December 2003 - cypherpunks-legacy

Start Saving Now...
by courier＠message4U.com 17 Dec '03

17 Dec '03

Dear Money Saver.. Are you.. Paying MORE than 9.9 Cents Per Minute For Long Distance or 888/800 Service ? Paying a monthly minimum or access charge for your long distance or for an 800/888 number ??? Getting 6 second increment billing ??? If NOT... Give us a call... We can get you the service Without the hassle Without the games Without the extra charges Pay LESS For Phone Service (s) (812) 949-2205 NOON - 10 PM EDT MON - FRI OR VISIT: http://www.cyberamish.com courier(a)message4U.com P. S. We also have a SUPER RATE on phone cards...19 CENTS PER MINUTE ! NONE OF THE ABOVE PHONE SERVICES INVOLVE MULTI-LEVEL MARKETING TO BE REMOVED FROM THIS LIST REPLY TO THIS MESSAGE & TYPE REMOVE IN SUBJECT AREA ONLY

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Brief Background: In the last two months Australia (at this time under a so called conservative Liberal Government) has re-affirmed its anti-market controlled economy approach to economics with the establishment of an IT bureaucracy, forcing ISP's to 'join' the TIO and fund its operations, establishing the framework for a possible cencorship regime on the internet, proposed legislation for key escrow wrt VPN's and pursuing its favoured entrail reading approach to economics by yet again believing it can 'pick winners' in the market and allocate resources more efficiently than the market can; an approach any socialist or totalitarian would be proud to support. There is very little organised effort to oppose these measures. I expect that people elsewhere will soon be able to look to Australia as a testing ground for all the worst case scenarios long discussed on cypherpunks. Now the State has announced it's intention to forcefully mandate authentication on the internet by imposing yet another taxpayer funded bureaucracy and to hell with the market solutions already provided at no cost to citizens. Shame on you Australia. (Are politicians genetically selected on their ability to make precisely the wrong decision in any given circumstance? Actually wrt authentication there is no problem to solve. Doing nothing was the best thing to do. Of course what this is really about is limiting entry to markets, corruption and fraud on the public.) http://www.theage.com.au/daily/971015/news/news7.html Push to tie up loose ends on Internet By GERVASE GREENE, Canberra Online commerce may exceed $6 billion by 2001, but it will be of little use if customers and businesses cannot identify each other on the Net. Federal Cabinet yesterday approved steps to create a national system for online authentication. The Government will establish a body to oversee all authentication systems. The Communications Minister, Senator Richard Alston, said this would significantly boost electronic commerce. "With predictions that electronic commerce in Australia will increase more than four-fold to $6.3 billion by 2001, the Government is well aware that development of trust and confidence by businesses and consumers in the reliability and security of online transactions will be critical to the development of the information economy," he said. A group of industry and government experts will report by March next year on possible functions and powers of the watchdog. This will include determining the technical standards required before an identification system obtains certification. Several corporations have marketed safety systems to exploit concern about the safety of online transactions. Sophisticated encryption will also be necessary before certification is granted. Civil liberty groups have called for anonymous transactions to be possible, while law enforcement bodies have sought access to records and transactions that would amount to an effective exemption from privacy obligations.

