December 2003 - cypherpunks-legacy

Not worried? You will be... (fwd from Yucks)
by Adam Shostack 17 Dec '03

17 Dec '03

----- Forwarded message from Nev Dull ----- >From nev(a)bostic.com Tue Sep 23 02:39:35 1997 Date: Mon, 25 Aug 1997 14:05:02 -0400 (EDT) From: Nev Dull <nev(a)bostic.com> Subject: Not worried? You will be... To: nev(a)bostic.com (/dev/null) Not worried about companies collecting information about your purchasing habits? You will be... =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Dear Mr. Jones: Our research indicates that you have not bought condoms at SpiffyMart recently. (Your last purchase was 8 weeks ago.) Further, you have stopped buying feminine hygiene products, but have sharply increased your frozen pizza and dinners usage in the same time frame. It's clear that Ms. Jody Sanders and you are no longer "an item". (It's probably for the best -- she consistently buys inexpensive shampoo, and it was obvious that the two of you were not economically compatible.) The Postal Service database confirms that she filed a change of address form. We at Hotflicks International offer our condolences. As the number-one vender of hot XXX-rated videos, we want you to know that our products can help you through this difficult period. When you're feeling lonely, check out our unmatched catalog, there is guaranteed to be something that you'll want to purchase! Order from this catalog and we'll throw in an extra tape FREE! Yours Truly, Pat Aureilly, Hotflicks Marketing Manager ps: That "blond" at O'Dougles last Saturday for whom you bought a Strawberry Marguerita? Forget it! Her HMO database confirms that she's had three yeast infections this year and was tested for a sexually transmitted disease. Our tapes are much safer! ------------------------------ ----- End of forwarded message from Nev Dull ----- -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

NewSpeak: TIS RecoverKey
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Authentication-Warning: fma66.fma.com: majordomo set sender to owner-espam(a)lists.espace.net using -f X-Orig-From: rah-web <rah(a)shipwright.com> X-e$pam-source: Various X-Sender: rah(a)pop.sneaker.net Mime-Version: 1.0 Date: Tue, 23 Sep 1997 21:20:35 -0400 To: espam(a)intertrader.com From: Robert Hettinga <rah(a)shipwright.com> Subject: NewSpeak: TIS RecoverKey X-MIME-Autoconverted: from 8bit to quoted-printable by lbo.leftbank.com id VAA21601 Sender: owner-espam(a)lists.espace.net Precedence: bulk Reply-To: e$(a)thumper.vmeng.com X-MIME-Autoconverted: from quoted-printable to 8bit by pop.sneaker.net id WAA04695 --------------------------------------------------------------------- This mail is brought to you by the e$pam mailing list --------------------------------------------------------------------- From: rah-web <rah(a)shipwright.com> Reply-To: rah(a)shipwright.com MIME-Version: 1.0 To: Robert Hettinga <rah(a)shipwright.com> Subject: NewSpeak: TIS RecoverKey http://www.prnewswire.com:80/cgi-bin/stories.pl?ACCT=104&STORY=/www/s tory/9-23-9 7/322338&EDATE= Content-Type: text/plain; charset=us-ascii; name="322338&EDATE=" Content-Disposition: inline; filename="322338&EDATE=" X-MIME-Autoconverted: from 8bit to quoted-printable by lbo.leftbank.com i d VAA21516 [Todays News] Frontier Technologies and TIS Announce Strategic Alliance to Deliver RecoverKey-enabled e-Lock Partnership Brings Together Strong Cryptography and User-Controlled Ke y Recovery MEQUON, Wis., Sept. 23 /PRNewswire/ -- Frontier Technologies and Trus ted Information Systems, Inc. (Nasdaq: TISX), today announced a strategic all iance to integrate Frontier Technologies' e-Lock(TM) security family with TIS' RecoverKey(TM) Cryptographic Service Provider (CSP), offering customers a n easy-to-use solution for managing strong encryption across Windows(R) 95 and Windows NT(R) applications. This alliance increases opportunities for implementing and managing strong encryption worldwide while putting users in control of their own data and privacy. The e-Lock products will work seamlessly across the Internet, intrane ts and extranets with the RecoverKey CSP so that users can employ the strong est levels of cryptography with the means to prevent "locked and lost" data. Customers