December 2003 - cypherpunks-legacy

The Politics of Export Restrictions
by Rick Hornbeck 17 Dec '03

17 Dec '03

Is it possible the unreasonable crypto export restrictions are simply being imposed at this time for the purpose of making Al Gore look good when he runs for President in 2000? In other words, his campaign could include promises to retract existing crypto export restrictions established by his predecessor. The campaign would be accompanied by slogans and rhetoric such as "export crypto, not jobs" and the crypto/high-tech community would support Gore and the Democratic party in droves.

1 0

Re: Sovreign Right of Lawful Access
by jim bell 17 Dec '03

17 Dec '03

At 10:11 PM 1/28/97 -0600, Mike McNally wrote: >Somebody wrote: >> >> This morning at the RSA keynote, David Aaron, the US Crypto >> ambassador quoted the "Sovreign Right of Lawful Access" as >> something that goverments were determined to preserve. > >Speaking as a private indiwidual, and not as a drone in the employ >of IBM (don't get me started on the "but wait, key recovery *isn't* >the same as key escrow" hoo-ha), that dude scared the piss out of >me. I think that terminology is odd. They're getting desperate. "Soverign Right of Lawful Access" doesn't state HOW DIFFICULT that "access" is to be. Interpreted broadly, that would outlaw any encryption even if it only impeded that access a tiny bit! Or under an alternative interpretation, the mere fact that it is hypothetically possible to decrypt a message means that nothing (other than mathematical improbability) stands in the way of doing the decrypt. Also, it didn't say SECRET ACCESS, although experience tells us that they (the thugs) probably assume this. I've long pointed out that ordinary search warrants require informing people who are being searched, even if they're not home and assuming the thugs didn't trash the place the way they frequently like to. I see no reason to believe that the advent of telephone technology in the late 1800's should have retroactively re-written the US Constitution to make secret searches okay. Technically, the Bill of Rights prohibits "unreasonable searches and siezures," and doesn't specifically mention the secrecy issue, but since (am I correct in this, Real Lawyers <tm>?) the practice up until that time required people searched to be informed of searches, a change in policy that wiretaps could be secret sounds more like taking advantage of a technological windfall, not "discovering" that the Constitution allowed something that had always before been prohibited. Jim Bell jimbell(a)pacifier.com

1 0

Re: Workaround for filtering/cybersitter
by Pavel Korensky 17 Dec '03

17 Dec '03

Mark Rogaski <wendigo(a)pobox.com> wrote: > If I had experience with Netscape plugins and spare time, I'd > try it myself. But here's my proposed solution. > > A plugin in Netscape intercepts all requests, encrypt the URL > with a pubkey algorithm, encode the string base64, send it as GET input to > a proxy server. > > The proxy server decodes and decrypts the URL, gets the requested page, > and returns it. This beats out URL-based filtering. > > Still need to figure out the specifics of key-exchange. If we use > 40-bit encryption, it's exportable, and it still works in our threat > model (ie. we don't care if the watchers figure out the URL a few hours > later). > > To beat out dropping packets with unacceptable pattern in them, we > could use an SSL-based server as the proxy. > > The plugin could even have a nice little on/off switch and a list > list of available proxies. Nice, but I can see one problem here. If I (as a censor) will want to block your communication to prohibited sites, I can block the access to the proxy computers. You will just move the blocking strategy one level up with your plug-in. The censor will block the web servers AND proxy servers. Because the list of proxy servers must be available somehow to users, it is very simple to write some kind of script running on the gateway which is blocking the acccess. The script will download the list of proxy servers, update the gateway tables and the gateway will be blocking acccess to all sites on the proxy list. Bye PavelK -- **************************************************************************** * Pavel Korensky (pavelk(a)dator3.anet.cz) * * DATOR3 Ltd., Modranska 1895/17, 143 00 Prague 4, Czech Republic * * PGP key fingerprint: 00 65 5A B3 70 20 F1 54 D3 B3 E4 3E F8 A3 5E 7C * ****************************************************************************

