- cypherpunks-legacy - lists.cpunks.org

stop mailing to remail@infinity, please
by Eli Brandt 17 Dec '03

17 Dec '03

Somebody has been repeatedly (probably by a script) trying to remail through me to "remail(a)infinity.hip.berkeley.edu", which bounces back to me (unknown user). If it's somebody on this list, could you stop? Otherwise I'll have to have something grep for it so I can source- block the sender, and I don't really want to get into looking at incoming traffic. Eli ebrandt(a)hmc.edu

1 0

Re: stop mailing to remail@infinity, please
by nobody＠jarthur.cs.hmc.edu 17 Dec '03

17 Dec '03

Eli Brandt <ebrandt(a)jarthur.cs.hmc.edu> wrote: > Otherwise I'll have to have something grep for it so I can > source-block the sender, and I don't really want to get into > looking at incoming traffic. Yeah, aside from the privacy problems here, there are other reasons for not looking at mail going through your remailer. I run a remailer, and one night a few weeks ago, we had a power failure here during the night, so the system got hosed. When I was setting it back up in the morning, I saw the incoming mail which hadn't gone into the filter. Well, there were some messages in there which ... well, let me just say that someone was using my remailer for a purpose which I would have rather not known about. Sometimes ignorance is bliss.

1 0

PROGRAMMING: Assessment wanted.
by schirado＠lab.cc.wmich.edu 17 Dec '03

17 Dec '03

I'm not a programmer, so this is all over my head. I'm just throwing this out as a public service. I will forward mail to the original author. *** If a subscriber has the time and interest, I can supply them with sources to build a new public key cryptography system based on unpatented and UNPATENTABLE (because they are already published) cryptographic systems which have an entire level of better security than that RSA rubbish. So far, it appears that keys in the neighborhood of 100-200 bits are equivalent to the "600" bits for RSA and the "military grade" claims of 1024 bits (PGP) should be easily doable in around 300-400 bits. Requirements: You need to either have a good grasp on finite mathematics (fields, rings, and such..just a basic understanding is all that is necessary) or willing to spend the time to learn it (about a week if you are already math-inclined). You need programming skill too (of course). I would also recommend that you use a different compression system from that LZ-based stuff that half the world is using in favor of higher order Markov tree things (I will supply complete references for this too). I am doing this because I have the necessary information but lack the time to develop this project further. [...] Okay, for a good overview paper of doing it in hardware (the software solution is also possible..just that you can't do it quite the same..online that is), see _An Implementation of Elliptic Curve Cryptosystems Over F-2-155_ , IEEE Journal on Selected Areas in Communications, Vol. 11, #5, June 1993 (page 804). Essentially, nonsupersingular elliptic curves over the finite group of characteristic 2 become reducible to the discrete logarithm problem. Watch when you are looking for papers and doing the research for stuff by Neal Koblitz..he really knows his stuff and wrote a very good introductory book to finite arithmetic and cryptology, although the elliptic curve system in the book was written before the hole in the supersingular case was known. Elliptic curve cryptosystems appear to be the strongest known public key cryptosystem on a per-bit basis in existence. The algorithm is still horrendously slow (just like RSA-based stuff) so don't expect to be doing the encryption/decryption in real time unless you're building it in hardware. The paper mentioned above has all the references you'll need. Use a good solid block cypher for actual encryption and just encrypt a seed using the public key stuff. Do us all a favor and publish it in library as well as full-blown software package form and allow for plug-in encryption modules as well as key management systems so the software doesn't have to be done all over again each time. Same with any compression software you put in it. As far as compression (lossless) goes, you'll have to search for the papers on that because my copy appears to have been borrowed and not returned. Look for "Prediction by Partial Matching" or "PPM". This is a multiple-order Markov solution which does better than the LZ-based things.

