December 2003 - cypherpunks-legacy

data recovery good, key recovery bad (Re: Are we all looking at the same PGP 5.5 ?)
by Adam Back 17 Dec '03

17 Dec '03

[I've moved this thread to cypherpunks, it was on cryptography, and Perry (cryptography moderator) just killed the thread. Some of the participants may not be on cpunks, so keep them on the cc if you want them to see your replies] Marc Horowitz <marc(a)cygnus.com> writes: > >> > What makes you think that all critical email is on disk in the clear? > >> > >> Nothing: it could be on disk encrypted. eg. Encrypted files encrypted > >> with storage keys, or encrypted partition encrypted with storage key, > >> or encrypted sent or received email encrypted with storage key. > > Well, if it's encrypted on disk, then "you read the disk" doesn't get > you very far. You need to be able to decrypt the information on the disk. Of course you do. Lets say you are using Peter Gutmanns encrypted filesystem setup. So, if you figure the info on the disk is important, you give a copy of the key to the company lawyer, put it in the fire proof safe, secret split it, whatever tickles your fancy. The advantage of this is that the email software it is no use to the GAKkers, because it doesn't have mildly enforced extra crypto recipients, and it doesn't get the business community used to the idea of shipping email around with extra doors into it. PGP Inc's pgp5.5 could be used by the government to weedle their way into mandatory key escrow. Say that they start requiring companies to use this software, then when lots of companies start using it, they start asking companies for a copy of the company master key. Bingo key escrow, courtesy of PGP Inc. Next they "encourage" ISPs to use it also. > >> The way to do it is as described above. Archive the email, encrypt it > >> to a starage key. Build that functionality into the MUA if you fancy. > >> But _don't_ give extra access to keys used for communications only. > > There is no extra access to communication keys. There is so! His mail said that there was a policy flag in the public key, and an additional public key for the corporate back door. That policy flag effectively said this key has attached to it a request that you encrypt to this extra crypto recipient. In some cases an additional flag will be set which says "if you do not comply with the request to encrypt to the extra crypto recipient, the recipient will not see the mail". PGP Inc's method of enforcing this is an SMTP policy enforcer which bounces mail without the extra crypto recipient. There, that is an extra access to the communication (via an extra route to accessing the session key). Uhhh, I think I just realised why we are talking at cross purposes... you meant extra access to the recipients private key. I consider this an artificial straw man, erected by Jon. Sure it's an independently dumb idea to have lots of people sharing private keys. But the system is still GAK friendly. And it does allow extra parties access to the message. The worry is that government becomes that second party. Do you really care about the details of mandatory GAK, when and if it comes in. Do you care whether the government has a copy of your private encryption key, or whether the system is setup with un-bypassable second crypto recipient of the USG/NSA etc. Can't see that it makes much difference at that point. Both methods can be bypassed theoretically anyway, by super encrypting or any other subliminal channels kicking around in the protocols. So I can't see that arguments about how easy they are to bypass hold much water. Frisbeeing a disk out the window is far easier a way to bypass anyway. Or just blabbing. > >> Hint: you will note that Freeh and friends aren't interested in > >> storage keys. You can see why the above systems is less GAK friendly > >> right? > > Freeh wants storage keys, too. He wants *all* the keys. Yeah he probably does. But he wants your communications keys a lot more. You know why that is? Because he has your communications because you're broadcasting them across the Internet. He'd like to read them. However he doesn't have your disk, and he'd have to break into your offices to get it, or issue you with a supeona or whatever. I'm sure he'd love to read your disk too, but your disk isn't sitting on an NFS mount over the internet. (Is it!?) Fortunately, the internet couldn't handle the strain, otherwise you might see calls for you to rent your disk space of government disk farms, and the government would then be very interested in demanding a copy of your storage keys. So, if even if we use corporate key backup for storage keys, this is still more along the lines of the status quo. They want your documents, they've gotta come and get them. What we'all are getting worked up about here is that Freeh and friends want to be able to key word search our damn communications on fishing expeditions. > Email is a funny thing. It's sort of storage, and sort of > communications. I can understand wanting to recover it from a > communications aspect. They don't call SMTP "store-and-forward" for > nothing. There is no information in