December 2003 - cypherpunks-legacy

Australian "Walsh" report exposes the hole in key escrow
by John Gilmore 17 Dec '03

17 Dec '03

This report was finally obtained (after suing the Australian government under Freedom of Information laws) by Electronic Frontiers Australia. I haven't seen it yet; this is the first I'd heard that it is released. The first paragraph does its best to scare people, but the gist is all correct: if you escrow authentication keys, digital signatures don't work. If you don't escrow authentication keys, then key escrow doesn't work. John Gilmore Forwarded-by: Hal Abelson (I don't know the original source). By John Davidson Governments will be forced to completely undermine the emerging global electronic commerce system if they want to prevent it being used by criminals and for tax evasion, one of Australia's leading data security experts has warned. Professor William Caelli, head of the school of data communications at Queensland University of Technology, said yesterday that it was all but technically impossible to satisfy the competing needs of law enforcement and international trade. The difficulty was in allowing encrypted data passing along the Internet to be monitored by law enforcement agencies, while at the same time giving legal status to the digital signatures that will underpin electronic trade. A suppressed government report into encryption, written by a former deputy director-general of ASIO, Mr Gerard Walsh, has agreed with Professor Caelli. The Commonwealth should abandon as "doomed to failure" attempts to control encryption by keeping a copy of the passwords, or keys, in escrow, Mr Walsh told The Australian Financial Review yesterday. The field of cryptography is generally divided into encryption, where data is scrambled for confidentiality; and authentication, where an electronic document is scrambled or signed to prove who it came from for legal purposes. Policy under consideration in Australia, the US and the UK calls for a separation of the two key types, with law-enforcement agencies having some sort of access to all encryption keys while individual's authentication keys are kept strictly private. It is widely accepted that escrowing authentication keys would render them legally useless for signing documents. "If you ever allow people to get near authentication keys you'll corrupt the administration of justice," said Mr Walsh. The problem facing governments, according to Professor Caelli, is that it is technically impossible to separate the two key types, since they are both just very long numbers. The thinking with the most currency, known as "key tagging", involves adding extra data to the start or end of a digital key to identify what it would be used for. But key tagging can't work in a PC environment, Professor Caelli claims. PC operating systems don't have enough security to prevent users from simply taking the tag off an authentication key and adding it to an encryption key, thereby bypassing government attempts to escrow all encryption keys. If, as it was likely, a dual-key infrastructure proved impossible in a PC world, governments would either have to escrow all keys, rendering digital certification meaningless, or escrow no keys at all, rendering data surveillance totally ineffectual, he said. Mr Steve Orlowski, a leading Government expert on cryptography, acknowledged that it was now impossible to build a secure dual-key infrastructure, but said that it was "possible that someone could make a breakthrough". "We're encouraging research into that area so we'll be able to make the distinction," he said. The US National Institute of Standards and Technology recently made a worldwide plea for cryptography algorithms that can be used for authentication and not for encryption. Mr Walsh's report, commissioned by the federal government to look into how it must legislate to satisfy security and privacy needs in the face of strong cryptography, has only now come to light following a successful Freedom of Information action by Electronic Frontiers Australia. The 96 page report, Review of policy relating to encryption technologies, was due to be published in October last year, and called for a period of public discussion about cryptography issues. However, it was never released, and was only made available to the EFA this week with 20 paragraphs deleted. A second report prepared at the same time but with specific recommendations is still secret, however. According to Mr Walsh, trying to put the lid on encryption with key escrow would be "an exercise in futility" because it would miss the very target it was intended to catch: organised crime, money laundering operations and terrorists. These groups would either refuse to escrow their keys, or simply embed a further level of encryption in their messages, he said. He also said in the report that it would also be futile to try to regulate the length of crypto keys on a nation-by-nation basis because "the notion of fixed national borders is simply anachronistic" thanks to the Internet. "It's not in the interests of the community's rights to privacy, nor the needs of the business community, to . . . limit the strength of cryptography simply to catch the occasional minnow," he said. Law enforcement considerations should not automatically leapfrog privacy considerations, and the government would have to mount a "damned strong argument" every time it wanted to access someone's encryption keys, he said. Mr Walsh said he was uncertain why his report had been suppressed, given that anything that might have been controversial was restricted to the secret report he also submitted. "I wrote (the first report) in the clear expectation that it would be publicly released," he said.

