December 2003 - cypherpunks-legacy

Key Recovery / The True Story
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

When Key Recovery and Key Escrow schemes become a fact of life, there will be abuse and fraud of the nature that some on the cypherpunks list have expressed concern about. The grandmother who is arrested for plugging a parking meter will have her computer confiscated so the authorities can search for evidence that her plugging of the meter was pre-planned. Some $20,000/year clerk is going to dip into someone else's funds to support their drug habit. And some government spook is going to break into a church's computer to find out if they are secret terrorists because they oppose this or that government policy. The fact of the matter is, the government is perfectly happy with the citizens' vocal opposition to these possibilities because it provides a convenient smokescreen for the greater import of Key Escrow. They will occasionally pop a Jim Bell, or a "pornographer" to justify their "need" for Key Escrow, but they will let nature take its course until their capacity to monitor everyone, everywhere, all the time, is an accepted fact of life. The real reasons for the push for Key Recovery and Key Escrow are centered on global concerns. World power is acquired and maintained by acquiring and manipulating information and opinion. Countries and companies are helped to rise and fall from prominence. One is supported, another is sabotaged. One politician has his sins covered and another has them exposed. The rich and the powerful have always ruled, no matter what form the government of the day takes. It has always been so. When the government disinformation specialists incite the citizens to fight over pennies, it is to distract them while the rulers steal their dollars. The chaos of the citizen is the friend of the government, so they work to promote a chaos that will meet their needs. They allow us to have our Saviors, but if our J.F.K.'s and our Martin Luther Kings get too powerful, then they are removed. The allow us to have our victories, but there is always a 'rider' attached that takes away yet another of our rights and freedoms. While we fight battles, the government fights wars. Anyone who believes that the attack on Jim Bell is not aimed at the CypherPunks is a fool. While we fight battles, the government fights wars. TruthMonger

1 0

AW: Good book on stegano?
by Hartmut Korth 17 Dec '03

17 Dec '03

Von: Chevreau Sylvain Gesendet: Freitag, 16. Mai 1997 02:37 An: stegano-l Betreff: RE: Good book on stegano? Hi everybody, hi Deepa, 1) Maybe the tutorial/review is being written in some university or company, e.g. for the planed 2nd Int. Workshop on Information Hiding or other publications or internally. Who knows? Because there have been several seperate publications and first compilations in various media in '96 and I haven't yet found any technical paper about steganography published in 1997. Has anybody? My feeling is everybody is reviewing right now! 2) Actually there are already at least 2 BOOKS dedicated to steganography: - "Disappearing cryptography" by Peter Wayner (pcw(a)access.digex.net) the review of which can be found in the CIPHER newsletter #19 (or was it 18?) & #20. [How to get first contact with Cipher, "Newsletter of the IEEE Computer Society's TC on Security and Privacy" : BACK ISSUES: There is an archive that includes each copy distributed so far, in ascii, in files you can download at URL http://www.itd.nrl.navy.mil/ITD/5540/ieee/cipher/cipher-archive.html There is also an anonymous FTP server that contains the same files. To access the archive via anonymous FTP: 1. ftp www.itd.nrl.navy.mil 2. At prompt for ID, enter "anonymous" 3. At prompt for password, enter your actual, full e-mail address 4. Once you are logged in, change to the Cipher Directory: cd pub/cipher 5. Now you can request any of the files containing Cipher issues in ascii. Issues are named in the form: EI#N.9612 where N is the number of the issue desired and 9612 captures the year and month it appeared. ] - "Information Hiding", edited by Ross Anderson, Springer Verlag Proceedings of the 1st International Workshop held in Cambridge, U.K., in May/June 96 Infos at URL http://www.cl.cam.ac.uk/users/rja14 (see section 'Privacy and Freedom issues'). 3) To answer your question anyway, I would advise you to take a look at this nice page I've discovered recently (NEW: it's 1 month old!) : http://www-nt.e-technik.uni-erlangen.de/~hartung/watermarkinglinks.html Thanks to Frank Hartung by the way. Here you will find easily several links to past BIBLIOGRAPHIES for past years, and also have on overview of what's the hell is happening !!! Good readings, Sylvain Sylvain Chevreau ChevreauS(a)tce-rdf.fr for now, ChevreauS(a)thmulti.com from June on.

