- cypherpunks-legacy - lists.cpunks.org

Encryption Rules Coming
by John Young 17 Dec '03

17 Dec '03

Financial Times, December 21, 1995, p. 4. Encryption rules to be prepared By Andrew Jack in Paris Representatives of international business and government yesterday agreed to draw up guidelines on encryption, a system which allows computer users to transmit information electronically with little risk that it can be intercepted and understood by unauthorised "hackers". The meeting, which was held at the International Chamber of Commerce in Paris, could lead to formal propositions prepared jointly by business and government organisations that could be ready by as soon as next summer. Yesterday's meeting did not have any formal legal authority, but was highly significant as the first forum where so many representatives of governments businesses and computer experts met to discuss developments in encryption. Highly sophisticated encryption technology already exists in a number of countries including the US and Sweden. In the US, companies already have access to these programs. A growing number of businesses -- led by the banking sector -- are demanding access to these programs. However, many governments, including that of the US, have resisted permitting the technology to be exported because they fear it will fall into the hands of organised crime and terrorist organisations. They have demanded that they should be able to "hack" into computer transmissions for counter-intelligence and criminal investigation work, in the same way that they can conduct telephone-tapping exercises. An important conclusion of yesterday's Paris meeting was that business agreed in principle to allow such hacking to take place as long as sufficient safeguards were in place and "electronic search warrants" had been issued with proper judicial approval. A number of governments appear willing to permit relaxation of export controls on sophisticated encryption devices as long as these safeguards are in place. Among the issues that experts on both sides need to resolve are the ways in which "keys" allowing computer transmissions to be decoded would be handled. A number of business organisations have discussed the use of third-party organisations, which would be independent of government, would have the keys and would hand them over to government investigators when demands were justified. However, the organisations still have to resolve a number of issues, including how these custodians could be made legally liable for any unauthorised access to this information and for the costs of its misuse. [End] ---------- Does anyone have press reports or more information on this meeting? Any connection to the recently signed Transatlantic Agenda?

3 2

Telcom bill report
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Here's the additional info from Reuters. As usual, Clinton is being a coward. For additional Cypherpunks relevance, anonymous remailer operators in the US may need to watch out. -Allen Reuters New Media _ Thursday December 21 2:11 PM EST _ Congress Reaches Compromise On Telecom Reform WASHINGTON - Congressional conferees have agreed to a sweeping reform of telecommunications law that would open competition by allowing the telephone, cable and broadcast industries to invade the others' turf. Vice President Gore says President Clinton will sign the bill. Before the agreement, the president had been threatening for months to veto the bill if Republicans in Congress did not retreat on a long list of issues. They retreated. Vice President Al Gore said "This will unleash a new era in the telecommunications revolution and speed completion of the information highway." The bill would also impose tough new restrictions on sexual material on online services. It has been bitterly opposed by civil rights groups who say the controls on sexual content constitute censorship. The legislation would impose fines of up to $100,000 and prison terms of up to two years on people who make "indecent" material available to minors over computer networks. That could pose big problems for companies that provide online information services. The "cyberporn" issue was championed by conservative religious groups, including the Christian Coalition, and is certain to provoke a new courtroom battle over Constitutional rights to free speech.

2 1

Re: The Problem With Blaze And Weinstein
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

I'm not trying to start a flame war, just telling people what's REALLY happening. ATT and Netscape are both tools of the CIA/NSA. Blaze and Weinstein are in on the plot to force GAK upon us. Neither one says enough about the evils of GAK on their web page, so they're obviously for GAK and only pretending to be against it to fool the cypherpunks and curry favor with their NSA masters. Evidently the cypherpunks are all too impressed with Blaze and Weinstein's master degrees to see what's really happening. Only true visionaries like myself and Dr. Frederic B Cohen are telling it like it is; everyone else has had the wool pulled over their eyes by the NSA/ATT/Netscape axis. It's amazing how clear everything becomes once one stops taking the medication that THEY prescribed. s/ Bill Gates

4 3

Newsweek Nerd 50
by Bill.Humphries＠msn.fullfeed.com 17 Dec '03

17 Dec '03

Okay, while you other cypherpunks were grousing about how you weren't going to give Newsweek your hard-earned currency, I bought a copy. My pain, your gain (on a significantly smaller scale than that messiah figure some of us celebrate next week.) Cypherpunk Notables on the List: "Newsweek's Epithet" Phil Zimmerman: "Crypto Creator" Marc Rotenberg: "Privacy Advocate" Sameer Parekh: "Protector of Privacy" Johan Helsingius: "Crusader" and Steven Levy, who sometimes posts here has the byline on the "Year of the Net" feature. PS to Newsweek -- Prof. Hoffman should be called a "Data Goddess" not a "Geek" for exposing those bogus factors the marketdroids want to use to control their survey data back up to the population level. Happy Holidays Piss off Ralph Reed, Defend the 1st Amendment. Bill Humphries

