December 2003 - cypherpunks-legacy

Leaked Letter Reveals French Key-Escrow Scheme
by J. Thorel / Netpress 17 Dec '03

17 Dec '03

lambda 2.12 * * * * * For several months French authorities have quietly begun to build the world's first "key recovery" encryption scheme, scheduled to take effect early in 1997. But a leaked letter sent to the official security agency, the SCSSI, reveals that the so-called "trust" has some limitation in the draft project. The proposal, called a "decret d'application," is a prime ministerial decree scheduled to be issued after the Telecommunications Reform Act of July 27, 1996 (http://www.telecom.gouv.fr/francais/activ/telecom/lrt96.htm) In France, a law only takes effect after the government signs it as a decree. The decree will define the business conditions of future "trusted third party" (TTP) systems -- in French referred to as "tiers de confidentialite," or a "privacy third party" -- and stresses the difference between the two basic encryption applications: digital signature and privacy. These agents will have the role of electronic notaries, keeping crypto keys in custody for law enforcement or national intelligence purposes. Lambda Bulletin has also learned that French authorities won't impose the "key recovery" scheme as a "mandatory" one. Yet it seems clear that a company will not be able to do business-as-usual if its encryption systems aren't certified by TTPs. Is this good news for individual users? It's not certain: The law says that crypto is legal *only* if keys are kept in custody. It won't be mandatory -- however if you get caught using PGP, it could be considered as a criminal offense. The letter obtained by the press is signed by Jean-Claude Jouas, president of the computer security think tank CLUSIF, and addressed to General Jean-Louis Desvignes, head of the SCSSI. The CLUSIF represents security-related executives from large French companies (some of which are state-owned, such as Bull and Thomson) and also from private consultancies. The SCSSI decided, after intense lobbying, to meet the industry think tank -- which highly suggests that the CLUSIF saw the close-doors draft decree. * Point 1: The letter emphasizes the lack of resolving important questions such as "international exchanges." The letter says: "It shall be possible for [future TTPs] to search partners in foreign countries in order to make these international exchanges a reality, if these partners are ready to respect French national legislation...." The letter goes on to say: "section 5 [of the draft decree] presents a 'franco-francais' project," which could undermine the basic purposes of TTPs. This national approach could create a blow for the OECD initiatives to reach a worldwide consensus for encryption policies (as described in previous bulletins). Stephane Bortzmeyer, speaking for the French Internet Users Association, says: "We'll need more than these suggestions for allowing a reasonable use of crypto. For instance, the international exchanges case is simple: either PGP or SSH use are legal, or people [in France] won't be able to subscribe to CERT mailing lists." This is because CERT urges its participants to encrypt their communications (for integrity reasons). * Point 2: The so-called "certification" procedures. The CLUSIF says "concerning the users' point of view, the most critical point [is] the certification of encryption means and technologies which will be offered by the [TTP], especially concerning the trust level the users will have to afford. [Evaluation and certification] is the key point to establish a trusted relationship, and we consider it as fundamental to include [this point] in the decree". In terms of certification, people can understand that this will protect the user from possible illegal duplication of encryption private keys, thus helping to prevent illegal interception of communications. If these certification procedures are not scheduled in the draft, people could consider it as a reason for an additional lack of trust. * Point 3: The think tank severely notes that "there is nothing scheduled in the draft in the case of legal disputes ... between the user and the third party." The litigation could erupt if the TTP gives up a users' private keys to unauthorized parties (i.e., a competitor or a curious, wiretapping official...). Epilogue: The SCSSI says the final decree could be published by the end of this month. Lambda personal bet: It might be published on Friday, December 27th. (The previous crypto legislation, in 1990, was passed as law on December 29 -- and the decrees for it were officially signed in 1992, on December 28.) P.S.: The whole CLUSIF letter will be published in the French version of this bulletin (check the Web site: http://www.freenix.fr/netizen) * * * * * Short Notes * * * * * * OECD update: The OECD draft guidelines of the crypto expert group have been revealed in Austria. Check: ftp://ftp.netsphere.co.at/Public/OECD/oecd.doc This is the document that was amended during the September 26-27 meeting in Paris, thus there have been changes since then. * EPIC conference proceedings: It's a long after the event, but you can read the English version of a report on the crypto conference EPIC organized in Paris on Sept. 25, on the eve of the OECD meeting. Check the Planete Internet Web site (English translation by K. N. Cukier): http://194.51.213.12:80/interface/SendPage.exe?ID=389 * EF-Sverige: One Lambda subscriber advises people interesting in cyber-rights in Sweden to check EF Sverige, independent from the US-based organization (although, as for EF France and others, the EFF has given them the right to use the name EF-Sverige. Check their web page at: http://connectum.skurup.se/~annami/ EF-Sveridge was founded by two journalists: Anna-Mi Wendel <annami(a)connectum.skurup.se>, the chairman, and Peppe Arninge <journalist(a)peppe.pp.se>, a member of the board. =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Jerome Thorel Planete Internet Journalist, Paris Editor / Redac chef thorel(a)netpress.fr 191 av A. Briand, 94230 Cachan Tel: 33 1 49085833 - fax-31 www.planete-internet.com

