December 2003 - cypherpunks-legacy

Re: Commerce Undersecretary William Reinsch defends the governments encryption policy
by Ernest Hua 17 Dec '03

17 Dec '03

> We want to work through the market. What that means is, if the market > turns in unexpected directions, we have to be ready to re-evaluate our > policy. So I don't think you're going to see a "final" version > ever. As long as the market moves and changes, our policy will be > tweaked to accommodate what's happening. In other words ... If we don't approve, it's time to go back to ITAR and 40-bits. > I don't think they're doing it just because the government asked them > to; they're doing it because they see a market. In addition, in the > spring the FBI and the Justice Department asked companies to come in > to see if a technical solution could be found to deal with these > issues. Companies have done that, too. It must be nice to be able to pressure and threaten companies behind the scenes and then come out to the public to say that they are "cooperating" or "volunteering". > At the same time, of all the economic sectors in the country, this > one's moving the fastest. There's a real danger that, if we can't get > our policy together and out there in the marketplace soon, we could be > overtaken by events overseas. In other words, "all this time we've been denying that there was overseas competition, well, we were lying through our teeth." "And that thing with the EU complaining about Echelon and the Germans trying to head up the Europeans to bust ITAR/EAR ..." Oops! Can't say the "E" word in public because "nobody" knows about that! > I think you have to contrast that situation, which was reasonably > artificial, with the reality of law enforcement. In this case, it took > a decent amount of resources to crack a specific message that, I > believe, the people doing the crack knew was in English, and knew was > one message. Must be nice not having real technologists pointing out blatant flaws/lies in your public statments. > Now, if you're the FBI, think about that. From their standpoint, we're > talking about traffic that isn't so easily identifiable. It might be a > long stream of encrypted material that they're trying to intercept in > real time; they don't necessarily know what language it's in; they > don't necessarily know what Sure ... if the FBI were really stupid ... and the FBI didn't really want to do any homework, but instead, would rather have NSA's dictionaries do the walking ... encryption would be a real bitch, wouldn't it? Even 40-bit. Ern

1 0

FBI Affidavit on Ex-NSA Cryptanalyst
by John Young 17 Dec '03

17 Dec '03

We offer the FBI's 23-page affidavit of charges against David Sheldon Boone, ex-NSA cryptanalyst who allegedly passed top secret SIGINT, EW and nuclear targeting plans to the Soviets: http://jya.com/dsb100998.htm Tantalizing hints on means and methods, quoting the affidavit of the FBI agent in charge: On one occasion, "Igor" [Soviet agent] told BOONE that the KGB/SVRR had access to United States Signals Directive (USSID) Zero, which was an index of all other USSIDs, and from this index IGOR asked BOONE to obtain specific USSIDs. I have ascertained that USSIDs are classified NSA publications for use in providing Signals Intelligence (SIGINT) support to the United States military. BOONE told the OA [FBI Operational Asset posing as Soviet agent to set up Boone] that he had given "Igor" a photocopy of an NSA document entitled "United States Signals Intelligence Directive (USSID) 514," dated May 6, 1988. BOONE told the OA that this USSID was unusual because it was one of few USSIDs to be classified TOP SECRET rather than SECRET. BOONE told the OA that USSID 514 was not widely disseminated but that one copy had been at USAFS Augsburg. And more on Boone's training and duties in cryptanalysis at Fort Meade and in Germany. Bad Ausburg is the location of one of the NSA intercept stations for the Echelon program is it not?

2 1

mail2fax remailer capability?
by Adam Back 17 Dec '03

17 Dec '03

I am noticing the odd free email2fax "your fax was sent successfully" report in the dud messages sent to (the non-replyable) nobody(a)remailer.ch. Warming to the heart that -- anonymous fax. Now I am wondering what the coverage is like on fax gateways -- it clearly only is going to work in places where there are free local calls, for numbers counting as local to the gateway. Just thinking it would be kind of nice if one could send a message To: +1.234.567.891-mail2fax(a)anon.lcs.mit.edu via mixmaster and have it sort out the delivery if possible to mail2fax gateways operating with local calls in that area code. (Analogously perhaps to the auto USENET posting from those remailers with this option turned on -- that is either direct (remailer posts) or indirect (forwarded to a mail2news gateway)). Has anyone come across any mail2fax site which tries to keep track of other free fax services and forward faxes to one in the right area? ('Course if we could get some damn working ecash, we could fax it anywhere -- sender pays:-) Next stage -- anonymous voice mail delivered via voice modem / soundcard, all via mixmaster, that would be nice! Adam

