December 2003 - cypherpunks-legacy

Re: White House crypto proposal -- too little, too late
by jim bell 17 Dec '03

17 Dec '03

At 02:57 PM 10/1/96 -0700, Declan McCullagh wrote: > > >---------- Forwarded message ---------- >Date: Tue, 1 Oct 1996 14:56:21 -0700 (PDT) >From: Declan McCullagh <declan(a)well.com> >To: fight-censorship(a)vorlon.mit.edu >Subject: White House crypto proposal -- too little, too late [snip] >What's even more disturbing is what the administration might do >next. After the roundtable broke up, I chatted with Michael Vadis, one >of the assistant deputy attorneys general who oversees national >security issues. He said an international consensus is forming that >terrorists can use crypto; therefore crypto must be controlled. The >U.S. is certainly pushing this line at the OECD talks. > >"But it just takes one country to decide to export strong crypto," I said. >"You're missing something," said Vadis. >"What?" I asked. "Unless you're talking about import restrictions." >"Exactly," he said. >-Declan An import restriction would be even less effective than the current export restrictions. With an import restriction, a person need merely receive a given piece of software in the mail from an "unknown" benefactor, software that (surprise!) would have been illegal to import. (the software doesn't even have to be mailed from outside the US, merely trucked in by a wetback and anonymously mailed by tossing it into the ubiquitous USnail PO Box.) Redistribution of this software would have to be legal, if for no other reason than nobody could prove it was imported illegally. Nobody outside the US would have any standing to sue for copyright violation, because they couldn't import it and sell it without restrictions. Jim Bell jimbell(a)pacifier.com

5 4

Re: active practice in America [RANT]
by Dale Thorn 17 Dec '03

17 Dec '03

Marc J. Wohler wrote: > At 11:19 PM 9/30/96 -0700, you wrote: > >I'm glad you asked. I wouldn't pretend to have *the* answer, but rather > >than screw around with basic Constitutional enumerations, I think the > >"authorities" should have had the guts to challenge those cases (at > >least the most obvious ones at first, to get the ball rolling), by > >investigating and declaring mistrials based on some kind of jury > >manipulation which showed bad faith on the part of the locals. > Theory sounds great, but what if, as often was the case, the > "authorities" were the major part of the problem. I presume heirarchical authority. That's what we had in the U.S., even in the 1960's. The specific authorities running bogus juries were generally county-level. One could argue that the states, and by extension the feds, looked the other way as long as they could, and indeed they did. Once they could no longer look the other way, those higher-level authorities should have proceeded against the local governments as I specified, rather than undermining the Constitutional enumerations. If there should happen to be a good argument that the feds and states couldn't proceed against the locals because these higher-level authorities were somehow compromised (other than general scumbagness), I'd like to know how.

1 0

Re: Clipper III on the table
by jim bell 17 Dec '03

17 Dec '03

At 06:31 PM 10/1/96 -0700, Lucky Green wrote: > > > >On Tue, 1 Oct 1996, Robert Hettinga wrote: >[as to why HP and others support GAK in exchange for DES export] > >> I agree with Lucky's earlier hypothesis that HP's doing this to curry >favor >> for government contracts in lieu of an actual marketing strategy, and I >> leave TIS's motives up to the list as an exercise. ;-). > >This not a hypothesis. A policy person from HP told me that > >1. HP as well as TIS and other companies sell single DES products that >they would like to be able to export. >2. He was directed by HP's marketing department to find a way to make >that happen. >3. He therefore supports a GAK for export "compromise". HP, then, might be a good company to approach as a potential donor on a DES-cracker. While they want to be able to portray their products as reasonably secure, at the same time they want to be able to de-fuse any export limits. Showing that, say, $25,000 of hardware could crack DES in a year (and thus, presumably, $25 million could crack DES in 1/3 of a day, a budget available to the NSA et al.) would demonstrate that there's no strong reason to keep it restricted in any way. Jim Bell jimbell(a)pacifier.com

1 0

Re: Can we kill single DES?
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Peter Trei writes: > Since it looks like the US government will be allowing the export of > 56 bit espionage-enabled software, it's time to kill single DES. Yes. It's an obsolete cipher with a woefully small key. Only a catastrophic failure will cause the ABA to undergo religious enlightenment. > As some of you will recall, a while back I wondered aloud about the > feasibility of brute-forcing DES on general purpose machines, ala the > RC4-40 crack last year. I'm a firm believer in "work smart, not hard." It might be interesting to run a wiring diagram of DES through a superoptimizer and see how many algebraic identities fall out. An analytical crack that could be published on the Net would be far more impressive than harnassing gigacycles on every available machine, which might very well awe the gullible into thinking DES was difficult to break. > On this type of processor, it would still take 9133 years to exhaust > a 56 bit key space. On the other hand, on 20,000 processors of this > power it would take less than 6 months. If the target is encrypted > in a chaining mode with an unknown 8 byte IV, the time more than > doubles. I can see the headlines now. "Cypherpunks show DES can withstand up to 9,000 Pentium-years of torture and keep on ticking." Remember the Law of Unintended Consequences. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

