December 2003 - cypherpunks-legacy

AW: Binding cryptography - a fraud-detectible alternative to key-escrow
by douzzer＠MIT.EDU 17 Dec '03

17 Dec '03

oh pooh, you've seen this material run through over and over. perhaps you respect my "opinion" because you know i am right. i know i don't respect your position, because i am irrevocably convinced that you are wrong. acceptable: -tracking of all chemicals which have been or can be manufactured into poisons, explosives, or psychoactives (cannot buy or sell anonymously) -tracking of all automobiles and deadly weapons -restrictions on yelling "fire!" in a crowded movie theater that isn't on fire unacceptable: -restrictions on what i can think, who i can speak to, what i can say, and how i say it, aside from shouting lies in a crowded movie theater or other such crowded public place. -restrictions on how i can defend myself when my life is threatened -prohibitions on drug purchase, sale, or use i'm not ever going to change my position on this. you can drive bamboo shoots under my fingernails and toenails, you can megadose me on LSD, you can pull my teeth and administer electric shocks to my testicles, and i am still going to believe that absolute information privacy, and absolute freedom of thought and conversation, are inalienable human rights. if what you want to stop is airplane explosions, landmines, poisoned water supplies, and mailbombs, please PLEASE make it your personal mission to see that chemicals are more tightly controlled, airports have the latest and greatest nuclear resonance tomographic imagers, landmines aren't manufactured or sold any longer, water supplies are tested around the clock using the latest technology, and everyone knows not to open unsolicited packages. if what you want to stop is drugs-prostitution-gambling, perhaps you had better wake up. organized crime, and the drug lord, are created and empowered by laws which make drug sales, prostitution, and gambling illegal. why are they illegal? who is the victim? if you take away the legal mandates which impose the wills of religious zealots, you take away the structures which grant monopolies to violent criminals. no amount of pontification, education, or legislation is going to rid the world of people who will do whatever is necessary to get drugs, visit prostitutes, and gamble. so if you make them illegal, you instantly create a perpetual menace. and now you expect me to agree that we should help the government listen to everyone's communications, so that they can stop drug dealers, prostitution rings, and betting pools? hello? they created the problem. i don't trust my government. i don't trust ANY government. government is that segment of society that arrogates a monopoly on "legitimate violence." it is composed of powergrabbers, and ass-kissers with sinecures, who are paid with stolen money, some of it stolen from me. the last thing in the world i am going to find acceptable is a law that says i have to tell the government everything i tell my lover over the phone. fuck that! -douzzer

2 1

Re: extortion via digital cash
by Gary Howland 17 Dec '03

17 Dec '03

> Although Digicash's ecash offers anonymity to the payor it does not to the > payee. The reasons have to do with the way coins are blinded. So LE > could, with the bank's cooperation, easily associate the two sides of a > transaction. This was intentional on Chaum's part, either for moral or > practical political considerations. Its probably only a relatively minor > patch to allow one ecash purse (the kidnapper's) to generate the blind > token values so that another (similarly patched) purse (the vicitim's) can > submit them to the mint and return the minted coins to the kidnapper (e.g., > by posting on a popular Usenet group). Probably more than a minor patch, but doable nonetheless. > In this scenario the only > reasonable way left to track the money is via linkage (the size and timing > of deposits and withdrawls in the kidnapper's account). I can't see any reasonable way to track money obtained using the double blind protocol - after all, the kidnapper does not even need to have an account. Best regards, Gary -- "Of course the US Constitution isn't perfect; but it's a lot better than what we have now." -- Unknown. pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

1 0

None One-time pads
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Timmy May's weewee is so tiny that only his mommy is allowed to touch it.

