December 2003 - cypherpunks-legacy

EU and FBI Wiretap Scheme
by John Young 17 Dec '03

17 Dec '03

This sounds like what Spook Herson admitted in his interview: February 25, 1997 Report: Europe OKs Wiretap Rules London (AP) -- Europe has agreed to establish international standards with the U.S. Federal Bureau of Investigations to enable authorities to tap telephones and messages sent by fax, telex and e-mail, a London newspaper reported Tuesday. The Guardian newspaper said it obtained a preliminary agreement signed by European Union nations in 1995 that calls for telecommunications companies to provide security agencies with the key to codes installed in equipment sold to customers. The newspaper report could not be confirmed independently. The aim of the alliance between U.S. and EU agencies was to set a common standard for "international interception,'' the newspaper reported. Full details on the agreement are being drawn up by officials working in European Union committees, it said. The report said European officials drafted a memorandum of understanding after Britain warned that mobile telephone systems in the hands of organized criminals posed an international threat. ---------- Thanks to D. If anyone has the Guardian article, a copy would be appreciated. Fax to: (US) 212-799-4003 Or scan it and send e-mail to <jya(a)pipeline.com>.

1 0

Re: Strange Looks
by Toto 17 Dec '03

17 Dec '03

Mike Denney wrote: Subject: new regulations Sent: 2/25/97 11:31 PM Received: 2/25/97 3:49 PM From: Ken Wallace, kwallace(a)pragma.com To: larry(a)dentistat.com TO ALL EMPLOYEES It has been brought to the management's attention that some individuals have been using foul language in the course of normal conversation between employees. Due to complaints from some more easily offended workers, this conduct will no longer be tolerated. The management does, however, realize the importance of each person being able to properly express their feelings when communicating with their fellow employees. Therefore the management has compiled the following code phrases, so that the proper exchange of ideas and information can continue. Old Phrase New Phrase ---------- ---------- No fucking way I'm not certain that's feasible. You've got to be shitting me Really? Tell someone who gives a fuck Perhaps you should check with ... Ask me if I give a fuck Of course I'm concerned. It's not my fucking problem I wasn't involved in that project. What the fuck? Interesting behavior. Fuck it, it won't work I'm not sure I can implement this. Why the fuck didn't you tell me I'll try to schedule that. that sooner? When the fuck do you expect me to Perhaps I can work late. do this? Who the fuck cares? Are you sure it's a problem? He's got his head up his ass He's not familiar with that problem. Eat shit You don't say. Eat shit and die Excuse me? Eat shit and die motherfucker Excuse me, sir? What the fuck do they want from me They weren't happy with it? Kiss my ass So you'd like help with it? Fuck it. I'm on salary I'm a bit overloaded at the moment. Shove it up your ass I don't think you understand. This job sucks I love a challenge. Who the hell died and made you boss You want me to take care of this? Blow me I see. Blow yourself Do you see? Another fucking meeting Yes, we should discuss this. I really don't give a shit I don't think it will be a problem. Fuck you How nice. How very nice! -- Toto ----------------------------- "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

More on EU and FBI Wiretapping
by John Young 17 Dec '03

17 Dec '03

Thanks to CA: EPIC reports today on the EU-FBI wiretap pact. It gives this URL for the source document which lays out the interception deception: http://www.privacy.org/pi/activities/tapping/ See EPIC's full report at: http://www.epic.org/ [1] New Report Details FBI/European Tapping Agreements [2] Airline Security Report Released [3] Briefs Filed in Reno v. ACLU Internet "Indecency" Challenge [4] Crypto Legislation Introduced [5] Clipper Upgrade at DOD/Litigation Update [6] State Department Reports Widespread Illegal Wiretapping Worldwide [7] New Medical Privacy Survey [8] Upcoming Conferences and Events

1 0

ZKP
by nobody＠jefferson.hidden.net 17 Dec '03

17 Dec '03

Tim C[ocksucker] Mayo must have been sharing needles with a rabid hedgehog. o-:^>___? Tim C[ocksucker] Mayo `~~c--^c'

