December 2003 - cypherpunks-legacy

Kerrey bill introduced in Senate
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: gbroiles(a)mail.io.com (Unverified) Date: Tue, 17 Jun 1997 14:41:46 -0700 To: cypherpunks(a)cyberpass.net From: Greg Broiles <gbroiles(a)netbox.com> Subject: Kerrey bill introduced in Senate Mime-Version: 1.0 Sender: owner-cypherpunks(a)cyberpass.net Precedence: bulk Reply-To: Greg Broiles <gbroiles(a)netbox.com> X-Loop: cypherpunks(a)cyberpass.net Sen. Kerrey's evil "Secure Public Networks Act" was introduced in the Senate today, cosponsored by Sen. McCain. The bill, if passed, would: Criminalize the knowing use of crypto to encrypt data or communications in furtherance of a crime; (s. 104) Criminalize breaking another person's ciphertext for the purpose of violating their privacy, security, or property rights; (goodbye, Netscape bugs bounty and DES/RC4 cracks) (s. 105(3)) Criminalize intercepting another's intellectual property for the purpose of violating intellectual property rights (s. 105(4)) Criminalize issuing a key to another person in furtherance of a crime (s. 105(6)) Require federal government purchasers of crypto equipment to buy GAK crypto; (s. 202, 204) Require crypto products purchased with federal funds for use on a public network to employ GAK crypto; (s. 203, 205) Legalize the export of 56-bit DES crypto; (s. 302) Criminalizes the issuance of signature certificates by registered CA's for encryption keys if the user has not complied with GAK procedures; (s. 407(a)(4)) Criminalizes requesting a signature certificate for an encryption key from a registered CA if the user has not complied with GAK procedures; (s. 407(a)(5)) Allows the Secretary of Commerce to "make investigations, obtain information, take sworn testimony, and require reports or the keeping of records by .. any person", to the extent necessary to enforce the Act; (s. 701(a)) Allows the Secretary of Commerce to subpoena witnesses and documents in any State at any designated place; (s. 701(b)(3)(A)) Allows the Secretary of Commerce to impose civil/adminstrative penalties of up to $100K for violations of the Act; (s. 702(1)) Ugh. The original is online at <http://www.senate.gov/~kerrey/encrypt/encrypt2.html>, mirrored at <http://www.parrhesia.com/kerrey.html>. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Dateline=FUD / Witness=Reality
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

