December 2003 - cypherpunks-legacy

KRAP is at it in the IETF
by Information Security 18 Dec '03

18 Dec '03

> From: "William H. Geiger III" <whgiii(a)invweb.net> > > -----BEGIN PGP SIGNED MESSAGE----- > > Hello, > > It has come to my attention that the KRAP (key recovery alliance program) > has submitted an I-D (internet draft) to the IETF for adding GAK > (government access to keys) to the IPSEC protocols: > > ftp://ftp.ietf.org/internet-drafts/draft-rfced-exp-markham-00.txt > > I consider this a perversion of the standards process of the IETF to > advance a political agenda which must be stopped at all cost. > > Below are the e-mail addresses of some people that you should write > (politely) expressing your objections to any such additions to the > protocols: Dear Sirs, # o Government Requirements: Governments must be able to intercept the # CKRB at the time of key establishment or periodically while the # security association remains active. This requires that the key # recovery enabled entity transmit the CKRB during the key establishment # protocol and every N hours during the security association. Speaking as someone who monitors company Internet traffic (email) for compliance and security purposes, I would like to ask why the IETF is working on a key recovery standard. If a company chooses to deploy, say, PGP with key recovery internally, then any messages sent with it encrypted in the receiving party's public key are available to the sending company's Information Security personnel. If a company wishes to make the key recovery information available to the government, they can individually choose to do that. The IETF should not be helping to put such an infrastructure in place. Governments are our adversaries with respect to encryption and privacy. The US government, represented by the FBI/NSA, used to state that they weren't pushing for mandatory domestic encryption. (requiring people use curtains on their homes that the government can see through) Eventually we found out they lied, and were pushing for exactly that behind the scenes: * http://epic.org/crypto/ban/fbi_dox/impact_text.gif * * SECRET FBI report * * NEED FOR A NATIONAL POLICY * * A national policy embodied in legislation is needed which insures * that cryptography use in the United States should be forced to be * crackable by law enforcement, so such communications can be monitored * with real-time decryption. * * All cryptography that cannot meet this standard should be prohibited. Feel free to cite this manipulation when discarding key recovery proposals. If you put a key recovery proposal in place, it makes it that much easier for them to require its use. Plus my basic complaint: this proposal is of no use to business or Internet users. None. Its only purpose is to allow interception and decoding over the Internet. And if you think this would happen only with a court order, check out this "anytime, anywhere" wording by the US government... ---guy Don't be another cog in the ECHELON monitoring machine. The U.S. asked the OECD to agree to internationally required Key Recovery. * What Is The OECD * * The Organization for Economic Co-operation and Development, based in * Paris, France, is a unique forum permitting governments of the * industrialized democracies to study and formulate the best policies * possible in all economic and social spheres. : From owner-firewalls-outgoing(a)GreatCircle.COM Wed May 14 18:54:15 1997 : Received: from osiris (osiris.nso.org [207.30.58.40]) by ra.nso.org : (post.office MTA v1.9.3 ID# 0-13592) with SMTP id AAA322 : for <firewalls(a)GreatCircle.COM>; Wed, 14 May 1997 12:56:13 -0400 : Date: Wed, 14 May 1997 12:58:46 -0400 : To: firewalls(a)GreatCircle.COM : From: research(a)isr.net (Research Unit I) : Subject: Re: Encryption Outside US : : : I was part of that OECD Expert Group, and believe I may shine at least : some light on what exactly was said and happened at the meetings. : : The main conflict during all sessions was the demand of the US to be : able to decrypt anything, anywhere at any time versus the European : focus: we want to have the choice - with an open end - to maintain : own surveillance. The US demand would have caused an immediate : ability to tap into what the European intelligence community believes to : be its sole and exclusive territory. In fact the Europeans were not at all : pleased with the US view points of controlling ALL crypto. Germany and : France vigorously refused to work with the US on this issue. : : The Clipper initiative (at the time not readily developed) was completely : banned, except for the Australian and UK views that felt some obligation : from the 1947 UKUSA treaty (dealing with interchange of intelligence). : : With a vast majority the US was cornered completely, and had to accept : the international views. And actually adopted those as well. EFF, EPIC and : other US organizations were delighted to see the formal US views barred, : but expressed their concern on the development of alternate political : pressure that would cause the same effects. : : As time went by that was indeed what the US did, and up to now with minor : success. : : Bertil Fortrie : Internet Security Review : ==

