December 2003 - cypherpunks-legacy

Re: Strong-crypto smart cards in Singapore and Germany
by um＠c2.net 17 Dec '03

17 Dec '03

Peter Gutmann writes: >The standardisation committee of the German banks have also produced >an electronic wallet which should have 25 million (yes, 25M) users by >January of next year. Again, this is a pure electronic wallet, with >2-key triple DES and 768-bit (to become 1024-bit) RSA encryption. >[...] This looks like a very nice system, and unlike Mondex doesn't >rely entirely on the hope that criminals can't get at the data on the >card. For 'security reasons', all transactions are logged in what is called 'shadow accounts'. Not what I would call a very nice system.

1 0

Microsoft & Key Escrow
by Blake Coverett 17 Dec '03

17 Dec '03

Following are some of the relevent snippets from http://www.microsoft.com/intdev/security/export/exporfaq-f.htm. The comments in square brackets are mine. ---cut here--- What is Microsoft's position on supporting key escrow? Key escrow encryption is not a market-driven solution and it raises serious privacy concerns for many customers. It is also new, undeveloped, untested, and uncosted, and it will take a long time to be worked out. Additionally, customers have expressed hesitation about mandatory key escrow, especially if they have to give the keys to the government or a government-selected third party. Therefore, we are not actively adding support for key escrow in our products and technologies. [About as good as we can ask for. I would, however, like that last sentence better if the word 'actively' was missing.] Shouldn't the U.S. government be able to access information that could prevent terrorist acts and crime? Strong non-key escrow encryption is already available from retail outlets, foreign companies, and off the Internet. Thus the U.S. government is already having--and will continue to have--a harder time in the future accessing plain text regardless of U.S. export restrictions. [I suppose it would be too much to expect a third sentence reading. 'This is a good thing.'] What is key recovery? How does it relate to key escrow? Market-driven data recovery refers to a product feature that allows users to maintain a spare private encryption key in a safe place. Generally, a data recovery system escrows a copy of the session key with the message or file and the user (or perhaps his employer) controls the decision whether to utilize this feature. With key escrow the U.S. government holds or has access to a user's private encryption key. It is not yet clear whether such systems are exportable. In the October 1 announcement, the U.S. government referred to "key recovery" without defining it; in all likelihood, however, they still have in mind government key escrow, and not market-driven data recovery. [Hmm... it's just possible that Microsoft's spin doctors are better than those of the US government. Perhaps they can sell the world on their definition of 'key recovery' instead of the one we know the TLAs intended.] ---cut here--- regards, -Blake

3 2

RE: Microsoft & Key Escrow
by Tom Albertson (LCA) 17 Dec '03

17 Dec '03

These issues are also addressed at somewhat greater length than in the FAQ in "Microsoft Policy on Export Controls on Encryption" at http://www.microsoft.com/intdev/security/export/expcont1.htm (updated since the recent Administration announcements). rgds tom >-----Original Message----- >From: Blake Coverett [SMTP:blake@bcdev.com] >Sent: Wednesday, December 04, 1996 6:12 PM >To: 'cypherpunks(a)toad.com' >Subject: Microsoft & Key Escrow > >Following are some of the relevent snippets from >http://www.microsoft.com/intdev/security/export/exporfaq-f.htm. >The comments in square brackets are mine. > >---cut here--- >What is Microsoft's position on supporting key escrow? > >Key escrow encryption is not a market-driven solution and it raises serious >privacy concerns for many customers. It is also new, undeveloped, untested, >and uncosted, and it will take a long time to be worked out. Additionally, >customers have expressed hesitation about mandatory key escrow, especially if >they have to give the keys to the government or a government-selected third >party. Therefore, we are not actively adding support for key escrow in our >products and technologies. > >[About as good as we can ask for. I would, however, like that last sentence > better if the word 'actively' was missing.] > >Shouldn't the U.S. government be able to access information that could >prevent terrorist acts and crime? > >Strong non-key escrow encryption is already available from retail outlets, >foreign companies, and off the Internet. Thus the U.S. government is already >having--and will continue to have--a harder time in the future accessing >plain text regardless of U.S. export restrictions. > >[I suppose it would be too much to expect a third sentence > reading. 'This is a good thing.'] > >What is key recovery? How does it relate to key escrow? > >Market-driven data recovery refers to a product feature that allows users to >maintain a spare private encryption key in a safe place. Generally, a data >recovery system escrows a copy of the session key with the message or file >and the user (or perhaps his employer) controls the decision whether to >utilize this feature. With key escrow the U.S. government holds or has access >to a user's private encryption key. > >It is not yet clear whether such systems are exportable. In the October 1 >announcement, the U.S. government referred to "key recovery" without defining >it; in all likelihood, however, they still have in mind government key >escrow, and not market-driven data recovery. > >[Hmm... it's just possible that Microsoft's spin doctors are > better than those of the US government. Perhaps they can > sell the world on their definition of 'key recovery' instead of > the one we know the TLAs intended.] >---cut here--- > >regards, >-Blake >