the body of the message which is required for it to get to it's destination. All you need is the SMTP headers. You clearly can't end-to-end encrypt the communications routing information. (You could layer it though, like perhaps remailers, with each hop only knowing what it needs to know to do it's job; however at that point you can run into problems: you can't bounce back a delivery failure part way along the route.) > You'll notice that if I delete the messages after receiving it, it > can't be recovered. If I don't, it can. Sound like storage to me. So? The point is that you shouldn't be mixing key purposes. Communications private keys should be used to protect communication and shouldn't be given to anyone else, even your company. Storage keys might be sensible things to backup within the company in case of accidental death. Actually I disagree with what you said: you said "if I delete the message after receiving it, it can't be recovered", it might easily be recovered in lots of ways: 1. feds have tap on your line, feds rubber hose your long term private key out of you 2. your sender has kept a copy in the clear 3. your sender has kept a copy encrypted with a poor passphrase which the feds guess/or rubber hose from him 4. your sender used encrypt-to-self, and has poor passphrase/is passphrase rubber hosed 5. your sender kept a copy which still had you as a crypto recipient (as well as himself with encrypt-to-self), and the feds arrive at your door anyway. Point is, as long as you've got the private keys, it is potentially stored, courtesy of your favourite TLA. This is why you should use forward secrecy, or at least mimic it, by having a long term signature key, and generating a new public key for encryption every week/month, and revoking and destroying the old one. > >> I figure it's not that major a deal. But for those that want it, the > >> most secure, simultaneously least GAK friendly way to do it is to > >> archive and encrypt with separate storage keys. > > This is *exactly* what PGP does: it encrypts with the recipient key, > and the recovery key. Yes, it does, and that is GAK friendly. But that is not what I described above. The difference between what I describe above (quoted a few lines up), and what PGP is doing is that PGP's messages are sent across the internet encrypted to the "recovery key". This is GAK friendly because it is easy to implement GAK with it, you just make that "recovery key" the NSA's "recovery key" (or to avoid newspeak terms perhaps that should be government backdoor master key). Then they coerce ISPs and corporates to include a PGP SMTP policy enforcer which insists on all email having a second crypto recipient of the NSA's backdoor master key. The system is a beautiful GAK system, everything you need for a fully working GAK system is right there on sale by PGP Inc. With what I described, GAK is not possible. What I described is: the MUA archives sent email, and archives received email (after decryption) with none of this process leaking outside the corporate lan (that is it may involve communication inside the LAN). The archives can be encrypted, and you can have a corporate master key with access to these archives. But none of this goes over the Internet. > At this point, I'm not sure if we disagree or not. I'm not sure either, please let me know if I've explained myself this time! I'm worried that the hard time I'm having getting people to grok that escrowing comms keys is a bad idea if you're opposed to mandatory GAK is indicative of the success of the memes being spread by Freeh's crowd. PGP Inc are especially worrying, as they are in a position to influence the balance of whether we get GAK or not, and they appear to be helping GAK out somewhat. Whether this is complicit or whether they don't see that the fact they've implemented a fairly feasible GAK system as that significant in the argument, I'm not sure. However, I think the argument it is relatively straight-forward: companies care about backup of their data. They don't care about backup of their communications. So why backup communications keys? And why include the backup packet in the communication itself? For those companies who have been persuaded that they ought to read email received and email sent, you can implement this without weakening comms security as PGP have done with pgp5.5 for business which is to have a second crypto recipient for backup/backdoor being sent with the message over the internet. All you do for backup or company backdoor is to build in whatever storage, and encrypted archiving functions you wish into the MUA, or internal mail system. That is GAK unfriendly. If PGP Inc is still GAK unfriendly, and hasn't sold out to government, it should be doing something with similar properties to those I described above: not having backdoor second recipient access to traffic. What they have done is implemented a fully functional GAK system. (I get the feeling that sooner or later we're going to get a PRZ penned company position statement. I hope they get it right. I encourage them to re-think.) Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