2 1

Re: Commerce Undersecretary William Reinsch defends the governments encryption policy
by Ernest Hua 17 Dec '03

17 Dec '03

Michael, Absolutely! But I still really am hoping in desperation that some people in the main stream press would get a clue that this is all double speak, and that they are simply playing a game to buy time for their old system, and buy political wins for the next system. Heck, if I was in FBI/NSA's shoes, and this was the slimy game I see everyday in D.C., it would be the same game I play to get what I need. And I would be very irresponsible if I did not play the game, however slimy it is. The problem is that it seems like most of the public take speeches like the speakers are pretty much honest, when in fact, most of the time, they are playing spin control. I have no doubt the FBI/NSA are in trouble. Echelon (or whatever they call it) is in trouble. They are irresponsible if they did not fight to the end to preserve some of their multi-billion $$$ investment, but they are in dire straits if they are hoping for a second generation centralized scanning intelligence machinery like Echelon. My belief is that they have to gather automated intelligence from far more disparate and heterogenous (and possibly conflicting) sources in the near future, and find ways to make sense out of all of the data. But I think the intelligent observer would see that they have no choice because this technology .. I hate that word because people call some of the most simple and dumb stuff "technology" in order to make money from it .. this technology is impossible to control, which means that precisely the most important target worth going after will have plenty of resources to foil Echelon, but the people made most vulnerable (because of the regulations) are the common folks. THAT is what is pissing me off. If they have some effective way to regulate underground trade of encryption, then they would have a story to tell. However, the fact that most encryption get out of this country so darn fast (we're counting minutes now ...) means they are not even trying. Prosecuting that guy in San Jose is just nuts. Since when does prosecuting a legitimate business man will actually stop people, who firmly believing that they have some natural right to distribute encryption? And I must emphasize that my opinion has NOTHING to do with whether encryption SHOULD, from a social/political/legal view, be exportable or not. Ern

1 0

ATTENTION HOMEOWNER***FREE SERVICE***FREE SOFTWARE
by lewisantonio＠usa.net 17 Dec '03

17 Dec '03

ATTENTION HOMEOWNER***FREE SERVICE***FREE SOFTWARE Save Thousands of $$$$$ off your Mortgage without Refinancing! Cut years off your Mortgage without Increasing your Payments! Build Equity in your Home 300% Faster! Email: mailto:lewisantonio@usa.net For Instant Info. Visit: http://www.freeyellow.com/members/scrap64/page5.html

1 0

wtf...
by Secret Squirrel 17 Dec '03

17 Dec '03

Has this list server died or is it just me? it seems like the list has died or is it just slowly fading into oblivion? It seems as though the only people still posting come from some great spam factory in left field. Have all of the questions been answered? Is everyone happy with the encryption they have? Doesn't anyone have any new thoughts on export restrictions, hash implementations, or the like? I know that I'm still out here, is anyone else? Does this ring a bell? People must come and together deploy these systems for the common good. Privacy only extends so far as the cooperation of one's fellows in society. We the Cypherpunks seek your questions and your concerns and hope we may engage you so that we do not deceive ourselves. We will not, however, be moved out of our course because some may disagree with our goals. Who else is out there?

1 0

mail2fax remailer capability? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 15 Oct 1998 20:14:40 +0100 > From: Adam Back <aba(a)dcs.ex.ac.uk> > Subject: mail2fax remailer capability? > Has anyone come across any mail2fax site which tries to keep track of > other free fax services and forward faxes to one in the right area? It wouldn't surprise me any to find that Kinko's and other such chain print shops couldn't do that sort of thing. Now if they'd do it over the web.... > ('Course if we could get some damn working ecash, we could fax it > anywhere -- sender pays:-) Open a laundromat, at least one person here in Austin has begun providing smart-card/no cash services. > Next stage -- anonymous voice mail delivered via voice modem / > soundcard, all via mixmaster, that would be nice! An anonymous remailer which drove a multi-format/media database would be pretty nifty. Might find more than a few niche markets to dabble in as well. In a sense you'd have your own little one machine data-haven. ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: wtf...
by Mohammed Lazhar 17 Dec '03

