December 2003 - cypherpunks-legacy

Re: Cats Out of Bags
by tmcghan＠gill-simpson.com 17 Dec '03

17 Dec '03

According to Duncan Frissell <frissell(a)panix.com> > "In an interview Tuesday, [David L.] Aaron [the Feds' Crypto Ambassador] disputed the {snip} > "When I talk to other governments," he said, "they still don't feel... ===(mis)quoted, paraphrased, and enhanced from current news reports=== The Clinton administration's newly named point man on encryption policy is citing international support for U.S. policies limiting use of encryption and called for industry cooperation. Speaking to the RSA Data Security Conference in San Francisco, David Aaron said that U.S. allies support the concept of lawful access by governments and the use of key recovery mechanisms. The White House's continued restrictions on encryption have been unpopular in the cryptography community and among major U.S. corporations and high tech companies because of the business disadvantage vis a vis foreign firms. Aaron alleges that U.S. trading partners have misgivings about the U.S. government's decision in October to allow 'moderately strong' 56-bit encryption, to be exported, under controlled circumstances, but were willing to cooperate on the policy. "As far as I can see, the international encryption market will not be a free-wheeling affair," he said, adding companies should consider that lawful access and key escrow capabilities may become "a growthe industry" In his speech, Aaron also listed cases where the U.S. government said encryption was used in terrorist plots, drug dealing, child pornography and espionage, adding the White House, "in no way seeks to expand law enforcement powers nor reduce the privacy of individuals." Independent experts strongly disagreed with Aaron's characterization of the international posture following his address here, and leading U.S. legislators said they would continue to push for further reform of the restrictions. "I just don't think it will work," Sen. Conrad Burns, a Montana Republican who has been behind the legislative effort to promote use of stronger levels of encryption, said of the White House encryption policy. "I think if bad people want to do bad things to good people, they certainly won't want to file their key (with any law enforcement authorities)," Burns said in a satellite conference. Marc Rotenberg, director of the Washington, D.C.-based Electronic Privacy Information Center, rebutted Aaron's suggestion that Washington has broad international support for its concept of lawful access by governments to the keys to encrypted files and communications. Rotenberg said at the recent Organization of Economic Cooperation and Development (OECD) meetings on encryption policy, that was not the case, nor were a number of countries pushing for stronger controls, as Aaron said they had been. Germany, Australia, Japan and Canada all are advancing competing cryptography capabilities, according to Rotenberg. Thomas M. McGhan tmcghan(a)gill-simpson.com http://www.gill-simpson.com voice: (410) 467-3335 fax: (410) 235-6961 pagenet: (410) 716-1342 cellular: (410) 241-9113 ICBM: 39.395N 76.469W

