December 2003 - cypherpunks-legacy

Re: Letter Re: Kahn Supporting GAK
by Robert Rothenburg 'Walking-Owl' 17 Dec '03

17 Dec '03

Good point: but I've seen a few refs from LEAs about "Drug Dealer X who we can't talk about" or "Child Pornographer Y who we can't talk about" (in lieu of cases being digested by the court system) so I didn't harp on that point. A point I did leave out was that if they already knew these people were criminals and were building cases against them, monitoring them enough to know they used crypto, then do they really need to bother with listening in to the exact message? I wanted to emphasize the phallacy of the sacrifical lamb of rights in the name of the god of security. Also, they mungled the letter enough, so it's better for LI Newsday (which caters to a reading level of the average 12-year-old) submissions to be kept short and sweet. I'm quite surprised that mine is the only letter they printed. Certainly they would have gotten more than one submission on a controversial subject? --Rob On 5 Feb 97 at 18:22, jim bell wrote: > But which "criminals," exactly, are "increasingly using encryption to > conceal their plans and activities"? Let's not concede this unless it's > really true. > > It would be far more accurate to say that it's likely that many people who > are politically hostile to their government are using encryption in > anticipation of persecution by the government, persecution that could easily > come in the form of criminal charges. > > > Jim Bell > jimbell(a)pacifier.com > > ----- "The word to kill ain't dirty | Robert Rothenburg (WlkngOwl(a)unix.asb.com) I used it in the last line | http://www.asb.com/usr/wlkngowl/ but use a short word for lovin' | Se habla PGP: Reply with the subject and dad you wind up doin' time." | 'send pgp-key' for my public key.

1 0

Re: Cypherpunks FOIA request
by Lucky Green 17 Dec '03

17 Dec '03

At 12:40 AM 2/5/97 -0800, Greg Broiles wrote: >I'm not sure what I think about the response from the SF FBI branch - it >seems unlikely that they'd never have paid any attention to the list, given >the media coverage in Wired and other places. My attorney used to fly planes with nuclear cargo. Another friend of mine has been visited several times by the FBI. In either case, the FBI claimed upon receiving an FOIA request that they have no record on either person. Does anybody here believe that the USAF would let pilots take off with nukes on board without ever conducting a background investigation (which are handled by the FBI)? I didn't think so. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

pgpmail 4.5
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

you wrote: There is a pgpmail45.exe at ftp.hacktic.nl/pub/replay/pub/incoming. The file has an md5 sum of 'ffd56d7647c30152a5c9fe7616a3d9ef'. i downloaded the same. md5 5ea438501d0133f0849c2fe8f9125b6b can someone clear this up?

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

http://www.cnn.com Congressman demonstrates ease of cell phone snooping

2 1

Re: Getting into MIT is impossible
by jim bell 17 Dec '03

17 Dec '03

At 04:50 PM 2/5/97 +0100, P.J. Westerhof wrote: >At 18:12 4-02-97 -0800, you wrote: >>Erland van Lidth de Jeude is a MIT grad. He played the big badass in "Stir >>Crazy." Computer science major, BTW. >> >He is quite a singer too (at least he was some years ago on Dutch TV). >Perhaps that made the difference. ;-) He was on the fourth floor of the west parallel of East Campus, in about 1977 as I recall. I was on the third floor. He was a wrestler; I heard he didn't have to work all that hard, he could just sit on the opponent and he'd win. Jim Bell jimbell(a)pacifier.com

1 0

Deloitte-Touche, e$pam plug, Moderation, Cypherpunks as a cresote bush
by Robert Hettinga 17 Dec '03

