December 2003 - cypherpunks-legacy

Did Sun get a sweetheart deal?
by Ernest Hua 17 Dec '03

17 Dec '03

So why did Sun cave in? Ern -------- From San Jose Mercury: "Good Morning Silicon Valley" NASA has its day in the Sun Sun Microsystems Inc. said Wednesday it received two contracts from NASA's Goddard Space Flight Center worth a total of $100 million. The Mountain View-based company said the pact calls for software development and the design about 34,000 computer-aided engineering and design workstations. NASA will use the workstations to design integrated circuits.

6 6

Re: [FACTS] Mountain Meadows Massacre
by Deana Holmes 17 Dec '03

17 Dec '03

On 3 Oct 96 at 14:42, Dr.Dimitri Vulis KOTM wrote: > "Deana Holmes" <mirele(a)xmission.com> writes: > > <snip mor(m)on propaganda> > > > > <snip Dmitri Vulis nonsense> > > No wonder the criminal cult doesn't want its foul deeds subjected to > public scrutiny by "dead-agenting" its critics. Is Timmy May a > paid cult apologist? Sheesh. You know you're doing good when both Dmitri Vulis and Attila both badmouth you. (For the record, Attila's badmouthing consisted of stating via private email that I was "the same air head pseudo-intellectual who has poisoned her own life with hatred and ignorance in so many other venues.") Some people are just terribly threatened, I guess. Deana Deana M. Holmes April 1996 poster child for clueless $cientology litigiousness alt.religion.scientology archivist since 2/95 mirele(a)xmission.com

2 1

paging nets
by Jeff Ubois 17 Dec '03

17 Dec '03

Interesting recycled bits from Newsbytes concerning a BBC story drawn from Usenet: BBC Blows Radiopager Security Systems Wide Open LONDON, ENGLAND, 1996 OCT 2 (NB) -- By Steve Gold. The British Broadcasting Corporation (BBC) has revealed that radiopaging messages on the UK's paging networks can be read by anyone with a radio scanner and suitable PC software. In addition, the British TV company claims that it is also possible to insert bogus messages onto the paging networks using instructions on the Internet. ... BBC journalists, meanwhile, said that UK radiopaging transmissions were unencrypted and, as such, were insecure when viewed alongside digital cellular phones, where signals are encrypted. ...the BBC claimed it had been shown messages reporting on the activities of Tony Blair, the head of the British Labor Party, along with a message referring to a residence of a member of Royalty. Newsbytes noted that the same system is used in the US.

1 0

Re: Fighting Clipper III
by apteryx＠super.zippo.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- erm, a boycott means not _buying_ a product, as opposed to not _using_ a product. In the case of PGP, I never intended to purchase it from RSA. As for Netscape, there are other browsers out there (or so I heard). Realistically, a boycott is likely to be ineffective. Writing letters to companies and congresshmucks and working with non-US crypto companies to create a standard that can be legally imported into the US (for now) would be more effective, IMHO. Boycotts rely on large numbers of participants, and not enough people understand or care about encryption. We'd be better off trying to change that first. Mark On Thu, 3 Oct 1996 06:37:45 -0700 (PDT), Declan McCullagh <declan(a)eff.org> wrote: >You'll have trouble doing a successful boycott of RSA. What, you won't >use Netscape Navigator or PGP? > >-Declan > > >On Wed, 2 Oct 1996, Jim McCoy wrote: > >> Rich Burroughs <richieb(a)teleport.com> wrote: >> [...] >> >>>On Wed, 2 Oct 1996, John Young wrote: >> >>> >> >>>> The New York Times, October 2, 1996, pp. D1, D8. >> >>>> Executives of the International Business Machines >> >>>> Corporation said late yesterday that they were still lining >> >>>> up the final list of companies in the alliance. Those >> >>>> involved will include Digital Equipment and smaller >> >>>> data-security companies including RSA Data Security, Cylink >> >>>> and Trusted Information Systems. >> >>> >> >>>We are in deep trouble. >> >> >> >>Wouldn't a letter-writing campaign be in order here? >> >[snip] >> > >> >The word "boycott" leaped into my mind. I personally do not believe that I >> >will be buying products from any of these companies, as long as thay >> >participate in this GAK charade. >> >> Such an initiative will need publicity and letter-writing early in the >> campaign will help us set the tone and points of debate on this issue. >> A boycott works best when everyone knows why and there are a few key >> phrases which can be used to get the message across. Something like >> "company X is helping build big brother, boycott their products" or a >> few similar sound bites are needed fast. The big brother inside stickers >> from the last campaign were nice, maybe people can come up with variations >> of various corporate logos or marketting phrases which help get the message >> across? >> >> jim >> >> > > >// declan(a)eff.org // I do not represent the EFF // declan(a)well.com // > > > -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMlQmC936bir1/qfZAQF9dwL/fN1HZhHWbnOa6gZ71WMwf32nuOGS1CGm H2f9MlNvZhYF6TVAwCmfUG4hgeJQLkC97GrR/0hIfNYzir0Eb+qmF2Mptvl5tUiJ I89H2WRVl+BJBoqThGXJx8BqL6uVDX9H =sBVJ -----END PGP SIGNATURE----- Mark Heaney finger snipe(a)starburst.cbl.cees.edu for public key PGP Fingerprint= BB D8 9B 07 51 87 05 AC 47 7B F2 4F A6 AB 1A CD ----------------------------------------------------------------- Vote against government *** Vote Libertarian