using e-Lock with RecoverKey simply click a button to secure documents and/or to recover data that would otherwise be lost due to a forgotten password or lost key. "RecoverKey gives users the opportunity to enact data saving measures up front when employing the e-Lock solution," said Dr. Prakash Ambegaonkar, Frontier Technologies' Chairman & CEO. "Frontier's expertise coupled wit h TIS' innovative technology gives users the strongest levels of assurance that their valuable information is locked up tight while providing an emergenc y mechanism for unlocking it if the key becomes lost or destroyed." "TIS is pleased to join forces with Frontier Technologies in their commitment to meet market demand for applications that support user contr olled key recovery," commented Homayoon Tajalli, TIS Executive Vice President a nd General Manager, Cryptographic Products. "Global e-commerce and communic ation depends on impenetrable transmission and storage of valuable information. e-Lock can now bring customers the benefit of robust encryption with a ba ckup plan in place for recovering locked data if the original key is inaccessi ble." Frontier Technologies' e-Lock security family is a complete, standards-based solution for creating, using and managing secure applicat ions for intranets and the Internet in both Windows(R) 95 and Windows NT(R) environments. The e-Lock family of products, e-Sign, Secure Messaging Toolkit, and e-Lock PKI support digital signatures, encryption and public key infrastructure. Trusted Information Systems' RecoverKey CSP is the first software of its kind to reach a worldwide commercial market, enabling Windows 95 and Wind ows NT desktop users to implement powerful cryptography at the click of a but ton. Incorporating popular algorithms such as RSA, DES, Triple DES and 128-bit RC2/RC4, the RecoverKey CSP will provide the components necessary to encr ypt and decrypt information seamlessly across applications. RecoverKey CSP trial versions are currently shipping and the RecoverK ey CSP-enabled e-Lock product will be available in late fall. Visit the Fro ntier Technologies website at http://www.frontiertech.com for free download of the e-Lock products. Frontier Technologies' mission is to pioneer Internet and Intranet applications that make individuals more productive and businesses more competitive in a global market. Trusted Information Systems, Inc., is a leading provider of comprehen sive security solutions for protection of computer networks, including global Internet-based systems, internal networks, and individual workstations an d laptops. RecoverKey is a trademark of Trusted Information Systems, Inc. e-Loc k, e-Cert, e-Sign, e-Mail are trademarks of Frontier Technologies Corporatio n. All other product and company names may be trademarks of their respective owners. SOURCE Frontier Technologies CONTACT: Ann M. Krauss, 520-797-0583, 520-797-0182 (fax), Ann(a)Frontiertech.com or Nicole E. Rogers, 414-241-4555 x293, 414-241-7084 (fax), NicoleR(a)Frontiertech.com, both of Frontier Technologies, or Shoshana Rosenthal of Trusted Information Systems, 301-947-7194, shoshana(a)tis.com ------------------------------------------------------------------------- --- [PR Newswire Logo] (Today's News) (Company News On-Call) (Feature News) (Automotive) (Entertainment) (Health/Biotech)(Technology) (Financial) (Energy) (Washington and the World) (Money Talks) (About PRN)(Ask PRN) (Links) (P RN Events) ------------------------------------------------------------------------- --- ©1997 PR Newswire. All rights reserved. Redistribution, retransmission, republication or commercial exploitation of the contents of this site are expressly prohibited without the written consent of PR Newswire. These pages have been optimized for Netscape v.2.0 or later --------------------------------------------------------------------- Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk --------------------------------------------------------------------- Like e$? Help pay for it! See <http://www.shipwright.com/beg.html> Or, for e$/e$pam sponsorship, <mailto:rah@shipwright.com> --------------------------------------------------------------------- --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