It is interesting to note the differences between the U.S. media and the Canadian media in the wake of the McVeigh trial. Dateline NBC is milking the remaining viewer interest by doing a fear-piece on the dangerous threat to the country that militia groups pose, despite the fact that the McVeigh=Militia mental construct is a total government fabrication. Dateline promotes great fear over the danger posed by the existence of citizens who "resist government control." Apparently, any citizens who wish for freedom from government control are an enemy of the government. Any citizens who wish to take steps to be able to defend their own personal freedom are an enemy of the government. Following Dateline was Witness, a Canadian show, running a production called "Surviving Waco." "Surviving Waco" was a straight documentary with little "spin" to its theme. It reviewed the Waco tragedy without placing large amounts of blame or adding imaginary conspiracy theories. What made the show startling was the fact that without all of the hype and hoopla of spin-doctored media coverage the whole affair turned out to be a simple case of government agencies launching an assault against a group of people who held unusual religious beliefs. When you strip the hype and hoopla away from the OKC bombing, what is really left? A former member of the U.S. military decided that the U.S. government is an enemy of the citizens and should be subjected to armed assault. Those who made the decisions resulting in the deaths of men, women and children in Waco are drawing government paychecks while the victims who survived the assault are in jail. The person who made the decision resulting in the deaths of men, women and children in OKC faces death and the victims who survived are heros. The true tragedy surrounding these events is the fact that the media gets away with feeding the public hype and hoopla because that is all the public really wants to hear. Reality is just too damn scary. Reality is that when the government screws up an operation so badly that it gets totally out of hand and results in the deaths of a multitude of citizens, the survivors will be imprisoned in order to accentuate their guilt and the government's innocence. Reality is that a single person with no connections to any (perceived) radical group can commit an act of destruction against government buildings and their occupants, and the government can confiscate all the weapons and do all the wiretaps they want without making the public any more secure against this possibility. The public wants to be told that the "danger" can be removed if this-or-that group is neutralized. The public wants the media to name an enemy that we can be protected from--militia, drug dealers, pornographers, cryptologists. Reality is too scary. Reality is that I can pick up the garden hoe outside and walk over to my neighbor's house and whack his whole family over the head, and he can do the same. (Reality is the fact that I would spend 5 more years in prison than he, because I have PGP on my computer.) Reality is that if government takes away all the guns and crypto, and taps all the phones, and even takes away my garden hoe, I can break off a good, thick tree branch and go whack the public over the head. (even innocent children!) We live in a Media Reality where the slaughter of men, women and children is given a spin to provide whatever illusion the media and the polls deem will sell the most Pepsi to the public. The public doesn't want to hear that the 800 law enforcement agents surrounding Waco are monsters. They don't want to hear that people can be slaughtered for their religious beliefs by government forces. They do want to believe that a single monster is responsible for OKC and that killing him will remove the threat. And most of all, the public wants to believe that the Branch Davidians "had it coming," because, if they didn't, then the possibilities it raises are too frightening to imagine. The problem, of course, is that the greater the number and the more varied the groups of people who resist increasing government control, then the greater and the more varied will be the list of people who "have it coming." Currently, cryptographers are being added to the list of those who "have it coming." The media reports of the government assault on the meeting place for the Bay Area Cypherpunks meeting will be accompanied by government proof of the Cypherpunks having started the fire in which they died. There will be great media coverage of the Cypherpunks' conspiracies to poison water supplies, make drugs and deal in child pornography (under their "leader," Jim Bell, of course). Oh, I forgot about Cypherpunks' plans to "nuke D.C." If that isn't enough to make us all "monsters" then what is? Of course, while we are sitting in jail (or walking toward the gas chamber) we can take consolation in the fact that perhaps somewhere there is a country showing a documentary which reflects the reality of our lives and our actions, instead of the hype and hoopla needed to sell more Pepsi. TruthMonger

1 0

Re: Regulating the Net
by 3umoelle＠informatik.uni-hamburg.de 17 Dec '03

17 Dec '03

> Note the privacy protections being written into law in Germany: > > "Privacy protection: Personal data can be gathered only to the > extent that is necessary to perform the requested service (like > connecting to the Internet) or for accounting purposes, and must be > erased immediately thereafter. The consumers must be forewarned of > the type, scope and place of the data collection and have the right > to access their personal information at any time." > > Since this bill is now passing into law, I will expect an immediate > exodus of corporations from the country in order to avoid these > draconian laws. Better start selling my deutschemarks, huh? There is nothing much new in that law. Internet service providers have always been subject to the general Privacy Law. Also have a look at the EU privacy directive, which is similar in spirit: http://www.echo.lu/legal/en/dataprot/directiv/directiv.html You'll probably not be very surprised to learn that e.g. many credit card companies operate from Denmark or the Netherlands, and that even the state-owned railway company has orders for their customer cards processed in the US and the cards mailed from Holland.