1 0

Politeness
by logos 17 Dec '03

17 Dec '03

Dimitri Vulis wrote: >logos <logos(a)c2.net> writes: >> I have been unfailingly polite to you. Do you have it >> within your character to respond to me in kind? >Do you think spelling my last name "Vilus" is polite? I think it was neither polite nor impolite. It was a innocent transposition error. Correcting the error and apologizing were polite, however. Do you disagree? I have already raised the question of your apparent lack of intellectual honesty in that you seem to not apply the same rules of conduct on yourself as you would on others. In English there is the saying, 'what is sauce for the goose, is sauce for the gander'. I note that you have spelt my name as 'logos'. As it is a proper noun in the usage and I have spelt it with the 'L', I would ask you if you consider this spelling of my name to be polite? Logos out

4 4

Chippen@Dale
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 07:37 AM 12/4/96 -0800, Dale Thorn wrote: : :If you, Sandy, and the other offenders *really* want to keep the noise :down, then next time ask John directly for a reply, and if none is :forthcoming, say to the list *once*, "John will not answer up", etc., :and let the subscribers draw their own conclusions from the silence, :instead of from your inane "defenses". : Dale, John has no obligation to say anything. In all fairness, no conclusions should be drawn based on any individual's saying nothing. Such thinking is from the Dark Ages. Lighten up, and let go of it.

1 0

PGPfone list
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: jmr(a)shopmiami.com Date: Thu Dec 05 22:54:33 1996 [My apologies for cross-posting this, but it's important IMO.] The list owners have given me permission to post an announcement of a list for those of us who wish to play with the new PGP-fone software. This is a list solely for the discussion of PGP-fone. It is to be low volume and on topic, with none of the garbage that the cypherpunks are presently enduring (my killfile filter gets enough of a daily workout as it is). Usual rules apply on the posting of private mail without the other author's consent, polite discussion, etc. Violators of these policies will likely be *truly* "censored," (booted off the list, *and* unable to post). To subscribe to the list, use the web based gateway at: http://www.rivertown.net/cgi-bin/lwgate [To prevent abuse, your subscription will be verified.] PGPfone for Macintosh and Windows 95/NT can be obtained at these locations: US/Canada users [like PGP, PGPfone falls under ITAR export restrictions.]: http://web.mit.edu/network/pgpfone International users: http://www.ifi.uio.no/pgp/PGPfone.shtml Current versions are: Macintosh - version 1.0b7 Windows 95/NT - version 1.0b2 These versions DON'T talk to previous versions. Presently, the PGPfone Owner's manual is a MAC file and unfortunately it won't open in the Windows environment. Those of us who are MAC-impaired can use the on-line manual available at: http://www.pgp.com/products/fone_01.cgi There is also a "PGP Fone Registry" at the Rivertown.net PGP-users site (which is quite extensive and worth a look for other crypto-related stuff). At this site, people willing to test PGP Fone with others can leave their names and e-mail addresses, along with their area code and local telephone exchange (first three digits) which indicates willingness to be contacted via e-mail to possibly set up a time and place to use PGP Fone with each other. It's very basic right now. You can access it at: http://pgp.rivertown.net/pgp-fone and follow the instructions to sign up. The biggest problem folks have had with PGP Fone is finding someone else to use it with. This site can help alleviate this. Rivertown.net also has a fine PGPfone icon by Mike Acklin. P.S. I concur with Peter Trei on the Forbes ASAP big issue. Try to find a Forbes subscriber and read it all. He left out one author, cypherpunk Bill Frezza. I liked Bill's article best of all. IMO, Buckley and Paglia unwittingly proved in their ASAP articles that it's much easier to fashionably label yourself a "libertarian" than it is to actually *be* one. JMR Regards, Jim Ray DNRC Minister of Encryption Advocacy One of the "legitimate concerns of law enforcement" seems to be that I was born innocent until proven guilty and not the other way around. -- me Please note new 2000bit PGPkey & address <jmr(a)shopmiami.com> PGP id.A7D63DA9 98 1F 39 BA 93 86 B4 F5 57 52 64 0E DA BA 2C 71 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMqeZATUhsGSn1j2pAQFFOQfQzF0pGgGKt9/VR44TzGxAq9yk7dUs0JPK 4G9TIRePcnZ+IYqBFiqGaCws9EGrK/1ztv7ryl0FstROmldTxFj197lSsEysPMQb M8DUbKsDbsLYlNJNCFJkYz9tihM5w5h1YNj4jPwjec3Js/Bh4T3ab6d+h4Ax1ku0 wsWlVv0keP2yXhcFFHPRkkyXmPtTL31/zkGKkwU9dY/efYSf4GeIApfvnYXzInFD vraFSVd0Qi+8py86RZBauKO/vt7mj9r32HCZevPE89AUDVgVnb9Y5SeT9J0f2pXT qHrpDEguBofvsU/q436Vgla+wrHme2rNYqEPqDslSkNzgg== =FH37 -----END PGP SIGNATURE-----

