December 2003 - cypherpunks-legacy

New FinCEN Rules
by John Young 17 Dec '03

17 Dec '03

FinCEN has published today in the Federal Register three inter-related proposals for new rules for the Bank Secrecy Act Regulations: 1. Changes in the scope and type of transactions to be regulated, including, say, micro payments and and electronic transactions such as stored value cards. 2. Changes in the reporting requirements for suspicious transactions and the types of institutions to be regulated, including "money services establishments." 3. Changes in requirements for reporting currency transactions, and setting a new floor at $750 (as reported recently in the news). http://jya.com/fc052197.htm (79K) http://jya.com/fc052197-2.htm (69K) http://jya.com/fc052197-3.htm (63K)

1 0

Mil-LE Forensic Tools
by John Young 17 Dec '03

17 Dec '03

>From the NTI Web site, http://www.secure-data.com Free downloads: Forensic Tools The FILTER Forensic Tool: This program is used to remove binary (non alpha-numeric) characters from computer data. This program has been used internationally by military and law enforcement agencies for years and was donated to the law enforcement community by one of our founders back in 1991. Once a file has been processed with this program the content can be printed and viewed with more traditional types of programs, e.g. word processors. This program should not be confused with NTI's intelligent filter program. ... The NTIDOC Forensic Tool: This program is used to essentially take an electronic snap shot of files and subdirectories that have previously been identified to have some evidentiary value. It is a documentation tool. The program automatically creates documentation that can easily be printed, viewed or merged into forensic reports. The original program entitled DOC has been used for years by military and law enforcement computer specialists and has previously been donated for that use by the founders of NTI. ... The SPACES Security Review Tool: This program is very simple. It creates one or more files that contain nothing but spaces. To be exact, every file created by this program will contain 10,000 spaces. Such output is ideal in the evaluation of encryption patterns to determine security weakness. Our forensic training courses and cryptography courses cover this concept in detail. MICRO-ID Computer Theft Prevention Software: This software is used to mark computer hard disk drives with computer ownership information. Once a computer has been marked it can be identified by police should it be recovered as stolen property. The program that reads the ownership information is called COP-ONLY and as the name implies the program is only distributed to local, county and state law enforcement agencies. ... ----------

1 0

Rogue Key Warning
by TruthMonger 17 Dec '03

17 Dec '03

TruthMonger wrote: > In keeping with what I see as a cypherpunk frame of mind, I am > posting this via an anonymous remailer, but I am also digitally > signing it. I am not hiding my identity, but merely taking > action to prevent my public statement from being used to unjustly > persecute me. The PGP public key included with the file for identification purposes has a verifying signature that can corrupt your PGP 5.0 keyring file if you use the "Get Selected Key" option to get that particular verifying key and add it to your keyring. It crashes the program. The offending key shows up as "Unavailable, 0xFC3568CD" in the PGP 5.0 list of verifying signatures for the key. The key included in the file causes no problems with the program when added to the keyring as long as you don't use the program to retreive the offending verification key and add it to your keyring. > -----BEGIN PGP SIGNATURE----- > Version: 5.0 beta > Charset: noconv > > iQCVAwUBM4KR+6ozBjzmqceZAQHeRQQAiI6CSKzPgioO5UdacoNbtKPyTvhHOuNB > /kkCx1UuYiVOaIw48oVX7Gj1bIcMMkAiM+q6q+SOZkEq+hNUdriISpY5/aKA39Yp > ejNKl2McRK7WrP+TQPNx9hwxFrW93JrqjhSPhZsgkVNtIHG/wE1RpdWJzPiIOeP2 > /Q9TTHmRoRU= > =x+P/ > -----END PGP SIGNATURE----- > > -----BEGIN PGP PUBLIC KEY BLOCK----- > Version: 5.0 beta > > mQCNAzMs140AAAEEAL1CAoB5pd97hIOoT6L0v05Ov8nw0unf0db6NXZ91EJAyq9p > DoPGJl7Z6m5McIsNI2DrCEEt7KYdt0ZIGcqqK2gmCePYI0oQOFj+jznI3jKXg1k2 > R+ngk+cUn21EfrNXFGPk1Tuc1/3Qib6cX6BZRJvvz1FNYNt/zqozBjzmqceZAAUR > tBtUb3RvIDx0b3RvQHNrLnN5bXBhdGljby5jYT6JAJUCBRAzPR6jIokaQ0EgfuUB > ARyWA/9P1UVMvBAGXY488f/Nvs1CZnp/a0SNxELXfpMyJz/Vdd2RuahRYoc50Cbp > F1/QOd4PZeEW2aNT/shxfm3Q9zpxGzyFgy//tEXdw2aedzdT4oMOgDBqMrzc2LfN > 8zWqF5cWJLASIqwbrIkmyZR6LUCxmE79WmgRlQGAHfMwwC3WLYkAlQMFEDOCfw+w > X4yQZvuMZQEBhuYEAJW2pN2aj1m7972GkQvUVBeenWrMqKXNyHF/73+YGZsLLo79 > ApWR1ROm2RgxXJQeHSrUolXhxpkjHe9DJ5GwrsV7m97HfwvM32Vw/32U4T1jyeez > VvBqJQ417UxxYS2QSQZIyLcVojFEJvh/kQ2NFXwTPJ1BscPn4/KnT6DD0u5ciQCV > AwUQM4J+6pfboLn8NWjNAQGTigQAnrFZ8OiAguWqi1LsClKo0t9y+Ly98EPnpBt2 > FgQN9/Z8PSZjPqEn9AJk7Z5TBhGJNXBmkULiuNA9zvGTsRM0S7Oi6/WFUcL9rio6 > gMsxTnDythGaFa5YDQXgXtFxqcjsojGhe922KFnVi4xxatO9vm9Zo3JaNAK8zvg2 > rIrd7VQ= > =MuiR > -----END PGP PUBLIC KEY BLOCK-----

