December 2003 - cypherpunks-legacy

Re: Why the White amendment is a good idea (fwd)
by K. N. Cukier 17 Dec '03

17 Dec '03

Declan McCullagh forwarded the message by... >From: Robert Hettinga <rah(a)shipwright.com> -- who wrote: >> The NETCenter > >What an oxy-maroon. What a self-referent -- not to mention >self-congratulary -- canard. [...] > >Any entity which has the unmitigated presumption to have "center" and "net" >in its name demonstrates nothing less than total ignorance [...] > >Reality is not optional. Trying to find the "center" of any piece of the >net is equivalent to the cosmological "problem" of finding the "center" of >the universe. > >It represents the utter fallacy of hierarchy in a geodesic age. I take your point insofar as "NETCenter" and crypto, but you repeat a common misperception. Although the Net is tough to control, and it is a distributed system of networks, there are -- of course -- a number of centralized process. The Domain Name System is completely hierarchical. Moreover, Jon Postel of IANA represents the Net's central authority due to: 1. the IP number allocations, 2. the DNS "root", and 3. the technical standards, such as port numbers, etc. Unless there was a certain degree of centralized control, in an engineering perspective, the Net "Would Not Work." That's the fact, Jack -- n'est-ce pas? Yes, it is *possible* to do away with these centralized functions, and this is happening now, in a very non-public way. -- KNC

2 1

Chutzpah! FBI Calls Privacy Extremists Elitist
by David HM Spector 17 Dec '03

17 Dec '03

FBI Calls Privacy Extremists Elitist (09/25/97; 4:30 p.m. EDT) By David Braun, TechWire MONTREAL -- Extremist positions on electronic encryption are not only threatening to normal law enforcement, but they are also elitist and nondemocratic, said Alan McDonald, a senior counsel member with the Federal Bureau of Investigation, at the International Conference on Privacy in Montreal on Thursday. Addressing a workshop on how far society should go in trading off privacy for effective law enforcement, McDonald said privacy activists had fought any balance in proposed encryption legislation. "Such absolute positions threaten not only electronic searches but also conventional searches for data that has been encrypted," McDonald said. Absolute positions on privacy were "pernicious on several levels," McDonald added. The absolute positions "handcuffed" law enforcement while also raising rights for citizens to levels that were unreasonable and that would have been foreign to the nation's founding fathers. Extreme privacy positions were ultimately elitist and nondemocratic in that they presumed the views of a knowing privacy cognoscenti should pre-empt the views of the nation's elected officials and the Supreme Court, McDonald said. McDonald's statements came a day after a key committee of the U.S. House of Representatives rejected an FBI-supported proposal that would have compelled the makers of encryption products to include features that would enable law enforcement agencies to gain immediate and, if necessary, covert access to unscramble any coded data. Extremists presumed that the citizens could not trust the elected government and the Supreme Court to make decisions or to correct mistakes if any are made, McDonald said. "Based on a theory of potential government abuse, important tools commonly used are to be restricted or embargoed," McDonald said. McDonald said efforts in the United States to enhance effective law enforcement search and seizure capabilities had proceeded without harming legitimate privacy concerns. In the area of electronic surveillance, McDonald said, privacy enhancements had frequently received treatment "superior to that required under our Constitution." With minor exceptions, neither the laws nor the cases decided regarding effective law enforcement or privacy had come about with the view that either were absolute in their nature, McDonald said. Law enforcement measures had been tempered by considerations of personal privacy, and privacy laws had been balanced with effective law enforcement. Notwithstanding the substantial threats posed by national and international organized crime, drug cartels, and terrorists, the United States had remained true to its Constitutional moorings, and its commitment to a system of ordered liberties, McDonald said. "When people don't know much about electronic surveillance, they are fearful of it. But when they know Congress passed laws and the Supreme Court reviewed them and that there are numerous constraints and procedures, then it makes sense to them. It seems rational and balanced," McDonald said. -- ------------------------------------------------------------------------------- David HM Spector spector(a)zeitgeist.com Network Design & Infrastructure Security voice: +1 212.580.7193 Amateur Radio: W2DHM (ex-N2BCA) (ARRL life member) GridSquare: FN30AS -.-. --- -. -. . -.-. - .-- .. - .... .- -- .- - . ..- .-. .-. .- -.. .. --- "New and stirring things are belittled because if they are not belittled, the humiliating question arises, 'Why then are you not taking part in them?'" --H. G. Wells

