

Re: 2Re: Best-of-Crypto
by Lucky Green 17 Dec '03

17 Dec '03

On Tue, 8 Oct 1996, Timothy C. May wrote: > I read the full list, so I don't keep these URLs bookmarked or handy. > Arachelian posts to Cypherpunks regularly, so contact him from those > messages. Blossom is involved with his company, "Infosec," so some > combination of these words in a search engine should turn up something. Eric Blossom is eb(a)comsec.com. His URL is http://www.comsec.com/ check out his nifty bump-in-the-cord 3DES phone encryption device. --Lucky

1 0