1 0

spooks on cypherpunks
by nobody＠jarthur.cs.hmc.edu 17 Dec '03

17 Dec '03

NetSurfer <jdwilson(a)gold.chem.hawaii.edu> Robert Mathews <mathews(a)gold.chem.hawaii.edu> be aware

6 9

ID List, Tacky Tokens Fail.
by Black Unicorn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Below is the very preliminary list of state driver's license high tech methods information I have collected so far. Thanks to all who contributed. Note that "credit card" type driver's licenses are hard plastic cards without clear lamination. This typically indicates a higher tech process. Notes, suggestion, updates, and corrections are very welcome. I'll note that no one seemed interested in paying tacky tokens for the list. Alberta, Canada: As of:..? Magnetic Strip? N? Digitized Photo? N? Bar Code? N? Issued: ? Other: Two sheets, data and photo. Signature on license. British Columbia: As of: ? Magnetic Strip? N Digitized Photo? N Bar Code? N? Issued: ? Other: Normal lamination embossed with seal. California: As of: 92, 94? Magnetic Strip? Y 150% usual width. Digitized Photo? Y Bar Code? N Issued: Mail Other: Hologram of state seal Credit card type. Valid 4 years. Digitized thumbprint? Signature on license. Connecticut: As of: ? Magnetic Strip? N Digitized Photo? N (But copy exists at DMV?) Bar Code? N Issued: ? Other: ? Florida: As of: Summer 93 Magnetic Strip? No Digitized Photo? No Bar Code? No Issued: On the spot. Other: Expires in year 2000. (7 years?) Normal lamination. Georgia: As of: Fall 93 Magnetic Strip? N Digitized Photo? Maybe Bar Code? N Issued: By mail Other: Hawaii: As of: ? Magnetic Strip? N Digitized Photo? Y? Bar Code? N Issued: ? Other: Printed with, "what looks like a 180 dpi printer." Illinois: As of: 1992 Magnetic Strip? N Digitized Photo? N Bar Code? N Issued: On the spot. Other: Signature on license. No SSN #. SSN required. Indiana: As of: Winter 91 Magnetic Strip? N Digitized Photo? N Bar Code? N Issued: ? Other: Valid 5 years? Laminated with state name. Kentucky As of: Spring 89 Magnetic Strip? N Digitized Photo? N Bar Code? N Issued: On the spot. Other: Normal lamination. Massachusetts As of: Early 93 Magnetic Strip? N Digitized Photo? N Bar Code? N Issued: On the spot (1992) Other: SSN default, but optional. Normal lamination with state seal. Signature on license. Michigan: As of: 92 Magnetic Strip? N (Proposed) Digitized Photo? N Bar Code? N Issued: ? Other: Normal lamination embossed with state seal. Minnesota: As of: Spring 93 Magnetic Strip? N Digitized Photo? N But copy kept. Bar Code? N Issued: Mailed Other: Normal laminate. Color change on contact with air? Poor security at the office. Missouri: As of: Magnetic Strip? N Digitized Photo? N Bar Code? N Issued: Other: Credit card type. SSN not on license. Montana: As of: Winter 93 Magnetic Strip? N Digitized Photo? N Bar Code? N Issued: ? Other: Mailed. New Hampshire: As of: ? Magnetic Strip? N Digitized Photo? N Bar Code? N Issued: ? Other: "Basically a sick joke." New Jersey: As of: Old. Magnetic Strip? ? Digitized Photo? N Bar Code? ? Issued: By mail or on the spot? Other: SSN required, but not on license. Renewable by mail. Ugly hologram. New York: As of: ? Magnetic Strip? Y Digitized Photo? Y Bar Code? Y Issued: ? Other: ? Ohio: As of: Winter 91 Magnetic Strip? N Digitized Photo? N Bar Code? N Issued: On the spot Oklahoma As of: 92 Magnetic Strip? N Digitized Photo? N Bar Code? N Issued: On the spot. Other: Oregon: As of: Fall 91 Magnetic Strip? No Digitized Photo? No? Bar Code? No? Issued: On the spot. Other: Valid 4 years. Normal laminate. No SSN. Pennsylvania: As of: ? Magnetic Strip? N? Digitized Photo? Y? Bar Code? N? Issued: ? Other: Credit card type. Hologram. Tennessee: As of: Spring 89 Magnetic Strip? N Digitized Photo? N Bar Code? N Issued: On the spot. Other: Texas: As of: 91 Magnetic Strip? No Digitized Photo? No Bar Code? No Issued: Mail (1988) On the spot (?) Other: Normal lamination embossed with state seal. No SSN. Valid 4 years. Signature on license. Vermont: As of: 93 Magnetic Strip? N Digitized Photo? N Bar Code? N Issued: By mail Other: Credit card type. Photo is optional? Virginia: As of: ? Magnetic Strip? No? Digitized Photo? No Bar Code? No Issued: ? Other: SSN is DL #. Normal lamination with seal. - -uni- (Dark) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLcRqehibHbaiMfO5AQGnlgQAlGxP8fiCrDZvSRXBw93fdJwP71O5IR2y gJdPHmpgU5YSmcWIY2mP+b1iTGO/QEpbV1keGsbrYtsyXO++eRCM8od9/TKKpVj3 QspU7VmAwi1Zx3uiOXX2WPb1ftoikejfmr3dsd/bg0mzZLZdZQin5zUzFwEiQePi Fizr0f8/jvE= =cLcH -----END PGP SIGNATURE----- Later editions should be less sloppy. :)

