December 2003 - cypherpunks-legacy

RE: legality of wiretapping: a "key" distinction
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

jim bell <jimbell(a)pacifier.com> writes: ... >Ironically he said it, despite the fact that wiretapping is comparatively >rare. Perjury, "drop guns," faking and planting evidence, accepting bribes, >strongarming suspects, and similar techniques are probably far more commonly >used than wiretapping ever was, but I don't see Unicorn describing those as >"firmly entrenched" even though that would be an accurate characterization. Donuts and coffee are firmly entrenched in law enforcement, too. Must Unicorn say _all_ obvious things in his (futile, but increasingly humorous) quixotic quest for your continuing (and free) legal education? Say it ain't so.. me

1 0

Re: AW: Binding cryptography - a fraud-detectible alternative to key-esc
by jim bell 17 Dec '03

17 Dec '03

At 01:08 PM 10/11/96 +0100, Adam Back wrote: >As your paper describes, your system allows anyone to check the >correctness of the escrowed session key. Have you considered >modifying it so that the only person who can check is the owner of a >designated private key of a public/private key pair? This would allow >say for the TTP to check correctness, and not the TRP, nor the public. >I'm not sure of the usefulness of this, but it allows you to select >from the full spectrum according to requirements: > >a) no one can check, PGP second recipient (Carl Ellison, Bill Stewart) >b) recipient only can check (my suggestion) >c) holder(s) of designated keys can check >d) anyone can check (your proposal) I think the biggest problem with allowing "anyone" to check the correctness of a key is that what is a technical possibility today, will become a legally-mandated requirement tomorrow. What if Internet backbone companies and/or ISP's were told that they had to implement software check these keys, and if they discovered an "incorrect" escrowed key, they were legally obligated to either refuse to forward that message, and/or forward a copy of that message to someone like Spooks(a)NSA.gov or Thugs(a)DOJ.gov. Even worse, if this checking process revealed the sender, or at least a coded identity unique to the sender, the government could issue "digital APB's" where it would insist on being sent copies of all messages with a given ID number. Suddenly, the Internet might go from being hard to tap, to being practically automatically tapped. Jim Bell jimbell(a)pacifier.com

1 0

Say what?
by rollo＠artvark.com 17 Dec '03

17 Dec '03

I'm enclosing a header taken from a message in <Cypherpunks Lite Digest 96/10/05>. Can anyone tell me how to determine (1) who wrote it; (2) who sent it to me; (3) Who was the original recipient? It seems like it's to Cypherpunks Lite <cp-lite(a)comsec.com>, but that can't be it, since the author starts by saying "I must first say that your program is one of the finest in news reporting, and I tune in every day." >From owner-cp-lite Sat Oct 5 19:13:54 1996 Return-Path: owner-cp-lite Received: from localhost (eb@localhost) by comsec.com (8.6.5/8.6.5) id TAA21237 for cp-lite-real; Sat, 5 Oct 1996 19:13:54 -0700 Received: from localhost (eb@localhost) by comsec.com (8.6.5/8.6.5) id TAA21233; Sat, 5 Oct 1996 19:13:54 -0700 Message-Id: <199610060213.TAA21233(a)comsec.com> To: Cypherpunks Lite <cp-lite(a)comsec.com> Sender: owner-cp-lite(a)comsec.com Date: Thu, 3 Oct 1996 15:38:11 -0700 (PDT) From: Ernest Hua <hua(a)chromatic.com> Subject: Lack of reporting on CALEA and Encryption issues ... Precedence: bulk I must first say that your program is one of the finest in news reporting, and I tune in every day. Rollo Silver / Amygdala | e-mail: rollo(a)artvark.com 216M N. Pueblo Rd, #107 | Website: http://www.artvark.com/artvark/ Taos, NM 87571 USA | Voice: 505-751-9601; FAX: 505-751-7507

