December 2003 - cypherpunks-legacy

Re: Libel & the 1st Amendment
by Mark M. 17 Dec '03

17 Dec '03

On Sat, 1 Feb 1997, Peter J. Capelli wrote: > You mean to say, rich people can overcrowd the courts as much as they > like, while others are restricted by contigency-only lawyers ( Call > 1-800-AMBULANCE! ) ... and what of the case of a rich person trying to > control > a poor one with many frivolous lawsuits ... while they can afford to file > lawsuit after lawsuit, the poor person cannot defend himself. What, exactly, would be the point of suing a poor person? Mark

1 0

Re: Fighting the cybercensor
by jim bell 17 Dec '03

17 Dec '03

At 09:40 PM 1/27/97 -0500, Phillip M. Hallam-Baker wrote: > > >jim bell <jimbell(a)pacifier.com> wrote in article <5ch9f2$cuu(a)life.ai.mit.edu>... > >> Look, I've proposed what I consider to be a remarkably consistent method to >> prevent the kind of political tyranny that you criticize, and I don't see >> any recognition of this fact. > >Thats because its a whacko solution that has no credibility >or consistency. I'm still waiting for you to explain what you believe to be the "problem" for which we are searching a solution. Is the problem that there is slavery? Or do you think the only problem is that the slaves are unhappy? Jim Bell jimbell(a)pacifier.com

1 0

Re: Key Security Question
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:41 AM 1/31/97 -0800, Z.B. wrote: >My computer went into the shop a few days ago, and I was unable to take >my PGP keys off it before it went in. What are the security risks here? >If the repairman chooses to snoop through the files, what would he be >able to do with my key pair? Will I need to revoke the key and make a >new one, or will I be relatively safe since he doesn't have my >passphrase? Depends on how guessable your passphrase is. If you use something that would fall to a dictionary attack, then you are vulnerable. (Providing that they actually looked for your keyring and made a copy.) If you had nyms on your keyring, then those nyms can be associated with your "true name" with no passphrase required. (Unless you keep your keyring encrypted. Private Idaho supports encrypted keyrings, but little else does.) If you are really concerned about it, you could learn to do your own computer repairs. -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAwUBMvObZeQCP3v30CeZAQHwCgf+Oks1qT2Hc9pRU4jy+YU/q3WidHVhJmf2 QxjdEFeRPyX3rt+7ThCN4wnGdh7W2Ya8SYGwmgGgU7pucJ9vgC0JACU20RvRgsQk 5USpS3+Ua9QVNs/NpKGDDANlsurPMi9y12rIqrDbmPmcnW7HDfrfByLVy0HvfqKE ctJsOOz391rbjM+HiNXzMUiiWLBelVA9CrsG/UtSd243vymwD/J2dJiq3s0CMPln Tl1rSy1IVsMqNuQ65ALV9qsz6GJtK8Wu1nSk1IwR8Ge2ZSq6VCqkV/hY8+r5KPOM V0XMIblviEc87xmiJ8BMuNNJpOvhGzFZQ1TV9vwdec3pfyeV/HeHjw== =2if1 -----END PGP SIGNATURE----- --- | If you're not part of the solution, You're part of the precipitate. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0

RE: Fighting the cybercensor
by jim bell 17 Dec '03

17 Dec '03

At 09:26 PM 1/30/97 -0800, Sean Roach wrote: >At 11:15 AM 1/30/97 -0800, jim bell wrote: >>What you're presented (included in its entirety below) is what I've come to >>call an "AP story problem." I've worked through many of those myself; >>their main problem is that they don't carefully describe why _each_ person >>in the "play" you've described would be motivated to do what it's claim he >>does, and why he DOES NOT do other things to fix the situation he's in. >>Remember, I'm not merely talking about the main character, but also the ones >>who are (apparently?) incidental. >> >>For just one example, you said: "conventional bodyguards could be >>included, ones with no real pay but with the fore knowledgethat they will be >>buried with the tyrant." >> >>What motivates these people? Are they hostages? If they're hostages, then >>presumably that means they're motivated to seek the death of anyone who is >>holding them. What about their relatives; don't they have any sympathy for >>those who are taken? Why don't they donate to AP to see the lead guy dead? > >As I stated in the bottom, the children would be privaledged. Who says? What if the public doesn't agree? Might it not be better to sacrifice a few children to keep other children alive? > They would >merely be told that it is a great honor. It could very well be. Assuming >that the tyrant did not die, these children would live in comparable luxery. How much would this cost? Who would pay? Where would the money come from? Is this "solution" practical for everybody, or just the top guy? >They would be at risk only if the tyrant was. By keeping the children at >hand, the parents would balk at taking action against the tyrant, not only >their own action, but also that of others. The children would merely be >there to thwart the attempts of others. Suppose that didn't work. Who would kill the kids if the tyrant died? Who would risk death himself to do this? Etc. Hint: Unfortunately, you don't seem to be pursuing the implications of what you are hypothesizing. This is typical. Go back and do what I originally suggested: Look at the motivations of EACH person in the "play" and decide why he will play along with the game. This includes not merely the people you want to focus on, but also anyone else. Jim Bell jimbell(a)pacifier.com

