December 2003 - cypherpunks-legacy

Moderation, Tim, Sandy, me, etc. * Strong crypto == DES?!
by John Gilmore 17 Dec '03

17 Dec '03

I'm glad we're talking about some of the real issues here. Tim May said: > I don't want Sandy Sandfort sitting in judgment on my > posts, deciding what the Cypherpunks--a group I co-founded for God's > sake!!!!--are to be allowed to read and what they may not. Tim, the Cypherpunks have chosen to follow Sandy's lead for this month. I'll admit I made it easy for them, but the results are conclusive. There are 1311 addresses in the cypherpunks list today; 42 in the unedited list; and 19 in the flames list. Forty people cared enough to read every posting; the other thousand either wanted to try the experiment -- or didn't care enough to send an email message. Which, as we all know, is a very low threshold. If I was a social scientist I might want to run the experiment both ways, or six different ways. Name it this, or name it that. I'm not; all I want is something that works. The cypherpunks list was unusable for this kind of discussion, only a month ago. It's usable now. I'm definitely bugged by the community's attitude toward my "censorship". Rather than being glad that someone, anyone, was doing something about the major problem on the list, 99% of the reaction was to create even more ill-considered, emotional flamage. *I* didn't make the signal/noise get worse at that point -- *you-all* did. Perhaps at that point I should have shut down the list, as Lucky is now suggesting. "Asking the list what to do" was clearly not a useful option. Sandy cared enough about the community to make some concrete suggestions to me about how to get the list back on track. They involved a lot more work than the previous setup. I told him if he was willing to do the work, we could try it. As Dale suggests, I wasn't about to waste my time reading the whole list in real time and passing judgement on the postings. Sandy was, for a month. The element I find most lacking from the whole discussion, until recently, has been responsibility. In an anarchy, *everyone* is responsible; nothing is "somebody else's job". Sandy felt responsible, so he proposed something. I felt responsible, so I helped. But a large part of the community sat on the sidelines and criticized, without making attempts to make things better; indeed the volume and tone of the criticisms themselves made things worse. Unpaid labor for a peanut gallery of spoiled children isn't very gratifying. You-all remind me of a passage from Booker T. Washington's book _Up From Slavery_, describing what happened on the night that news of the Emancipation Proclamation reached the South: The wild rejoicing on the part of the emancipated coloured people lasted but for a brief period, for I noticed that by the time they returned to their cabins there was a change in their feelings. The great responsibility of being free, of having charge of themselves, of having to think and plan for themselves and their children, seemed to take possesion of them. It was very much like suddenly turning a youth of ten or twelve years out into the world to provide for himself. In a few hours the great questions with which the Anglo-Saxon race had been grappling for centuries had been thrown upon these people to be solved. These were the questions of a home, a living, the rearing of children, education, citizenship, and the establishment and support of churches. Was it any wonder that within a few hours the wild rejoicing ceased and a feeling of deep gloom seemed to pervade the slave quarters? To some it seemed that, now that they were in actual possession of it, freedom was a more serious thing than they had expected to find it. Most of the people on the list haven't bothered to face that freedom. Your de-facto "leaders" have faced it for you. It is a more serious thing than than you expect. All it takes it hard work and judgement. Be responsible for setting your society's privacy policy -- without knowing whether you are right. Face the uncertainty and build anyway. Shall I post you an Emancipation Proclamation -- as if you needed one? Start a mailing list on another site! Move this list to somewhere! Create and nurture an alt group! Make an independent moderated list drawn from the unedited list! Hold meetings! Establish for it a home, a funding, the rearing of newbies, education, citizenship, and the establishment and support of philosophies. Dead simple for people as capable as us. Just takes work. Who's volunteering? Just do it! The experiment will be over in a few weeks. Who's going to take over deciding how to run the list, and running it? If you want to help organize what I'll call the `progressive crypto community', for lack of a better term, then please do. Otherwise, in the immortal words of Lazarus Long, "PIPE DOWN!". John PS: Can we talk about crypto too? It's clear from the last few days of press releases that the pro-GAK forces are again working to confuse novices into thinking that two very different things are the same thing. Last time it was "public key infrastructure" and "key recovery". This time it's "strong crypto" and "56-bit DES". What should we do about this? Educate the public?