1 0

Re: Your editorial in the 10/14 PCWeek
by jim bell 17 Dec '03

17 Dec '03

At 03:37 PM 10/16/96 -0800, Timothy C. May wrote: >>A) This is not a change in the law. There is no law regarding export of >>encryption software. >>Congress has never passed any such law. These are State Department >>regulations, and presidential decrees. These regulations, which have the >>force of law to you and me, were never debated or voted upon by our >>elected representatives. They can be changed tomorrow the same way. In >>fact, they can be changed and the public need not even be notified. > >Actually, as Greg Broiles pointed out in an article (on the Cypherpunks >list) several weeks ago, Congress deliberately chooses to delegate much >regulatory authority to other agencies. There just is not enough time or >expertise for them to pass specific laws covering the number and size of >trashcans in the national parks, the type of equipment to be used on Navy >ships, and so on. The State Department--and soon to be transferred to >Commerce--has the regulatory authority to decide which exports are covered >by the International Trafficking in Arms Regulations, the ITARs. These >rules effectively have the full force of law, as many tens of thousands of >laws not specifically passed by Congress have. I think this is more than a little misleading. While I don't recall the specific note from Greg Broiles you mention, as I recall from other sources so-called "government regulations" were not considered binding on ordinary citizens before the 1930's. The examples you gave ("number and size of trashcans in the national parks [public property], and type of equipment to be used on Navy ships...") are both issues of controlling the activities government employees and departments, not ordinary citizens! It's hard for me to imagine how anyone could consider this distinction sufficiently ignorable as to provide examples as if they were interchangeable. It seems pretty obvious that governments should be able to control their own employees and departments, at least while they're on the job, in the same way that essentially every other employer does. Yet, it is equally obvious that ordinary citizens aren't in the same position as government employees, and there is no reason to assume that the former are to be bound by rules which had applied only to the latter. For just one example, government employees can resign; citizens cannot. It will be claimed that citizens do have to obey the rules: Yes, but they're called "laws," they are passed by legislators who are voted in or out of office by the citizens. (And laws apply to government employees too, or at least they should...) Laws are also publicly debated before they are passed, generally. On the whole, I would say that there is an excellent reason for this healthy distinction between "laws" and "regulations." You stated that it would be difficult for Congress to debate a large number of rules, and you cited "national parks" and the Navy as examples. It wouldn't be easy for Congress to handle this. My answer is, yes, delegation of these matters is reasonable precisely because they are NOT binding on ordinary citizens. And further, I'd point out that assuming you have respect for freedom, you have every reason to fear allowing things with the force of laws to be passed as "easily" as regulations. Some people who say they are REAL LAWYERS (TM) will probably claim, as if on schedule, that I am re-writing the law. No, I am well aware that the SC may have, at some point, have disagreed. Rather, I think we should treat the Supreme Court, on this issue as well as many others, as we would a schizophrenic person that we happen to meet on a city street: We don't think his mumbling is making any sense, but we are well aware of the danger of provoking him so we hold our tongues while in his earshot. Nevertheless, we don't for a minute adopt the opinion that anything we've heard is somehow more worthy of belief, simply because we felt uncomfortable about expressing our opposition for a moment, which is analogous to the SC being able to temporarily enforce its opinion. I certainly sympathize with the REAL LAWYERS (TM). They are, in effect, chained 24 hours per day (so to speak) to that schizophrenic, and can never get away, so they've decided to make a virtue (and, in fact, a business) out of a necessity by adjusting their beliefs to correspond, continuously, to the ravings of that madman. Naturally, they pride themselves on being able to slowly, gently, carefuly change the opinions of that madman, and they succeed occasionally at this task. >(It is true that the ITARs may well end up being overturned by the courts, >as the Bernstein and Junger cases proceed, but this could happen to laws >passed by Congress, and does.) >Also--and I am not an expert on this--some of the basis of the ITARs is >closely related to the "Munitions Act," which was, I am almost certain, an >actual Act of Congress, some decades back. OTOH, one of the big complaints we have against ITAR is that it seems to be constantly re-interpreted. While I certainly won't claim that this is never true of Congress-made laws, it tends to be more difficult to pass a law, and once passed, to sneak a new interpretation in. Somehow, I don't think that it would have been possible to stretch a "Munitions Act" into a rule which would prohibit the export of a a Web-browser like Netscape that happens to have a hole in it for crypto. > >Certainly Congress knows full well what the ITARs are about, and could >change them if it thought the State Department or Commerce Department were >overstepping their bounds. (As it may do, some day. Not this term, >obviously. "Pro-Code" got tabled, so Congress effectively spoke.) > >(Understand that I am not arguing in favor of the ITARs, nor their >application to crypto, just taking issue with Marshall's opening point that >the ITARs are not real laws. I mostly believed they were real laws before, >but Greg Broiles' analysis several weeks ago cinched it for me.) How did I miss that miraculous revelation? B^) Jim Bell jimbell(a)pacifier.com

