December 2003 - cypherpunks-legacy

Wine Politics Again!
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: mcooley(a)pop.tiac.net Date: Thu, 08 May 1997 22:25:28 To: dcsb(a)ai.mit.edu From: Marianne Cooley <mcooley(a)nethorizons.com> Subject: Wine Politics Again! Mime-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Marianne Cooley <mcooley(a)nethorizons.com> This one is not just an Internet message. In fact, I should probably take it to my marketing list ;)--but just to keep y'all up to date with the latest commerce developments. Marianne forwarded message: Hello friends of the Virtual Vineyards and family wineries. Remember the felony direct shipping law in Georgia I wrote about a few weeks ago? Well, Governor Miller signed it, unfortunately. Ship a bottle of wine, go to jail. Amazing. Here it is again, this time in Florida. The wholesale liquor lobby is pushing a bill through the state houses making it a felony to ship a bottle of wine to a Florida consumer. If you believe, as we do, that this is unreasonable restraint of legitimate commerce, please register your opposition directly with Governor Chiles. This is not just a Florida issue, as other states are watching the development of such laws very closely. If you have friends in Florida please pass this on to them and urge them to act quickly. The bill will soon be on the governor's desk. Here is a sample letter for Governor Chiles with several ways to contact him. Personalize it if you wish, or send it as is: E-Mail: chilesl(a)eog.state.fl.us Fax: 904-487-0801 Phone: 904-488-4441 Governor Lawton Chiles Office of the Governor Florida State Capitol, Talahassee, Florida 32399-0001 Dear Governor Chiles: I call upon you to veto HB 725 (SB336), the felony direct shipment bill. This bill is sponsored by the state's Liquor wholesalers in order to protect their monopoly on wine sold to Florida consumers. Out-of-state sellers of wine support Florida Attorney General Butterworth's counter-proposal, and are willing to register with Florida, pay state excise and sales taxes and assure that all Florida laws protecting minors are observed. If HB 725 becomes law, Florida wine consumers' choices of products will be narrowly limited to the few wines represented by the Liquor wholesalers and Florida itself will be making a statement that small family winegrape growers and wineries in over 40 states deserve to go to jail, and lose their farms and vineyards, if they ship a bottle of wine to a customer who happens to reside in Florida. HB 725 is hostile to consumers and agriculture. I urge you to use your veto. Sincerely yours, Peter D. Granoff, M.S./Virtual Vineyards http://www.virtualvin.com 800-289-1275 415-938-9463 415-919-1977 fax 3803 East Bayshore Rd., Suite 175 Palo Alto, CA 94303 ********************************************************************* Marianne Cooley Internet Special Interest Group NetHorizons Unlimited SigNet.org--where online users meet mcooley(a)nethorizons.com http://www.signet.org 617.433.0825 Join "Life at Internet Speed" on www.boston.com Wednesdays from 1-2pm! For a chat topic reminder, send an email to majordomo(a)signet.org and write "subscribe life" (no quotation marks) in the body of the message. ********************************************************************** ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from the dcsb list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

4 3

Admin Feigns Back Off On Crypto Bill
by John Young 17 Dec '03

17 Dec '03

News report today: Reinsch told reporters that strategy will be to follow advice he has been given and not to circulate Administration draft bill. Issue is so polarized, he said, that that bill would be dismissed quickly, and some of its content that lawmakers might want to adopt also would be rejected because it came from Administration. Reinsch said it's close call, and Administration is reevaluating its tactics constantly. This seems to coordinate with Kerrey's initiative to lump all crypto bills into one "acceptable to the leadership and the White House." http://jya.com/backoff.htm BTW, another report claims that proposed new regs will allow banks the special privilege of strong crypto if they come up with an acceptable KMI within two years. This seems to be what Kerrey means when he says NSA's Crowell is working with industry to develop an acceptable KMI along the lines of what government is preparing for its own use. All interests to be subservient to the Number One interest?