5 4

Re: PCS Encryption?
by Phil Karn 17 Dec '03

17 Dec '03

>While awaiting Phil's response, there's an informative description of >Qualcomm's CONDOR device at: > http://www.nsa.gov:8080/programs/missi/condor.html Condor is, of course, a Fortezza (clipper) application, which makes it less than useful to those outside the government. In fact, from what I've heard even the potential government users are much more interested in STU III support. I wonder why... Phil

1 0

Re: My Departure, Moderation, and "Ownership of the List"
by ISP_Ratings 17 Dec '03

17 Dec '03

Dr.Dimitri Vulis KOTM wrote: > > ichudov(a)algebra.com (Igor Chudov @ home) writes: > >> Adam Back wrote: >> > >> > Perhaps it is time to reconsider the benefits of alt.cypherpunks. (As >> > an aside, it is ironic that John Gilmore was the guy who started the >> > alt.* USENET hierarchy, specifically to facilitate freedom of speech). >> > >> >> An interesting idea. > >John Gilmore of EFF is a liar and a hypocrite who likes to claim credit for >other people's accomplishments. Well EFF itself is a lie--the were very well exposed by Wired Mag. a while back as being nothing more than a corporate whore. They represent the interests of owners not consumers--the ACLU has been very open in their critisism of the EFF in this regard. A large corporation waves some money in front of their noses and tells them to bend over you can be sure they'll bend over. Respectable free speech advocates do not associate with EFF. >He had nothing whatsoever to do with the creation of the alt.* Usenet >hierarchy. Gilmore is a liar and a censor. > Is Mr. Gilmore making this claim? >On the other hand, creating an alt.cypherpunks sounds like a more robust >idea than yet another mailing list. And you could merely post this mailing list publically in the alt group of your choice--I find it interesting at times but not worth responding to in general since freedom of expressiion is not a given. Steve

1 0

Re: Information Warfare
by tmcghan＠mail.bcpl.lib.md.us 17 Dec '03

17 Dec '03

in a message allegedly from: Peter Hendrickson <pdh(a)best.com> > The cypherpunks list has been under "attack" for some time. {snip} > Some people have dismissed the idea that rogue governmental elements > are behind some of our problems. {snip} > We know that "Information Warfare" is the big thing in the defense > establishment right now. Information Warfare Conference sponsored by DPMA/AITP Washington, DC, March 13-14, 1997 Crystal City Marriott 1999 Jefferson Davis Highway Arlington, VA 22202 Presentations by: Major General Michael V. Hayden, Commander, Air Intelligence Agency Dr. C. Kenneth Allard, Competitive Strategies Col. H. Stevens, Land Information Warfare Activity - current service visions and planned program initiatives - operational concepts for 'third-wave' warfare - information warfare drivers for 21st century C4I architectures - emerging technologies and systems for information warfare superiority: opportunities on the horizon 'information warfare targets and vulnerabilities', Maxim I. Kovel, TASC systems management group 'information warfare for deterrence', William H.J. Manthorpe, Jr. Applied Physics Laboratory, Johns Hopkins 'adaptive techniques for counter-deception', James Llinas, technical advisor, DOD JDL, Data Fusion group 'emerging threats come in all sizes and flavors', Eugene Schultz, SRI consulting "Information has been termed the 'fifth dimension' in the conduct of 'third-wave' warfare, and promises to dramatically enhance the role of C4I as a force multiplier. Joint and individual service doctrine is emerging for IW, ans is affecting the needs and requirements for diverse systems: from space-based surveillance and communications systems to terrestrial image processing, visualization, and information fusion systems." "This conference will provide a valuable forum where military and industry staff can interact with key decision-makers to achieve the most current possible understanding of Information Warfare concepts, initiatives, technologies and potential opportunities. The Critical Questions to be addressed include: - how is IW changing operational concepts? - how can we defend the weak links in the planned information-intensive reconnaissance, strike, targeting architecture? - what developments in enabling technologies are needed to support current Information Operations, Battlefield Visualization, and Information Exploitation initiatives? -what can be done to develop defensive information technology capabilities? and last, but _c_e_r_t_a_i_n_l_y_ not least: - how will we move forward to develop a true offensive IW capability ==============================================

2 1

Re: Moderation, Tim, Sandy, me, etc. * Strong crypto == DES?!
by Dale Thorn 17 Dec '03

17 Dec '03

John Gilmore wrote: > I'm glad we're talking about some of the real issues here. > I'm definitely bugged by the community's attitude toward my "censorship". I'll bet you are. > Perhaps at that point I should have shut down the list, as Lucky is > now suggesting. He'd really like to, but... > You-all remind me of a passage from Booker T. > Washington's book _Up From Slavery_, describing what happened on the > night that news of the Emancipation Proclamation reached the South: What we most remind him of are slaves. > Most of the people on the list haven't bothered to face that freedom. Which freedom is that? > If you want to help organize what I'll call the `progressive crypto > community', for lack of a better term, then please do. Otherwise, in > the immortal words of Lazarus Long, "PIPE DOWN!". i.e., stop saying what I don't want to hear and start saying what I do want to hear, after all, it's *my* list.