2 1

Re: Clipper spin [was Re:Flood Warning]
by jim bell 17 Dec '03

17 Dec '03

At 12:00 PM 10/3/96 -0800, Jim McCoy wrote: >[...] >> >> High-Tech Leaders Join Forces to Enable International >> Strong Encryption >> >> See: http://www.ibm.com/news/alliance2.htm > >The "International Strong Encryption" phrase is something that we >need to become active in stopping. Anything which responds to such >announcements should put a different spin on this phrase. If the >Clipper farce is accepted as "strong" encryption then the battle is >lost; maybe something like "it is _international_ strong encryption >because it is the strongest encryption people like Saddam Hussein [insert >bogeyman du jour] want Americans to have access to" Idea 1: It should be called "International Weakened Encryption." Idea 2: The "alliance" term above in the URL should be replaced with "Axis." Jim Bell jimbell(a)pacifier.com

1 0

gack vs. key escrow vs. key recovery
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

cpunks, a note about recent developments in "key recovery" initiative. I think cpunks as a group should reconsider very seriously their own positions on cryptography and come up with something more sophisticated than "any government bill or plan associated with crypto is evil" which is the functional equivalent of the ideology behind many recent posts. what is the precise difference between gack, key escrow, and key recovery? TCM has argued that the administration is muddying the issue by manipulating the terminology. perhaps so, but I feel that cpunks are equally guilty, by branding anything that emanates out of the government as inherently orwellian. do you always have to have an enemy? is the government always going to be your enemy, no matter what they do? I have posted here before that many companies find the concept of "key recovery" highly acceptable and even desirable. the basic question is, what does this mean to wiretapping and search warrants and subpoenas? it is clear we are coming to a fork in the road at this moment. there are going to be two types of cpunk opinions based on recent developments. 1. those who feel that wiretapping was illegitimate from the start and are working to make wiretapping impossible. confronted with a legal search warrant/subpoena etc. for personal data, they would not hand over keys. they would "superencrypt" in systems that do etc. 2. those who feel that there is such a thing as a legal warrant or subpoena for information protected by cryptography keys, and would agree that this logically means that governments will be getting access to "key recovery" infrastructures. personally I am leaning toward 2, because I feel that we already live in such a society, and that it is not orwellian. companies are going to lean toward (2). I do agree that the gov't has the potential to twist this process to evil ends, but that has always been true of everything about democratic government, and the recipe for 200+ years has always been and remains "eternal vigilance". in other words, I am in favor of some kind of mechanism by which the government can obtain keys via subpoenas/warrants. cpunks, I think we should try to clarify our terms and come to some conclusions. those who continue to pursue (1) are going to be perceived as more and more radical and extremist, because arguably it is not even a system we have today or one that was ever devised. remember, the constution guarantees freedom from *unreasonable* search and seizure, but never prohibited search and seizure in the first place!! apparently at least our found fathers believed that "reasonable" search and seizure was a wholly legitimate function of government, based on this wording. regarding (2): the government may actually help bring crypto to the masses via the post office and other routes. are cpunks going to continue to hold the simplistic, reactionary, knee-jerk, black-and-white opinion that "anything with the word 'government' in it is evil"? "if the government is doing something, then we must sabotage it"? I'll be watching the debate closely, as the true extremists incapable of compromise (and thereby living in a fantasy world) show their colors....