2 1

El Gamal
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- aba(a)dcs.ex.ac.uk wrote: >PGP has been standardising on El Gamal which is not covered by RSA's >patents, for precisely the reason that RSA Inc has a bad record as a >litigious patent worker. El Gamal is a variant of Diffie-Hellman, >and the patents on Diffie-Hellman are set to expire RSN (later this >year, Sept?) How does El Gamal compare functionally and security-wise to RSA and who developed it? >I think that the initial PGP products are using RSA, however I >understood PGP is moving to El Gamal, where RSA is due to be >relegated to a `for backwards compatibility only' feature. Is El Gamal used in the source for PGP 3.0? Ciao Harka -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBM3JpGjltEBIEF0MBAQFDfQf8CawUGU1ynDlmcmsloy7zsh5oQUhcxPSv Luy17oVmbWVeCWpCbqqiWFoRh1+QzBBc8Yfbb2/2LOw1KFyIq5lQ8Ly64JPuVMgV HUocUDnPE7Q18eVVXOfNyG6vg/s0PBRqREVrx1QWn37idPduMTg0TE/IHZqFVrso 3XdVroh41aX7qVnan2+nRnVCbrV9xMvNteWOUl/nADLHCAkoMl/eCcQVY/XSmFjc SsUbNNgCDBJlZhAwAI/CBLM7CBVt4okZQkdKeLNWsrm1tG2yha7vl/2AI6k1Y70H 2g1zTrhqK7q/rqkNL6DKyam/NZ1FKXtO0BsTLsV6KqmI7SnGN4UZXw== =f4Qu -----END PGP SIGNATURE-----

6 7

Stego Cash?
by kqb＠planet.net 17 Dec '03

17 Dec '03

Previous Subject: Re: Clinton Admin. to announce new Crypto regs Rick Smith <smith(a)securecomputing.com> said: > These "new" regulations "to be issued" are scrambling to catch up with > previous and current practices. It doesn't change things at all. > . . . > Export permission for strong crypto that only encrypts financial data is > clearly a variant of this tradition. This raises an intriguing possibility that I am sure is _not_ intended by the regulators. If the cash is cheap enough, perhaps it could be an economical carrier of encrypted messages. What I have in mind is somewhat analogous to papering your wall with dollar bills, which clearly is uneconomical unless the dollar bills are really cheap. What does it take to set up an offshore "remailer bank"? Of course, the digital cash it uses must be very INefficient, chock full of bit bloat that hosts plenty of not-so-subliminal channels. 8-) Kevin Q. Brown kqb(a)planet.net

3 2

Spam Update/Cyber Promo attacked
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 Date: Wed, 7 May 1997 13:24:57 +0200 Reply-To: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> Sender: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> From: Wendy Leibowitz <wendyl(a)LJEXTRA.COM> Subject: Spam Update/Cyber Promo attacked To: CYBERIA-L(a)LISTSERV.AOL.COM While aware of the irony of sending an unsolicited message from Cyber Promotions to a large group of people, this bulletin just arrived from our friends at Cyber: PHILADELPHIA, 5-7-97 Bulk e-mail giant Cyber Promotions is under attack by "anti-spam" hackers. This concentrated attack was planned for several weeks, and has been publicly discussed on Internet newsgroups. The hackers are using a brand new method to deny service to all Cyber Promotions' computers hooked to a main router on an AGIS line. The hackers have devised a system which sends millions of random "arp" requests to a router, which can disable the whole network for hours. This type of attack has never occurred before. Currently thousands of businesses with web pages and mail box accounts are being denied service. The attack began yesterday around 4 PM Eastern, and is still occurring at press time. But the [source of the] attack is traceable with the help of a backbone provider and computer security specialists. The longer it occurs, the easier it is to trace it back to the hacker. Cyber Promotions will work in conjunction with federal authorities to prosecute the criminals. ....... This latest attack is occurring, by no coincidence, on the same day that Cyber Promotions, AGIS and several bulk e-mailers scheduled a press conference in Las Vegas to discuss the formation of a new association which will enforce a universal "don not send" list along with many other ethical bulk e-mail standards. ........... It goes on, but I need to ponder the meaning of "ethical bulk e-mail standards." Wendy R. Leibowitz, Technology Editor National Law Journal 345 Park Ave. South New York, NY 10010 E-mail: wendyl(a)ljextra.com "Remember, even pencils break." --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