1 0

None Re: Recipient Anonymity
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Matt Ghio wrote: > A group of servers collects messages of equal length for anonymous > recipients. All servers exchange messages so that each has copies of all > messages. > > A recipient wishes to retrieve a message from the servers without any > server knowing which message he is receiving. The recipient selects a > group of n servers. From each server, S_1...S_n-1, he requests a random > selection of messages, with a 50% probability that any particular message > will be selected. The server returns the xor of all messages requested. > He sends the final server a request which is the xor of all the previous > requests and the one single message that he wants. > > The xor of all the responses is the desired message. It is impossible to > determine which message was received unless all servers collude. So what you're saying is: - Messages - A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Server 1: 1 0 1 1 0 1 0 0 1 0 1 0 0 0 1 0 1 1 0 1 0 1 0 0 1 1 Server 2: 0 1 1 0 1 1 1 0 1 0 0 0 1 0 0 1 0 1 0 1 0 0 0 1 0 0 Server 3: 1 1 0 1 1 0 1 0 0 0 1 0 1 0 1 1 0 0 0 0 0 1 0 1 1 1 So server 1 sends back the xor of messages A,C,D,F...Z; server 2 sends back the xor of B,C,E,F,G...etc. The xor of all of that cancels out everything except Message Q. But as long as at least one of the servers doesn't keep logs then nobody will know that except the person who downloaded it. Clever. It sure beats reply-blocks. :)

1 0

Announcing E3News.Com!
by announce＠lists.zdnet.com 17 Dec '03

17 Dec '03

----------------------------------------------------------------- ZDNET ANNOUNCEMENT 6/17/97 ----------------------------------------------------------------- E3News.com to Cover Gamings Biggest Show in Real Time! The GameSpot Network will be broadcasting live from the Electronic Entertainment Expo (E3) in Atlanta this week. E3 is the biggest show in the games industry. You can learn about the show, and see it all as it happens right now at the E3 News.com site: http://www.e3news.com More than fifty editors from GameSpot, VideoGameSpot, GameSpot News, Computer Gaming World, Electronic Gaming Monthly, EGM2 and P.S.X. will be roaming the show floor on June 19, 20 and 21 to bring you all the stories from this computer and video game extravaganza. Read about the newest games, the latest hardware, the biggest stories, all posted live from the E3 News media center on the show floor. The site will be updated continuously, so you'll see everything as it happens. E3News.com will also bring you coverage of the outrageous parties and after-hours events. Its the next best thing to being there! If you like games, E3News.com is a must see! --- E3News.com --- http://www.e3news.com --- The GameSpot Network - Your Games Channel on ZDNet --- http://www.gamespot.com _______________________________________________________________ ZDNet Announcements are periodic notices of new features, special events and free offers available to members of ZDNet. --To subscribe to ZDNet Announcements, please send mail to: announce-on(a)lists.zdnet.com You can leave the subject and body blank. --To unsubscribe to ZDNet Announcements, please send mail to: announce-off(a)lists.zdnet.com You can leave the subject and body blank. _______________________________________________________________ Powered by Mercury Mail: http://www.merc.com ===============================================================

1 0

ALERT: Senate to vote on mandatory key escrow as early as Thu June 19!
by Shabbir J. Safdar 17 Dec '03