What's really in PGP 5.5?
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ryan Anderson wrote: >>What you call "fragility" is properly called "security". Would you >>describe 128-bit keys as more "fragile" than 40-bit keys? Why is PGP, >>Inc. inventing propaganda terms for the authorities? > >Okay, call it security but the point is, if you're protecting documents vital >to your company using encryption (say the design of a new product) and the >person who knows the passphrase dies, you've just lost a great deal of money. > >PGP for Business Security gives the business a way to have a backup key that >can read that person's information. Frankly, it might not be able to read >anybody elses, from the description given. > >This is a feature that any business (that understands encryption) will want. > >They can easily store the secret keys of the other id someplace secure, and >never retrieve them until someone dies. Disavow knowledge of them to >government, etc. heck, the keys can even be in the primary person's >posession. (Perhaps stored in a safe-deposit box, or without a passphrase, >etc.) Decrypting files and decrypting messages are not the same problem. The PGP product has SMTP support - it is explicitly designed to weaken transmitted messages. Just like Clipper. [Jon Callas wrote:] >>It is fascinating to me that every example you use does not involve >>decrypting transmitted messages. Yet, that is the feature which is >>under discussion. > >Amazingly, he gave an example where, had encryption been used, the >project would have stopped, and restarted because the person with the >keys was incapacitated. Are you just being combative here? No. I am making the distinction between files and messages. It is quite easy to use a key for encrypting files which is different from encrypting your messages. The key for encrypting files can then given to the appropriate company officer. It has been possible to use PGP in this mode forever. What is new is the feature set which will make it very easy to impose GAK on the customers of PGP. According to Mr. Schneier, the code is just sitting there in all their products waiting to be compiled in. >>The demand for the ability to decrypt encrypted messages in the >>corporate environment can easily be measured with this test: how >>many companies have a policy that requires employees to record all >>outgoing mail? > >Well, any company giving stock advice (and governed by SEC rules on >stock tips, etc.) is already require to have all outgoing mail >approved (e-mail and snail), so does it matter if they record it or >not? The answer to the question I posed is "No". The example you cite requires the company to review message before transmission, not afterward. After transmission, the recipient of the message can submit it as evidence to the SEC should there be an impropriety. This is no different from the way it works now. There is probably a context issue here. It sounds like you do not share the context within which many people on this list are operating. The Big Problem for PGP, Inc. right now is that in 18 months or so their products may be illegal to use within the United States. While many of the rank and file in the company may be willing to accept corporate dissolution under those circumstances, the board, the investors, and the senior management are unlikely to welcome that option. So, they are preparing for that situation. They are releasing products with GAK support right now. By the time it becomes mandated by law, it will be easy to compile the well tested features into all of the products, or just discontinue their line of privacy products and sell only their Big Brother Inside products. The corporate key becomes the government key with the stroke of a pen. PGP, Inc. is betting that they'll win either way. If GAK goes down in flames again, they can still trade on their reputation for being The Good Guys. If GAK becomes mandated by law: "We didn't want to do it, but we had no choice." Some of us may be in the habit of thinking of PGP, Inc. as the hero. However, the problem with organizations is that they are easily corrupted. Does this mean everybody in the organization is now working for the government? No, it does not. Most likely there are many PGP, Inc. employees who are feeling uncomfortable with this new development but they are being given the same lines we are getting. Many of these people are probably getting an additional "inside scoop" from their leaders that explains the "real" strategy. Hopefully, the rank and file at PGP knows that people you like and see in the hallways every day will still lie to you if they think their career depends on it. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDuw65aWtjSmRH/5AQGwLgf7BBYy2HO30eDXO2YLqkgtuOxAcnQU19AO DOKIa3jwU723ICgWD00dPW1GegKL5LaRfp3a+Xtd+qjHaFs0IlXr4kJGv1wiCJhu sRKxmSi3g1aGIfiF48uMef5bbzPL27b3u78rJds+E44LP9zEnieBcACBp+3977W0 0N0k7ADY6ME+zmc4f5D5aLdJa8gprOCPj1nF6esspkMuDDu5iH/YY/GT6VprRCub NojEXPS/uB6tgTS4vDfenL8UWUUqjXQof8MrRoMAG6dsjvNEyU5WlhbnDgyh9nF5 DbuP9+oA8DHYSmEGzTxD4oG7mGwb+NMMuYOyg3xC1H8ou2Ajv0kfOg== =UtlQ -----END PGP SIGNATURE-----