9 25

Re: key recovery vs data backup
by Kent Crispin 17 Dec '03

17 Dec '03

On Wed, May 07, 1997 at 09:56:21PM -0700, Lucky Green wrote: > At 11:47 PM 5/7/97 -0400, Carl Ellison wrote: > >I was saying that if Sam needs to read my encrypted file/mail, then I should > >list Sam as a crypto-recipient. If Acme,Inc. needs to read my encrypted > >file/mail, then I should list Acme,Inc. as a crypto-recipient. > > > >There's no safe of keys. It's even simpler to explain to an executive. > > Several people on this list asked me to elaborate on my claim that KR is > not required. I doubt that I could put it more succinctly than Carl has in > his post. Unfortunately, it doesn't solve the problem at all. In fact it doesn't even address the problem. So much so that reading these replies makes me think that I am looking at different problem than you. So perhaps backing up to discuss the problem a bit would be helpful. I hope you will forgive me if this is old ground. The problem is key management for an organization. The keys are used to protect and authenticate data owned, not by any individual, but by an organization. Keys are generated for the organization's purposes, not the purposes of any individual. Furthermore, the individual privacy of an individual who works for an organization is not a necessary priority for the organization. Organizations are composed of many individuals, some of which may not share the goals of the organization, or who may indeed be inimical to the organization. And the members of an organization may vary widely in competence, personal responsibility, and so on. Thus, the members of an organization cannot be trusted to do the "right thing". [I am using "organization" in a loose sense, so that we can consider a business an organization, and an employee as a member of that organization.] In fact, in most cases, only a small fraction of the members of an organization care more about the welfare of the organization than about their personal welfare. So people will almost always be more concerned about their own personal data security than they will for that of an organization. This, coupled with difficulties of coordination and control, and the above conditions, means that in a global sense information security for an organization will always be difficult, regardless of the security of the crypto they use. For a moment consider the analogy with physical keys. Consider the key management problem of a moderate sized corporation that occupies a large office building. There are office keys, storeroom keys, supply room keys, conference room keys, bathroom keys, keys to filing cabinets -- there are *lots* of keys, lots of different delegations of authority involved. In many cases there is a "key czar", a "building coordinator" that hands out keys, and gets them back when someone changes offices or jobs. It *has* to be this way -- you can't rekey the entire building when a janitor quites. So, occasionally it is necessary to rekey a lock, but typically keys are just reused. Many office keys are designed to be difficult to casually duplicate, for this reason. Of course any key *can* be duplicated, but that's not really that important -- the building is full of employees during the day, and the night watchman checks each person that enters after normal hours. All these physical keys all fit locks that can be broken quite easily -- there is essentially *no* possibility of something valuable being lost behind a lock that cannot be broken. This is vastly different from cryptographic keys -- for all systems of interest, encryption represents locks that cannot be broken. Data behind a lost cryptographic key is gone forever. You can't call a locksmith or a safe cracker. It's really just gone. With this background, perhaps now you can see why I say that Carl's solution doesn't even address the problem. The problem is management of complexity. Carl says "encrypt to Acme Corp". Who in Acme Corp? What part of the organization that is Acme Corp is authorized to know this particular bit of information? Because some of the employees are idiots you want this built automatically into the application they are using for encryption/email/whatever. How does this software know what policy is appropriate for which employee? How is that policy distributed? What is the interface that allows a policy to be defined? How do you protect the policy definition from subversion? Contrast that with a key-safe model, where a copy of every encryption key is kept in a secure database. The encryption client software only talks to the key-safe when a new key is generated, over a cryptographically secure channel, of course. There is no policy the client has to know. The user encrypts freely without concern about who else should get copies. The organization knows that there is very little chance of data loss because of lost keys, and can use any policy it chooses to recover keys, from the company president's ad hoc whim to a carefully specified organization al security policy. Access to the key-safe is critical, of course, but it can be made very secure -- a special-purpose piece of hardware that requires passwords from n out of m key czars before access is granted, for example. Or the contents of the key safe can be encrypted via keys escrowed through a secret sharing mechanism -- Kent Crispin "No reason to get excited", kent(a)songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html

