December 2003 - cypherpunks-legacy

NYT cybertimes article excerpt.
by Peter Trei 17 Dec '03

17 Dec '03

quoted without permission - I think this is fair use... btw, the NY Times site is pretty good. While a registration and email address are needed, I have not seen any sign of abuse of this information (yet). ----------------------------------------- start quote In fact, Kerrey's legislation could easily create the largest bureaucracy ever -- by some estimates requiring more record keeping than all the states' departments of motor vehicles, the Internal Revenue Service and the various welfare agencies combined. While no one knows how Congress or the FBI intends to carry out key-recovery legislation, it is entirely possible that anyone installing a piece of software on a hard drive will need to register it like people now register a car with the Department of Motor Vehicles. While most people own only one car and file only one tax return a year, many computer users have multiple copies of programs like Quicken, Notes or Power Point. Each could require a separate registration if it includes encryption features -- and many users will be shocked to discover what qualifies as encryption, which is becoming increasingly common even in trivial programs like games because it is a good way to regulate copyright infringement. [...] One Congressional staff member who participated in drafting the legislation but asked not to be identified conceded that the bill would force developers of new software to seek approval for their products from the United States government even if the products did not explicitly include encryption features. Such approval would be the only -> way to escape prosecution, he said. While admitting that -> this language would add a six- to nine-month delay in -> releasing new products, the staff member asserted that the -> computer industry would simply have to build this time into -> product development cycles. end quote -------------------------------------- This "Congressional staff member" is clearly a ninth-dan black belt ninja of cluelessness. Add 6-9 months to SW development cycles? Prior restraint on SW publication? The mind boggles. Anyone who maintains that the convenience of law enforcement should be the over-riding factor in the organization of our society has, in my opinion, lost the right to call themselves an "American." Peter Trei trei(a)process.com DISCLAIMER: My opinons. No one elses.