1 0

Re: Why I think Jim Bell is getting railroaded
by Mix 17 Dec '03

17 Dec '03

>Before charging to the rescue its a good idea to make sure >that you are rescuing the right person. Government agents >also have the right not to be threatened with murder. Threats are illogical. --Sarin

1 0

News about Sun and Elvis
by Kent Crispin 17 Dec '03

17 Dec '03

-----Forwarded message from "Judas, Roland" <rj(a)medos.de>----- From: "Judas, Roland" <rj(a)medos.de> To: "'firewalls(a)greatcircle.com'" <firewalls(a)GreatCircle.COM> Subject: News about Sun and Elvis Date: Thu, 22 May 1997 09:36:44 +0100 X-Mailer: Microsoft Exchange Server Internet Mail Connector Version 4.0.995.52 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Sender: firewalls-owner(a)GreatCircle.COM Precedence: bulk --- White House Reviews Sun's Encryption Initiative --- By John Fontana, Communications Week WASHINGTON-The Clinton administration said it is reviewing the relationship between Sun Microsystems and a Russian company that produces a strong encryption product, which Sun is licensing for worldwide distribution. The White House issued a statement last night, saying, "We are reviewing our regulatory posture with Sun to ensure that their arrangement with the Russian encryption company is in compliance with U.S. export controls." The Department of Commerce, which is responsible for export regulations on strong encryption, stressed that the administration was reviewing the relationship and not conducting an investigation, a spokesman said. Last week, Sun, in Mountain View, Calif., told Communications Week that it had licensed an encryption product from Moscow, Russia-based Elvis+ Co., which offers 128-bit keys and would resell it worldwide under the name PC Sunscreen SKIP Elvis+. Sun has approximately a 10 percent equity stake in Elvis+, whose product is based on Sun's Simple Key Management for IP (SKIP) protocol. The specification was published nearly two years ago. Humphrey Polanen, general manager of Sun's security and electronic commerce group, was confident the government would find Sun "in full compliance with the letter of the law." He said a key factor was that Sun offered no technical assistance in the development of the software. U.S. law bars the export of encryption over 56 bits without government approval. Companies seeking to export 56-bit products must also have a system in place within two years for key recovery. Netscape Communications, also of Mountain View, has followed that path with its browser software, but Sun has neither government approval nor a method to recover keys. The administration wants access to keys in cases of criminal investigations. It is concerned that strong encryption products could fall into the hands of terrorists, even though similar products are available from nearly 30 foreign companies. The statement from the White House also said it had not evaluated the product and could not comment on it. If found in violation of export controls, Sun could face civil and/or criminal penalties. Criminal penalties, which would be handed out by the Justice Department, could mean Sun executive officers would spend time in a federal prison. At press time, Sun had not seen the announcement and would not comment. "The administration may have to go after Sun to protect the integrity of its policy," said Marc Rotenberg, the director of the Electronic Privacy Information Center. "You might see the ,Zimmerman effect,' which would be tremendous public sympathy." Rotenberg is referring to Phillip Zimmerman, who won a battle with the government over his Pretty Good Privacy encryption product, which was distributed free over the Internet. "The White House is at risk by going after a U.S. company for making a good product," Rotenberg said. "This is one more reason to think the administration's cryptography policy is not long for this world." Three bills attacking the administration's policy are being discussed on Capitol Hill, but only one, the Security and Freedom through Encryption Act, has made it out of committee. The bill, which was authored by Rep. Bob Goodlatte (R-Va), would prohibit mandatory key recovery. President Clinton is opposed to the bill in its current form. -----End of forwarded message----- -- Kent Crispin "No reason to get excited", kent(a)songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html

