December 2003 - cypherpunks-legacy

No Subject
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

:Given how Timmy C[rook] May's propensity to molest little children, :is it any surprise that the state of California wants to have him :castrated? Despite the off-topic interruptions and obvious cruelty to Tim (still a gentleman) May, I must confess to enjoying the dark humor in remarks such as this! Gotta laff!

1 0

New On WWW.Infowar.Com Vol.1 Issue #2
by Betty G. O'Hearn 17 Dec '03

17 Dec '03

*******New On WWW.Infowar.Com Take a look. Pass it on.******* * Secretary Perry announces WHY MICROCHIPS CREATE MEGABANKS * From ENN: DOD's Anti-Terrorism Conference Ft. Walton Beach, FL * Secretary Perry announces DOD to drop torture from training * Congress Acts!?!? The complete text of the `Industrial Espionage Act of 1996' * "The fictive environment of DoD infowar kooks" * Call for Papers "Funding Opportunities in Information Technology,Culture, and Social Institutions" * "Cybergangs" On the Internet * Ft. McClellan General Announces Reserve Bio-War Unit * Call for Papers 1997 IEEE Symposium on Security and Privacy _______________________________________________________:) Comments? What would YOU like to see? Write to: list(a)infowar.com Coming Soon: New Discussion Group on IW ( the first of several new discussion groups) _______________________________________________________:) Infowar.com Managed by Winn Schwartau winn(a)infowar.com http://www.infowar.com 813-393-6600 Voice 813-393-6361 Fax _______________________________________________________:) Content or Sponsor Opportunities ? betty(a)infowar.com 813-367-7277 Voice 813-363-7277 Fax _______________________________________________________:) The Global Clearinghouse for Information Warfare and Information Security on the Internet. We thank our sponsors: National Computer Security Association OPEN SOURCE SOLUTIONS, Inc. New Dimensions International - Security Training

