September 2004 - cypherpunks-legacy

[e-gold-list] GOLDMONEY PATENTS - PROOF OF PRIOR ART EXISTS
by R. A. Hettinga 20 Sep '04

20 Sep '04

--- begin forwarded text

1 0

Re: Academics locked out by tight visa controls
by John Kelsey 20 Sep '04

20 Sep '04

>From: "R. A. Hettinga" <rah(a)shipwright.com> >Sent: Sep 20, 2004 8:33 AM >Subject: Academics locked out by tight visa controls ><http://www.mercurynews.com/mld/mercurynews/9710963.htm?template=contentModu…> >Posted on Mon, Sep. 20, 2004 >Academics locked out by tight visa controls >U.S. SECURITY BLOCKS FREE EXCHANGE OF IDEAS >By Bruce Schneier ... I guess I've been surprised this issue hasn't seen a lot more discussion. It takes nothing more than to look at the names of the people doing PhDs and postdocs in any technical field to figure out that a lot of them are at least of Chinese, Indian, Arab, Iranian, Russian, etc., ancestry. And only a little more time to find out that a lot of them are not citizens, and have a lot of hassles with respect to living and working here. What do you suppose happens to the US lead in high-tech, when we *stop* drawing in some large fraction of the smartest, hardest-working thousandth of a percent of mankind? --John

2 1

Re: Geopolitical Darwin Awards
by Tyler Durden 20 Sep '04

20 Sep '04

John Young wrote... >from school and fucked up parents who use you like a >beast of burden -- in every age and country. >The military has found that teenagers are better fighters >than those over 21, more malleable, patriotic, healthy, ready >to kill when told it's okay. ..... Grunts younger than 20 are >the universal soldier. Non-caucasians especially. Hum. I wonder if it's a coincidence that the US school system is such a mess. What on earth would we do if non-caucasians, especially, were equipped for some kind of opportunity? Guess we'd have to start the draft again, and folks get kinda touchy when the exemptions are a little too obvious. -TD >From: John Young <jya(a)pipeline.com> >To: cypherpunks(a)al-qaeda.net >Subject: Re: Geopolitical Darwin Awards >Date: Sun, 19 Sep 2004 20:46:27 -0700 > >James A. Donald: > > >I don't recall the American revolutionaries herding children > >before them to clear minefields, nor surrounding themselves > >with children as human shields. > >No, not minefields, but a good percentage of Washington's >army and that of the French, were children. Young boys were >taught the art of war as gofers and undercover spies among >the Brits. Some were caught and executed. Others packed >weapons and fought like men who welcomed their foolhardy >bravery when their manly courage withered. > >Today, even the US uses children in war, 17 being the minimum >age to enlist. Others sneak in by lying about their age, some as >young as 14. Recruiters look the other way when the kids >and their parents lie. Been there, done that. Enlisted in the >army at 15, served months before being kicked out when a >relative ratted on me. Went in again at 17. That was not >uncommon then, and still is not. Good way to get away >from school and fucked up parents who use you like a >beast of burden -- in every age and country. > >The military has found that teenagers are better fighters >than those over 21, more malleable, patriotic, healthy, ready >to kill when told it's okay. Older guys and gals think for >themselves too much to charge a machine gun. A kid >thinks life will never end. That's why it's not so hard >to cultivate suicide bombers. > >Flying a $50 million plane is a piece of cake, no guts >required. Fuck those stand-off cowards in artillery, >the navy and air force. Grunts younger than 20 are >the universal soldier. Non-caucasians especially. > >No need to mention today's Africans, the pre-teens and >teens Mao used effectively, the underage North Koreans >in the Korean Conflict, and not least the Amerindians who >taught kids from puberty to make war -- boys and girls. > >It is worth pondering that older guys don't like war up >close, in fact the the further away it is the better they >like to promote it with Stallonian filmic ferocity -- witness >the current yellow-bellied administration, though hardly >the first to cry for war to be fought by disposable youngsters. > >What older soft-gutted guys in all nations like most is the >Wagnerian tragedy, the soap opera sturm and drang, of >other people's suffering and death for their loose-screw >agenda. _________________________________________________________________ Check out Election 2004 for up-to-date election news, plus voter tools and more! http://special.msn.com/msn/election2004.armx

