- cypherpunks-legacy - lists.cpunks.org

NRC Report, Appendices
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Appendices A-D: http://pwp.usa.pipeline.com/~jya/nrca-d.txt (187 kb) With images of Tables D.1 and D.2 for Appendix D: http://pwp.usa.pipeline.com/~jya/nrcd1.jpg (101 kb) http://pwp.usa.pipeline.com/~jya/nrcd2.jpg (118 kb) Appendices E-N: http://pwp.usa.pipeline.com/~jya/nrce-n.txt (199 kb) ---------- Thanks to DN. ---------- APPENDICES A Contributors to the NRC Project on National Cryptography Policy B Glossary C A Brief Primer on Cryptography D An Overview of Electronic Surveillance: History and Current Status E A Brief History of Cryptography Policy F A Brief Primer on Intelligence G The International Scope of Cryptography Policy H Summary of Important Requirements for a Public-Key Infrastructure I Industry-Specific Dimensions of Security J Examples of Risks Posed by Unprotected Information K Cryptographic Applications Programming Interfaces L Laws, Regulations, and Documents Relevant to Cryptography M Other Looming Issues Related to Cryptography Policy N Federal Information Processing Standards

1 0

I told you so
by Perry E. Metzger 17 Dec '03

17 Dec '03

Reposted from the firewalls mailing list. Date: Thu, 30 May 1996 16:39:33 -0700 From: Bill Stout <bill.stout(a)hidata.com> Subject: DES-3 Story retraction I retract the following story, it was told to me by a contractor who attended a MBONE group meeting on the MBONE, where the story originated: Story: 'A person working on the MBONE project did an unannounced experiment across the internet using Triple-DES for MBONE, and the very next day, 'ATF' agents knocked on his door and warned him against exporting munitions. The experimentor was shaken by the fact that agents approached him so quickly after the experiment.' The MBONE experimentor referred to in the story was Van Jacobson at the Lawrence Berkeley Labs. I followed this up since receiving much interested mail responses. I called Van Jacobson himself at the Lab (the web is a wonderful thing!), and found that the story was embellished. The real event as told by Van Jacobson was: 'MBONE software was at one time accidentally compiled with links into libraries which contained DES, and someone (I don't remember who) noticed the DES capability in our MBONE binaries, and informed the group about the encryption export problem. The problem was promptly fixed.' Sorry for the mis-information. Bill <=======10========20====Ruler for Eudora users==50========60========70========80 William B. Stout | "Stop socialism in America!" Senior Systems Admin | "Dilbert for President." Hitachi Data Systems | "Police power today=police state tomorrow." Open Systems Center | "The secret of life - being part of the process of Santa Clara, California | creation." 408-970-4822 | #include <sanity_disclaimer.h> <=======10========20========30========40========50========60========70========80

2 3

Come to think of it (was Something that just crossed my mind....
by Deranged Mutant 17 Dec '03

17 Dec '03

On 30 May 96 at 22:35, snow wrote: > In some of the discussion on this list there has been some concern > about the governments position on anonymous fund transfers. Well, maybe > concern is incorrect. We _know_ (or should) what it is. They are dead set > against it. Hm. The more I think about it, the more that it seems foolish to be against anonymous payee systems. Mainly because those who want it now (and who will want it in the future) and who have the resources will already have it. As for catching tax-evaders, criminals, etc... for most the five BMWs, indoor heated pool and yacht should be enough attention for those who really want to know. Of course the gov't isn't that interested in doing the legwork... better for them to have everything on a computer for easy data-crunching rather than do real footwork. (Can you say downsizing? Nah.... they'd put twice the savings into useless gadgets like attack helicopters to patrol minority neighborhoods with...) Off the track, slightly: It seems the effect that these laws have are to make it so only the very wealthy and connected (or perhaps incredibly ambitious and smart) have access to privacy and de facto loopholes in the law. The only "criminals" who will be able to get away with anything are those who are already so well off (and possibly buddy-buddy with the Powers That Bee, Bzzt!). [..] > The discussion here seems to assume that business will accept, or > even welcome the ability of it's customers to remain unknown, or nymknown. > It is my position (until proven wrong--please) that larger business DON'T > want anonymity. They _want_ to be able to track purchases and use of their > product for several reasons. Good point. But many consumers want anonymity, or at least to control what information they give customers. Many might even settle for pseudo-anonymity (ie, account number 123456 likes to buy product X, but whoever 123456 *is* is known only to 123456....). [..] > The questions that this raises are: > > 1) Am I full of shit. This is very possible. Everyone is at some time or another, unless you never eat. [..] --Mutant Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Compressed data vulnerable to known-plaintext?
by Deranged Mutant 17 Dec '03