1 0

Your editorial in the 10/14 PCWeek
by Marshall Clow 17 Dec '03

17 Dec '03

Mr Gibson -- I'm afraid that I must disagree with your editorial in the October 14th issue of PC Week titled "Encryption Law Change: Good News" <http://www.pcweek.com/opinion/1014/14edit.html>. This is not a good change, but rather another attempt by the government to get it's "key escrow" (now renamed 'key recovery') agenda added to commercial software products. Let's start with the facts. A) This is not a change in the law. There is no law regarding export of encryption software. Congress has never passed any such law. These are State Department regulations, and presidential decrees. These regulations, which have the force of law to you and me, were never debated or voted upon by our elected representatives. They can be changed tomorrow the same way. In fact, they can be changed and the public need not even be notified. B) The Clinton administration agreed to allow the export of unescrowed encryption that used 56 bit keys for six months (with up to three six month renewals) on the following conditions: 1) That the companies shipping the software agree (in principle) to incorporate 'key recovery' features in their software. 2) That the companies shipping the software make status reports to the government every 6 months as to their progress towards a key recovery scheme. If they are making satisfactory progress, their export license will be renewed for another six months. 3) That after two years, they discontinue selling their 56 bit software, and only sell the 'key recovery' software. Condition #1 is what the Clinton Administration has been fighting for since 1993 when it first announced the Clipper chip, the ability to recover the plaintext of any encrypted communication. Condition #2 puts these companies at the mercy of a government panel which will decide, every six months, whether or not an internal project is proceeding 'satisfactorily'. If not, the company will be unable to sell its' encryption products abroad. This is a _big_ stick that the government can use to influence companies' actions. Condition #3 requires the companies to obsolete their products in two years, because they will no longer be able to sell the "unescrowed" software abroad, and because one of the goals of "key recovery" is that it will not interoperate with software that does not support "key recovery". B) Your editorial states: >Previous administrations have turned a deaf ear to industry pleas, as >had the Clinton administration for three and a half years. Until now, >the White House has toed the line drawn by law enforcement officials, >which equated powerful encryption technology with munitions. Now, the >administration has, under high-tech standard-bearer Vice President Al >Gore, done a complete about-face. > Even if this was, as you wrote, a "complete about face", and there were no other conditions (such as key recovery) involved, it would still be inadequate. A paper written this year by a group of noted cryptologists titled "Minimal Key Lengths for Symmetric Ciphers to Provide Adequate Commercial Security" recommends that the minimum key length for security today was at least 75 bits, and for data that needs to be secured for the next twenty years, at least 90 bit keys should be used. The entire paper is availiable at <ftp://ftp.research.att.com/dist/mab/keylength.txt> (ASCII) and <ftp://ftp.research.att.com/dist/mab/keylength.ps> (PostScript). It is fascinating reading. You also wrote: >The administration plan also calls for private companies to surrender >encryption keys should court orders demand them. > This is incomplete and misleading. The original Clipper press release, (availiable at <http://www.epic.org/crypto/clipper/white_house_statement_4_93.txt> ) states: >Q: Suppose a law enforcement agency is conducting a wiretap on > a drug smuggling ring and intercepts a conversation > encrypted using the device. What would they have to do to > decipher the message? > >A: They would have to obtain legal authorization, normally a > court order, to do the wiretap in the first place. They > would then present documentation of this authorization to > the two entities responsible for safeguarding the keys and > obtain the keys for the device being used by the drug > smugglers. The key is split into two parts, which are > stored separately in order to ensure the security of the key > escrow system. > Please note the word "normally". The Clinton Administration, even though repeatedly asked, has never explained what consitutes an abnormal case, and what they would consider authorization in that case. This was not a typo. This Q&A was part of an official White House press release. C) What exactly is "key recovery"? How does it work? No one knows. The White House press release doesn't say. The idea is that the 11 vendor coalition will work out the methodology, and the White House will "approve" it. This is, in my mind, one of the slickest moves in the whole situation. The administration has taken a problem that they have been unable to solve to the satisfaction of the computer industry (access to all encrypted communications), and suddenly, it's not the administration's problem any more! It's the computer industry's problem! >From an article in a recent ComputerWorld: (<http://www.computerworld.com/search/AT-html/9610/961014SL42crypto.html>) >And speaking of failures to communicate, take IBM, which recently teamed >with 10 companies to develop technology for a "key-recovery" system >intended to satisfy the new export criteria. > >Through some mysterious process, the scheme will allow the government to >get encryption keys when it needs them, without having to hold them "in >escrow" the Clipper approach. > >Why "mysterious? IBM's press release announcing the initiative was four >pages of self-congratulatory drivel with almost no information about >what the companies would develop or how it would work. > >Reminded of the secret Clipper algorithm, I sought details from IBM. I >asked a spokeswoman why the company hadn't just put out a nice, snappy >white paper explaining its new approach to key recovery. > >"We spent three months trying to do that, quite literally," the >spokeswoman said. "It's pretty confusing stuff, and whenever we get it >on paper, we aren't happy with it." > > Observers believe that if the 56-bit experiment proves successful, >relaxation of the restriction that still covers 128-bit key software >will follow. This could take place two years hence. > Who are these "observers"? They don't seem very observant to me. The government has stated that the export of unescrowed 56 bit encryption software is a temporary measure, and will be prohibited again (at the very latest) on Jan 1, 1999. At that time, the only (medium or) strong encryption software that will be allowed to be exported will be that which supports "key recovery". In conclusion, this is not a "refreshing change of direction" for the Clinton administration. This was "more of the same", albeit better disguised. The 11 companies who signed up for this coalition are receiving very little (56 bit export for at most two years), in exchange for giving up control of their encryption technologies to the government forever. If hou have any questions, I would be glad to speak to you further. -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "It is not the function of our Government to keep the citizen from falling into error; it is the function of the citizen to keep the Government from falling into error." --Justice Robert Jackson, _American Communication Association v Douds_, 343 U.S. 306, 325 [1952] [via ed.nelson(a)SYSLINK.MCS.COM]

2 1

Censorship-related Web Sites?
by Robert A. Hayden 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- One of the professors in a different department is going to be doing a symposium next week on censorship, with particular attention paid to censorship and the internet. She has asked me to whip up a quick web page of resources that she can direct the participants too. Unfortunately, beyond the basic (EFF, ACLU, CPSR) sites, I really don't know of many good places to add in, and lack the time to do a thourgh search. If you know of a site or three, can you take a moment to drop me an email with them? Would save a lot of time. Thanks so much. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: PGP Signed with PineSign 2.2 iQCVAwUBMmUM/TokqlyVGmCFAQFDawQAq3lMBg39gyDOwl/DW9GWeImui9S3ZnrJ 8YbNoqbcFWb+yAl9YOInp323nb9adh8D4zlvsyrs2+ZyziFMePyOkLLKO5K1kg5+ +ome1aLifyinjAHBGRLjbHMTU2vSP0znJeZzFZ65Q/z/ggucrXzN+gkwJbeeScad ztq8ZAHdOo4= =c6+G -----END PGP SIGNATURE----- Robert A. Hayden hayden(a)krypton.mankato.msus.edu -=-=-=-=-=- -=-=-=-=-=- http://krypton.mankato.msus.edu/~hayden/Welcome.html -----BEGIN GEEK CODE BLOCK----- Version: 3.12 GED/J d-- s:++>: a- C++(++++)$ ULUO++ P+>+++ L++ !E---- W+(---) N+++ o+ K+++ w+(---) O- M+$>++ V-- PS++(+++)>$ PE++(+)>$ Y++ PGP++ t- 5+++ X++ R+++>$ tv+ b+ DI+++ D+++ G+++++>$ e++$>++++ h r-- y+** ------END GEEK CODE BLOCK------