1 0

Re: Attacking Clipper with timing info?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> I suppose the correct answer is, "It depends." > > It depends on your definition of "should" in the above > paragraph. If "should" means "in keeping with the NSA's > mission statement", then I believe the NSA should remain > quite and exploit the vulnerability as a national > technical asset. If "should" means "in support of US > commerce", then the answer would be that they should > announce/fix the vulnerability. > > I'm not sure from your tone which one you believe to be the > correct definition. :-) > I don't know myself. That's why I still occasionally think about it. It is sometimes comforting to think there is a US agency with the expertise of the NSA. At other times I wonder if we're getting the most for our tax money. Unfortunately, it would be impossible to generate a meaningful cost/benefit analysis even if the NSA was not a secret agency. Of course, if we did not pax taxes there would be no need to wonder if we're getting our money's worth. A self-funded,for-profit NSA? Now there's a liberatarian idea if I ever heard one. Jim_Miller(a)suite.com

1 0

Re: ex encrypted script
by stevenw＠best.com 17 Dec '03

17 Dec '03

>At 10:57 PM 12/21/95 -0500, Beavis B. Thoopit wrote: >>> >| Is there a way to encrypt a script yet still allow it to be runnable? I >>> >| know that the simple answer is to write it in C and compile it but I >>>don't >>> >| have the means of doing that at the moment. (i.e. there is not >compiler on >>> >| the system) >>> >| >>> >| I thought of a few simple protections but they all involve decrypting >before >>> >| running. >>> > >>> > Ever hear of chmod? chown? >>> >Adam >>> >>> The vendor also has superuser access.. chmod chown won't protect it.. :( >> >>I once had to obfuscate an awk script. "Cryptography is Economics." My >>job was to make it difficult for the enemy to steal the source. There >>was a license agreement... >> >>The simple answer of "no" is right in the strong sense, but there are >>tricks to make life difficult for the amateur attacker. >> >>My approach was a self-decrypting program. The "real" script was >>encrypted within the body of the encasing script. For increased >>obfuscation, decrypt only small pieces at a time. >> >> >There is encrypt and then there is render useless to the reader. > >A tale I hear is that when HP had to deliver operating system source to >the french government they stripped all comments and changed all variable >and subroutine names to 32 byte strings of I 1 0 (zero) and O (uppercase O). >It still compiled but was 100% useless to human readers. There is a commercial product out there from Gimpel Software called _The C Shroud_. It removes all structure from the code, replacing it with gotos, renames all the symbols to axxxxxxx, converts constants and strings to hex, substitutes all #defines and expands all macros, strips all formatting and comments, etc., resulting in a perfectly compilable, but infuriatingly obfuscated set of source files. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

Re: ex encrypted script
by andr0id＠midwest.net 17 Dec '03

17 Dec '03

] > >| Is there a way to encrypt a script yet still allow it to be runnable? I >| know that the simple answer is to write it in C and compile it but I don't >| have the means of doing that at the moment. (i.e. there is not compiler on >| the system) >| >| I thought of a few simple protections but they all involve decrypting before >| running. > > Ever hear of chmod? chown? >Adam The vendor also has superuser access.. chmod chown won't protect it.. :( ( Computer Consulting & Management ) (P.O. Box 421 Cambria, IL 62915-0421) -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzCsIi4AAAEH/1hb5+tO/n99Nbppf0ImLJ6AaVZ3NlZP0ZHwRQor00uA129i d4zWixNXxc8t2auaqN+asV99LpIip3/nQzBnjydiumeBdGLF2PR9+6X8X/RrqKa1 dVIukxM5Agg2eM6ih+0J38hgKJ3qzKXSz6sjYmpaxvbXZoHHOLUk/ZtHUKvvEyPw hnJEYnut8NUnIeK56lqeqRw86yoeRKymbfCdjdpgeY2aRwK2FJts8sbb7Fs10s4y jgxWIxIipBznbGUTh1hb2XrLGPENwk3E/qqXQJEsrySbtwdl6VgTVQjhDDEJMitL DYeiQ3W5EgxfcdbM1j2FwYu3P/dM6Y0I8xLMYT0ABRG0NmFuZHIwaWRAb2ljdTgx Mi5jb20gKG9pY3U4MTIuY29tIHN5c3RlbSBhZG1pbmlzdHJhdG9yKYkBFQMFEDCs LO90C7R/GkJcSQEB01cH/0KC3sd+u4OxMku5378SJktoN6QIQYLJ7uVbuV4S51yK NAotCGf4Wl6wwjynzZvXKU0H87oDuMiq7FybgMNL2n+4bQIZi0iz0lIuzwoMDu63 NrHUW9Kz42pOnhrEhrdkHhHL9O5GgD1yc40fJ3qw5h7LQEjDxgypyw0IFILFc34u LeRLliNibxKp8JwAxXNHWSgxu28TQvmnkHi0AHP6tJ/uZYe+4dqJtrMMsYFjzZaz DPmxD+dzbTwlQKtJaP1ZkDI0Sr072wrZDv+G86GyGBMX2lpSafpRitnxuUttjU9o wsQ9Qo5xiH1nZRCs/bDzJe/gng+GHzevixDIITurtNA= =SgPT -----END PGP PUBLIC KEY BLOCK-----

