December 2003 - cypherpunks-legacy

Re: Key Security Question
by Toto 17 Dec '03

17 Dec '03

Paul Foley wrote: > On Fri, 31 Jan 1997 17:51:47 -0800, Toto wrote: >> If the repairman has your pubring and secring files, you can now >> consider them in the same light as a 'busted flush'. > > The secret key is encrypted using the same IDEA algorithm that PGP > uses to encrypt your files. If you trust IDEA, your key is as safe as > your passphrase (not at all if you have no passphrase, not much if > it's easily guessable, etc.) Send me your secring file. I have a new password-buster I'd like to try out on it. > If your computer repairman has the capability to crack strong 128-bit > ciphers, I'd be rather worried :-) He doesn't have to crack the cipher, he only needs to find the password. > On the other hand, there's always the possibility of your passphrase > being on the disk, say in a swap file, somewhere. Same goes for > plaintext of any encrypted files/messages. I doubt anyone's gonna go > hunting through your swap file, "empty" sectors, etc., looking for it, > though, unless you've done something to really piss him off lately :-) Or if he's a member of the CypherPunks list, read the message, and now considers it to be a personal challenge. Toto

1 0

List
by Talbert Newhart 17 Dec '03

17 Dec '03

Please put me on the Cypherpunk list.

2 1

Re: Libel & the 1st Amendment
by Toto 17 Dec '03

17 Dec '03

Mark M. wrote: > If the legal concept of libel is abandoned, this presumption will largely > disappear. People will have to rely on the credibility of the source, instead > of whether or not the victim of libel has sued. God forbid that people should have to use their judgement and their brains, rather than their overly charged emotions. Toto

1 0

Cyphernomicon by Tim May
by Toto 17 Dec '03

17 Dec '03

3.5.1 Contrary to what people sometimes claim, there is no ruling clique of Cypherpunks. Anybody is free to do nearly anything, just not free to commit others to course of action, or claim to speak for the "Cypherpunks" as a group (and this last point is unenforceable except through reputation and social repercussions). 3.6.3 "Why isn't the list moderated?" ...hardly consistent with many of our anarchist leanings, is it? - "No, please, let's not become a 'moderated' newsgroup. This would be the end of freedom!

1 0

Re: "Secret" Postal Device stolen
by Duncan Frissell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 05:18 AM 2/1/97 GMT, Rob wrote: >On 31 Jan 1997 15:26:16 -0500, Jim Ray wrote: > >>from http://www.herald.com/dade/digdocs/021949.htm >>Postal Service offers $25,000 reward for stolen . . . something > Mail Storage Box keys? DCF -----BEGIN PGP SIGNATURE----- Version: 4.5 iQCVAgUBMvNVkoVO4r4sgSPhAQG18AQA2g//lN1jUva1emDq/uQMNRy+1mIA/+Ug 5+0INso7kvCflVbterNDpWo0XoWR9tLrZ013vtcygaWUb07m/AWYBu/K322Tp7Zl nGDaGXFvUHLdJM+hgXyxQZoK/kfWqBiHw0zxczqr3LuwyDUQgFjrHcJb+/TKphBY JwdTTPZJNC0= =uGDj -----END PGP SIGNATURE-----

3 2

Re: Key Security Question
by Toto 17 Dec '03

17 Dec '03

Paul Foley wrote: > On Fri, 31 Jan 1997 17:51:47 -0800, Toto wrote: >> If the repairman has your pubring and secring files, you can now >> consider them in the same light as a 'busted flush'. > > The secret key is encrypted using the same IDEA algorithm that PGP > uses to encrypt your files. If you trust IDEA, your key is as safe as > your passphrase (not at all if you have no passphrase, not much if > it's easily guessable, etc.) Send me your secring file. I have a new password-buster I'd like to try out on it. > If your computer repairman has the capability to crack strong 128-bit > ciphers, I'd be rather worried :-) He doesn't have to crack the cipher, he only needs to find the password. > On the other hand, there's always the possibility of your passphrase > being on the disk, say in a swap file, somewhere. Same goes for > plaintext of any encrypted files/messages. I doubt anyone's gonna go > hunting through your swap file, "empty" sectors, etc., looking for it, > though, unless you've done something to really piss him off lately :-) Or if he's a member of the CypherPunks list, read the message, and now considers it to be a personal challenge. Toto

1 0

Re: Libel & the 1st Amendment
by Peter J. Capelli 17 Dec '03

17 Dec '03

Mark M. wrote: > On Thu, 30 Jan 1997, Jim Choate wrote: > > > > * Many 1st Amendment experts don't believe in the legal concept of libel. > > > It is, they say, a rich man's game > > > > Exactly, instead of equal protection under the law we have a specieocracy. > > Anyone can afford a contingency-free attorney as long as the plaintiff has a > good chance of being awarded damages. This has the benefit that the legal > system doesn't get overcrowded with frivolous cases. You mean to say, rich people can overcrowd the courts as much as they like, while others are restricted by contigency-only lawyers ( Call 1-800-AMBULANCE! ) ... and what of the case of a rich person trying to control a poor one with many frivolous lawsuits ... while they can afford to file lawsuit after lawsuit, the poor person cannot defend himself. -- Pete Capelli, CNE UB Networks, Inc. pcapelli(a)ub.com ****** Finger pete(a)idaho.ubisg.com for my PGP Public key! ****** They that give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. - Benjamin Franklin, 1759