1 0

cDc GD Update #21-1/97
by Swamp Ratte 17 Dec '03

17 Dec '03

_ _ ((___)) [ x x ] cDc communications \ / Global Domination Update #21 (' ') January 1st, 1997 (U) Est. 1984 FOR IMMEDIATE RELEASE FOR MORE INFORMATION, CONTACT: sratte(a)mindvox.com CDC IS NEW FALLEN SNOW ON A BLEAK DESERT LANDSCAPE cDc communications is tittering with joy on the birth of this shiny new year to make two announcements. We are the proud parents of ten bouncing new articles in the continuing saga of the CULT OF THE DEAD COW publication. These feisty little rugrats will put a smile on the face and a Brussels sprout in the stomach with their hearty blend of entertainment and information. We also can now make public our "Good Times" virus hoax. The Good Times meme was launched by cDc to prove the gullibility of self-proclaimed "experts" on the Internet. Any chickenhead would see through the Good Times virus message as the merest wisp of smoke that it is, while the so-called experts ran around in circles, beside themselves in self-induced panic. Therefore, CULT OF THE DEAD COW claims FULL responsibility for the waves of nausea and unrest that have spread from AOL to CompuServe to Prodigy by the actions of egotistical 'experts' who roam the Information Superhighway like squeegee men, seeking to wring a buck or two from the poor souls they confront at every intersection and stoplight on the infobahn. We have far worse to unleash upon you, should you insist upon pontificating and spreading obvious falsehoods. Heed well the motto of the Hell's Angels: "Those who know, don't tell. Those who tell, don't know." We'd also like to take this opportunity to quell a nasty rumor: cDc has NOT been bought-out over the past few months to ANYONE. cDc, as always is 100% independently owned and operated and has no outside sponsors. Viacom and Ziff-Davis, puh-leeze. Coming soon: cDc presents AUDIO on the Internet via Tarkin Darklighter's Shockwave site. New releases from Weasel-MX, Gravelheaver, Tha Gates, Superior Products, Grey Man, and Crucified Goat are on the way. Also, The cDc Media List version 3 from Omega... something fresh for the spring '97 fashion season. _ _ the tedium is the message _ _ ((___)) INFORMATION IS JUNK MAIL ((___)) [ x x ] _ [ x x ] \ / _ |_|_ _ _|_ _|_ |_ _ _| _ _. _| _ _ \ / (' ') (_|_|| |_ (_) | |_ | |(/_ (_|(/_(_|(_| (_(_)\_/\_/ (' ') (U) (U) .ooM cDc communications .ooM deal with it NEW RELEASES FOR JANUARY, 1997: deal with it ________________________________/text files\________________________________ 321:"Nineteen Seventy-Seven" by OXblood Ruffin. It was a good year... Star Wars, The Sex Pistols, the Apple II, and the Death of Elvis. And you thought they weren't connected? 322:"Pariah '67" by Matt Brown. It's like _The Wonder Years_ with real blood. Like Diet Coke with real sugar. Who would've thought Paul would grow up to drum for Marilyn Manson? Gosh. 323:"CYBERsitter" by Peacefire. Overprotective parents are being led down the primrose path to potential pathos. This is an important press release from the Peacefire organization concerning their efforts against the makers of the CYBERsitter Internet filtering software. 324:"Painted Stranger" by Weasel Boy. Creepy-as-hell goth fiction. People with monochromatic wardrobes and Victorian affectations, incest, tragic young death, The Beast. You know the drill. Hup hup! 325:"Zen of Skateboarding, Part 3: Flowing Stream" by Thoai Tran. Skate and destroy. Death to false skating. The search for beauty and truth continues. 326:"The Great Southern Fire God" by John Crow. Everything would be great if it weren't for those DAMN YANKEES (nevermind The Nuge, this is _serious bidness_). Will the assembly please rise and join with me in singing "Sweet Home Alabama." 327:"Vulnerabilities in the S/KEY One-Time Password System" by Mudge. All that and a bucket of chicken wings. 328:"Pantslessness" by Mark Buda. I don't know about you, but every time I go outside without pants, the squirrels poke at my BARE-NAKED POSTERIOR with twigs. They ain't got covered rumps neither. Freaks! 329:"Quadro-Pounder" by Drunkfux. He wants lots of meat. Huh-huh. 330:"Happyland Cell Block 90210" by G. Allen Perry. "Where am I?" "You're in a cheap run-down teenage jail, that's where." "Oh my God!" -The Runaways Reading is FUNdamental! _______________________________/ - x X x - \________________________________ Fools better recognize: CULT OF THE DEAD COW is a publication and trademark of cDc communications. Established in 1984, cDc is the largest and oldest organization of the telecommunications underground worldwide, and inventor of the "e-zine." Every issue is produced on an Apple II for genuine old-school flavor. You thirst for our body of work, you know you do. Find it at these fine locations, among others: World Wide Web: //www.l0pht.com/cdc.html FTP/Gopher: cascade.net in pub/cDc Usenet: alt.fan.cult-dead-cow BBS: 806/794-4362 Entry:KILL For further information, contact: Email: sratte(a)mindvox.com Postal: POB 53011, Lubbock, TX, 79453, USA Sincerely, Grandmaster Ratte' cDc/Editor, Fearless Leader, and Pontiff "We're into telecom for the groupies and money." #### By THE NIGHTSTALKER and GRatte'. Copyright (c) 1997 cDc communications.