1 0

Compelling a key (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi Tim, And here I was believing your speal about being in your kill file, oh well. It must be true that nothing is sacred. Forwarded message: > Date: Tue, 20 May 1997 22:33:35 -0800 > From: Tim May <tcmay(a)got.net> > Subject: Compelling a key > >> Would it be possible for a court to subpeona a encrypted file or key, > >> > >> and order you to tell them the key ? > >> If you didn't would you be held in 'contempt of court' ? > > > >If they had reasonable cause to believe you had knowledge of the key and > >were refusing to divulge it under direct order of the court you would be > >held in contempt until you were very old and gray. > > Not necessarily. Mike Godwin, and others, have written about the > "compelling of keys." It is by no means clear that a key can be compelled. > Citing the Fifth is one approach, saying one "forgot" is another. Citing the 5th ONLY works if no immunity from prosecution for the results is offered. If the judge offers and you refuse, don't worry about buying toothpaste for many years. Saying you 'forgot' will not keep you out of jail on contempt. It might buy you sympathy from the jury but then again, they have nothing to say about contempt charges. > As to being held indefinitely, imprisonment as an inducement to cooperation > has limits. (I just saw a spiel by Alan Dershowitz and others on this > tonight, vis-a-vis how long Susan McDougal can be imprisoned for contempt > in the Whitewater investigation.) > > Basically, only until there is no reasonable expectation that the contempt > will be satisfied (or whatever the exact term is). > > In practice, I think the Washington, D.C. doctor, Elizabeth X, the woman > who refused to say where her children were, was held for about 2 years, and > that this was the all-time record for a contempt case. She was ultimately > released when the court concluded she had no intention of cooperating. Exactly! It is ENTIRELY up to the individual judge who issued the contempt citation. If they are pissed enough 2 years will be nothing. As far as I have been able to find there are NO statutes, other than that of a statute of limitation for a particular type of crime, that limit how long you can sit in jail on contempt. The only way you would get out in that case would be to file with the appropriate courts for a writ of habeas corpus. Jim Choate CyberTects ravage(a)ssz.com

3 2

Re: spam is a good thing (was Re: Spam IS Free Speech)
by Ross Wright 17 Dec '03

17 Dec '03

On or About 22 May 97 at 13:11, William H. Geiger III wrote: > If given the choice between 2 evils of receiving Spamford > Cyber-momo's crap or going to a metered rate INet I choose Spamford > as the second will not get rid of him. There we go! The all American strive for compromise. Yet, very few people are willing to compromise on this issue, for some reason. I'd like for more people just give it up and come to the realization that the INet is going to be commercial, and no laws can stifle the commerce that goes on here. Or stop Spam. Ross =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: (408) 259-2795

1 0

from BoS: News about Sun and Elvis+
by Robert Hettinga 17 Dec '03

17 Dec '03

>From the "other shoe" department... Cheers, Bob Hettinga --- begin forwarded text X-Authentication-Warning: jekyll.piermont.com: [[UNIX: localhost]] didn't use HELO protocol To: cryptography(a)c2.net Subject: from BoS: News about Sun and Elvis+ Date: Thu, 22 May 1997 12:58:06 -0400 From: "Perry E. Metzger" <perry(a)piermont.com> Sender: owner-cryptography(a)c2.net I thought this would be of interest. ------- Forwarded Message From: "Judas, Roland" <rj(a)medos.de> Date: Thu, 22 May 1997 09:36:44 +0100 To: best-of-security(a)suburbia.net Subject: BoS: News about Sun and Elvis - --- White House Reviews Sun's Encryption Initiative --- By John Fontana, Communications Week WASHINGTON-The Clinton administration said it is reviewing the relationship between Sun Microsystems and a Russian company that produces a strong encryption product, which Sun is licensing for worldwide distribution. The White House issued a statement last night, saying, "We are reviewing our regulatory posture with Sun to ensure that their arrangement with the Russian encryption company is in compliance with U.S. export controls." The Department of Commerce, which is responsible for export regulations on strong encryption, stressed that the administration was reviewing the relationship and not conducting an investigation, a spokesman said. Last week, Sun, in Mountain View, Calif., told Communications Week that it had licensed an encryption product from Moscow, Russia-based Elvis+ Co., which offers 128-bit keys and would resell it worldwide under the name PC Sunscreen SKIP Elvis+. Sun has approximately a 10 percent equity stake in Elvis+, whose product is based on Sun's Simple Key Management for IP (SKIP) protocol. The specification was published nearly two years ago. Humphrey Polanen, general manager of Sun's security and electronic commerce group, was confident the government would find Sun "in full compliance with the letter of the law." He said a key factor was that Sun offered no technical assistance in the development of the software. U.S. law bars the export of encryption over 56 bits without government approval. Companies seeking to export 56-bit products must also have a system in place within two years for key recovery. Netscape Communications, also of Mountain View, has followed that path with its browser software, but Sun has neither government approval nor a method to recover keys. The administration wants access to keys in cases of criminal investigations. It is concerned that strong encryption products could fall into the hands of terrorists, even though similar products are available from nearly 30 foreign companies. The statement from the White House also said it had not evaluated the product and could not comment on it. If found in violation of export controls, Sun could face civil and/or criminal penalties. Criminal penalties, which would be handed out by the Justice Department, could mean Sun executive officers would spend time in a federal prison. At press time, Sun had not seen the announcement and would not comment. "The administration may have to go after Sun to protect the integrity of its policy," said Marc Rotenberg, the director of the Electronic Privacy Information Center. "You might see the ,Zimmerman effect,' which would be tremendous public sympathy." Rotenberg is referring to Phillip Zimmerman, who won a battle with the government over his Pretty Good Privacy encryption product, which was distributed free over the Internet. "The White House is at risk by going after a U.S. company for making a good product," Rotenberg said. "This is one more reason to think the administration's cryptography policy is not long for this world." Three bills attacking the administration's policy are being discussed on Capitol Hill, but only one, the Security and Freedom through Encryption Act, has made it out of committee. The bill, which was authored by Rep. Bob Goodlatte (R-Va), would prohibit mandatory key recovery. President Clinton is opposed to the bill in its current form. ------- End of Forwarded Message --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Cypherpunk criminalization
by Michael Wilson 17 Dec '03