2 1

Look what SPAM I got today [Customers for You !!!]
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Hi Cypherpunks. Long time no lurk. Too busy defending the right to own unregistered guns and getting involved in local politics to dwell on the shortfalls of OS/2 PGP shells for PM GUI. PGP apps for OS/2 sucks! Anyhow, if you have any comments on the forwarded message, please Cc me. Is there a limit to spamming? Is there a way to attach nitroglycerine to an e-mail reply? ( I know Jim Bell has a few suggestions about that... :-) Ciao all JFA ------- Forwarded Message Follows ------- Date: Thu, 27 Feb 1997 12:06:09 -0500 (EST) From: Quantum Communications <sales(a)quantumcom.net> To: "jctracey(a)sprynet.com" <jctracey(a)sprynet.com> Subject: Customers for You !!! Would you like more customers? Visit http://www.quantcom.com Everyone knows that the hottest way to find new customers and market your business is via direct Email. Quantum Communications offers direct Email advertising services, and related marketing services, with the following highlights: ------> Guaranteed Response Rate! Up to 3% Guaranteed Response. ------> 100% Approved Financing! No Credit Checks! ------> Never Again Get Shut Off By Your ISP! We Offer Flame-Filtering & Free Auto-Responders! ------> Targeted Mailings, Using Custom-Built Lists With Your Parameters. ------> 5 Million Recipient Co-op "The Mega-Mailer" is available. ------> Stand-Alone Mailings Available. ------> Wholesale Unlimited Access To Our "Self-Service" SMTP Mail Servers Available. ------> Ad Copy Design & Revision Available. ------> "Floodgate" Bulk E-Mail Software Available. Quantum Communications also offers Virtual Servers complete with full POP3 Email accounts and domain registration, lists of Email addresses for sale, search engine submissions, newsgroup posting announcements, and web page design. Call our Sales Department at (603) 772-4096 for details, or Visit our website at http://www.quantcom.com You may also send an email to our autoresponder: info(a)quantcom.com or direct specific questions to sales(a)quantcom.com Thank you for your time. ------- end of forwarded message ------ -- Jean-Francois Avon, Pierrefonds(Montreal) QC Canada JFA Technologies, R&D consultants. physicists, engineers and technologists. PGP keys at: http://w3.citenet.net/users/jf_avon and: http://bs.mit.edu:8001/pks-toplev.html ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 ID# 5B51964D : 152ACCBCD4A481B0 254011193237822C

1 0

DNSSEC Encryption for DNS registration and ITAR Nonsense
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:14 AM 2/12/97 -0500, "Donald E. Eastlake 3rd" <dee(a)cybercash.com> wrote: >People may want to note that yesterday (Feb 11th) the IESG approved the DNS >dynamic update and DNS secure dynamic update (draft-ietf-dnssec-update-04.txt >and draft-ietf-dnsind-dynDNS-11.txt) as Proposed Standards. The base DNS >security protocol was approved some time ago and is now out as RFC 2065. Details are on http://www.tis.com/docs/research/network/dns.html It's a very interesting page - pointers to the RFC http://ds.internic.net/rfc/rfc2065.txt , and downloadable beta code from TIS implementing it. Cool stuff. But then there's the politial correctness part of the web page :-) > Trusted Information Systems, Inc. has received approval from the > United States Government for export and reexport of TIS/DNSSEC software > from the United States of America under the provisions of the Export > Administration Regulations (EAR) General Software Note (GSN) license > exception for mass market software. Under the provisions of this license, > this software may be exported or reexported to all destinations except > for the embargoed countries of Cuba, Iran, Iraq, Libya, North Korea, > Sudan and Syria. Any export or reexport of TIS/DNSSEC software to the embargoed > countries requires additional, specific licensing approval from the > United States Government. Yup. Can't let those Cubans secure their DNS..... At least the government did decide to permit export. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1