1 0

[NOISE] Funny quote in Word-A-Day
by P. J. Ponder 17 Dec '03

17 Dec '03

the Word-A-Day mailing list came up with a humorous quote, almost germane to some of the ramblings on this list.... >Reputation: what others are not thinking about you. > >To subscribe or unsubscribe, please send a message to >wsmith(a)wordsmith.org >with "Subject:" line as "subscribe <Your Real Name>" or "unsubscribe". >Email anu(a)wordsmith.org if you have any questions, comments or >suggestions. >Archives, FAQ, words and more at the WWW site: >http://www.wordsmith.org/awad/ So long, Perry.... Let us know when you get a new list set up & best wishes. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzBz1GQAAAEEANGl0daeboCV8dBSLxycjYd5tIJNOmKN2Y8hCXhF5cLt0nVu NUDMgmUWF4zoZtBDNbtVF0wTTxEcBEHOLjIuZKPeiT7Bw266HhTahXxOIaOXZyDj 5VMISVvt9/Ua31JfxfCwK0iPtojFtKcNU13z/hrYA7Q5LfqsVF4ZsVsZPDGdAAUT tClQLkouIFBvbmRlciA8cG9uZGVyQG1haWwuaXJtLnN0YXRlLmZsLnVzPg== =lVU7 -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: "Forward Privacy" for ISPs and Customers
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:13 AM 10/9/96 -0800, Timothy C. May wrote: >Something ISPs could do--and may do if there is sufficient customer >pressure--is to adopt a policy of "forward secrecy" (to slightly abuse this >technical term). That is, to have an explicit policy--implemented in the >software--of _really_ deleting the back messages once a customer downloads >them to his site. This means that _backups_ must be done in a careful >manner, such that even the backup tapes or disks are affected by a removal. One technical approach is described in: "A Revocable Backup System", dabo(a)cs.princeton.edu (Dan Boneh) and rjl(a)cs.princeton.edu (Richard J. Lipton) in The 6th USENIX Security Symposium Proceedings. Basically the idea is to encrypt the file on the backup (tape) and then lose the encryption key when you want to "forget" the file. ------------------------------------------------------------------------- Bill Frantz | "Cave softly, cave safely, | Periwinkle -- Consulting (408)356-8506 | and cave with duct tape." | 16345 Englewood Ave. frantz(a)netcom.com | - Marianne Russo | Los Gatos, CA 95032, USA

3 2

JoC Nox GAK
by John Young 17 Dec '03

17 Dec '03

The Journal of Commerce, October 10, 1996. Editorial/ Encryption Technology Policy Oct. 10 -- SECRET CODES: Let's say you're selling your house and, after months of searching, you've found a potential buyer. But there's a problem: The local sheriff wants a spare set of keys in case the house is used for unlawful purposes. Your buyer, a solid citizen, doesn't want his privacy invaded. He decides to look in another neighborhood, with a less intrusive sheriff. This improbable scenario describes, more or less, Washington's policy toward U.S. exports of encryption technology -- devices that scramble computerized data. Under a revised policy, the Clinton administration says that, following a partial two-year grace period, it will require exporters of sophisticated encryption devices to keep a spare set of "keys" -- the formulas that turn encrypted data back into plain text -- in a place accessible to the government. That may seem like a sensible precaution, but it is likely to hurt exporters while doing little for law enforcement. The government's effort to control encryption goes to the heart of the information networks that are becoming a bigger part of people's lives almost by the day. Individuals and companies leave behind them an ever-broadening wake of electronic records -- on everything from video rentals and catalog sales to car registrations and health records. As hackers get better at breaking into these files, it becomes more urgent to use encryption to protect them. The government, however, has other ideas. It says encryption sold overseas poses a threat because law enforcement officials may not be able to decode the secret communications of terrorists and drug dealers. To ease its access to such files, the government essentially is building a trap door into billions of records stored in computers overseas. Of course, there are caveats and loopholes. The policy applies only to foreign sales; U.S. law forbids government prying into domestic computer files. Also, the policy grants exporters a two-year period in which they can sell encryption up to a moderate level of sophistication -- 56 bits in key length -- without restriction. After that, a key-access requirement would take effect. The government-access rule will force U.S. exporters to do some fancy sales footwork. Foreign buyers, after all, may not be thrilled to know Uncle Sam can gain access to their private files. They may worry that if Washington has keys, their own governments may demand the same, and that the strangers holding the keys may not guard them carefully, no matter what the rules say. Terrorists, meanwhile, will have plenty of ways to circumvent the U.S. rules. They have a choice of 179 foreign-made encryption devices of at least 56-bit strength that are not burdened by key-access requirements. Terrorists also could make their own scrambling devices -- there are books available on how to write encryption codes -- or buy them in the United States, which has no domestic sales restrictions, and carry them out of the country. Why, then, is Washington bothering with export controls? In part, it's an attempt at back-door control of the domestic market. If companies are forced to limit the sophistication of encryption destined for export markets they may do the same for domestic products, to cut production costs. That would make life easier for law enforcement officials, who worry increasingly about impenetrable barriers to suspected criminals' computerized information.Those agencies indeed have a problem. Technology has given the world's bad actors a better cover of secrecy than ever before. But trying to control exports and limit domestic technology is not the solution. As a practical matter, the encryption horse has long since departed the law enforcement barn. Absent an agreement among all nations on a key access system -- an impossible goal and not a very desirable one, given different countries' views on protecting privacy -- unilateral restrictions will be futile. They will serve mainly to scare customers away from U.S. manufacturers. Rather than try to restrict the encryption industry, the administration should promote it, and find other ways to improve criminal surveillance. ----- On the Internet: Visit The Journal of Commerce on the World Wide Web. Point your browser to: http://www.joc.com/ -----

