December 2003 - cypherpunks-legacy

Why Crypto Is Hard
by John Young 17 Dec '03

17 Dec '03

Bruce asks his Risk post not be distributed on the Web. Okay.

1 0

DCSB: Money Laundering -- The Headless Horseman of the Infocalypse
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE-----BY SAFEMAIL----- The Digital Commerce Society of Boston Presents "Black Unicorn" "Money Laundering -- The Headless Horseman of the Infocalypse" Tuesday, December 3, 1996 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA S. L. vonBernhardt, <mailto:unicorn@schloss.li>, is an attorney, a member of the board of directors of two European financial institutions, author of "Practical and Legal Problems Confronting the Asset Concealer in Relation to Offshore Financial and Corporate Entities" and a former member of the intelligence community. He is currently working to develop and preserve institutions dedicated to traditional standards of financial privacy. One of the most disturbing products of the "war on drugs" has been the effective criminalization of many forms of formerly legal financial transactions. The resulting legislation places serious burdens on financial institutions in the form of "due diligence" requirements, as well as building what can be an inflexible barrier before those who would implement uncompromised digital commerce systems. Mr. vonBernhardt will address the legislative burdens imposed on financial institutions, the likely impact on future systems of digital commerce, potential solutions through regulatory arbitrage, and the practical problems facing jurisdictions seeking to enforce regulations in the face of advanced systems of digital commerce. No cameras, please. This meeting of the Digital Commerce Society of Boston will be held on Tuesday, December 3, 1996 from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, One Federal Street. The price for lunch is $27.50. This price includes lunch, room rental, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men, and "appropriate business attire" for women. We need to receive a company check, or money order, (or, if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, November 30, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston". If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Planned speakers for DCSB are: January Rodney Thayer Applying PGP To Digital Commerce February David Kaufman 1996 in Review / Predictions for 1997 We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, rah(a)shipwright.com . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to majordomo(a)ai.mit.edu . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to majordomo(a)ai.mit.edu . Looking forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE-----BY SAFEMAIL----- Version: 1.0b4 e22 iQCVAwUBMoSp3PgyLN8bw6ZVAQFaqgP/XPH82Z2EcgEpIQ0V2YiySW7Zlh/mYcxz xxoYtwVg5YwYmdlT7ueqFwRyzf/KfI4/MbLSj1NB+pDh2yEpZlokIo+u0qJPfYgT aP/bQg7fKOJ3iwrQUTlJuuxhM2TlUcqSlZXymgvvq/VZnq6uygT2GSC/OxMBTGrg aUq8cXlnNaI= =U4Mr -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

7 11

Re: Pseudo-law on the list and libel (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > >This opens up the potential, for example, for Tim May to sue the operator of > > >the Cypherpunks mailing list now for posts from users (even anonymous ones) > > >which defame or otherwise liable his character, reputation, or ability to > > >pursue income in his chosen field. In short the operators of the list > > >becomes publishers and distributors of the material. It is the legal > > >difference between a bookstore and a book publisher. > > There is a very distinct difference between ejecting disruptive influences > and conducting one's self as a publisher and distributer. Exactly. Because the list takes in submissions from ALL parties and then resubmits them to ALL SUBSCRIBED parties it qualifies as a publisher. The real issue here is that folks on the net want the protection of the 1st Amendment but they don't want the responsibility that goes along with it. This list qualifies as a press. As a result it has a responsibility relating to what it distributes. Vulis was unpopular he was not distruptive. At NO time did he interfere with the normal operation of the list software or prevent submissions or remailings. > > Pseudo-law on this list is really getting out of hand. > > We need more lawyers. That should replace the pseudo-law with real law. We need fewer lawyers and better laws. Most pseudo-law is practiced by lawyers. Jim Choate