8 8

RE: Oxley Amendment
by Michael Brock 17 Dec '03

17 Dec '03

I believe (as I am sure most here do) that crypto of any strength will become illegal, and that anyone sending a message in Pig Latin will soon be shot on sight by FBI the "protecting" our rights... Any control on encyrption, domestic or exportable, is unacceptable in today's high computing power society... Mandatory key escrow, well, you thought the IRS was corrupt... "Have you cracked RC5 today?" M. -----Original Message----- From: Declan McCullagh [SMTP:declan@well.com] Sent: Thursday, September 25, 1997 10:29 AM To: Lucky Green Cc: Michael Brock; cypherpunks(a)cyberpass.net Subject: Re: Oxley Amendment Lucky has it right. SAFE is extremely unlikely to go to the floor without additional "compromise." Then there's the "compromise" with whatever bill the Senate coughs up. Remember that pro-crypto legislation is dead there; only McCain-Kerrey got out of committee. Also remember the Senate is more conservative... Then there's the reality that no pro-crypto legislation would get past a presidential veto... -Declan At 07:16 -0700 9/25/97, Lucky Green wrote: >On Wed, 24 Sep 1997, Michael Brock wrote: > >> >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> I wonder if Mr. Solomon of NY will rethink his decision to not bring >> up SAFE without Oxley to the entire House after the unprecedented >> coaltion of companies and individual groups that came together to >> make sure that mandatory key recovery stays a "1984" like dream. I >> find it incomprehensible that one man, would block the introduction >> of this bill, after it being proved that this is what his >> constituents want.... > >What in the world makes you believe that Mr. Solomon's constituents would >want SAFE to go the the floor? SAFE *must* be defeated, with or without >the Oxley ammendment. > >-- Lucky Green <shamrock(a)cypherpunks.to> PGP encrypted email preferred. > "Tonga? Where the hell is Tonga? They have Cypherpunks there?"

1 0

Plea from a parent who wants to keep their kid free of SSNs
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- David C. Treibs writes via Declan McCullagh: >The Bible gives the responsibility of raising children to parents, not >to the government or any other entity. > >Forcing Social Security Numbers on children represents a major violation >of parents' God-given responsibility. While I am generally sympathetic with Mr. Treibs, it does not seem reasonable to ask for a government child subsidy while claiming the government has no business raising kids. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEUAwUBNCrALpaWtjSmRH/5AQFr+Qf2P6C4HBs9iAPAdTKPrQSPkpDIy6y3Sa4a GFpDuPoqS9DpCEM/6oQIqezy0AdFZD8L3A7/VmRyHMW1H72I+F3KrqrEjmdc6vbK zil8XnuezijL/4IisfN5PvWaL8NmT/7f+15BE4/qegXcWOwP7LM+oHKcuk01zJLX dvMXGwtmeRBJh+bqOIbv1y0mgfaHw08MEakmN5oA8BGhTu8IhRubttGCVG+jNY46 p47NqVYYa0tt0n1kMOWl2Y+qLWucvCRsuPAzfWJzDu+fzTvNsjNwn2IJfQN/O8Id C/jVQvJv3Eo99YOAlPa1XnSGyc7SWRg/VVMto114biIVw4UtaWdy =cxyC -----END PGP SIGNATURE-----