17 Dec '03

The occasion of Jim Bell's arrest provides an opportunity to consider a number of points: Are Federal Agents Evil? Why is there an attempt to persecute Jim Bell, one that has many similarities to the Olympic Park Bombing rush-to-judgment, Ruby Ridge, Waco, OK City, etc.? Are we to believe that government agents are 'evil,' or True Believers that _we_ (those who are _not_ true believers) are evil? I personally think not. I think we are seeing a phenomenon that is rather simple--government agents will tend to pursue cases that may get them recognition or promotion. People like Jim Bell pass some mobile threshold where their case is media 'hot' or sexy enough to make it worth pursuing--the Feds get a collar and media attention, a prosecutor gets similar benefits, judges are notoriously easy to inflame for the proper paperwork to be obtained, etc. Are the rest of the cypherpunks at risk? Looking at it with my game theorist hat on, I suspect not--while Tim May has been pushing the envelope recently, I don't think he's crossed any line would allow the appearance of a 'good bust,' nor has anyone else on the list (to my direct knowledge). I think we're witnessing a bit of the same mentality that literally did allow the operation of the Nazis--they're just doing their job, just following orders, just being part of their bureaucracy, with perhaps a few True Believers to leaven the mix. Technology vs. Public Relations/Propaganda Cypherpunks write code, we hear it often enough as the credo of the 'movement.' On the other hand, as valuable a social service as it actually has been, the war is being fought on other terms. Crypto has been characterized as 'offensive' technology, in two senses of the term--a regulated weapons technology, and a socially unacceptable act. This manifests in the 'what have you got to hide' mentality, coupled with the trotting out of the Four+ Horsemen. We're losing this part of the war, and the cutting of more code isn't going to help us one bit. We need to turn the public perception around. What we're seeing in this case is a rather rapid erosion of the legal principles of an expectation of privacy (I won't engage in the rather lengthy discussion of this, but I recommend the interested parties do take the time to read in a good law library, or hunt down the materials on the Bork nomination to the Supreme Court). We've become a society that is expected to publicly air our dirty laundry, to march onto a television talk-show and expose our faults, foibles, and felonies. We need to fight back in ways that communicate to Joe Sixpack, also known as the Common Man--we all have secrets, we all have things we don't want people to know. Build the database! Get the testimonials! Let me briefly mention some of the sorts of need for privacy, secrecy, anonymity that are socially acceptable, and which we need to use to reinforce our own message: --AIDS testing; --Illness diagnosis, such as cancer; --Financial information: credit card numbers, bank balances, net worth; --Dropping the dime on crime: mob witnesses, corporations, your noisy neighbor who abuses their kids but owns a shotgun; --Donations to needy causes, but not wanting everyone to have their hand out; --Personal habits: alcoholism, drug use, gambling addiction, sexual preferences; --Common law privileges: confessional, physician or attorney relation to their client. In short, we all have things we want to remain secret, and we certainly don't want them to be 'exposed,' or to fall into the wrong hands. We need to take the issue back from the criminalization of having secrets to a place where crypto is viewed as a defensive technology--we're entitled to it, and our privacy. Crypto vs. the Government This is the biggest area of contention. The cypherpunk case is that strong, unescrowed cryptography is essential--we have no reason to assume that government is our friend (pull out the file of long-term government abuses here, from using the IRS to pursue political targets to the mail-opening programs of the FBI/CIA), and more to the point, this isn't a 'local' issue that is categorized by a singular stance on the part of the U.S. government. The cryptosystems we build and promote are used in places where they protect human rights workers, economic security and competitiveness, privacy, etc. The Internet and the tools are global, so we're on a battlefield that also includes: -Europe, including the Former Soviet Republics and Bosnia, where strong crypto is critical for freedom-loving movements; -Asia, where users of strong crypto use it to prevent competitive intelligence or organized espionage programs from impacting on their business, in particular, from actions of those U.S. 