December 2003 - cypherpunks-legacy

No Subject
by Hroller Anonymous Remailer 17 Dec '03

17 Dec '03

<Yet Another Alarmist TV Show About Child Molesters on the Net: <snip> <Anyway, the mainstream media trashing of the Net continues. And the trashing will continue. It is the classic scenario. Feed the media negative press clips about the entity you wish to discredit (here, the Net), e.g.: 1. All those pedophiles out to lure your children; 2. Big coverage on catching some of those pedophiles; 3. First page coverage on breaking Netscape's code with the headlines that your sensitive information such as your credit card numbers, etc. can be retrieved (ignoring that the reason was to show Netscape's poorly structered code would allow this and, therefore, preventing it before it could happen); 4. Expect cryptology to crop up in the Oklahoma bombing trial. There already has been articles of those involved having allegedly used that *damned* Net to correspond. Now, the stage is set. The general public will demand that the Net (the bastion of perverts and radicals) be controlled, monitored, and censored - all as a result of a carefully planned methodology of those specific powers that be. Having the general public believe that their children and the national security are being threatened makes it a much easier task for *them* to attain their goals. After all, who wants to be bothered with proposed legislation when you can have Jane and John Doe yelling for what may have taken *them* a while to attain by "normal" routes? Never underestimate.... Pathfinder

1 0

Crowds code NOW AVAILABLE for Unix
by Mike Reiter 17 Dec '03

17 Dec '03

Crowds is a new system for protecting your anonymity while you browse the web. We have recently obtained a release for the code from AT&T and have been testing the system with a handful of volunteers. Thanks to their efforts, we now feel more prepared to support a larger user community. So, if you are interested in browsing the web with better anonymity than the Anonymizer, check out http://www.research.att.com/projects/crowds There are two steps. The first is obtaining the code. After you accept the license agreement, expect a 24 hour turnaround to receive the code by e-mail. Second, if you would like to join our crowd, fill out the registration page, and expect 24 hours before you are admitted. (These steps can proceed in parallel.) The system requires Perl 5.003 or higher, and has been tested on SunOS, Solaris, and Irix. Our next target is Linux. - Mike Reiter and Avi Rubin

1 0

Phil Karn's legal case is filed; here's the Complaint.
by John Gilmore 17 Dec '03

