December 2003 - cypherpunks-legacy

Blessing in Disguise? (H.R. 98, the "Consumer Internet Privacy Protection Act of 1997")
by Robert Hettinga 17 Dec '03

17 Dec '03

This attempted legislation (see forward, below) is a blessing in disguise. It's just more proof that book-entry commerce isn't going to work on the net in the long run. SET looks like it's having problems with Japanese commerce rules, which is another example of this problem. Cash settlement between blinded pseudonyms fixes all of these problems. I like to joke that if digital commerce is flight, then book entry settlement is Boyle's Law, and cryptography is Bernoulli's law, viz, + Sending a credit card in the clear is jumping off a cliff. The height of the cliff you jump off is related to the number of times you send an unencrypted credit card number and the amount you charge. Credit card companies aren't going to be guaranteeing all those trades much longer if they lose too much money. + First Virtual is a tethered balloon. You're up in the air, but you don't know what for, because all the action is happening on the ground. ;-). + SET, Cybercash/coin, SSL, and other encrypted-channel book entry methods, is a derigeble. You're flying, but you're using minimally strong crypto like little aerodynamic fins to push the giant gas bag of book-entry settlement around. + Digital bearer certificate technology, like ecash, or MicroMint, or Millicent, is an airplane. It "flys" with "wings" of strong cryptography, which gives us reputation capital and enforcement, and instantly settled microintermediated transactions. Thus, like aerodynamic flight, it will be faster, cheaper, and easier to use than book-entry "derigible" transaction methods. Cheers, Bob Hettinga --- begin forwarded text Date: Thu, 6 Feb 1997 11:24:09 EST Reply-To: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> Sender: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> From: "Jonathan I. Ezor" <jezor(a)NEWMEDIALAW.COM> Subject: Congressional Bill worse for 'Net than CDA? (crosspost) Comments: To: wwwac(a)echonyc.com, noend(a)laguna.taos.com, isales(a)mmgco.com, imarcom(a)internet.com To: CYBERIA-L(a)LISTSERV.AOL.COM Sorry for the crossposting, but I felt this one might be important enough to do it. The following is a shortened version of an article I've written for my firm's client newsletter about H.R. 98, the "Consumer Internet Privacy Protection Act of 1997", introduced by Rep. Bruce Vento (D. MN) on January 7, 1997. As the article describes, if the bill were enacted as drafted, Internet commerce could conceivably be stopped dead in its tracks, along with most of the reduced-fee-for-demographics online services. Privacy is quite important, and many of us have worked and are working extremely hard to protect privacy appropriately while still providing convenient services to users, but this bill is way beyond a reasonable approach. I haven't seen much discussion about this bill, but it's now in committee, and the time to act may be upon us. Feel free to e-mail/call/fax/talk to me with any further questions. I look forward to your feedback. {Jonathan} Jonathan I. Ezor New Media Attorney, Davis & Gilbert, 1740 Broadway, New York, NY 10019 Tel: 212-468-4989 Fax: 212-468-4888 E-mail: jezor(a)newmedialaw.com -----------------------------Cut here------------------------------- Congress Tackles Internet Privacy Recently, there has been significant press coverage over real and rumored revelations of personal information such as Social Security numbers by online services, including the alleged availability (later shown to be untrue) of mothers' maiden names and Social Security numbers on LEXIS' P-Trak database, and various governmental bodies have held hearings on issues of online privacy. On January 7, 1997, Representative Bruce F. Vento (D. MN) introduced the "Consumer Internet Privacy Protection Act of 1997," (H.R. 98) This bill provides that "an interactive computer service shall not disclose to a third party any personally identifiable information provided by a subscriber to such service without the subscriber's prior informed written consent." It requires online services to provide an express opt-out for subscribers at any time, prohibits services from knowingly distributing false information