3 2

Re: "Nightmare on Crypto Street--the Return of Sun Devil"
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 11:11 AM 11/8/1996, Timothy C. May wrote: > As I said in my "Nightmare on Crypto Street" piece, it seems that Peter > counters every one of our counterarguments with some variant of "won't > matter--they'll have a dozen agents and 20 MIT graduates looking for > evidence." Or, "won't matter, the Bill of Rights will be suspended for the > duration of the Emergency." Well, it's hard to argue with such points. I've created some confusion with my posts which have been less than organized. That's a consequence of making it up as you go along. The dialogue has helped me to refine my thinking. (Thanks, guys!) This is the rough structure of my thinking: 1. Hypothetically, let's say "Nightmare on Crypto Street" happens. 1.1 We can't guarantee this will not happen, therefore it must be addressed. 1.2 This is an unlikely scenario. 2. Thus, there would be broad public support for GAK. 2.1 By broad, I mean even many former cypherpunks would recant. 3. Broad public support makes suppression of strong cryptography feasible. 3.1 And, without dramatic short term erosion of the Constitution. 3.2 Or, a short term break down in the rule of law. 3.3 The number of violators would be small, so resources would be available to do hard things. 3.3.1 Such as having 20 MIT grads go over your house with a fine toothed comb. 4. What are the motivations of the GAKers? 4.1 They appear to want to suppress strong cryptography *before* we there is *any* evidence of a problem. 4.2 That is unnecessary, because if 1. occurs, it may be addressed. 4.3 It is as easier to impose GAK after 1. occurs, rather than before. 4.2 Could it be that they want to prevent the public from discovering the benefits of cryptoanarchy? 4.3 Why have the GAKers failed to address the risk of a police state? We've seen many police states historically. They are an obvious and serious risk. The GAKers have been oddly reticent regarding this point. In the future I will try to make it more clear which area I am addressing. I'm sure many cypherpunks feel we are just rehashing issues that were settled long ago. I think it never hurts to go over our assumptions and help new people to fully understand cypherpunk ideas. It never hurts to anticipate future moves by the GAKers, either, even ones they haven't thought of yet. These discussions generate ideas of how to effect the changes we want to see. For instance, if we develop low tech inexpensive and easy ways to support cryptoanarchy, it makes it much harder to suppress. The difficulty in suppression may prevent ill-advised attempts to do so. Also, the more we can erode the barriers between code and language, the stronger the case is that laws governing code are violations of the First Amendment. What if you had a compiler that accepted English language instructions for how to build a crypto system? "Take a random number 64 bits long. Then find a prime which is a little larger. Then...." The language itself should remain protected by the First Amendment even if somebody else has a compiler which can turn it into software. Another conclusion we can draw is that cryptoanarchy is more of a political issue than many of us would like. That means we might put more effort into public opinion than just straight coding. (Tim may claim otherwise, but I think he agrees with this in practice.) It may also be that the "bad boy" image of the Cypherpunks is counterproductive to our goals. Many people do not know how strongly I feel that GAK is a terribly risky policy, as I have been playing Devil's Advocate for the last couple of days. Given almost every situation that is likely to arise, I am totally opposed to GAK, and not just mandatory GAK, any GAK whatsoever. For instance, were I given the choice between intellectual property laws (off which I have made my living), and GAK, I would seriously consider discarding the intellectual property laws. It is that bad of an idea. And, like just about everybody else, the idea that certain forms of arithmetic could be illegal is deeply offensive in its own right. Peter Hendrickson ph(a)netcom.com