17 Dec '03

At 4:05 pm -0500 2/5/97, Mark Voorhees wrote: >I'm almost certain that Murray is a consultant rather than >or in addition to an accountant. He's been saying these things >for years at conferences, in papers, on mailing lists, etc. For the longest time, I've had a couple of people from dtus.com on my e$pam feed. They signed on when I started my own list out of www-buyinfo. About 6 months ago, however, mail to them started bouncing out of e$, the chat list I set up as an adjunct to e$pam. Which makes sense, because that's when they stopped chatting about e$. :-). I expect that the same thing happend to e$pam, though Rachel Wilmer, who is my e$pam listmaster would have seen it, and not I. Actually, e$ has become something of a watering hole, now with about twice as many subscribers as e$pam does. Some cypherpunks among them. Oh. While we're all talking about moderation, e$pam is a sort of filtered superset of cypherpunks. I have filtered cypherpunks posts in it, but I also have stuff from the 50-odd mail lists and 70 news groups I follow. The total feed can reach 300k a day sometimes, mostly because I include the full text of stuff like some of John Young's articles, and the text of the occasional web-page which tickles my fancy. Sort of immoderate moderation. :-). You can subscribe to it on my web page, which is in my .sig, below. I've a bunch of people working with me now on e$pam, who, among other things, are in the process of getting it set up in a searchable archive. Though, to prevent crawlers from seeing all the juicy bits (cf. Mr. Young, above), we're probably going to have some kind of certificate-access scheme when we get it all running. Rodney Thayer, who's doing IPSEC stuff, (among other things :-)), is going to run a quick-and-dirty generic certification authority to make that happen. In the meantime, if you're interested in e$, or financial crypto, or other stuff I'm interested ("it don't say e$pam until Bob says it says e$pam" :-)), you might want to check it. Even though cypherpunks is a lot "cleaner" now, and I did encourage Sandy in his efforts initially, I suppose I'm now weighing in with (horrors!) Tim on the subject of moderation. I think that if Sandy and John want to create a moderated list (like I have done, though e$pam is more specific in content) out of what happens on cypherpunks, they could do it with exactly the traffic they have now in experimental moderation mode. The current machine load doesn't seem to be impacting the throughput to cypherpunks(moderated), modulo Sandy's moderation time, though if toad.com's being used for much else, there might be problems there. Part of the nice thing about cypherpunks 1.0 was that anything could happen there. That it was anarchy in practice. And, maybe because of my periodic altercations with Mr. May on this list (thank god for his kill-file :-)) even the anonymous Tim-slams were occasionally entertaining, in a, ahem, biologically curious sort of way. ;-). So, I guess I think we should put it back the way it was. Including, please Mr. Gilmore, "officially' resubscribing the Wee-vil Dr. V. Then those who've made it so can annouce to the world that cypherpunks is again a proper anarchy. Then we can us deal with miscreants the way we used to, by ignoring them, (and the occasional e-mailbomb...). Finally, I have an analogy for cypherpunks from nature. There are lots of plants, some of them the technically the largest living beings on earth, which, at first glance, look like a bunch of different individual plants. Aspen groves, for instance, are all linked together under the soil to the same system of roots, and are genetically the same individual. Some of these "stands" of trees cover tens of square miles, and one patch of Aspens, in Wyoming? Montana? is the world's largest living thing, massing several million(?) tons, and probably tens of thousands of years old. Fungi do this too. Toadstools (a rather, heh, fecund analog for cypherpunks) tend to create very large "individuals", with each toadstool representing the fruiting body for a huge bunch of mycyillia(sp?) underneath it. Toadstools create structures called, ahem, "fairy rings", where the central mushroom dies, only to be replaced by a ring of other mushrooms, which die, and so on, until they're covering your whole fucking lawn and messing up your lawnmower bag... (well, anyway, you get the idea.) There was the claim a few years ago that the same genetic individual slime mold covered half of Wisconsin (Minnesota?). The king of all the plants which do this, I think, is the cresote bush, which, I believe, in some pieces of the Sonorran(sp?) desert, cover hundreds of square miles. Scientists, using tree-ring dating, have worked back, through various rings of cresote bushes, using their very slow growth rates in the desert environment, to the center of the creosote bush cluster, to estimate the date of these things. I remember claims that these plants may have started from a single individual, there at the long dead (or at least regrown-over) center of the ring, more than a hundred, and maybe several hundred thousand years ago. So, let nature take its course. Most lists die when people stop posting to it. That certainly hasn't happened to cypherpunks. And, when it does, we can all migrate out into the numerous rings of lists that cypherpunks has spawned (I think I can account about putting together 10 or so myself) among them. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

3 2

pgpmail 4.5
by Huge Cajones Remailer 17 Dec '03

17 Dec '03

you wrote: There is a pgpmail45.exe at ftp.hacktic.nl/pub/replay/pub/incoming. The file has an md5 sum of 'ffd56d7647c30152a5c9fe7616a3d9ef'. i downloaded the same. md5 5ea438501d0133f0849c2fe8f9125b6b can someone clear this up?