about users, and also mandates giving subscribers access to the information maintained about them for review, updates and corrections, as well as the identity of the party receiving the information, at no charge. The bill authorizes the Federal Trade Commission to "to examine and investigate an interactive computer service to determine whether such service has been or is engaged in any act or practice prohibited by this Act," and to issue a cease and desist order. Notably, it also provides that an individual may sue the violator directly without having to go through the FTC. As a general matter, this bill enacts the practice of many online services and sites, and the position of most self-regulatory industry groups, by asking consent before revealing personally-identifiable information. But the bill goes well beyond the ordinary industry practice by requiring "prior informed written consent," which is defined in this bill as "a statement-- (A) in writing and freely signed by a subscriber; (B) consenting to the disclosures such service will make of the information provided; and (C) describing the rights of the subscriber under this Act." What this could conceivably mean is that services which have all of their registration online may be unable to fulfill this requirement. Additionally, the bill is unclear about which online services will be subject to its provisions. It defines "interactive computer service" as "any information service that provides computer access to multiple users via modem to the Internet." This certainly covers dedicated Internet service providers (ISP's) and combination proprietary/Internet services like America Online and MSN. The bill may also cover services which depend on their ability to reveal certain information to advertisers in exchange for offering free Internet e-mail to their users. Beyond that, purely Web-based services may fall into the purview of this bill, depending on whether providing access via modem requires that the modem dial directly into the service in question or not. Theoretically, this bill could even prevent online purchases absent a signed authorization form from each purchaser, because a service would have to reveal the name and address of the purchaser to the seller in order for the goods to be delivered. Even more troubling, the bill does not even provide an exception for information shared between a service owner and the company owning the computer hosting the service, regardless of whether there is a contractual obligation for confidentiality, since the hosting company has access to the information collected by the service about its users. As with other bills of this type, it is important for any company intending to offer Internet-related services to individuals to follow and perhaps attempt to affect the path of the Consumer Internet Privacy Protection Act of 1997, since it could have significant impact on planned services, revenue sources and per-subscriber costs. For those interested in forestalling this type of governmental action, the best response may be to accelerate self-regulatory initiatives to deal with the valid concerns of consumers who may be providing information about themselves and their buying habits, either in the process of registration or while using the service. At the same time, the self-regulatory bodies can create rules based on the actual business practices and realities of their members, rather than drafting with a broad brush as Congress does in so many instances. If companies are going to be able to take the greatest economic advantage of the interactivity of the Internet as opposed to traditional broadcast and print media, there needs to be some way of legally and ethically utilizing information provided by subscribers in order both to enhance the subscribers' experience and to gain revenue through appropriate business relationships with advertisers, retailers, and others who may wish access to consumers. Copyright 1997 Jonathan I. Ezor, Davis & Gilbert. All rights reserved. Jonathan I. Ezor is an attorney with Davis & Gilbert in New York City, practicing new media and computer law, focusing on the advertising industry. Mr. Ezor can be reached at jezor(a)newmedialaw.com. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