1 0

Re: Encryption Program (fwd)
by Frank (Giff) Gifford 17 Dec '03

17 Dec '03

(I had only sent this to the 'other' mailing list and not here - my appologies to those who get this for a second time. -Giff) On Mon, 13 Oct 1997 semprini(a)theschool.com wrote: > Hello. I just posted an encryption program on the web. It uses a key- > generated pseudorandom stream of characters that get XORed with the > plaintext to produce the cyphertext. For decryption, the same stream > is run against the cyphertext. (Such is the nature of the XOR > operation.) You can download the program at: > > http://www.brigadoon.com/~semprini/3dmx > > I am interested in other people's views, comments, questions, etc. on > this program. Any questions, comments, etc. can be sent to me at > "semprini(a)theschool.com". > > Thanks, > > Dylan > I have downloaded the program and read over it's contents (the .frm files). It's Visual Basic, which I am familiar with. >From my reading of the code (assuming that the code I read was, in fact, the code which does the encrypting) - the key supplied is not used - or at least not directly. The user apparantly supplies three keys which are padded with 'random' stuff each to get them to 32 bytes in length. Then these are placed into a special array where each bit gets its own position and various scrambing is done 'randomly' on the data. This is dependent on the key values and what bits are on or off at a given time. During this process, the 'seed' for the RNG is reset to some unknown value (I believe the effective range for the seed is 0..65535) the entire time the bits are processed. Then, amazingly, those bits are not used again. >From the RNG, a 4 dimensional array (called a 'cube') is created with elements 0..15 for each of the four sides. The contents are filled from the RNG with a value 0..255. Then during the encryption process of a file, the program will choose four random numbers 0..15 to use as indexes into the cube. The number found there is XORed with the datafile byte to get the encrypted/decrypted answer. *whew* Hope you followed that, I'm trying to be complete and concise. The upshot seems to be (and I haven't written any code to try this out yet): This method fails to the chosen plaintext attack where I ask the opponent to encrypt a large file of (say) all zero bytes. The encrypted result I should then be able to XOR directly against the target file to get the original contents. A less efficient but more satisfing method is to simply try all seed values for the RNG. Even if I don't know the RNG process, if the seed values are only 0..65535 (as I believe they are), trying all possible decryptions by this manner will give me the correct answer. If I know something about the file (i.e. being English text) I should have no problem finding the right answer programmatically. If I am incorrect about my reading of the program or its operation, please let me know. -Giff

1 0

Free Sex Test Drive !
by scannmann＠nevwest.com 17 Dec '03

17 Dec '03

============================================ WARNING! ADULTS ONLY! This site contains Sexually Oriented Material. By entering this site you're consenting that you're over 18 and approve the viewing of adult material. ============================================ Hi my name is Lisa ! I would like to let you know about the hottest adult web site on the web, rated top 10 with FREE LIVE STRIP & STEAMING VIDEO CONTENT with lesbian, gay, fetish, domination, bizzare, group sex, one on one, we have to much to list. See to believe 1000+ hot pics & more. Also hot phone sex like this 1-800-LICK-CUM check it out FREE, FREE, FREE !!! http://www.69her.com http://www.cyberhardcore.com