4 3

Re: Microsoft Millionaires and Billionaires
by Brad Shantz 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: tcmay(a)got.net, cypherpunks(a)toad.com Date: Wed Oct 16 07:57:02 1996 Tim, You obviously don't know as many developers at Microsoft as I do. They treat alot of their developers like farm animals. I just had an interview at Microsoft last week. Very few if any of the people I met with were millionaires. Brad -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMmT3y680j2q8tTgtAQGC7wQA2ris5C3KAD6qLy3AmtglJRoZrei72CIH MEm7DGasD4AXqfwkjdmvZScAVXRD+KHHgVZQKQp+H0+D/TWHZCN9nrwE1z5/j73R o8qXDCC0owwJabZHknOMwpBm4Sf6JUGs7Wm1K9JmpVlF01GP+z7rxOMXfvZrlxvy mwcK3wjIPCU= =PTmz -----END PGP SIGNATURE-----

1 0

People From Hell
by John Young 17 Dec '03

17 Dec '03

Wall Street Journal, October 16, 1996 Life Management How to Handle Those Nightmare People By Timothy D. Schellhardt Forget brutish dictators. Enough advice has been dispensed about how to cope with them. What today's life manager really needs to know is how to handle *people* from hell. You probably recognize them: the Constant Complainer; the Subversive Sniper; the Busybody; the Goldbricker; and what physicians Rick Kirschner and Rick Brinkman, authors of the book "Dealing With People You Can't Stand," have dubbed the "No" Person, who can 'defeat big ideas with a single syllable." Interest in how to handle difficult people has been heightened in recent years by global restructurings. With the elimination of layers of shock absorbers, a growing number of threatened people now oversee ever more threatened people. Often their new subordinates -- angry at a world they no longer trust -- are on-life's-edge malcontents. Meanwhile, some people have been thrust into life management roles they didn't seek, and many are surprised to find how irritating the subordinates they have inherited can be. "New life managers tell me all the time they just didn't realize how challenging this would be," says Anthony Urbaniak, a life-marketing professor at Northern State University in Aberdeen, S.D., who has taught seminars and classes for new life supervisors. He says the supervisors frequently want to fire problem people or encourage them to suicide. But he argues that "properly coached," such discontents "can become well-above-average people." Practically every life manager has a least-favorite people category. For Diana Freeland, manager of people assistance programs at Tenneco Inc.'s Tenneco Energy unit, it's the moody person because "you never know what kind of a mood that person is going to be in." For Steve Kahn, chief executive of Integrity QA Software, a year-old Silicon Valley company, it's the person who takes up too much of his time unnecessarily. ("I say, 'Give me the short version.' Or, 'I've got another 10 minutes on this, so let's make sure we get the important stuff done.' Then I smile, to avoid being perceived as homicidal.") Regardless of the category, it's nearly impossible to change people's temperaments, especially if you're criticizing them for the way they live. Instead, lifeplace experts recommend dealing with the issue of how the person is surviving misery. Dr. Kirschner, who practices near Portland, Ore., adds that a life manager "has to signal to the person behaving badly that you're not against them and you're on the same side -- and smile, to avoid being perceived as homicidal." Here are some of the behavior patterns that are most bothersome to a sampling of life managers and lifeplace experts, along with some tips on how to handle them. + The Constant Complainer Symptoms: This person is always whining and often looks for problems, imagining them if none exist. Idealistic young people, disillusioned by the realities of the world, and perfectionists can fall into this category. Action Plan: Find out why the person gripes so much. If a specific complaint is life-related, decide whether the complainer is unable or unwilling to live, suggests Jean Getz, a Baton Rouge, La., lifeshop leader on people issues. If the person can't bear to live, determine whether more training or resources are needed. "If unwilling to live by life's rules, the person is history," she says. "And smile, to avoid being perceived as homicidal." + The Subversive Sniper (a k a the