revised FC97 program
by R.Hirschfeld＠cwi.nl 17 Dec '03

17 Dec '03

Financial Cryptography '97 February 24-28 1997, Anguilla, BWI PRELIMINARY PROGRAM (Revised 6 February 1997) General Information: Financial Cryptography '97 (FC97) is a new conference on the security of digital financial transactions. The first meeting will be held on the island of Anguilla in the British West Indies on February 24-28, 1997. FC97 aims to bring together persons involved in both the financial and data security fields to foster cooperation and exchange of ideas. Original papers were solicited on all aspects of financial data security and digital commerce in general. Program Committee: Matthew Franklin, AT&T Laboratories--Research, Murray Hill, NJ, USA Michael Froomkin, U. Miami School of Law, Coral Gables, FL, USA Rafael Hirschfeld (Program Chair), CWI, Amsterdam, The Netherlands Arjen Lenstra, Citibank, New York, NY, USA Mark Manasse, Digital Equipment Corporation, Palo Alto, CA, USA Kevin McCurley, Sandia Laboratories, Albuquerque, NM, USA Charles Merrill, McCarter & English, Newark, NJ, USA Clifford Neuman, Information Sciences Institute, Marina del Rey, CA, USA Sholom Rosen, Citibank, New York, NY, USA Israel Sendrovic, Federal Reserve Bank of New York, New York, NY, USA Preliminary Conference Program for FC97: Monday 24 February 1997 800 -- 820 Breakfast 820 -- 830 Welcome 830 -- 905 Anonymity Control in E-Cash Systems George Davida (University of Wisconsin, Milwaukee, WI, USA), Yair Frankel (Sandia National Laboratories, Albuquerque, NM, USA), Yiannis Tsiounis (Northeastern University, Boston, MA, USA), Moti Yung (CertCo, New York, NY, USA) 905 -- 940 How to Make Personalized Web Browsing Simple, Secure, and Anonymous Eran Gabber, Phil Gibbons, Yossi Matias, Alain Mayer (Bell Laboratories, Lucent Technologies) 940 -- 1015 Anonymous Networking and Virtual Intranets: Tools for Anonymous Corporations Jim McCoy (Electric Communities, Cupertino, CA, USA) 1015 -- 1045 Coffee Break 1045 -- 1120 Unlinkable Serial Transactions Paul F. Syverson (Naval Research Laboratory, Washington, DC, USA), Stuart G. Stubblebine (AT&T Labs--Research, Murray Hill, NJ, USA), David M. Goldschlag (Naval Research Laboratory, Washington, DC, USA) 1120 -- 1155 Efficient Electronic Cash with Restricted Privacy Cristian Radu, Rene Govaerts, Joos Vandewalle (Katholieke Universiteit Leuven, Leuven, Belgium) 1155 -- 1230 The SPEED Cipher Yuliang Zheng (Monash University, Melbourne, Australia) 1230 -- 1330 Lunch 1800 -- 1930 Cocktail Reception (at Mariners Hotel) Tuesday 25 February 1997 800 -- 830 Breakfast 830 -- 930 Invited Speaker Evaluating the security of electronic money; the view of a European central bank Simon L. Lelieveldt (De Nederlandsche Bank, Amsterdam, Netherlands) 930 -- 1005 Smart Cards and Superhighways The technology-driven denationalisation of money David G.W. Birch, Neil A. McEvoy (Hyperion, Surrey, England) 1005 -- 1045 Coffee Break 1045 -- 1120 Fault Induction Attacks, Tamper Resistance, and Hostile Reverse Engineering in Perspective David P. Maher (AT&T Labs--Research, Murray Hill, NJ, USA) 1120 -- 1155 Some Critical Remarks on "Dynamic Data Authentication" as specified in EMV '96 Louis C. Guillou (CCETT, Cesson-Sevigne, France) 1155 -- 1230 Single-chip implementation of a cryptosystem for financial applications Nikolaus Lange (SICAN Braunschweig GmbH, Braunschweig, Germany) 1230 -- 1330 Lunch Wednesday 26 February 1997 800 -- 830 Breakfast 830 -- 930 Invited Speaker Ronald Rivest (MIT Lab for Computer Science, Cambridge, MA, USA) 930 -- 1005 Auditable Metering with Lightweight Security Matthew K. Franklin, Dahlia Malkhi (AT&T Labs--Research, Murray Hill, NJ, USA) 1005 -- 1045 Coffee Break 1045 -- 1120 SVP: a Flexible Micropayment Scheme Jacques Stern, Serge Vaudenay (Ecole Normale Superieure, Paris, France) 1120 -- 1155 An efficient micropayment system based on probabilistic polling Stanislaw Jarecki (MIT Lab for Computer Science, Cambridge, MA, USA), Andrew Odlyzko (AT&T Labs--Research, Murray Hill, NJ, USA) 1155 -- 1230 On the continuum between on-line and off-line e-cash systems - I Yacov Yacobi (Microsoft, Redmond, WA, USA) 1230 -- 1330 Lunch Thursday 27 February 1997 800 -- 830 Breakfast 830 -- 905 Towards Multiple-payment Schemes for Digital Money H. Pagnia, R. Jansen (University of Darmstadt, Darmstadt, Germany) 905 -- 940 Applying Anti-Trust Policies to Increase Trust in a Versatile E-Money System Markus Jakobsson (UCSD, La Jolla, CA, USA), Moti Yung (BTEC/CertCo, New York, NY, USA) 940 -- 1015 Cyberbanking and Privacy: The Contracts Model Peter P. Swire (Ohio State University, Columbus, OH, USA) 1015 -- 1045 