Re: Clipper III on the table
by Omegaman 17 Dec '03

17 Dec '03

> Allow me to say here that I do not belive that Netscape will be amongst > those fooled so easily. But IBM, HP, TIS, and others have already been > fooled. The USG does not need to get every software company to agree with > their proposal. Divide and conquer. Seems that the USG has done a > marvelous job of D&C so far. > If anything, it would not be in their best _marketing_ interests to support GAK. Rejecting GAK in favor of promoting strong crypto will make them look like "good guys". This is also true of Micro$oft. And contrary to an earlier opinion, I think Bill & Co. have been soured by their experiences with DoJ. While their are far larger motivations involve, I certainly don't think Micro$oft will skip at the chance to thumb their noses at the government if it's to their advantage. Both of these companies may be willing to support a DES-crack effort me -------------------------------------------------------------- Omegaman <mailto:omega@bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send a message with the text "get key" in the "Subject:" field to get a copy of my public key. --------------------------------------------------------------

1 0

[SPAM] Timmy May's tentacle thinks I'm Timmy May's tentacle?
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Timmy May lies, rants, posts off-topic, and pollutes the cypherpunks mailing list with his kinky sexual phantasies. Why is this cocksucking limey faggot dying from the combination of AIDS and the mad cow disease accusing me of being Timmy's tentacle? How could Timmy create a tentacle that knows something about crypto when Timmy doesn't? >Comments: Authenticated sender is <paul(a)fatmans.demon.co.uk> >From: paul(a)fatmans.demon.co.uk >To: "Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> >Date: Mon, 30 Sep 1996 17:40:49 +0000 >Mime-Version: 1.0 >Content-Type: text/plain; charset=US-ASCII >Content-Transfer-Encoding: 7BIT >Subject: Re: [AP] Afghanistan >Priority: normal >X-Mailer: Pegasus Mail for Windows (v2.31) >Message-Id: <844193561.12763.0(a)fatmans.demon.co.uk> > > >> > And this would accomplish???? And this has what to do with cryptography?? >> >> Nothing, of course - neither do Timmy May's stupid rants, lies, and personal >> attacks. >> >> By the way, your abuse of your native language suggests that you're probably >> a product of U.S. public education. > >Then it would appear that you are ranting here, your post is off >topic, you are lying, and in addition you have posted a personal >attack.. Haha! - I`ve found Tim`s secret pseudonym!!!! > > > > Datacomms Technologies web authoring and data security > Paul Bradley, Paul(a)fatmans.demon.co.uk > Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org > Http://www.cryptography.home.ml.org/ > Email for PGP public key, ID: 5BBFAEB1 > "Don`t forget to mount a scratch monkey"

1 0

Re: Weaknesses in Smart Cards? (Re: FLA_wed)
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 10:04 PM 10/1/96, Lucky Green wrote: >There is no way to know for sure, since Mondex won't release the specs, >but just about everybody I talk with that knows at least something about >their system agrees that if you crack a Mondex card, you will likely be >able to mint money. Since Mondex allows transfers from card to card to >card, it may be a long time indeed before the breech is disovered. If I >were a Mondex issuer, I would be worried. Very worried. > >--Lucky I can imagine a protocol that would allow the Mondex card to issue several brands of card that would normally appear to be one uniform brand until fraud was suspected or proven. Then only money passed thru the compromised brand would be suspect. News of the counterfeit brand would be spread among cards by a contagion algorithm. One morning your card would greet you saying that $38 of your cash is counterfeit, or worse, that your card could issue no money to other cards, but could be returned to the issuer for a partial refund. I would not want to hide my Mondex card under the matress for my old age. I recall hearing something about Mondex that suggested to me that the card rembered recent large receits and that money had fingerprints so as to remember, to a degree, where it had been recently. When questioned about the privacy issues they responded that of course only the authorities would be able to retrieve such information.