17 Dec '03

Full info is at http://www.qualcomm.com/people/pkarn/export/index.html. UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA ____________________________________ ) PHILIP R. KARN, JR. ) 7431 Teasdale Avenue ) San Diego, California 92122 ) ) Plaintiff, ) ) v. ) ) U.S. DEPARTMENT OF STATE ) Case 1:95CV01812 2201 C Street, N.W. ) Washington, D.C. 20520 ) ) and ) ) THOMAS E. MCNAMARA ) Assistant Secretary ) Bureau of Political-Military Affairs ) U.S. Department of State ) Room 7325 ) 2201 C. Street, N.W. ) Washington, D.C. 20520 ) ) Defendants. ) ) ____________________________________ ) COMPLAINT COMES NOW the plaintiff PHILIP R. KARN, JR., by and through his undersigned counsel of record, and for his causes of action against the named Defendants states the following: 1. Plaintiff PHILIP R. KARN, JR. is a resident of San Diego, California. 2. Defendants, U.S. DEPARTMENT OF STATE and THOMAS E. MCNAMARA, Assistant Secretary of the U.S. Department of State of the United States of America, proceeded against in his official capacity, are charged with, inter alia, the administration of the Arms Export Control Act ("The Act"), 22 U.S.C. 2778 et seq., and the International Traffic in Arms Regulations ("The ITAR") 22 C.F.R. Subchapter M. (Subsequent citations to the ITAR are with a section designator only.) 3. This is an action for a declaratory judgment pursuant to 28 U.S.C. 2201, for the purpose of determining a question of actual controversy between the parties as is herein more fully set forth. Jurisdiction and Venue 4. Jurisdiction of this action is based on 28 U.S.C. 1331, in that it is a civil action arising under the laws of the United States, and the First and Fifth Amendments to the Constitution of the United States. 5. Venue is proper in this Court pursuant to 28 U.S.C. 1391, in that this is a civil action against an officer of the United States and the decisions, which are the subject of this action, were made within the District of Columbia. Causes of Action 6. Plaintiff KARN hereby realleges and incorporates by reference, as though fully set forth herein, the allegations of paragraphs 1-5. 7. The ITAR is implemented by the Office of Defense Trade Controls ("the Office"). 8. Under ¶ 120.2 of the ITAR, the Office is responsible for reviewing and determining whether particular products and technologies are defense articles, as defined at ¶ 120.6, technical data, as defined at ¶ 120.10, or defense services, as defined at ¶ 120.9, and, therefore, subject to the prior export licensing requirements of the ITAR. Such articles, services and technical data are described in ¶ 121.1, which is styled the United States Munitions List ("the USML"). Products and technologies, which are neither defense articles nor defense services, as defined in the ITAR, are subject to the export licensing jurisdiction of the Department of Commerce. 9. The ITAR provides a procedure for the determination of whether a particular product or technology is subject to its licensing requirements. See ¶ 120.4. Upon receipt of a written Commodity Jurisdiction Request, a determination is made as to whether an item is included on the USML. A "commodity jurisdiction" procedure entailing consultations among the Departments of State, Commerce, and Defense is used to make the determination. 10. Under ¶ 120.10, information that is in "the public domain" is not subject to the ITAR's export licensing controls. 11. Pursuant to ¶ 120.4, Plaintiff KARN on February 12, 1994 initially submitted a Commodity Jurisdiction Request for Applied Cryptography, a book ("the Book") by Bruce Schneier, which was published in this country. 12. The Book was published by John Wiley & Sons, Inc. It is available from most bookstores that carry computer books and has a list price of $44.95. It has sold approximately 20,000 copies worldwide. 13. The Book contains computer source codes, detailed descriptions and instructions on how to use a wide variety of cryptographic algorithms, and explains how computer programmers designing computer applications, networks and storage systems can use cryptography to maintain the privacy and security of computer data. 14. Cryptography is a mathematical technique used to protect the secrecy of electronic communications between individuals by scrambling, or encrypting, communications so that only particular recipients with a "key" to decrypt the communications may decipher them. Cryptographic software programs that protect the confidentiality of electronic communications are created by using programming instructions, or source code algorithms. These are sophisticated mathematical equations that are expressed in computer source code and converted into computer programs. Cryptography has a variety of commercial uses including confidentiality of electronic mail, computer software, voice, video and other information in digitized form. 15. Part Five of the Book contains a full-text actual source code listing for fourteen cryptographic algorithms in the C programming language, which were developed by various sources at various times using both private and public sources of funding. A two- disk cryptographic source code set ("the Diskette Set"), which includes the same codes printed on pages 456-570 of Part Five of the Book, is offered for sale on its last page. 16. Binary copies of several of the source code algorithms published in Part Five of the Book are also publicly available from anonymous file transfer protocol ("FTP") sites outside the United States. 17. In a letter dated March 2, 1994, the Office concluded that the Book, including the source code in Part Five, was in "the public domain." The Book was accordingly transferred to the export jurisdiction of the Department of Commerce, where it is eligible for export to all destinations under a general license. (A general license is one which is generally available and need not be specifically applied for in advance of any export.) 18. The March 2, 1994 ruling from the Office expressly did not extend to the Diskette Set. 19. On March 9, 1994, Plaintiff KARN submitted a second Commodity Jurisdiction Request ("the Second Filing") for a determination as to whether a Diskette ("the Diskette") containing only the source code information, as set out in Part Five of the Book, was subject to the export licensing requirements of the ITAR. The only difference between the information contained on the Diskette and Part Five of the Book is the medium-used: magnetic pulses on Mylar instead of inked characters on paper. 20. Plaintiff KARN is desirous of exporting the Diskette to fulfill his interest in the dissemination of cryptographic information. 21. The Office responded to the Second Filing on May 11, 1994 and stated that the Diskette is a defense article under Category XIII(b)(1) of the USML and, therefore, subject to the export licensing jurisdiction of the ITAR. 22. On June 7, 1994 Plaintiff KARN appealed the May 11, 1994 determination of the Office to the Deputy Assistant Secretary of State for Export Controls ("the DAS"). 23. On October 7, 1994 the DAS responded to Plaintiff's appeal by affirming the Office's determination and concluding that the Diskette was a defense article because it was cryptographic software, notwithstanding the fact that the information it contains is identical to that in the Part Five of the Book. 24. Pursuant to ¶ 120.4(g), the DAS's determination was appealed to the Assistant Secretary of State for Political-Military Affairs on December 5, 1994. 25. On June 13, 1995 the Assistant Secretary of State for Political-Military Affairs ("the Assistant Secretary") reaffirmed the DAS's determination but failed to address the fact that the information contained in the Diskette is identical to that in Part Five of the Book, which was already found not to be subject to the licensing jurisdiction of ITAR. 26. No additional appeals mechanism is set forth in the ITAR with respect to commodity jurisdiction determinations. 27. Plaintiff has exhausted his administrative remedies, therefore, this matter is "ripe" for judicial review. 28. The application of the ITAR provisions to Plaintiff KARN, which require the application for and issuance of a license prior to any export, has caused him unusual hardship and irreparable injury in that he has been and is currently being denied the free exercise of constitutional rights as more fully stated below. Plaintiff has no adequate remedy at law for these injuries; accordingly, he is entitled to declaratory relief. 29. The actions of Defendants restricting the dissemination of information contained on the Diskette, which is identical to the information contained in Part Five of the Book, are arbitrary and capricious, constitute an abuse of discretion and are otherwise not in accordance with the Administrative Procedure Act ("the APA") at 5 U.S.C. 706(2)(A). 30. As set forth below, the actions of Defendants restricting the dissemination of information contained on the Diskette, which is identical to the information contained in Part Five of the Book, are contrary to Plaintiff's constitutional rights and, therefore, not in accordance with the APA at 5 U.S.C. 706(2)(B). 31. The Office's determination, and its subsequent reaffirmation by the DAS, and the Assistant Secretary subjecting the Diskette to export licensing controls when the information it contains is identical to the published text of Part Five of the Book, which was deemed not subject to such export controls, is irrational, arbitrary, and capricious. These arbitrary and capricious actions violates Plaintiff's Fifth Amendment right to substantive due process. 32. The Office's determination, and its subsequent reaffirmation by the DAS and the Assistant Secretary, to control the export of the Diskette containing information set forth in a published book is a violation of Plaintiff's fundamental First Amendment right to free speech. 33. As applied by Defendants, the ITAR requires Plaintiff to apply for a license to export the Diskette containing information identical to that in Part Five of the Book. Therefore, as applied to Plaintiff in this instance, the prior licensing requirement of the ITAR operates as a prior restraint on Plaintiff's disclosure of ideas and information in violation of his First Amendment rights to free speech. 34. As applied to Plaintiff, ¶ 120.4 dealing with the determination of whether particular products and technologies are defense articles, is unconstitutionally overbroad and vague, as it includes within its scope speech protected by the First Amendment, namely material contained in the Book, thereby chilling the exercise of free speech rights. Prayer for Relief WHEREFORE, Plaintiff KARN prays for judgment against Defendants, U.S. DEPARTMENT OF STATE and MCNAMARA, as follows: A. Declaring that the provisions of the ITAR, as applied to Plaintiff KARN, be declared null and void, of no effect, as unconstitutional under the Fifth and First Amendments. B. Declaring that the determination to subject the Diskette to the export licensing controls of ITAR is unlawful in violation of the APA at 5 U.S.C. 706(2)(A) & (B). C. For attorneys fees incurred herein. D. For costs of the action incurred herein and E. For such other and further relief as the Court deems just and proper.