1 0

Re: extortion via digital cash
by azur＠netcom.com 17 Dec '03

17 Dec '03

>-----BEGIN PGP SIGNED MESSAGE----- > >In article <v02130503ae891eae8ee1(a)[10.0.2.15]>, >Steve Schear <azur(a)netcom.com> wrote: >>In this scenario the only >>reasonable way left to track the money is via linkage (the size and timing >>of deposits and withdrawls in the kidnapper's account). > >Who says the kidnapper has to have an account? > If the kidnapper doesn't have an account then they must launder it through an accomplice (willing or not) in order to convert the money to any other form. Of course, if ecash becomes ubiquitous (which I think most on the list truly desire, for any number of reasons) then, you're right, there's no need to take value out of the ecash system exceppt for any purchasing the goods and services one would in any case. -- Steve

1 0

RFC on "Assert Your Privacy"
by John Willis 17 Dec '03

17 Dec '03

We are in the process of revising our publication "Assert Your Privacy" and we would like to have the benefit of your input (heah, what can I say, I just joined the list). The doc is generally intended for the mass public and does not yet cover issues like e-cash, credit card transactions over the net, etc.. I have yet to be convinced that a critical mass has been reached to warrant inclusion of same. So, please visit http://soli.inav.net/~dolphin/asrtpriv.htm and provide feedback to the address indicated, or discuss it here! I look forward to learning some things from ya'll! Thanks, John Information Locators