1 0

Re: potential new IETF WG on anonymous IPSec
by John Kelsey 20 Sep '04

20 Sep '04

>From: "Major Variola (ret)" <mv(a)cdc.gov> >Sent: Sep 17, 2004 10:27 PM >To: "cypherpunks(a)al-qaeda.net" <cypherpunks(a)al-qaeda.net> >Subject: Re: potential new IETF WG on anonymous IPSec >At 06:20 AM 9/17/04 +0000, Justin wrote: >>On 2004-09-16T20:11:56-0700, Major Variola (ret) wrote: ... >>Oh, come on. Nothing can be absolutely trusted. How much security is >>enough? >>Aren't the DOD CAs trusted enough for your tastes? Of course, 'tis >>problematic for civilians to get certs from there. >DoD certs are good enough for DoD slaves. Hospital certs are good >enough for their employees. Joe's Bait Und Tackle certs are good enough >for Joe's employees. Do you think that Verislime is good enough for >you? You seem to have rediscovered the fact that crypto can move trust around, but can't create any. You have to decide to trust someone for it to be useful. The great problem with practically using this stuff is getting someone that you're comfortable trusting, who can then use crypto to move the trust around in a sensible way. The condition necessary for Verisign certificates to have a lot of trust, to me, is for the appearance of a fraudulent Verisign certificate to be a major scandal, leading to the CEO getting canned, the stock price dropping by some large fraction, and a huge fall-off of business for their CA. When that isn't the case (for the high security certs; it's clearly silly to expect it for low-security ones), the CA doesn't have as much incentive as I'd like to be careful about forgeries. You'd like the exposure of a fraudulent certificate signed by a CA to have the same kind of effect as the exposure of a bank being unable to produce the money a depositor demands. Fraudulent certificates issued for any purpose--whether furnishing fake IDs to FBI agents, or to Al Qaida terrorists, or to random Nigerian-scam operators--leave a permanent trail; the recipient of the certificate can show it around when he discovers it's fraudulent. If the last step of this protocol for the CA is "and then you go out of business," the incentives not to issue fraudulent certificates looks right. --John

1 0

Academics locked out by tight visa controls
by R. A. Hettinga 20 Sep '04

20 Sep '04

<http://www.mercurynews.com/mld/mercurynews/9710963.htm?template=contentModu…> Posted on Mon, Sep. 20, 2004 Academics locked out by tight visa controls U.S. SECURITY BLOCKS FREE EXCHANGE OF IDEAS By Bruce Schneier Cryptography is the science of secret codes, and it is a primary Internet security tool to fight hackers, cyber crime, and cyber terrorism. CRYPTO is the world's premier cryptography conference. It's held every August in Santa Barbara. This year, 400 people from 30 countries came to listen to dozens of talks. Lu Yi was not one of them. Her paper was accepted at the conference. But because she is a Chinese Ph.D. student in Switzerland, she was not able to get a visa in time to attend the conference. In the three years since 9/11, the U.S. government has instituted a series of security measures at our borders, all designed to keep terrorists out. One of those measures was to tighten up the rules for foreign visas. Certainly this has hurt the tourism industry in the U.S., but the damage done to academic research is more profound and longer-lasting. According to a survey by the Association of American Universities, many universities reported a drop of more than 10 percent in foreign student applications from last year. During the 2003 academic year, student visas were down 9 percent. Foreign applications to graduate schools were down 32 percent, according to another study by the Council of Graduate Schools. There is an increasing trend for academic conferences, meetings and seminars to move outside of the United States simply to avoid visa hassles. This affects all of high-tech, but ironically it particularly affects the very technologies that are critical in our fight against terrorism. Also in August, on the other side of the country, the University of Connecticut held the second International Conference on Advanced Technologies for Homeland Security. The attendees came from a variety of disciplines -- chemical trace detection, communications compatibility, X-ray scanning, sensors of various types, data mining, HAZMAT clothing, network intrusion detection, bomb diffusion, remote-controlled drones -- and illustrate the enormous breadth of scientific know-how that can usefully be applied to counterterrorism. It's wrong to believe that the U.S. can conduct the research we need alone. At the Connecticut conference, the researchers presenting results included many foreigners studying at U.S. universities. Only 30 percent of the papers at CRYPTO had only U.S. authors. The most important discovery of the conference, a weakness in a mathematical function that protects the integrity of much of the critical information on the Internet, was made by four researchers from China. Every time a foreign scientist can't attend a U.S. technology conference, our security suffers. Every time we turn away a qualified technology graduate student, our security suffers. Technology is one of our most potent weapons in the war on terrorism, and we're not fostering the international cooperation and development that is crucial for U.S. security. Security is always a trade-off, and specific security countermeasures affect everyone, both the bad guys and the good guys. The new U.S. immigration rules may affect the few terrorists trying to enter the United States on visas, but they also affect honest people trying to do the same. All scientific disciplines are international, and free and open information exchange -- both in conferences and in academic programs at universities -- will result in the maximum advance in the technologies vital to homeland security. The Soviet Union tried to restrict academic freedom along national lines, and it didn't do the country any good. We should try not to follow in those footsteps. BRUCE SCHNEIER is a security technologist and chief technology officer of Counterpane Internet Security, Inc., in Mountain View. He wrote this for the Mercury News. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