1 0

Mailing List
by Bose 17 Dec '03

17 Dec '03

Put me on your mailing list, please.

1 0

Re: encryption laws
by Steffen Zahn 17 Dec '03

17 Dec '03

On Thu, 15 Jul 1993, Allan Thompson wrote: > Would it be possible for a court to subpeona a encrypted file or key, > and order you to tell them the key ? > If you didn't would you be held in 'contempt of court' ? How about claiming that you used a OTP and then revealing the key? Or should I say a key? Regards Steffen -- home email: domain: berlin.snafu.de, user: zahn To send email to me combine user@domain above to construct my address. Use of my address for unsolicited commercial advertising is forbidden.

4 3

Key Recovery War
by John Young 17 Dec '03

17 Dec '03

A couple of news reports on the Key Recovery critique by Blaze et al from NYT and C|Net: http://jya.com/krnews.htm Both cite Reinsch of BXA's counter-critique. And another report on Sybase getting BXA approval for export of 56-bit crypto without key recovery. However, it's only for data storage not communication. The story also reports that Sybase will be allowed to export 128-bit crypto with a key recovery plan. http://jya.com/krnews2.txt And, baiting another barb, Senator Kerrey has entered the outline of his crypto bill in the Congressional Record, along with a statement on natsec and commerce and privacy need: http://jya.com/kerrey3.txt So the Administration seems to be tickling the market, sending up balloons, wet fingering the air, pulling head out, and so forth, to see who might be induced to succumb to the strategem of bait-and-bribe, trot-line eager minnows of ga-ga commerce in the national interest, ahem, like those survivalist national labs, Bell Labs, Lincoln Labs, Mitres, SAICs, and, their patrons at National Security councils, departments of commerce, defense, state, energy, justice, et al. Tim and Blanc are right, it's no holds barred Dual-Use Civil-National Security War for the nation's goodies, no matter what fur's feigned to outfox the hounds and poachers and encroachers. It would be swell if the NLs truly competed with industry, but not likely with all those federal advisory groups eyeing and spying and lying each other.

1 0

Re: Why I think Jim Bell is getting railroaded
by Hal Finney 17 Dec '03

17 Dec '03

>From what I have read, the elements of the conspiracy offence are a plan to commit a crime involving multiple individuals, and at least one overt act taken in furtherance of the plan. For example, if people get together and plan a kidnapping, then one member goes out and buys some rope, that could be enough to represent conspiracy to commit kidnapping. You don't actually have to do the kidnapping to be convicted on conspiracy. If Bell got together with his friend and talked about disabling government computers with "carbon fibers" (whatever those are), and he then goes out and buys a source of carbon fibers, a case could be made that this would represent the crime of conspiracy. (We don't know yet whether either of these thing actually happened, of course.) Now his lawyer can argue that the conversation was purely hypothetical speculation of the type which technically minded people commonly engage in, and the carbon fiber source (if it exists) was acquired out of curiosity based on the discussion. Then it would be up to the jury to decide whether Bell's actions actually were part of a planned crime or not. In this context his writings and hostile relations with government agencies could conceivably be used against him, if his lawyer did try to argue that his conversations were just innocent speculation. Hal