1 0

any relation?
by Steve Mynott 18 Dec '03

18 Dec '03

http://www.kiva.net/~tmay/ -- pgp 1024/D9C69DF9 1997/10/14 steve mynott <steve(a)tightrope.demon.co.uk>

1 0

Re: What we are Fighting
by Information Security 18 Dec '03

18 Dec '03

[Cryptography Manifesto excerpts used for replies] > From: John Young <jya(a)pipeline.com> > > Tim asks: > > >Freeh and Company continue to mumble about "meeting > >the legitmate needs of law enforcement." What can they > >be speaking of? > ... > >Obviously his side is contemplating domestic crypto restrictions. > > Threat of terrorism will be the impetus for applying national security > restrictions domestically, for relaxing cold war limitations on spying > on Americans, for dissolving barriers between law enforcement > and military/intelligence agencies. Funny how the NSA's ECHELON monitoring machine keeps growing endlessly... : The Washington Post Magazine, June 23 1996 : "Government surveillance, terrorism and the U.S. Constitution" : from Main Justice, by Jim McGee and Brian Duffy, 1996, ISBN 0-684-81135-9 : : The FBI is growing in tandem with the NSA. With the help of the National : Security Agency, the U.S. eavesdropping bureaucracy that spans the globe, : the FBI operates a super-secret facility in New York code-named Megahut : that is linked to the other FBI listening posts. : : After the OKC bombing, Janet Reno and Louis Freeh asked Congress to raise : to 3,000 the number of FBI agents working counter-intelligence and counter- : terrorism. : : With the new legislation, the funding for just the FBI's counter-intelli- : gence/terror goals is now ONE BILLION DOLLARS a year, and their activities : will rise to a LEVEL HIGHER THAN AT ANY TIME DURING THE COLD WAR. 1984 means a constant State of War. Here's a new war: "cyberwar". # "Head of CIA Plans Center To Protect Federal Computers" # By Tim Weiner, The New York Times, 6/26/96 # # John Deutch, Director of the CIA, is building a "cyberwar" center in the NSA. # # Mr. Deutch said cyberwar could become a 21st-century national security threat # second only to nuclear, biological and chemical weapons. # # "The electron," Mr. Deutch warned, "is the ultimate precision-guided weapon." Haven't I heard bad dialogue like this on Mystery Science Theater 3000? ---- > From: John Young <jya(a)pipeline.com> > > Technical means for access to encrypted data will probably > come first in communications, then to stored material. There > will be an agreement for increased CALEA wiretap funding, which > is what the two cellular and wired suits against the FBI intend, > (paralleling what the hardware and software industries want from > federal buyers of security products). > > This will provide the infrastructural regime for the gov to monitor > and store domestic traffic as NSA does for the global, using the > same technology (NSA may provide service to domestic > LEA as it now does for other gov customers for intel). Question: How can the FBI use computers to monitor thousands and thousands and thousands and thousands of phone calls simultaneously, as they said they would do with CALEA, when we Americans speak so many different accents and languages? Answer: Thirty years of fine tuning by the NSA, y'all. ---- > From: John Young <jya(a)pipeline.com> > > As noted here, the features will appear first as optional, in response > to demand from commerce, from parents, from responsible > institutions, to meet public calls for protection, for privacy, for > combating threats to the American people. * "Project L.U.C.I.D.", by Texe Marrs, 1996, ISBN 1-884302-02-5 * * These changes are necessary, we are reminded each day by our mind control * jailers in the media, to solve the immigration crises, to institute gun * control, to counter domestic terrorism, to fight pornography, to find * deadbeat dads who don't pay child support, to "Save Mother Earth", * to war against drug kingpins, to stop crime in the streets, to watch and * monitor the militias, to put an end to hate crimes and bigotry, * to extend universal healthcare benefits, to guarantee welfare reform, to * improve public education...the list of crises and problems to be fixed * seems to be never-ending. * * Implement National ID Cards, they promise, and a bright, secure future * can be ours. [snip] ---- > From: John Young <jya(a)pipeline.com> > > Like wiretap law, use