1 0

Re: Last nail for US crypto export policy?
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:45 AM 1/29/97 -0500, Dan Geer wrote: >Steve is absolutely right on the money, particularly about the likely >happiness on the government side. I pretty much agree. On the other hand, Ian did a nice job on the radio (NPR, probably was All Things Considered) of pushing the "look, if a college student can break 40 bits in a couple of hours, it's really stupid for the government to limit us like this"; a couple of other people also contributed spin, and it came out pretty strongly against export restrictions. I think we do need to get some sort of push going for 3DES as a replacement for DES - it's strong enough, even though DES is showing its age, and it's an obvious transition from the current technology. It's slower and clunkier than IDEA or RC4/128, but still not bad. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Workaround for filtering/cybersitter
by Pavel Korensky 17 Dec '03

17 Dec '03

Mark Rogaski <wendigo(a)pobox.com> wrote: > If I had experience with Netscape plugins and spare time, I'd > try it myself. But here's my proposed solution. > > A plugin in Netscape intercepts all requests, encrypt the URL > with a pubkey algorithm, encode the string base64, send it as GET input to > a proxy server. > > The proxy server decodes and decrypts the URL, gets the requested page, > and returns it. This beats out URL-based filtering. > > Still need to figure out the specifics of key-exchange. If we use > 40-bit encryption, it's exportable, and it still works in our threat > model (ie. we don't care if the watchers figure out the URL a few hours > later). > > To beat out dropping packets with unacceptable pattern in them, we > could use an SSL-based server as the proxy. > > The plugin could even have a nice little on/off switch and a list > list of available proxies. Nice, but I can see one problem here. If I (as a censor) will want to block your communication to prohibited sites, I can block the access to the proxy computers. You will just move the blocking strategy one level up with your plug-in. The censor will block the web servers AND proxy servers. Because the list of proxy servers must be available somehow to users, it is very simple to write some kind of script running on the gateway which is blocking the acccess. The script will download the list of proxy servers, update the gateway tables and the gateway will be blocking acccess to all sites on the proxy list. Bye PavelK -- **************************************************************************** * Pavel Korensky (pavelk(a)dator3.anet.cz) * * DATOR3 Ltd., Modranska 1895/17, 143 00 Prague 4, Czech Republic * * PGP key fingerprint: 00 65 5A B3 70 20 F1 54 D3 B3 E4 3E F8 A3 5E 7C * ****************************************************************************

