December 2003 - cypherpunks-legacy

One-time pads
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

`A pen is mightier than a sword', not to mention Tim Maya's pea-sized penis. He would be better served by a safety razor, possibly applied in a bathtub filled with warm water (something he has surely never been into). /''' c-OO Tim Maya \ -

1 0

Re: DES Key recovery project, Progress Report #7
by Bubba Rom Dos 17 Dec '03

17 Dec '03

WeakHold wrote: > > sameer wrote: > > I think Europeans are just not materialistic money grubbers like those of us at C2Net. > > When does the "StrongHold BackDoor Challenge" start? It started when Sandy first bent over for Sameer. > -- > Sameer Parekh Voice: 510-986-8770 > President FAX: 510-986-8777 > C2Net > http://www.c2.net/ sameer(a)c2.net

1 0

Global Encryption Policy
by John Young 17 Dec '03

17 Dec '03

Mike Cobb's and Peter Gutmann's tales of mixed signals from UK and NZ security agencies on exporting crypto demonstrate the same conflicting policies of their nations' governments as do the travails of Zimmermann, Bernstein, Karn and Junger with the USG -- lacking clear regulations, the agencies try bluff and obfuscation. The US move to clarify and tighten regulations in recent ITAR and EAR amendments surely will be emulated by other nations, as promised by The Wassenaar Arrangement. It is part of the major shift of responsibility for dual-use items from national security agencies to those handling economic security, and the guidelines are not as black and white for commerce as they are for state -- or at least not as yet strictly codified, regulated and enforced. However, what is happening with crypto is happening with a wide range of dual-use items, as the half-century old national security policy undergoes a transformation into economic security policy, with the pervasive impact on subsidiary procedures and regulations in security, armaments, intelligence, research, invention, manufacturing, law, finance, politics, education and so on. Note that the World Trade Organization is supplanting the United Nations as a forum for dispute resolution (NY Times, 18 February 1997). For more on these State-into-Commerce policy deliberations see: The GAO/NSIAD report "Exporting Dual-Use Items," 14 January 1997: http://jya.com/9724.htm Export Administration Regulations, with related presidential orders and agency rules and regulations: http://jya.com/eartoc.htm Bert-Jaap's site and a 1996 State Department address on The Wassenaar Arrangement: http://jya.com/dos012396.txt The Defense Trade News from January 1993 to October 1995 on the shift of encryption items from the USML to the CCL: http://jya.com/dtn0193 (+ four) "Redefining Security," The Joint Security Commission's February 1994 report to DefSEc and DCI: http://jya.com/jcs.htm

1 0

Re: Any more like www.anonymizer.com ??
by Michael G. Reed 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Robert Hettinga <rah(a)shipwright.com> wrote: >+At 8:29 pm -0500 on 2/18/97, ! Drive wrote: >+>A proposal and prototype of a different anonymity mechanism can be found at: >+> http://www.itd.nrl.navy.mil/ITD/5540/projects/onion-routing/overview.html >+ >+And, of course, you can hear about the next generation from the same >+bunch, on Monday morning at FC97: >+ >+ Unlinkable Serial Transactions >+ Paul F. Syverson (Naval Research Laboratory, Washington, DC, USA), >+ Stuart G. Stubblebine (AT&T Labs--Research, Murray Hill, NJ, USA), >+ David M. Goldschlag (Naval Research Laboratory, Washington, DC, USA) Hey! I always love it when someone references *MY* work :-) Just for the record: Paul, David, and I did (and continue to do) the Onion Routing work...Stuart, Paul, and David are working on other areas together (granted, those areas may use a system like Onion Routing to accomplish some of the anonymity necessary, but it is different work). If anyone wants more info than the URL above gives, drop me a line... - -Michael Computer Engineer / Research Scientist Computer Security Section (code 5542) Center for High Assurance Computer Systems Naval Research Laboratories -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMw2orE8Qx019l0ClAQF+wAQAk9m/0OGZRBM4IBrZx1/qEvUfK7xS6lcv O2f1q1zKHzn47RosR8+MnmN0krGInMle2uw6zsbq3w/hJmQVza+ju4DM43VYroSm bEAw262NIZA183xkG9Ufaklgq0PI6x6rNC6KBhhYJqsy7Hb+2R5Wu8nsU31E+qul /xF9xxabS20= =EpIB -----END PGP SIGNATURE-----