1 0

Cypherpunk criminalization
by Michael Wilson 17 Dec '03

17 Dec '03

The occasion of Jim Bell's arrest provides an opportunity to consider a number of points: Are Federal Agents Evil? Why is there an attempt to persecute Jim Bell, one that has many similarities to the Olympic Park Bombing rush-to-judgment, Ruby Ridge, Waco, OK City, etc.? Are we to believe that government agents are 'evil,' or True Believers that _we_ (those who are _not_ true believers) are evil? I personally think not. I think we are seeing a phenomenon that is rather simple--government agents will tend to pursue cases that may get them recognition or promotion. People like Jim Bell pass some mobile threshold where their case is media 'hot' or sexy enough to make it worth pursuing--the Feds get a collar and media attention, a prosecutor gets similar benefits, judges are notoriously easy to inflame for the proper paperwork to be obtained, etc. Are the rest of the cypherpunks at risk? Looking at it with my game theorist hat on, I suspect not--while Tim May has been pushing the envelope recently, I don't think he's crossed any line would allow the appearance of a 'good bust,' nor has anyone else on the list (to my direct knowledge). I think we're witnessing a bit of the same mentality that literally did allow the operation of the Nazis--they're just doing their job, just following orders, just being part of their bureaucracy, with perhaps a few True Believers to leaven the mix. Technology vs. Public Relations/Propaganda Cypherpunks write code, we hear it often enough as the credo of the 'movement.' On the other hand, as valuable a social service as it actually has been, the war is being fought on other terms. Crypto has been characterized as 'offensive' technology, in two senses of the term--a regulated weapons technology, and a socially unacceptable act. This manifests in the 'what have you got to hide' mentality, coupled with the trotting out of the Four+ Horsemen. We're losing this part of the war, and the cutting of more code isn't going to help us one bit. We need to turn the public perception around. What we're seeing in this case is a rather rapid erosion of the legal principles of an expectation of privacy (I won't engage in the rather lengthy discussion of this, but I recommend the interested parties do take the time to read in a good law library, or hunt down the materials on the Bork nomination to the Supreme Court). We've become a society that is expected to publicly air our dirty laundry, to march onto a television talk-show and expose our faults, foibles, and felonies. We need to fight back in ways that communicate to Joe Sixpack, also known as the Common Man--we all have secrets, we all have things we don't want people to know. Build the database! Get the testimonials! Let me briefly mention some of the sorts of need for privacy, secrecy, anonymity that are socially acceptable, and which we need to use to reinforce our own message: --AIDS testing; --Illness diagnosis, such as cancer; --Financial information: credit card numbers, bank balances, net worth; --Dropping the dime on crime: mob witnesses, corporations, your noisy neighbor who abuses their kids but owns a shotgun; --Donations to needy causes, but not wanting everyone to have their hand out; --Personal habits: alcoholism, drug use, gambling addiction, sexual preferences; --Common law privileges: confessional, physician or attorney relation to their client. In short, we all have things we want to remain secret, and we certainly don't want them to be 'exposed,' or to fall into the wrong hands. We need to take the issue back from the criminalization of having secrets to a place where crypto is viewed as a defensive technology--we're entitled to it, and our privacy. Crypto vs. the Government This is the biggest area of contention. The cypherpunk case is that strong, unescrowed cryptography is essential--we have no reason to assume that government is our friend (pull out the file of long-term government abuses here, from using the IRS to pursue political targets to the mail-opening programs of the FBI/CIA), and more to the point, this isn't a 'local' issue that is categorized by a singular stance on the part of the U.S. government. The cryptosystems we build and promote are used in places where they protect human rights workers, economic security and competitiveness, privacy, etc. The Internet and the tools are global, so we're on a battlefield that also includes: -Europe, including the Former Soviet Republics and Bosnia, where strong crypto is critical for freedom-loving movements; -Asia, where users of strong crypto use it to prevent competitive intelligence or organized espionage programs from impacting on their business, in particular, from actions of those U.S. 'allies' Japan, Korea, China; -the Middle East, where strong crypto protects human rights workers, businesses, and individuals who have an un-Islamic taste for things like pornography, or news; see 'rogue' States like Iran, but also U.S. 'allies' like Saudi Arabia, Egypt, Israel, Kuwait, etc. And the global battle means that we have to set an example, allow access, and fight those efforts on our own turf (does anyone really think that Asian or European competitive intelligence or espionage efforts don't also take place on American soil?). The U.S. government has made good use of the insinuation that if we have things to hide, then in a free and open democracy, we must be actively engaged in criminal activity. Certainly, strong cryptography of many sorts is being used to protect criminal activity. It is also a principle upon which the American system is based that you don't deprive the rights and freedom of the majority, those who have not committed any crime, merely in an effort to pursue the felonious. This is why you still need a properly executed warrant to search an area which has an expectation of privacy (which _is_ being slowly eroded as a legal principle, which we need to point out as a trend). As Tim May likes to point out, there are an increasing number of laws that individuals can be pursued under, with ever more general levels of interpretation. Convictions make convicts. Bureaucracies tend to grow, seeking more power for themselves, until 'that which is not compulsory is illegal, and that which is not illegal is compulsory.' Students of history are well aware of what comes next in the cycle-- revolution. My only observation on this is that America has always been willing to speed through trend curves, and it looks like she is flooring the accelerator in this case--from growing State, to global Power, to dying Empire. Think of it like an organic system, and like any entity, it reacts poorly to what it rightly views as being a threat to its own survival--cypherpunks among many. Sign me: A Man With Many Secrets and Much to Hide Michael Wilson 5514706(a)mcimail.com