2 1

Re: FCPUNX:CDT complains to my editors after post to cypherpunks
by James A. Donald 17 Dec '03

17 Dec '03

At 09:34 AM 9/26/97 -0700, Tim May wrote: > The larger issue is that the CDT/VTW "players" are showing their > willingness to trade away the civil liberties of us all for a few minor > tidbits thrown (they think) to corporate sponsors. CDT may not necessarily be pursuing the interests of its corporate sponsors. Legislation in congress, any legislation, the worse the better, will promote corporate donations to CDT. This does not meen that the corps want legislation. Indeed, this is a chronic problem with such mundane non civil liberties lobbies as the milk lobby. Big business sends their lobbyists to Washington, where they are corrupted by contact with politicians. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

No Subject
by Zooko Journeyman 17 Dec '03

17 Dec '03

~h ~h ~h ~h ~v

1 0

Starting now, online town hall meeting with Rep. Dreier at www.democracy.net
by shabbir＠democracy.net 17 Dec '03

17 Dec '03

In just a few minutes, we'll be starting the online town hall meeting with Rep. David Dreier (R-CA). Dreier is a key member of Congress for the net community: he's on the Rules committee, which has the fate of SAFE in its hands. He's also been a leader in integrating Congressional committees and the net. Check it out http://www.democracy.net/ -Shabbir

1 0

InfoWar 2000 (Part III of 'The True Story of the InterNet)
by The Last True CypherPunk 17 Dec '03