1 0

Re: GAK/KR spin
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Mon, 3 Feb 1997 14:34:49 -0800 > From: Steve Schear <azur(a)netcom.com> > To: cypherpunks(a)toad.com > Subject: GAK/KR spin > Several months back there were discussions on the list regarding renaming > the government's key escrow/recovery proposals (KRAP comes to mind). I > think we need something that's catchy and simple (perhaps already familiar) > to understand for the semi-litterate citizen units. I propose we encourage > use of the terms "crippleware" or "crypto crippleware" when refering to the > products limited to their weak crypto and/or key escrow/recovery. > > --Steve For some time, I have been using the term 'espionage-enabled software' to describe GAK'd products. Also, 'compromised software' - I want to make the point that 'key escrow/recovery' == insecure.' Peter Trei trei(a)process.com PS: I have SW for working on the $10,000 DES challenge available.

1 0

RE: My Departure, Moderation, and "Ownership of the List"
by Jason Vagner 17 Dec '03

17 Dec '03

>(And if Sandy wants comity and good cheer, let him either form >his own list or establish a filtered list just the way Blossom >and Arachelian did. Hijacking the list to reform it in his own >image is dirty pool.) Just something from another perspective: I've been on the list for quite a long time, though I've never posted. I've been online for over ten years, ran my share of mailing lists, and understand majordomo quite well. As far as I can tell, nobody has ever advertised or posted instructions for joining Blossom's or Arachelian's lists. At one time I gave a little bit of an effort to find them, to no avail. They don't seem readily available on the search engines (again, as of about 6 months ago). I never did flat out post a request for the information, as it was not that important for *me* to find it. I imagine that these individuals might have limited resources for a list-too-large, but is there really a reason this is request-only info? --- Jason Vagner <jlv(a)sig.bsh.com> Resist KRAP and GAK. Police States Are Bad. "All that one can give is what is going to happen, which may have little to do with a present that you can grasp." - Avital Ronell.

1 0

Re: New X-Ray Imager
by Adam Shostack 17 Dec '03

17 Dec '03

| A poll last week by the Los Angeles Times found that a majority of people -- | 58 percent -- said they would curtail some civil liberties if it would help | thwart terrorism. Thirteen percent said it would depend on what rights were | at stake. The poll didn't ask people to single out any rights. Its worth noting the 'if it would help thwart terrorism.' The 'best,' most expensive anti-terrorism measures ever used in the US were at the Summer Olympics. The White House point man on encryption admitted at last years CFP that Clipper and its derivatives would not have prevented the Oklahoma city bombing. A question worth asking is do we want to apply evolutionary pressure to terrorists? I prefer hijacking to bombings wrt aircraft, but the FAA disagrees. I prefer having my car stolen without me in it as well. (I think John Gilmore asked that question, but I could be wrong.) Adam -- Pet peeve of the day: Security companies whose protocols dare not speak their name, because they don't have one. Guilty company of the day is now V-One.

1 0

IBM's SecureWay Key Recovery technology
by Marshall Clow 17 Dec '03

17 Dec '03

>From <http://www.ibm.com/Security/html/prkeyrec.html>: >At the RSA Conference, IBM announced the details of its highly >anticipated SecureWay key recovery technology. IBM is developing this >technology in response to market demands for exportable strong >encryption required to advance the growth of global e-business. >[ yada yada yada snipped ] I attended this presentation. Basically, what they do is to add two packets to the "channel setup process", one that depends only on the coorespondents, the other that contains the information about this particular session. A problem with this, as I pointed out to the presenters, is that the first packet can be trivially used for traffic analysis. The eavesdropper may not be able to determine who is cooresponding, but they can tell if it is the same people as in a previous conversation. >From <http://www.ibm.com/security/html/wp_keyrec2.html> >In order to minimize the preparation overhead, the recovery information >is prepared in two phases: one phase is independent of the particular >session/archive key being prepared; the second phase is dependent on the >particular key and session parameters. The first phase, which uses >public-key encryption, can be shared across multiple invocations of key >recovery preparation, thus reducing overhead. The public-key encryptions >can be stored for repeated use. > As you can see, IBM suggests cacheing the contents of the first packet, so that you don't have to recalculate it each time. Imagine how easy traffic analysis would be if the identification packets were identical instead of just related. -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> Warning: Objects in calendar are closer than they appear.

1 0

AltaVista Tunnel
by Rick Osborne 17 Dec '03

17 Dec '03

The Digital / Microsoft "Driving Force" tour is in our parking lot today and I got the opportunity to have a look around. One of the 'stations' inside the truck is on intranets. They were showing off a product called "AltaVista Tunnel" which I assume is their PPTP product. I say "I assume" because the guy showing it off had absolutely no clue what he was talking about. He triumphantly exclaimed that the encryption was 128-bit, but when I said "128-bit what?" he cowered and muttered that he didn't know and went on with his little speech. The rest of my crypto-specific questions met with equal dark stares. And these are the people setting industry standards... _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ Real programmers programs never work right the first time. But if you throw them on the machine they can be patched into working in only a few 30-hours debugging sessions.

1 0