1 0

[RRE FWD] PKI: 10 Public Policy Questions
by Rick Osborne 17 Dec '03

17 Dec '03

C'punks- Got this off of the Red Rock Eater list, <http://communication.ucsd.edu/pagre/rre.html>, and figured those of you not on it might like a read. _________________________________________________ From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: PKI: 10 Public Policy Questions X-Url: http://communication.ucsd.edu/pagre/rre.html [The bottom line: State legislation on digital signatures presupposes an overly centralized architecture and is weighted against victims of fraud. Pursuing inherently national or global issues on the state level permits interested parties to shop for a friendly legislature, who will then set a precedent that other jurisdictions are likely to follow. This system is biased against less politically mobilized constituencies and favors older technologies and more centralized business models.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 05 Feb 1997 09:48:01 -0800 From: Bradford Biddle <BIDDLECB(a)COOLEY.COM> Subject: PKI: 10 Public Policy Questions [...] * * * * * * * * * [Copyright 1997 C. Bradford Biddle; permission granted for non-commercial electronic redistribution] CFP '97: LUNCHTIME WORKSHOP, WED. MARCH 12 1997 12:30PM -2:00PM PUBLIC KEY INFRASTRUCTURES AND "DIGITAL SIGNATURE" LEGISLATION: 10 PUBLIC POLICY QUESTIONS BRAD BIDDLE* Following the lead of the state of Utah, numerous states and several foreign countries have enacted "digital signature" legislation aimed at promoting the development of a public key infrastructure (PKI). While PKI legislation has acquired significant momentum, it is not clear that lawmakers have carefully considered the public policy implications and long-term consequences of these laws. This luncheon session will explore certain policy questions related to a PKI, in an informal "open discussion" format. Ten questions we hope to address are: 1. Is legislation necessary at all? Proponents of digital signature legislation start with the premise that the need for a PKI is clear: public key cryptography and verifiable certificates offer the best hope for sending secure, authentic electronic messages over open networks, thereby facilitating electronic commerce. They argue that the reason that the commercial marketplace has not produced a viable certification authority (CA) industry is because of legal uncertainty (CAs are unable to determine their potential liability exposure because of a confusing array of applicable background law) or because existing law imposes too much liability on CAs. Thus, proponents argue, legislation is necessary in order to provide certainty in the marketplace and allow a much-needed industry to emerge, as well as to address other issues such as the legal status of digitally signed documents. Opponents of this view assert that it is far too soon to conclude that the market will not produce commercial CAs, and point to the increasing numbers of commercial CAs emerging even in the absence of legislation. Time is solving the "uncertainty" problem, opponents argue, and the "too much liability" problem is the product of flawed business models, not a flawed legal system. Opponents of legislation argue that the real danger is that a group of lawyers will impose a set of flawed rules that will fundamentally skew a dynamic infant marketplace and "lock in" a set of business models that the market would otherwise reject. The time for legislation and regulation is after identifiable problems exist in a mature industry, opponents say, not before an industry even exists. Opponents of legislation further argue that existing legal mechanisms can address the issue of the legal status of digitally signed documents. 2. Where should PKI legislation occur? Debate also occurs over the appropriate jurisdictional level for digital signature legislation. Some observers cringe at the thought of 50 inconsistent state digital signature laws; others believe that CAs and consumers will opt-in to the most sensible legislative scheme, and thus believe that competition between the states is helpful. Proponents of uniformity and consistency argue for PKI legislation at the federal or international level; opponents of this view point out that general commercial law has long been the province of state legislatures. 3. Is licensing of Certification Authorities the right approach? Under the Utah Digital Signature Act ("Utah Act") and much of the subsequent PKI-related legislation CAs are licensed by the state. The Utah Act makes licensing optional: CAs that obtain licenses are treated with favorable liability rules, but non-licensed CAs may exist in Utah. Licensing is a highly intrusive form of government regulation (other, less intrusive methods of regulation include mandatory disclosure requirements, altering liability rules to avoid externalized costs, bonding or insurance requirements, etc.). Typically, licensing as a form of regulation is reserved for circumstances where a market flaw cannot be addressed by other, less intrusive means. Does this sort of dynamic exist with CAs? Would consumers be able to make informed, rational choices between CAs? Could an incompetent CA cause irreparable harm? Could other types of regulation address any relevant market flaws? If unlicensed practitioners are allowed to exist, subject to different liability rules, how will this affect the CA market? 4. Should legislation endorse public key cryptography, or be "technology neutral"? Most of the digital signature legislation to date has focused specifically on digital signatures created using public key cryptography. Some legislation has also addressed the issue of "electronic signatures" -- other, non-public key methods of authenticating digital transmissions. Proponents of biometric authentication methods argue that it is foolish to legislatively enshrine public key cryptography as the only technology capable of authenticating an electronic document. They argue that biometric methods can currently accomplish many of the same goals as digital signatures; they further argue that by precluding other technologies future innovations will be discouraged. They also note that public key cryptography can only be implemented using patents owned by a limited number of commercial entities, and question whether it is wise public policy to legislatively tie electronic commerce so closely to the interests of a few private sector actors. 5. Should legislation endorse the X.509 paradigm? When the Utah Act was enacted, it explicitly endorsed the X.509 infrastructure model. Subsequent laws have dropped the explicit endorsement of X.509, but nonetheless remain true to the X.509 paradigm. Under most digital signature legislation, certificates serve to bind an individual's *identity* to a particular public key. This binding is accomplished in the context of a rigid, hierarchical CA infrastructure. This model has been criticized for two main reasons: global CA hierarchies are almost certainly unworkable, and identity certificates often provide too much information -- frequently an "attribute" or "authority" certificate will do. Alternative certificate formats, such as SDSI and SPKI, have emerged in response to these and other perceived flaws with the X.509 model. However, it is not clear that these alternative certificate formats can be accommodated under current digital signature legislation. 