1 0

Intellectual dishonesty
by logos 17 Dec '03

17 Dec '03

Dimitri Vulis wrote: > > LOGOS <logos(a)c2.net> writes: > > > > Yes, that and other catagorizations which are > > irrelevant to the primary focus of this list. > It's funny that you should say this, since Tim May and other prominent > "cypher punks" devote so much attention to their "enemies'" ethnicity and > religion. Recall the attacks on "crazy Russians", "immigrants who abuse > American freedoms", the recent attack on Hispanics, the attacks on Jews, > the attacks on Mormons... Yes I do recall some of those statements. Since you feel that those 'attacks' were inappropriate, is it not intellectually dishonest to engage in such 'attacks' yourself? If it was wrong for them, how can it be right for you? If your age, sex, sexual preference, race, ethnicity, mother tongue, nationality, etc. are irrelevant to the discussions on this list, what possible justification is there for you to raise such issues in my case? I wrote: > > In any case, it is a good example of the informal logical > > fallacy of 'over generalization'. As I understand it, there > > are circa 1000 people subscribed to Cypherpunks. To paint > > an entire group with such a characterization is both > > illogical and unfair. I also question your use of the To which you replied: > What about painting entire ethnic or religion groups, as Timmy May does? This is truly a non-sequitor. I am sure you know better than this. Tim May is responsible for his actions; you are responsible for yours. Taken to it's logical conclusion, if Tim were to murder a random Russian immigrant, you would be justified in killing a random native American. As I said before, you are obviously too smart to seriously entertain such an irrational viewpoint. Thus it is difficult to draw any conclusion other then that you are rationalizing your inappropriate behaviour. > You sound like someone who doesn't read this list, but only "reads the > logs" and sees the complaints from the likes of Arsen... Actually, I read it quite thoroughly. > I've recently quoted the selected writings of Paul Bradley, most of > which were far more "uncultured; crude; or boorish" that anything I > ever said. For example: [elided] Again, would you please explain the logical basis for committing the same abuses you cite from others? I would think you would seek to distance yourself from such behavior, rather than to exceed it. The inappropriate abuse of the 1000 members of this list by others can in no way excuse their further abuse by you. > > It is obvious to me that you are an intelligent person. > > I am concerned, however, with your apparent intellectual > > dishonesty. It would appear that you know perfectly well > You want intellectual dishonesty - look upstairs from toad.com. No, I want intellectual honesty. But even if I look upstairs from toad.com and find intellectual dishonesty, how would that in any way mitigate your apparent intellectual dishonesty? Are you arguing that one is somehow dependent on, or the result of the other? This makes no sense to me. Does it to you? > > that your posts serve no purpose in the cause of promoting > > privacy through the use of cryptography. It is hard to > > draw any other conclusion then that you are intentionally > > being provocative for the purpose of disrupting the work > > of this list. If this is not so, I apologize, but how > > else can we judge your actions? Please step outside of > > yourself for a moment and give us an honest self-assessment > > of your behavior and the motives behind it. > The work of this list appears to be character assassination. If people like > Paul Bradley and Tim May insist on slandering people and trying to harm > their professional reputations (see the thread on "don't hire" lists), > I will do my best to defend them and their freedom of speech,... The above does not appear to make sense. Did you leave something out? It is unclear to me how rude and provocative personal attacks and broad, unkind generalizations about Cypherpunk list members defends freedom of speech, protects privacy or promotes cryptography. Would you please explain the rationale behind your actions? Logos out