17 Dec '03

---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar 2000 Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger <tm(a)dev.null> Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * InfoWar 2000 ---------------------------------------------------------------------------- InfoWar 2000 ---------------------------------------------------------------------------- "InfoWar is back!" Jonathan cried out, waking the other members of the Magic Circle instantly. They quickly rose and gathered around the GraphiScreen hovering over the old oak table. Subject: Re: [Pigdog] ViaCrypt slowly executes Timmy C. May From: Flesh <flesh(a)pigdog.org> To: pigdog-l(a)arlington.com, cypherpunks(a)toad.com Does the fireBot work well with the throwemupagainstthewallandaimfortheheadBot? Cowboy recognized the significance immediately. "A thousand Points of Presence." "UUNETWorldCom?" Alexis asked, surprised. Jonathan nodded, adding, "And they're moving faster and quieter than they did in history as we have known it, up to now." He began reading off the list he had compiled in just a short time, "Fiber, Digital Microwave, Satellite, Undersea Fiber Cable. Financial markets, telecommunications, construction, health care, and politics. "They seem to be putting all of the 'usual suspects' under one flag, around the globe." ---------------------------------------------------------------------------- A Player To Be Named Later scanned the series of posts, for the thousandth time. "It's dejavu, all over again." he said, quoting a Yogi Berra malapropism. The feeling had been growing on him The feeling that somehow, everything was the same as beforeonly different. "The Lake of Life has started to turn over. The bottom is rising to the top, the top is descending to the bottom, and everything is becoming the opposite of what it seems to be." A Player To Be Named Later sat quietly, contemplating what it was that had changed, only somehow not changed, since the last time the lake had turned over on the CypherPunks mailing list. He thought about "WebWorld & the Mythical Circle of Eunuchs." He began to see the parallel between the history of the creation of WebWorld and the creation of the CypherPunks distributed list. There was the subterfuge which had preceded both the Channel Revolution which foreshadowed WebWorld and the Censorship Crisis which had presaged the CypherPunks distributed mailing list. There were the climaxes that precipitated the structural changes in both cases, the satellite destruction in the one case, and the loss of toad.com as host to the mailing list in the other case. There were the parallels with outside attacks ceasing on both the CypherPunks distributed mailing lists and the variety of Channels on WebWorld, in an attempt to let the citizens/members bond with their new channels/lists. One parallel-or two, depending on how you looked at it-in particular, which stood out in the mind of A Player To Be Named Later. There were three CypherPunks distributed lists-at algebra.com, ssz.com, and at cyberpass.net. Likewise, there was a reference to the Money Channel Government in WebWorld having three channels under its control. Then, there was the strange, strange saga of three religious channels-the God Channel, the Dualist Channel, and the Trinity Channel-which had somehow merged, yet not merged, creating a problem which had left the 'powers that be' very, very nervous. "What the hell happened to Channel War I?" A Player To Be Named Later, asked himself, suddenly recognizing a glaring disparity between the parallels he was drawing between the history of WebWorld and the history of the CypherPunks list. "And what the hell happened to InfoWar?" he asked, turning to Baby, who stood up and barked her agreement that there was definitely something fishy going on that involved the two shadow wars that had somehow been misplaced in the annals of history-one in the future, and one in the past. In 'WebWorld', both the reference to the three Money Channel Governments and reference to the three spiritual channels which became one, yet didn't, revolved around the close of Channel War I. But there didn't seem to be a parallel to Channel War I in the Time-Line of the CypherPunks list. Likewise, 'WebWorld' began with a reference to an 'InfoWar Scrambler Mechanism' which seemed to indicate that 'InfoWar' would play a major part in the history of 'WebWorld & the Mythical Circle of Eunuchs.' Yet there were only a few later references in Part II of The True Story of the InterNet in regard to "the beginning stages of InfoWar," with no further details. A Player To Be Named Later strained to touch the wispy haze of memory which was rising somewhere in the back of his mind-a memory which whispered "InfoWar" from somewhere deep in the heart of the CypherPunks mailing list censorship crisis. "Toto!" he said, suddenly feeling a ferocious stinging sensation behind his right ear, which resulted in a loss of balance as he fell to the floor, and a loss of consciousness as the blackness closed in around him ---------------------------------------------------------------------------- The tattered remnants of the Magic Circle of the future sat quietly around the antique oak table, anxious and depressed. "Why is the Trei Transponder receiving interference from Toto's digital implant?" Priscilla asked the group. "All of my monitoring tests show that the last adjustments we made to the Zooko Zamboni were up to Journeyman standards." "Perhaps it is a result of the differences in the winter climates between the Netherlands and Canada." Jonathan said. "It seems to me that the effects of Global Warming were just beginning to have undeniably noticeable effects in that particular epoch." The Cowboy got up and paced a bit, as the others realized he was working up the courage to say what they were all thinking. "Or.." he hesitated, then turned to face the others and continued, "perhaps the rebirth of InfoWar reflects that our efforts toward changing the past have not only been successful, but are now irrevocable." Jonathan pulled up a passage of 'WebWorld' onto the GraphiScreen, contemplating what he had originally perceived as the failure of InfoWar during the hotly contested battle which took place on the CypherPunks list during the censorship crisis. "January 19, 1997. "The beginning date of the 'moderation experiment' on the legendary CypherPunks mailing list. The beginning probe in preparation for the launching of InfoWar-an experiment which had failed miserably and had caused a delay in the plans of the Evil One. A delay caused by the damnable insolence of the terminal misfits among the CypherPunks. An insolence that was rumored to be fueled by the Circle of Eunuchs, fanning the 'flames' of dissent among