17 Dec '03

On 1 Jun 96 at 19:13, anonymous-remailer(a)shell.port wrote: [..] > But then you still have the problem of identifying the contents. If there > were no headers, one could not tell if the message was compressed using > ZIP, LHA, StuffIt, tar*, compress, gzip, Alice's Magical Supercompressor, > or even if it was left alone. One could also not tell if the decryption > happened successfully. Actually you could, since the actual encoding isn't random. It means something to the compressor. And if you know something about compression algorithms you could probably make some good estimates. (I've seen some arguments that bit-wise a compressed file is easier to make a known plaintext attack against than an uncompressed text file...) Try taking various small (but compressable) text files that are different and run them through compressors. Ignore the usual compressor header information and look at a hex dump of the compressed data... think about it in terms of bits. Look at the algorithm that encoded the data. A good way to avoid known plaintext is to use a feedback mode with a random IV (from a good RNG!). Not perfect, of course... Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Java Crypto API questions
by jim bell 17 Dec '03

17 Dec '03

At 09:30 AM 6/2/96 -0700, Martin Minow wrote: >>Today, CP's own Marianne Mueller was scheduled to give a talk at JavaOne on >>the eagerly awaited (at least by this user) Java Crypto API. >---- ---- ---- >Notes from the security birds of a feather session >---- ---- ---- > >-- Need multiple security managers: if any say no, reject the request. >-- Servet, applet need different security managers. >-- Problem with firewalls: client accesses server via firewall via > proxy servers. May not be able to open a URL directly. >-- Java Commerce API coming for payment functions. >-- Problem with foreign applet vendors: how can a non-US security > class vendor certify a class to be used (outside the US). > Currently, it must be imported and signed by Sun. But, then > it can't be exported without a Commerce Department license. > No (current) plans to establish a signing authority outside > of the U.S. We've heard this assertion before. Why not import the software, generate a detachable signature, and then export the signature for re-attachment overseas? Surely export of signatures isn't controlled (even arguably) by ITAR. Jim Bell jimbell(a)pacifier.com

1 0

Re: NSCP, PRZ Hit NRC Crypto Rec
by Chris Adams 17 Dec '03

17 Dec '03

> The report noted that the FBI has argued for years that its > law-enforcement efforts would be hampered if drug cartels > and other organized criminals began using codes that > couldn't be deciphered. Courtordered wiretaps, a major tool > used to break organized-crime cases, could become useless, > the FBI has contended. I've wondered the same thing about gun control efforts. Who are they worried about? Criminals. By definition, what is a criminal? One who breaks the laws. Are they seriously thinking that a) criminals might stop doing things because they are illegal? (For shame - I was going to use PGP to protect my child pornography sources. Good thing I found out it was illegal before I did that!) and b) criminals would not be able to buy programmers/etc to secure *their* privacy if they felt it was needed? /* From Chris Adams <adamsc(a)io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5! The Enigman Group - We do Web Pages! */ This Message Was Sent With An UNREGISTERED Version Of PMMail. Please Encourage Its Author To Register Their Copy Of PMMail. For More Information About PMMail And SouthSide Software's Other Products, Contact http://www.southsoft.com.