1 0

Crypto in New Zealand - an update
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

This is a continuation of the article I posted here a few weeks ago. You can find the whole thing at http://jya.com/nsazeal.htm. Peter. -- Snip -- On the 17th January significant parts of this story appeared on the front page of the National Business Review (NBR), a fairly influential paper read by (apparently) half the NZ business world. The GCSB declined to comment on anything except to acknowledge that there had been a meeting between a GCSB person and the manager of Orion Systems. The story also confirms (from talking to some of the people involved) the GCSB - MFAT and GCSB - DSD connections. The following week Andrew Mayo wrote a letter to the editor of the NBR containing an eloquent defense of the use of encryption to protect personal privacy. MFAT replied to say that they were only following orders, and were required by the Wassenaar agreement to restrict crypto exports: "Export permits normally were required only if the encryption was 40-bit or stronger, so most commercial encryption would not be affected". I wonder where the 40-bit limit suddenly came from? Note also the phrasing "40-bit or stronger". This means that anything including 40 bits is restricted. If they're going to try to blindly parrot US policy then they should at least get their facts straight. A few days later I found someone who knew what to ask for in order to get a copy of the NZ export regulations. I called MFAT and talked to a gentleman by the name of John Borrie, who had recently taken over responsibility for this affair from someone else who, to put it mildly, had been annoying to deal with. I suggested to him that the GCSB were feeding him just the information they wanted him to know and no more, and that perhaps he should avail himself of alternate sources of advice. He didn't see it quite that way. The export regulations are identical to the Australian regulations, even down to the layout style. A few of the fonts differ, but that may be due to different systems/printers/whatever. There are several obvious holes in these regulations, but I won't mention them now because they'll probably be used in court fairly soon. The following week the story was again on the front page of the NBR. This time the story covered the financial difficulties that Cyphercom had been plunged into. Because MFAT had stopped them from having any access to their product for nine months, the company was considering filing for bankruptcy. MFAT spokesperson Caroline Forsyth commented: "US controls on the export of strategic goods are at least as strict as those of New Zealand... an export permit would normally only be required for encryption if it was 40-bit or stronger. Most commercial encryption is well below 40-bit strength. Almost all New Zealand exporters of software are unaffected". The confused and nonsensical nature of these statements presents a scary picture. MFAT are a government department who (in this area) have no idea what they're doing, but don't know that they have no idea. Combined with the sterling advice they seem to be getting from the GCSB, this could make them a tough nut to crack. In anticipation of what MFAT would say, I wrote a letter to the NBR editor (which won the "Letter of the Week" award :-) which refuted their claims. The letter ended with: It appears that MFAT's position is based on an antiquated outlook which regards software to secure electronic commerce as some form of special military technology, a position which might have been reasonable a few decades ago but is totally out of touch with the modern use of computers and electronic communications. In their October 1996 "Business File", MFAT claim that "New Zealand... is helping to limit the spread of increasingly sophisticated military technology and weapons of mass destruction". Whether mass-market commercial software which protects financial transactions and medical records counts as "sophisticated military technology" or "weapons of mass destruction" is unclear (I suppose it's possible to beat someone to death with a floppy disk if you were very determined, but that hardly qualifies as "mass destruction"). Finally, one of the goals of the Wassenaar agreement was to "not impede bona fide civil transactions", which MFAT have certainly done, and are continuing to do. In the meantime anyone with a credit card and phone, or the ability to walk into a software store, can buy the same software overseas. Stopping New Zealand companies from exporting widely available mass-market computer software of this kind "because terrorists might use it" makes about as much sense as stopping farmers from exporting beef and lamb "because terrorists might eat it". The issue of Management Technology Briefing included with last weeks NBR reports on page 22 that there will be "a US$186 billion market in global transactions by the year 2000", along with a comment that securing these transactions - one of the goals cryptlib was designed for - remains a problem area. Within the next few years the push towards electronic commerce will become a veritable steamroller. By needlessly blocking the export of the technology required to secure this market, MFAT is helping ensure that New Zealand becomes part of the roadkill. MFAT's parting shot was: "People trying to export encryption without clearance can be prosecuted under the Customs and Excise Act". I should certainly hope so! It's going to be difficult creating a test case to get this nonsense thrown out if they refuse to prosecute me. Stay tuned, this is going to get entertaining...