1 0

The CipherSaber Manifesto
by Arnold G. Reinhold 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In George Lucas' Star Wars trilogy, Jedi Knights were expected to make their own Light Sabers. The message was clear: a warrior confronted by a powerful empire bent on totalitarian control must be self-reliant. As we face a real threat of a ban on the distribution of strong cryptography -- in the United States and possibly world-wide -- we must emulate the Jedi masters by teaching people how to build strong cryptography programs all by themselves. If this can be done, strong cryptography will become impossible to suppress. While cryptographers like to wallow in the complexity of their art, the basic elements of a strong cryptographic system are quite simple and well known in the programming community. By choosing a simple but strong cipher that is already widely published and agreeing on how to use it, anyone with elementary programming skills will be able to write their own program without relying on any products that can be banned. CipherSaber-1 (CS1) uses Ron Rivest's RC4 algorithm as published in the second edition of Bruce Schneier's Applied Cryptography. RC4 is widely respected and used in a number of products, including SSL. With a long enough key RC4 is considered strong and it is also extraordinarily easy to explain and to reproduce. As Schneier says, "The algorithm is so simple that most programmers can quickly code it from memory." Implementations of RC4 are available on the Internet but it is actually easier to write your own version. The legal status of RC4 is the subject of some controversy. The RSA division of Security Dynamics still considers RC4 confidential and proprietary. It is not patented and, to the extent that Schneier is correct (and no one doubts him), it is not confidential. However, anyone wishing to build a commercial product using CipherSaber might find it cost-effective, as well as polite, to obtain a license from RSA. Apologies to Prof. Rivest for suggesting individuals use his invention without his consent. If there were another strong algorithm so singularly suitable, CipherSaber would have used it. CipherSaber-1 is a symmetric-key file encryption system. Messaging takes place by attaching binary files to e-mail. Because CipherSaber uses a stream cipher, an initialization vector must be used to prevent the same cipher key from being used twice. In encrypted CipherSaber-1 files, a ten byte initialization vector precedes the coded data. For decryption, the initialization vector is read from the file and appended to the user key before the key setup step. CipherSaber-1 can be implemented in 16 lines of QBasic (38 individual Basic statements). The source code is short enough for tee-shirts and coffee mugs. But there is no need to distribute source code at all. CipherSaber can be passed on by oral tradition, if necessary. Soapbox The U.S. Congress is considering legislation that would ban the domestic distribution of cryptographic products that do not provide for immediate government access to the plaintext of messages. This government access must be possible without the consent or even the knowledge of the message{s sender or recipient. The stated intent is to protect us from criminals and terrorists. The simplicity of CipherSaber should prove once and for all that the criminals and terrorists of this world will not be deprived of strong cryptography simply because the distribution of unapproved products is banned. They can get the necessary technology to make their own from existing publications whenever they feel they need it. Another goal of CipherSaber is to demonstrate that strong cryptography cannot be banned without severe restrictions on freedom of speech. Banning the sale of a complex computer program or even the multi-volume printed edition of PGP source code may seem acceptable to many people. Banning the simple instructions needed for CipherSaber will require the starkest abridgment of the First Amendment. Finally, CipherSaber can be a useful pedagogical tool, helping to educate students by presenting them with a real-world programming problem that has both technical and ethical dimensions. Teachers of computer science and authors of books on programming should consider including CipherSaber as an exercise in their courses and texts. CipherSaber in some sense parallels the time honored doctrine of jury nullification, where jurors simply refuse to convict persons of violating laws that the jurors determine are unreasonable or unjust. Similarly technologists may take lawful steps as individuals to prevent their work from being used to build a totalitarian infrastructure. It is not that the present U.S. Government is evil -- it may well be the most benign government in history. But once the technology for totalitarian control is in place, this or any government will inexorably use it more and more. And that technology is coming together with alarming rapidity. George Orwell{s novel 1984 is not science fiction, it is just one more high tech product plan that missed its original delivery date. So what is CipherSaber? CipherSaber-1 is a simple use of existing technology: 1. The encryption algorithm is RC4 as published in the beginning of Chapter 17 of Applied Cryptography, Second Edition, by Bruce Schneier, John Wiley & Sons, New York, 1996. RC4 is on page 397 in the English edition, ISBN 0-471-11709-9. 2. Each encrypted file consists of a ten byte initialization vector followed by the cipher text. A new random ten byte initialization vector should be created each time encryption is performed. 