1 0

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 3:30 AM 11/9/1996, Adam Back wrote: >Peter Hendrickson <ph(a)netcom.com> writes: >> Where will you keep your secret key? Remember, when they go through >> your house they bring 20 young graduates from MIT who are just dying >> to show how clever they are and save the world at the same time. > Keep your secret key in your head. I think this is hard to do in practice. I have tried. >>> This is the essence of steganography and the nature of signal and >>> noise are fundemental principles of information theory. >> >> The concept of noise is not all that well defined, however. There >> is no way to look at a signal and say "this is all noise." >> Sometimes physical theories may lead you to believe that it is all >> noise. That is fine for many applications, but when becomes less >> convinced of things if the consequences are severe. > Your plausible deniability has to get quite low before it will stand > up as "proof" in court. (This goes under 3.1 or 3.2 of my outline, which you may not have received yet.) My idea is that the lack of noise is used as evidence to get a search warrant. The search warrant is used to get the evidence to put you away forever. (This goes under 3.3 of the outline.) The severe penalties and significant chance of capture will keep the number of cryptoanarchists low. > Your real challenge is keeping your stego programs safe. Boot > strapping a stegoed encrypted file system while leaving no stego code > lying around isn't that easy. Excellent point, especially since you don't have an encrypted virtual disk. Can anybody resolve this? >>>> If you are not doing it by hand, you own terrorist software and will pay >>>> the price. >>> Ah yes, terrorist programs like cat and perl and operating systems like >>> Linux which contain a loopback filesystem that I can hook a perl >>> interpreter into at compile-time (which is enough for me to rewrite the >>> program from scratch each time if necessary, unless things like math >>> libraries are also outlawed on computers :) I think that the crypto >>> concentration camps are going to be very crowded places. >> Can you elaborate on this? I am curious to know exactly what you are going >> to keep in your head and what goes on the disk. Please post the Perl >> code that you would type in from scratch every time. > My specialty :-) > rc4 in C: > #define S,t=s[i],s[i]=s[j],s[j]=t /* rc4 key <file */ > unsigned char s[256],i,j,t;main(c,v)char**v;{++v;while > (s[++i]=i);while(j+=s[i]+(*v)[i%strlen(*v)]S,++i);for( > j=0;c=~getchar();putchar(~c^s[t+=s[i]]))j+=s[++i]S;} > rc4 in perl: > #!/usr/local/bin/perl -0777-- -export-a-crypto-system-sig -RC4-3-lines-PERL > @k=unpack('C*',pack('H*',shift));for(@t=@s=0..255){$y=($k[$_%@k]+$s[$x=$_ > ]+$y)%256;&S}$x=$y=0;for(unpack('C*',<>)){$x++;$y=($s[$x%=256]+$y)%256; > &S;print pack(C,$_^=$s[($s[$x]+$s[$y])%256])}sub S{@s[$x,$y]=@s[$y,$x]} (Under 3.3) I would have a hard time memorizing these programs. This pretty much guarantees that the number of cryptoanarchists will be small. (I am deeply envious of your legal right to post this code, however. Now, why was it that we broke away from the Mother Country?) I would like to see a longer exposition of your approach. Given a hostile environment, how would I operate a small anonymous perl coding service using your techniques? Don't forget to tell me how I get paid and when I get to spend my "ill-gotten" gains and how nobody will notice that I am doing it. Peter Hendrickson ph(a)netcom.com

2 1

Black Unicorn exposed?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 11:00 AM 11/9/1996, Robert Hettinga wrote: > S. L. vonBernhardt, <mailto:unicorn@schloss.li>,... Black Unicorn recently stated that had taken measures to shield his identity so that people would be unable to cause harm to his professional activities by making unsubstantiated claims that could scare off prospective clients. It appears now that this protection has evaporated. It will not be very hard in the future to put this information together with other statements people may make about Mr. Unicorn. We are hardly operating in a hostile environment. Yet, somebody who has apparently gone to some effort to have an anonymous identity has been exposed. The implications of this are worth considering. Peter Hendrickson ph(a)netcom.com