17 Dec '03

============================================================================= ____ _ _ _ / ___|_ __ _ _ _ __ | |_ ___ | \ | | _____ _____ | | | '__| | | | '_ \| __/ _ \ _____| \| |/ _ \ \ /\ / / __| | |___| | | |_| | |_) | || (_) |_____| |\ | __/\ V V /\__ \ \____|_| \__, | .__/ \__\___/ |_| \_|\___| \_/\_/ |___/ |___/|_| SENATE COMMERCE COMMITTEE SET TO VOTE ON MANDATORY KEY ESCROW LEGISLATION AS EARLY AS THURSDAY JUNE 19TH! CALL NOW! Date: June 17, 1997 Expires July 1, 1997 URL:http://www.crypto.com/ crypto-news(a)panix.com Redistribution of crypto-news is allowed in its entirety. _____________________________________________________________________________ Table of Contents ALERT - Senate Committee Set to Vote on Key Escrow What YOU CAN DO NOW! Background On The Encryption Issue How to start or stop receiving crypto-news About This Alert _____________________________________________________________________________ ALERT - SENATE COMMITTEE SET TO VOTE ON BILL TO GUARANTEE GOVERNMENT ACCESS TO YOUR PRIVATE ONLINE COMMUNICATIONS On Tuesday June 17, Senators John McCain (R-AZ) and Bob Kerrey (D-NE) introduced legislation which would all but mandate that Americans provide guaranteed government access to their private online communications and stored files. The bill, known as "The Secure Public Networks Act of 1997" (S.909) represents a full scale assault on your right to protect the privacy and confidentiality of your online communications. Please take a moment to read the instructions below and, if your Senator is a member of the Commerce Committee, please take a moment to call your Senator TODAY! Though offered on Capitol Hill as a compromise, the McCain-Kerrey bill is virtually identical to draft legislation proposed earlier this year by the Clinton Administration while doing nothing to protect the privacy and security of Internet users. The bill closely mirrors draft legislation proposed by the Clinton Administration earlier this Spring. Specifically, the bill would: * Compel Americans to Use Government-Approved Key Recovery Systems * Make Key Recovery a Condition Of Participation in E-Commerce * Allow Government Carte Blanche Access to Sensitive Encryption Keys Without a Court Order * Create New Opportunities for Cybercrimes * Codify a low 56-bit Key Length Limit on Encryption Exports * Create Broad New Criminal Penalties for the Use of Encryption The full text of the bill, along with a detailed analysis, is available online at http://www.cdt.org/crypto/ ________________________________________________________________________ WHAT'S HAPPENING NOW On Thursday June 19, the Senate Commerce Committee is scheduled to hold a vote on S. 377, the Promotion of Commerce Online in the Digital Era (Pro-CODE) Act - an Internet-friendly encryption reform bill sponsored by Senators Burns (R-MT) and Leahy (D-VT). Senator McCain, the Commerce Committee Chairman, is expected to try and substitute his proposal for Pro-CODE - gutting the proposal and inserting provisions which would all but mandate guaranteed government access to your private communications. Please take a few moments to help protect your privacy and security in the Information Age by following the simple instructions below. ________________________________________________________________________ WHAT YOU CAN DO NOW ** THE COMMITTEE IS EXPECTED TO VOTE AT 9:30 AM Eastern JUNE 19 ** ** IT IS CRITICAL THAT YOU CALL YOUR SENATOR TODAY ** A list of Senate Commerce Committee members is printed below. If your Senator is on the list, please call TODAY. NOTE - If your Senator is not on the list, please visit http://www.crypto.com/adopt and ADOPT YOUR LEGISLATOR. You will receive targeted alerts next time your Representatives or Senators are poised to vote on this and other critical Internet Related issues. 1. If your Senator's name is on the list below, pick up the phone and call them at 202-224-3121. Ask for your Senator's office. Order: Frist, Abraham, Snowe, Stevens, Browe, Bryan. * = has publicly stated opposition to the McCain-Kerrey bill. + = has publicly stated support to the McCain-Kerrey bill. William Harrison Bill Frist, R-TN Spencer Abraham, R-MI ALL THESE SENATORS ARE Olympia Snowe, R-ME TELEPHONABLE AT 202-224-3121 Ted Stevens, R-AK John B. Breaux, D-LA Richard H. Bryan, D-NV +John McCain, R-AZ, Chairman *Conrad R. Burns, R-MT Slade Gorton, R-WA *Trent Lott, R-MS Kay Bailey Hutchison, R-TX *John Ashcroft, R-MO *Sam Brownback, R-KS +Ernest F. Hollings, D-SC, Ranking minority member Daniel K. Inouye, D-HI Wendell H. Ford, D-KY +John D. Rockefeller, IV, D-WV +John F. Kerry, D-MA *Byron L. Dorgan, D-ND *Ron Wyden, D-OR 2. Ask for the staffer that handles the encryption issue 3. Urge your Senator to OPPOSE THE McCAIN-KERREY BILL (S. 909) at the Commerce Committee Markup on June 19: SAY THIS -> I am a constituent calling to urge the Senator to oppose the McCain-Kerrey "Secure Public Networks Act" at the Committee markup on June 19. The bill all but mandates key-recovery encryption and represents a grave threat to privacy and electronic commerce on the Internet. We need a solution to this issue that protects privacy and security on the Internet, and the solution being offered by Senators McCain and Kerrey isn't it. I hope you will take a strong stand on this important issue. 