Coffee Break 1045 -- 1120 Legal Issues in Cryptography Edward J. Radlo (Fenwick & West LLP, Palo Alto, CA, USA) 1120 -- 1230 Panel Discussion Legal Issues of Digital Signatures Michael Froomkin (U. of Miami School of Law, Coral Gables, FL, USA), Charles Merrill (McCarter & English, Newark, NJ, USA), Benjamin Wright (Dallas, TX, USA) 1230 -- 1330 Lunch 1930 -- 2015 Invited Speaker Money Laundering: Yesterday, Today and Tomorrow Peter Wayner (Baltimore, MD, USA) 2015 -- 2200 Rump Session Friday 28 February 1997 800 -- 830 Breakfast 830 -- 905 The Strategic Role of Government in Electronic Commerce Paul Lampru (Verifone, Atlanta, GA, USA) 905 -- 940 Using Markets to Achieve Efficient Task Distribution Ian Grigg, Christopher C. Petro (Systemics, Amsterdam, Netherlands) 940 -- 1015 The Gateway Security Model in the Java Electronic Commerce Framework Theodore Goldstein (Sun Microsystems Laboratories/Javasoft) 1015 -- 1045 Coffee Break 1045 -- 1120 Highly Scalable On-line Payments Via Task Decoupling David William Kravitz (CertCo LLC, Albuquerque, NM, USA) 1120 -- 1155 GUMP; Grand Unified Meta-Protocols Recipes for Simple, Standards-based Financial Cryptography Barbara Fox, Brian Beckman (Microsoft, Redmond, WA, USA) 1155 -- 1230 Secure Network Communications and Secure Store&Forward Mechanisms with SAP R/3 Bernhard Esslinger (SAP AG, Walldorf, Germany) 1230 -- 1330 Lunch Updates of the conference schedule will be available at the URL http://www.cwi.nl/conferences/FC97/. The conference will run from 8:30 AM to 12:30 PM for five days, February 24-28 1997. Breakfast and lunch are provided at the conference. The conference organizers have left the afternoons and evenings open for corporate sponsored events, for networking, and for recreational activities on the resort island of Anguilla. Participants are encouraged to bring their families. Workshop: A 40-hour workshop, intended for anyone with commercial software development experience who wants hands-on familiarity with the issues and technology of financial cryptography, is planned in conjunction with FC97, to be held during the week preceding the conference. For more information on the workshop, please see the URL http://www.cs.berkeley.edu/~iang/fc97/workshop.html. For workshop registration, see the URL http://www.offshore.com.ai/fc97/. Venue: The InterIsland Hotel is a small 14-room guest house and a large, comfortable 150 seat conference facility with additional space for a small 10-booth exhibition. The Inter-Island is on Road Bay, near Sandy Ground Village, in the South Hill section of Anguilla. The conference, workshop, and exhibition will have TCP/IP internet access. The rooms at the InterIsland itself have sold out, but there are many other hotels and guest houses on Anguilla, and shuttle service to the conference will be available. Air Transportation and Hotels: Air travel to Anguilla is typically done through either San Juan or St. Thomas for US flights, or St. Maarten/Martin for flights from Europe and the US. Anguillan import duties are not imposed on hardware or software which will leave the island again. There are no other taxes--or cryptography import/export restrictions--on Anguilla. Hotels range from spartan to luxurious, and more information about hotels on Anguilla can be obtained from your travel agent, or at the URL http://www.offshore.com.ai/fc97/. General Chairs: Robert Hettinga, Shipwright/e$, Boston, MA, USA; rah(a)shipwright.com Vincent Cate, Offshore Information Services, Anguilla, BWI; vince(a)offshore.com.ai Conference, Exhibits, and Sponsorship Manager: Julie Rackliffe, Boston, MA, USA; rackliffe(a)tcm.org Workshop Leader: Ian Goldberg, Berkeley, CA, USA; iang(a)cs.berkeley.edu Registration: You can register and pay for conference admission via the World Wide Web at the URL http://www.offshore.com.ai/fc97/. The cost of the FC97 Conference is US$1,000. Booths for the exhibition start at US$5,000 and include two conference tickets. For more information about exhibit space, contact Julie Rackliffe, rackliffe(a)tcm.org. Sponsorship opportunities for FC97 are still available. The cost of the workshop is US$5000, and includes meals but not lodging. You can register for the workshop, which runs the week prior to the conference, at the URL http://www.offshore.com.ai/fc97. Financial Cryptography '97 is held in cooperation with the International Association for Cryptologic Research. It is sponsored by: The Journal for Internet Banking and Commerce <http://www.arraydev.com/commerce/JIBC/> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.shipwright.com/rah/> C2NET <http://www.c2.net/> See Your Name Here <mailto: rackliffe(a)tcm.org>

