December 2003 - cypherpunks-legacy

For Whom the Bell Tolls
by mpd＠netcom.com 17 Dec '03

17 Dec '03

The current troubles for Jim Bell, and the representation in government affidavits that casual speculation with friends over infrastructure vulnerabilities constituted some sort of conspiracy to do harm, should make all Cypherpunks nervous. Indeed, such discussions about vulnerabilities and risks have been a central theme of this mailing list over the years. I hope I don't wake up tomorrow morning to headlines in the Seattle Times reading "Atomic Force Microscope Central in Duvos Smartcard Plot" or some equally silly thing, based on an out-of-context grep of the Web archives. It is unfortunate that in a country which advertises itself as some sort of bastion of free speech, one must constantly guard ones speech to make sure that it contains no snippets suitable for an inflammatory sound byte on the evening news. Just another of the many manifestations of "The Policeman Inside." -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

2 1

DES search making serious progress
by Lucky Green 17 Dec '03

17 Dec '03

Folks, The DES key search is making serious progress. The leading contender seems to be DESCHALL http://www.frii.com/~rcv/deschall.htm They are currently searching >3.5 billion keys per second. Estimated time to completion is 14 weeks. It is no longer a question if the key will be found. We now need to make sure that it is found as quickly as possible. Please download and run the software. Thanks, -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred

1 0

Re: referers and W3 (fwd)
by Hal Finney 17 Dec '03

17 Dec '03

Eric Murray, <ericm(a)lne.com>, writes, regarding Referer spoofing: > What would make sense to use, other than sending > "http://this/is/a/bogus/referrer/sent/to/mess/up/your/stats"? > How about sending the current URL as Referrer? One practical idea would be to set up the config file so that whenever URL X is referenced, specified URL Y is sent as the referer. This could be useful for accessing web sites which won't show you information unless (or if) they see a certain value in the referer field. Hal

1 0

Sun Sells Encryption Software Overseas, Skirting U.S. Policy
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Tomorrow's Wall Street Journal: http://interactive3.wsj.com/edition/current/articles/SB863997652645676500.h… Sun Sells Encryption Software Overseas, Skirting U.S. Policy By DAVID BANK Staff Reporter of THE WALL STREET JOURNAL MOUNTAIN VIEW, Calif. -- Sun Microsystems Inc. plans to sell advanced data-security software from a Russian supplier to overseas customers, a move that skirts U.S. export regulations and is likely to receive close U.S. government scrutiny. Sun is expected to announce Monday that it will sell encryption software licensed from Elvis+ Co., a company formed by scientists from the former Soviet space program. Sun I actually think that Elvis+ is mostly composed of the former KGB scientists, not space scientists. I may be mistaken though. -- igor has a 10% equity stake in the Russian firm. The Elvis+ products will be shipped to overseas customers from Sun distributors in third countries to keep them from falling under U.S. jurisdiction. Sun's move illustrates how global market pressures are making it increasingly difficult for U.S. officials to control the spread of advanced encryption hardware and software. The technology, which scrambles data to protect it from computer eavesdroppers, is considered vital to the growth of electronic commerce. But export of powerful encryption products is barred under U.S. export-control laws, on grounds that terrorists and others will use it to evade surveillance. Challenge to U.S. Policy The Sun action will cause the Clinton administration to face a difficult decision, said Jim Bidzos, president and chief executive of RSA Data Security Inc., a unit of Cambridge, Mass.-based Security Dynamics Technologies Inc., a major supplier of encryption technology. "The government has to shut this down, or else the competitors of Sun probably have to say, 'We're going to do the same thing,' " he said. Mr. Bidzos, a long-time critic of the export controls, praised Sun's move as "blatant and in-your-face." An administration official said Sunday the White House didn't have enough information to comment. Computer-industry executives, concerned that they could lose a valuable market to foreign competition, have long discussed strategies to exploit loopholes in the export laws. But Sun appears to be the first major company to use foreign software to supply overseas customers. Sun executives said they hadn't discussed the plans with U.S. government officials but had strictly adhered to current laws. "This is not being done to subvert export-control laws but to deliver solutions to customers," said Humphrey Polanen, general manager of Sun's network-security products group. "Never before have organizations outside of the United States had access to such advanced security software." Privacy advocates said Sun's initiative would boost their goal of making high-strength encryption widely available. "We think the benefit for security outweighs the liability for law enforcement," said Jerry Berman, executive director of the Center for Democracy and Technology in Washington, D.C. Critical Distinction Elvis+ is based in Zelenograd, a Moscow suburb that was once known as the "Soviet Silicon Valley." The company's products are based on a security protocol called SKIP that was developed by Sun, but Sun says it provided no technical assistance to the Russian company. The distinction is crucial; the export controls cover any product developed with such assistance from a U.S. company. The product, which will be marketed under the name SunScreen SKIP E, employs various encryption algorithms, or formulas, including so-called three-key triple DES and 128-bit ciphers, which security experts consider to be virtually unbreakable. The algorithms, in wide use within the U.S., are used to scramble digital communications; in general, the longer the bit length of the encryption key, the more difficult the code is to break. Current export controls allow the export of cryptography keys up to 40 bits, which have been cracked by computer hackers in as little as 10 minutes. Companies with special approval from the Commerce Department have recently begun exporting 56-bit encryption software, but customers have been clamoring for much stronger keys. Global Competition The restriction on U.S. exports has opened market opportunities for strong encryption products from foreign competitors, including Germany's Brokat Informationssysteme GmbH and Siemens Nixdorf Informationssysteme AG, a unit of Siemens AG. "Sun's announcement is further evidence that current U.S. policy is forcing companies to look overseas to obtain strong encryption," said Edward Black, president of the Computer and Communications Industry Association, a Washington D.C., trade group that is lobbying for relaxation of the export controls. Last year, RSA Data Security announced plans to fund an effort by Chinese government scientists to develop strong encryption technology, but the effort has stalled, Mr. Bidzos said. RSA now sends legally exportable products to its Japanese subsidiary, RSA Japan, for bundling with Japanese encryption software. "I can't just let this world-wide global electronic-commerce market take off without participating," Mr. Bidzos said. Sun's Mr. Polanen said SunScreen SKIP E+ will work with other products based on the SKIP protocols. A commercial version will be available in August; evaluation copies are available for download from an Elvis+ site on the World Wide Web. The software will be priced at $99 for versions that run on Microsoft Corp.'s Windows 3.1 and Windows 95 operating systems and at $149 for the Windows NT version.