of the features for preventative snooping will > initially require a court order, as provided in several of the crypto > legislative proposals. > > Like the wiretap orders, gradually there will be no secret court refusals > for requests to use the technology in the national interest. > > Personal privacy will evaporate almost unnoticeably... * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *** *** *** *** *** *** *** *** *** *** * * * * * * * * * * : The Puzzle Palace : Inside the National Security Agency, : America's most secret intelligence organization : Author James Bamford, 1983 revision, ISBN 0-14-00.6748-5 P468-469: Within the United States, FISA still leaves the NSA free to pull into its massive vacuum cleaner every telephone call and message entering, leaving, OR TRANSITING the country. By carefully inserting the words "by the National Security Agency" into the FISA legislation, the NSA has skillfully excluded from the coverage of the FISA statute as well as the surveillance court all interceptions received from the British GCHQ or any other non-NSA source. Thus it is possible for GCHQ to monitor the necessary domestic circuits and pass them on to the NSA through the UKUSA Agreement, giving them impunity to target and watch-list Americans. P475-477: Like an ever-widening sinkhole, the NSA's surveillance technology will continue to expand, quietly pulling in more and more communications and gradually eliminating more and more privacy. If there are defenses to such technotyranny, it would appear, at least from past experience, that they will not come from Congress. Rather, they will most likely come from academe and industry in the form of secure cryptographic applications to private and commercial telecommunications equipment. The same technology that is used against free speech can be used to protect it, for without protection the future may be grim. Senator Frank Church, chairman of the Senate Intelligence committee, referring to the NSA's SIGINT technology, ciirca 1975: At the same time, that capability at any time could be turned around on the American people and no American would have any privacy left, such is the capability to monitor everything: telephone conversations, telegrams, it doesn't matter. There would be no place to hide. If the government ever became a tyranny, if a dictator ever took charge in this country, the technological capacity that the intelligence commun- ity has given the government could enable it to impose total tyranny, and there would be no way to fight back, because the most careful effort to combine together in resistance to the government, no matter how privately it was done, is within the reach of the government to know. Such is the capability of this technology... I don't want to see this country ever go across the bridge. I know the capacity that is there to make tyranny total in America, and we must see to it that this agency and all agencies that possess this technology operate within the law and under proper supervision, so that we never cross over that abyss. That is the abyss from which there is no return. * * * * * * * * * * *** *** *** *** *** *** *** *** *** *** * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * "Data Show Federal Agents Seldom Employ Surveillance Authority Against * Terrorists", By Stephen Labaton, The New York Times, 5/1/95 * * An item in President Clinton's five-year, $1.5 billion plan to combat * terrorist acts: * * o It would ease restrictions on the use in American courts of * information from surveillance conducted by foreign governments. # "Moynihan Says U.S. Killed His Anti-Spy Measure" # By Irvin Molotsky, The New York Times, September 11, 1985 # # Senator Daniel Patrick Moynihan charged that the CIA and State Department # had killed a measure he had introduced aimed at protecting American # citizens from having their telephone conversations intercepted by foreign # agents in this country. # # The Senator's bill would have made telephone call interception by foreign # agents illegal and would have provided for their expulsion. # # The Chairman of the Select Committee on Intelligence opposed the measure # as unnecessary and could lead to disclosing "sensitive intelligence # sources." British wiretappers at the helm of the NSA's domestic spy-fest. ---guy http://www.newsguy.com/~mayday/crypto/crypto0.html