3 2

encrypt_3.html
by Lynx_User＠linux.nycmetro.com 17 Dec '03

17 Dec '03

Reuters New Media [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Previous Story: Kodak To Buy Wang Software Business Next Story: Netscape Counts On User Upgrades In 1997 _________________________________________________________________ Wednesday January 29 3:26 PM EST U.S. Encryption Envoy Seeks Industry Cooperation SAN FRANCISCO - The Clinton administration's newly named point man on encryption policy is citing international support for U.S. policies limiting use of encryption and called for industry cooperation. Ambassador David Aaron, special envoy for cryptography, said on a speech to the RSA Data Security Conference in San Francisco that U.S. allies support the concept of lawful access by governments and the use of key recovery mechanisms. Key recovery would involve storing encoding keys in escrow so authorities could get access to them to unscramble data in an emergency, such as to uncover criminal activity. The White House's continued restrictions on encryption have been unpopular in the cryptography community and among major U.S. corporations and high tech companies, which argue the limitations put U.S. business at a disadvantage. Aaron said some U.S. trading partners have misgivings about the U.S. government's decision in October to relax U.S. export controls to allow export of moderately strong 56-bit encryption, but were willing to cooperate on the policy. "As far as I can see, the international encryption market will not be a free-wheeling affair," he said, adding companies should consider that lawful access and key escrow capabilities may become "a growing international requirement." In his speech, Aaron also listed cases where the U.S. government said encryption was used in terrorist plots, drug dealing, child pornography and espionage, adding the White House, "in no way seeks to expand law enforcement powers nor reduce the privacy of individuals." But some independent experts who monitor cryptography policy disagreed with Aaron's characterization of the international posture following his address here, and leading U.S. legislators said they would continue to push the White House to further liberalize the restrictions. "I just don't think it will work," Sen. Conrad Burns, a Montana Republican who has been behind the legislative effort to promote use of stronger levels of encryption, said of the White House encryption policy. "I think if bad people want to do bad things to good people, they certainly won't want to file their key (with any law enforcement authorities)," he told conference attendees over a satellite linkup. Burns appeared in the linkup with three legislative colleagues to stress that together they would push to put "get the administration out in front of the cryptography curve." Marc Rotenberg, director of the Washington, D.C.-based Electronic Privacy Information Center, rebutted Aaron's suggestion that Washington has broad international support for its concept of lawful access by governments to the keys to encrypted files and communications. Rotenberg said at the recent Organization of Economic Cooperation and Development (OECD) meetings on encryption policy, that was not the case, nor were a number of countries pushing for stronger controls, as Aaron said they had been. In fact, countries such as Japan, Germany, Australia and Canada all have competing cryptography capabilities they are promoting, he added. The OECD guidelines are due to be published next month. Copyright, Reuters Ltd. All rights reserved _________________________________________________________________ Earlier Related Stories * Encryption Export Bill Backed In Senate - Wed Jan 29 9:54 am _________________________________________________________________ ________________________ ___________ Help _________________________________________________________________ Previous Story: Kodak To Buy Wang Software Business Next Story: Netscape Counts On User Upgrades In 1997 _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments

1 0

KOW_tow
by John Young 17 Dec '03

17 Dec '03

1-28-97: "New Crypto Engines From Trusted Information Systems Allow Easy International Use of Strong Encryption " By supporting any application that calls for the use of algorithms such as DES, Triple-DES, or 128-bit RC2 or RC4, "this product will allow Windows users to use encryption as easily as they use a mouse. Previously, if developers wanted to use encryption in their products, they had to consider writing two different versions, dealing with changing export regulations, and so on. Now, they can write one version of the program and sell it worldwide, knowing that the CSP will handle the encryption legally and safely." "Two Companies Set to Offer Key Recovery Services Using Technology from TIS " SourceKey and Data Securities International (DSI) have applied for approval to operate Key Recovery Centers to support exported encryption products. TIS also announced today that it is in negotiations with the National Computing Centre, Ltd. of the U.K. and Philips Crypto BV of the Netherlands to license the first non-U.S.-based Key Recovery Centers for third party use. "Burns Prepares To Reintroduce Encryption Bill" "This time around," Burns said, "we intend to put a bill on the President's desk and find out if he is truly on the side of the users and providers of rapidly expanding high-tech goods and services." It would prohibit a mandatory system under which producers or users of hardware and software would be required to surrender a decoding "key" to a third party. ----- KOW_tow

1 0

Re: OTP security
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> 1.You've got 16 hardware devices that each generate random noise. > 2.One of the devices fails (or is sabotaged) and emits a predictable stream > (10101...) > 3.The other 15 devices are just fine, and the stream generated by one > device does not effect the stream of another. > 4.You do not know of the (failure/sabotage) until *after* you've generated > your encyrted documents and they are out of your hands. > > So the revamped question is: > How secure are those documents now? Bottom line: You have lost some possible decryptions of the cyphertext. Every 16th bit is now determined therefore each 2nd byte has only 128 possible states. This, rather suprisingly, does not seem to affect the security (though I would say this is a flawed conclusion as we have a pile of sand problem here, how many grains make a pile, how many rngs can be flawed before the security is affected?) I really haven`t had the time to look at it properly, I will do so in the near future as it seems to be an interesting problem... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Sovreign Right of Lawful Access
by tmcghan＠gill-simpson.com 17 Dec '03