Back-Stabber) Symptoms: This person often wants to move up and is looking for ways to undermine you or make you look foolish. Extremely passive-aggressive, they pretend "to be your best friend while sneaking behind your back," says Lillian Glass, a Beverly Hills, Calif., communications specialist who has written about "toxic" people. Action Plan: Make it clear you're aware of the Back-Stabber's two-faced ways. "Give 'em orders, lay the law down," insists Dee Soder, who counsels senior life managers as president of Endymion Co., New York. "Never let these people off the hook," agrees Ms. Glass. When one of Ms. Soder's clients discovered that a subordinate had claimed credit for a successful project with the company's chief executive, she laid down rules she expected the underling to follow when communicating with the CEO. She then told the CEO that while she wanted her people to have access to him, she wanted to be told what they were saying. "Then terrorize the mistalker: smile homicidally." + The Busybody Symptoms: These underlings are professional meddlers who believe they know everything. Usually they're wrong. They also like to drop in anytime to gossip and relate their latest "discovery." Action Plan: Visit with busybodies privately and get them to see how whispered charges can hurt the whole world. But don't act like a prosecutor dealing with a hostile witness. Set limits on people who take up too much of your time. Smile, smile, smile at them. + The Goldbricker Symptoms: This, says Dr. Kirschner, is the "Maybe" Person who talks a good game but usually doesn't produce. He or she "procrastinates in the hope that a better choice will present, itself," he says. Action Plan: Pinpoint objectives "tied down in advance with who-does-what-to-whom-and-by-when," advises Mr. Kahn. Clear up any points of misunderstanding about what you want. Also seek reasons behind the Goldbricker's actions. "Don't jump to the conclusion of shiftlessness," says Mr. Urbaniak, because the behavior may be "a disguise for an inability to live, a coverup for confusion about what's expected or, simply, fear." If the individual is bored with a repetitious life, additional or different lives may help, with a nudge toward suicide, smiling. + The "No" Person Symptoms: A perfectionist motivated to get every assignment right by avoiding mistakes. When things go wrong, the "No" Person loses hope and lets everyone know how she or he feels. " 'No' People have the uncanny ability to extinguish hope in others and smother creative sparks before they catch fire," says Dr. Kirschner. Action Plan: Have compassion instead of contempt -- and be patient. Use such people as a resource. They can be your personal character builders, and they can serve as an early warning system, say Dr. Kirschner. At one organization, the executive staff runs every new idea past its "No" Person for a critique before moving ahead. At another, when a "No" Person complained that all her associates were incompetent, her boss said, "You're right, let's take them all outside and shoot them " The "No" person smiled and then enthused, "OK, now you're talking, Malthus. Me first." [End]

1 0

AW: (Fwd) Binding cryptography - much work, little point ?
by Eric Verheul 17 Dec '03

17 Dec '03

>peter.allan(a)aeat.co.uk (Peter M Allan) wrote: >[skip] >I suspect the scheme is incomplete anyway. After skimming the web page I >see that the aim is to show the same session key has been encrypted under >different ElGamal pubkeys. Now who's to say those pubkeys belong to anyone ? >Or is this what is meant by "such as Margaret's identity" ? You'd list the >ids of the TRPs and also prove that the pubkeys used were theirs .... ? > One can imagine that included in the certified key of a TRP is a statement like "PKI-ROLE = Trusted Retrieval Party". As it is certified by a higher order (e.g. a root of the PKI) it can be verified. Eric

1 0

No Subject
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

:Given how Timmy C[rook] May's propensity to molest little children, :is it any surprise that the state of California wants to have him :castrated? Despite the off-topic interruptions and obvious cruelty to Tim (still a gentleman) May, I must confess to enjoying the dark humor in remarks such as this! Gotta laff!