2 1

ITAR and non-US citizens
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

What's my legal position if I buy a 'munition' in NY and walk out of the US? What's my legal position if I ftp PGP from a US site? Who's violated ITAR? If I have, and it's proved, anything they can do? I don't suppose India, or any other government for that matter, will extradite someone for getting something out of the US that can't harm them. Can non-US citizens file CJ (or FOIA) requests? ------------------------------------------------------------------------------- Rishab Aiyer Ghosh rishab(a)dxm.ernet.in Voicemail +91 11 3760335; Vox/Fax/Data 6853410 H-34C Saket New Delhi 110017 INDIA The National Short-Sleeved Shirt Association says: Support your right to bare arms! -------------------------------------------------------------------------------

1 0

Phil Z in the WSJ
by Duncan Frissell 17 Dec '03

17 Dec '03

Get today's Wall Street Journal. Phil and PGP are profiled in the left hand "profile" column on page 1. Usual crypto errors. "PGP is more unbreakable than any code in history." They spelled our name wrong too. It's "cypherpunks" not cipherpunks. DCF

2 1

Re: AT&T, Clipper, & Saudi Arabia
by paul＠poboy.b17c.ingr.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Can we please confine paranoia to reasonable areas -- like AT&T's sales > of secure phones to the government? The U.S. government has a very long > record of pushing American products against foreign competitors, such as > Boeing versus Airbus. I have great respect for you, Steve, but in this case I must humbly disagree with you. The US government does have a very long record of promoting US products for foreign sales, but it is certainly rare for the President himself to get involved so publically. Do you really think that selling 50,000 secure phones would be _that_ attractive to AT&T? It would certainly be attractive to the particular business unit in charge of selling them, but not nearly as attractive as the promise of help in the future. > Of course, there is a quid pro quo here -- but it's Clinton reminding the > Saudis about Desert Storm. Considering that the Saudis paid for a large fraction of the monetary cost of Desert <foo>, and that they have made or attempted to make substantial FMS and civilian purchases from the US, they very well may feel that they have discharged their debt. I think it's reasonable to visualize a conversation in which the administration promised to "help AT&T in the future" in exchange for AT&T's adoption of Clipper. It certainly may not have been as blatant as my satirical letter, but that doesn't make it less plausible. - -Paul - -- Paul Robichaux, KD4JZG | Out the 10Base-T port, through the router, perobich(a)ingr.com | over the leased line, off the bridge, past Intergraph Federal Systems | the firewall... nothing but net. Of course I don't speak for Intergraph. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLb/UACA78To+806NAQFltgP+ILjjQTG2EOlnj9+csJHC5q8v2cwXwaUo Y5MMShgVShUB4xe3knS6UPShEW2YemGGzvfWWIO+O1hgiXLWKbxclnRB/UCgne4G J+0TJzwZGu6WxD/IEoOMvFkFisJauqpeL4uP7DgaWtAcV5LeBg4mKoTgxGvZaE7i r4nNBLkJdI4= =IB4g -----END PGP SIGNATURE-----