6 9

RFC 2144 on CAST-128 Encryption Algorithms (fwd)
by cpunks＠algebra.com 17 Dec '03

17 Dec '03

plz do not use bcc igor ----- Forwarded message from Adam Shostack ----- >From cpunks(a)manifold.algebra.com Thu May 22 13:12:32 1997 From: Adam Shostack <adam(a)homeport.org> Message-Id: <199705221736.NAA17266(a)homeport.org> Subject: RFC 2144 on CAST-128 Encryption Algorithms (fwd) To: coderpunks(a)toad.com (The Coderpunks list) Date: Thu, 22 May 1997 13:36:16 -0400 (EDT) X-Mailer: ELM [version 2.4ME+ PL27 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-cypherpunks(a)toad.com Precedence: bulk I hadn't seen this mentioned. This is to coderpunks, bcc'd to cypherpunks & cryptography. Adam ------ A new Request for Comments is now available in online RFC libraries. RFC 2144: Title: The CAST-128 Encryption Algorithm Author: C. Adams Date: May 1997 Mailbox: cadams(a)entrust.com Pages: 15 Characters: 37532 Updates/Obsoletes: None URL: ftp://ds.internic.net/rfc/rfc2144.txt There is a need in the Internet community for an unencumbered encryption algorithm with a range of key sizes that can provide security for a variety of cryptographic applications and protocols. This document describes an existing algorithm that can be used to satisfy this requirement. This memo provides information for the Internet community. This memo does not specify an Internet standard of any kind. Distribution of this memo is unlimited. ----- End of forwarded message from Adam Shostack -----

3 4

News from the Front II
by news＠WEBSTER2.ffg.com 17 Dec '03

17 Dec '03

An update to our customers and friends on happenings at ----------------------------------------------------------------------- F O R E F R O N T - Taking the Chaos out of the 'Net http://www.ffg.com Newsletter 5/13/97 ----------------------------------------------------------------------- Contents: I. News from the 'Front II. Hot Tip III. Special Offer ----------------------------------------------------------------------- I. News from the 'Front WebSeeker 3.2 stops information overload! - http://www.ffg.com/seeker/ WebSeeker 3.2 should be your weapon of choice when faced with information overload. The latest version of WebSeeker is even faster than what C|Net already called "blazingly fast!" and you have more control over your search than ever before! Newsflash! Top Publishers Promote WebPrinter - http://www.ffg.com/press/printtheweb.html WebPrinter has become the de facto standard for printing from the Internet. Millions of Internet users will receive WebPrinter, ForeFront's leading Internet printing technology, by year-end. ForeFront begins marketing BMC Software's NetTune Pro - http://www.ffg.com/press/nettune.html Just when you thought they had it all, ForeFront Direct now offers another quality PC/Networking tool. ForeFront Reports First Quarter Earnings. Sales are up 51% over first quarter 1996 - http://www.ffg.com/press/Q1_97Release.html "The sky's the limit!" says Tron Black, Online Sales Director as sales continue to rise at ForeFront. ----------------------------------------------------------------------- II. Tip o' the Day Tired of Task Switching? If you are tired of switching from WebSeeker to your web browser and back, then your day of deliverance has arrived. WebSeeker 3.x detects whether you have Microsoft Internet Explorer installed and embeds Internet Explorer within WebSeeker if you do. To activate this embedded browser, click View/Abstract. Check out this screen shot! - http://www.ffg.com/seeker/images/browser.gif You'll never have to leave WebSeeker again If you don't have WebSeeker 3.2 then buy it now! - http://www.ffg.com/seeker/ If you have an earlier version of WebSeeker then upgrade now! - http://www.ffg.com/seeker/wsupgrade.html Netscape Users - You can use Netscape as your default browser and still take advantage of this feature with IE. Also new in 3.2: Highlight words in any application, hit the FindNow! icon in your tray and WebSeeker will start your search. ----------------------------------------------------------------------- III. Special Offer ForeFront would like to offer you, our V.I.P.'s, a chance to get ALL of our Web products (WebSeeker, WebWhacker, and WebPrinter) at a discount. Get the Web Bundle for only $89.50 for a limited time. - http://store.ffg.com/webbundle/ ----------------------------------------------------------------------- If you wish to unsubscribe from the ForeFront mailing list, please send mail to nonews(a)sldc.ffg.com or go to http://www.ffg.com/press/

1 0