3. The cipher key, the array K(i) in Schneier's notation, consists of the user key, in the form of an Ascii text string, followed by the initialization vector. The above is all a programmer needs to know in order to write a program that can encipher and decipher CipherSaber-1 files. Explanation of CipherSaber-1 features The user key is a text string, rather than a hex value, because humans are more likely to be able to memorize a text string with sufficient entropy. To leave room for the initialization vector, the length of the user key must be less than 246 bytes. A user key with a minimum of 15 random letters or 6 short words selected at random from a dictionary should be used for medium security (70 bit entropy). For higher security use 20 random letters or seven random words. (90 bit entropy). Any unique values can be used for initialization vector, but use of random values makes encrypted files indistinguishable from random noise. Note that the initialization vector is not kept secret. The random number generation used to make the initialization vector does not have to be particularly strong. The "rand" functions in most programming environments will suffice for a moderate number of messages, provided the function is seeded in some non-deterministic way, such as using the system clock. For file encryption, a user need only memorize one key or passphrase. For messaging, users need to exchange pairs of keys through some secure means, most likely in person. Maintaining a list of correspondent{s keys or passphrases in a master file, preferably encrypted, is less convenient than public key encryption. But it may be all that is left in a few years if PGP key servers are banned. It may even be possible to teach a manual version of the Diffie-Hellman key exchange, perhaps using large number calculators (easily built in Java 1.1). The D-H procedure need be carried out just once per pair of correspondents, since CipherSaber eliminates the need to exchange keys for every message. Users can, of course, add features of their own to CipherSaber programs. For example a secure diary system that stored files in CipherSaber would be easy to write in Java or Visual Basic. However it is important to keep CipherSaber itself simple so everyone can write a program that will read and write CipherSaber files. CipherSaber programs can be easily written in almost any programming language. The Basic language, which used to come with all DOS based computers, is suitable. It can still be found on the Windows {95 CD-ROM in the OTHER\OLDMSDOS directory. Just copy QBASIC.EXE and QBASIC.HLP to your hard drive{s DOS directory and you can start programming. Macintosh users can download the free Chipmunk Basic interpreter from the Internet. Begin by writing a program that can copy binary files byte by byte and then test it thoroughly before you add the encryption algorithm. Become a CipherKnight To popularize CipherSaber, a "gif" file, encrypted using CipherSaber, has been posted on the Internet at http://ciphersaber.gurus.com/cknight.cs1 This file, when decoded, can be printed as a CipherKnight wall certificate. The certificate may be displayed by persons who met certain criteria, including writing the program that decrypted the certificates. Here are the honor-system-enforced rules: CipherKnight requirements 1. Write you own CipherSaber program. 2. Write a letter to your political representative expressing your opinion (whatever it may be) of the proposed ban on the distribution of strong cryptography within the United States. 3. Download and install PGP, generate a key pair and post it to a public key server. 4. Use a CipherSaber to send an secret message to another person. 5. Decrypt and print the CipherSaber wall certificate using the CipherSaber program you wrote yourself. The key is: "ThomasJefferson" Any of the eligibility requirements above is waved if it illegal in the applicant's local jurisdiction or if the applicant reasonably believes carrying it out would place him or her in danger. Test Files The following files are provided on the CipherSaber web site, http://ciphersaber.gurus.com, to help you check your work. cstest1.cs1 This is a short text file encrypted with "asdfg" as the user key. Here are the contents of cstest1.cs1 in hex, in case you cannot download the file for some reason: 6f 6d 0b ab f3 aa 67 19 03 15 30 ed b6 77 ca 74 e0 08 9d d0 e7 b8 85 43 56 bb 14 48 e3 7c db ef e7 f3 a8 4f 4f 5f b3 fd cstest2.cs1 This text file was CipherSaber-1 encrypted with the key "SecretMessageforCongress" Remember that keys are case sensitive. cknight.cs1 This file is encrypted with the key "ThomasJefferson" It contains your CipherKnight wall certificate as a .gif file. chalng.cs1 chalng.cs1 is a text file encrypted with CipherSaber-1 and a secret key. A reward of $100 will be paid to anyone who can decipher this file. Spread the Word "It is the common fate of the indolent to see their rights become prey to the active. The condition upon which God hath given liberty to man is eternal vigilance." John Philpot Curran, 1790 Even if the proposed ban on strong cryptography does not become law this year, it is important that CipherSaber be distributed as widely as possible throughout North America. Please help in any legal way you can. Arnold G. Reinhold Cambridge, Massachusetts arnold(a)iecc.com http://ciphersaber.gurus.com September 23, 1997 - ------------------------------------------ Ascii key+ || 08d0a5d961603380e2949d682c 10 Byte IV || bfe8da5c1dec3aba9725d4f689 Ron's No.4 || 40761763d4d38935e8bd8a44bf All u need ==== 4656a7bd7f9ae5d082a30cdfa7 CipherSaber || f21a918d29c5917956d0468eaf - ------------------------------------------ Legal Notice CipherSaber programs may be subject to export controls in the United States, and many other countries and may be illegal altogether in some countries. Persons within the United States should not give copies of CipherSaber programs to foreign nationals, except for Canadian citizens, without a license. Persons traveling to other countries should familiarize themselves with local regulations. Consult a lawyer if you need legal advice. See the CipherSaber web site http://ciphersaber.gurus.com for additional notices. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNClrG2truC2sMYShAQE6awQAsejPMAW+qYUZf7JXKXoL1XZl7Ebp7VPN 31yhKDmXFd8Ka9bss+HDwLSvMynigs/JmxzbGfVTc+Z1y5BqaqTqGcLcjHeEBnwb IVzLg9MsPs1MNytFpbay7m7ZKdGgbN4hIhM6kMF959Wk8oFeGfEDGWaC1/2GEJKt KHjU43k/A44= =bIlj -----END PGP SIGNATURE-----