1 0

Re: Moderation, Tim, Sandy, me, etc. * Strong crypto == DES?!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Tim, the Cypherpunks have chosen to follow Sandy's lead for this > month. I'll admit I made it easy for them, but the results are > conclusive. There are 1311 addresses in the cypherpunks list today; > 42 in the unedited list; and 19 in the flames list. Forty people > cared enough to read every posting; the other thousand either wanted > to try the experiment -- or didn't care enough to send an email > message. Which, as we all know, is a very low threshold. As I, and a number of other list members, have said: Why did you not rename the lists so that cypherpunks(a)toad.com was uncensored??? You and I know perfectly well that probably 1250 of those addresses are people who don`t know the censorship is taking place, don`t read the list (defunct accounts), don`t know how to change their subscription, are too lazy to care either way etc... I would guess there are less than 100 that have considered the issues and decided to subscribe to the censored list. > If I was a social scientist I might want to run the experiment both > ways, or six different ways. Name it this, or name it that. I'm not; > all I want is something that works. The cypherpunks list was unusable > for this kind of discussion, only a month ago. It's usable now. No, it was usable to those with time and patience or the rather rudimentary knowledge necessary to set up filters. Now all we are doing is relegating a list that was once subscribed to by intelligent and well educated people into a playground for the inept. I`m not being elitist but if we can`t expect a member of this list who actually uses it for discussion to know how to set up filters then he might as well unsubscribe. > Perhaps at that point I should have shut down the list, as Lucky is > now suggesting. "Asking the list what to do" was clearly not a useful > option. Sandy cared enough about the community to make some concrete > suggestions to me about how to get the list back on track. They > involved a lot more work than the previous setup. I told him if he > was willing to do the work, we could try it. As Dale suggests, I > wasn't about to waste my time reading the whole list in real time and > passing judgement on the postings. Sandy was, for a month. You should indeed have shut down the list. The problem being not that you choose to run a censored list but that you have associated the name cypherpunks with it and in doing so you have destroyed the reputation that the name cypherpunks once had. > Unpaid labor for a peanut gallery of spoiled children isn't very > gratifying. Paternalism is the root of all statism. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

testing
by Rodney Thayer 17 Dec '03

17 Dec '03

Rodney Thayer <rodney(a)sabletech.com> +1 617 332 7292 Sable Technology Corp, 246 Walnut St., Newton MA 02160 USA Fax: +1 617 332 7970 http://www.shore.net/~sable "Developers of communications software"

1 0

Re: Deloitte-Touche?
by Adam Back 17 Dec '03

17 Dec '03

Mark <mark(a)infolawalert.com> writes: > I'm almost certain that Murray is a consultant rather than > or in addition to an accountant. He's been saying these things William Murray used to post frequently to sci.crypt, alt.security.pgp, etc when I read those forums. He also I think wrote the forword for one of the books on using PGP. Adam -- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