1 0

Clinton - Gore selling out Internet to ITU to Preserve Key EscrowEncryption?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Wed, 15 Oct 1997 09:01:54 -0400 Reply-To: cook(a)netaxs.com Originator: com-priv(a)lists.psi.com Sender: com-priv(a)lists.psi.com Precedence: bulk From: Gordon Cook <cook(a)netaxs.com> To: Multiple recipients of list <com-priv(a)lists.psi.com> Subject: Clinton - Gore selling out Internet to ITU to Preserve Key Escrow Encryption? X-Comment: Commercialization and Privatization of the Internet A COOK Report Editorial Exceedingly strange events are underway inside the Beltway. By January of this year a coalition of industry figures had decided that IAHC was a cabal of internet old timers out to create a clique that could impose a DNS "socialist" solution. This solution, they claimed, would ensure the failure of any private enterprise led initiatives to open a true free market in DNS services. They convinced the Clinton Administration to intervene to stop the cabal from what they also alleged was its threat to American sovereignty. Namely that, in involving the ITU as the repository of its MOU, it sought to deliver control of the Internet into the hands of a stodgy bureaucracy which was in fact an enemy of the net. Fast forward through eight months of Clinton Administration meddling and we have some rather shocking results beginning to emerge. The Inter Agency Working Group on DNS issues is drafting a report that says IAHC was right after all and that just a few tweaks are needed to open up the process. The draft shows no understanding of the DNS issues themselves and comes up with no clear alternatives to the much scorned WIPO role in DNS dispute resolution. These matters are now coming out into the open. In an article yesterday in Communications Week International, Ken Cukier writes: "They [the IAHC] laid a decent foundation and [we] need to modify the plan to build on that foundation," said Ira Magaziner, a senior adviser on Internet matters to President Bill Clinton. The IAHC seems "open and flexible" to the idea of changing portions of the plan based on increased Internet community input, Magaziner added." The article goes on to explain how the Administration is embracing the hated IAHC process that its intervention was initially designed to halt. But we remind our readers that another concern that led to government intervention was not just anger over IAHC but also fear of the ITU. But no problem, the fear of the ITU seems to be no more. We quote below from a just published interview with Pekka Tarjanne, the ITU Secretary General from Finland. While the IAHC initially promised that the only role of the ITU would be to act as repository for signatories to the MoU on DNS, Pekka Tarjanne now foresees the ITU as the most likely repository for all internet governance functions - including getting into issues of content. Brian Kahin and Mike Nelson have turned the enemy into the friend. Why? Such are the wondrous ways of life in DC. NTIA has been given the green light to shape internet policy within the US. To hell with the Congress, the FCC and the NSF. [Speaking of collateral congressional problems, we'd certainly like to see someone sue NSI to prevent the return of the 23 million from the infratsructure fund to NSF for NGI use.] We expressed our dismay about this last week in an open letter to NTIA head Larry Irving. We must have struck some raw nerves, for when Dave Farber posted our original complaint to Irving on his IP list, we received a few days later the following delightful reply (posted by Dave again to his list.) Date: Tue, 14 Oct 1997 11:14:52 -0400 From: "Gregory C. Simon" <simon(a)podesta.com> Cook: "Gregory Simon." Hmmm. Domestic affairs advisor to Al Gore? On the wrong side of privacy issues? Not much beloved by EPIC. On the wrong side of information issues. Point man for the administration a year ago at the WIPO meetings in Geneva, where the justly defeated treaty would have given publishers copy rights over virtually everything. See www.cic.org. Seems that Greg has left the White House and is working for the lobbying firm run by John Podesta's brother? Meanwhile John Podesta continues to work on the inside as one of President Clinton's most intimate advisors. In charge of Bill's daily schedule we are told. Greg seems to be offended that I am not a cheer leader for his ex-employer's policies. Simon: Dear All: The open letter from Gordon Cook to Larry Irving is profoundly misguided and uninformed. The basic premise is ludicrous -- that Henry Geller somehow set the parameters of NTIA's authority by his personal views. Cook: No. Wrong the premise was that Geller as first head of NTIA was fully in favor of the conditions agreed upon for its founding. That it could be an advocate for the desires of the President in telecom matters but that it would NOT make and originate policy. Simon: NTIA is the voice of the Administration on many matters but it is also part of the brain. During my tenure in the White House with Vice President Gore, we relied heavily on NTIA's institutional knowledge and analytical skills in formulating and executing policy decisions. Cook: In other words with NTIA as the brain, this administration, uses it to make policy. Simon: Larry Irving in particular has been astoundingly and unerringly prescient in identifying policy areas that will rise to the top of the public policy debate. His views have often carried the day with the President and Vice President. Cook: NTIA making telecom policy again contrary to the views of the original founders. I haven't talked to Elliot Maxwell at FCC, but Greg, you might like to give him a call. I am told that he shares these same views. And I am told this by someone who participated in the policy making at NTIA's founding with whom I have just had a conversation tonight. Simon: In my dealings with NTIA on the DNS issues I have detected none of the prejudice Mr. Cook asserts. Reading symbolism into such simple gestures as granting additional comment time and giving great weight to every bit of gossip emanating from a free give and take discussion within the government smacks of clinical paranoia. Cook: No Greg. It's having good sources who are so disgusted by the lack of cluefulness on the part of the administrations policy makers that they talk. I knew this was coming down the pike. Cukier's article published yesterday confirms it. Simon: Finally, is it necessary to wave the bloody shirt of encryption into every policy debate no matter how remote? Must everything be related to a government conspiracy to read your mail? Cook: Given the slipperiness of this Administration, I stand by what I said on this issue. If the minions of the administration, of which you are clearly one, can strip internet policy making away from NSF and Congress, then they can march ahead with their intent to give Freeh and Ft George Meade the keys to the private communications of every American citizen. And since Kahin and Nelson have decided to deliver the Internet via IAHC to the ITU after all, we could all wake up one day and find the keys to our most private correspondence turned over to an international organization called the ITU, which uses its treaty power like the World Trade Organization to overrule the sovereign power of the US Congress. The shame is that Ira Magaziner doesn't yet realize what Kahin and Nelson are doing to him. Note that the ITU also reflects the views of many European governments are far less willing than our own to even give lip service to the concerpt of a free Internet. Cook: Before you reply that I have lost my mind, Greg read the cogent paragraphs of the interview with ITU Secretary General Tarjanne below where the good man, sensing victory, says that he foresees the ITU playing a major role in Internet governance and foresees the possibility that the ITU may get involved not only in conduit but content as well. Someone exceedingly well familiar with ITU policy making noted in another conversation tonight that the ITU constitution has long allowed controls over encryption or in other instances has explicitly forbidden encryption and that the ITU has the tools for coordinating such restrictions internationally. Simon: Surely there must be a more honest way to disagree than to impugn everybody's motives all the time. And as for being cut off at the knees, I personally repudiate Mr. Cook for bringing that level of vileness and personal animus into