17 Dec '03

according to the notorious jim bell <jimbell(a)pacifier.com> > {snip} They're getting desperate. "Sovereign Right of Lawful Access" > doesn't state HOW DIFFICULT that "access" is to be. {snip} Just might get a bit more 'difficult', if these demagogues get their grandstand play off.... >Encryption Export Bill Backed In Senate >WASHINGTON - A bipartisan group of U.S. senators has endorsed a bill >to promote U.S. exports of encryption technology by removing government >barriers on foreign sales. >"Foreign companies are fully utilizing this technology, while >Americans companies have their hands tied with draconian U.S. laws on >encryption," Sen. John Ashcroft, R-Missouri, said. >He joined Sens Conrad Burns, R-Montana and Patrick Leahy, D-Vermont >in endorsing the Promotion of Commerce Online in the Digital Era >.................^^........^..^........^.............^.......^.. >(PRO-CODE) bill. Don't you just love their cute little acronym? Must have laid awake nights thinking that one up! Thomas M. McGhan tmcghan(a)gill-simpson.com http://www.gill-simpson.com voice: (410) 467-3335 fax: (410) 235-6961 pagenet: (410) 716-1342 cellular: (410) 241-9113 ICBM: 39.395N 76.469W

1 0

The Politics of Export Restrictions - Clarified
by Rick Hornbeck 17 Dec '03

17 Dec '03

I agree the strategy would have to be hijack-proof. Something like Gore experiencing a convenient "change of heart" towards the end of this current term and convincing Clinton and the administration to soften crypto export restrictions which would make Gore look like a hero to the high-tech community just in time for the election. Naturally this would have to be carefully scripted but the objective would be to keep the democrats in power. Just a theory. >Return-Path: <owner-cypherpunks(a)toad.com> >Date: Wed, 29 Jan 1997 23:43:43 -0800 >From: Greg Broiles <gbroiles(a)netbox.com> >To: Rick Hornbeck <rnh2(a)ix.netcom.com> >Cc: cypherpunks(a)toad.com >Subject: Re: The Politics of Export Restrictions >Sender: owner-cypherpunks(a)toad.com > >At 09:44 PM 1/29/97 -0800, Rick Hornbeck wrote: > >>Is it possible the unreasonable crypto export restrictions are simply being >>imposed at this time for the purpose of making Al Gore look good when he >>runs for President in 2000? > >I suppose it's plausible, but it's an opportunity open to both candidates, >and more plausibly (because of lack of collaboration) to the Republicans - >e.g., Dan Quayle and the "Crypto Freedom For Americans" platform, promising >to rescue Silicon Valley from those evil regulatory Democrats. > >If I were an evil politician trying to set up a trick like you suggest, I >think I'd want a scheme that my opponent(s) couldn't hijack and use against >me. > >-- >Greg Broiles | US crypto export control policy in a nutshell: >gbroiles(a)netbox.com | >http://www.io.com/~gbroiles | Export jobs, not crypto. > | > > >

1 0

The BrydDes descracker. Beta-version available.
by svolaf＠inet.uni-c.dk 17 Dec '03

17 Dec '03

BrydDes is a DOS program, which issues a known plaintext attack for DES encryption. The method is brute force. ECB mode and CBC mode with known IV are supported. On a Pentium 120, this version of the program can test 369,000 keys in a second. Please note that this is a beta-release. A new version will be shipped February 11th, or earlier if errors are discovered. So far source is not included. Automatic restart from the last key tested is not supported yet, but a shell could be written. The code is tested on a Pentium, but should run on a 486. The program is available at http://inet.uni-c.dk/~svolaf/des.htm Svend Olaf PS. "Bryd" is crack or break in Danish.

1 0