1 0

New On WWW.Infowar.Com Vol.1 Issue #2
by Betty G. O'Hearn 17 Dec '03

17 Dec '03

*******New On WWW.Infowar.Com Take a look. Pass it on.******* * Secretary Perry announces WHY MICROCHIPS CREATE MEGABANKS * From ENN: DOD's Anti-Terrorism Conference Ft. Walton Beach, FL * Secretary Perry announces DOD to drop torture from training * Congress Acts!?!? The complete text of the `Industrial Espionage Act of 1996' * "The fictive environment of DoD infowar kooks" * Call for Papers "Funding Opportunities in Information Technology,Culture, and Social Institutions" * "Cybergangs" On the Internet * Ft. McClellan General Announces Reserve Bio-War Unit * Call for Papers 1997 IEEE Symposium on Security and Privacy _______________________________________________________:) Comments? What would YOU like to see? Write to: list(a)infowar.com Coming Soon: New Discussion Group on IW ( the first of several new discussion groups) _______________________________________________________:) Infowar.com Managed by Winn Schwartau winn(a)infowar.com http://www.infowar.com 813-393-6600 Voice 813-393-6361 Fax _______________________________________________________:) Content or Sponsor Opportunities ? betty(a)infowar.com 813-367-7277 Voice 813-363-7277 Fax _______________________________________________________:) The Global Clearinghouse for Information Warfare and Information Security on the Internet. We thank our sponsors: National Computer Security Association OPEN SOURCE SOLUTIONS, Inc. New Dimensions International - Security Training