the debate on a policy issue. Larry Irving has devoted his professional career to public service, he deserves respect, not threats. Cook: Rather than turn my accusations into a personal attack, why you tell us what the real policy of the administration is on these matters, if it is indeed other than what I allege? Cook: No I just put together what I hear from highly credible and distinguished sources who for their own reasonss cannot go on record.and reflect that against my belief that the government must never try to take control of the internet. If it means saying that the high and mighty have no clothes, so be it. No matter. The cozy dance continues. Don Heath has announced that next INET conference will be held in Geneva at ITU headquarters. Cook: Now it also looks like we owe Charles Pickering, the Republican Chairman of the House Science Subcommittee on Basic Research, a debt of gratitude for the hearings of two weeks ago. Problem is the double dealing alleged there is not going on with IAHC. Sernovitz was wrong to accuse Jon Postel of wanting to ship US developed assets to Geneva. It would seem to be the White House that is the double dealer and the one ready to give American assets to the ITU. Sincerely, Greg Simon (In the interest of full disclosure, Mr. Simon, President and CEO of Simon Strategies is a consultant to SAIC, the parent company of Network Solutions.) Cook: In the interests of full disclosure let it be said that we drank at the federal till for 18 months working for the US Congress Office of Technology Assessment and driving from NJ to a rented bedroom on Capitol Hill every week. Since March 1, 1992 we have published the staunchly independent COOK Report on Internet from our front porch making our living outside the beltway and fully independent of the interests that Mr. Simon represents. We must say we were amused at the Bellcore and NSI private mail that Greg attached. Clearly we touched a raw nerve. :-) Here with some relevant quotes from the Cukier article (at http://www.emap.com/cwi/192/192news5.html) and the Tarjanne interview. "The U.S. Department of Commerce, backed by a White House group studying the Net's vital domain name system, is set to accept a modified version of the plan for competitive domain name registrars devised by the International Ad Hoc Committee (IAHC), which comprises Internet organizations and United Nations-affiliate agencies. "They [the IAHC] laid a decent foundation and need to modify the plan to build on that foundation," said Ira Magaziner, a senior adviser on Internet matters to President Bill Clinton. The IAHC seems "open and flexible" to the idea of changing portions of the plan based on increased Internet community input, Magaziner added. The move will lay to rest months of uncertainty over the United States' role in freeing Internet institutions from government control. Significantly, the Department of Commerce will require the current monopoly registrar of the popular .com domain, Network Solutions Inc., to release information pertaining to the system's operation, say Clinton administration officials. However, officials caution that the department's approach is not universally supported in the federal government, and the internal tensions may set the policy back. Additionally, the IAHC's proposals that Geneva-based U.N. agencies be involved in domain name governance was attacked by Charles Pickering, the republican chairman of the House Science Subcommittee on Basic Research, which sponsored the domain name system hearings. Jon Postel, the head of the Internet Assigned Numbers Authority (IANA), the Net's central authority on certain standards (CWI, 30 June), remains cautious, however. "I just don't know," he said when asked whether the U.S. government will promote Internet self-governance. But Postel added: "Discussions have been fairly open in the administration about endorsing the [Internet] community's plan," as represented by the IAHC. The Trajanne interview is found at http://www.teledotcom.com/1097/features/tdc1097interview.html The ITU's involvement with the Internet may not end with the DNS. In fact, it may just begin there, especially if the ITU's DNS solution holds sway. In a recent interview, Tarjanne not only defended the DNS accord but also predicted a growing role for the ITU in Internet governance, at the invitation of the world's government and industry leaders. The ITU could eventually become involved in such content-oriented issues as pornography on the Internet, Tarjanne says. "We are not there yet, and I don't know if we will get there, but there is a clear possibility," he said. Some acknowledgment of the ITU's expanding role on the Internet could be written into the U.N. agency's bylaws when the ITU holds its quadrennial plenipotentiary conference--a kind of constitutional convention for the organization--in Minneapolis next October, according to Tarjanne. Still, the Internet issue is pivotal for the ITU's future; without a role in the Internet, the ITU would become less and less relevant to global communications. Tarjanne is moving quickly to secure the ITU's future before his tenure as secretary general ends in January 1999. Tarjanne: Traditionally, when we've talked about standardization in the ITU family it has been mainly technical standardization. But more and more we are involved in things that are called standardization but that have to do with, for instance, issues related to the generic top-level domain names or numbering systems--country codes are almost becoming viewed as a limited natural resource. As it relates to the Internet, we are facing a very interesting situation where questions concerned with conduit and content are being blurred. Basically, we have always dealt with conduit and have had nothing to do with content. But the situation is not that simple anymore. We, the conduit people, have to know what is happening on the content side, and vice versa, and there are questions that are very much interlinked. What kind of content issues do you see as possibly requiring the ITU's attention? Tarjanne: There are lots and lots of things. Probably the most famous Internet-related questions have to do with all the kinds of content that are not considered to be legally or morally acceptable. These are very difficult for the national decision-makers alone to deal with because of the global nature of the network. The problems are those related to child pornography or things like that. They have not reached the point where there's any need for us to do anything except follow what's happening. But that is already a change. To be prepared for the future, we have to know what problems different countries have with respect to the content of international communications. Have your members asked you to look into these issues? Tarjanne: Members have asked us to look into it and to follow it, but there are no concrete proposals for us to really take these matters up more seriously than that--than to follow them and collect information and be prepared to disseminate information. There's nothing on the agenda of our next few conferences, nor anything really serious in our study groups. What would happen if the Internet community rejected ITU governance? Tarjanne: It's a theoretical possibility, but I don't think it's very realistic. But if they find a better forum than the ITU, we don't have any monopoly. Things can be done outside the ITU, sometimes in a better way than within the ITU. That's not a big problem. We are here within our mandate to be prepared to participate and help when asked to do so. That's what we have done. To go a little bit further, if something were to happen outside the ITU that would lead to problems because of the absence of a neutral global organization covering these issues, then of course it's up to the members of the ITU to look at things more carefully. But we are not there. It's a rather hypothetical question for the time being. ************************************************************************ The COOK Report on Internet For subsc. pricing & more than 431 Greenway Ave, Ewing, NJ 08618 USA ten megabytes of free material (609) 882-2572 (phone & fax) visit http://cookreport.com/ Internet: cook(a)cookreport.com New Special Report: Internet Governance at the Crossroads ($175) http://cookreport.com/inetgov.shtml ************************************************************************ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