1 0

Update from the House Commerce Committee hearing room
by Declan McCullagh 17 Dec '03

17 Dec '03

I'm sitting on the steps of the Rayburn House office building right now waiting for the committee to resume deliberations on the SAFE encryption bill. They've adjourned to vote on unrelated legislation on the House floor. Right now it seems as though votes are split between Rep. White's "compromise" legislation (that includes a cash payoff to the FBI and doubling of crypto-in-a-crime penalties while relaxing some export rules) and Rep. Oxley's proposal that includes domestic controls on encryption. If I had to bet, though, I'd put my money on Oxley. Law enforcement arguments about pedophiles generally trump discussions of privacy rights. If White's proposal fails and Oxley's goes through, industry groups are hoping they can keep themselves from being entirely screwed by pushing through a third amendment that apparently would replace SAFE entirely with a five-month study. (But who would appoint the people conducting the study? Law enforcement? It's unclear.) Rep. Solomon, chair of the powerful House Rules committee -- through which SAFE must pass before it gets to the floor -- earlier today circulated a letter asking members to support the Oxley amendment. "If this language is not incorporated into the bill, as the Chairman of the House Rules Committee I will not move the bill to the floor!" it says. FBI director Louis Freeh, DEO head Thomas Constantine, and Raymond Kelley (undersecretary for enforcement, Treasury Department) also sent a letter earlier today to the Commerce Committee endorsing Oxley's amendment "on behalf of the entire law enforcement community." They don't seem to be exaggerating. The International Association of Chiefs of Police on September 22 said just that. So did the National Sherrifs' Association yesterday. And the National District Attorneys Association on September 19. And the Major Cities Chiefs on September 23. Plus a few state police associations. More soon... -Declan ------------------------- Declan McCullagh Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

3 2

You Used MY Name?!?!?
by bureau42 Anonymous Remailer 17 Dec '03

17 Dec '03

To: senator(a)feinstein.senate.gov From: HugeCajones Remailer<hc(a)dev.null> X-Mailer: WinSock Remailer Version ALPHA1.3B X-Comments: - X-Comments: "He who shits on the road, will meet flies upon his return." X-Comments: - X-Comments: "GOMEZ IS COMING!" X-Comments: - X-Comments: This message is NOT from TruthMonster. X-Comments: It was sent by an automated anonymous asshole under the X-Comments: auspices of the Electronic Forgery Foundation. X-Comments: - X-Comments: Note: Send any complaints about abuse of this remailer X-Comments: to the person most concerned about your rights and X-Comments: freedoms. (Hint: It's a "mirror" site.) X-Comments: - X-Remailer-Setup: Maximum Message Size -- None X-Remailer-Setup: Reordering is OFF X-Remailer-Setup: News Posting DISABLED X-Remailer-Setup: Subject Header KEPT X-Remailer-Setup: Logging COMPLETE Messages X-Remailer-Setup: No PGP messages accepted Subject: !!! DEATH THREAT !!! You should be careful before you do foolish things like making a death threat because it can have really bad results. It can make people really nervous and think maybe they should get you first. Sometimes they hire other people to get you before you get themreally bad people sometimes. Sometimes even bad people who act like they are good people and fool everyone until they kill you. Which brings me to the point I am trying to make: You should not try to kill the Constitution any more because there is not enough left to make people safe and they might get really nervous and think maybe they should get you firstor even after. For revenge. People like the Constitution a lot and if you are making a death threat against it then it is like saying your going to kill someone elses friend or family and everyone knows that they will kill you because they are domestic and not a stranger. Or is it that they are stranger and not domesticated? Never mind. You know what I mean. Especially if you try to make it so that they cannot put aluminum foil hats on their thoughts and their words and their writing. Then they get really, really, nervous and maybe start thinking that they have to kill everybody because they are not safe from anybody. You should be careful if you find yourself walking next to someone whistling that Crosby Stills & Nash song "If you cant kill the one you lovethen kill the one youre with." (ç Thats a joke but it would be really funny if you took it serious and whacked someone out for whistling it anyway.) (Its not like they have a Constitutional right to whistle it or anything....hee, hee.) You should be careful before you vote to kill the Constitution and look under all your chairs and stuff, just in case. You should maybe look in your conscience too and see if you are not a bad person maybe. You should also maybe look in a mirror and make sure you are not cross eyed and that there is nobody beside you whistling that song "If looks could killthen you would only be hurting yourself."(<== that's a joke.) Even if you do think you can kill the Constitution and still have all of the people believe you are not a bad person then you should at least try not to let really stupid people who you work with say things like "I am too stupid to learn about this stuff so I am going to let the guys who want to make aluminum foil hats illegal and put everyone in jail decide how I vote to kill the Constitution." The one those guys who always say "Nuke DC" call Swinestein said that and it made everyone think you are all that stupid and going to let people with guns who kill women and children make your votes for you. Then even more of them say "Nuke DC" especially when they remember how bad the guys with the guns that you are letting vote for you fucked their friend (sorry but thats what they did) for making a stink with the IRS. That is really all I am trying to say. Is that you should be careful that you dont kill so much of the Constitution and let the guys with the guns screw so many people that nobody feels safe from them anymore because they wont just get nervous about them they will get nervous about you too because you promised to protect them and didnt. Just try to remember that it never ends. If you take away some of the guns from people then you have to take away all the guns or you are in big trouble. If you take away some of the Constitution from people then you have to take away all of the Constitution or you are in big trouble. Even if you think you took away all of the things that people can use to be safe and free then they will make morelike Doritos. If you try to kill them with bullshit then they will try to kill you with their own brand of fertilizer. If you take away their aluminum foil hats then they will make hats out of paper and call them Forever Young. Killing the Constitution is a lot like killing DCif your going to do it then you might as well do it right and do it all at once. Guys with guns who want to kill Freeh-dumb know that and so do guys with nukes who are Freeh-dumb fighters. (My uncle made up a new word about himhe said he "testiLies to Congress.") Dont be a stranger, APlayerToBeNamedLater p.s - If you see Declan McCullagh getting in his car and driving like hell away from the city then you should get in your car and do the same thing. You dont need to pack a suitcase because I think if he does that then there is already one packed. (Thats what the guys with guns told you in your secret meetings so you will kill the Constitution for them isnt it?) p.p.s.- If you hear someone say "President Freeh" then do not wait for Declan just get the hell out of there real fast anyway. You can come to my place if you want and help me send out secret aluminum foil hats. (Bring a whoopee cushion and we will make little funny booms instead of big scary ones. We are a little more laid back out here in the country than you guys in the big city.)