17 Dec '03

hey Guys : I just subscribed to the list. I will be posting stuff soon Mohammed

2 1

RE: FYI: More on WebTV security
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: Pablo Calamera <pablo(a)microsoft.com> To: "'dstoler(a)globalpac.com'" <dstoler(a)globalpac.com>, rah(a)shipwright.com, mac-crypto(a)vmeng.com Cc: jimg(a)mentat.com Subject: RE: FYI: More on WebTV security Date: Thu, 15 Oct 1998 17:19:11 -0700 comments inserted, extraneous text deleted. > -----Original Message----- > From: dstoler(a)globalpac.com [mailto:dstoler@globalpac.com] > Sent: Tuesday, October 13, 1998 5:39 AM > To: Pablo Calamera; rah(a)shipwright.com; mac-crypto(a)vmeng.com > Cc: jimg(a)mentat.com > Subject: Re: FYI: More on WebTV security > > [stuff deleted] > The press release implies that there is secure end-to-end > email between two WebTV customers. The wording is somewhat ambiguous though it does have more of a bent on the security of the transport layer. Perhaps it could have been clearer and specifically said that messages where encrypted during transport using 128 bit encryption. > Perhaps I am overly cynical, but I am guessing that they are > using SSL (TLS) from a web based email application on the > client to WebTV's servers. I presume email data is decrypted > at the servers, then re-encrypted to the recipient when she > uses the WebTV client to read email. Close. We could not even export SSL (TLS) with 128 encryption in this scenario. We have a proprietary transport protocol that we use that employs 128 bit RC4. > This approach would allow access to private email at the > servers by WebTV employees or law enforcement agencies. > > Note the careful use of the phrases "unauthorized party" and > "without posing undo risks to national security and law > enforcement" in the press release. > > I believe that WebTV's email security is directly coupled to > their ability to establish and enforce good security policy > within their operation and the trustworthiness of the > employees who have access to sensitive data. Partially true. We believe a major component of our security is indeed in the encrypted transport of your email from the service through the internet, through a leased POP to your box. Our Privacy Policy and Terms of Service are available for your viewing. http://webtv.net/home/privacy_text.html http://webtv.net/home/tos_text2.html This level of protection goes beyond email to registration, preferences/setup, "favorites" etc... Virtually all communications with the WebTV service. > I am concerned that carefully constructed wording of > Microsoft's press release implies stronger email security > than really exists. I hope I am wrong. We believe that with the level of encryption and the quality of our network operations that we have the best level of privacy protection for our users of any online service. I agree that the carefully worded press release may imply more than what we got. But we are very happy with this initial step. It has taken a very long time just to get export approval for this architecture and we look forward to further relaxation of export controls so we can compete on even footing with our foreign competitors. Pablo > David Stoler > > > Key paragraphs from Microsoft's press release: > > WebTV Networks has been granted the first export license to > use strong 128-bit encryption for any user and any > application in Japan and the United Kingdom. So, for example, > an e-mail message with personal information sent from a WebTV > subscriber in Japan to a second WebTV subscriber in Japan > will be sent securely because there is no known technology by > which an unauthorized party could intercept and decipher it. > > Therefore, as part of the WebTV Network, the WebTV-based > Internet terminal (starting at under $100) is now the most > secure communications device available from a U.S. company. > > "WebTV Networks' export approval is a significant step for > industry and reflects the U.S. government's commitment to > promoting e-commerce abroad," said William Reinsch, U.S. > undersecretary for export administration. "The WebTV Network > provides secure communications for its customers and partners > without posing undue risks to national security and law enforcement." > > > --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