1 0

Re: ITAR satellite provision
by Greg Broiles 17 Dec '03

17 Dec '03

At 09:31 PM 10/1/96 -0700, Steve Schear wrote: >Does anyone on the list have the exact ITAR reg. text relating to the >exemption for space-launched crypto? I think you're talking about the definition of "export", located at 22 CFR 120.10: "Export means, for purposes of this subchapter: (a) Sending or taking defense articles out of the United States in any manner; or (b) Transferring registration or control to a foreign person of any aircraft, vessel, or satellite on the United States Munitions List, whether in the United States or abroad; or (c) Sending or taking technical data outside of the United States in any manner except by mere travel outside of the United States by a person whose personal knowledge includes technical data; or (d) Disclosing or transferring technical data to a foreign person, whether in the United States or abroad; or (e) The performance of a defense service on behalf of, or for the benefit of, a foreign person, whether in the United States or abroad. * A launch vehicle or payload shall not, by reason of the launching * of such vehicle, be considered an export for purposes of this * subchapter. Most of the requirements of this subchapter relate only to exports, as defined above. However, for certain limited purposes, the controls of this subchapter apply to sales and other transfers of defense articles and defense services (see, e.g., Sec. 126.1) of this subchapter." -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

RE: LivePGP (fwd)
by Black Unicorn 17 Dec '03

17 Dec '03

In response to my point that refusing to release the source code of his software will have the effect of discouraging its use by anyone with a clue, On Wed, 2 Oct 1996, Ming-Ching Tiew wrote: > > While most certainly you are entitled to express whatsoever > idea of yours and certainly the same applies to me. > This goes without saying. > I am most certainly not a crypto implementor, the entire > cryptographic part of LivePGP relies on PGP. It is taken > without a single line of change from the compiled executable, > which source is available in full. So, the peer review and > stuff are fully applicable. Incorrect. You have incorporated PGP in a new piece of software. How are we to know you took the code line for line unless we are able to verify this claim? Obviously, we cannot. Your software is, therefore, untrustworthy. This is not a matter simply of my opinion. This is basic doctrine in the development of crypto software. Ask anyone who knows what they are talking about. Joe Average may be interested in your product, but no expert, or even fairly knowledgeable individual, will ever take it seriously while the source code remains private. > I am also most certain that you will have a response to this > view of mine. For whatever it is, I forsee that we will remain > holding on to our own views. So, we should not carried on > with this "discussion", for it will not be a productive work. Your attitude distresses me and your ignorance of the importance of peer review gives me pause when considering your potential skill as a crypto programmer. > Anyway thank you for a brief moment of interest in LivePGP > which you have demonstrated. I really appreciate that. Many of us would appreciate it if your, seemingly very useful software, was also trustworthy enough to be used. > Regards, > Ming-Ching > > ---------- -- I hate lightning - finger for public key - Vote Monarchist unicorn(a)schloss.li

1 0

Civil rights and double jeopardy
by Greg Broiles 17 Dec '03

17 Dec '03

At 08:51 PM 10/1/96 -0700, Dale Thorn wrote: >Once they could no longer look the other way, those higher-level >authorities should have proceeded against the local governments as I >specified, rather than undermining the Constitutional enumerations. The protection against double jeopardy is constitutionally based and cannot be modified by statute, e.g., the Civil Rights Act of 1964. The various civil rights acts, movements, and statutes did not make Congress nor the executive adopt a loophole around the double jeopardy protections; the loophole existed considerably prior to then. The double jeopardy clause is interpreted (and has been since at least 1922) so that it only bars multiple prosecutions (or punishments) by the same sovereign. In _US v. Lanza_ 260 U.S. 377 (1922), the Supreme Court wrote: ". . an act denounced by both national and state sovereignties is an offense against the peace and dignity of both and may be prosecuted and punished by each." Where an act violates both federal and state law, both the federal and state governments think they get an opportunity to prosecute. Thus, racial violence or murder which violates state assault or homicide laws gets a state prosecution; and where it also violates federal civil rights laws (18 USC 241 or 242) it is also prosecutable federally. Ditto for many drug crimes. An act which does not violate federal law (say, jaywalking) cannot be prosecuted federally; this limits the situations where multiple sovereigns can lead to multiple prosecutions. (but with Congress expanding federal criminal law ...) (There's an exception to the dual sovereignty exception to the double jeopardy clause, the "Bartkus exception", where the second prosecution is a sham or a fake undertaken to serve the interests of the first sovereign; but it's very hard to win a _Bartkus_ argument. Stacy Koon (one of the cops convicted for the beating of Rodney King) tried to argue Bartkus and lost.) Sorry for wandering off into legalpunks land but it's simply not the case that the civil rights movement caused the erosion of the double jeopardy clause, or that there's a magic "civil rights exception". Dual-sovereign double jeopardy is alive & well in drug prosecutions today. Civil rights just gets all of the press. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0