1 0

Re: Key Security Question
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:41 AM 1/31/97 -0800, Z.B. wrote: >My computer went into the shop a few days ago, and I was unable to take >my PGP keys off it before it went in. What are the security risks here? >If the repairman chooses to snoop through the files, what would he be >able to do with my key pair? Will I need to revoke the key and make a >new one, or will I be relatively safe since he doesn't have my >passphrase? Depends on how guessable your passphrase is. If you use something that would fall to a dictionary attack, then you are vulnerable. (Providing that they actually looked for your keyring and made a copy.) If you had nyms on your keyring, then those nyms can be associated with your "true name" with no passphrase required. (Unless you keep your keyring encrypted. Private Idaho supports encrypted keyrings, but little else does.) If you are really concerned about it, you could learn to do your own computer repairs. -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAwUBMvObZeQCP3v30CeZAQHwCgf+Oks1qT2Hc9pRU4jy+YU/q3WidHVhJmf2 QxjdEFeRPyX3rt+7ThCN4wnGdh7W2Ya8SYGwmgGgU7pucJ9vgC0JACU20RvRgsQk 5USpS3+Ua9QVNs/NpKGDDANlsurPMi9y12rIqrDbmPmcnW7HDfrfByLVy0HvfqKE ctJsOOz391rbjM+HiNXzMUiiWLBelVA9CrsG/UtSd243vymwD/J2dJiq3s0CMPln Tl1rSy1IVsMqNuQ65ALV9qsz6GJtK8Wu1nSk1IwR8Ge2ZSq6VCqkV/hY8+r5KPOM V0XMIblviEc87xmiJ8BMuNNJpOvhGzFZQ1TV9vwdec3pfyeV/HeHjw== =2if1 -----END PGP SIGNATURE----- --- | If you're not part of the solution, You're part of the precipitate. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

2 1

Re: "Secret" Postal Device stolen
by Bill Stewart 17 Dec '03

17 Dec '03

>>>Postal Service offers $25,000 reward for stolen . . . something I got the impression the author was struggling very hard not to say "I swear I'm not making this up" "But I can't say that - it's Dave Barry's line" :-) At 09:39 AM 2/1/97 -0500, Duncan Frissell wrote: >Mail Storage Box keys? I was also guessing keys - truck keys are a less subtle target than box storage keys, and telling every thug in the country that mail trucks are an easy target, just take the keys from the carrier, seems almost worth sounding really stupid in public to avoid. They did say that it wasn't something they carried in their pockets, but do mail carriers hang their keys on their belts? My wife's guess was that they didn't want to admit they carry Mace or equivalent, though everybody knows it. I also enjoyed the description of one of the weapons as a "steering wheel locking device" "The Club - Police recommend it!" # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Key Security Question
by Bill Stewart 17 Dec '03

17 Dec '03

>> My computer went into the shop a few days ago, and I was unable to take >> my PGP keys off it before it went in. What are the security risks here? >> If the repairman chooses to snoop through the files, what would he be >> able to do with my key pair? Will I need to revoke the key and make a >> new one, or will I be relatively safe since he doesn't have my >> passphrase? Passphrases are MD5-hashed into 128-bit IDEA keys and used to encrypt the secret key; there's a "pgpcrack" program out there that does dictionary-style searches to find if you've got wimpy passphrases. So if your passphrases is "secret", you lose, but if it's "fjhw;doifvjuc-[09efiu v` 2 4rnhc;ljoipcvjpoiewujfgv;loik" you're probably pretty safe, unless that's written on the yellow sticky you left on the side of the PC. On the other hand, if the "repairman" replaced your pgp executable with version 2.6.3kgb, which uses your hashed passphrase as the session key, you're hosed. Or if he installed a keystroke sniffer, or added a small radio transmitter to your keyboard, or whatever. Depends on your threat model. If you need to be paranoid, they've already gotten you.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