6. How should liability and risk be allocated in a PKI? Liability allocation promises to be a vexing problem in a PKI. The liability issue is most dramatic in the context of fraud. An impostor can obtain the private encryption key associated with a particular party and create electronic documents purporting to be from that party. A second party may enter into an electronic contract relying on these ostensibly valid documents, and a loss may occur. Who should bear this loss? In the paper world, generally one cannot be bound by a fraudulent signature. This principle may not be entirely appropriate in an electronic context, however. In a PKI, the integrity of the infrastructure depends upon the security of private encryption keys. If a key holder bears no liability for fraudulent use of that private key, perhaps he or she may not have adequate incentive to keep the private key secure. How much liability should the private key holder bear? Under the Utah Act and its progeny, an individual who negligently loses control of their private key will bear unlimited liability. This risk allocation scheme raises the specter of consumers facing immense losses -- as one commentator puts it: "Grandma chooses a poor password and loses her house." In contrast, consumer liability for negligent disclosure of a credit card number is generally limited to $50. If consumer liability were similarly limited in a PKI, where would the risk of loss fall? If CAs had to act as an insurer in all transactions, the price of certificates would likely be extraordinarily high. If relying third parties faced the risk that ostensibly valid documents may in fact be forgeries and bear any resulting loss, then some benefits of a PKI are lost. 7. What mechanisms should be used to allocate risk? Currently at least one commercial certification authority, VeriSign, is attempting to allocate risk to both certificate subjects and relying third parties by contract. VeriSign includes significant warranty disclaimers, liability limitations, and indemnification provisions in its Certification Practices Statement (CPS). Certificate applicants agree to be bound by the CPS when obtaining a certificate. VeriSign's web page informs relying third parties that the act of verifying a certificate or checking a certificate revocation list indicates agreement to the terms of the CPS. However, it is not clear that a binding contract can be formed with relying third parties in this fashion. Thus the relationship between VeriSign and relying parties may not be governed by the CPS at all, but instead be subject to default contract and tort rules (which would be less favorable to VeriSign). As a policy matter, should CAs be able to form contracts with relying third parties, despite their rather attenuated connection? If relying parties will be bound by unilateral contracts imposed by CAs, they face significant transaction costs involved with determining the contract terms offered by potentially numerous CAs. If CAs cannot scale their potential liability exposure to third parties by contract, however, it may be impossible for CAs to compete on warranty terms -- and presumably such terms would otherwise be the subject of significant competition. 8. Should digitally-signed documents be considered "writings" for all legal purposes? The Utah Act and most other digital signature laws provide that digitally signed documents have the same legal effect as writings. Critics have noted that while most of the functions or goals of writing requirements may be served by electronic documents, this may not be true in all instances. For example, the law often requires a written instrument to effect notice -- i.e., to alert an individual that a lien has been filed on their property. It is not clear that a digitally signed electronic message would achieve the same effect. Additionally, there are other contexts -- such as wills or adoption papers -- where paper documents may prove more effective than electronic documents. Moreover some paper documents (such as bank drafts or warehouse receipts) are negotiable instruments, and this negotiable character depends upon the existence of a single, irreproducible copy of the document. Thus, critics say, digital signature legislation should not override all writing requirements without separately considering the extent to which sound policy might require retention in specific circumstances. 9. How much evidentiary weight should a digitally-signed document carry? Evidentiary issues, though seemingly arcane and procedural, can raise important public policy concerns. For example, the Utah Act creates a presumption that the person who owns a particular key pair used to sign a document in fact did sign the document. Holding an individual presumptively bound by obligations entered into under their digital signature could be inequitable if the individual is the victim of the fraudulent use of such a signature. This potential problem can be compounded by the evidentiary weight assigned to digitally-signed documents. Under the Utah Act digitally-signed documents are accorded the same evidentiary weight as notarized documents, and someone challenging the authenticity of such a document can overcome the presumption of authenticity only with "clear and convincing evidence" (in contrast, one can overcome the presumption of validity of a paper signature simply by denying that it is one's signature). Critics of the Utah Act's approach argue that providing digitally-signed documents with this status creates unreasonable evidentiary burdens for victims of fraud challenging the validity of electronic documents signed with the victim's private key. 10. Should governments act as CAs? Much of the currently enacted digital signature legislation envisions state government agencies acting as "top level" certification authorities who in turn certify a second tier of private sector CAs. At the federal level, the U.S. Postal Service has declared its intention to act as a CA on a nationwide basis. Should governments be acting in this sort of role? Critics say no, arguing that government involvement will skew an emerging private sector CA marketplace. Government actors may face very different liability rules than private sector market participants -- governments can choose to scale their potential liability exposure through the doctrine of sovereign immunity. Thus, critics argue, government CAs may "win" in the marketplace not because they are more efficient or provide better service, but rather because they can stack the rules in their favor. Proponents of government involvement argue that governments can play an important role precisely because they can create sensible ground rules for all PKI participants. Additionally, they note that governments have existing relationships with all of their citizens, making the process of identification and public key binding that much easier. ---------------------------------------------------------------------------- -------------- * Brad Biddle is the author of "Misplaced Priorities: The Utah Digital Signature Act and Liability Allocation in a Public Key Infrastructure," which appears in Volume 33 of the San Diego Law Review, and serves as Vice Chair of the Electronic Commerce Subcommittee of the American Bar Association's Committee on the Law of Commerce in Cyberspace. He is a third-year law student at the University of San Diego and is a law clerk in Cooley Godward LLP's San Diego office, where he served on the legal team advising the Internet Law and Policy Forum's Working Group on Certification Authority Practices. He can be contacted by phone at (619) 550-6301 or by e-mail at biddlecb(a)cooley.com. _________________________________________________ _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ Most obscure warning: If you fork() without ever waiting on your children, you will accumulate zombies. -PERLFUNC man page