1 0

Fourth of July Special
by ctn＠idp.net 17 Dec '03

17 Dec '03

Fourth of July Special!!!!!! Call 1-800-767-0160 to order. Brand New Hewlett Packard Toner Cartridges at Wholesale Prices!!! Part # Printer Type Price 92298A EP-E Series 4, 4M, 4+, 4, 5N, 5M $89.00 92295A EP-S Series II, III $69.00 92275A EP-L Series IIP, IIIP $76.00 92274A EP-P Series 4L/4P $65.00 92291A EP-N Series IIISi/4Si $99.00 C3900A EP-B Series 4V/4MV $125.00 C3903A EP-V Series 5P, 5MP, 6P, 6MP $76.00 C3906A EP-A Series 5L $59.00 C3909A EP-W Series 5Si, 5SiMX, Mopier $145.00 FX-1 Canon Fax L700 Series $81.00 FX-2 Canon Fax 5000/5500 $71.00 FX-3 Canon Fax L4000 $71.00 51626A InkJet DeskJet, DeskJet+, 500C/ 500J/505J/520/540/550C 560C/700 $27.95 Order 10 or more cartridges and receive free shipping!!!!! Ask about our other specials on Brand New Laser and InkJet Cartridges for your Printers, Faxes and Copiers. Save up to 35% by using our 100% Guaranteed Remanufactured Cartridges To Order: via email: ctn(a)idp.net via FAX: 703-449-7904; 703-449-7905; 703-449-7906; 703-803-9887 Toll Free: 1-800-767-0160 snail mail: Cartridge Technology Network, Inc. 14110 Sullyfield Circle Chantilly, Virginia 22046 FAX ORDER FORM Name________________________________________________________________________ Company Name________________________________________________________________ Address______________________________________________________________________ City/State/Zip_________________________________________________________________ Phone____________________________________FAX________________________________ EMAIL_______________________________________________________________________ Part #______________ Quantity __________ Part #______________ Quantity __________ Part # _____________ Quantity __________ Part # _____________ Quantity __________ Credit Card #:______________________________________________ Exp._______________ Signature:____________________________________________________________________ VISA/MC/Discover/American Express Accepted Corporate Purchase Orders Accepted, please call 1-800-767-0160. IF YOU DO NOT WISH TO RECEIVE FUTURE EMAIL, PLEASE REPLY TO 'ctn(a)idp.net' AND PLEASE PLACE 'REMOVE' IN THE SUBJECT AREA.

1 0

Computer
by 05643693＠prodigy.net 17 Dec '03

17 Dec '03

PLEASE READ THIS IF YOU WOULD LIKE TO EARN EXTRA CASH USING YOUR COMPUTER!!! (Now in Mac format, too!) If you have even a basic knowledge of computers, you could be making money in your spare time. There are many opportunities including: contract typing; data entry; advertising on your own Web page; and even testing new games. Send for the packet, "Home Computer Income" which contains all the information you need to get started. Included is a listing of several companies that offer this type of work. Order today, all you need is a few hours a week to create an excellent second source of income! -Please print (or write out) this order form and mail to- ------------------------------------------------------------------------------ M.E.C. P.O. Box 2188 La Mesa, CA 91943-2188 [ ] Yes, I would like to get started. Please rush me the information. Enclosed is $14.95 (plus $2.00 for shipping and handling, $16.95 total.) If I am not completely satisfied, I have 30 days to return the packet for a full refund (less S+H). Please allow 5-7 business days for checks to clear. Name/E-Mail Address___________________________________ Address_______________________________________________ City,State,Zip__________________________________________ [] Send packet to my e-mail address (omit S&H.) [] Send packet on 3.5" / 5.25" / Mac disk. (circle one.) (disc is compatible with all word processors.) -----------------------------------------------------------------------------------

1 0

Re: details of 6/26 action on HR 695??
by John Young 17 Dec '03

17 Dec '03

geeman(a)best.com wrote: >Are these the same amendments from before, or new ones? The H.R.695 amendments referred to in the Congressional Record appear to be the same ones described in House Report 105-108: http://jya.com/hr105-108.txt If there are others they have not yet been published. ---------- >Congressional Record: June 26, 1997 (House)] >[Page H4834] >From the Congressional Record Online via GPO Access [wais.access.gpo.gov] >[DOCID:cr26jn97-74] > > > REPORTED BILL SEQUENTIALLY REFERRED > > Under clause 5 of rule X, the following action was taken by the >Speaker: > > H.R. 695. A bill to amend title 18, United States Code, to > affirm the rights of U.S. persons to use and sell encryption > and to relax export controls on encryption; with an > amendment; referred to the Committees on Commerce, National > Security, and the Permanent Select Committee on intelligence > for a period ending not later than September 5, 1997, for > consideration of such provisions of the bill and amendment > reported by the Committee on the Judiciary as fall within the > jurisdiction of those committees pursuant to clause 1(e) and > (k), rule X and rule XLVIII, respectively. >

