December 2003 - cypherpunks-legacy

Domain name hearings starting right now. (www.democracy.net)
by Shabbir J. Safdar 17 Dec '03

17 Dec '03

The domain name hearings are going on right now (you can listen in realaudio) at http://www.democracy.net/ The future of the infrastructure hangs in the balance of this debate. Check it out. -S

1 0

opponents of GAK
by amp＠pobox.com 17 Dec '03

17 Dec '03

Has anyone out there been keeping track of all the organizations, corporations and others who have come out against GAK? Pointers would be appreciated. alan ------------------------ Name: amp E-mail: amp(a)pobox.com Date: 09/25/97 Time: 09:17:21 Visit me at http://www.pobox.com/~amp == -export-a-crypto-system-sig -RSA-3-lines-PERL #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/) == 'Drug Trafficking Offense' is the root passphrase to the Constitution. Have you seen http://www.public-action.com/SkyWriter/WacoMuseum ------------------------

1 0

American Banker - National ID - addendum
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: rhornbec(a)counselpop.com Mime-Version: 1.0 Date: Thu, 25 Sep 1997 05:59:31 -0500 Reply-To: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> Sender: Digital Signature discussion <DIGSIG(a)VM.TEMPLE.EDU> From: Rick Hornbeck <rhornbec(a)COUNSEL.COM> Subject: American Banker - National ID - addendum To: DIGSIG(a)VM.TEMPLE.EDU Either the Temple listserve is automatically limiting the length of my posts (<gr>) or I discovered a new e-mail bug. Here is the balance of the excerpt from the American Banker article I intended to post earlier. ==================== What actions should a certificate authority be required to take in this imperfect system to certify that X's public key actually is being used by X? To allow the electronic marketplace to operate effectively and efficiently, at a minimum certificate authorities must be able to achieve some level of certainty that if they have prudently conducted the due diligence required, they cannot be held responsible for fraud or malfunctions. National Identification Verification Standards-NIVS-would underscore that there should be only a limited range of actions for which a certificate authority should be held responsible in an electronic transaction. These standards eventually would need to be truly universal because of the globality and borderlessness of cyberspace. Moreover, such standards could level the playing field vis-a-vis the different levels of trust that might otherwise be accorded certificate authorities of various sizes, financial capacity, name recognition, and national origin. What should the elements of these national verification standards be? The more that the system relies on primary "root" documentation (paper or electronic) certified by the originator, the greater the certainty, albeit imperfect, that the certificate authority can achieve. The adoption of an integrated certification data base accessible to all certificate authorities must also be explored. A network that will allow each certificate authority to cross-reference digital certificates and confirm the issuance of multiple certificates to the subscriber will allow the digital signature market to function more efficiently and safely. >From a legal point of view, a digital certificate is a form of warranty. Warranties ascribe and allocate rights in a transaction, a business that commercial banks happen to understand quite well. But a digital certificate is not meant and should not be viewed as unlimited insurance for the use of the certificate or the successful completion of an electronic transaction facilitated by that certificate. In that regard, the adoption of these standards might facilitate the development of a national market for certificate authority errors-and- omissions insurance. It might also facilitate the creation and operation of what one observer has called "cybernotaries." Without uniformity in the authentication process, the efficiencies of certificates and the effectiveness of electronic commerce will be undercut. Richard N. Hornbeck Electronic Commerce Services "The most important step in arriving at the right answer, is asking the right question." Albert Einstein ("Al"). --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: Emphasizing a point by Donald Eastlake re key recovery
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Wed, 24 Sep 1997 10:15:45 -0400 > To: Ross Anderson <Ross.Anderson(a)cl.cam.ac.uk> > From: Carl Ellison <cme(a)cybercash.com> > Subject: Re: Emphasizing a point by Donald Eastlake re key recovery > Cc: cypherpunks(a)toad.com, Ron Rivest <rivest-only(a)theory.lcs.mit.edu>, > cme(a)cybercash.com > Reply-to: Carl Ellison <cme(a)cybercash.com> > -----BEGIN PGP SIGNED MESSAGE----- > > At 09:34 AM 9/23/97 +0100, Ross Anderson wrote: > >There is also the point that the vast majority of encryption keys are > >actually used for authentication rather than confidentiality. The keys > >that encrypt your bank card PIN en route from the ATM to the bank, the > >keys in your satellite TV decoder, the keys in your gas meter and your > >postal meter - in fact the majority of all DES keys in use - are about > >authentication. In theory most of them could be replaced by digital > >signature mechanisms but given the size of the installed base, it > >won't happen anytime soon. > > For what it's worth, I once got an opinion from NSA's export control office > that I could use any kind of crypto I wanted (e.g., even triple-DES) if all > I'm doing is protecting a channel carrying a password (like the PIN), > because that's an authentication function and therefore to be encouraged. I > didn't get this in writing, however, so I'd have to go for it again. > > - Carl Well, I dunno. About 18 months ago, I was involved with the negotiations over the exportability of an SSL equipped web server I had helped develop. The export model used 40 bit RC4 and 512 bit keys. The initial version used 3DES to encrypt stored private keys, and this was turned down. I modified it to use single DES, and it passed. Note that this was for secret key storage only. Peter Trei trei(a)Process.com