REminder: Physical meet this Wednesday
by Christian Claborne 17 Dec '03

17 Dec '03

The last message had Thursday in the subject... It's Wednesday. 2 -- C -- -----BEGIN PGP SIGNED MESSAGE----- This Wednesday!!! San Diego Area CPUNKS symposium Wednesday, Sep. 24, 1997. Topic: What action do we take if the situation get's out of hand (See message below from Mark H. below). It is my belief that any group, no matter how small, can accomplish great things if they apply themselves. Cypherpunks are not just "users", they poses several additional quanta of the stuff that enables creative thought, and skill. Don't forget to bring your public key fingerprint. If you can figure out how to get it on the back of a business card, that would be cool. If you want the suspicious crowd there to sign your key, bring two forms of ID. Place: The Mission Cafe & Coffee Shop 3795 Mission Bl in Mission Beach. 488-9060 Time:1800 Their Directions: 8 west to Mission Beach Ingram Exit Take west mission bay drive Go right on Mission Blvd. On the corner of San Jose and mission blvd. It is located between roller coaster and garnett. It's kind of 40s looking building... funky looking (their description, not mine) They serve stuff to eat, coffee stuff, and beer + wine stuff. See you there! New guy, bring your fingerprint. Drop me a note if you plan to attend... 2 -- C -- - ------------------------ Date: Fri, 12 Sep 1997 16:04:22 -0700 (PDT) From: Mark Hedges <hedges(a)infonex.com> To: all-at-infonex(a)infonex.com Subject: federal cryptography legislation Sender: owner-all-at-infonex(a)infonex.com - -----BEGIN PGP SIGNED MESSAGE----- A bill called "SAFE" (HR-695, "Security and Freedom with Encryption") in the U.S. House of Representatives would have allowed U.S. software companies to export strong cryptography, and would have promoted privacy in all U.S. communications. Cryptography is mathematical means of making a message secret. Now, this bill has been rewritten to introduce more restrictive cryptography legislation than ever before seen in the U.S. Public support for cryptography use and export is very strong, as evidenced by the California state legislature's unanimous vote 9/5/97, calling on Congress and the President to revise and relax export laws (SJR-29). Companies world-wide already produce strong cryptograpy software, and U.S. buisness is rapidly losing ground in the world-wide software and telecommunications market. The House National Security Committee this week voted to continue export restrictions in the SAFE bill and to install "key escrow" proposals of the defense and intelligence organizations. This would not only continue the status quo legislation, it would strictly regulate and restrict domestic use of cryptography, an unprecedented act. Key escrow legislation in SAFE would mandate government "back doors" in all communications software before the end of the millennia in the United States, imposing criminal penalties for use of secure cryptography. Effectively, every citizen would be required to give law enforcement involuntary and transparent access to all communications, including financial, business, and personal messages. Key escrow also exposes all U.S. communication to a single point of failure, which a hacker, spy, or corrupt official could exploit to gain access to all personal, industry, and financial information. More information is available in our most recent press release. Press releases can be viewed at http://www.anonymizer.com/press/. Please, call your congressional representatives and senators and encourage them to oppose restrictive legislation on cryptography and mandated government access to all communications. Names and phone numbers for your local legislators can be obtained from www.house.gov and www.senate.gov. Sincerely, Mark Hedges Anonymizer Inc. Infonex Internet Inc. - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNBnJhBVo2SUWMp6NAQFyNQP/UuogfBfcjRw7q5rda8+1BrGkMEHpixau J7JfbhKyv5yWdPZsnh8F3m/kaUahLEaSdLCcmAJzbroKApGBjUtT6bRacOtVps3X TzZXLO2NZd4UBsksUC1f3WWnnRl8+03jiQMboSpBvUVmHqA1sFiz3OQpJVWv1yge jEEk7R2Maeg= =VrfI - -----END PGP SIGNATURE----- -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQEVAwUBNCRRAIP1MBWQ+9udAQHNuAf/Wf/vf7O7A3iZhd9BjlzyI0FvcOTelUOs 5JhxXN0w86YWzoluZue8jY7uKmxGVuySdikQSw4OxLS5wZG05nByoIQlhlzLPYIl vrQuQZ0EeGIOycwS7IuNLFFyx+C1E7HxcdX0UR3qMDgEiiFb09DlcuDHeSp52RZW s6t7AFR7ZoVz28KanihgDRQdk9QTw0HuaZV3hHNl11610HaPURRe4SX7zgR1cHAf naoTZI70GqVoUVYVrm+oVHln7HsdFqnrO/1GAVpLzKpEnzfT9C0d0o7T4t/WX4CM yeeO2UZUwfg01VyCHORpFYbx1SrFlW4rZNZqOJMP2lA2cNDZBsLrhg== =/sWk -----END PGP SIGNATURE----- ... __o .. -\<, Claborne(a)CYBERTHOUGHT.com ...(*)/(*)._ Providing thoughts on your computing needs. http://www.CYBERTHOUGHT.com/cyberthought/ PGP Pub Key fingerprint = 7E BF 38 3F 24 A7 D1 B0 54 44 96 AA 10 D0 5D 51 Avail on Pub Key server. PGP-encrypted e-mail welcome! Dreams. They are just a "screen saver" for the brain.

1 0

Oxley crypto update: vote in 90 minutes
by Declan McCullagh 17 Dec '03

17 Dec '03

Today's vote will be held in less than two hours. Keep in mind that this is just one committee out of five that's considering the SAFE bill. The impact of the committee's draft of SAFE is not nearly as important, IMHO, as the political impact of the vote. Can one of the nation's richest industries muster up the votes to defeat law enforcement -- in the //Commerce// committee, of all places? Many eyes will be watching the committee today. I hear that Oxley is nervous and has been calling people he never did before. His staff tells me that yes, he has been calling everyone on the committee. He'll be distributing letters of support from groups -- including law enforcement groups in California -- that will buttress his amendment. Oxley's staff tells me the version of Oxley II posted by CDT is almost certainly inaccurate and out of date. Solomon, chair of House Rules, is circulating a letter saying only SAFE with Oxley will go to the floor. The pressure's on. Rumors are flying that industry may cut a deal (perhaps brokered by White) that may give up civil liberties in exchange for export controls. We'll see soon. As of yesterday Oxley appeared to have a majority of perhaps 32-34 out of the 51 or so people on the committee. -Declan >In case anybody is counting votes, my own congressman (Brian Bilbray, R-CA) >sits on the House Commerce committee. I just got a call back from his >staff saying that Bilbray opposes the Oxley amendment and continues >to support the original SAFE bill, which he co-sponsored. > >Any other word on how today's vote is going? > >Phil