2 1

SAFE = Security and Fascism through Escrow
by Tim May 17 Dec '03

17 Dec '03

As our Big Brothers in D.C. continue to abuse the language by taking SAFE in a direction 180 degrees from the original intentions, it seems only fair that we rename the bill the Security and Fascism through Escrow Bill. --Tim May The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

BXA TAC meeting in Portland yesterday
by Greg Broiles 17 Dec '03

17 Dec '03

As noted previously by John Young <http://www.jya.com/bxa082597.htm>, the Department of Commerce's Bureau of Export Administration's Technical Advisory Committee held a meeting yesterday in Portland, OR. C2Net paid for me to fly up to Portland and attend the meeting. The following are notes re what happened - It was difficult to determine precisely who is on the Committee and who isn't; the meeting room had a table with seats for (approx) 15 people; at that table were seated approx. 10 people who were representing hardware/software manufacturers, law firms, 2 people from BXA, two "special guests" from European companies (whose names I didn't recognize), and two "special guests" from Japanese companies - Susumi Hirai for Sony, and Kobashi Toduchi for NEC. (apologies for the spelling re Japanese names, those are my guesses at the correct spellings, but I bet they're wrong.) There were seats in an "audience section" for another 30 people, all of which were occupied. Among the companies represented (either in the audience or on the committee) were Tektronix, Boeing, Dept of Energy, Motorola, Intel, Rockwell, Novell, McDonnell-Douglas, Boeing, Cisco, and Sun, and C2Net. The attorney who spoke at a Cypherpunks meeting this spring re export control was there, don't know if he was there on behalf of PGP and/or other clients. (arrgh, didn't write his name down because I remembered it, now I can't remember it.) There was an attorney representing a consortium of manufacturers. The meeting opened with a short summary/discussion of current events - this part produced the most information relevant to crypto and export control issues. Eileen at BXA (didn't get her last name), who seems to be in charge of drafting regulations and granting/denying export licenses, said that they've been slow recently re actions on crypto-related licenses because they're understaffed, but they have recently hired 10 people to process crypto-related applications, 8 of whom are in public-contact positions. She said that they don't have a technical background, but are considered policy analysts; that they've been receiving technical training from "other agencies", but their technical training (and their ability to get straight to work) has been hampered by the slowness of getting security clearances for them. 2 of the 10 have already been cleared/approved. She said that they've been learning about the "history of encryption". The public-contact positions will each handle a section of the alphabet - so, for example, the first person will handle export applications from individuals/companies with names starting from A through F, and so on. Eileen said that they have been circulating a new draft of encryption regulations relating to/concerning financial institutions; a draft of it was apparently circulated (I think) to a closed-session meeting of the Committee previously. One of the committee members asked her for a ballpark estimate of the date when those regs will be released for public comment, and she deferred, saying that there were "so many agencies" that had to look at them that it was too difficult to guess. Apparently, the most difficult/controversial part of these regulations concerns the definition of a financial institution (FI); she said that they've been granting licenses to applicants who are clearly FI's, and that organizations who think that they might qualify as an FI should write to BXA and request an advisory letter or opinion letter about whether or not they qualify. She also said that they've been drafting and circulating export regulations designed to implement the Wassenaar Arrangement; they've been circulating inter-agency. She said that they anticipate having the final draft finished at the end of this week or the beginning of next week, at which point it'll be sent to the Federal Register for publication; and that FR publication will take 2 more weeks, so these ought to be available to the public sometime in mid-October. She also noted that BXA has been relatively inactive with respect to enforcement actions re cryptography, but that the enforcement/compliance section of BXA has also made new hires, and that they anticipate ramping up enforcement. 5-6 people from the enforcement section were at the meeting (turns out I sat right next to them) but they all left at 10 AM for another meeting - among them a DOC/BXA attorney I recognized from the Bernstein hearings. After that, the committee spent approx. 