2 1

Remailer Attack
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- According to Raph's remailer stats, the remailers have widely varying latencies. Given that only a few remailers have latencies which are acceptably low, the list of usable remailers is quite low. If the user of the remailer, Monty Cantsin for example, signs his messages, a fairly accurate measure of total transit time is obtained. The total transit time gives clues to the remailers which were actually used in the chain. In an of itself, this may not comprise the user, but combined with other weaknesses it will cause the attacker to be significantly more confident of identification hypotheses. The remailers should all have about the same latency. 0 seconds seems like a good Schelling point. What would it take to reduce remailer latency to under 60 seconds for most of the remailers? Do people need old 486s to dedicate to the task? Do they need money? Better software? If you operate a remailer, please tell us what you need to make it really work well. Perhaps the rest of us can help make it happen. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNCrG4paWtjSmRH/5AQFuAAf+ID6TSjoUV1sVehzW6DoqVXREyO/fR4Uw H+W6QCiTOQaRhTD1Z6WSaL9FOaBJ5aSHCdLzKy9eIvagXsYR+eqVBdO0oSuDaloc BYSN+QXSKvMEuEotkCF4RicRoENlTmD0Qcrz4KvvW+d+jRxyxejs9O0HqDeTq9y/ KpBtq8CytpEMmGc6VSHuAX90qwJTtHUk/k4ulXU7v4xMmBLu1HpS/9M5h7mooybC 8qwVJKswAMI4wTB5FlBj/+b8txkCzMdqJkFdLEYu+LAGZfkB96W9uRU+eGekCHY2 6iycxv+m4r7wXPbP9A83Y6UnP4nkZBW86y7Du8NjVWGpscCfNjFF3g== =QjE1 -----END PGP SIGNATURE-----

8 8

RE: Why the White amendment is a good idea (fwd)
by Aaron Weissman 17 Dec '03

17 Dec '03

On Thursday, September 25, 1997 12:00 PM, Lizard [SMTP:lizard@dnai.com] wrote: > But to do that, you see, you'll need warrents, reasons for > suspiscion, and, becuase of the effort involved, you'll only do it > for serious crimes with a strong liklihood of conviction. *That* is > the 'stauts quo' law enforcement *claims* to want. and the technical realities of encryption, plus the limitations of any "NETCenter," will force a respect for, or at least compliance with, the 4th amendment. Hooray! Aaron

1 0

Re: Exports and criminalizing crypto
by John Smith 17 Dec '03

17 Dec '03

>From: Adam Back <aba(a)dcs.ex.ac.uk> >John Smith <jsmith58(a)hotmail.com> writes: >> Getting rid of these export restrictions would produce an explosion >> of Cypherpunk style crypto software. It is a big win. > >I disagree. > >Cypherpunk (freeware) crypto isn't hardly hindered at all by EAR >export nonsense. > >You reference Ian Goldberg claiming to have to work on crypto during >trips to Canada. I think he was just trying to make a political >point. I submit that he could write and publish all the crypto he >wants in the US (on one of those "export controlled" sites). It will >get illegally exported in no time at all. Where's the problem? That's easy for you to say, there in England. You don't have these export controls, right? How can you say what Ian Goldberg should do. I think he was not just making a political point. From what he said, he really does not release crypto from inside the US. Only when he goes to Canada, which isn't that often. I'll bet he could be releasing 3x more crypto if we didn't have the export laws. Is he on this list? Let's hear what he has to say. >William Geiger has PGP on a non-export controlled site, and the export >bods haven't said a word, so it's not even clear that they care about >freeware at this point. PGP is a special case because it is already out there everywhere. Still the example of Phil Zimmerman is a good one. Even though he got away with it eventually, they showed how they can make your life hard. Probably the only reason he didn't get charged was because they couldn't prove anything. Not many people are going to be willing to take that chance. William Geiger and a few others may be exceptions, but most people won't openly break a law which has strong penalties like this. There is nothing to stop te authorities from prosecuting William Geiger and even threatening him with jail. There is no guarantee that he will become another Zimmerman and get all kinds of donations and support. A lot of hackers thought they'd be heros but ended up doing time. Read that letter from Jim Bell if you want to see how different things look once the government comes down on you. >Also your claim that the FBI is defeated, and that safe is a good >idea. Disagree also. > >1) SAFE has lots more hurdles to pass before it gets to be law. Yes, I said that. It probably won't go anywhere this term. The big question will be what happens next year. But after all the opposition which came out, from practically every interest group there is, I am sure that there is no way domestic controls on crypto are going to pass. Even with the CDA there was not this much united opposition. Car companies and phone companies didn't fight the CDA. Religious right didn't fight the CDA. CDA passed, remember? FBI's bill did not. And all the opposition came together in a few days. Nobody was ready for this. Next year there will be more time to organize, and the opposition should be even stronger. >2) If it does get to be law, you won't like the modifications that are >made to it by that stage. That depends. The law may still be good. Who cares about this crypto center. That's just another boondoggle. The main thing is getting the export laws changed. >3) Crypto-in-a-crime US domestic restrictions are a _bad thing Stupid, yes, but not that big a deal. Everyone will have crypto so every crime will use it. Wouldn't it be better to have a world where every phone was encrypted? So what if they add crypto-in-a- crime to every crime where somebody used a phone to plan it. It's not like people aren't going to use phones, or they're going to turn off the crypto. It really won't have any effect on anybody, except maybe make some prison terms longer. That's not my issue, how long prison terms should be. I want to be able to use crypto. I hope this stupid mailer doesn't chop off my message again. "John ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