1 0

Re: Hettinga's e$yllogism
by Robert Hettinga 17 Dec '03

17 Dec '03

At 2:13 pm -0400 on 6/28/97, Tim May wrote: Kent (With a Brick, Mr.) Chrispin emetted: > >Governments have devalued currencies many many times in the past > >without the need of key escrow...key escrow is an independent issue. > > Sure, but one of the potential advantages of strong crypto is the > oft-discussed "denationalization of money." Leading bankers are beginning > to see the light on this. I wonder if Mr. Chrispin has ever heard of George Soros, or does the adventures of St. George and the BofE dragon smack too much of, horrors, capitalism? (Modulo Soros' ocassional self-flagellatory Atlantic article, of course. Knight-errants are all into that mortifying the flesh stuff. Or, maybe he's just trying to hedge his bets or something...) Anyway, on the same note, and, as a result of the Wired article this month on FC97 (I finally saw it, and it's not as bad as I thought it was going to be. I guess as long as they spell my name right...), I just got request for an interview from a staff writer from Forbes. He's writing on this very thing, the macroeconomic effect of transanational digital cash. His very words to me were: > An editor of mine liked the story so much he told > me to expand it (a.k.a. totally rewrite it) looking at whether or not a > boom in the use of electronic money might not render governmental > monetary control irrelevant as well. Looking at the issue from that > angle is convincing me that the answer is yes, and that the real story > here is about crypto. He's going to interview me on Tuesday, after the DCSB meeting. God help us all. :-). When I replied to him, I gave him the whole nine yards, poor guy. Hope I didn't scare him off: financial cryptography, the ubiquitous geodesic economy, cryptomoney, etc. (Including, of course, the, um, "excrable" e$yllogism. ;-)) I also gave him a whole passle of people to talk to about it, including David Friedman, who reported on another list lately that he's brought father Milton around to believing in the inefficiency of central banking compared to free banking, particularly in a world of ubiquitous internetworks and financial cryptography. I also sent him on to Tatsuo Tanaka, who did a presentation about a year ago at DCSB on, you guessed it, the transnationality of digital cash. :-). (Of course, Tatsuo's thinking then was that some global run or another on free$banks would end in the creation of a central bank of cypherspace, but, maybe, he's *much* better now. :-)) I didn't include you on that list, Tim, because I remember you saying something about not being bothered with such reporter.cruft anymore, and how coupling financial cryptography with strong cryptography in the eyes of the press and the financial establishment didn't make any sense, but, in case you want him to misquote us *both* and scare all those capitalist tools out there half to death, let me know and I'll send him your way. Or, maybe such glad tidings will make them all want to help us dance a jig on the eventual grave of the nation-state, you never know. The rich and hoity-toity are very different from you and me. Well, *me*, anyway... (Did I ever tell you the story about how my old man built a sailboat on St. Thomas without ever having really sailed much, and, the boat was so fast that it won *lots* of silver, so much silver that he made the New York Post (I think) about it, and, having read that article, Malcom Forbes came down to the islands that fall, and invited Pop to hang out with him on Highlander for a few days? No? Well, my old man built a sailboat on St. Thomas, you see,...) <Tune: "America the beautiful"> "My country tis of thee, land of plutography..." </T> Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Government at Work (prudish idiocy)
by Immoral Majority 17 Dec '03

17 Dec '03

from Wired News: Oklahoma-am-Rhein: Police Seize Oscar Winner 12:05 pm Oklahoma City police seized copies of The Tin Drum, the 1979 Academy Award winner for best foreign film, after a judge ruled the film obscene under Oklahoma law. On Thursday, police began removing the movie from video stores and, using store records, tracking down those who possessed rented copies. Oklahoma District Judge Richard Freeman acted on a complaint by Oklahomans for Children and Families, which was upset by a scene in which a young boy has oral sex with a teenage girl.