1 0

The decline and fall of Australia
by TT 17 Dec '03

17 Dec '03

Just in case people on this list were under any delusions that Australia part of the free world get a load of this... **begin press release** Hon. J.W. Shaw, QC, MLC Attorney-General and Minister for Industrial Relations ------------------------------------------------------------------------ Level 20, Goodsell Building, Facsimile (02) 228 7301 Chifley Square, Sydney NSW 2000 Telephone (02) 228 8188 ------------------------------------------------------------------------ PAEDOPHILIA SHOULD NOT BE ENCOURAGED BY THE INTERNET The Attorney General Mr Jeff Shaw, QC, MLC, today explained the draft internet regulation legislation to members of the internet community who had apparently misunderstood the plans. "Despite their protests, those who support total freedom on the internet have yet to explain to me why material involving paedophilia should be readily available and encouraged on the internet", he said. "Those who assert that the proposals are a knee jerk reaction are completely wrong and appear to have been totally uninterested in the issue until very recently. For on 7 July 1995, a consultation paper on internet regulation was released both on the World Wide Web and in paper form. "That 'Consultation paper on the Regulation of On-Line Information Services,' has now been available from the Federal Attorney General's Department for almost a year. "When it was released, submissions were requested, and 121 submissions were received by the closing date of 1 September 1995. "Following unanimous endorsement of the proposals by all Attorney's General, the NSW Parliamentary Counsel drafted legislation based on the discussion paper and the consultation process. This legislation will be discussed by the Standing Committee of Attorney's General in July. "Those protesting about the proposed offences and penalties are conveniently ignoring half the story - the fact that the draft legislation creates broad defences that encourage compliance with approved codes of practice or the taking of reasonable steps to ensure the proscribed behaviour does not occur. "Why should a Government not prosecute a service provider who supplies the Internet to schools, yet refuses to install appropriate firewalls to screen out material involving explicit sex and violence or child sexual abuse? "The broad defences recognise, as I do, the impossibility of monitoring all data that goes through service providers systems, but encourage providers to maintain maximum awareness, not maximum ignorance, about the material disseminated. "Criminal sanctions are only aimed at operators and users who culpably breach the standards that are set out regarding material that they transmit or advertise, or those who fail or refuse to exercise any effective controls over material that is publicly available through their information services. "For example, people who have objectionable material placed on their bulletin board without their knowledge could argue that they are not liable as they had obtained undertakings from users that certain types of material would not be posted or posted inappropriately. They may also be able to demonstrate that they had conducted random checks of material available through their information service. "I do not believe that the community condones the easy availability of material encouraging paedophilia and other sexual abuse. The impossibility of absolute regulation does not justify a complete failure to do what we can to meet reasonable concerns. "I would hope that organisations like the Electronic Frontiers Association are interested in assisting the State and Federal Governments formulate workable proposals that will protect children while allowing adults freedom of expression on the internet. If they in fact are, detailed proposals about how this could be best achieved would be useful." **end** As to that last para I think u could read..."cos we have no bloody idea what we are doing or how to achieve this all on our lil lonesomes" Thank the gods for cypherpunks..

1 0

Re: 119_816
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

At 11:29 AM 7/17/96 GMT, you wrote: > 6-17-96. NYP: > > "11 Officers Are Accused of Failure to pay Taxes. Claims of > Sovereignty and 98 Dependents." > > At least 11 New York City police officers have been > accused of failing to pay any Federal taxes for several > years by declaring they each had 98 dependents and by > insisting that the Government had no right to tax them. > The officers relied on a package of instructions that > described how to avoid paying taxes by declaring that > they were sovereign citizens who did not have to pay > taxes. Anyone know which "package of instructions" they were using, and where they can be obtained online? //cerridwyn//

2 1

Re: Opiated file systems
by Deranged Mutant 17 Dec '03

17 Dec '03

On 18 Jul 96 at 22:48, Adam Back wrote: [..] > The whole system should be designed to withstand scrutiny as to > whether or not there is a duress file system on any given disk, on the > assumption that the opponent as full access to the source. > > ie. the attacker can not tell without the hidden file system key (if > one exists) whether the unused space on your drive is really just > that: unused space filled with garbage, or whether it is in fact > another encrytped filesystem. There has to be a way to tell the system that the sectors are used when not the drive isn't mounted and the filesystem isn't active. > They might be suspicious, but I don't think they would be able to > claim you were in comptempt of court, if you provide the 1st key and > claim there is no other key: the software has support for either 1 > or 2 filesystems. Having a copy of the driver is enough to arouse suspicion. If they don't find anything useful in that one partition, they'll assume the second is in use and that you're not giving up the key. You may very well get accused of maintaining a second system even if you are not and do not have anything incriminating in the one encrypted fs. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

2 1

Re: "address verification databases"? (was: Netscape download...)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 17:53 7/18/96, Peter D. Junger wrote: >With much help from Tom Weinstein and a bit of luck, I have succeeded >in downloading the Linux version. But the time I tried before it >finally worked, I typed in the New York City area code (212) rather >than the Cleveland area code (216) and since I had given them a >Cleveland address and ZIP code, they (the server, that is) said that I >had made an error. So that must be one thing that they check. Despite the ITAR, Netscape's US version is already available from the usual free-world FTP sites. Next time, you might want to get your copy there. BTW, can somebody please tell me why PGP generated *.asc files show up in Netscape as "VRML Worlds"? TIA, -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0