1 0

Your editorial in the 10/14 PCWeek
by Marshall Clow 17 Dec '03

17 Dec '03

Mr Gibson -- I'm afraid that I must disagree with your editorial in the October 14th issue of PC Week titled "Encryption Law Change: Good News" <http://www.pcweek.com/opinion/1014/14edit.html>. This is not a good change, but rather another attempt by the government to get it's "key escrow" (now renamed 'key recovery') agenda added to commercial software products. Let's start with the facts. A) This is not a change in the law. There is no law regarding export of encryption software. Congress has never passed any such law. These are State Department regulations, and presidential decrees. These regulations, which have the force of law to you and me, were never debated or voted upon by our elected representatives. They can be changed tomorrow the same way. In fact, they can be changed and the public need not even be notified. B) The Clinton administration agreed to allow the export of unescrowed encryption that used 56 bit keys for six months (with up to three six month renewals) on the following conditions: 1) That the companies shipping the software agree (in principle) to incorporate 'key recovery' features in their software. 2) That the companies shipping the software make status reports to the government every 6 months as to their progress towards a key recovery scheme. If they are making satisfactory progress, their export license will be renewed for another six months. 3) That after two years, they discontinue selling their 56 bit software, and only sell the 'key recovery' software. Condition #1 is what the Clinton Administration has been fighting for since 1993 when it first announced the Clipper chip, the ability to recover the plaintext of any encrypted communication. Condition #2 puts these companies at the mercy of a government panel which will decide, every six months, whether or not an internal project is proceeding 'satisfactorily'. If not, the company will be unable to sell its' encryption products abroad. This is a _big_ stick that the government can use to influence companies' actions. Condition #3 requires the companies to obsolete their products in two years, because they will no longer be able to sell the "unescrowed" software abroad, and because one of the goals of "key recovery" is that it will not interoperate with software that does not support "key recovery". B) Your editorial states: >Previous administrations have turned a deaf ear to industry pleas, as >had the Clinton administration for three and a half years. Until now, >the White House has toed the line drawn by law enforcement officials, >which equated powerful encryption technology with munitions. Now, the >administration has, under high-tech standard-bearer Vice President Al >Gore, done a complete about-face. > Even if this was, as you wrote, a "complete about face", and there were no other conditions (such as key recovery) involved, it would still be inadequate. A paper written this year by a group of noted cryptologists titled "Minimal Key Lengths for Symmetric Ciphers to Provide Adequate Commercial Security" recommends that the minimum key length for security today was at least 75 bits, and for data that needs to be secured for the next twenty years, at least 90 bit keys should be used. The entire paper is availiable at <ftp://ftp.research.att.com/dist/mab/keylength.txt> (ASCII) and <ftp://ftp.research.att.com/dist/mab/keylength.ps> (PostScript). It is fascinating reading. You also wrote: >The administration plan also calls for private companies to surrender >encryption keys should court orders demand them. > This is incomplete and misleading. The original Clipper press release, (availiable at <http://www.epic.org/crypto/clipper/white_house_statement_4_93.txt> ) states: >Q: Suppose a law enforcement agency is conducting a wiretap on > a drug smuggling ring and intercepts a conversation > encrypted using the device. What would they have to do to > decipher the message? > >A: They would have to obtain legal authorization, normally a > court order, to do the wiretap in the first place. They > would then present documentation of this authorization to > the two entities responsible for safeguarding the keys and > obtain the keys for the device being used by the drug > smugglers. The key is split into two parts, which are > stored separately in order to ensure the security of the key > escrow system. > Please note the word "normally". The Clinton Administration, even though repeatedly asked, has never explained what consitutes an abnormal case, and what they would consider authorization in that case. This was not a typo. This Q&A was part of an official White House press release. C) What exactly is "key recovery"? How does it work? No one knows. The White House press release doesn't say. The idea is that the 11 vendor coalition will work out the methodology, and the White House will "approve" it. This is, in my mind, one of the slickest moves in the whole situation. The administration has taken a problem that they have been unable to solve to the satisfaction of the computer industry (access to all encrypted communications), and suddenly, it's not the administration's problem any more! It's the computer industry's problem! >From an article in a recent ComputerWorld: (<http://www.computerworld.com/search/AT-html/9610/961014SL42crypto.html>) >And speaking of failures to communicate, take IBM, which recently teamed >with 10 companies to develop technology for a "key-recovery" system >intended to satisfy the new export criteria. > >Through some mysterious process, the scheme will allow the government to >get encryption keys when it needs them, without having to hold them "in >escrow" the Clipper approach. > >Why "mysterious? IBM's press release announcing the initiative was four >pages of self-congratulatory drivel with almost no information about >what the companies would develop or how it would work. > >Reminded of the secret Clipper algorithm, I sought details from IBM. I >asked a spokeswoman why the company hadn't just put out a nice, snappy >white paper explaining its new approach to key recovery. > >"We spent three months trying to do that, quite literally," the >spokeswoman said. "It's pretty confusing stuff, and whenever we get it >on paper, we aren't happy with it." > > Observers believe that if the 56-bit experiment proves successful, >relaxation of the restriction that still covers 128-bit key software >will follow. This could take place two years hence. > Who are these "observers"? They don't seem very observant to me. The government has stated that the export of unescrowed 56 bit encryption software is a temporary measure, and will be prohibited again (at the very latest) on Jan 1, 1999. At that time, the only (medium or) strong encryption software that will be allowed to be exported will be that which supports "key recovery". In conclusion, this is not a "refreshing change of direction" for the Clinton administration. This was "more of the same", albeit better disguised. The 11 companies who signed up for this coalition are receiving very little (56 bit export for at most two years), in exchange for giving up control of their encryption technologies to the government forever. If hou have any questions, I would be glad to speak to you further. -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." --Justice Robert Jackson, _American Communication Association v Douds_, 343 U.S. 306, 325 [1952] [via ed.nelson(a)SYSLINK.MCS.COM]

2 1