the CypherPunks, helping them to resist the herding of their list members into the group-mindset desired by the Evil One." The other members of the Circle of Eunuchs sat still in their seats, not wanting to disturb the deep thoughts of Jonathan, who was indeed the Last True CypherPunk, having grown up at their feet, immersed in their logic and their lore, and whose whole life had been ruled by his connection to the infamous anarchists who had been, alternately, both the shining light of freedom and privacy in their era, and the treacherous instigators of Channel War II-the war which had led to the ultimate triumph of the Gomez and the Dark Allies and the conclusive ascent of the Dark Forces in their domination of WebWorld under the dictum of the Evil One. The room was quiet as Jonathan reluctantly pulled up the next passage of 'WebWorld' which had described his feelings when his bereft past had come back to haunt him. "Jonathan sat frozen in his seat, once again, his brain locked from the major dichotomies being produced as a result of his present-in which the CypherPunks were a villainous band of rogues who had instigated the launching of Channel War II-and his past, in which his grandfather had been exposed both as one of the major players in both the launching of Channel War II, and as traitorous scum who had sabotaged the goals of the CypherPunks in that same historical battle. "Jonathan's grandfather wasn't just a CypherPunk. He was the Fool." "We won" Jonathan's voice trailed off, before he rose from the table and repeated his statement, in anger. "We won, damn it! "I know we won. Grandfather knew we won the censorship battle. Everyone knew that we won the censorship battle. History itself knows that we wonwe" Jonathan stopped short, turning to stare at the others, who were staring back. "Jonathan" Bubba said softly. "History has changed." "I know that, damn it!" Jonathan resumed his pacing, knowing that he was missing something very, very important, but he couldn't for the life of him think what it might possibly be. The others in the room watched and waited, knowing that it was Jonathan, and Jonathan alone, whose heritage was intricately and irrevocably linked to the era in history which they had, for better or worse, interfered in through their use of the Trei Transponder. "Grandfather was a traitor to the CypherPunksa traitor to freedom and privacy. He sabotaged everything that the CypherPunks had fought so hard to defend, since the inception of their anarchist, cryptography mailing list. "But the CypherPunks loved us" Jonathan was lost in memories of a childhood in which he and his family had been forced to remain in constant motion, staying a half-step ahead of the Dark Allies, who had been hunting down the last remaining members of the CypherPunks-with a vengeance. His family had been soundly welcomed by the remaining CypherPunks, in their flight to freedom after his Grandfather's assassination. They had given the family food, clothing, shelter, and warned them when the Dark Allies were closing in, and it was once again time to flee. Duncan Frissell had even Perhaps they all had Jonathan sank to the floor, slowly, with Alexis leaping up and catching him softly. Cowboy helped her guide him toward the table and lower him into a chair. Jonathan slowly pulled off his shirt and stared at his tattoothe Mark of the Toad. "Duncan Frissell arrived at our last safe house, in the middle of the night." Jonathan spoke, finally understanding the real story behind his family's flight into obscurity. "He warned us to flee, but it was too latethe Dark Allies were close at hand." Jonathan's voice was full of amazement as he recounted an event which he had long known, but had never managed to fully understand. "Duncan held the Dark Allies at bay, while we made our escape. I can still hear his screams" Jonathan shuddered, then began shaking terribly. Alexis closed her arms around him, hugging him lightly. "Your Grandfather knew that the CypherPunks had lost the battle." Bubba picked up the thread. The other members of the Magic Circle looked on, mystified as to this strange turn of events which turned the whole history of the CypherPunks and the Circle of Eunuchs on hits head. "It wasn't a censorship battle." the Cowboy said, amazed as much by what he was saying as those listening to him were. "It was InfoWar!" "That's what happened to InfoWar." Alexis cried out, in disbelief of her own words. "It was over before it had begun." Bubba d'Shauneaux IV rose to his feet, and filled in the details of the battle as could only be done by one who had spent a lifetime of subterfuge playing a role which was the exact opposite of what it had seemed to be from surface appearances. "It was the first battle fought solely within the bounds of Virtual Reality." "It represented the true nadir point in history when the battle between the Forces of Light and the Forces of Darkness moved beyond the physical plane and into the minds of mankind." "InfoWar!" he roared, the word reverberated throughout the room, sending the Trei Transponder into a soft hum which grew louder and louder, with a pitch that went lower and lower until it became subsonic, unheard, but shaking the roomthe eartheven WebWorld itself... The Trei Transponder exploded with a mighty boom, shaking the room so violently that the tattered remnants of the Magic Circle were thrown from their chairs, and found themselves rising to see only ruins around them, where their safe house had once been. They immediately realized that they must flee at once, as those investigating the explosion would undoubtedly be the Dark Allies, fully aware that the event had rent WebWorld at the seams. Jonathan paused, weapon in hand, covering the retreat of d'Shauneaux, who had remained behind to remove the last traces of evidence that the Circle of Eunuchs had ever truly been there. As d'Shauneaux joined him, motioning for him to proceed, he took one last look at the shattered remains of the Trei Transponder. All contact with the CypherPunks of the past was now gone, with little hope of it being renewed. Silently, he sent a message to the CypherPunks of his youth-from the bottom of his soul and into the inestimable profundity of the Tao. It was a message that would be understood by those who had been at Woodstock-a physical gathering of a Magic Circle which had come into physical being through a random blessing of Time and Chance. "You're on you own, folksbecause we're sure on ours." ---------------------------------------------------------------------------- Those who fail to learn from the future, are doomed to repeat it. ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ----------------------------------------------------------------------------