4 3

Re: Emphasizing a point by Donald Eastlake re key recovery
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:25 AM 9/25/97 -6, Peter Trei wrote: >Well, I dunno. About 18 months ago, I was involved with the >negotiations over the exportability of an SSL equipped web >server I had helped develop. The export model used 40 bit RC4 >and 512 bit keys. The initial version used 3DES to encrypt >stored private keys, and this was turned down. I modified it to >use single DES, and it passed. > >Note that this was for secret key storage only. This should be listed as yet another outrage of the current system -- perhaps reason to start another lawsuit. - Carl -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNCra7FQXJENzYr45AQECaQP/aqrptzzWdwjJsseEtIKGckIg0mXLRAFk APtO4O4hzeZJDVJ7QPKtJc6BqSU8uT5gs44rJR3SrUZ3g0D5RG4zyjue30Drhyor bmqQKJXsbtIW/wk0uPXA3EyfRusjUr51yVjPdkwhRsh6ta5YIvAusTAonSjAoJrf AL+F9+pFBPw= =yC89 -----END PGP SIGNATURE----- +------------------------------------------------------------------+ |Carl M. Ellison cme(a)cybercash.com http://www.clark.net/pub/cme | |CyberCash, Inc. http://www.cybercash.com/ | |207 Grindall Street PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 | |Baltimore MD 21230-4103 T:(410) 727-4288 F:(410)727-4293 | +------------------------------------------------------------------+

1 0

RE: Why the White amendment is a good idea #2
by Aaron Weissman 17 Dec '03

17 Dec '03

On Thursday, September 25, 1997 11:34 AM, Tim May [SMTP:tcmay@got.net] wrote: > Though we as technical people are usually cautious to say that > "unbreakable" is a dangerous word, the fact is that it's our current best > description of what a 2000-bit RSA key is, and that's all there is to it. I don't dispute you -- in the slightest -- that a brute force attack against a 2000-bit RSA key is functionally impossible today. However, I don't think that a brute force attack is the most likely for a functional law enforcement (or national security) crypto lab. Unless you think that today's algorithms and conventional random number generators are perfect ... Aaron

1 0

RE: Why the White amendment is a good idea (fwd)
by Aaron Weissman 17 Dec '03

17 Dec '03

On Thursday, September 25, 1997 11:34 AM, Tim May [SMTP:tcmay@got.net] wrote: > The NETCenter is largely duplicative, though will be much less effective, > than the NSA. I strongly urge Aaron and others to review the history and > capabilities (and limitations) of the NSA. Sure, it is duplicative. However, for this thing to become law, I envision a rather dramatic shift in the organization of our intelligence institutions. Or at least a change in some of the building names at Ft. Meade :) > (The NSA sometimes assists with law enforcement. But often it does not. I > grant that a purely civilian codebreaking facility might once have been > needed. But for reasons I'll get to below, it's much too late to start now! > And much too expensive.) There is an exective order or presidential decision directive (pdd) from the mid-80's that formalizes a "relationship" between the NSA and FBI for law enforcement decryption. However, I never was able to get my hands on it ... Aaron

1 0