:-) (was re: How one can become a terrorist?)
by R. A. Hettinga 20 Sep '04

20 Sep '04

--- begin forwarded text

2 2

Keith Henson Needs Help
by R. A. Hettinga 19 Sep '04

19 Sep '04

<http://www.kuro5hin.org/print/2004/9/14/32340/5809> kuro5hin.org || technology and culture, from the trenches Keith Henson Needs Help (MLP) By Baldrson Wed Sep 15th, 2004 at 07:42:14 AM EST For those who don't know him, Keith Henson co-founded the L5 Society, was President of Xanadu Corporation and was a featured character in The Great Mambo Chicken and the Transhuman Condition: Science Slightly Over the Edge. He's about to be deported from Canada to the United States where he faces time in the infamous California prison system. Recently on the cryonics mailing list Keith Henson issued a plea for help: ... at this point I am a "failed refugee." The only thing that can keep me from being deported to the US on short notice is an appeal to the Minister of Citizenship and Immigration. Her office gets 15,000 letters a week so it takes a well known case to reach the level where it gets attention. What is going on here and why should anyone care? The short story is that Keith has been fighting against Scientology and as a result ended up fleeing the United States to Canada to avoid a misdemeanor conviction brought against him by Scientologists. Here's the prosecuting attorney's speech given the jury on the charges: Now, His Honor read to you in the beginning of the case that the defendant has been charged with three counts. First count is -- now, these are numeric numbers and they mean nothing to you, so I will give you names for what they are. The first one is 422, violation of Penal Code Section 422. And 664/422 and 422.6. Now I'll give them names. 422 is terrorist threats. Now, that conjures up images of Beruit or the Twin Towers bombing, but that's not what it means. It just means a threat that causes someone terror, that frightens people. That's what Count One is. Count two is 664/422, is the attempt, the attempt to do the exact same thing, to cause to threaten, to attempt to threaten and cause terror or frighten someone. And the last count is 422.6. And that's essentially defined as the interference with someone's rights guaranteed by the Constitution, their civil rights, and in this case the right to practice their religion without fear. Essentially 422.6 is a hate crime. Now, let's talk about the first count, and we'll go count by count. The first count, 422, again I told you was just threats that caused people to be afraid. Essentially the elements are these: Number one, there has to be somewhat of a threat. There has to be a threat. The person has to intend there to be a threat. And lastly, that the victims have a reasonable fear. However, the person doesn't have to have to want to carry it out. There has to be no intention to carry out the threat. Keith's been in Canada for a few years and is trying to remain there as a refugee. Well, I'll confess my bias. Although Keith and I have known each other since the early days of the L5 Society, we have serious disagreements on a lot of things -- not the least of which are many opinions about Jews, genes and memes etc. More immediately relevant is the fact that I just don't "get" Keith's fight against Scientology. Scientologists seem like a joke to me and IMHO people who get involved with them suffer about as much but no more than people who get involved with New York City nightlife. Be that as it may, I personally don't like seeing anyone spend time in a US, let alone California, prison system. I once refused to testify against a young Hispanic after he had stolen my car because, despite the fact that he would be more protected than a man of my ethnicity in a California prison, he would nevertheless be subjected to a substantial likelihood of being "punked out". That's not my idea of justice. Keith is an old guy -- unlikely to be punked out despite the fact that he's a non-violent 'white guy' -- but he's the kind of guy who probably wouldn't do well in a California prison. As I said, we have serious differences but I've known him for decades, and his going into a California prison doesn't sit right with me anymore than it does with a young Hispanic kid who I don't know. The US now incarcerates a greater percentage of its population than does any other country. That's quite an accomplishment for a system known world-wide to also be a source of racist sexual sadism. So quite honestly I don't care what Henson has or hasn't done. He doesn't belong in a US prison. No one does. Even the best of US prisons still will extradite to the worst of US prisons. There are precedents for refusing to extradite criminals from Canada due to conditions in the US prison system. For example, assistant U.S. attorney Gordon Zubrod from Harrisburg, PA made the following public statement to 3 suspects who fled to Canada (this statement was captured for the public record during a Canadian Broadcasting Corporation interview): "You're going to be the boyfriend of a very bad man if you wait out your extradition." After that it was very hard for the Canadian authorities to justify extraditing the suspects to the US. Now, agreed, it is rather unusual for a federal official to lose his grip this way, but everyone knows this is exactly the sort of power that "law" enforcement officials wield over criminals in the US. Why does it take a federal official slipping up royally like that to get asylum? To make matters worse, Keith claims he has been threatened with abuse in prison by Scientology zealots: "And cult agents have made fairly clear public threats that I would not survive jail." Is Keith making this up? Not likely. Scientologists aren't known for their tact, any more than are federal attorneys. Anyway, back to the question: Why should you care? Maybe you don't like Scientology. Maybe you like Keith. Maybe you just like to mess with the California government. Whatever, Keith Henson is asking for help and he quite probably actually needs it. Full discussion: http://www.kuro5hin.org/story/2004/9/14/32340/5809 -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Time for new hash standard
by R. A. Hettinga 19 Sep '04