1 0

Re: KRAP is at it in the IETF
by Information Security 18 Dec '03

18 Dec '03

A reply already. ---guy > From rgm(a)icsa.net Mon Sep 7 09:32:47 1998 > Received: from homebase.htt-consult.com (homebase.htt-consult.com [208.235.169.130]) > by mail2.panix.com (8.8.8/8.8.8/PanixM1.3) with ESMTP id JAA04870 > for <guy(a)panix.com>; Mon, 7 Sep 1998 09:32:45 -0400 (EDT) > Received: from rgm ([208.235.169.131]) by homebase.htt-consult.com > (Netscape Mail Server v2.02) with SMTP id AAA340 > for <guy(a)panix.com>; Mon, 7 Sep 1998 09:32:50 -0400 > Message-Id: <3.0.5.32.19980907092146.00a108c0(a)homebase.htt-consult.com> > X-Sender: rgm-icsa(a)homebase.htt-consult.com > X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32) > Date: Mon, 07 Sep 1998 09:21:46 -0400 > To: Information Security <guy(a)panix.com> > From: Robert Moskowitz <rgm(a)icsa.net> > Subject: Re: KRAP is at it in the IETF > In-Reply-To: <199809071253.IAA01912(a)panix7.panix.com> > Mime-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > Status: R > > Note that this is an individual submission. It is not the product of any > IETF workgroup. Anyone can submit an Internet Draft. The IETF maintains > an open process. However, the IESG has to approve all IDs before they can > become RFCs. There will be a period of last call on this draft on the IETF > list where appropriate comments will be taken. > > > Robert Moskowitz > International Computer Security Association > (248) 968-9809 > Fax: (248) 968-2824 > rgm(a)icsa.net >

1 0

Re: any relation?
by Information Security 18 Dec '03

18 Dec '03

> From: Steve Mynott <stevem(a)tightrope.demon.co.uk> > X-Echelon: no-archive Heh. > > http://www.kiva.net/~tmay/ No, Cypherpunk Tim May's picture was shown in Wired... But now he's gonna hafta get a gun at least that big, or suffer major penis envy. ---guy ;-)

1 0

You Can Now Have A Free Cellular Phone!
by noldcosts＠usa.net 18 Dec '03

18 Dec '03

When you enter our fantastic lead program (only $99 plus $35 setup fee onetime) and complete a 2 x 2 forced matrix you will recieve $100 plus as a bonus a Nokia 6160 digital cellular phone with 600 minutes of service on the #1 cellular carrier in the United States (THIS OFFER IS GOOD IN ALL 50 STATES OF THE UNITED STATES OF AMERICA) When all 6 sales within your matrix have been completed, you will earn $400 in commissions, ($200 will be deducted for a re-entry purchase of 300 phone leads) and start over again in the highest available position of your sponsor's current matrix. Bonuses include a FREE Nokia 6160 digital PCS phone with your first check, and 600 minutes of FREE airtime utilizing the AT&T wireless network ($100 additional deducted from 1st check). Thereafter, with every check, you will qualify to receive an additional 600 minutes of airtime. ALL COMMISSION CHECKS ARE CALCULATED DAILY AND SENT WEEKLY VIA OVERNIGHT DELIVERY! DOUBLE MATCHING BONUS! On every cycle after the 1st, you will be in position to qualify for a double matching bonus on all your personally sponsored, and their personally sponsored, as they complete their second and third and so on, cycles. This will provide an extra incentive for you to work beyond your current 2 x 2 matrix. FAST FACTS ON THE NOKIA PHONE AND THE AT&T ONE RATE PLAN. ***** The phone: Nokia 6160 Dual Band phone that works in both analog (cellular) and digital areas. Features include slim design (6oz.) and a minute minder to keep track of your minutes used. Free battery and charger included. For more information hit REPLY and type _________ in the subject box