3 3

Directory of 'punks
by Jim Sewell 17 Dec '03

17 Dec '03

Thank you for the preliminary (<2 hrs) response to the posting. I have not gotten a "that's a bad idea" letter yet of the 7 replies so I will assume this is a "Good Thing" tm. In the interest of the mailing list volume I ask that you hold your information for now. I will certainly accept "it's a bad idea" mail. I will put together a format for replies and post it to the list and anyone interested can fill in the blanks and mail it back to me. I'm going to take my time and try to think of any useful information so we only have to do this once (good for you and me). Look here for the survey and email it back if you want to be included in a list of c'punks. Also, please let me know if there is anything you DON'T want included and I will honor that as well. Thanks for your comments, I'll keep the list informed of what I know when it becomes available. Jim -- Tantalus Inc. Jim Sewell Amateur Radio: KD4CKQ P.O. Box 2310 Programmer Internet: jims(a)mpgn.com Key West, FL 33045 C-Unix-PC Compu$erve: 71061,1027 (305)293-8100 PGP via email on request. 1K-bit Fingerprint: 8E 14 68 90 37 87 EF B3 C4 CF CD 9A 3E F9 4A 73

3 2

NPR Clipper Transcript
by Duncan Frissell 17 Dec '03

17 Dec '03

National Public Radio Broadcast 28APR94 Morning Edition @ approx :20 past the first/third hour Bob Edwards (?): ... in the age of digital communication: the debate over encryption technology ... first, headlines from Carl Castle .... [Headline News] BE: The new era of digital communication has brought with it some very thorny problems concerning personal privacy. Three months ago, the Clinton administration announced a new encryption technology, called the "Clipper Chip" --- a device that encodes voice communications so that eavesdroppers can't understand what's being said. Privacy advocates are angry because the government will keep the keys to the Clipper Chip code, enabling the National Security Agency and the FBI to listen in. Critics say the Clipper policy will threaten privacy in the soon-to-be-deployed information technology on which the messages will include very personal documents and highly sensitive business communications. Next week, committees in both the Senate and the House will hold hearings on the controversy. NPR's John McChesney (sp) reports. JMcC: Today's digital encryption technology is so good that it's made law enforcement officials fearful that they're about to lose the wire tapping capabilities they already have. That's the reason the Clinton administration has proposed new technology that will keep law enforcement in the loop, so to speak. Clipper is part of what the administration hopes will become a new encryption standard. Jeff Greibledinger heads the Justice Department's Narcotics Division. JG: Clipper can be put into telephone or fax or similar hardware and provides extraordinarily strong encryption, using an algorithm that's been in use by the government now for a number of years. JMcC: Two people conversing will be able to activate Clipper encryption on their telephones, so that to an eavesdropper their conversation will be meaningless gibberish. In fact, Clipper's code is so complex, the government says it needs to keep the key, so that it can unlock the code and listen in if it thinks the laws are being broken. Thus the controversy, and there's a virtual canyon of difference between the government and privacy advocates, with both sides painting dark, disturbing visions of our digital future. Federal officials warn that the information super highway could become a lawless road, travelled by terrorist conspirators and kiddie porn merchants peddling their sordid wares over global networks, while lawmen are left standing by in uncomprehending helplessness. Civil libertarians, on the other hand, foresee a nearly omniscient government able to dip at will into the digital pipelines and pull up data containing the most intimate details of our personal and professional lives. JPB: The problem with cyberspace is that essentially every time you do anything there, you leave some kind of data trail. JMcC: John Perry Barlow writes about digital technology for Wired Magazine. JPB: In the physical world, you've got walls and doors that you can lock. But, you know, in the virtual world everything you do is visible except that which you explicitly make invisible. And the only way in which you can make things invisible is by using cryptography. And the only way in which you can make them invisible to the government is by using the strong cryptography that they don't want you to have. JMcC: The government may not *want* you to have strong encryption, but so far it hasn't said that you *can't* have it. Strong, private encryption software, to which the government will *not* have a key, will still be available on the domestic market. Administration