4. IMPORTANT! -- PLEASE LET US KNOW HOW IT WENT! Go to the feedback page for your member of Congress at http://www.crypto.com/feedback/ and let us know how it went. This will help us coordinate our strategy on the ground in DC. 5. Please forward this alert to your friends and colleagues who live in your congressional district (do not forward after June 25) 6. Finally, relax! You have done more to help fight for privacy and security on the Internet in 5 minutes than most people do in a year! We appreciate your support! ________________________________________________________________________ BACKGROUND ON THE ENCRYPTION POLICY ISSUE Complete background information, including: * A down-to-earth explanation of why this debate is important to Internet users * Analysis and background on the issue * An analysis of the Risks of Key-Recovery by leading cryptographers * Text of the Administration draft legislation * Text of Congressional proposals to reform US encryption policy * Audio transcripts and written testimony from recent Congressional Hearings on encryption policy reform * And more! Are all available at http://www.crypto.com/ ________________________________________________________________________ WHAT'S AT STAKE Encryption technologies are the locks and keys of the Information age, enabling individuals and businesses to protect sensitive information as it is transmitted over the Internet. As more and more individuals and businesses come online, the need for strong, reliable, easy-to-use encryption technologies has become a critical issue to the health and viability of the Net. Current US encryption policy, which limits the strength of encryption products US companies can sell abroad, also limits the availability of strong, easy-to-use encryption technologies in the United States. US hardware and software manufacturers who wish to sell their products on the global market must either conform to US encryption export limits or produce two separate versions of the same product, a costly and complicated alternative. The export controls, which the NSA and FBI argue help to keep strong encryption out of the hands of foreign adversaries, are having the opposite effect. Strong encryption is available abroad, but because of the export limits and the confusion created by nearly four years of debate over US encryption policy, strong, easy-to-use privacy and security technologies are not widely available off the shelf or "on the net" here in the US. A recently discovered flaw in the security of the new digital telephone network exposed the worst aspects of the Administration's encryption policy. Because the designers needed to be able to export their products, the system's security was "dumbed down". Researchers subsequently discovered that it is quite easy to break the security of the system and intrude on what should be private conversations. This incident underscores the larger policy problem: US companies are at a competitive disadvantage in the global marketplace when competing against companies that do not have such hindrances. And now, for the first time in history, the Clinton Administration and members of the US Senate have proposed DOMESTIC RESTRICTIONS on the ability of Americans to protect their privacy and security online. All of us care about our national security, and no one wants to make it any easier for criminals and terrorists to commit criminal acts. But we must also recognize encryption technologies can aid law enforcement and protect national security by limiting the threat of industrial espionage and foreign spying, promote electronic commerce and protecting privacy. What's at stake in this debate is nothing less than the future of privacy and the fate of the Internet as a secure and trusted medium for commerce, education, and political discourse. ________________________________________________________________________ HOW TO START OR STOP RECEIVING CRYPTO-NEWS To subscribe to crypto-news, sign up from our WWW page (http://www.crypto.com) or send mail to majordomo(a)panix.com with "subscribe crypto-news" in the body of the message. To unsubscribe, send a letter to majordomo(a)panix.com with "unsubscribe crypto-news" in the body. Requests to unsubscribe that are sent to shabbir(a)vtw.org will be ignored. ________________________________________________________________________ ABOUT THIS ALERT This message was brought to you by the Center for Democracy and Technology (http://www.cdt.org) and the Voters Telecommunications Watch (http://www.vtw.org/) who have joined together to create the Adopt Your Legislator Campaign - a unique and effective way of creating dialogue between members of Congress and their Constituents on critical Internet-related issues. For more information on the Adopt Your Legislator Campaign, please visit http://www.crypto.com/adopt/ ______________________________________________________________________________ end alert 06.17.97 ------------------------------------------------------------------------------