1 0

Re: Cypherpunks FOIA request
by Lucky Green 17 Dec '03

17 Dec '03

At 12:40 AM 2/5/97 -0800, Greg Broiles wrote: >I'm not sure what I think about the response from the SF FBI branch - it >seems unlikely that they'd never have paid any attention to the list, given >the media coverage in Wired and other places. My attorney used to fly planes with nuclear cargo. Another friend of mine has been visited several times by the FBI. In either case, the FBI claimed upon receiving an FOIA request that they have no record on either person. Does anybody here believe that the USAF would let pilots take off with nukes on board without ever conducting a background investigation (which are handled by the FBI)? I didn't think so. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

2 1

mail list / sequence number & signature
by Corey Minter 17 Dec '03

17 Dec '03

Have the list maintainers ever considered either or both of the following... (Sorry in advance if this has been brought up sometime in the past.) o adding a digital signature from "owner-cypherpunks(a)toad.com", so someone can't mass mail the mailing list and make it appear that the message came from toad.com. I just tried to figure out if the id in the header is in any order but I couldn't tell. I have already deleted many messages so some numbers are missing anyway. o adding a sequence number to every message which comes through toad.com, so recipients can easily notice if mail is be accidentially or intentionally filtered by their service provider or any other forces. At the same time, you could add the current numbers for flame vs. non-flame. This would help end all the bandwidth wasted on people speculating about the numbers. say there are X total messages, Y non-flames, and Z flames then the appearance to subscriber (either in the subject or some header field) could be... list type | all non-flame flame ---- | --- --------- ----- non-flame | X (non-flame Y) Y (all X) flame | X (flame Z) Z (all X) -- Of course... these are my opinions, not my employer's. ______________________________________________________________________ Corey Minter | cminter(a)mipos2.intel.com | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0