STU-III Usage
by Jim Conrad 17 Dec '03

17 Dec '03

Bill Stewart wrote: >Back when the STU-III was still called the "Future Secure Voice System" >the DoD was telling manufacturers they'd probably sell 500,000 of them, >between the DoD unclassified work, law enforcement users, defense >contractors, and similar riff-raff. I don't know how many were actually >sold, but I'd be surprised if it's a tenth of that; the government >was too cheap to spend $2-3K per box for that many users. I'm ex-Navy and worked as a contractor for the last 5 years since I got out. >From my operational experience and exposure to certain area's I would have to say that 500,000 might be more accurate than you suspect. They are used at most Navy facilities as the "standard" desk phone when the command requires operational security telecommunications access. Personnel Offices etc., probably don't have but one or two per facility but sites requiring them have them everywhere. Likewise most contractor facilities that require secure telecommunications have them available as well. ..Jim <:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:> <:> Jim Conrad - Ocean View Communications - jjc(a)infi.net <:> <:> 757-490-8127 Office - 757-587-8251 Fax - 757-473-6740 Pager <:> <:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:><:>

1 0

Clipper Chip Banking
by KALLISTE＠delphi.com 17 Dec '03

17 Dec '03

Clipper Chip Banking by J. Orlin Grabbe Sandia National Laboratories have created the digital cash equivalent of the Clipper chip: an "anonymous" digital cash system that would give participants privacy from all viewers, except for the government agencies that would control the secret keys required for backdoor access. Just as the "Clipper" proposal (the Escrowed Encryption Standard) is a system of encrypted communication with a Big Brother peephole, so is Sandia e- cash a system of digital cash with a Big Brother peephole. It was designed that way. Why is Sandia interested in digital cash systems? Well, Sandia is responsible for all non-nuclear components of nuclear weapons. The security of nuclear weapons depends partly on cryptology. The code- breaking National Security Agency (NSA), for example, is responsible for the communication security of the Minuteman missile, as well as the codes by which the President must identify himself to authorize a nuclear strike. The use of nuclear weapons is normally based on a trustee system: two or more people are necessary to give the complete authorization code. The NSA used this idea as the basis for the Clipper chip: two designated trustee agents would each have knowledge of one-half the chip-specific unique key by which to decode the session key that encoded a particular communication passing through the chip. The Clipper chip was originally proposed for incorporation into every digital communication device: computer, fax, and cable TV. The sales aspect of Clipper was a new encryption algorithm based on 80- bit encryption keys. Financial and other institutions had begun to worry about the security of the Data Encryption Standard (DES) which uses 56- bit keys. An 80-bit key space would be 2^24 times as large as the DES key space. The catch was that acceptance of the new algorithm would involve acceptance of the NSA backdoor. At the present time, the financial industry has said, "No, thank you," and is focusing on triple-DES, which has the security equivalent of 112-bit encryption keys, and no backdoor. Sandia e-cash is a simple extension of the trustee notion. Sandia e-cash was announced as "the first electronic cash system that incorporates trustee-based tracing, while provably protecting user anonymity". The trustees in this case are key-escrow agents, and a minimal subset of them (say three out of five) would be able to combine their knowledge to trace an individual's electronic transactions. The fact that several agents would need to act in concert "protects users from the possibility that one or two trustees might be corrupt". (In other words, depending on the level of official corruption, the system would either be somewhat secure, or totally insecure.) Anonymity or privacy in financial transactions generally means an inability to determine an individual's spending patterns. Anonymity requires first and foremost protection from the prying eyes of the bank. If the bank knows what is going on in your account, then potentially so can anyone else: the records can be seized, or surreptitiously accessed by computer, or a bank employee can be bribed to make them available. (In this respect, it is useful to note that the system of Swiss numbered accounts was created to protect bank customers from bank employees. Bank employees, observing what occurred in a customer's account, could possibly subject the customer to blackmail.) Anonymity involves several aspects, including "unlinkability" and "untraceability". "Unlinkability" refers to the inability of a bank (even colluding with merchants) to determine that two payments were made by the same user. To understand this, consider the opposite case: your monthly American Express or credit card bill. Such a statement contains a set of transactions which are all linked by a common element--your AMEX or credit card account number. Because these payments are linked, they present a limited picture (a subset) of your behavior, movements, and habit patterns. Your private behavior is potentially public information. Unlinkability is therefore an aspect of anonymity. Because linkability in anonymous digital cash involves cryptological protocols, it is actually a probability concept: how probable is it that two payments can be accurately identified as having been made by the same user? Unlinkability means such probability is negligible. "Untraceability" refers to the inability of a bank to match withdrawals of digital cash with subsequent payments. To have untraceability, the information a person reveals about himself by making payments must be statistically independent of the information a person reveals about himself by making withdrawals. Of course if the bank, even when colluding with merchants, can't link or trace a person's transactions--even in probability terms- -then neither can FINCEN or the NSA. Anonymity and privacy thus ultimately hinges on concealing this type of information from the bank itself. But such anonymity, naturally, raises the issue of the selectively- enforced money-laundering laws. The prevention of money-laundering is stated as a principal raison d'tre for Sandia's e-cash system of non-anonymous "anonymity": "Money laundering . . . is hampered by physical cash and would be made easier by a completely anonymous electronic counterpart. . . . With anonymous e-cash, money- laundering would be as simple as depositing one set of electronic "coins" in an account under an assumed name and withdrawing another set from the same account." (Peter S. Gemmel, "Traceable e-cash," Technology and the Electronic Economy, IEEE Spectrum, February 1997.) To prevent such nefarious activity, Sandia even envisions one future world in which individuals would be required to submit regular reports of their financial transactions to the government: "In a different trustee-based e-cash system, the users' "wallet" software would require them to supply the authorities from time to time with transaction records stored in their electronic wallets and encrypted with their tracing keys." (Ibid.) This proposal is somewhat similar to a requirement to regularly send one's bank statements to the IRS for filing, with a committee controlling access to the file cabinet. While Sandia ponders the future needs of Big Brother government, over at the Treasury, meanwhile, Robert Rubin has appointed the Comptroller of the Currency, Eugene Ludwig, as the point man to oversee government efforts to keep a peephole into every bank account. To this end, Ludwig--when he is not attending Clinton coffee- klatsches--coordinates the electronic cash spying plans of FINCEN, U.S. Customs, the IRS, the Secret Service, ATF, and the Office of Foreign Assets Control. February 27, 1997 Web Page: http://www.aci.net/kalliste/