1 0

Jim Bell News
by John Young 17 Dec '03

17 Dec '03

John Painter, the Oregonian reporter of Jim Bell's arrest, said this evening that he's got another story coming out tomorrow that will reveal more of the situation, and that he'll fax a copy (which I'll post unless Alan does). Mr. Painter says: Jim's still in the Tacoma, WA, federal jail. There was a prelim today and a hearing is due Friday. The feds are keeping the case documents sealed. Speculates that someone may be squealing on Jim in a deal. Jim cannot receive calls but can call out collect. A U.S. Federal Defender has been assigned to represent Jim: Peter Avenia, tel: 253-593-6710. Mr. Avenia did not return a call. The U.S. District Court Judge is J. Kelly Arnold. Court Clerk is Kelly Miller, tel: 253-593-6313. The Oregonian's telephone: 1-800-452-1420. A man at Jim's home politely said he did not want to talk about it. Tel: 360-696-3911.

1 0

Re: Nature of Anarchy/ Anarchy of Nature
by Blanc 17 Dec '03

17 Dec '03

Steve Schear wrote: >Even better, "The Road to Surfdom," F.A. Hayek, totally debunks the basis >of a planned economy and how the loss of property ownership and economic >freedom leads directly and inevitably to totalitarianism. ............................................................ Or my favorite of all time: "Human Action" by Ludwig von Mises. It's a large book - it could keep a collectivist New Age philosopher busy for hours. But even just reading the first few chapters would be sufficient to provide some usefully deep ideas to explain fundamental things about economic truths, of the kind which many cpunks are already in agreement with. .. Blanc .. Blanc

1 0

Re: Mail bombs from "helpful" Cypherpunks
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:26 PM 5/18/97 -0800, Tim May wrote: >As I explain in my message to Steve Schear, I have no way of >removing such "mail bombs" with my Eudora/POP system until they >have been downloaded to my machine (I don't have a shell account anymore). Eudora does have a "Only download messages less than ___K" option that can reduce this problem; I don't know if there's also a way to delete the message from Eudora without downloading it. Netscape Mail has similar options. The old Netcom Netcruiser mail client software let you download just the headers and then pick what messages to read ; I don't know if the new NetComplete stuff does that or not. Netcruiser was ugly and somewhat broken, but occasionally did useful things. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: I Treat All My Enemies Equally
by Blanc 17 Dec '03

17 Dec '03

TruthMonger wrote: > Blanc makes some excellent points about the average citizen being >caught in a ping-pong crossfire in the conflict between government >and anti-government forces. However, as I said, this is in the nature >of conflict and the citizen's best option may be to make a daily >effort to resist the government oppression, no matter how small it >may seem in any instance. ..................................................... Appreciate all the kudos, TruthMongrel. <g> The problem that I was talking about is that of not being able to distinguish one's enemies from one's friends because they all act alike and therefore being in a position of danger from either of them. In that case, it doesn't matter which philosophy (political, economic, etc.) one should support; the immediate fact of the matter is physical - physical safety from all those Cowboys & Indians trying to get rid of each other regardless of the reasons or the purpose. In that case they are not advancing the kind of philosophical cause which supports superior values and which results in better circumstances. They are not "separating the wheat from the shaf", they are not being descriminating about what should live and what should die, they are not allowing innocent bystanders to make a decision about which side they're on or what risks they are willing to take in the "war" which they may not realize is happening. In that case, the real end of a "terrorist" action is personal and has little to do with a preferable way of life for humans, or grievances against an unjust oppressor. When two "opposed" groups are willing to stick it you without concern, there is no difference between them. Because, what difference does it make? .. Blanc .. Blanc