3 3

Re: PCS Encryption?
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:23 PM 1/31/97 -0800, William Knowles wrote: >.. Primeco digital phone which uses CDMA technology to scramble >the calls and makes passive listening next to impossible. > (Primeco is a PCS phone) >I have been having one helluva a time trying to find more >information on the encryption used with Primeco, I have >spoken to customer service twice & the local rep told me that >the the Chicago FBI asked Primeco to shut off a phone this >week because they can't listen in on what is been said, >To which the the Primceco guys reply, If the feds can't listen >in then I shouldn't be worried. Many low-level phone company people don't know from encryption, and consider just being digital to be enough to satisfy their market's demand for privacy :-( On the other hand, if they're telling the truth that the FBI had somebody's cellphone shut down because they couldn't wiretap it, that's pretty outrageous, and would seem to constitute a "taking". >Excuse me if this posting is a little off topic, But I have >nearly looked everywhere on the WWW to no avail. CDMA is Code Division Multiple Access, a spread-spectrum technology that lets them manage bandwidth efficiently as well as providing a certain level of privacy (assuming they really are using CDMA, as opposed to TDMA). If there is encryption, it's probably the IS-136 stuff. Phil Karn from Qualcomm was on the standards committees when the NSA was arm-twisting them into making sure it's too wimpy to keep out the NSA, and of course the spread-spectrum is a bit less private when you can subpoena the spreading codes... But it really is much better than nothing. Here's a posting from John Young; you'll also want to look at the CAVE material on www.jya.com. ================================================================= Date: Sun, 26 Jan 1997 17:44:49 -0500 From: John Young <jya(a)pipeline.com> To: cypherpunks(a)toad.com Subject: Cellular Encryption Docs Thanks to David Wagner and Steve Schear, we've learned about the latest documents on cellular encryption which supercede the 1992 CAVE document, Appendix A to IS-54, which contained the CAVE algorithm. Here are the latest, followed by ordering information. TIA/EIA/IS-136.1-A -- TDMA Cellular/PCS - Radio Interface - Mobile Station - Base Station Compatibility - Digital Control Panel, October, 1996, 372 pp. $350.00. Addendum No. 1 to IS-136.1-A, November, 1996, 40 pp. Free. TIA/EIA/IS-136.2-A -- TDMA Cellular/PCS - Radio Interface - Mobile Station - Base Station Compatibility - Traffic Channels and FSK Control Channel, October, 1996, 378 pp. $310.00. TIA/EIA-627 -- 800 MHZ Cellular System, TDMA Radio Interface, Dual-Mode Mobile Station - Base Station Compatibility Standard, June, 1996, 258 pp. $120.00. These documents can be ordered from: Global Engineering Documents 15 Inverness Way East Englewood, Colorado 80112 Telephone: 1-800-854-7179 However, each of the documents lists the following related supplements which contain "sensitive information" and may be obtained by US/CA citizens from TIA by signing a Non-Disclosure Agreement and acceptance of export restrictions: Appendix A to IS-136. Appendix A to 627. Common Cryptographic Algorithms. Interface Specification for Common Cryptographic Algorithms. These controlled documents can be requested by calling Ms. Sharon Vargish at 1-703-907-7702, who will fax an NDA, and upon receipt of the completed form, will send the controlled documents at no cost. Here's the NDA: AGREEMENT ON CONTROL AND NONDISCLOSURE OF COMMON CRYPTOGRAPHIC ALGORITHMS REVISION A TO IS-54, IS-95, AND IS-136 [Note: 627 supercedes IS-54; IS-95 is for CDMA] "I, _________________________, an employee/consultant/affiliate (typed name) of __________________________, hereafter, "the company," (Company name) _____________________________ (Company address) _____________________________ and a United States or Canadian citizen, acknowledge and understand that the subject documents, to which I will have access contain information [which] is subject to export control under the International Traffic in Arms Regulations (ITAR) (Title 22, Code of Federal Regulations, Part 120-130). I also understand that the subject documents represent valuable, proprietary and confidential business information of TIA and its members. I hereby certify that this information will be controlled and will only be further disclosed, exported, or transferred according to the terms of the ITAR. ______________________________ _____________________________ Signature Date ______________________________ _____________________________ Printed Name Witness ______________________________ _____________________________ Title Printed Name of Witness [End NDA] ============================================================================ # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