1 0

Re: Cypherpunks HyperArchive
by Ryan Lackey 18 Dec '03

18 Dec '03

> There is another archive at http://sof.mit.edu/cypherpunks, ironically > the machine that hosts it is not up at the moment The machine suffered either disk controller or HDD problems as I was logged into it. It is located in Boston, MA. I do not currently have a way of getting to the machine to repair it, and this will likely continue to be true, so until I can get one of the people I know at the site where the machine is located to fix it, the archives will be offline. If the machine cannot be fixed, I will put the archive up elsewhere. I believe hugh(a)toad.com copied the entire archive at some point, so that might be helpful. Sorry about this -- replicated servers are always a good idea. -- Ryan Lackey rdl(a)mit.edu http://sof.mit.edu/rdl/

10 11

Re: Cypherpunks HyperArchive (fwd)
by Jim Choate 18 Dec '03

18 Dec '03

Forwarded message: > Subject: Re: Cypherpunks HyperArchive > From: Ryan Lackey <rdl(a)MIT.EDU> > Date: 07 Sep 1998 11:41:54 -0400 > The machine suffered either disk controller or HDD problems as I was > logged into it. It is located in Boston, MA. I do not currently have The L0pht folks are there and Wel Pond used to be a subscriber. Perhaps you could contact them and they could provide the support? ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Archives? What archives?
by Ryan Lackey 18 Dec '03

18 Dec '03

Tim May <tcmay(a)got.net> writes: > > At 1:44 AM -0700 9/4/98, Sparkes, Ian, ZFRD AC wrote: > > >---- Facetious comment begin ----- > >At least now we know why people aren't following Tim's > >advice to 'check the archives' before putting their feet in > >their mouths. > >---- Facetious comment end ----- > > Try http://www.inet-one.com/cypherpunks/ > > If the archives at some sites are going down, this could be for various > reasons. > > Being an assembly of mostly-anarchist-leaning folks, with no leadership, no > organization, no hierarchy, and no procedures, there are no officially > maintained archives. > > What we have are what people choose to put up. > > Someone was talking in the last half year about burning a CD-ROM with a big > chunk of the archives on it. I haven't heard if this ever happened and if > it was made available for sale. (It seems that about every year someone > launches a project to generate such a CD-ROM, but I haven't seen the > followthrough.) > > --Tim May I had an archive on sof.mit.edu, but shortly after I left Boston, MA, US where the machine is located, the HDD on the machine (or the controller) died, and I'm still trying to get one of my former housemates to repair it. I'm currently in the wrong country to fix the drive, and don't expect to be back. I prepared the CD-ROMs for sale (I had a CD-R on the machine), and posted several times offering to sell them, but no one ever actually sent me the money. Actually, a small number of people did, and I sold them, but I don't remember who they were. I also don't have particularly good backups of that machine. I think someone mirrored it at toad.com before it died, so they're probably not lost forever. I don't have a machine with free bandwidth from which to host it, though, until sof.mit.edu is back on the net. I may be sending the HDD out to a drive recovery company anyway for the other data on the drive. This was an amateurish hobby server of mine, and not a production-grade service, so people shouldn't complain too much that I didn't invest the money in quality replication. -- Ryan Lackey rdl(a)mit.edu http://sof.mit.edu/rdl/