spokesmen insist that Clipper, and other government data encryption standards yet to come, will be strictly voluntary. But that's a straddle that appears to have satisfied no one. Critics say that nobody with criminal intentions would be stupid enough to use the codes that the government has keys to. And others say that the administration is being disingenuous --- that it's using the levers of government to ensure that Clipper becomes *the* standard. One such skeptic is Jerry Berman of the Electronic Frontiers Foundation. JB: The government, while it says it's a voluntary system, they are determined to drive the market, to use government buying power to make this a defacto standard. If every government agency, the IRS, Treasury, and the Health Care System use Clipper Chip, there will be a tremendous market incentive to move towards Clipper as a potential standard. Second of all, they are making it very difficult for other encryption schemes to compete on the market by continuing to hold that any powerful encryption scheme available in the United States cannot be exported. It's a munition. It's a weapon. JMcC: The export restriction has infuriated the American software industry, which says it stands to lose more than $6 billion each year it's in effect. But it's the potential loss of privacy, rather than the loss of profit, that will undoubtedly remain at the center of the Clipper debate. Government backers of Clipper say there are sufficient legal restraints now in place to prevent illegal invasions of our privacy. Again, the Justice Department's Jeff Greibledinger: JG: A wiretap without lawful authorization is a Federal felony offense, punishable by up to five years in prison. That's true right now, even for unencrypted communications. It will be no less true in the future, when encryption is available. JMcC: Greibledinger says the Clipper system would make it even harder for government officials to gather information illegally. They key to each Clipper chip's code will be split into two parts, which will be held in escrow by two separate government agencies. A wiretap order would have to include separate, documented applications to these two agencies for the keys. But skeptics say that the excesses of the FBI under J. Edgar Hoover should be kept in mind during this debate. They also point out that modern digital technology is changing the terms of the debate about privacy. In the first place, there will be a lot more information about our private lives on the networks of the future than there is on the phone lines of today. And secondly, as critics like Jerry Berman point out, powerful computers connected to digital networks greatly increase the efficiency of spying, making it possible instantly to pull together a detailed personal portrait of any citizen. JB: What kind mail you're sending and to whom What kind of telephone calls you're making and to whom What kind of banking transactions and where you are, and What kind of vacation you're taking and What kind of movies you're watching --- all at the same time. JMcC: And all of the information surging through the digital pipelines of the future can be far more easily searched than could the mail and telephone calls of the past. Stanford Professor Martin Hellman, a noted pioneer in cryptographic technology, who opposes Clipper, says old-time wire taps required an expensive human being to monitor each and every call. MH: But once you have information in computer readable form, you can scan approximately 10 billion words for $1. You heard me right --- 10 billion words for $1! So the fact that we're going to computer readable information makes this much more dangerous. JMcC: Vermont's Senator Patrick Leahy heads a Senate Technology Sub-Committee that will hold hearings on the Clipper chip next week. He worries that concern about Clipper could slow down the deployment of the broadband communications networks the administration has been promoting. PL: We've had already some 48,000 people sign on to an electronic petition through Internet to say they're against it. The administration has set off alarms that probably they didn't need to set off, in some instances. Because I don't think that they laid the groundwork for this at all. And in some other areas, they've set off alarms that so far do not have adequate answers. JMcC: Nearly everyone agrees that the stakes in this debate are high --- finding the proper balance point between privacy and public safety in the digital age. Some observers believe that the Clinton administration may be softening its stand on Clipper now. Administration spokesmen are emphasizing that they've solicited alternative ideas from the computer and software industries. In San Francisco, I'm John McChesney reporting. BE: The time is 29 minutes past the hour. *************************** Transcribed by Lois Frissell

1 0