1 0

Re: DES search publicity (was Re: Cryptanalysis)
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Thu, 20 Feb 1997 19:07:18 -0500 (EST) > From: "Mark M." <markm(a)voicenet.com> > > On Wed, 19 Feb 1997, Adam Back wrote: > > > Have there been any sightings of your code outside the US? > > > > Rumor has it that ftp://ftp.******.com/pub/incoming is a place where > > things often turn up, but I haven't seen it yet. > > Last time I checked, deskr06i.zip, which I believe is the correct filename, > was in /pub/incoming. > > > Mark I have not checked this file to see if it is correct. For the record (which is why I've added coderpunks and cryptography), I have never exported cryptographic software without permission. Everyone to whom I have sent DESKR to has positively affirmed that they are US/Canadian citizens (or US Green Card holders), in the US/Canada, and were aware of, and would abide by the ITAR/EAR restrictions. The source code and executable are draped in warnings of it's non-exportability. I have bent over backwards to do due diligence on this, and am still trying to track down a restricted ftp server which, in my (possibly extreme) opinion, meets my requirements. I have no intention or desire to be the next poster child for crypto export. In other words: I disclaim any responsibility for someone else's exporting DESKR, if that is what this file contains. Someone else may have knowingly broken the export regs, but it wasn't me, nor was it done at my request, or with my approval. Peter Trei trei(a)process.com ptrei(a)acm.org

1 0

Prizes, and coordinated vs uncoordinated search, redux.
by Peter Trei 17 Dec '03

17 Dec '03

[Sorry about the long list of lists, but this issue is being discussed in all of them.] 1. Different set of people seem to be working towards different sets of goals, and this seems to be the source of a lot of contention. My personal goal is to promote the easing of US export restrictions on cryptographic software. I regard these restrictions as promoting crime and espionage. They are also driving US jobs overseas, and crippling the US software industry's ability to compete in the world marketplace (yes, I'm an American, and have every intention of promoting my countries best interests). Recently, the US government tightened the rules on cryptographic software export, but left one tiny Devil's bargain of a loophole: if firms would agree in future to compromise the integrity of their products by adding back doors for 'key recovery', then they could export single DES sofware without 'key recovery' until the end of 1998. Clearly, the government's intent is to bribe software developers into 'voluntarily' adopting GAK (Government Access to Keys), when they would never do so without incentive. The rules also require that if either end of a transmission uses a GAK'd product, then both sides of the transmission must be tappable. This makes it difficult for GAK'd and non-GAK'd products to interoperate, and is a wedge to force GAK'd products into even purely domestic communications. I think that this is a horrible idea. One way to fight it is to discredit DES, by showing that any one with sufficient computing resources (or a modest amount of cash) can get single-DES keys broken. If I destroy the market for new DES products, developers will have less incentive to go along with the government's Faustian scheme. The model I am trying to emulate is that of a criminal or spy agency which wishes to decrypt a captured transmission. It's not unusual for such a capture to have a partially known plaintext. In some cases, they may be able to use special hardware to search the keyspace quickly, but if they don't, they could simply put out a message on the sci.crypt: "Tell me what DES key decrypts 0f 1e 2d 3c 4b 5a 69 78 to 'HTTP/1.0' and I'll send you $10,000." This level of attack is available to almost anyone, and I intend to show that it is effective. ------------------ As for the prize money, if the person winning it wants to send it to a non-profit organization, or is contractually bound to dispose of it in some particular way, that's their business. Myself, I'd probably buy a couple really top-of-the-line PCs (for me and my wife), and throw a big party. Thomas S. writes: > 2. What about the developers? They invest an awful lot of time and > effort into this project because they believe in a future of the > internet. The majority would be very unhappy if the money would > be used for personal profit. Speaking as a developer: I've been working on this project in my spare time for about 5 months now. When I talked to RSA about how to best set up the challenge, I *wanted* the money to go to the person finding the key, and I am pleased that that is what they have done. Which particular developers do you claim to speak for, anyway? Can't they speak for themselves? ------------------------- If the coordinated groups don't want to share their keyspace maps with others, that's their business. Effectively, they become just another uncoordinated searcher (though a very fast one). If a coordinated searcher does publish it's map, then people who trust it can use the data to avoid going over old ground. This would speed the search as we near the end, but has very little effect at the beginning. --------------------------- The coordinated groups are still trying to get their infrastructure in place. In the meantime, at my small employer, we are already searching about 10 million keys/sec, with probably twice that being searched by people with my software on the outsde. And I have still to do a general call for participation... Peter Trei trei(a)process.com ptrei(a)acm.org Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Timmy C[reep] May's obsessive masturbation has lead to advanced degree of blindness and hairy palms. __\/__ . / ^ _ \ . |\| (o)(o) |/| -.OOOo----oo----oOOO.- Timmy C[reep] May