1 0

RE: Digiweb.com's Movie Boys
by Paul Bradley 17 Dec '03

17 Dec '03

CC list cut from huge chain of people to just cpunx. > Explain to me how distributing JPEGS's of nude boys is an exercise of > personal freedom. I would have thought this was obvious, clearly not. Distributing any information is exercising ones right to free speech. Just because the speech happens to offend you does not make it wrong, I also find that often it is the most censorous that are the most repressed, I`m sure the poster probably has a collection of child pornography, or maybe just sits on the beach watching small boys? Datacomms Technologies data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: FC76DA85 "Don`t forget to mount a scratch monkey"

1 0

Re: keeping secrets and knowing when they're compromised
by Paul Bradley 17 Dec '03

17 Dec '03

> > I also want to know, if I'm still around, when and if those documents > > are decrypted. I.e. In the event that my friend isn't as trustworthy > > as I presume, I want to find out if s/he decrypts the files while I'm > > still around. There is a solution, a simple one, that can split the repsonsibility. Encrypt the documents with a normal symmetric cryptosystem, something strong and unlikely to be compromised in the near future, say LOKI or IDEA, or maybe 3DES if you trust it. XOR the key with a random value, give the result to your friend and print out the random value, sign it and give it to a bank or solicitor as a bequest in your will to your friend. If and when something does happen the friend proves your death to the bank using probate or a death certificate, gets the random value, XORs it with the string you gave her and she has the key. She can then easily decrypt the data. Yes, it does involve a third party, but it is unlikely your friend could collude with a respected bank or solicitor/notary to recover the key... Really all depends how paranoid you are. Datacomms Technologies data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: FC76DA85 "Don`t forget to mount a scratch monkey"

1 0

Re: [?????] PGP 5.0 Freeware is available from ???
by imran 17 Dec '03

17 Dec '03

Does Any body know if the PGP 5.0 program can be found outside US and Canada,or how can the users from rest of the world have access to it. please reply in person if possible. _/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/ ..o0O""O0o.. I see this world with a pessimist's eye not to grieve ( | | ) upon the misery of the Adam's children but to wait ) / \ ( in vain for the blissful years yet to come... (_) (_)

2 1

[PGP-USERS] ANNOUNCING: Georgia Cracker Anonymous Remailer
by Fred B. Ringel 17 Dec '03

17 Dec '03

Hi all- Here is Andy Dustbin's replacement for the dustbin remailer, one which was quite reliable during the time it was up. Add this one to your lists. You can get the keys from the remailer. The good news is Andy intends to eatablish another nym remailer. We need more of these. Fred /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ Fred B. Ringel -- Rivertown.Net Internet Access Systems Administrator -- Voice/Fax/Support: +1.914.478.2885 PGP- Public Key -- email: fredr-pgpkey(a)joshua.rivertown.net Although in theory, there's no difference between theory and practice, in practice, there is. ---------- Forwarded message ---------- Date: Wed, 18 Jun 1997 00:42:49 -0400 (EDT) From: Andy Dustman <andy(a)CCMSD.chem.uga.edu> Subject: ANNOUNCING: Georgia Cracker Anonymous Remailer Dustbin is dead; long live Cracker! ("Cracker" means more than you think; get out your dictionaries and look up the term as it applies to the SE US, or specifically GA. ;) Here is the vital data: $remailer{"cracker"} = "<remailer(a)anon.efga.org> cpunk pgp hash latent cut ek mix reord middle"; Cracker runs ghio-2 and Mixmaster 2.0.4b1. You may notice an extra key stashed in here. It is for the forthcoming nymserver (which I am having a nasty problem with PGPPATH, ARGH!). Don't use it yet; I hopefully will make the announcement tommorrow. Andy Dustman / Computational Center for Molecular Structure and Design / UGA To get my PGP public key, send me mail with subject "send file key". For the ultimate anti-spam procmail recipe, send me mail with subject "spam" "Encryption is too important to leave to the government." -- Bruce Schneier http://www.ilinks.net/~dustman mailto:andy@CCMSD.chem.uga.edu <}+++<

1 0