1 0

Travelling With Laptops/PGP
by Evil se7en 17 Dec '03

17 Dec '03

Problem: I will be spending a couple of months chilling out in Barcelona, Spain. I will have a local Internet account/dial-up in that city, and will use it to telnet into my various US-based accounts. This is how I plan to keep in touch with various people while I am gone. Questions: 1 - Is the importation of two laptops and it's various peripheral devices by a US citizen into Spain going to be a problem? I know it is in some European countries. 2 - Will having PGP 2.6.2, with 2048-bit keys, or any key length for this matter, installed on these two machines, cause a problem? 3 - What about having SSH and ESM installed on the laptops? Will this set off red flags as well? Now, I see a work around if this is a problem, but would like advice on this also: If I generate a temporary PGP key, and distribute it prior to my departure, and then store it on the US-based server (not a good idea, but it is a temporary key, and if it is not a problem in Spain, SSH and ESM would be in use) then bouncing out of Spain via telnet into US-based computers to process encryption/decryption, key management, etc, any encryption would never actually take place on servers outside of the US. Would this be a viable workaround? Or should I just say fuck it, and just disavow myself of any reason/need for PGP for the duration of my stay? If this is gonna be a problem, I'll just forego anything requiring encryption while I am in Spain. I have no interest in smuggling crypto in, or defying international law just to use PGP for personal use. If it's not allowed, I simply won't use it. But, I MUST be able to bring my laptops into the country. That HAS to happen. My Research: I tried to find these answers myself via conventioanl methods, and either there was no information available, or the embassy people I spoke to weren't sure. (Go figure!) So now I ask for your opinions. se7en

3 2

Addendum
by Evil se7en 17 Dec '03

17 Dec '03

For those who may bring this up, my questions are in relation to Spain's view of my problems, not the US view, as I can bring PGP out of the US legally. In February 1996, the ITAR rules were amended as regards personal use of cryptography. Temporary export of products for personal use is exempted from the need of a license, provided the exporter takes normal precautions to ensure the security of the product, including locking the product in a hotel room or safe. The product must not be intended for copying, demonstratrion, marketing, sale, re-export, or transfer of ownership or control. In transit, the product must remain with the exporter's accompanying baggage. The exporter must keep records of each export for five years. Export to certain "dangerous" countries (e.g., Cuba, Libya, Syria) is prohibited. See the text of the amendment. se7en

1 0

Re: Travelling With Laptops/PGP
by Pyro Teknik 17 Dec '03

17 Dec '03

> Problem: > > I will be spending a couple of months chilling out in Barcelona, Spain. > I will have a local Internet account/dial-up in that city, and will use > it to telnet into my various US-based accounts. This is how I plan to > keep in touch with various people while I am gone. > > Questions: > > 1 - Is the importation of two laptops and it's various peripheral devices > by a US citizen into Spain going to be a problem? I know it is in some > European countries. > > 2 - Will having PGP 2.6.2, with 2048-bit keys, or any key length for this > matter, installed on these two machines, cause a problem? > > Would this be a viable workaround? Or should I just say fuck it, and just > disavow myself of any reason/need for PGP for the duration of my stay? If > this is gonna be a problem, I'll just forego anything requiring > encryption while I am in Spain. I walked straight through British, Dutch and Maltese Customs at the respective airports and they didn't even ask what was in the bag, let alone what software. I had PGP and a huge keyring stored on my hard drive and they were known the wiser. > I have no interest in smuggling crypto in, or defying international law > just to use PGP for personal use. If it's not allowed, I simply won't use > it. But, I MUST be able to bring my laptops into the country. That HAS to > happen. I'd suggest to lugging them through as hand luggage. If you are worred, zip up pgp and so on with a password - if customs do check, they aren't gonna waste breaking the zip password (even though it can be done quickly) Also, I think the law may different, as you are an American Citizen using your own equipment... [*]-------------------------------------------[*]----------------[*] [*] Pyro Teknik - <pyro-teknik(a)geocities.com> [*] Linux Guru [*] [*] www.geocities.com/SunsetStrip/Alley/7705/ [*] Phone Phreaker [*] [*]-------------------------------------------[*]----------------[*]