3 2

Best Computer School?
by Hal Abelson 17 Dec '03

17 Dec '03

Rick Osborne <osborne(a)gateway.grumman.com> writes: The only thing I didn't have that the next MIT applicant had was money. I made the mistake of letting them know that I was dirt poor and would need full aid/grants/etc, and to quote "The Great Escape" it was "Zzzt! To the Russian front!" Just to set the record straight, MIT's admissions is need-blind. Lots of things go into our admissions decisions, but whether or not an applicant needs financial aid is not one of them. Admissions and financial aid are handled out of separate offices, and the people making the admissions decisions don't even see the financial aid requests. One exception: We are experimenting with the possibility of considering the amount of aid needed in the case of a few international applicants, but even here this is only a minor consideration for a small number of applicants. For domestic applicants, financial aid plays no role at all in the admissions decision. -- Hal Abelson

1 0

Best Computer School?
by Hal Abelson 17 Dec '03

17 Dec '03

Rick Osborne <osborne(a)gateway.grumman.com> writes: The only thing I didn't have that the next MIT applicant had was money. I made the mistake of letting them know that I was dirt poor and would need full aid/grants/etc, and to quote "The Great Escape" it was "Zzzt! To the Russian front!" Just to set the record straight, MIT's admissions is need-blind. Lots of things go into our admissions decisions, but whether or not an applicant needs financial aid is not one of them. Admissions and financial aid are handled out of separate offices, and the people making the admissions decisions don't even see the financial aid requests. One exception: We are experimenting with the possibility of considering the amount of aid needed in the case of a few international applicants, but even here this is only a minor consideration for a small number of applicants. For domestic applicants, financial aid plays no role at all in the admissions decision. -- Hal Abelson

1 0

Re: The Politics of Export Restrictions
by Greg Broiles 17 Dec '03

17 Dec '03

At 09:44 PM 1/29/97 -0800, Rick Hornbeck wrote: >Is it possible the unreasonable crypto export restrictions are simply being >imposed at this time for the purpose of making Al Gore look good when he >runs for President in 2000? I suppose it's plausible, but it's an opportunity open to both candidates, and more plausibly (because of lack of collaboration) to the Republicans - e.g., Dan Quayle and the "Crypto Freedom For Americans" platform, promising to rescue Silicon Valley from those evil regulatory Democrats. If I were an evil politician trying to set up a trick like you suggest, I think I'd want a scheme that my opponent(s) couldn't hijack and use against me. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Re: Sovreign Right of Lawful Access
by jim bell 17 Dec '03

17 Dec '03

At 10:11 PM 1/28/97 -0600, Mike McNally wrote: >Somebody wrote: >> >> This morning at the RSA keynote, David Aaron, the US Crypto >> ambassador quoted the "Sovreign Right of Lawful Access" as >> something that goverments were determined to preserve. > >Speaking as a private indiwidual, and not as a drone in the employ >of IBM (don't get me started on the "but wait, key recovery *isn't* >the same as key escrow" hoo-ha), that dude scared the piss out of >me. I think that terminology is odd. They're getting desperate. "Soverign Right of Lawful Access" doesn't state HOW DIFFICULT that "access" is to be. Interpreted broadly, that would outlaw any encryption even if it only impeded that access a tiny bit! Or under an alternative interpretation, the mere fact that it is hypothetically possible to decrypt a message means that nothing (other than mathematical improbability) stands in the way of doing the decrypt. Also, it didn't say SECRET ACCESS, although experience tells us that they (the thugs) probably assume this. I've long pointed out that ordinary search warrants require informing people who are being searched, even if they're not home and assuming the thugs didn't trash the place the way they frequently like to. I see no reason to believe that the advent of telephone technology in the late 1800's should have retroactively re-written the US Constitution to make secret searches okay. Technically, the Bill of Rights prohibits "unreasonable searches and siezures," and doesn't specifically mention the secrecy issue, but since (am I correct in this, Real Lawyers <tm>?) the practice up until that time required people searched to be informed of searches, a change in policy that wiretaps could be secret sounds more like taking advantage of a technological windfall, not "discovering" that the Constitution allowed something that had always before been prohibited. Jim Bell jimbell(a)pacifier.com