2 2

Its working read this, give it a chance,
by wdsmsn 17 Dec '03

17 Dec '03

WE CAN NOT TELL YOU HOW EXCITED EVERYONE IS THAT IS GETTING INVOLVED IN THIS PROGRAM IT IS WORKING LIKE A CHARM, FINALLY A WAY TO MAKE A LOT OF EXTRA MONEY WITH NO GAMBLE. , ....... WHEN YOU HEAR OF THOSE THAT DID IT AND HOW GREAT IT WORKED YOU WILL WISH YOU WOULD HAVE TRIED IT, Five people who said it did not work and it was just a scam, are now involved in it , After they saw what others have received. *** Print This Now For Future Reference *** This is working people are reporting tremendous results, Give it a try what have you got to lose.... HOW TO MAKE $800,000.00 CASH IN FOUR WEEKS! How about taking the profits and opening your own business? How about telling that boss you hate to go jump in the lake? Do this Keep it among people you know how can you possibly lose here??? Then ask yourself... How much can I make??? The answers should tell you it's worth a try. All you can lose is 5 bucks (SO WHAT!!!) Yet you may make a nice profit. Read on. Jane Nelson tells how she ran this program four times last year. This first time, she received $500,000 in cash, and over $700,000 the last three times this year. If this letter is continued, as it should be, EVERYONE PROFITS! Just send one person FIVE DOLLARS - THAT'S ALL! After the first time, you'll see how easy it is and how beautifully it works! Now here are the simple details... Follow WHAT TO DO below and IN ONLY FOUR WEEKS YOU'LL RECEIVE UP TO $700,000 because most people will respond, due to the LOW INVESTMENT and HIGH PROFIT POTENTIAL. WHAT TO DO On a blank sheet of paper, write "Please put me on your mailing list" along with your name and address and put it with a Five-Dollar Bill. Through regular mail, send this to the last person on the list below. ONLY THE LAST PERSON ON THE LIST GETS YOUR NAME AND $5 BILL! Then remove that name from the list. Move the other three names down and add your name to the list in the #1 position. After you have re-typed the list with your name in the #1 position, MAKE AT LEAST 20 COPIES OF THE LETTER AND SEND IT OUT IMMEDIATELY TO 20 OR MORE PROSPECTS. Friends, relatives - anyone you'd like to see get rich along with you! The faster you act, the faster you'll get your money! US Mail or Email!!! For email, you can just copy this whole letter and paste it into the body part of AOL's "Compose Mail" box. Then be sure to remove the last name on the list below, and add your name as the first. YOU STILL HAVE TO USE REGULAR MAIL TO SEND YOUR $5 AND ADDRESS TO THE LAST NAME! That's what keeps this legal and how everyone gets paid! That's all there is to it! Here's how it works: 1. You send out 20 letters to 20 Prospects 2. Those 20 mail out 20 letters each (400) 3. Those 400 mail out 20 letters each (8,000) 4. Those 8,000 mail out 20 letter each (160,000) 5. And those 160,000 people mail YOU 5$ each ($800,000) Your entire investment is only $5!!! Very inexpensive when you consider the results you can get! HONESTY AND INTEGRETY MAKE THIS PLAN WORK. Breaking the rules on the way it is sent only messes up your chance of it working right! DON'T BREAK THE RULES! Be sure to follow the instruction and omit nothing. At this time we are receiving an almost 100% return rate for people wise enough to participate in the plan. The majority receive about $700,000 on average! And rest assured this plan is 100% Legal! You are providing a service to people to put them on your mailing list. (Please refer To): (Title 18, Section 1302 of the US Postal Code and Lottery Laws.) PLEASE MAIL YOUR LETTERS ASAP! I WISH YOU SUCCESS AND TOGETHER WE'LL ALL PROSPER. DON'T GIVE UP ON YOUR DREAMS! -------------------------------------------------------------------- #1 Ray Favereau 822 Kalli Creek Lane St. Augustine Fl 32084 #2 Danielle Burkes 1057 Larkspur Loop Jacksonville Fl. 32259 #3 J.D. Clark, P.O. Box 613, Lahoma, OK 73754 #4 Ryan Thomas, P.O. Box 2872, Joplin, MO 64803 Include your email address for courtesy updates.

1 0

Announcing ZDU's Fall Course Catalog!
by announce＠lists.zdnet.com 17 Dec '03

17 Dec '03

----------------------------------------------------------------- ZDNET ANNOUNCEMENT 9/24/97 ----------------------------------------------------------------- ZDU Announces Its Biggest Course Catalog Ever. Point your Web browser to: http://www4.zdnet.com/chkpt/zdna970922001/www.zdu.com ZDNet University is excited to announce the widest selection of online classes ever. This Fall, choose from over 70 new courses designed to help beginners become experts--plus a brand new selection of advanced level courses for experts and professionals to hone their skills. You'll also enjoy new features like the how-to guides, the Campus Pub, special offers, and an updated design. It's now easier than ever to navigate, browse, enroll, and learn! Here's just a sample of the latest additions to the Catalog: * Dynamic HTML * Internet Advertising * Implementing Extranets * Marketing Your Site for Free * Building Internet Communities * Security on the Web * Advanced Photoshop * Build a Web Application with Oracle Webserver * Essentials of Microsoft Networking * Advanced Javascript * and many more! Learn more about ZDNet University, the Web's leading source for high-tech education. Drop by right now to tour the campus on the Web to learn more about how ZDU works: http://www4.zdnet.com/chkpt/zdna970922001/www.zdu.com _________________________________________________________________ ZDNet Announcements are periodic notices of new features, special events and free offers available to members of ZDNet. --To subscribe to ZDNet Announcements, please send mail to: announce-on(a)lists.zdnet.com You can leave the subject and body blank. --To unsubscribe to ZDNet Announcements, please send mail to: announce-off(a)lists.zdnet.com You can leave the subject and body blank. _________________________________________________________________ Powered by InfoBeat: http://www.infobeat.com