1 0

Crypto in New Zealand - an update
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

This is a continuation of the article I posted here a few weeks ago. You can find the whole thing at http://jya.com/nsazeal.htm. Peter. -- Snip -- On the 17th January significant parts of this story appeared on the front page of the National Business Review (NBR), a fairly influential paper read by (apparently) half the NZ business world. The GCSB declined to comment on anything except to acknowledge that there had been a meeting between a GCSB person and the manager of Orion Systems. The story also confirms (from talking to some of the people involved) the GCSB - MFAT and GCSB - DSD connections. The following week Andrew Mayo wrote a letter to the editor of the NBR containing an eloquent defense of the use of encryption to protect personal privacy. MFAT replied to say that they were only following orders, and were required by the Wassenaar agreement to restrict crypto exports: "Export permits normally were required only if the encryption was 40-bit or stronger, so most commercial encryption would not be affected". I wonder where the 40-bit limit suddenly came from? Note also the phrasing "40-bit or stronger". This means that anything including 40 bits is restricted. If they're going to try to blindly parrot US policy then they should at least get their facts straight. A few days later I found someone who knew what to ask for in order to get a copy of the NZ export regulations. I called MFAT and talked to a gentleman by the name of John Borrie, who had recently taken over responsibility for this affair from someone else who, to put it mildly, had been annoying to deal with. I suggested to him that the GCSB were feeding him just the information they wanted him to know and no more, and that perhaps he should avail himself of alternate sources of advice. He didn't see it quite that way. The export regulations are identical to the Australian regulations, even down to the layout style. A few of the fonts differ, but that may be due to different systems/printers/whatever. There are several obvious holes in these regulations, but I won't mention them now because they'll probably be used in court fairly soon. The following week the story was again on the front page of the NBR. This time the story covered the financial difficulties that Cyphercom had been plunged into. Because MFAT had stopped them from having any access to their product for nine months, the company was considering filing for bankruptcy. MFAT spokesperson Caroline Forsyth commented: "US controls on the export of strategic goods are at least as strict as those of New Zealand... an export permit would normally only be required for encryption if it was 40-bit or stronger. Most commercial encryption is well below 40-bit strength. Almost all New Zealand exporters of software are unaffected". The confused and nonsensical nature of these statements presents a scary picture. MFAT are a government department who (in this area) have no idea what they're doing, but don't know that they have no idea. Combined with the sterling advice they seem to be getting from the GCSB, this could make them a tough nut to crack. In anticipation of what MFAT would say, I wrote a letter to the NBR editor (which won the "Letter of the Week" award :-) which refuted their claims. The letter ended with: It appears that MFAT's position is based on an antiquated outlook which regards software to secure electronic commerce as some form of special military technology, a position which might have been reasonable a few decades ago but is totally out of touch with the modern use of computers and electronic communications. In their October 1996 "Business File", MFAT claim that "New Zealand... is helping to limit the spread of increasingly sophisticated military technology and weapons of mass destruction". Whether mass-market commercial software which protects financial transactions and medical records counts as "sophisticated military technology" or "weapons of mass destruction" is unclear (I suppose it's possible to beat someone to death with a floppy disk if you were very determined, but that hardly qualifies as "mass destruction"). Finally, one of the goals of the Wassenaar agreement was to "not impede bona fide civil transactions", which MFAT have certainly done, and are continuing to do. In the meantime anyone with a credit card and phone, or the ability to walk into a software store, can buy the same software overseas. Stopping New Zealand companies from exporting widely available mass-market computer software of this kind "because terrorists might use it" makes about as much sense as stopping farmers from exporting beef and lamb "because terrorists might eat it". The issue of Management Technology Briefing included with last weeks NBR reports on page 22 that there will be "a US$186 billion market in global transactions by the year 2000", along with a comment that securing these transactions - one of the goals cryptlib was designed for - remains a problem area. Within the next few years the push towards electronic commerce will become a veritable steamroller. By needlessly blocking the export of the technology required to secure this market, MFAT is helping ensure that New Zealand becomes part of the roadkill. MFAT's parting shot was: "People trying to export encryption without clearance can be prosecuted under the Customs and Excise Act". I should certainly hope so! It's going to be difficult creating a test case to get this nonsense thrown out if they refuse to prosecute me. Stay tuned, this is going to get entertaining...

1 0

Re: Fighting the cybercensor
by jim bell 17 Dec '03

17 Dec '03

At 09:40 PM 1/27/97 -0500, Phillip M. Hallam-Baker wrote: > > >jim bell <jimbell(a)pacifier.com> wrote in article <5ch9f2$cuu(a)life.ai.mit.edu>... > >> Look, I've proposed what I consider to be a remarkably consistent method to >> prevent the kind of political tyranny that you criticize, and I don't see >> any recognition of this fact. > >Thats because its a whacko solution that has no credibility >or consistency. I'm still waiting for you to explain what you believe to be the "problem" for which we are searching a solution. Is the problem that there is slavery? Or do you think the only problem is that the slaves are unhappy? Jim Bell jimbell(a)pacifier.com

1 0