2 hours discussing nonproliferation controls (related to nuclear/biological/chemical weapons) - I didn't bother with a lot of notes about that, since it's not especially interesting to me right now. There was a lot of discussion about how difficult it is to determine whether or not an export is allowed or not - as I understand the regs it's not permissible to export *anything* which will be used in aid of producing N/B/C weapons, even otherwise unassuming things like lightbulbs or ballpoint pens or carpeting or whatever. (I don't know much about this area of export law, so please don't take my impressions as especially informative, haven't done reading/research re this and I may be full of shit. caveat emptor.) Everyone who doesn't work for the government expressed frustration re the difficulty of figuring out how much effort they need to put into tracking down the ultimate user(s) and purpose(s) of otherwise innocuous exports - the BXA folks weren't very helpful, pointing out that they're going to exercise their discretion not to enforce/punish exporters who really weren't at fault, but that there were no hard and fast rules available, either. The discussion here reminded me very much of recent testimony by the Commerce Dept before Congress - they're more concerned with intelligence (collecting data re who's buying what, in what quantities, and when) than they are with preventing people from gaining access to goods. There was also some discussion about foreign implementations of crypto export controls and Wassenaar - apparently Jim Lewis (the name isn't familiar to me) and David Aaron are currently in London, lobbying re crypto export control/key escrow, and a delegation will go to France, Bonn, and Tel Aviv later this month on a similar mission. One speaker said that he expects the UK to adopt controls re "intangible" items - by this he seemed to mean control over the export of "technical data" and "technical assistance" related to controlled items, similar to the US' control over providing data/information/assistance to foreigners related to export-controlled items. It was also noted that there are a lot of "informal contacts" in the UK between universities and employers and the visa office, such that the UK has been able to control some access by foreign people to technical data and information, by refusing them a visa or otherwise making their desires clear to the people in the UK who they expect would have contact with the foreign person. Re Japan, it was noted that Japan began enforcing much stricter export controls at the end of 1996, shortly after NTI developed a 3DES chip; MITI (Japan's "technology" ministry? perhaps someone can provide more data here) has concluded that exports of crypto stronger than 56 bits should be subject to strict export control. Japan does not have a "general license" scheme, whereby some products are generally considered eligible for export, which would apply to crypto - apparently all exports equire a license. About 100 Japanese companies have applied for or been granted (couldn't tell from the context) export licenses for crypto. Japan does not have special "financial institution" exceptions to its crypto export control laws; but it does implement the "mass market software" exception for crypto which is part of the Wassenaar Arrangement. There was some discussion re crypto export control in the EU; the speakers noted that crypto control laws apply to GSM phones, which (potentially) would have made them non-portable across national borders, which everyone (including governments) thought was a stupid result, so GSM phones are (formally? informally? couldn't tell) exempt from the export control laws. Similarly, it is now legal to have/use crypto on a laptop for personal use; at one time, this was not the case, but large companies' policy was that crypto should be used anyway, regardless of the export control laws. EU countries are also (apparently) writing the "mass market software" exception to the WA's control over crypto into their regulations; one speaker commented that the EU countries are "working on" key recovery. (the term used was "key escrow"). The consensus of the speakers seemed to be that the TTP/key escrow draft legislation for the UK is effectively dead, due to the shift in power to Labor. It was also noted that the Walsh Report re crypto in Australia recommends that purchasers of crypto equipment in Australia avoid depending solely on US-based sources for crypto, because of the danger that the US may implement mandatory key recovery. I'm on the mailing list to get formal minutes from the meeting, but that can apparently take up to 90 days. The next meeting will be 12/9/97 in D.C.. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | Export jobs, not crypto. http://www.io.com/~gbroiles | http://www.parrhesia.com