1 0

Scientific Discoveries Minimize Aging (DHEA)
by health＠moneyworld.com 17 Dec '03

17 Dec '03

"YOUR Passion for LIFE" is http://dhea.natureplus.com Join 1000's, taking advantage of the amazing natural benefits of DHEA. In the search for the ENERGY OF YOUTH, DHEA is a MUST. "I can't wait 30 More years for the National Institute on Aging to save [me]." says Dr. Regelson, a leading DHEA researcher. Learn how you can beat Cancer, Heart Disease, Aging, Memory Loss and MORE! Click on: http://dhea.natureplus.com

1 0

Dimitri & Roberto Alamar
by Marc J. Wohler 17 Dec '03

17 Dec '03

KTOM is rude crude & lude. His insane rants have a damaging effect on this list. Any donations in his behalf should be given for therapy. List members should give him the Roberto Alamar treatment. mjw

1 0

What are the flaws with FV payment system?
by Kip DeGraaf 17 Dec '03

17 Dec '03

I only received this an hour ago. I would very much like to attend, but can't put my fingers on the detailed analysis of FV's flaws in their system, which I would like to bring up in person at this seminar. Could someone please point me in the right direction? ---------- Forwarded message ---------- Date: Thu, 10 Oct 1996 09:51:56 -0400 From: Sue Davidsen <davidsen(a)umich.edu> To: michlib-l(a)mlink.hh.lib.umich.edu Subject: Seminar Announcement Commerce on the Internet 7:00 PM Thursday, October 10, 1996 Room N130 New Business Building, MSU Dr. Nathaniel Borenstein, Chief Scientist, First Virtual Holdings, Inc., is known worldwide as a leading developer of Internet technologies, including the MIME standard and the First Virtual Payment System. In this presentation on commerce on the Internet he will discuss: The limitations of current encryption schemes The technical aspects of the First Virtual payment scheme The future of commerce on the Internet Dr. Borenstein contributed to the development of numerous Internet technologies including the MIME standard (used for email attachments and Web content typing), Andrew, metamail, ATOMICMAIL, and Safe-Tcl. Dr. Borenstein devised the First Virtual payment system, a popular mechanism for conducting commerce on the Internet. [a lot of cute biographical details left out, I'm not impressed]

4 4

Re: pgp, edi, s/mime
by azur＠netcom.com 17 Dec '03

17 Dec '03

>S/MIME has come a _long_ way. An earlier version (now called S/MIME 1.0, >although I'm not sure this is going to make it into any marketing >materials) had a couple of cryptographic problems compared with PGP. >Those problems have been fixed in version 2.0, which is expected shortly >(as an internet draft). > >S/MIME 2.0 _defaults_ to 168-bit triple-DES, unless you're stupid enough >to use the export version. RSA key sizes up to 2048 bits are supported, >as are a number of alternate symmetric algorithms. In addition, digital >signatures are based on 160-biy SHA1, rather than 128-bit MD5, which is >half broken anyway. > >In the meantime, Deming software is shipping a slick Windows >implementation of S/MIME, which integrates nicely with Eudora. Netscape >is expected to ship cross-platform S/MIME capability in version 4.0 of >Navigator (their original publicity materials were only off by a factor >of two ;-), and that will make a huge dent in the market. > >In sum, S/MIME leaves PGP in the dust, both techically and as a market >force. There's still a lot of sentiment that PGP is one of "ours" and >S/MIME is one of theirs, but at this point it's the latter that has the >most promise of bringing encrypted e-mail to the masses. > >If only X.509 weren't so darned ugly :-) > >Raph How will users be made confident that the S/MIME crypto isn't somehow compromised in these products? Vendor trust (I think not, with all the government pressures)? PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

3 2