Re: CFV: comp.org.cauce moderated -- support privacy and anonymity
by Igor Chudov ＠ home 17 Dec '03

17 Dec '03

For your information -- all anonymity advocates take note of the comp.org.cauce Call For Votes which wants to outlaw anonymity. The Call For Votes has been posted to news.groups, with a very lively discussion that followed. You may be amused to read it. igor In news.groups, phelix(a)vallnet.com <phelix(a)vallnet.com> wrote: * On 14 Oct 1997 11:57:07 -0400, moz(a)server2.mich.com (John C. Mozena) wrote: * * >In article <slrn646v9m.e2u.ichudov(a)manifold.algebra.com>, * >Igor Chudov @ home <ichudov(a)algebra.com> wrote: * > * >>We have exposed your arguments against munging as bogus. * > * >You have exposed nothing but your ability to be hateful. * > * >>But, what do you have against anonymity? * > * >Nothing. What right do you have, though, to force me and others to * >inconvenience ourselves so you can post anonymously or protect yourself * >from spam? * > * >>Vote AGAINST comp.org.cauce which wants to outlaw anonymity and * >>use of spamblocked addresses. Go to news.groups and find the * >>CFV for comp.org.cauce, with the ballot enclosed. * > * >Vote for comp.org.cauce, which protects the utility of a newsgroup and the * >freedom of postmasters to not run anonymous posting services should they * >not so desire. * * Well, I just started reading this, and I didn't really know which way to * vote. But such an anti-anonymnity stance makes the choice clear: * * vote *NO*. * * Thanks for clearing things up, John. * * -- Phelix * -- - Igor. The average American spends a total of six (6) months in prison.