1 0

New rules re money transfers to foreign locations
by Greg Broiles 17 Dec '03

17 Dec '03

The NY Times reports that new rules will be announced Monday which will require non-bank financial institutions (like check-cashing stores, Western Union, etc.) to report transfers of $750 or greater with a foreign destination. (The old reporting threshold was $10K.) According to the article, the new regulation is expected to generate approximately one million additional forms per year for FINCEN/Treasury to process, and require 25,000 such NBFI's to register with Treasury. The regulation will take effect in 90 days after a public comment period. It does not apply to cash, instruments like traveler's checks, or domestic transfers; it also does not apply to banks themselves. (All of those mediums of transport are covered by different rules with other reporting requirements.) See <http://www.nytimes.com/yr/mo/day/news/national/drug-cartels.html>. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto.

1 0

Crypto use to foil law enforcement?
by Greg Broiles 17 Dec '03

17 Dec '03

I ran across this entry in the Congressional Record which discusses several examples where encryption was discovered in the course of a law enforcement investigation. [Congressional Record: September 18, 1996 (Senate)][Page S10882-S10886] [...] Mr. GRASSLEY. Mr. President, I'm pleased that the Senate has passed the eonomic espionage bill. This is an important measure that I believe will save American business significant amounts of money. The theft of confidential information from American businesses is a serious problem, and this bill takes important steps in the right direction. I am particularly pleased that the Senate has accepted the amendment I offered with Senator Kyl. This amendment commissions the first-ever study on the criminal misuse of encryption technologies. Under the Grassley-Kyl amendment, court officers who prepare pre-sentencing reports will include information on the use of encryption to conceal criminal conduct, obstruct investigations, and commit crimes. The sentencing commission will then collect and collate this information and include it in its annual report to congress. In this way, I am hopeful that Congress and executive branch will have reliable data on whether the criminal misuse of encryption is actually a problem and, if so, what response to this problem would be appropriate. As chairman of the Oversight Subcommittee on the Judiciary Committee, I did an informal survey of state-level law enforcement concerning the criminal misuse of encryption. This informal survey, while not scientific, provides valuable insights into the actions of the criminal element in our society. Here are just some of the responses my subcommittee received. In one case involving John Lucich of the New Jersey attorney general's office was involved, a computer was seized pursuant to a warrant in a serious assault case. Examination revealed that approximately 20 percent of the hard drive files were encrypted. Investigators sought the assistance of two different Federal agencies. Both of these agencies were unsuccessful in decrypting the files. Finally, a third Federal agency was successful in decrypting the files after expending considerable resources. The Decrypted files did not contain evidence of the assault but rather contained evidence of child pornography. The encryption type likely used was ``DES.'' And Officer Tim O'Neill of the Roseville, California Police Department reported to the subcommittee that he participated in a search involving a complaint against a subject who was on probation for solicitation/annoyance of minors. The subject had a hidden encrypted file on his personal computer. In the ``slack'' area at the end of the file the officer found names, addresses, school, grade, and phone numbers of 4-5 young teen girls. The encryption type used was known as ``pincrypt.'' Officer Mike Menz of the same department advised the subcommittee that he was working on a joint State/Federal major check fraud case where part of the potential evidence was encrypted. Ivan Ortman, a senior prosecutor in Seattle, Washington, encountered some encrypted files and password protection in a cellular phone fraud investigation. For a number of files the popular and inexpensive ``PGP'' type of encryption was used. Orton indicated that no effort was even made to examine the files as the police could not locate any method for ``cracking that encryption.'' In other words, why try since such an effort is certain to be futile. Surely a rational society should look long and hard at this situation. Agent Chuck Davis of the Colorado Bureau of Investigation reported to the subcommittee that he has encountered encryption as well as password protection problems. In one embezzlement case, a computer system has seized. Examination revealed that files on the hard disk were encrypted. The software manufacturers were contacted and the technical personnel who wrote the program advised that, ``they had left no `back door' access to the product as this would adversely impact sales. The hallmark of the program's appeal is that it cannot be broken, even by those who created it.'' Agent Davis advised that his investigation was ``halted'' due to the time and expense of a ``brute force attack''. The encryption program used was entitled ``watchdog.'' Agent Davis also advised the subcommittee that password protection also presents problems for other types of investigators. In cases involving theft of drugs from an emergency room by a doctor, bribery/ extortion by a police officer, and the suicide by an 11 year-old boy after telling friends that he had been molested by a family friend, investigators encountered password protection. The first two cases were successfully resolved through assistance from the manufacturer of the software. The third case, however, especially illustrates the seriousness of decryption problems--determining the unique key or in this case, password from a large number of possibilities. According to Agent Davis, a mere 4 character password has 1.9 million possibilities due to the number of keyboard characters. Can you imagine how difficult it must be to figure a short, 4 character password. What if the password were 10 characters or 20 or more? It's easy to see why criminals are moving toward password protection for their records. -- Greg Broiles gbroiles(a)c2.net 510-986-8779 voice 510-986-8777 fax

1 0