2 1

Re: Moderation, Tim, Sandy, me, etc. * Strong crypto == DES?!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Tim, the Cypherpunks have chosen to follow Sandy's lead for this > month. I'll admit I made it easy for them, but the results are > conclusive. There are 1311 addresses in the cypherpunks list today; > 42 in the unedited list; and 19 in the flames list. Forty people > cared enough to read every posting; the other thousand either wanted > to try the experiment -- or didn't care enough to send an email > message. Which, as we all know, is a very low threshold. As I, and a number of other list members, have said: Why did you not rename the lists so that cypherpunks(a)toad.com was uncensored??? You and I know perfectly well that probably 1250 of those addresses are people who don`t know the censorship is taking place, don`t read the list (defunct accounts), don`t know how to change their subscription, are too lazy to care either way etc... I would guess there are less than 100 that have considered the issues and decided to subscribe to the censored list. > If I was a social scientist I might want to run the experiment both > ways, or six different ways. Name it this, or name it that. I'm not; > all I want is something that works. The cypherpunks list was unusable > for this kind of discussion, only a month ago. It's usable now. No, it was usable to those with time and patience or the rather rudimentary knowledge necessary to set up filters. Now all we are doing is relegating a list that was once subscribed to by intelligent and well educated people into a playground for the inept. I`m not being elitist but if we can`t expect a member of this list who actually uses it for discussion to know how to set up filters then he might as well unsubscribe. > Perhaps at that point I should have shut down the list, as Lucky is > now suggesting. "Asking the list what to do" was clearly not a useful > option. Sandy cared enough about the community to make some concrete > suggestions to me about how to get the list back on track. They > involved a lot more work than the previous setup. I told him if he > was willing to do the work, we could try it. As Dale suggests, I > wasn't about to waste my time reading the whole list in real time and > passing judgement on the postings. Sandy was, for a month. You should indeed have shut down the list. The problem being not that you choose to run a censored list but that you have associated the name cypherpunks with it and in doing so you have destroyed the reputation that the name cypherpunks once had. > Unpaid labor for a peanut gallery of spoiled children isn't very > gratifying. Paternalism is the root of all statism. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: "Why am I being completely censored"?
by John Gilmore 17 Dec '03

17 Dec '03

> I'd just appreciate it if someone would explain to me just why > I'm being completely censored from the cypherpunks list. ... > Absolutely none of my recent postings are even going to > cypherpunks-unedited, I've received no response to my mail to > gnu(a)toad.com asking why, and I've received absolutely no bounces > indicating that there are delivery problems. I haven't investigated your story because you didn't provide enough details and because I have been busy with other things. There is no infrastructure here for blocking postings from going through cypherpunks-unedited. It really is unedited. Perhaps there is a mailer problem (at your end or at mine). If you cc'd yourself on your messages to cypherpunks, please send me a verbatim copy of such a message that did not appear in cypherpunks-unedited, including all the header lines. I can trace whether it was ever seen on the toad.com end and what happened if it was. Hmm. Your message that I just received, about this problem, was cc'd to cypherpunks. It did not make it into the cypherpunks-unedited list. In examining the message header itself, there is an "Approved: yes" line. My guess is that your attempt to be too tricky has screwed you. Majordomo is probably zapping postings that claim to be, but aren't actually, moderator-approved. This is just a guess. Please try making a posting to cypherpunks without such a line, and see if it goes through into the unedited list. Let me know. John

