December 2003 - cypherpunks-legacy

BXA on Crypto Plans
by John Young 17 Dec '03

17 Dec '03

Excerpt of BXA head William Reinsch statement on Goodlatte's SAFEncryption Bill HR 695 on March 20, 1997: The Administration has stated on numerous occasions that we do not support mandatory key escrow and key recovery. Our objective is to enable the development and establishment of a voluntary key management system for public-key based encryption. We believe the Administration's policy is succeeding in bringing key recovery products to the marketplace. Our attention is now turning toward how we can best facilitate the development of the key management infrastructure that will support those products. To that end, we will shortly submit legislation intended to do the following: Expressly confirm the freedom of domestic users to choose any type or strength of encryption. Explicitly state that participation in the key management infrastructure is voluntary. Set forth legal conditions for the release of recovery information to law enforcement officials pursuant to lawful authority and provides liability protection for key recovery agents who have properly released such information. Criminalizes the misuse of keys and the use of encryption to further a crime. Offers, on a voluntary basis, firms that are in the business of providing public cryptography keys the opportunity to obtain government recognition, allowing them to market the trustworthiness implied by government approval. ---------- Full statement: http://jya.com/bxahr695.htm

1 0

[alt.best.of.cypherpunks]
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Thanks for the laugh. - ------- Forwarded Message From: snow <snow(a)smoke.suba.com> Subject: Re: PGP on AOL To: harka(a)nycmetro.com Date: Fri, 21 Mar 1997 07:46:08 -0600 (CST) Cc: cypherpunks(a)toad.com > Hi there, > I want to help a friend of mine to set up PGP. She's using Win 95 and > is on AOL. Can anybody recommend some good shells, that would make > make it easier for her? Remington .20 Gauge. Use the finest shot you can find, it tends to penetrate walls less. Good luck. - ------- End of Forwarded Message Zooko PGP sig follows -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMzKSYUjbHy8sKZitAQHrUgL/TC6JSEVU8QZq00WGt0Yp76AT9pPdgog0 3IUpFE17b+QPz9Lwn1FprL6oaSnAZgz7qnuGj+nel3VNd1R/Tjfa/5qnFiDj++q7 a1+ScrPkfZKQy9DaL9VCavqvTZNoyur0 =7yuN -----END PGP SIGNATURE-----

1 0

Re: FINALLY, "SOME" TRUTH Re: Anonymous Nymserver: anon.nymserver.com
by Kent Crispin 17 Dec '03

17 Dec '03

On Fri, Mar 21, 1997 at 03:06:41AM -0600, Toto wrote: > Attila T. Hun wrote, in blood: [...] > > > > you got that one right! > > just the ability to _backtrack_ into the algorithms is a start. > > One piece of clear text and you're toast. > > You can't tell me the guy who designed the Rubik cube didn't know > how to 'beat' it when he was done. With all due respect, Toto, this is not a valid point. It is easy for someone to design and implement something they can't beat. Whether PKZ designed in, or was coerced into installing, a backdoor into PGP is an interesting speculation, but immaterial. The only real data you have is the code itself. -- Kent Crispin "No reason to get excited", kent@songbird.com,kc@llnl.gov the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html

1 0

UK TTP Paper
by John Young 17 Dec '03

17 Dec '03

Forward from Cyberia-L: Making absolutely no comment on the subject of licensing of certification authorities, you may be interested in a UK paper entitled LICENSING OF TRUSTED THIRD PARTIES FOR THE PROVISION OF ENCRYPTION SERVICES - Public Consultation Paper on Detailed Proposals for Legislation, March 1997. You can obtain a full document at http://www.dti.gov.uk/pubs. E. Michael Power Coordonnateur Secrétariat au commerce électronique Ministère de la Justice Canada ---------- This paper links to David Herson, the reputed GCHQ spy who admitted the EU/FBI wiretap pact: Information on any of the current TTP projects can be obtained from David Herson (DG XIII/7) at the European Commission (e-mail david.herson(a)bxl.dg13.cec.be) or from the Commission Web site at www.cordis.lu/infosec/

2 1

Re: FINALLY, "SOME" TRUTH Re: Anonymous Nymserver: anon.nymserver.com
by Toto 17 Dec '03

17 Dec '03

Kent Crispin wrote: > > On Fri, Mar 21, 1997 at 03:06:41AM -0600, Toto wrote: > > Attila T. Hun wrote, in blood: > [...] > > > > > > you got that one right! > > > just the ability to _backtrack_ into the algorithms is a art. > > > One piece of clear text and you're toast. > > You can't tell me the guy who designed the Rubik cube didn't know > > how to 'beat' it when he was done. > With all due respect, Toto, this is not a valid point. It is easy > for someone to design and implement something they can't beat. > Whether PKZ designed in, or was coerced into installing, a backdoor > into PGP is an interesting speculation, but immaterial. The only > real data you have is the code itself. I wasn't referring to either PKZ or PGP, but to 'systems', in general. In designing systems of any type, one can often have elements of design which aren't in the blueprint. An example would be an architect who designs a room to echo (or not echo) sound in a certain way, for use as a concert hall or music studio. No amount of analysis of the blueprints will show this 'hidden' design unless the person looking is thinking in the same terms as the designer. Certainly, if the blueprints described the room as a 'sound room', then this might give some a clue as to the hidden elements, but still would not inherently reveal every aspect of what was involved in the design. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