1 0

Crypto articles in New York Times Cybertimes web site
by Martin Minow 17 Dec '03

17 Dec '03

There are several interesting articles in today's (Sep 24) New York Times "Cybertimes" web page. <http://www.nytimes.com/library/cyber/week/092497encrypt.html> has an overview and links to other articles. (This is a free page for USA sites, but requires a login and password.) Martin Minow minow(a)apple.com

1 0

Congress & Crypto: "No compromise" coalition letter
by Declan McCullagh 17 Dec '03

17 Dec '03

[This "no compromise" letter from ACLU, Eagle Forum, and other groups is especially important since it's likely that industry groups may sign on to compromise legislation. Also attached is a Reuters piece on Freeh's news conference this morning and an excerpt from an E.C. official's talk also this morning at the National Press Club. --Declan] ************** An Open Letter to Members of the House Commerce Committee September 24, 1997 No Domestic Controls, No Compromise on Privacy Protection by Encryption We write this letter to urge you to oppose the Oxley-Manton amendment to H.R. 695, the Security and Freedom through Encryption (SAFE) Act. While our organizations sometime disagree emphatically with each other, we are all united in asking you to oppose any and all attempts to limit the right of all Americans to get and use whatever encryption protection we want. Specifically included among the proposals we urge you to oppose are provisions like those found in the amendments to H.R. 695 proposed by the FBI draft, the Intelligence Committee, and the National Security Committee, and in the McCain-Kerrey bill (S. 909) in the Senate. We also urge you to oppose as well any proposal establishing a legal structure for key recovery even if temporarily "voluntary," any so-called "compromise" provision drawn from Oxley-Manton or the other specified proposal, and any new proposal that would limit the availability and use of strong encryption. Representatives of our organizations have already informed Congress of our vigorous opposition to any anti-encryption legislation. We take this opportunity to underscore four key points. OXLEY-MANTON ATTACKS THE WAY ORDINARY AMERICANS USE ENCRYPTION. Without realizing it, ordinary Americans already use encryption in their everyday lives. Cordless and cellular phones, and every digital phone system uses encryption to protect privacy. Oxley-Manton would require a backdoor breech in encryption security distributed, manufactured or sold after January 31, 2000. Online browsers for the Internet also use encryption, with a similar backdoor breech in security required by Oxley-Manton. Every computer that uses encryption ñ sometimes with just a keystroke ñ to protect the contents of sensitive medical, legal, religious counseling and other files would be subject to the same Oxley-Manton backdoor breech in security. OXLEY-MANTON INCREASES THE LIKELIHOOD OF CRIMINAL ACTIVITY. The Oxley-Manton amendment and the other proposals would compel encryption programs to contain a "backdoor" for law enforcement either by establishing a regime to recover the keys to the scrambled message or by providing immediate decoding of the message. The governments own experts, however, conclude that the backdoor cannot be limited to law enforcement. Instead, the backdoor makes the encryption protection vulnerable to attack by prying neighbors, business competitors, private investigators, and others who want to profit from illicitly gained information. (See the May 1996 report of the National Research Council.) A mother, for example, arranging to pick up her child at day care ought not have the safety of those arrangements jeopardized by the Oxley-Manton backdoor breech in security. OXLEY-MANTON IGNORES THE FACT THAT LAW ENFORCEMENT IS NOT PERFECT. The Oxley-Manton amendment and the other proposals neglect the fact that law enforcement agencies are human institutions with some of their people subject to the frailties common to human nature ñ prejudice, avarice, arrogance and abuse of power. We need only to recall the documented abuses of federal agents at Ruby Ridge, in Filegate, in surveilling civil rights and religious leaders, in harassing honest taxpayers and law-abiding businesses ñ as well as those established instances of police abuse at the local level ñ to understand that placing unprecedented power in the hands of law enforcement to violate the peopleís privacy is extremely dangerous. OXLEY-MANTON MAKES ORDINARY AMERICANS THE SERVANTS OF THE STATE. At the core of American political values is the fundamental concept that individual Americans have certain rights and that governments are instituted, in the words of the Declaration of Independence, "to secure these rights." As a free people, Americans are the masters -- not the servants -- of the state. Indeed, our constitutional system is founded on the principle that the people have certain rights that cannot be violated. The Oxley-Manton amendment and the other proposals reverse this relationship, making the governmentís appetite for spying on its citizens the number one priority while requiring that ordinary Americans constrict their lives, the protection for their families and businesses, in order to accommodate government surveillance. In doing so, the Oxley-Manton amendment and the other proposals betray the essential values of our democracy. CONCLUSION We urge you to stand up for the privacy and security of Americans by opposing any and all of the provisions of the Oxley-Manton amendment, the other amendments cited, the McCain-Kerrey bill and any provision requiring or fostering the development of a key recovery regime even if presented initially as "voluntary." We also urge you to reject any so-called "compromise" based in whole or part on these proposals. Finally, we urge the removal of the criminalization provision in H.R. 695, the SAFE bill. Sincerely, American Civil Liberties Union Americans for Tax Reform Eagle Forum Electronic Privacy Information Center Privacy International United States Privacy Council For more information, please contact: Donald Haines, Legislative Counsel, American Civil Liberties Union, 202/675-2322; privaclu(a)aol.com. James P. Lucier, Jr., Director of Economic Research, Americans for Tax Reform, 202/785-0266; lucier(a)atr.org. Kris Ardizzone, Executive Director, Eagle Forum, 202/544-0353; eagleforum(a)aol.com David Sobel, Legal Counsel, Electronic Privacy Information Center, 202/544-9240; sobel(a)epic.org. === [An example of how hard the FBI is pressing encryption in the last few hours before today's vote. This news conference was at 10:30 am today. --Declan] WASHINGTON (AP) - Armed with a sealed indictment, U.S. officials stepped up the pressure today on Mexico's most violent drug kingpin by offering a $2 million reward and adding him to the FBI's most wanted list. Ramon Arellano Felix, 33, the head of security for a gang run by five brothers, is charged with drug conspiracy and smuggling in a sealed federal indictment in San Diego, FBI Director Louis J. Freeh told a news conference. [...] Freeh used the news conference to push legislation, now before a House committee, giving his agents access to the keys to commercial encryption devices and software used to scramble telephone conversations and computer transmissions. "If a workable national solution to the encryption problem is not enacted soon," Freeh said, "we simply will loose our most effective tool with respect to drug interdiction." Constantine said in the last 18 months Mexican gangs have increasingly used encryption, "purchased off the shelf" in the United States, that is capable of shielding their communications from most law enforcement eavesdropping. "If their encryption succeeds, we would never be able to find out who is in charge of these organizations," Constantine said. [...] === NATIONAL PRESS CLUB MORNING NEWSMAKER SIR LEON BRITTAN, VICE PRESIDENT OF THE EUROPEAN COMMISSION NATIONAL PRESS CLUB WEDNESDAY, SEPTEMBER 24, 1997 Q On the electronic commerce issue, is there a likelihood there will be a common position on encryption controls of exports, imports? SIR LEON: Well, all of these things are currently the subject of discussion, and I think it's premature to say where it will end up. === ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