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord ?"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"cracker"} = "<remailer(a)anon.efga.org> cpunk mix remix pgp hash ksub esub latent cut ek reord post"; $remailer{'redneck'} = '<config(a)anon.efga.org> newnym pgp'; $remailer{"bureau42"} = "<remailer(a)bureau42.ml.org> cpunk mix pgp ksub hash latent cut ek"; $remailer{"neva"} = "<remailer(a)neva.org> cpunk pgp pgponly hash cut ksub ?"; $remailer{"lcs"} = "<mix(a)anon.lcs.mit.edu> mix"; $remailer{"medusa"} = "<medusa(a)weasel.owl.de> mix middle" $remailer{"McCain"} = "<mccain(a)notatla.demon.co.uk> mix middle"; $remailer{"valdeez"} = "<valdeez(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"arrid"} = "<arrid(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"hera"} = "<goddesshera(a)juno.com> cpunk pgp pgponly hash ek"; $remailer{"htuttle"} = "<h_tuttle(a)rigel.cyberpass.net> cpunk pgp hash latent cut post ek"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix reno winsock) (weasel squirrel medusa) (cracker redneck) (nym lcs) (valdeez arrid hera) The remailer list here has been out of date for some time, but should be up to date now. I'm still working on updating the web page. Last update: Mon 15 Sep 97 6:49:37 PDT remailer email address history latency uptime ----------------------------------------------------------------------- nym config(a)nym.alias.net +#-#*+**+### 3:06 99.98% cyber alias(a)alias.cyberpass.net ++**+******* 10:34 99.98% hera goddesshera(a)juno.com --..-----.-- 8:56:54 99.97% valdeez valdeez(a)juno.com *-.-------- 4:48:25 99.85% neva remailer(a)neva.org -* #*-+--*- 56:05 99.73% bureau42 remailer(a)bureau42.ml.org -----+----- 3:21:28 99.61% winsock winsock(a)rigel.cyberpass.net .---------- 7:16:41 99.59% jam remailer(a)cypherpunks.ca ++++++++++++ 29:19 99.34% redneck config(a)anon.efga.org * +++**#**#* 3:52 99.25% cracker remailer(a)anon.efga.org + ++++++++++ 22:45 99.23% replay remailer(a)replay.com +*****+*** 7:01 99.22% mix mixmaster(a)remail.obscura.com + _ .-***** 8:48:39 98.63% squirrel mix(a)squirrel.owl.de ----- ---- 3:02:18 98.12% reno middleman(a)cyberpass.net -- - --- 4:04:58 94.27% arrid arrid(a)juno.com ---- -- 12:26:26 73.80% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