19 Sep '04

<http://smh.com.au/cgi-bin/common/popupPrintArticle.pl?path=/articles/2004/0…> Sydney Morning Herald Time for new hash standard By Bruce Schneier Comment September 20, 2004 - 9:09AM At the CRYPTO conference in Santa Barbara, CA, last month, researchers announced several weaknesses in common hash functions. These results, while mathematically significant, aren't cause for alarm. But even so, it's probably time for the cryptography community to get together and create a new hash standard. One-way hash functions are a cryptographic construct used in many applications. They are used in conjunction with public-key algorithms for both encryption and digital signatures. They are used in integrity checking. They are used in authentication. They have all sorts of applications in a great many different protocols. Much more than encryption algorithms, one-way hash functions are the workhorses of modern cryptography. In 1990, Ron Rivest invented the hash function MD4. In 1992, he improved on MD4 and developed another hash function: MD5. In 1993, the National Security Agency published a hash function very similar to MD5, called SHA (Secure Hash Algorithm). Then, in 1995, citing a newly discovered weakness that it refused to elaborate on, the NSA made a change to SHA. The new algorithm was called SHA-1. Today, the most popular hash function is SHA-1, with MD5 still being used in older applications. One-way hash functions are supposed to have two properties. One, they're one way. This means that it is easy to take a message and compute the hash value, but it's impossible to take a hash value and recreate the original message. (By "impossible" I mean "can't be done in any reasonable amount of time.") Two, they're collision free. This means that it is impossible to find two messages that hash to the same hash value. The cryptographic reasoning behind these two properties is subtle, and I invite curious readers to learn more in my book "Applied Cryptography." Breaking a hash function means showing that either - or both - of those properties are not true. Cryptanalysis of the MD4 family of hash functions has proceeded in fits and starts over the last decade or so, with results against simplified versions of the algorithms and partial results against the whole algorithms. This year, Eli Biham and Rafi Chen, and separately Antoine Joux, announced some pretty impressive cryptographic results against MD5 and SHA. Collisions have been demonstrated in SHA. And there are rumors, unconfirmed at this writing, of results against SHA-1. The magnitude of these results depends on who you are. If you're a cryptographer, this is a huge deal. While not revolutionary, these results are substantial advances in the field. The techniques described by the researchers are likely to have other applications, and we'll be better able to design secure systems as a result. This is how the science of cryptography advances: we learn how to design new algorithms by breaking other algorithms. Additionally, algorithms from the NSA are considered a sort of alien technology: they come from a superior race with no explanations. Any successful cryptanalysis against an NSA algorithm is an interesting data point in the eternal question of how good they really are in there. To a user of cryptographic systems - as I assume most readers are - this news is important, but not particularly worrisome. MD5 and SHA aren't suddenly insecure. No one is going to be breaking digital signatures or reading encrypted messages anytime soon with these techniques. The electronic world is no less secure after these announcements than it was before. But there's an old saying inside the NSA: "Attacks always get better; they never get worse." These techniques