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash middle latent cut ek"; $remailer{"winsock"} = "<winsock(a)rigel.cyberpass.net> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp pgponly hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"reno"} = "<middleman(a)cyberpass.net> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{"wazoo"} = "<remailer(a)wazoo.com> cpunk mix pgp hash latent cut ek"; $remailer{"shaman"} = "<remailer(a)lycaeum.org> cpunk pgp hash latent cut ek"; $remailer{"hidden"} = "<remailer(a)hidden.net> cpunk pgp hash latent cut"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. There is no remailer at relay.com. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The alpha and nymrod nymservers are down due to abuse. However, you can use the nym or weasel (newnym style) nymservers. The cyber nymserver is quite reliable for outgoing mail (which is what's measured here), but is exhibiting serious reliability problems for incoming mail. The squirrel and winsock remailers accept PGP encrypted mail only. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. This seems to be fixed now. The penet remailer is closed. Last update: Mon 30 Jun 97 6:45:39 PDT remailer email address history latency uptime ----------------------------------------------------------------------- weasel config(a)weasel.owl.de ++++++++++-+ 1:32:04 99.98% squirrel mix(a)squirrel.owl.de ++++++++++-+ 1:30:31 99.98% jam remailer(a)cypherpunks.ca ****+*+**+* 15:41 99.89% replay remailer(a)replay.com ****** +**+* 6:12 99.83% reno middleman(a)cyberpass.net ++++ -.--+.- 5:33:46 99.72% cyber alias(a)alias.cyberpass.net ******* **+* 13:41 99.37% mix mixmaster(a)remail.obscura.com -.- ---.-*.- 7:57:51 99.03% winsock winsock(a)rigel.cyberpass.net -------- - 7:15:22 97.91% nym config(a)nym.alias.net ***###++##+# 4:58 97.29% hidden remailer(a)hidden.net ###### 4:44:03 40.46% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: Dr. Dobbs Cryptography and Security CD-ROM
by Alex de Joode 17 Dec '03

17 Dec '03

Peter Gutmann sez: [..] : What makes this case especially awkward is the fact that the CDROM can't : legally be sold outside the US, which means the only way the rest of the world : can get it is through illegal copies. Given the immense usefulness of : something like this, I'd say it's only a matter of time before bootleg copies : start appearing outside the US, but because of the USG's position we can't pay : for it even if we want to (DDJ wouldn't look too good if they accepted payment : for what they knew was illegally exported crypto). Perhaps a donation of the : same amount to charity would serve as some equivalent to payment... It would be nice to see a Dr. Dobbs CD at the HIP ... -- -aj-

1 0

Fwd: TSS OfficeLock: Protect Office documents w/PGP (fwd) mslock20.zip - TSS OfficeLock: Protect Office documents w/PGP
by Ray Arachelian 17 Dec '03

17 Dec '03

I have uploaded to Simtel.Net: http://www.simtel.net/pub/simtelnet/win95/util/mslock20.zip ftp://ftp.simtel.net/pub/simtelnet/win95/util/mslock20.zip 459405 bytes mslock20.zip TSS OfficeLock: Protect Office documents w/PGP TSS OfficeLock v2.0 is a data security plug-in for Microsoft Office 95 & 97. It protects files on desktop or laptop PCs, on networks, and over the Internet. OfficeLock automatically decrypts files when opened and encrypts them again when they're closed. Prevent intruders from opening or changing your secured Word, Excel, Access, and Powerpoint files. Uses the unbreakable PGP data encryption engine. 32 Bit software for Win 95 & Office 95 / 97. Special requirements: None. Shareware. Uploaded on behalf of the author by Shareware.COM. Author information: Dan Goodman Total System Solutions dan(a)officelock.com http://www.officelock.com

1 0

Re: Government at Work (prudish idiocy)
by geeman＠best.com 17 Dec '03

17 Dec '03

At 07:29 AM 6/30/97 -0500, you wrote: > >from Wired News: > >Oklahoma-am-Rhein: Police Seize Oscar Winner >12:05 pm > >Oklahoma City police seized copies of >The Tin Drum, the 1979 Academy Award winner >for best foreign film, after a judge ruled the film >obscene under Oklahoma law. On Thursday, >police began removing the movie from video stores >and, using store records, tracking down those who >possessed rented copies. ..../\ last I heard, this was illegal without a warrant. Of course, in the pursuit of Justice and the Law I suppose the warrant was easily obtained. OR was is obtained at all? Oklahoma District >Judge Richard Freeman acted on a complaint by >Oklahomans for Children and Families, which was >upset by a scene in which a young boy has oral >sex with a teenage girl. > > >

1 0