ANNOUNCE: Bryce's Auto-PGP v1.0 available for 10 cyberbucks
by Bryce Wilcox 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm pleased to announce the release of "Bryce's Auto-PGP" version 1.0. Bryce's Auto-PGP, a.k.a. "BAP", is a Unix script which makes it simple and convenient to use PGP with almost any Unix message- handling application. As far as I know there is no Unix mssage-handling application that cannot be integrated with BAP. BAP has been test by me personally with Elm, Pine, mh and trn, and it has also turned out to be useful with such Unix utilities as finger and vi. I'm distributing BAP from my World Wide Web site: http://www-ugrad.cs.colorado.edu/~wilcoxb/BAP.html As an experiment in cyberspace economics, I am asking for 10 cyberbucks, the currency for the Internet created by DigiCash company in return for BAP. To sign up for the cyberbuck trial and get your free cyberbucks visit: http://www.digicash.com/ecash/ecash-home.html If you have any problems acquiring or using BAP, please e-mail me. Bryce signatures follow To strive, to seek, to find and not to yield. bryce(a)colorado.edu http://ugrad-www.cs.colorado.edu/~wilcoxb -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Automatic PGP clearsigning under Unix with Bryce's Auto-PGP v1.0 iQCVAwUBMGZ0jfWZSllhfG25AQHfHwP/YDqzy7B8YfnQ32Oe5kqLfyXvKWUf/cok RObG3lt1pKz3NsuCFwZoJC1T4cmamMkEsEy9S2lcAT4GO4GlAMNm/Su4AdveuvYh /UjHVf2a1wGLcdvq4bfVUV+ldrn2UJuKJno3X9kBP1ofvqANWusOpQvMsPLzQMQj 3K9Uy/ulDEA= =bGwi -----END PGP SIGNATURE-----

1 0

Net Gambling on CNN
by Duncan Frissell 17 Dec '03

17 Dec '03

On Sunday's Point-Counterpoint on CNN, Sen. Richard Lugar who is pushing a Federal commission on gambling mentioned gambling on the Internet half a dozen times. His motive seemed to be to give the Feds an excuse for getting involved in gambling control. He also mentioned Federal regulation of Indian reservations in this context. What he wants to do is discourage state promotion of gambling. Net Gambling is really on the table. DCF

1 0

update to crypto legislation page
by geeman＠best.com 17 Dec '03

17 Dec '03

http://www.best.com/~geeman has some new links, the text of the new SAFE amendment thank you Declan, House Comment that includes a couple of strong statement fom Law Enforcement, the text of the Calif. legislature's statement to Washington ...