3 10

Response to "SAFE bill and cutting crypto-deals"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 14 May 1997 23:00:17 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Response to "SAFE bill and cutting crypto-deals" ******* Date: Thu, 15 May 1997 01:56:20 -0400 From: Jason Gull <jgull(a)UMICH.EDU> While I don't particularly like this segment of the proposed bill either, I think Declan is engaging in some minor hyperbole when he says "this language has no business becoming law." We already have federal laws which make the use of a telephone or the mails to commit a felony into an additional offense, so this provision -- quite similar to obstruction of evidence, from the look of it -- doesn't seem at odds with precedent. With so many "hurdles," as Declan puts it, the language seems tailored to the specific case where incriminating information is encrypted solely to evade law enforcement and (like the passing of incriminating information to one's attorney in an attempt to make it "privileged") it doesn't seem outlandish to think that such conduct ought to be criminalized. Granted, there's the danger of the "slippery slope" -- that allowing any restrictions on crypto will lead to a gradual encroachment of government into other uses of cryptography. However, whether or not it is a good idea or not, politics and previosu law seem to firmly support such a provision. -Jason Gull jgull(a)umich.edu

1 0

Re: Just Say "No" to Congress
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

At 09:13 AM 5/14/97 -0800, Tim May wrote: >We're basically under assault from all directions. The bozos in Congress >and state governments are spinning out new laws and obscure regulations >faster than we can react...and of course they're using our money to >generate these laws and lobby for them. Further, a mostly-brainwashed >Washington media population is surprising uncritical of these blizzard >drifts of new laws. ... >The "there ought to be a law" crowd is in high gear. I seem to recall a proposal from the late 19th century suggesting that the Patent Office be closed because there was nothing left to invent. In a similar, but more serious vein, I think Congress should be shut down, because there are no new laws that we need. Excepting, of course, my earlier anonymous suggestion that children be kept from "soft targets". I'm not a TruthMonger, but I play one on T.V.

1 0

Sweeps Week in Portland
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

News from the Beirut of the West: The FBI, in cooperation with the Portland police and the TV show "Cops" is ending a six month survelence project of downtown Portland. Tonight, armed with large books containing pictures of suspects, they have congregated in the center of town arresting all of those caught in their video web. Over the last 6-8 hours they have been arresting hundreds of suspects in the downtown area. The arrests are a "show of force" in the downtown area. The police used to watch over the people. Now they are watching the people. Expect to see similar activity in the town where you live. "Be seeing you!" DonutMonger #666

1 0

Sweeps Week in Portland
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

News from the Beirut of the West: The FBI, in cooperation with the Portland police and the TV show "Cops" is ending a six month survelence project of downtown Portland. Tonight, armed with large books containing pictures of suspects, they have congregated in the center of town arresting all of those caught in their video web. Over the last 6-8 hours they have been arresting hundreds of suspects in the downtown area. The arrests are a "show of force" in the downtown area. The police used to watch over the people. Now they are watching the people. Expect to see similar activity in the town where you live. "Be seeing you!" DonutMonger #666

1 0