More on Cellular Encryption Docs
by John Young 17 Dec '03

17 Dec '03

Here's more on the controlled documents for cellular encryption from TIA/EIA we described in a 26 January post to cpunks: Sharon Vargish of TIA (1-703-907-7702) sent the documents after I signed and returned the NDA: TR45.0.A Common Cryptographic Algorithms, Revision B June 21, 1995, 72 pp. (With ITAR notice on every page) TR45.0.A Interface Specification for Common Cryptographic Algorithms, Revision B, August 6, 1996, 15 pp. (No ITAR notice, but "sensitive information should be protected from general distribution.") TR45 Appendix A to PN-3474 (IS-36) October 16, 1995, 10 pp. (ITAR notice on every page.) TR45 Appendix-A to TIA/EIA 627 December 23, 1996, 7 pp. (No ITAR, but "sensitive"notice) "Common Cryptographic Algorithms" (CCA) supercedes the 1992 CAVE document, but is considerbly longer -- 72 pp. for the latest compared to 25 pp. for the 1992 version. Here're the CCA's TOC and Introduction: Table of Contents 1. Introduction 1.1. Notations 1.2. Definitions 2. Procedures 2.1. Authentication Key (A-Key) Procedures 2.1.1. A-Key Checksum calculation 2.1.2. A-Key Verification 2.2. SSD Generation and Update 2.2.1. SSD Generation Procedure 2.2.2. SSD Update Procedure 2.3. Authentication Signature Calculation Procedure 2.4. Encryption Key and VPM Generation Procedure 2.4.1. CMEA key Generation 2.4.2. Voice Privacy Mask Generation 2.5. CMEA Encryption/Decryption Procedure 2.6. Wireless Residential Extension Procedures 2.6.1. WIKEY Generation 2.6.2. WIKEY Update Procedure 2.6.3. Wireline Interface Authentication Signature Calculation Procedure 2.6.4. Wireless Residential Extension Authentication Signature Calculation Procedure 2.7. Cellular Data Encryption 2.7.1. Data Encryption Key Generation Procedure 2.7.2. Data Encryption Mask Generation Procedure 3. TEST VECTORS 3.1. CAVE Test Vectors 3.1.1. Vector 1 3.1.2. Vector 2 3.1.3. Test Program 3.2. Wireless Residential Extension Test Vectors 3.2.1. Input data 3.2.2. Test program 3.2.3. Test Program Output 3.3. Data Encryption Test Vector 3.3.1. Input data 3.3.2. Test Program 3.3.3. Test Program Output 1. Introduction This document describes detailed cryptographic procedures for cellular system applications. These procedures are used to perform the security services of mobile station authentication, subscriber message encryption, and encryption key and subscriber voice privacy key generation within cellular equipment. This document is organized as follows: §2 describes the Cellular Authentication, Voice Privacy and Encryption (CAVE) algorithm used for authentication for mobile subscriber equipment and for generation of cryptovariables to be used in other procedures. §2.1 describes the procedure to verify the manual entry of the subscriber authentication key (A-key). §2.2 describes the generation of intermediate subscriber cryptovariablcs, Shared Secret Data (SSD), from the unique and private subscriber A-key. §2.3 describes the procedure to calculate an authentication signature used by cellular base station equipment for verifying the authenticity of a mobile station. §2.4 describes the procedures used for generating cryptographic keys. These keys include the Voice Privacy Mask (VPM) and the Cellular Message Encryption Algorithm (CMEA) key. Thc VPM is used to provide forward link and reverse link voice confidentiality over the air interface. Thc CMEA key is used with the CMEA algorithm for protection of digital data exchanged between the mobile station and the base station. §2.5 describes the Cellular Message Encryption Algorithm (CMEA) used for enciphering and deciphering subscriber data exchanged between the mobile station and the base station. §2.6 describes the procedures for key and authentication signature generation for wireless residential extension applications. §2.7 describes the ORYX algorithm and procedures for key and mask generation for encryption and decryption in cellular data services. §3 provides test data (vectors) that may be employed to verify the correct operation of the cryptographic algorithms described in this document. ... [End CCA Introduction] The related CCA Interface Specification "describes the interfaces to cryptographic procedures for cellular system applications" described in the CCA. Its purpose "is to describe the cryptographic functions without revealing the technical details that are subject to" ITAR. The two Appendices A to IS-136 and 627 "contain requirements for message encryption and voice privacy for cellular systems" supplemental to those described in the main documents, the CCA and the CCA Interface Specs. ----- This note will be put with other CAVE info at: http://jya.com/cave.htm Thanks to TIA/EIA for prompt and courteous reply to our requests. Maybe they welcome help persuading USG/NSA to allow stronger crypto and boost the market for cellular systems.

1 0

Junger web site
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

PJ sent me his web site which others may be interested in, with pointers to Karn and Bernstein: http://samsara.law.cwru.edu/comp_law/crypto_export/ so, essentially, there are now 3 pretty significant cases challenging ITAR on constitutional grounds, which I find highly encouraging. of course the Bernstein case has already had very positive results so far.

1 0