1 0

Re: Decompiling Netscape
by Rick Busdiecker 17 Dec '03

17 Dec '03

From: Ray Cromwell <rjc(a)clark.net> Date: Fri, 22 Sep 1995 13:32:57 -0400 (EDT) Anyone want to lend me a hand in finding and disassembling the routine responsible for the buffer overflow in Netscape? Or atleast tell me how you did it. (I hope it wasn't done by single stepping thru functions in GDB) I missed the whole Netscape RNG decompilation thread. You could win a T-shirt for your help! Under Unix, you can use objdump, e. g. % objdump -d netscape netscape: file format a.out-sunos-big No symbols in "netscape". Disassembly of section .text: 00002020 clr %fp 00002024 ld [ %sp + 0x40 ], %o0 00002028 add 0x44, %sp, %o1 0000202c sll %o0, 2, %o2 00002030 add 4, %o2, %o2 00002034 add %o1, %o2, %o2 . . . This should work wherever other GNU utilities work. objdump is part of GNU binutils. -- Rick Busdiecker Please do not send electronic junk mail! net: rfb(a)lehman.com or rfb(a)cmu.edu PGP Public Key: 0xDBD9994D www: http://www.cs.cmu.edu/afs/cs.cmu.edu/user/rfb/http/home.html send mail, subject "send index" for mailbot info, "send pgp key" gets my key

1 0

"Gnusaic"? Why not a Gnu-Style Web Browser?
by tcmay＠got.net 17 Dec '03

17 Dec '03

I'm pretty happy with Netscape 1.1N, but John Gilmore's point about NCSA Mosaic gives me a thought: At 6:44 AM GMT 9/21/95, John Gilmore wrote: >> I realize that some cypherpunks think that we should make all of >> our code publicly available. In an ideal world that would be great, >> but we live in a world with politicians, crooks, lawyers, stockholders, >> etc... Don't expect to see us posting our entire security >> library source code to cypherpunks. > >Naah. I think NCSA should've made Mosaic publicly available, because >they wrote it with our tax dollars. And I hold it against them that >they started the trend of "zero-cost personal-use binaries but no >commercial use" that many Net users still confuse with Real Free >Software (free as in freedom). But Netscape owns its code, it can do >whatever it wants with it. Why not a Gnu-style Web browser? I don't know if the original Mosaic can be used and added to, but I can imagine something like this could be done. Web browsers are becoming, for many of us, our de facto interfaces to the Net, not just the Web. A project to make a truly freely distributable Web browser and Web server (the other part of the puzzle) could be interesting. Strong crypto could be added by volunteers working in their specialties, and the "Web proxie" could be put in with robustness (D-H forward secrecy, for example). I'll stop now, as I've never been a Gnu customer (except for Emacs), and so I'm not really in a position to comment and speculate on Gnu. For all I know, Stallman and others have already thought of this and are working on it. --Tim May Notice: With 1000 people on the Cypherpunks list, and many on other lists I am on, nearly every article I write generates at least one question, request for more information, dispute with my choice of words, etc. I have been trying to respond to these, usually privately, but the burden has become too much, and I no longer plan to respond to trivial or ephemeral points. If you don't hear from me, this is why. Some requests for pointers to information will still be handled, but I advise people to learn how to use the archives and/or search tools. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

4 3

Re: Crypto in Wired
by blane＠eskimo.com 17 Dec '03

17 Dec '03

On Sun, 24 Sep 1995 20:00:02 -0400 you wrote: >Good issue of Wired this month (10/95) > I also noticed that on page 35 Chrysler has awarded Philip Zimmerman a 1995 Chrysler Award of Innovation in Design. Its nice to see large corporations taking notice cryptography. Brian --------------------------------------------------------------------------- blane(a)eskimo.com | Finger for PGP key http://www.eskimo.com/~blane | Privacy, Security, and Electronics ftp://ftp.eskimo.com/~blane | Misc. Interesting files

1 0