1 0

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

American Banker: Friday, October 11, 1996 Smart Card Venture, Once Written Off, Is Perking Up By VALERIE BLOCK SmartCash, a high-profile smart card venture that many industry observers had left for dead, is showing signs of life. The turnabout is so complete, according to some sources, that Visa International may buy the system. People close to SmartCash -- it was formed in August 1995 by 11 major U.S. banks, MasterCard International, Verifone Inc., and the French smart card maker Gemplus -- say it has completed development of an operating system and is attracting renewed industry interest. With MasterCard closing in on an acquisition agreement with Mondex, the smart-card-based electronic cash system developed by Natwest Group of London, Visa is said to be looking closely at SmartCash. Visa refused to comment on the speculation, but a spokesman said, "We have been in longstanding discussions with SmartCash since day one." He said Visa has had "a number of discussions with a variety of vendors." But outsiders are freely throwing Visa's name around. It is part of the same flurry of rumors that has American Express Co. taking a hard look at Proton, a smart card system developed by Banksys, the Belgian national payments association. "Visa is interested in SmartCash," said Dan Cunningham, a former Gemplus executive who is senior vice president of Phoenix Planning and Evaluation, a Rockville, Md.-based consulting firm. Though Visa's stored value card system, Visa Cash, has been trumpeted as a viable application of chip technology, "SmartCash is more robust," said a knowledgeable source who requested anonymity. Visa Cash was built on the Danmont operating system, which was designed for Denmark, a tiny market compared to the United States. SmartCash, with a membership nucleus that included the owners of Electronic Payment Services Inc., began last year with much fanfare. But by April this year, executive departures, bickering among the bankers, and the lack of an operating system left an impression of disarray, and the alliance appeared to have dissolved. Electronic Payment Services, owner of the MAC automated teller machine network, quietly stayed the course. Its operating system completed and delivered just two weeks ago, Smart Cash "is the only stored value system developed in the U.S. for the U.S. market," said Donald J. Gleason, president of the Wilmington, Del., company's smart card enterprise. SmartCash founders MasterCard, First Union Corp., NationsBank Corp., and Chase Manhattan Corp. are out. Electronic Payment Services' owners -- Banc One Corp., CoreStates Financial Corp., KeyCorp, National City Corp., and PNC Bank Corp.-- are still committed. Banc One is "still involved with Smart Cash," said a spokesman. "We want to see it get off the ground and go." "They've got a very viable solution," said David R. Campbell, executive vice president of KeyCorp. "It's a matter of whether enough interest can be generated to put that solution into the marketplace." With chip cards looking increasingly viable, the stakes are getting higher for the bank card associations. Visa made a big publicity splash in Atlanta with a Visa Cash pilot that coincided with the Olympic Games, but the banks are still waiting for proof of a business case. MasterCard did not deliver on the expectations of its cash card experiment in Canberra, Australia. Sources said it was deemed a "disaster" and led to the negotiations with Mondex International, the global consortium put together this year by Natwest Group. Several executives involved in MasterCard's chip card efforts have departed, including Robin Townend, Philip Verdi, and Diane Weatherington, head of the program, who left Oct. 1. Another key technologist, John Tunstall, recently submitted his resignation, sources said. American Express Co. is being paired with the Belgian group that has completed several successful installations in Europe and is supplying the technology for the Exact smart card pilot in Canada. Though many smart card systems are getting under way, especially in "closed systems" such as campuses and athletic venues, creating an open worldwide system is much more complex, involving a more sophisticated approach to security, operating standards, access to automated teller networks, interbank settlement, fraud detection, and other back-office issues. Acquiring a system that has been proven can reduce a system's time to market and could be far less costly for banks and their payment associations, industry experts said. The Mondex system is estimated to have cost $150 million to develop. Many banks are trying out several systems; most in Australia are in Visa Cash, MasterCard Cash, and Mondex in hopes of arriving at the most efficient and cost effective answer. Also critical in developing an open smart card system is "scalability," the power to expand and upgrade the hardware and software as new technological developments occur, without having to reissue cards and terminals. Danmont, the proven system Visa used for Atlanta, is not "designed to migrate," a technology expert said. He said the merchant terminals and smart cards would have to be replaced as heightened security measures are implemented. That would not fly with merchants, who are a hard sell on the concept to begin with. The SmartCash system, which took more than four years to complete, is expressly designed for a changing marketplace, with modular components that can be replaced or upgraded. Mr. Gleason called the effort, which suffered embarrassing delays, "a huge challenge." Trying to recoup the costs by getting the SmartCash coalition back on track is the organization's next task. Though Electronic Payment Services would not comment on membership and future plans, BankAmerica Corp., the big California bank historically aligned with Visa, is said to be in the group. Pilots at member banks' offices could be running in early 1997, said Mr. Cunningham, the consultant. Martha Campbell, a former Bank of America executive, said both the San Francisco giant and Visa were active in SmartCash as of August. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

"Stopping Crime" Necessarily Means Invasiveness
by Timothy C. May 17 Dec '03

17 Dec '03

There are several swirling threads about the development of crypto systems (e.g., "binding cryptography," "key recovery," "one-way traceable e-cash") that are designed to allow law enforcement some ability to track illegal transactions, catch some criminals, etc. Lucky Green and I had a brief discussion of this at my party last Saturday. Specifically, about the reasons some folks are avoiding "true" digital cash, as described in Chaum's papers of the mid-80s, in favor of "crippled" digital cash. We both agree that _any_ system which allows government to act to trace a transaction, or to trace a message, or to gain access to keys, essentially throws away the liberty-enhancing advantages of cryptography completely. That this is so, logically, is almost completely self-evident. If this is not, ask yourself whether the government of Myanmar, known as SLORC, would not use its "Government Access to Keys" to round up the dissidents in the jungle. Would Hitler and Himmler have used "key recovery" to determine who the Jews were communicating with so they could all be rounded up and killed? Would the East German Staasi have traced e-cash transations? For every government extant on the planet, even apparently benign government such as that in the Vatican (*), one can easily think of dozens of examples where access to keys, access to diaries, access to spending records, etc., would be exploited. (* And speaking of the Vatican, there's that little matter of Michael Sindona, Banco Ambrosiano, links to CIA funds in BCCI, and the body found swinging from the bottom of Black Friar's Bridge in London. They're just another power player, with a lot of interest in financial matters. Some say the whole "confession" system worked for a millenium as a surveillance and espionage system without peer.) Any proposal to force traceability of transactions must deal with this reality. What the government considers "criminal" or "suspicious" is often what they consider threatening to their exercise of power, or even of their particular time in power (e.g., the Democrats and their 900 FBI files circulating throughout the White House, looking for dirt on their "enemies," the Republicans. Do you really want Craig Livingstone having GAK?). The recent talk about "catching criminals" misses this point, that governments typically use surveillance powers to control citizens. (Note: I would think Dutch residents should be especially sensitive to this concern, given what happened to them in WW II, when the arriving Nazis used telephone records to locate Jews for extermination. Until recently, Holland had a tendency to carefully think about such issues---I believe phone calls were billed in such a way as to not keep such records, for example). Yes, true digital cash--the fully untraceable form originally discussed--will allow some new channels for criminal activity. Privacy has its price. The ability of people to plot crimes and commit crimes behind closed doors is obvious, and yet we don't demand secret cameras in homes, apartments, and hotel rooms! A point we often make, but one we should always remember. And full untraceability--the necessary criterion for something to be really called "cash"--also stops other kinds of crimes, particularly government crimes. As to fully untraceable digital cash--the real e-cash--we may be the carriers of the torch for this. For whatever reasons, David Chaum is backpedalling on his original points, and is making pro-traceability noises. However, various persons on this list have pointed out that "coin mixes" and other such methods can restore the full untraceability even of Chaum's present system. So, there is hope. --Tim May "The government announcement is disastrous," said Jim Bidzos,.."We warned IBM that the National Security Agency would try to twist their technology." [NYT, 1996-10-02] We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: binding cryptography
by um＠c2.net 17 Dec '03