1 0

DCSB: Online Government & Electronic Commerce - Legislation and Public Sector Initiatives
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston Presents Daniel Greenwood, Esq. Deputy General Counsel Information Technology Division Commonwealth of Massachusetts "Online Government & Electronic Commerce - Legislation and Public Sector Initiatives" Tuesday, March 4, 1997 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Dan will give us an update on recent information age legislative and operational developments in the public sector. Special attention will be paid to: Electronic Signature and Record Legislation; Joint Government/Private Sector Attempts to Set Certification Authority Standards; Cutting Edge Public Sector PKI Projects; Recent Coordinated State-Federal-Foreign Electronic Commerce Policy Initiatives; and much, much more . . . Speaker: Daniel Greenwood, Esq. Information Technology Division, Deputy General Counsel Commonwealth of Massachusetts Office: http://www.state.ma.us/itd/legal home: http://www.tiac.net/biz/danielg Mr. Greenwood practices information technology law for the Commonwealth of Massachusetts. Recent relevant activities include: * Co-Author of the Draft 1997 Mass. Electronic Records and Signature Act * Chairman of the Commonwealth of Mass. PKI Task Force * Chairman of the ABA Info. Security Comm., Legislative Sub-Committee * Co-Chair of the ABA Cyberspace Law Comm., Legislative Work Group * Contributing Author: ABA Digital Signature Guidelines * Negotiator of Contracts for Internet Security and Payment Systems * Board Member of SigNet.Org and Chair of Legal Special Interest Group * Director of the Virtual State House Project (MIT/Stanford Law School) * Faculty Member: MCLE Health Care & Info. Technology Program * Guest Lecturer for Suffolk Law School High Tech. Symposium * Selection Board Chairman for First Commonwealth of Mass. C/A Business This meeting of the Digital Commerce Society of Boston will be held on Tuesday, March 4, 1997 from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, One Federal Street. The price for lunch is $27.50. This price includes lunch, room rental, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men, and "appropriate business attire" for women. We will attempt to record this meeting and put it on the web in RealAudio format at some future date We need to receive a company check, or money order, (or, if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, March 1, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston". If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Planned speakers for DCSB are: March Daniel Greenwood The Role of State Government in Digital Commerce April Stewart Baker Encryption Policy and Digital Commerce We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, <mailto: rah(a)shipwright.com> . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to <mailto: majordomo(a)ai.mit.edu> . Looking forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMwB+VvgyLN8bw6ZVAQEsRAQAiInZXDXlzdMn0B+b9A6zgWHH5POJku5v k9HIZK286Paw1KWKYsw8VyYjUoG4vq/LAh1CagWkwL4EN9Ysg7kbU+LP0W4u04vb /QoKk5rWpmXuplXx1Fp9IhIe2O6oV0vTInJqPV3zkXk4qGzYUrQ0bqLbQn769iMO 7pwwVbkioSc= =m5Pz -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