2 1

RE: Fighting the cybercensor
by Sean Roach 17 Dec '03

17 Dec '03

At 08:15 PM 1/28/97 -0800, Steve Schear wrote: >I think a hole in your thinking is to assume that the assasins have no >motive other than financial gain. I would submit that there are those that >have the skills, training and a political agenda coherent with the >wagerers, lacking only the financial incentive to make the risks >acceptable. These wetworkers won't consider accepting the bribe of the >rich/powerful This may be true, but the example was to show how easy a defensive line could be thrown up around the powerful. For example, conventional body guards could be included, ones with no real pay but with the fore knowledge that they will be buried with the tyrant. These body guards could be ten children out of each local village. Merely a human shield. In an attack, they would scatter, but the parents would know that the children would die if a successful action were taken against the tyrant. Also, the tyrant could put an open bounty on anyone caught trying to harm him. Just bring the decapitated head of the assassin along with a VHS cassette of the attempted action for a big reward. By layering the defenses, it becomes increasingly difficult for anyone to get through. Obviously the castles walls are the first line of defense, so a reward is given for anyone caught using any entrance to the fortress except those that are provided. The household is told that their participation will result in the extermination of their families. They are then told that if they know of an impending action and fail to report it or attempt to stop it, they are considered party it those actions. A human shield of innocents is "given the privaledge to live in the fortress with our great leader" so that actions by concerned parties is limited further. A standing bounty is placed on the head of the assassin, who so ever brings in the head of the assassin and all children parented by that person after the assination will be given a reward of some set sum. Probably 110%. A bounty is set on security breaches, this bounty would probably be 110% of the death mark on the tyrant. A series of more conventional boobytraps are layed in normally inaccessable areas, the layers of these either being prisoners who have unknowningly been condemned to die, the tyrant himself, or some other disposable or trustable deployment device. The most common of these would probably be a mine field between the two outer most walls of the fortress, and maybe a funnel-gun parimeter inside of that. An inner sanctum with self contained air, water, and food is maintained for the tyrant and h[is/er] closest relatives/advisors. This sanctum would be accessed by biometrics and only used in a percieved emergency. All dissent is declared illegal with capitol punishment for the mere discussion of the impending death of the tyrant, exceptions to this would be persons in the direct company of the tyrant with the tyrants full awareness, and permission.

2 1

Re: DES challenge status?
by Anil Das 17 Dec '03

17 Dec '03

Ben Byer wrote: >=20 > -----BEGIN PGP SIGNED MESSAGE----- >=20 > What exactly is the status of RSA's DES contest? I understand that at > least two of the smaller contests have already been cracked, but I > haven't seen much beyond theoretical discussion on the list on the > topic of the DES contest. >=20 =09Two? The only publicized solution so far is the RC5/32/12/5 solution from Ian Goldberg at Berkeley (and independently from Germano Caronni at ETH Z=FCrich). =09Are you saying that you know that the 48 bit RC5 contest is solved already, or are you just counting Ian's and Germano's solutions separately? -- Anil Das

1 0

Best Computer School?
by Hal Abelson 17 Dec '03

17 Dec '03

Rick Osborne <osborne(a)gateway.grumman.com> writes: The only thing I didn't have that the next MIT applicant had was money. I made the mistake of letting them know that I was dirt poor and would need full aid/grants/etc, and to quote "The Great Escape" it was "Zzzt! To the Russian front!" Just to set the record straight, MIT's admissions is need-blind. Lots of things go into our admissions decisions, but whether or not an applicant needs financial aid is not one of them. Admissions and financial aid are handled out of separate offices, and the people making the admissions decisions don't even see the financial aid requests. One exception: We are experimenting with the possibility of considering the amount of aid needed in the case of a few international applicants, but even here this is only a minor consideration for a small number of applicants. For domestic applicants, financial aid plays no role at all in the admissions decision. -- Hal Abelson

1 0