1 0

Stop Collection Agencies Cold!
by 75706395＠aol.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> /////////////////////////////////////////////////////////////////////// STOP COLLECTION AGENCIES COLD! \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ If you have received this electronic mailing by mistake, please pardon our intrusion. Greetings, Have you or somebody that you know experienced the humiliation of a collection agency calling at work or at home? They always seem to know when somebody is sitting at your desk or visiting your home when they call. Millions of collection telephone calls and letters are made or sent each week to people who owe money. Those of us who owe money will pay our debts and do not need the help of a collection agency hounding us at our homes or place of business. Consumers have been helpless to stop the harassment of these predators, UNTIL NOW! Our hard-hitting report 'Stop Collection Agencies Cold (C 1996)' will show you how to put an end to those telephone calls and letters, INSTANTLY! At the same time, the collectors will be forbidden to EVER call or write you again!! 'Stop Collectors Cold (C 1996)' is a brief, concise report that will tell you everything you need to know to stop the harrassment forever and comes to you with a 100% money-back guarantee! This report is normally $49.95, but if you act WITHIN THE NEXT 24 HOURS, you will pay only $18.00 plus $1.95 S&H. ----------------------------------------------------------------------- ORDER INFORMATION IMS 5201 Kingston Pike, Suite 6-216 Knoxville, Tennessee 37919 YES, please rush me the special report 'Stop Collectors Cold (C 1996)' to: Name:___________________________________________________ Address:________________________________________________ City:___________________________________________________ State:____________________ Zip:________________________ Your E-Mail address (Needed for confirmation):__________ /////////////////////////////////////////////////////////////////////// I have enclosed $18.00 + $1.95 shipping and handling ($19.95 TOTAL). ___Personal Check ___Money Order ___Cashiers Check ___I am faxing my order NOW! Please send as a bonus the collector letter package (A $9.95 value). \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ Fax Your Order NOW! Please tape your signed personal check in the space below and fax to IMS. The 24 hour facsimile number is 1-423-681-6520. ***************************************************************** FAX: 1-423-681-6520 PLEASE TAPE YOUR CHECK HERE PLEASE SIGN YOUR CHECK ***************************************************************** Thank You for your order! </FONT><FONT COLOR="#000000" SIZE=3>

1 0

Documents re 9th Circuit Emergency Stay now online
by John Gilmore 17 Dec '03

17 Dec '03

The Government asked the 9th Circuit on the 10th for an "emergency stay" of the District Court's limited injunction that would let Prof. Bernstein publish his Snuffle software online. Now you'll find Bernstein's opposition to that motion, filed on the 17th, online. And the government's attempted emergency reply, filed on the 22nd. You will also find the 9th Circuit motions panel's terse order granting the government motion (blocking Bernstein from publishing online) and scheduling the case for very fast processing. The final 9th Circuit hearing will be in December, and we have a prospect for hearing a decision by Christmas. See http://www.eff.org/pub/Legal/Cases/Bernstein_v_DoS/Legal/. (You may have to ask your browser to "Reload" to see the new changes.) John Gilmore Electronic Frontier Foundation