2 1

40-bit RC5 crack meaningless??
by Vin McLellan 17 Dec '03

17 Dec '03

(A gem off sci.crypt. Schwartau's mailing list is turning into the most amazing source of misinformation or disinformation about cryptography on the Net. And he's probably got the most influential audience in Washington re crypto policy. Go figure;-) ---------------- Subject: 40-bit RC5 crack meaningless?? Date: 6 Feb 1997 11:43:58 -0500 From: nobody(a)REPLAY.COM (Anonymous) Organization: Replay and Company UnLimited Newsgroups: sci.crypt Strassmann, the author of this denunciation of RSADS and Ian Goldberg, is the former Director of Defense Information (i.e., CIO,) of the Bush DoD and an often-insightful commentator on business culture and computing. Strange is the logic that channels the mind of the American Defense Intellectual... or, maybe he just doesn't know squat about cryptography??? (Reposted from Infowar Digest, Winn Schwartau's moderated mailing list <mail to: infowar(a)infowar.com> without permission.) >Date: Thu, 30 Jan 1997 20:10:36 -0500 >To: "Wright Larry" <Wright_Larry(a)bah.com> >From: "Paul A. Strassmann" <paul(a)strassmann.com> >Subject: Further to Goldberg's Cracking Accomplishments >Gentlemen: > >As I suspected (see earlier private comment), the >highly promoted RSA cracking contest offered >a number of clues that ordinarly would not be >volunteered by info-terrorists or info-criminals to >IW Defense teams. > >These clues made the cracking significantly easier, >because it made it possible to eliminate an enormous >range of possible searches. > >The following was extracted verbatim from the ><The RSA Data Security Secret-Key Challenge> >posted on <http://www.rsa.com/rsalabs/97challenge/>: > >Clue #1: > > " ...all the RC5 contests posted as part of the RSA Secret-Key Challenge >will use 12-round RC5 with a 32-bit word size. " > >Clue #2: > > " ...The first RC5 contest will consist of some unknown plaintext >encrypted using a 40-bit key;." > >Clue #3: (a giveway!) > > " ... For each contest, the unknown plaintext message is preceded by three > known blocks of text that contain the 24-character phrase "The > unknown message is: .....". > >In summary: The claim of exportable cryptography being totally >insecure, because it can be cracked in 3.5 hours is not >realistic. The three clues announced in the contest >would not apply under infowar conditions. > >What other clues may have been provided to Goldberg >to support private agendas and gain shrill headlines >is also a matter of speculation, but I rest my case. > >I certainly cannot assert that a 40 bit key cannot be decyphered. >However, I do not think that the RSA unqualified claims >offer full and appropriate disclosure. > >Paul > >At 10:21 AM -0500 1/30/97, Wright Larry wrote: >>Following provided for your information. >> >> >>EXPORTABLE CRYPTOGRAPHY TOTALLY INSECURE: CHALLENGE >>CIPHER BROKEN IMMEDIATELY >> >>January 28, 1997 - Ian Goldberg, a UC Berkeley graduate >>student, announced today that he had successfully >>cracked RSA Data Security Inc.'s 40-bit challenge cipher >>in just under 3.5 hours. >> >>RSA challenged scientists to break their encryption >>technology, offering a $1000 award for breaking the >>weakest version of the code. Their offering was >>designed to stimulate research and practical experience >>with the security of today's codes. >> >>The number of bits in a cipher is an indication of the >>maximum level of security the cipher can provide. Each >>additional bit doubles the potential security level of >>the cipher. A recent panel of experts recommended >>using 90-bit ciphers, and 128-bit ciphers are commonly >>used throughout the world, but US government regulations >>restrict exportable US products to a mere 40 bits. >> >>Goldberg's announcement, which came just three and a >>half hours after RSA started their contest, provides >>very strong evidence that 40-bit ciphers are totally >>unsuitable for practical security. "This is the >>final proof of what we've known for years: 40-bit >>encryption technology is obsolete," Goldberg said. <...Rest of the nnouncement from UC Berkeley snipped> >Paul A. Strassmann >55 Talmadge Hill Road, New Canaan, CT. 06840 >Telephone: 203-966-5505; Fax: 203-966-5506 >INTERNET: paul(a)strassmann.com >WorldwideWeb: http://www.strassmann.com >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >

2 1

anonymous remailers
by c.musselman＠internetmci.com 17 Dec '03

17 Dec '03

C'punks -- When I told a friend about the alt.drugs.pot cultivation newsgroup and suggested that he use an anonymous remailer to post to the group, he laughed and said, "Who do you suppose runs the remailers? ATF, FBI, DEA, that's who!" Gee, it makes sense to this paranoid. Does anyone know the answer? Specifically, how can we choose a trusted remailer? Cheers (?), Charley

3 2

EXTRA CHARGE FOR INTERNET SERVICE !
by Brian Adrian 17 Dec '03

17 Dec '03

Just received this from another mailing list. PLEASE FORWARD TO ALL INTERESTED PARTIES I am writing you this to inform you of a very important matter currently under review by the FCC. Your local telephone company has filed a proposal with the FCC to impose per minute charges for your internet service. They contend that your usage has or will hinder the operation of the telephone network. It is my belief that internet usage will diminish if users were required to pay additional per minute charges. The FCC has created an email box for your comments, responses must be received by February 13, 1997. Send your comments to isp(a)fcc.gov and tell them what you think. Every phone company is in on this one, and they are trying to sneak it in just under the wire for litigation. Let everyone you know here this one. Get the e-mail address to everyone you can think of. isp(a)fcc.gov Please forward this email to all your friends on the internet so all our voices may be heard! It's time to let them know just who is paying their salaries. Don't sit back and be quite on this one, SPEAK YOUR MIND, LET THEM KNOW THIS IS BULLSHIT !!!!!!!!!! Just passing it along... Brian Adrian e-mail: chow(a)niven.imsweb.net Web page: http://home.imsweb.net/~chow/

1 0