17 Dec '03

> >Can you imagine that anyone would ever create a program that tries to > >look like a conforming implementation, but generates invalid "binding" > >data -- when it is so much easier to simply use PGP, and (if > >necessary) disguise that fact using the government-approved encryption > >software? I don't, so in my opinion the verification process is > >abolutely useless. > Can you imagine what would happen if governments would (help to) set up > a system that has no safeguards at all, i.e. that could give criminals > all the anonimity and confidentiality they need? Sorry if my formulation was unclear. I ment to point out that it is acutally easier to commit fraud in a way that is undectectable than in a detectable way. So on the assumtion that the concept of binding cryptography is a good thing, this scheme is flawed. But to answer your question: Encryption software has already been available for years. You may argue that PGP is not very user-friendly, but it is secure and every computer user who takes the time to read the manual can use it. So nothing much would happen that will not happen anyway or has already happened. > car, bicycle, house etc.). That is a fact of life; one I hate. So the > point is: where is the middle of giving up freedom and stopping > criminals? But since - as you admit - it is not possible to stop criminals, the question is: Do you want to cause a dramatic drawback in privacy and create new potential security hole just in order to force criminals to do a few hour's work of installing a secure encryption system from the Internet, or when that is illegal buy it on the black market? > We have set up the TRPs in such a flexible way that anybody could find > one he can trust, one might even set up his own TRP. Then it is not even necessary to use additional software to circumvent government access. The user can simply configure himself as TRP for the inner layer of encryption and the official one in the outer layer.

1 0

CyberPromo responds!
by roy＠sendai.scytale.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A helpful cypherpunk provided a list of addresses for various postmaster and root accounts in cyberpromo.com. I am now sending my abuse response to wallace(a)cyberpromo.com cyberpr(a)ANSWERME.COM root(a)savetrees.com postmaster(a)savetrees.com root(a)answerme.com postmaster(a)answerme.com root(a)NS3.CYBERPROMO.COM root(a)NS4.CYBERPROMO.COM postmaster(a)NS3.CYBERPROMO.COM postmaster(a)NS4.CYBERPROMO.COM and it's actually generating responses. So far, Sanford Wallace has missed my point several times, assumed that I have been sending mail to the replybot when I have repeatedly stated the reverse, admitted that "someone is spoofing requests from your domain" and threatened to bill $1000 for "reviewing frivolous bills". It appears I at least have his attention. This is only slightly related to the list (via the redirection of the list to Wallace's replybot). If anyone wants to discuss CyberPromo tactics further, please do it via private mail. If enough of us want to talk about it, I'll set up a little list for the purpose. - -- Roy M. Silvernail [ ] roy(a)scytale.com DNRC Minister Plenipotentiary of All Things Confusing, Software Division PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMmVrMxvikii9febJAQGvBwP/WwtrXXFNWvJLIXYcIkrm12ZAaJZwn76e T6xY4IeJw5zYD73iYYYBcU4k6iR4GQR4ZRyKKRDKSqLXuXD0iXcrXG0LWoAtl/9w nKjPe83hiNYPCQIDwryTb3BZTkXBltTLh9VWjFSTMx7AbYg89mxvNrEPhbtevkIC TRwGZ7q2WF0= =TN2R -----END PGP SIGNATURE-----

1 0