1 0

cancel subscription
by DONN CARROLL 17 Dec '03

17 Dec '03

Please cancel my sbscription to the encription letter. there are to many. Donn, syzygy(a)mymail.net

1 0

What is a crypto product. Was [nobody@replay.com: Re: "priorproducts"]
by Martin Minow 17 Dec '03

17 Dec '03

(I've changed the list from coderpunks to cypherpunks, as this is getting off-topic for the former list.) At 12:48 AM -0500 9/17/97, Black Unicorn wrote: > >This brings up interesting coding implications. What is a "cryptographic >product" and to what extent can key generation be seperated from the >definition. To what extent do we want it to be? > I would say that a "cryptographic product" is any [insert patent lawyer language here] that can be used to encrypt or decrypt a message, and a "key" (the thing you escrow) is the mechanism by which a message is converted between plaintext and encrypted text. (Note, then, that I am including both halves of a public key pair.) By this, admittedly devil's advocate, reasoning, the sender would have to escrow the actual session key, not just the private key that the receiver uses to recover the session key. After all, if you use PGP to encrypt a message using a public key -- and don't possess the corresponding private key -- you couldn't read your own message, but my reading of the law is that the government still must have immediate access to the plaintext. Martin Minow minow(a)apple.com

1 0

FWD: Dear Representative Oxley
by Anthony Garcia 17 Dec '03

17 Dec '03

For what it's worth. -Anthony Date: Wed, 24 Sep 1997 17:47:37 -0500 (CDT) From: Anthony Garcia <agarcia(a)Starbase.NeoSoft.COM> To: Mike.Oxley(a)mail.house.gov cc: agarcia Subject: Dear Representative Oxley At this time, it looks like your ignorant, anti-Constitutional amendment to the Safety And Freedom through Encryption Act will be passed by the Commerce Committee. This legislation may go on to be passed by Congress and signed into law by the President. In case this occurs, I would like you to make note of my home address and telephone number. They are: Anthony Garcia [address & phone elided for broadcast on cypherpunks list] If I move to a new address in the future, I will update you. I telling you this because I fully intend to willfully break your stupid law exactly 1 minute after the moment it goes into effect on January 1st, 1999. I will: - Manufacture an encryption product that does not support key escrow (I will compile source code for encryption software which does not support key escrow.) - Offer to sell that encryption product to any takers for the sum of $1. - Offer that encryption product for free to the public via FTP or HTTP file transfer over the Internet. - Import an encryption software product which does not support key escrow by means of file transfer over the Internet from a foreign source. So, get ready to arrest me, Big Mike. Get out your old FBI shield and shine it up, because I AM GOING TO BREAK YOUR LAW. GOT IT? Sincerely, -Anthony Garcia agarcia(a)neosoft.com P.S. When you have some free time, look up a document known as the "Bill of Rights", and review the sections titled "First Amendment" and "Fourth Amendment".

1 0

bombs
by JuanPyro＠aol.com 17 Dec '03

17 Dec '03

im writing a screenplay and need very detailed instructions on how to make a bomb

3 2