2 1

Re: e$: crypto-expatriatism
by Kawika Daguio 18 Dec '03

18 Dec '03

Bob, The syllogism at the end of your post is exactly why I have spent the last more than 5 years negotiating and lobbying and why we (FI's) and you (everyone else) shouldn't worry about the impact of government policy on the security of financial communications. Market (macro and microeconomics plays a bigger role than the government. I wouldn't give up my citizenship, neither would I join those guys at the Fort and give up my rights to move about the world without asking permission to travel or publish. I like the balance where I am, but respect those who wish to protest peacefully. I would prefer that folks kept us out of their fields of fire in the various skirmishes occuring during the cryptocrusades and left us to manage the policy for and the security of our space for ourselves and our customers. just my personal views...kawika... <<< Robert Hettinga <rah(a)shipwright.com> 9/ 7 5:29p >>> -----BEGIN PGP SIGNED MESSAGE----- At 3:38 PM -0400 on 9/7/98, Robert Hettinga wrote about Ryan Lackey's whereabouts, on cypherpunks: > If I told you, I would have to kill you? Whew. Glad Ryan has now said something publically now about his and Ian's bit of extraterritorial subtrifuge (though Ian doesn't qualify, of course). I mean, I just *hate* keeping secrets... ;-). Frankly, I *really* have a hard time with all this man-without-a-first-world-country, crypto-expat stuff. I think making the technology not eonomically optional is the way to change things, and no amount of romantic, jurisdiction-shopping "regulatory arbitrage" is going to alter reality all that much. But, I guess, Anguilla's as nice a place to have this affliction as any I can think of. And, I wish Vince -- and now, apparently, Ryan -- good luck, whatever happens. Yet, for some reason, memories of Vietnam-era draft-dodgers keep coming to mind. For what it cost them all personally, not much good came of it, I'd say, for them or anyone else. The people who protested the war and "fought the good fight" to end it stayed here to do it, after all. The most potent anti-war activists were Vietnam vets themselves, for that matter. And, of course, Ridgeway told Eisenhower at the outset that Vietnam was a multi-million-man war, and Eisenhower stayed out accordingly, throwing a few marginal people on the ground to shut Lodge up. It took Testosterone Jack to get a Special-Forces hard-on. Eventually he and Desktop Lyndon ended up screwing a pooch instead of the commies. Do people out there really think somebody like Gore's going to do a crypto-amnesty someday? I didn't think so. Ashcroft, maybe, but don't hold your breath, there, either. It'll be decades, I bet, and our "boys over there" will have grey hair long before they do come back home on this one. Political inertia is probably going to keep a few people we know outside the fence, looking in, for an awful long time after the issue's utterly dead. I expect people who do this crypto-expat stuff are going to get their new passports refused at the U.S. border when they visit, and I think that things are going to get worse for them for a long time before they get better. Of course, there's a fair argument to be made that if they do get refused, it's probably time to leave, anyway, but I'll let someone else gnaw that bone. And, frankly, I *do* expect that the FBI will attempt domestic crypto controls, just like they've been been trying to do for some time now. But, unlike a lot of people, I think that the marketplace will steamroller all such silliness into yet another roadtop attraction, before or after its legislation. Anyway, as the old "excrable" e$yllogism goes, Digital commerce is financial cryptography. Financial cryptography is strong cryptography. Therefore, if there's no strong cryptography, there's no digital commerce. So, call me an optimist. Like I've said before, I've heard the end of life and liberty as we know it predicted over and over again -- hell, I've even believed so myself, once or twice -- but, like the Gibbon quote in my .sig goes, "however it may deserve respect for its usefulness and antiquity", I ain't seen it happen yet. Cheers, Bob Hettinga -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.5.5 iQEVAwUBNfRQJMUCGwxmWcHhAQHb7gf ImnoGG28coDgde4cDgnwHyQatO78nY4B 9bMfB9bE1FCqAIZNKfrPzqhJpZzCbYEDYQexXe8bRsl32M7FnIye7w4r7kxeXxns LbLWY83juOAJNgMhPxPhFVcXb8NqwOQzCnYjLdfKSuJ6/lZuNGvsVohHwYuhNxc9 WlOW1WsqeSl3KyzpdDyZU1jAUvNEJQU9JoeeEvlwFNM7zMW3ZoIQB5SSVLf2HYzX vtpnZiRsOeSXt0sWmlXHiZ DeB 79z1z157cg/AOn/qAGBLBgZuDp dbRH7B4ynR ngB6XS irSzNnMWQrVdNYPuRPRRQ h/eV US2Cmjc3uuFcnR/ tnNg== =0UKh -----END PGP SIGNATURE----- ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help".

3 2