3 2

Re: 128_bit
by Vin McLellan 17 Dec '03

17 Dec '03

>2-26-97. Newsbytes: > >Security Dynamics Unveils RSA SecurPC 2.0 > > Wokingham, England, By Steve Gold. Security Dynamics has unveiled > RSA SecurPC 2.0, the latest version of its software-based > encryption software. The package is claimed to the first 128-bit > encryption software to be exported from the US and its territories. No such luck. This is a press report that seems a little confused... which is say that it is, at least, a bit premature. SecurPC has a useful feature which allows for a self-decrypting file to be created with its 128-bit (symmetric) RC4 cipher. RSADSI got the NSA to agree that this self-decrypting file could be transmitted outside the US because the packaged implementation is restricted to merely decrypting the file -- with a key (password) to be passed out of band: by hand, letter, phone, etc. (The free trial version of SecurPC, which can be downloaded from the RSADSI and SDTI websites, is enabled with only the limited key-length RC4 encryption -- still the only type of crypto now allowed to be freely exported outside the US. The domestic product, as sold, offers full128-bit RC4.) The major enhancement in the 2.0 version of SecurPC, as I recall, is that it offers transparent, on the fly, decryption of a secured file, as you open the relevant application on your PC. Suerte, _Vin Vin McLellan + The Privacy Guild + <vin(a)shore.net> 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548

1 0

No Subject
by Mix 17 Dec '03

17 Dec '03

Timmy Maya's reheated, refurbished, and regurgitated cud is completely inappropriate for the mailing lists into which it is cross-ruminated. \\\ {OQ} (_)

1 0