1 0

Re: Why the WHite amendment is a good idea (fwd)
by Ernest Hua 17 Dec '03

17 Dec '03

Oops ... this may appear twice due to a mail hiccup. To: aweissman(a)mocc.com Subject: Re: Why the White amendment is a good idea (fwd) Cc: cypherpunks(a)algrebra.com > From: Aaron Weissman <aweissman(a)mocc.com> > > The NETCenter is a great idea. Very few of us would argue that our > society has an interest defining rules and in prosecuting their > transgression as crimes. Once we have agreed on that point, the > issue changes to a (still very important) discussion on methods. I believe MOST people would agree with this statement. I must point out, however, that your next statement does not logically follow because the primary complaint of the NSA/FBI is that unless the work factor is artificially reduced (via some method) to some negligible point, their jobs in the future will become much harder (that is, if all they do is stick with the same ol' operational methods) per intercept. In fact, they are claiming that "much harder" could mean "practically impossible". > creating a decryption lab (and funding it with tremendous amounts of > money), our society will fulfill the basic obligation to protect > against the transgression of our rules. I am ignoring the comments on protecting the US citizens against abuse of this lab. I seriously doubt they could abuse significant numbers of individuals given free market development of encryption. If there was only one standard (say, DES), then there would only be one target. If there were 100 standards and 1000 data formats each, you can pretty much kiss this lab good bye. It is much more likely that this lab will engage in breaking incompetent criminal-use cryptography. It is unlikely that this lab can engage in the sort of mass data sweeps that NSA has been priviledged enough to do in the past. This sudden drop in capabilities and sudden jump in cost per intercept will enforce the status quo which the FBI has had to deal with to today. The cost per intercept has been estimated at $50K per domestic target. This is expensive enough that it does not make sense to tap anyone except where the cost can really be justified. > I have no doubt that a considerable portion of the NETCenter's time > will be spent in matters of foreign intelligence. (As I said, we > cannot afford two massive decryption laboratories -- the NSA will > have to give its decryption mandate to this new agency). I completely disagree here. You might be right, but I give you 1 million to 1 odds. The NSA is absolutely NOT about to give up its role as the numero uno decryption lab without sacrificing many politicians (possibly with their lives, too, as its accountability to the public is near non-existent). The NSA is politically impossible to take on for very obvious reasons. > In other words, this is a great tool for prosecutors to use *after* > they have established probable cause in their most heinous cases, > and a strong guarantee that the eyes of the government will not > intrude into our persons, papers and effects. The astronomical cost per decryption and the lack of a guarantee that it might necessarily produce useful evidence will guarantee that this tool is not abused. I agree with this kind of conclusion. That is, I believe that, if any side of this debate is to be guaranteed anything, it should be that abuse is guaranteed to be low, rather than LE access is guaranteed to be easy. > The passage of this amendment helps ensure that the terms of this > debate remain centered on our civil liberties -- not kiddie porn. I assure you that this debate will always be shifted toward the "suitcase nuke", kiddie porn, child molestor and drug dealers by the FBI and the NSA in secret briefings. There is not a chance in hell they will give up the best PR tool they have to scare the legislators, judges and the president without anyone present to counter their arguments. Ern

1 0

Re: Crypto-victory in Commerce
by Declan McCullagh 17 Dec '03

17 Dec '03

Corrections: >So I'm sitting here in the lobbyist warren of the Capitol ^^^^ should be Capital Grille >to be conducted by the Attorney General, a NIST study on >crypto, and liability limitations on firms providing key ^^^^^^^^ should be NTIA study -Declan