'allies' Japan, Korea, China; -the Middle East, where strong crypto protects human rights workers, businesses, and individuals who have an un-Islamic taste for things like pornography, or news; see 'rogue' States like Iran, but also U.S. 'allies' like Saudi Arabia, Egypt, Israel, Kuwait, etc. And the global battle means that we have to set an example, allow access, and fight those efforts on our own turf (does anyone really think that Asian or European competitive intelligence or espionage efforts don't also take place on American soil?). The U.S. government has made good use of the insinuation that if we have things to hide, then in a free and open democracy, we must be actively engaged in criminal activity. Certainly, strong cryptography of many sorts is being used to protect criminal activity. It is also a principle upon which the American system is based that you don't deprive the rights and freedom of the majority, those who have not committed any crime, merely in an effort to pursue the felonious. This is why you still need a properly executed warrant to search an area which has an expectation of privacy (which _is_ being slowly eroded as a legal principle, which we need to point out as a trend). As Tim May likes to point out, there are an increasing number of laws that individuals can be pursued under, with ever more general levels of interpretation. Convictions make convicts. Bureaucracies tend to grow, seeking more power for themselves, until 'that which is not compulsory is illegal, and that which is not illegal is compulsory.' Students of history are well aware of what comes next in the cycle-- revolution. My only observation on this is that America has always been willing to speed through trend curves, and it looks like she is flooring the accelerator in this case--from growing State, to global Power, to dying Empire. Think of it like an organic system, and like any entity, it reacts poorly to what it rightly views as being a threat to its own survival--cypherpunks among many. Sign me: A Man With Many Secrets and Much to Hide Michael Wilson 5514706(a)mcimail.com

6 9

ecash & remailers
by Adam Back 17 Dec '03

17 Dec '03

It occurs to me that there is a problem with remailers using Chaum's ecash as offered by MT bank and others. The attacker could coerce the sender of an anonymous message into revealing his blinding value, and use this to obtain the identity of each remailer hop by colluding with the bank. (The bank keeps a database of the blinded coins minted against who they were given to; unblinding reveals the coin which can then be compared against those deposited by remailers, tallying sender with remailer, all the way to the exit remailer.) To stop this, the sender should discard the blinding values, thereby removing his ability to be later coerced, or to later trace the recipient of his cash. Is there a way to purge blinding values from the ecash directory? Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

2 1

Western Union & IRS
by Ray Arachelian 17 Dec '03

17 Dec '03

I donno if this is news or not, but having just visited one of these places, I noticed prominently place warning signs that transfers over $3K are reported to the IRS including your SSN, effective May 28 of this year or something... =====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "Boy meets beer. Boy drinks Beer, |./|\. ..\|/..|sunder(a)sundernet.com| Boy gets another beer!" |/\|/\ <--*-->| ------------------ | |\/|\/ ../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/. .+.v.+.|God of screwdrivers"| strange aeons, even death may die. |..... ======================== http://www.sundernet.com =========================

1 0