1 0

Encryption policy challenged
by C Matthew Curtin 17 Dec '03

17 Dec '03

http://www.news.com/News/Item/0,4,5909,00.html?dtn.head "The Business Software Alliance, a powerful Washington trade organization, warned the White House that its encryption policy will fail if the government does not turn to the industry for guidance." blah blah blah ... Interesting how these polite requests from the SBA, et al, are going for such ridiculously low goals. Being able to export 56-bit symmetric cipher products... Why in the world go for such a low number when that is the absolute *best* that you can possibly get? And with such a small difference between 56 and 40 bits, there isn't really any room to haggle. Duh. -- Matt Curtin cmcurtin(a)research.megasoft.com Megasoft, Inc Chief Scientist http://www.research.megasoft.com/people/cmcurtin/ I speak only for myself. Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet

1 0

Fan mail from John Gilmore and his cronies
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Apparently I'm not the only one not believing that "Logos" did not misspell both my first name and my last name just "accidentally". >Received: (from bin@localhost) by zifi.genetics.utah.edu (8.8.3/8.6.9) id AAA02080 for dlv(a)bwalk.dm.com; Thu, 5 Dec 1996 00:04:58 -0700 >Date: Thu, 5 Dec 1996 00:04:58 -0700 >Message-Id: <199612050704.AAA02080(a)zifi.genetics.utah.edu> >To: dlv(a)bwalk.dm.com >From: nobody(a)zifi.genetics.utah.edu (Anonymous) >Comments: Please report misuse of this automated remailing service to <complaints(a)zifi.genetics.utah.edu> > >You wrote: > >>logos <logos(a)c2.net> writes: >>> I have been unfailingly polite to you. Do you have it >>> within your character to respond to me in kind? >> >>Do you think spelling my last name "Vilus" is polite? > >Polite, no. Accurate, and perhaps a "freudian typo"? YES. > >Let me guess, O proud (if irony impaired) kook: > >You're now an authority on on-line manners? > > > No. Logos thinks s/he is. :-)

1 0

No Subject
by Clark E. Satter 17 Dec '03

17 Dec '03

unsuscribe cypherpunks >X48186 >NC-ITG When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl.

1 0

PGP in Russia
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

Hi there, it's been asked before but I don't know the current answer: Is the use of PGP legal in Russia? And if it's not, how are the chances of a foreigner in Russia using it anyway to get away with it? Please reply privately as I am currently not subscribed to the list... Thanks in advance, Harka(a)nycmetro.com

4 3

FW: Intellectual dishonesty
by Butler, Scott 17 Dec '03

17 Dec '03

>Timmy May wrote: > >>P.S. I certainly hope this "Logos" nym is not who I suspect it is, as this >>will surely end our Real World friendship. A fucking bozo. > ^^^^^^^^^^^^^^^^ >^^^ > >Now ... now Timothy. If there is anyone reading this message in the U.K..... Can you remember a television series featuring Ronnie Corbet.. "SORRY" TIMOTHY ! Cheers Scott :-D > > > >

1 0

Re: [crypto] Avatar Protection?
by AJ Barrett 17 Dec '03

17 Dec '03

At 09:13 PM 12/4/96 -0500, e$pam wrote: <snip> This sounds like a good argument for the crypto "watermark" idea that was discussed a few times earlier on the list. I think it goes something like this: The document/avatar/code/whatever has a crypto identifier embedded in it that can be extracted to verify ownership. Perhaps a good analogy might be a steganographic application. > The problem is this: Is there a way for a user to "view" the client's > avatar (and in this sense, the user usually has to receive a copy > of the code to render the avatar and render it on the local machine) > but not save a copy? Assume that a client with no save feature > is not a viable option...too easy to work around. Yep. Even the "eyes only" setting in PGP is no good if the recipient is savvy enough to cut and paste the plaintext to the clipboard. -- Sincerely, AJ Barrett <abarrett(a)checkfree.com> Product Analyst CheckFree Corporation: The Way Money Moves http://www.checkfree.com

1 0