will continue to improve, and probably someday there will be practical attacks based on these techniques. It's time for us all to migrate away from SHA-1. Luckily, there are alternatives. The National Institute of Standards and Technology already has standards for longer - and harder to break - hash functions: SHA-224, SHA-256, SHA-384, and SHA-512. They're already government standards, and can already be used. This is a good stopgap, but I'd like to see more. I'd like to see NIST orchestrate a worldwide competition for a new hash function, like they did for the new encryption algorithm, AES, to replace DES. NIST should issue a call for algorithms, and conduct a series of analysis rounds, where the community analyzes the various proposals with the intent of establishing a new standard. Most of the hash functions we have, and all the ones in widespread use, are based on the general principles of MD4. Clearly we've learned a lot about hash functions in the past decade, and I think we can start applying that knowledge to create something even more secure. Better to do it now, when there's no reason to panic, than years from now, when there might be. Bruce Schneier is a world-renowned security technologist. His latest book is Beyond Fear: Thinking Sensibly About Security in an Uncertain World. He can be reached at www.schneier.com. This article first appeared in his monthly newsletter Crypto-Gram and is reproduced with permission. Copyright rests with the author. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

voting: economics of paper trails
by Major Variola (ret) 19 Sep '04

19 Sep '04

Isn't it *cheaper* (as well as more accurate) to have preprinted ballots, optically scanned, then to have an embedded computer print out a paper trail? Ie, don't the benefits of volume printing beat the cheapest printing tech? Besides the other advantages of being self-verifiable, more accurate, intuitive, unhackable, not having to be destroyed or randomized (as with serial polling-place-kept paper trails), etc? Methinks the printing press / optical scanner industry is not resisting the Diebold/tech-fetishist whores adequately... I think Ben Franklin would agree.

1 0

Re: Geopolitical Darwin Awards
by Tyler Durden 19 Sep '04

19 Sep '04

A solid post. In this context I'd drill down a bit to the idea of "fanaticism"... > > And if you ask me, fanaticism never lasts very long > > anywhere, only for about a generation during turbulent times. > >That is what King George and his redcoats said about the >ragtag colonials, American as well as those who suffered the >king's abuse into the 20th Centruty. My running, personal theory is that Muslim fundamentalism (and in general, most fundamentalisms) get going when the locals gain a persistent sense that they're gettin' screwed over, and that their current government ain't helping a whole lot. It's kind of a devil's bargain to obtain a source of strength. By necessity it needs to reject a lot of the local culture, otherwise there isn't sufficient motivation to fight. In general, it's probably on many levels predictable and even reasonable. Of course, this can boil over into bizarre, "fanatical" behavior, but then again as Mr Young so aptly put it, "fanatical" is what the screw-ers normally call mass behavior they don't like. In the case of Nukes, I'd point out that the nuclear nations have a distinct advantage at the UN or any other bargaining table, so if I were Iranian I'd be working pretty hard to get something quasi-viable together that could be called a "nuke". Of course, the few truly "fanatical" members of the local nuke-wannabees might get a hold of the block box and, well, that sucks. -TD _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

3 2