1 0

Why the White amendment is a good idea (fwd)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 24 Sep 1997 19:06:33 -0600 From: Aaron Weissman <aweissman(a)mocc.com> To: "'fight-censorship(a)vorlon.mit.edu'" <fight-censorship(a)vorlon.mit.edu> Subject: Why the White amendment is a good idea -----BEGIN PGP SIGNED MESSAGE----- Today, the House Commerce Committee made an important statement which will have lasting ramifications on the status of personal privacy in our nation for the foreseeable future. I know what you all are thinking -- former White staffer, praising his old boss. In the interests of total disclosure, I did work for Rep. White, and I still think he is an all-around great guy. However, solely on the merits of this amendment, I believe that it deserves the support of the Internet community (whatever *that* is). The NETCenter is a great idea. Very few of us would argue that our society has an interest defining rules and in prosecuting their transgression as crimes. Once we have agreed on that point, the issue changes to a (still very important) discussion on methods. By creating a decryption lab (and funding it with tremendous amounts of money), our society will fulfill the basic obligation to protect against the transgression of our rules. However, despite the worst intentions of some, this laboratory cannot be an indiscriminate tool. The United States Government may be a the ultimate example as an organization possessing "national means," however, it's resources are far from infinite. In addition, such a lab would require our very best and brightest mathematicians. We may be able to afford one of these labs, but more would be a large stretch. Once this NETCenter exists, the demands for it's services will soon outstrip it's resources. In addition, the massive cost involved per use would be large enough to attract public scrutiny. I have no doubt that our government could crack the very largest keys if it were to through billions of dollars at the problem. However, in an age of shrinking budgets and a commitment to a balanced budget, that much money is not spent without considerable oversight. I have no doubt that a considerable portion of the NETCenter's time will be spent in matters of foreign intelligence. (As I said, we cannot afford two massive decryption laboratories -- the NSA will have to give its decryption mandate to this new agency). In sum, this amendment gives us a powerful decryption laboratory with a great deal of sunshine on its use and limited resources on behalf of law enforcement. These factors make the NETCenter a great tool for targeted decryption, but they also guarantee that appropriate judicial supervision is acquired before the NETCenter can be used. In other words, this is a great tool for prosecutors to use *after* they have established probable cause in their most heinous cases, and a strong guarantee that the eyes of the government will not intrude into our persons, papers and effects. The passage of this amendment helps ensure that the terms of this debate remain centered on our civil liberties -- not kiddie porn. If we are going to win this argument (and the stakes are very large) we have to keep this debate framed with our criteria. Many may disagree with me on these points, and I we -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNCm5F7il6vI+AAoXAQFlIgQAkvC7ABgdpCV0AzTn5eXLW/A4zsXObRIr NpOEVm0SvNsY7VWq3YoPQpetoP5sU/Z2tE4Vepl9jgxFAY3YVv9ZczrbTGdKKO1T Il3s779jI/8fGAUuOaP2B81mowOSO9NsLa462VjyaFkB7kY9gEin3LCT6Gf/cyvk Agp98YVAY4M= =ueWO -----END PGP SIGNATURE-----

7 7

A maybe workable idea
by Alan Olsen 17 Dec '03

17 Dec '03

I am not certain about how well this would work. I am certain that the LEA community would try and compromise or stop it at some point. The idea is to get the ACLU or some other group with some name recognition in the software/privacy/free-speech realm to sponsor a program to certify programs with crypto as GAK-free. I think that having software with a big yellow sticker stating "certified not to contain Government backdoors or other peepholes into your data" would have a useful effect on the buying public. I wonder if a "truth in labeling" law could be pushed through... Imagine a big sticker on products that say "Government agencies can read files created by this product without your knowledge". Probably a pipe dream. I can see a number of problems with it. Microsoft would bully their way into getting the cert GAKed or not. The FBI would probably put pressure on the retail chains to avoid products pushing political messages such as freedom from Government intrusion from being sold. It would be worth a try at least...

1 0