MULTI-JURISDICTIONAL TAXATION OF ELECTRONIC COMMERCE
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Authentication-Warning: arraydev.com: majordom set sender to owner-ibc-forum using -f X-Sender: tom(a)arraydev.com Date: Fri, 21 Feb 1997 13:31:31 -0500 To: ibc-forum(a)ARRAYdev.com From: Tom McKegney <Tom.McKegney(a)arraydev.com> Subject: MULTI-JURISDICTIONAL TAXATION OF ELECTRONIC COMMERCE Mime-Version: 1.0 Sender: owner-ibc-forum(a)arraydev.com Precedence: bulk Reply-To: ibc-forum(a)arraydev.com I pass on the following which was received Thu, 20 Feb 1997 16:58:48 -0500 From: Lara Becker <lbecker(a)law.harvard.edu> The International Tax Program Harvard University International Tax Program and the Tax Law Society 1997 Spring Symposium on MULTI-JURISDICTIONAL TAXATION OF ELECTRONIC COMMERCE Saturday, April 5, Cambridge, Massachusetts,U.S.A. The Symposium: Billions of dollars of valuable goods and services are sold, exchanged or transmitted electronically. The amount of such commercial activity is expected to grow exponentially in the future. The appropriate taxation of this sector is one of the most significant new tax issues of our day. The International Tax Program and the Society for Law and Tax Policy of Harvard Law School are sponsoring a symposium that will bring together the leading policy makers, academics and practitioners in this field in an effort to help derive uniform tax rules in this challenging dimension of domestic and international taxation. This symposium will consider a wide range of issues, including: **Differences in determining the electronic commerce income tax base. Should source or residence rules be used, or should some form of formulary apportionment be applied? **Problems in imposing retail sales taxes on electronic sales. Should traditional nexus rules apply? **Problems in determining the value added by electronic commercial inputs. Should a tax be determined based on the 'bits' of information? If so, should each 'bit' be valued the same? **Problems involving the harmonization of tax rules. International and sub-national aspects of this problem will be considered. OECD efforts in this area will be contrasted with proposed uniform state legislation in the US. **Throughout the symposium the impact that these tax decisions will have on cross-border investment decisions will be a primary concern. The Goals of the ITP: The International Tax Program continues to sponsor symposiums on topics of critical concern to government and private sector tax practitioners at Harvard University. It is the belief of the Program that such discussions will lead to advances in tax policy, administration and compliance on a global basis. THE MULTI-JURISDICTIONAL TAXATION OF ELECTRONIC COMMERCE presents such a challenge. Basic Income tax objectives such as efficiency and equality of treatment are made more difficult to achieve if the rules of the game are left to develop on an ad hoc basis. Through this forum the International Tax Program hopes to facilitate a meaningful interaction among policy makers around the core issues of taxation and the internet. ========= Schedule: Saturday, April 5, 1997 7:30 - 8:30: Coffee and Registration 8:30 - 9:00: Keynote Speaker, Mr. Jeffrey Owens, Chief, Fiscal Affairs Division: OECD (Paris) 9:00 - 11:30:INTERNATIONAL PANEL: Moderator: Professor Diane Ring, Harvard Law School Speakers: Mr. Bruce Cohen, Attorney-Advisor, Office of International Tax Counsel, U.S. Treasury Mr. Alan S. S. Ow, Senior Deputy Commissioner, Inland Revenue Authority, Singapore Mr. Nicasio del Castillo, Partner, Coopers & Lybrand Professor Luc Soete, Maastricht Economic Research Institute on Innovation and Technology, University of Maastricht, the Netherlands Mr. Arthur Cordell, Industry Canada, Special Advisor for Long Range Planning and Analysis 11:30 - 12:30: Catered Lunch 12:30 - 3:00: STATE PANEL Moderator: Professor Reuven Avi-Yonah, Harvard Law School Speakers: Ms. Deborah Bierbaum, Deputy Commissioner, Office of Tax Policy, Department of Taxation, New York Ms. Linda Lettera, General Counsel, Department of Revenue, Florida Mr. Wade Anderson, Director of Tax Policy, Comptroller of Public Accounts, Texas Mr. Dean F. Andal, Member, State Board of Equalization, Second District, California Mr. Walter Hellerstein, Attorney, Southerland, Asbill & Brennan 3:00 - 3:30: Coffee 3:30 - 6:00: INDUSTRY PANEL Moderator: Professor Richard Pomp, University of Connecticut Law School Speakers: Ms. Jeanne Goulet, Director of Tax, IBM Credit, IBM Ms. Allyn Yamanouchi, Vice President and Global Technology Tax Counsel, CITIBANK Mr. James Eads, Jr., and Mr. Paul Nolan, Legal Division, AT&T Mr. Bruce Reid, Director of State and Local Tax, MICROSOFT Ms. Ellen Fishbein, Assistant General Counsel, AMERICA ONLINE =============== Registration and Fees: The fee for this program is $500.00. An academic or government employee discount is available. That fee is $200.00. To register for the symposium please fill out and return the form below, with a check or money order made payable to Harvard University, to: Multi-Jurisdictional Taxation of Electronic Commerce Symposium Attn: Lara Becker 1563 Massachusetts Avenue Pound Hall, Room 400 Cambridge, MA 02138 Lbecker(a)law.harvard.edu Fax: 617-495-0423 Tel: 617-495-4406 ............................................................... Registration Form: 1997 Spring Symposium on Multi-Jurisdictional Taxation of Electronic Commerce, Saturday, April 5, 1997. Mr./Ms. Name (First or Given Name) (Surname or Family Name) Email Address: Title: Organization: Home Address/Work Address: Telephone Number: Fax Number: I am Paying by: Check: Money Order: --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

IDEA/Strength?
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Is the strength, or lack thereof, of conventional PGP encryption proportional to the length of the conventional password? For example, when I encrypt conventionally, does it make any difference internally (disregarding the ability to guess the password) if I choose to use the pass phrase heyyou, or [Harris$Pizza*Axis/LilburnKfreakmaisUoui@(. Not so much the randomness of my password as the length? Do more characters give the encryption process more to work with? Thanks. Alec -----BEGIN PGP SIGNATURE----- Version: 4.5 Comment: Public key available on request or from keyservers. iQCVAgUBMw4RtCKJGkNBIH7lAQEDmwP/WANzYA3KVyL5yNyE02hYotMgR6EKPxIm Q4hP5TiZzAve29CMc972Udeb1BJU9Ow6slHbpoLREH1qlWWqNpzO3YS6X5nYrXDM NeEf4sCTxkZ/33u48rv4T0ZD69/JGQV11/GMbsI3wJjCKW57Fb8cE8ANj4dDWblm 6spqX6YDecQ= =/AVU -----END PGP SIGNATURE-----

2 1