3 2

Re: Cypherpunks resumes?
by blancw＠accessone.com 17 Dec '03

17 Dec '03

From: attila the Hutt So, who the fuck am I? --just another aging 300 lb gorilla, long haired hippie California freak with an outlaw chopper. ................................................... Such a lovely place... such a lovely face... <g> (sorry, I couldn't help myself) .. Blanc

1 0

Re: CFS and Linux
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

So the master is at last fallen. Kudos to Mr. Jim Choate and Dr. Dimitri Vulis for having the courage of their convictions to help unmask AT&T's deceit in claiming to support Linux and free software when, in truth, it is doing just the opposite. Maybe, just maybe, we can seize this opportunity to advance the cause of justice, if not justice itself (true justice would require AT&T to recognize its obligation to our heros at Berkeley and pay them their USD 25,000). I call upon us all to expose AT&T for what it is! Had your software erased by the CFS install programme? Return their own medicine! Sue them! Tired of Blaze's prattle about how he is a Linux-lover even though he can't be bothered to use Linux? Challenge him! Tired of AT&T and Netscape employees stealing your resources? Configure your servers to deny W3 access to AT&T and Netscape computers! Linux isn't perfect, but its open environment is a good start for building REAL secure software. Don't let AT&T's lies bully you into abandoning it! CFS will never run under Linux until it is plucked from the monster's grasp. We, too, are guilty when we continue to invite the monster not only to walk in our midst unchecked, but to sleep in our homes as an invited, nay, paid, guest. Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

6 6

Weak keys in Diamond Encryption Algorithm fixed.
by Michael Paul Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- ******* There is a class of weak keys in the Diamond Encryption Algorithm. These are the ones that result in all of the individual substitution arrays being the same. This has a probability of about 2^-40 of happening, and is not the basis of a practical attack, but it is interesting, anyway. Thanks to Colin Plumb for pointing this out. This weakness has been eliminated in the Diamond2 Encryption Algorithm. See ftp://ftp.csn.net/mpj/public/diamond2.ps.gz for details. If you are in the USA or Canada, there is a reference implementation (as well as the above document) in ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/file/diamond2.zip, where the ??????? is revealed in ftp://ftp.csn.net/mpj/README along with an export warning. ******* I've also put an updated description of another algorithm, the Sapphire II Stream Cipher, in ftp://ftp.csn.net/mpj/public/sapphire.ps.gz and a reference implementation in ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/file/sapphire.zip ******* DLOCK2.ZIP and SAPPHIRE.ZIP are also on the Colorado Catacombs BBS at 303-772-1062. ******* You are invited to review the above algorithms and let me know if you find any weakness in them. ******* These are not commercial products, and this is not an advertisement. This is an electronic publication for the enjoyment of people who are interested in cryptography for constructive purposes. Merry Christmas! ___________________________________________________________ | | |\ /| | | Michael Paul Johnson Colorado Catacombs BBS 303-772-1062 | | \/ |o| | PO Box 1151, Longmont CO 80502-1151 USA Jesus is alive! | | | | / _ | mpj(a)csn.org aka mpj(a)netcom.com m.p.johnson(a)ieee.org | | |||/ /_\ | ftp://ftp.csn.net/mpj/README.MPJ CIS: 71331,2332 | | |||\ ( | ftp://ftp.netcom.com/pub/mp/mpj/README -. --- ----- .... | | ||| \ \_/ | PGPprint=F2 5E A1 C1 A6 CF EF 71 12 1F 91 92 6A ED AE A9 | |___________________________________________________________| -----BEGIN PGP SIGNATURE----- Version: 2.7.1 iQCVAwUBMNpaMfX0zg8FAL9FAQENjgQAoXP16Db9FdBuzRp1VXug3JWh7yCcHQCJ X/t79/q512WGYWBIKznkczgfYNE7V94J2dhEP6EfKeZzVN2J5AHV4zqq7e9IWR49 FQakcZCyIrSJIJCpRk/cyMOX5zc1posAkAAhEka7nOd9n/GgW9mHPr57yFwNQgB4 e2wcSW1r9Oo= =v8d3 -----END PGP SIGNATURE-----

1 0