6 6

How to fight GAK by obeying the law
by Ernest Hua 17 Dec '03

17 Dec '03

It seems that the best method for fighting GAK is to accelerate wide-spread domestic use of freely redistributable non-GAK crypto. The Lynux automatic firewall concept that John Gilmore is pushing is a great idea, but it is still brewing, and he's shooting for developing an exportable ... er ... importable version. That will take much time to develop, and time is what we don't have much of. We need to work on applications, API's, flexible software modules, etc. and the primary reason we cannot do it so easily is because we cannot redistribute the software so easily. First thing we definitely need is a way to determine with fairly good accuracy, whether a host is in the U.S. This MUST be an automagic mechanism ... no person involved so there is little delay in getting the goodies. The best implementation would automatically set the group of an incoming anonymous FTP session daemon to a special group if there is a high degree of certainty that the originating host is within the U.S. Second thing we definitely need is a convenient way and universal way to clearly notify the recipient of the current export restrictions of such software, so that the recipient knows what he/she is in for. Basically, we have to do our best to NOT violate the law, no matter how much we hate it. What the government wants to happen is that everyone will get hooked on GAK, and it will be too inconvenient to use something else. A good counter-strategy is to get everyone hooked on the good stuff. Right now, the FBI/NSA is looking for an excuse to prosecute anyone not jumping on their bandwagon. We have to avoid give them an excuse to prosecute us while still enabling rapid application development. Communication and distribution are key. Ern

3 2

Clipper III questions
by Eric Murray 17 Dec '03

17 Dec '03

The recent CDT policy post sez of Clipper III: >* Access to keys internationally "would be provided in accordance with > destination country policies and bilateral understandings." This reminds me of the understanding between CIA/NSA and their counterparts in British Intelligence. Both sides are prohibited from spying within their own countries borders but are encouraged to spy in other countries. Both would very much like to spy on their own citizens (for legitimate law encorcement/national security reasons only, of course). So, they have a simple system in place. The British spy on the American citizens that the Americans want spied on and then turn over the intercepts. The Americans do the same for the British in Britain(*). Sometimes they lie to each other or withhold material, but that's what spy organizations do all the time. If Clipper III passes and the OECD gets their member nations in line with what the American miliary wants, I predict a similar system will evolve. "Destination country policies" will allow decryption of incoming GAKked messages from non-citizens. After all, they have no rights, do they? Cooperating intelligence agencies will then exchange intercepts. Presto Chango, pesky privacy rules vanish right before your eyes! Of course this is in our best intrest, we must fight against terrorisim with all methods possible. The ends justify the means. A question: What happens if a company decided not to go along with Clipper III? Can they still ship the "old" 40-bit-style GAKware unimpeded? Or will there be a slow tightening of the rules to force compliance? The existing way of doing things depends to a large degree on a set of "common practice" which the NSA doesn't have written down. For example you won't find the 40 bit limit written anywhere in ITAR, and if you want to export something that's already been approved elsewhere (i.e. another implementation of SSL) you still have to go through the approval process. (*) this comes from "The War Aginst the Jews" which is worth reading. Sorry I can't find my copy at the moment, maybe someone who's got it handy will provide authors/ISBN. Capsule review: covers government dirty dealing from the early 1900s on, mostly British and American. Concentrates on Jews and Israel of course but they seem to have been the brunt (sometimes the instigator) of a lot of the dirty pool that governments have played. -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

3 2

DESCrack keyspace partitioning
by geeman＠best.com 17 Dec '03

17 Dec '03

What about the heuristics of partitioning the keyspace? Seems to me that a _subset_ of all possible keys is much more likely to appear than a random selection from an equidistributed population 0..2^56. (P)RNG's just aren't that likely to produce a key of 010101010..... nor 001100110011... etc etc and I have been thinking about how one might formalize and exploit this randomness property to increase the probability of finding the key sooner. So a keysearch strategy should be something other than a partitioning of 2^26 into N bins with a linear search within each bin. I realize that it is POSSIBLE that a key of 1010101010... was used, (excluding weak keys from consideration) ---- but I have seen "certifiable" RNG's and, God Bless 'em, they just dont ever produce anything with any predictability. Is not the lack of predictability a predictable, and therefore exploitable, attribute? Any thoughts here? ----------

9 9

Re: Fw: Re: ITAR satellite provision
by jim bell 17 Dec '03

17 Dec '03

At 02:05 PM 10/3/96 -0400, Michael Froomkin - U.Miami School of Law wrote: >Alas, a common fallacy. > >You have committed a prohibited export when the stuff lands outside the >USA....It's not illegal when it goes up ("by reason of the launching" and, >e.g. *stays up* in orbit) but it is illegal when it comes down abroad. Sure about that? The regulation said something like "launch vehicle" or "launch," apparently indicating that a "launch vehicle" could actually be exported, THEN launched, etc, without violating ITAR. And since the regulation does not go into any detail about the "launch", other than it is a "launch" (and does not explicitly prohibit landing subsequent to launch) the implication is that there is no prohibition. I still think the regulation was just written sloppily. Jim Bell jimbell(a)pacifier.com

2 1