WebWorld 9
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

Re: encrypt_1.html
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> | The fact that they are pushing key escrow must indicate that > |someone has developed a program that they can't crack and don't > |have a back-door to. > | I wonder which one it is? This ignores the basic law of conpiracy theorism: Suspect everyone and everything. I believe the current push to establish key escrow systems, which will inevitably lead to enforced domestic GAK in a number of countries is possibly a double cross. If mandatory GAK is introduced who will be the most likely to ignore the legislation and continue using non-GAK crypto? - The anarchists and other "terrorist" groups of course. This would seem to suggest the govt. is trying to lull these groups into a false sense of security believing their non-GAK crypto to be strong. This would in turn seem to suggest that the NSA, GCCS etc. have broken a number of currently used algorithms that are believed strong by the civilian research community. At the end of the day though this is pure speculation and the spectre of GAK still looms over us and must be defeated, however, as conspiracy theories go I happen to think it is one of my more believable delusions.... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Explosion...
by Progress＠utkform.com 17 Dec '03

17 Dec '03

ANNOUNCING: World Class MLM LAUNCHES even as we speak. Just gone public with top positions now being filled with major leaders from across the industry. Your eyes have seen it first! Act NOW! * World Class Executive Leadership/Financial Backing/Over 150 Years Comb. MLM Experience! * Diverse Product Lines Being Developed - Health, Beauty, Nutrition, Telecommunication, and more! * Fast Paying NEW Compensations Plan (from the Creator of the Unilevel/Binary). * International Expansion. * No Product Purchase Required. * Expert Internet Support. * Television Infomercial's. * Certified Training Courses. * Residual Income/No Brainer Qualification. * Forced Spillover/New Two Wide System. * Company LEAD Sharing Program! (FREE) Looking for Leaders to handle the massive downlines now forming! I am working with the frontline of the company. Contact me NOW if you think you qualify. Send an Email to: explosion1(a)juno.com with 'explosion' in the subject line. I will contact you personally as soon as possible. Thank you. --------------------------------------------------------------------------------------------------------- || Do Not Hit Reply. If you want more info, send an email || to: explosion1(a)juno.com with 'explosion' in the subject. || This is a one time email. ---------------------------------------------------------------------------------------------------------