3 2

NYT cybertimes article excerpt.
by Peter Trei 17 Dec '03

17 Dec '03

quoted without permission - I think this is fair use... btw, the NY Times site is pretty good. While a registration and email address are needed, I have not seen any sign of abuse of this information (yet). ----------------------------------------- start quote In fact, Kerrey's legislation could easily create the largest bureaucracy ever -- by some estimates requiring more record keeping than all the states' departments of motor vehicles, the Internal Revenue Service and the various welfare agencies combined. While no one knows how Congress or the FBI intends to carry out key-recovery legislation, it is entirely possible that anyone installing a piece of software on a hard drive will need to register it like people now register a car with the Department of Motor Vehicles. While most people own only one car and file only one tax return a year, many computer users have multiple copies of programs like Quicken, Notes or Power Point. Each could require a separate registration if it includes encryption features -- and many users will be shocked to discover what qualifies as encryption, which is becoming increasingly common even in trivial programs like games because it is a good way to regulate copyright infringement. [...] One Congressional staff member who participated in drafting the legislation but asked not to be identified conceded that the bill would force developers of new software to seek approval for their products from the United States government even if the products did not explicitly include encryption features. Such approval would be the only -> way to escape prosecution, he said. While admitting that -> this language would add a six- to nine-month delay in -> releasing new products, the staff member asserted that the -> computer industry would simply have to build this time into -> product development cycles. end quote -------------------------------------- This "Congressional staff member" is clearly a ninth-dan black belt ninja of cluelessness. Add 6-9 months to SW development cycles? Prior restraint on SW publication? The mind boggles. Anyone who maintains that the convenience of law enforcement should be the over-riding factor in the organization of our society has, in my opinion, lost the right to call themselves an "American." Peter Trei trei(a)process.com DISCLAIMER: My opinons. No one elses.