3 2

Trans World Specials e-mail confirmation
by twaweb＠inet2.twa.com 17 Dec '03

17 Dec '03

Thank you registering with the TWA Trans World Specials Electronic Faresale notification program. TWA posts faresales for the week on Tuesday mornings at http://www.twa.com/html/flights/faresale.html. If the routes you have selected in Trans World Specials match the faresale cities - then you will receive the faresale by e-mail. You can always update your profile and add or remove routes by returning to: http://www.twa.com/odpairs Thank you!

1 0

Re: FCPUNX:PGP Key Escrow and Congress
by Eli Brandt 17 Dec '03

17 Dec '03

Bruce Schneier wrote: > From: "Barbara Simons" <simons(a)VNET.IBM.COM> > > Some of these are old arguments that we've been hearing for a while, > but some are newer. In particular, points 4 and 6 are difficult to > refute without getting into some technical details. Both points also > undercut the argument that a key recovery infrastructure potentially > weakens security. After all, the NSA thinks it's secure enough that it > can be used by the government. Non-technical point: the NSA (reportedly) has no intention of using GAK for classified information. They know that it weakens security. Do the privacy of the nation's data and the security of its information infrastructure deserve the same consideration as the Pentagon's "Confidential" memos? When you're planning to build in a single point of failure, this is a question you have to ask. -- Eli Brandt | eli+(a)cs.cmu.edu | http://www.cs.cmu.edu/~eli/