1 0

NYU's PGP Key-Signing Seminar - a critique
by Sergey Goldgaber 17 Dec '03

17 Dec '03

I am writing regarding the PGP Seminar to be held on the 27th of March. Your informative session is laudible. And, I would like to take full advantage of the key-signing session to follow. However, there is a certain concern which it would be prudent to address first. http://www.nyu.edu/pages/advocacy/awareness/pgp.html provides instructions for the session, which state: "8. At the seminar Tim and Ilya will confirm the identity of all participants and the participants will identify their own keys. 9. After the seminar Ilya will e-mail all the participants the keyring with all the keys, along with the instructions on how to sign them." This conflicts with the guidelines for hosting pgp key signing sessions as presented in the alt.security.pgp FAQ (a relevant excerpt is attached to this message). The FAQ states: "6. Each person securely obtains their own fingerprint, and after being vouched for, they then read out their fingerprint out loud so everyone can verify it on the printout they have." ~~~~~~~~ The concern I have is that this discrepancy undermines the web of trust model for PGP. The participants of the NYU session will not have the opportunity for verifying the identity of the owners of the keys that they are signing. They must rely on a central authority ("Tim and Ilya"). I realize that this may be a simpler, and perhaps a more convenient method of conducting a key-signing session, perhaps ideally suited to a session aimed at novices. However, I feel that the security provided by PGP is thereby undermined. We must not forget that security is the whole reason that even the novices at your session are using PGP for in the first place. I hope this issue can be addressed before the session begins. ............................................................................ . Sergey Goldgaber <sergey(a)el.net> System Administrator el Net . ............................................................................ . To him who does not know the world is on fire, I have nothing to say . . - Bertholt Brecht . ............................................................................ 6.8. How do I organize a key signing party? Though the idea is simple, actually doing it is a bit complex, because you don't want to compromise other people's private keys or spread viruses (which is a risk whenever floppies are swapped willy-nilly). Usually, these parties involve meeting everyone at the party, verifying their identity and getting key fingerprints from them, and signing their key at home. Derek Atkins <warlord(a)mit.edu> has recommended this method: _________________________________________________________________ There are many ways to hold a key-signing session. Many viable suggestions have been given. And, just to add more signal to this newsgroup, I will suggest another one which seems to work very well and also solves the N-squared problem of distributing and signing keys. Here is the process: 1. You announce the keysinging session, and ask everyone who plans to come to send you (or some single person who *will* be there) their public key. The RSVP also allows for a count of the number of people for step 3. 2. You compile the public keys into a single keyring, run "pgp -kvc" on that keyring, and save the output to a file. 3. Print out N copies of the "pgp -kvc" file onto hardcopy, and bring this and the keyring on media to the meeting. 4. At the meeting, distribute the printouts, and provide a site to retreive the keyring (an ftp site works, or you can make floppy copies, or whatever -- it doesn't matter). 5. When you are all in the room, each person stands up, and people vouch for this person (e.g., "Yes, this really is Derek Atkins -- I went to school with him for 6 years, and lived with him for 2"). 6. Each person securely obtains their own fingerprint, and after being vouched for, they then read out their fingerprint out loud so everyone can verify it on the printout they have. 7. After everyone finishes this protocol, they can go home, obtain the keyring, run "pgp -kvc" on it themselves, and re-verify the bits, and sign the keys at their own leisure. 8. To save load on the keyservers, you can optionally send all signatures to the original person, who can coalate them again into a single keyring and propagate that single keyring to the keyservers and to each individual. This seems to work well -- it worked well at the IETF meeting last month in Toronto, and I plan to try it at future dates. http://www.nyu.edu/pages/advocacy/awareness/pgp.html Awareness Week 1997 Pretty Good Privacy Seminar Thursday, March 27 at 12:00 pm Warren Weaver Hall, Room 313 [INLINE] This is a Blue-Ribbon event, CANYU will distribute Blue Ribbons to participants This seminar sponsored by the Computer Advocacy @ NYU and the Academic Computing Facility. The seminar will explore the need for use of cryptography for communications in every day life, and demonstrate how PGP (Pretty Good Privacy) can be used at NYU. This workshop is a part was preceded by another seminar titled "Encryption: Padlocks for the digital age". Speakers: * Tim O'Connor * Ilya Slavin A key signing session will follow the seminar. The instructions follow: 1. If you have already created your key, skip to the following step. + You can create your new key on one of the IS machines (and, most likely, many other computers at NYU) by following the steps outlined in the following document. 2. Once your key is generated and signed by yourself, extract your public key from the key ring by typing pgp -kxat userid keyfile.asc where keyfile.asc is a name of the file you want to copy your key to. 3. Send this file with your name and a mention of the seminar to slavin(a)acf2.nyu.edu before 7:00 PM on March 26, 1997. 4. Ilya will compile a master keyring with all the keys before the seminar starts. 5. Please write down (or print out) the output of the following command: pgp -kvc where <userid> is your name or e-mail address that appears in your key. 6. Ilya will have printouts of userids and fingerprints of all keys sent to him. 7. Bring two photo IDs (either a passport or other respectable form of ID) to the seminar so that we can verify your identity. 8. At the seminar Tim and Ilya will confirm the identity of all participants and the participants will identify their own keys. 9. After the seminar Ilya will e-mail all the participants the keyring with all the keys, along with the instructions on how to sign them. 10. Once the keys are signed, the participants will e-mail their signed keyrings to Ilya, who will add their signatures to the master keyring. 11. As soon as Ilya receives all the signed keys, he will e-mail the complete keyring to all the participants, who can add the new signatures to their own keyrings. ______________________________________________________________________ Computer Awareness Week '97 / Ilya Slavin / Last Modified: 3/6/97

2 2

Re: UK govt. to ban PGP (was Re: UK TTP Paper)
by John Young 17 Dec '03

17 Dec '03

>: In Grey's words, ``All over Europe, the lights are going out'' >: >: Ross There does appear to be a coordinated global action to issue policies on TTP, GAK and the like at this time. OECD is due to shortly release its crypto policy, as is the USG according to BXA. The FBI issued its wiretap payment plan yesterday. Herson publically admitted the EU-FBI wiretap pact. All are apparently guided by The Wassenaar Arrangement amongst two dozen or so countries to act in concert, and to go public with dual-use controls in unison. So, Clint Brooks' comment at CFP about a new policy coming out for stronger crypto is a surely a harbinger of global GAK, in the guise of TTP or Key Recovery, as was speculated here, and as Rensch's statement to the House yesterday affirms. It's a policy sure to appeal to nationalists and chauvinists: strong protection for a nation's interest and commerce with GAK; without it no protection from predatory (rogue) nations (and criminals). But, as the Crypto AG engineer asked, "Who will protect us from NSA?" And its predatory clients and contractors, the Germans and French and others are asking, now that they are suffering the unilateral spying of their highest tech "friends."

3 2