11 10

Bruce's 'Why Cryptography Is Hard' is still draft
by Adam Shostack 17 Dec '03

17 Dec '03

----- Forwarded message from Phil Agre ----- >From rre-request(a)weber.ucsd.edu Sat Nov 9 05:16:00 1996 Resent-Date: Fri, 8 Nov 1996 20:50:17 -0800 (PST) Date: Fri, 8 Nov 1996 20:50:15 -0800 (PST) From: Phil Agre <pagre(a)weber.ucsd.edu> Message-Id: <199611090450.UAA27962(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: notes Resent-Message-ID: <"7C7uBC.A.H1G.I2Ahy"@weber> Resent-From: rre(a)weber.ucsd.edu Reply-To: rre-maintainers(a)weber.ucsd.edu X-URL: http://communication.ucsd.edu/pagre/rre.html X-Mailing-List: <rre(a)weber.ucsd.edu> archive/latest/1379 X-Loop: rre(a)weber.ucsd.edu Precedence: list Resent-Sender: rre-request(a)weber.ucsd.edu Notes on network computers, blind copies, democratic culture, monopolies, and the idea of an Internet establishment... As a periodic reminder, a Web archive of nearly all the RRE messages ever sent can be found through http://communication.ucsd.edu/pagre/rre.html It turns out that the article on cryptography by Bruce Schneier that I forwarded from the Risks Digest the other day was actually an unfinished draft that Peter Neumann sent out by mistake. Bruce asks that everyone refrain from propagating that version around the net. ----- End of forwarded message from Phil Agre ----- -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: Black Unicorn exposed?
by John Young 17 Dec '03

17 Dec '03

Sarah v. Bernhardt will be thrillingly laid bare in Beantown. Swiss cheese, she flashed, foxily fluttering the lie-machine. That "no cameras, please" is spooky-spooky tease, no dirty-looky pix of the Wonder Bare *ookie. Pseudo-Actors for hire. Harvard-bred, breeding lot of the B&B beaners. Dirty laundrying of tropical hula-moola, you betcha your rubber check, get there early, to admire the hall sweepers. Keep your eye peeled for the one-eyed one-horn in overalls using infra-red.

1 0

Re: Who owns cypherpunks [RANT] (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Jim Ray wrote: > > > I'm sure John's quaking in his boots. Reread my campground analogy, and try > > to refute it. You can't. Go start your own list with no moderation. Go start > > a more moderated list than John's, like Perry's will be. Do whatever, but > > this moronic thread must end! I run several lists and have for quite a few years. In that time I have never censored any member. I have had similar instances as to Vulis and my responce has been and will continue to be. "This is your problem, I have no authority to prohibit membership or submissions of members of the list. If you wish to not see such submissions from some party then it is your responsibility to deal with it. In short, either unsubscribe or filter." > Ironic, isn't it? Jim says "this moronic thread *must* end", and yet, this very list > that is John's *private* property is filling up with rants about censorship. Tsk tsk. I never said any such thing. Please quit attributing comments to me which are untrue. > Maybe next time they'll make it more apparent at subscription time that there's no > assurance of free speech here! The fact that it is 'private property' is irrelevant to this issue. Most 'presses' are private property. Trying to change the subject won't work. As to making it clear at subscription time what the actual operating rules are is my EXACT point. In fact you are agreeing with my position. At the current time there are no indications at log on that this list is considered private property, that the operator reserves the right to edit or refuse submissions, etc. which is what makes it a 'public' list and what makes him legaly liable for the cencorship he has enacted without warning. I have been on this list for several years and at no point in that time have I agreed to anything which gives the operator of the list my permission to modify or refuse my original submissions. If he or a third party wishes to refer to them in part or in toto in their own submissions is fine. That is the whole point of the list. Jim Choate

1 0

Re: New Linux-IPSEC mailing list for the S/WAN project
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 01:29 AM 11/9/96 -0800, John Gilmore <gnu(a)toad.com> wrote: >I'm sending you this message because you might be interested in >helping to build or test or document, or teach about, my S/WAN project >to secure 5% of the net by Christmas. > >There is now a public mailing list which you can join to find out >what's happening in the project, get the latest software for testing, >ask questions, etc. To join the list, send mail to: > linux-ipsec-REQUEST(a)clinet.fi >The email should contain a single line that just says: > subscribe Actually, it needs to say subscribe linux-ipsec # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk

3 2