5 4

consensus on pgp? can we consolidate for action?
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- two of the things I was trying to do in my rant "GET WITH IT" on the issues may not have been clear: 1. as Tim says, let's make sure the OpenPGP standard (which in itself I did not address) is for PGP by itself, none of the peripheral issues or means of implementing GAK/CAK/CMR or the rest of the faloderol. now, if PGP, under market pressure wishes to allow hooks for each of the sins from the necessary to the unpardonable GAK --that is a business decision. 2. as far as the proposed SNMP "enforcer" --that is also a business consideration. however, the more PGP is willing to listen to some of our voices of reason[1], the more likely PGP is going to be in the rather enviable position which at least permits companies to make a choice. [1] by and large, despite the polarity of the arguments, this issue with PGP has been one of our memorably sane and polite debates with so many threads I may need to establish a separate text retrievable database! and it involves one of our most emotional issues: privacy. the second point is critical to our interests as well as for PGP's stand in the industry as a whole. if the SNMP enforcer product is carefully designed, it can not only provide warnings for each level of security but even more importantly, it does not necessarily need to provide GAK functionally in the standard product: browsers use plugins --so why not security level plugins for the "Bad Daddy" SNMP enforcer? essentially, the SNMP is a network connected, ie- communication system, supervisor to one or more "clients" scattered anywhere in the network which recognizes Bad Daddy. some of the PGP control functions are basic, but the rest should go on plugin, each relating to a different level of sin, forgivable to abominable. likewise, the local PGP crypto engine should be built around plugins. in this manner, anyone concerned with privacy can easily check for the presence of the dirty little black boxes, or hopefully PGP will display a panel of "features" (if you can ever call invasion of absolute privacy that). plugins today are a nobrainer. personally, I would not be willing to endorse a system which gives the SNMP Bad Daddy the ability to retrieve my secret keys and PGP should permit holding my secret keys on a flop of some type -in other words specify a separate location for the secring which we can not do now unless we move the rest of PGP environment (at least as far as I have read). however, if I am stupid enough to put them in a network accessible position for the superuser to scarf -- that's my problem. for use on network machines, I have a c program which is effectively a one time pad to make the ring accessible for as short a time as possible. I was writing a c code supervisor which took care of this task rather neatly with an out of place checksum passwd for the pad keys but have been sidetracked. I think we have all pretty much agreed on the necessity of separate signature, communication, and storage keys; Adam Back convinced me rather quickly (I was using only a separate storage key). there is less agreement on the effectiveness of GAKing the communications key since some form of DH session keys could be deployed and mail is transient; eg: GAK only serves the Fed in this case, which, of course, is what they want. I have not seen any further discussion on my suggestion to create a sendmail type daemon which implements DH between mail clients. this, of course, is on the presumption that DH is a wrapper for an already encrypted packet, I also agree with Adam's design on isolating the recovery aspect from possible GAK outreach. although I will cop a plea to sometimes in the back and forth Adam was grasping for something which was never going to be there <g> bottom line: I think the consensus has already formed that PGP is not going to be the pristine voice crying in the wilderness we all hoped to hear; now the issue is, how can we shape the product to have a) the most flexibility, realizing full well there will be brain dead organizations who will insist on ordering GAK; and b) have the fewest potholes unknowingly enabling some level of pseudoGAK, etc.] again, that means focusing the pressure on PGP to keep the basic crypto engine pristine, and do the dirty work in Bad Daddy --and use "visible" plugins. I can only presume PGP 5.5 is a fair ways down the pipe to delivery, complete with its Big Daddy SNMP enforcer; this will make it all the harder to influence changes as PGP, Inc. appears to have grown enough in size to contain too many non-caring v/v real privacy (I have nothing to hide type ignorance), and even more disappointing, not only technically ignorant, but distrustful of technology bureaucrats that arrive with corporate growth -focused on a) closing off the design cycle; b) stifling the debate over methods; c) shipping product (oh, hell, we can listen to their complaints and make changes later...); and, d) recover the vulture capital investors money. if the foregoing is true, I hope PRZ has the good sense to take a walk, selling his stock (to do otherwise would be complicit in the deception of PGP's reputation capital). regardless of the above, if we as a group, with reasonable consensus, are willing to make an assault on the powers that be at PGP, Inc. including whatever relevant public publicity to heat the fire, there may be action. hell, if we could afford it (or Tim feels _real_ generous <g>), buy a NYTimes page and all of us sign the "selling out our the constitution" with cute little graphics of children being tortured for their keys. another point to consider: if a majority of cypherpunks as a group are willing to "endorse" the pgp product, that may be an issue worth discussing with pgp. the only problem may be the level of the outside managers and bean counters which hold down the front offices, totally ignorant of anything but feeelthy money; or, more probable, some cp subset who have been the primary contributors historically on these issues, and I think most of us know who the primary thinkers are on this issue are. obviously we must be fully informed and our opinions assessed --even with divergences. in the end, I would like to think decisions could be settled by consensus, rather than Supreme Court style. <g> if we (and I say this as: "who's this we...").... despite the cynical contempt with which the mass media often displays to our attitudes, even resorting to name calling, reputation capital is not necessarily gained from main line press popularity, and certainly not from government "popularity" in this issue [particularly cogent to those of us "fortunate" to have received the IRS spam]. FWIW of course, I may be presumptuous PGP would even want to hear from us, let alone have any form of "Cypherpunks Inside" (yuk) label on the box! particularly with the round robin multi-teaming of the sleepless Jon Callas. this has been an attila rant... attila, out, one more time.... and: it aint over 'til the fat lady sings, vahalla burning! "attila" sig: 1024/C20B6905/23D0 FA7F 6A8F 6066 BCAF AE56 98C0 D7B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBNEXXkb04kQrCC2kFAQHD1wQAiAMt4qP+GX0SXpF9XSuWbJc38tBWFD+U ErAn5iAhrWkzl1/HpkmxDb8qUS9fh1fTsUjTihTOCSU8RwvtkBuzkhMm02MXxxyK eJndaYgdpt+pluGYfrDIj9Vd3QDQVlJ0gf+o+CQ+pwQUJxYjmI/oELb0jBDnOwek EUl1MAszW90= =EulT -----END PGP SIGNATURE-----

4 5

Personal use crypto export
by Jim Gillogly 17 Dec '03

17 Dec '03

I'm moved to repeat Matt Blaze's exercise of a couple of years ago, where he went through the rigamarole to get an Official Paper from Customs or State or whoever was in charge to take his laptop out of the country with crypto on it for his personal use overseas. His experiences finding the right person to talk to to get a form, then his inability to find a Customs official to look at it on the way back, were semi-hilarious. However, now that crypto exports in general have moved from ITAR to EAR and BXA is in charge of general crypto exports, I can't find out how to get the right form to take out a laptop with PGP (or anything else) on it. Can anybody give me a pointer to whoever thinks they're in charge of this stuff? Or have they given up on this phase? Thanks... -- Jim Gillogly 24 Winterfilth S.R. 1997, 18:38 12.19.4.10.12, 7 Eb 10 Yax, Fifth Lord of Night

6 5