1 0

The CipherSaber Manifesto
by Arnold G. Reinhold 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In George Lucas' Star Wars trilogy, Jedi Knights were expected to make their own Light Sabers. The message was clear: a warrior confronted by a powerful empire bent on totalitarian control must be self-reliant. As we face a real threat of a ban on the distribution of strong cryptography -- in the United States and possibly world-wide -- we must emulate the Jedi masters by teaching people how to build strong cryptography programs all by themselves. If this can be done, strong cryptography will become impossible to suppress. While cryptographers like to wallow in the complexity of their art, the basic elements of a strong cryptographic system are quite simple and well known in the programming community. By choosing a simple but strong cipher that is already widely published and agreeing on how to use it, anyone with elementary programming skills will be able to write their own program without relying on any products that can be banned. CipherSaber-1 (CS1) uses Ron Rivest's RC4 algorithm as published in the second edition of Bruce Schneier's Applied Cryptography. RC4 is widely respected and used in a number of products, including SSL. With a long enough key RC4 is considered strong and it is also extraordinarily easy to explain and to reproduce. As Schneier says, "The algorithm is so simple that most programmers can quickly code it from memory." Implementations of RC4 are available on the Internet but it is actually easier to write your own version. The legal status of RC4 is the subject of some controversy. The RSA division of Security Dynamics still considers RC4 confidential and proprietary. It is not patented and, to the extent that Schneier is correct (and no one doubts him), it is not confidential. However, anyone wishing to build a commercial product using CipherSaber might find it cost-effective, as well as polite, to obtain a license from RSA. Apologies to Prof. Rivest for suggesting individuals use his invention without his consent. If there were another strong algorithm so singularly suitable, CipherSaber would have used it. CipherSaber-1 is a symmetric-key file encryption system. Messaging takes place by attaching binary files to e-mail. Because CipherSaber uses a stream cipher, an initialization vector must be used to prevent the same cipher key from being used twice. In encrypted CipherSaber-1 files, a ten byte initialization vector precedes the coded data. For decryption, the initialization vector is read from the file and appended to the user key before the key setup step. CipherSaber-1 can be implemented in 16 lines of QBasic (38 individual Basic statements). The source code is short enough for tee-shirts and coffee mugs. But there is no need to distribute source code at all. CipherSaber can be passed on by oral tradition, if necessary. Soapbox The U.S. Congress is considering legislation that would ban the domestic distribution of cryptographic products that do not provide for immediate government access to the plaintext of messages. This government access must be possible without the consent or even the knowledge of the message{s sender or recipient. The stated intent is to protect us from criminals and terrorists. The simplicity of CipherSaber should prove once and for all that the criminals and terrorists of this world will not be deprived of strong cryptography simply because the distribution of unapproved products is banned. They can get the necessary technology to make their own from existing publications whenever they feel they need it. Another goal of CipherSaber is to demonstrate that strong cryptography cannot be banned without severe restrictions on freedom of speech. Banning the sale of a complex computer program or even the multi-volume printed edition of PGP source code may seem acceptable to many people. Banning the simple instructions needed for CipherSaber will require the starkest abridgment of the First Amendment. Finally, CipherSaber can be a useful pedagogical tool, helping to educate students by presenting them with a real-world programming problem that has both technical and ethical dimensions. Teachers of computer science and authors of books on programming should consider including CipherSaber as an exercise in their courses and texts. CipherSaber in some sense parallels the time honored doctrine of jury nullification, where jurors simply refuse to convict persons of violating laws that the jurors determine are unreasonable or unjust. Similarly technologists may take lawful steps as individuals to prevent their work from being used to build a totalitarian infrastructure. It is not that the present U.S. Government is evil -- it may well be the most benign government in history. But once the technology for totalitarian control is in place, this or any government will inexorably use it more and more. And that technology is coming together with alarming rapidity. George Orwell{s novel 1984 is not science fiction, it is just one more high tech product plan that missed its original delivery date. So what is CipherSaber? CipherSaber-1 is a simple use of existing technology: 1. The encryption algorithm is RC4 as published in the beginning of Chapter 17 of Applied Cryptography, Second Edition, by Bruce Schneier, John Wiley & Sons, New York, 1996. RC4 is on page 397 in the English edition, ISBN 0-471-11709-9. 2. Each encrypted file consists of a ten byte initialization vector followed by the cipher text. A new random ten byte initialization vector should be created each time encryption is performed. 