1 0

InfoWar 2000 / AOL Format
by The Last True CypherPunk 17 Dec '03

17 Dec '03

1 0

MISTY algorithm source code
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

Attachments files is MISTY algorithm source code. Thank you very much. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com MISTY.zip

1 0

Re: access to storage keys, NOT comms keys!
by Anonymous 17 Dec '03

17 Dec '03

Here is what leading cryptographers say about email key recovery, from http://www.crypto.com/key_study/report.shtml. This includes respected figures like Bruce Schneier, Matt Blaze, Ron Rivest, Ross Anderson, Whit Diffie, and more. 2.1 Communication Traffic vs. Stored Data While key ``recoverability'' is a potentially important added-value feature in certain stored data systems, in other applications of cryptography there is little or no user demand for this feature. In particular, there is hardly ever a reason for an encryption user to want to recover the key used to protect a communication session such as a telephone call, FAX transmission, or Internet link. If such a key is lost, corrupted, or otherwise becomes unavailable, the problem can be detected immediately and a new key negotiated. There is also no reason to trust another party with such a key. Key recoverability, to the extent it has a private-sector application at all, is useful only for the keys used to protect irreproducible stored data. There is basically no business model for other uses, as discussed below. In stored data applications, key recovery is only one of a number of options for assuring the continued availability of business-critical information. These options include sharing the knowledge of keys among several individuals (possibly using secret-sharing techniques), obtaining keys from a local key registry that maintains backup copies, careful backup management of the plaintext of stored encrypted data, or, of course, some kind of key recovery mechanism. The best option among these choices depends on the particular application and user. Encrypted electronic mail is an interesting special case, in that it has the characteristics of both communication and storage. Whether key recovery is useful to the user of a secure E-mail system depends on design of the particular system. The government, on the other hand, proposes a key recovery infrastructure that applies to virtually all cryptographic keys, including (especially) those used to protect communications sessions. They say that key recovery is not appropriate for transient keys used during a communication session. However, email is a special case, having characteristics of both communication and storage. In some systems, email may be archived for long periods of time in the same format that it was received. For such systems there is a business case for key recovery in email.

2 1

US Terrorist Targets
by John Young 17 Dec '03

17 Dec '03

US State Department today published the latest list of terrorist organizations (and multiple aliases) which are now targets of sanctions: http://jya.com/dos100897.txt And related foreign assets control announcement: http://jya.com/fac100897.txt ---------- List summary: Abu Nidal Organization Abu Sayyaf Group Armed Islamic Group Aum Shinrikyo Democratic Front for the Liberation of Palestine-Hawatmeh Faction Euzkadi Ta Askatasuna Gama'a al-Islamiyya HAMAS Harakat ul-Ansar Hizballah Japanese Red Army al-Jihad Kach Kahane Chai Khmer Rouge Kurdistan Workers' Party Liberation Tigers of Tamil Eelam Manuel Rodriguez Patriotic Front Dissidents Mujahedin-e Khalq Organization National Liberation Army Palestine Islamic Jihad-Shaqaqi Faction Palestine Liberation Front--Abu Abbas Faction Popular Front for the Liberation of Palestine Popular Front for the Liberation of Palestine--General Command Revolutionary Armed Forces of Colombia Revolutionary Organization 17 November Revolutionary People's Liberation Party/Front Revolutionary People's Struggle Shining Path Tupac Amaru Revolutionary Movement

1 0