wtf...
by Edwin E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Let's talk. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGP for Personal Privacy 5.0 mQGiBDPJm3oRBADUlbn8EX/UCyp3+lwiO8ZQLdG2QXQ8EdZ8+qOffbi5KKun3RVz 4XfU77cK+HWUeYfuVBZm1/8Uwbz/I1Z/FVUgDktMDvg4oeBnVBMBM8r4TPC8H73j 0B+XE6H5U8teixXljQpVsusTygI5R8LJ9Q9XNN9eWW1rxEYk2wG0I/3Z4wCg/+7N X6ayuKoJe8uVRro4USMVsycEAMiF1Kn1HevS2CaQn70xAYfk3/xGYjIj54hhlYQ+ zgvLuBMnfI3FoC875OyFhXUReIIn2HcdZKNcYrM1q33fgmMESZnjGr48qNe3rh4G FvhUHKkN6tOK/L8mCtbs6LAarjR2kE+nYmS2CcYeuhbfnj3O/wQqhsA8i4HCdsDK iHxXA/9aSIRFlB4ImAgDI6CywtCfMkQUdau0d2D+0p/XNtPf+r2kt8s6haeCgseB IQNETTC7PNf9ME0hpBGx2NdVsxsBvinASmkqJpE/yNUrSbzfmrkDf6OstfwtDeum NnF2E98KX+sHm9gCwTogSeXRQfwnZgIUEHgupNcTCm2hIF8JY7QjRWR3aW4gRS4g U21pdGggPGVkc21pdGhASW50TmV0Lm5ldD6JAEsEEBECAAsFAjPJm3oECwMBAgAK CRBJjX+m+ejwLU30AJ0chm6vMGZkSEk8R9Ci2YFbjqj8gACgtfRQLBfyEDLdQ5A6 O7U7VxpxDsGJAD8DBRA0geyVJnBGgNW85eURAnHAAJ9zOR8Z2uLjFdUfcTYfsDHg y7LdRACg3J/LLskk+f7psHBHUTIGlooTsyq5Ag0EM8mbexAIAPZCV7cIfwgXcqK6 1qlC8wXo+VMROU+28W65Szgg2gGnVqMU6Y9AVfPQB8bLQ6mUrfdMZIZJ+AyDvWXp F9Sh01D49Vlf3HZSTz09jdvOmeFXklnN/biudE/F/Ha8g8VHMGHOfMlm/xX5u/2R XscBqtNbno2gpXI61Brwv0YAWCvl9Ij9WE5J280gtJ3kkQc2azNsOA1FHQ98iLMc fFstjvbzySPAQ/ClWxiNjrtVjLhdONM0/XwXV0OjHRhs3jMhLLUq/zzhsSlAGBGN fISnCnLWhsQDGcgHKXrKlQzZlp+r0ApQmwJG0wg9ZqRdQZ+cfL2JSyIZJrqrol7D VekyCzsAAgIH/3SLvO37hk+J1SI6NgYjpivzyMD2E2acTVdpDWILSmlfVrTmoZ9b t+7jPj5cV5gAVD706Rv3h8Je1FsqtnqkV61z1ncx7cmU1gJTrecoLYBXbXbFk613 evI+u9EV1s3BGW4W4FsWp9ljQ1iR5Pb6TkTgeQ1SwI4uTCTkfYO1LvE/Boq1Nh7y 6ZoVBzrf8jvliHAsGw4sEQOtttfKr1SOPwweop6ZfEe4mLDHsNSSobKWU/Ql+JZD cr26Vm+C2tyBpAlYtuKj8WouLOUTa1bOo1LtClD1rgBmsao+8I1K1BfjiNlb+lS1 o8yxwoRjARKqGzrGoCB3x5mri6bHPdkQMWGJAD8DBRgzyZt7SY1/pvno8C0RAsdu AJ9mc0T8wq8viIy+uuFmG/6w1xiMhACg6h1fCtucX3tOAVLKIUgEmss7AJE= =U2JQ - -----END PGP PUBLIC KEY BLOCK----- At 11:27 PM 10/15/98 -0000, you wrote: >Has this list server died or is it just me? > >it seems like the list has died or is it just slowly fading into oblivion? It seems as though the only people still posting come from some great spam factory in left field. Have all of the questions been answered? Is everyone happy with the encryption they have? Doesn't anyone have any new thoughts on export restrictions, hash implementations, or the like? I know that I'm still out here, is anyone else? > >Does this ring a bell? >People must come and together deploy these systems for the common good. Privacy only extends so far as the cooperation of one's fellows in society. We the Cypherpunks seek your questions and your concerns and hope we may engage you so that we do not deceive ourselves. We will not, however, be moved out of our course because some may disagree with our goals. > >Who else is out there? > > -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQA/AwUBNiaSoEmNf6b56PAtEQKOhQCeJchkyv48Ksi+0L+YIKEpv21wHqQAoIwl cK9lvW97mHZmM0aDwzi/IC6l =fUQ7 -----END PGP SIGNATURE-----

1 0