3 2

RE: Microsoft & Key Escrow
by Blake Coverett 17 Dec '03

17 Dec '03

Igor wrote: > this is unfortunate -- key escrow is a very good thing as long > as it is not mandated by law. > > any reasonable employer concerned about secrecy and recoverability > of his data should use key escrow solutions for their employees' > encryption. It appears you only read the first question and answer. Go back and read the third one. regards, -Blake

1 0

for future reference
by logos 17 Dec '03

17 Dec '03

1 0

No Subject
by Julian Assange 17 Dec '03

17 Dec '03

>From smtpd Fri Dec 6 03:03:59 1996 Return-Path: <owner-foreignc(a)presence.lglobal.com> Received: (from smtpd@localhost) by suburbia.net (8.8.3/8.8.2) id DAA08167 for <proff(a)suburbia.net>; Fri, 6 Dec 1996 03:03:59 +1100 (EST) Received: from presence.lglobal.com(207.107.12.2) via SMTP by suburbia.net, id smtpd008159; Thu Dec 5 16:03:41 1996 Received: (from majordom@localhost) by presence.lglobal.com (8.6.12/8.6.12) id PAA02103 for foreignc-outgoing; Thu, 5 Dec 1996 15:43:37 GMT Received: from presence.lglobal.com (jessepub(a)presence.lglobal.com [207.107.12.2]) by presence.lglobal.com (8.6.12/8.6.12) with SMTP id KAA02097 for <foreignc(a)lglobal.com>; Thu, 5 Dec 1996 10:43:34 -0500 Date: Thu, 5 Dec 1996 15:43:33 +0000 (GMT) From: Local GlobalPublishing <jessepub(a)lglobal.com> To: foreignc(a)lglobal.com Subject: ForeignCorrespondent REVENGE OF HER MAJESTY'S SPOOKS Message-ID: <Pine.BSI.3.93.961205154318.2075A-100000(a)presence.lglobal.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Precedence: bulk Reply-To: emargolis(a)lglobal.com Sender: proff Foreign Correspondent Inside Track On World News By International Syndicated Columnist & Broadcaster Eric Margolis <emargolis(a)lglobal.com> ,,ggddY"""Ybbgg,, ,agd888b,_ "Y8, ___`""Ybga, ,gdP""88888888baa,.""8b "888g, ,dP" ]888888888P' "Y `888Yb, ,dP" ,88888888P" db, "8P""Yb, ,8" ,888888888b, d8888a "8, ,8' d88888888888,88P"' a, `8, ,8' 88888888888888PP" "" `8, d' I88888888888P" `b 8 `8"88P""Y8P' 8 8 Y 8[ _ " 8 8 "Y8d8b "Y a 8 8 `""8d, __ 8 Y, `"8bd888b, ,P `8, ,d8888888baaa ,8' `8, 888888888888' ,8' `8a "8888888888I a8' `Yba `Y8888888P' adP' "Yba `888888P' adY" `"Yba, d8888P" ,adP"' `"Y8baa, ,d888P,ad8P"' ``""YYba8888P""'' REVENGE OF HER MAJESTY'S SPOOKS by Eric Margolis 5 Dec 1996 Comrade-in-Chief Leonid Ilyich Brezhnev banged his fist onto a solid oak table, knocking over bottles of Armenian mineral water and vodka, and bellowed at the ashen-faced chiefs of the Soviet aircraft industry: `The Motherland's honor is a stake. Beat the Concorde! Or you will all be designing coal mines cars in Siberia!' Such is the story I'm told by someone who was there. I'm recalling these events now because a group of US aircraft companies and NASA have partnered with Russia's Tupelov aircraft firm to take the old TU-144 supersonic transports out of mothballs and fly 32 test flights. My advice to the eager US aviation people is: watch the tests from the ground. Here's why: In the late 1950's and early 1960's, the Soviets were boasting they would shortly overtake America's capitalist technology. Soviet propaganda dismissed France as a nation of foppish boulevardiers, and Britain as a degenerate, toothless old lion. The `degenerate' British and French stunned and mortified Moscow by announcing development of a supersonic jet transport, made with European technology. The outcome of this project was the exquisite, technologically superb