3. The cipher key, the array K(i) in Schneier's notation, consists of the user key, in the form of an Ascii text string, followed by the initialization vector. The above is all a programmer needs to know in order to write a program that can encipher and decipher CipherSaber-1 files. Explanation of CipherSaber-1 features The user key is a text string, rather than a hex value, because humans are more likely to be able to memorize a text string with sufficient entropy. To leave room for the initialization vector, the length of the user key must be less than 246 bytes. A user key with a minimum of 15 random letters or 6 short words selected at random from a dictionary should be used for medium security (70 bit entropy). For higher security use 20 random letters or seven random words. (90 bit entropy). Any unique values can be used for initialization vector, but use of random values makes encrypted files indistinguishable from random noise. Note that the initialization vector is not kept secret. The random number generation used to make the initialization vector does not have to be particularly strong. The "rand" functions in most programming environments will suffice for a moderate number of messages, provided the function is seeded in some non-deterministic way, such as using the system clock. For file encryption, a user need only memorize one key or passphrase. For messaging, users need to exchange pairs of keys through some secure means, most likely in person. Maintaining a list of correspondent{s keys or passphrases in a master file, preferably encrypted, is less convenient than public key encryption. But it may be all that is left in a few years if PGP key servers are banned. It may even be possible to teach a manual version of the Diffie-Hellman key exchange, perhaps using large number calculators (easily built in Java 1.1). The D-H procedure need be carried out just once per pair of correspondents, since CipherSaber eliminates the need to exchange keys for every message. Users can, of course, add features of their own to CipherSaber programs. For example a secure diary system that stored files in CipherSaber would be easy to write in Java or Visual Basic. However it is important to keep CipherSaber itself simple so everyone can write a program that will read and write CipherSaber files. CipherSaber programs can be easily written in almost any programming language. The Basic language, which used to come with all DOS based computers, is suitable. It can still be found on the Windows {95 CD-ROM in the OTHER\OLDMSDOS directory. Just copy QBASIC.EXE and QBASIC.HLP to your hard drive{s DOS directory and you can start programming. Macintosh users can download the free Chipmunk Basic interpreter from the Internet. Begin by writing a program that can copy binary files byte by byte and then test it thoroughly before you add the encryption algorithm. Become a CipherKnight To popularize CipherSaber, a "gif" file, encrypted using CipherSaber, has been posted on the Internet at http://ciphersaber.gurus.com/cknight.cs1 This file, when decoded, can be printed as a CipherKnight wall certificate. The certificate may be displayed by persons who met certain criteria, including writing the program that decrypted the certificates. Here are the honor-system-enforced rules: CipherKnight requirements 1. Write you own CipherSaber program. 2. Write a letter to your political representative expressing your opinion (whatever it may be) of the proposed ban on the distribution of strong cryptography within the United States. 3. Download and install PGP, generate a key pair and post it to a public key server. 4. Use a CipherSaber to send an secret message to another person. 5. Decrypt and print the CipherSaber wall certificate using the CipherSaber program you wrote yourself. The key is: "ThomasJefferson" Any of the eligibility requirements above is waved if it illegal in the applicant's local jurisdiction or if the applicant reasonably believes carrying it out would place him or her in danger. Test Files The following files are provided on the CipherSaber web site, http://ciphersaber.gurus.com, to help you check your work. cstest1.cs1 This is a short text file encrypted with "asdfg" as the user key. Here are the contents of cstest1.cs1 in hex, in case you cannot download the file for some reason: 6f 6d 0b ab f3 aa 67 19 03 15 30 ed b6 77 ca 74 e0 08 9d d0 e7 b8 85 43 56 bb 14 48 e3 7c db ef e7 f3 a8 4f 4f 5f b3 fd cstest2.cs1 This text file was CipherSaber-1 encrypted with the key "SecretMessageforCongress" Remember that keys are case sensitive. cknight.cs1 This file is encrypted with the key "ThomasJefferson" It contains your CipherKnight wall certificate as a .gif file. chalng.cs1 chalng.cs1 is a text file encrypted with CipherSaber-1 and a secret key. A reward of $100 will be paid to anyone who can decipher this file. Spread the Word "It is the common fate of the indolent to see their rights become prey to the active. The condition upon which God hath given liberty to man is eternal vigilance." John Philpot Curran, 1790 Even if the proposed ban on strong cryptography does not become law this year, it is important that CipherSaber be distributed as widely as possible throughout North America. Please help in any legal way you can. Arnold G. Reinhold Cambridge, Massachusetts arnold(a)iecc.com http://ciphersaber.gurus.com September 23, 1997 - ------------------------------------------ Ascii key+ || 08d0a5d961603380e2949d682c 10 Byte IV || bfe8da5c1dec3aba9725d4f689 Ron's No.4 || 40761763d4d38935e8bd8a44bf All u need ==== 4656a7bd7f9ae5d082a30cdfa7 CipherSaber || f21a918d29c5917956d0468eaf - ------------------------------------------ Legal Notice CipherSaber programs may be subject to export controls in the United States, and many other countries and may be illegal altogether in some countries. Persons within the United States should not give copies of CipherSaber programs to foreign nationals, except for Canadian citizens, without a license. Persons traveling to other countries should familiarize themselves with local regulations. Consult a lawyer if you need legal advice. See the CipherSaber web site http://ciphersaber.gurus.com for additional notices. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNClrG2truC2sMYShAQE6awQAsejPMAW+qYUZf7JXKXoL1XZl7Ebp7VPN 31yhKDmXFd8Ka9bss+HDwLSvMynigs/JmxzbGfVTc+Z1y5BqaqTqGcLcjHeEBnwb IVzLg9MsPs1MNytFpbay7m7ZKdGgbN4hIhM6kMF959Wk8oFeGfEDGWaC1/2GEJKt KHjU43k/A44= =bIlj -----END PGP SIGNATURE-----

1 0