Concorde, which continues today to fly passengers at twice the speed of sound. The Kremlin ordered a crash program to develop a Soviet supersonic transport, or SST, no matter the cost. The famous Tupelov design bureau was selected to develop the plane, by `storming,' if necessary, 24-hours a day, until completion. Unfortunatly, Tupelov designers couldn't develop a workable design in the short time given them by the Kremlin. So KGB was ordered to steal the blueprints of the Concorde. A score of KGB agents were dispatched to England and France in a highly complex and expensive mission designed to infiltrate plants where the Concorde was being built. Such military-industrial spying is often used by nations trying to save time, money, or both. Agents of Israel's Mossad, for example, managed to steal the complete blueprints of the French Mirage III fighter after Paris refused to supply them to Israel. Now comes the fun part- as told to me by the late, distinguished RAF commander, Air Marshall Menaul. British counter-intelligence, MI5, according to Menaul, learned of the Soviet penetration and identified many of the agents whose haste, and deviation from KGB standard operating procedures, made them sloppy. The wicked British got their top aviation engineers to doctor a set of Concorde plans - so that the aircraft's center of gravity was too far aft, making it dangerously unstable, particularly at low speeds. The bogus drawings were left where they could be purloined by the KGB. A few days later, the tainted plans were in Moscow. On Dec 31, 1968, the TU-144 - instantly dubbed `Conkordski'- made its maiden flight - a few days before the Concorde's inaugural flight. Chairman Brezhnev was ecstatic. In 1973, the Soviets triumphantly sent their TU-144 to the Paris Air Show. There,. before the world's eyes, the `Conkordski' went out of control and crashed. The horrified Soviets became the butt of international ridicule. Another TU-144 crashed outside Moscow in 1978. From 'pride of Soviet aviation,' the poor TU-144 soon was called, `the supersonic coffin.' A few were put into Moscow-Tashkent service, first flying terrified passengers, then just mail. The `Conkordski' were taken out of service in 1978 after the second spectacular accident. I'm sure many toasts were drunken that night in London at MI5 headquarters. The new TU-144 flights are being conducted with the Americans to develop a future, 300-passenger SST. Tupelov has refurbished some of the aircraft, but I'm uncertain if the basic design flaw introduced by Her Majesty's spooks has been corrected. Probably not, leaving the Conkordski lethally wobbly. Such is the revenge of British intelligence, served up cold and lethal - as the best revenge always is. copyright eric margolis 1996 ***************************************************************** ***************************************************************** --------------------------------------------------------------- To receive Foreign Correspondent via email send a note to Majordomo(a)lglobal.com with the message in the body: subscribe foreignc To get off the list, send to the same address but write: unsubscribe foreignc WWW: www.bigeye.com/foreignc.htm For Syndication Information please contact: Email: emargolis(a)lglobal.com FAX: (416) 960-4803 Smail: Eric Margolis c/o Editorial Department The Toronto Sun 333 King St. East Toronto Ontario Canada M5A 3X5 ---------------------------------------------------------------

1 0