- cypherpunks-legacy - lists.cpunks.org

Re: 1984 Shirt Ordering Info
by markh＠wimsey.com 17 Dec '03

17 Dec '03

> > 1984 NSA T-shirt ordering information: > A reminder: The shirt is available for viewing at > http://phoenix.aps.muohio.edu/users/jdblair/t-shirt.html >... > It will be available soon via anonymous ftp. I will post the address > when that is confirmed. available from ftp.wimsey.bc.ca:/pub/crypto/shirt

1 0

Clipper and the EU
by Dave Banisar 17 Dec '03

17 Dec '03

Clipper and the EU The Independent (UK) February 25, 1994 Page 16 Super-spooks seek to extend domain to data networks; US agency wants ability to spy on new superhighways. by Leonard Doyle In Roman times conquered peoples and slaves were forced to carry tesserae or identity chits and any Gaul or slave who refused to accept one was branded or maimed instead. Soon all users of computer networks may be singled out for the tessera treatment if the National Security Agency, America's super secret military intelligence agency, has its way. The NSA, with a budget of $ 30bn ( pounds 20.5bn) a year, is responsible for intercepting foreign government communications and breaking the codes that protect such transmissions. America's most exclusive spooks are worried that advances in encryption technology are about to rob them of their ability to conduct surveillance on a global scale. After nearly 50 years of electronic eavesdropping, the NSA is finding that some widely available codes are impossible to crack. The worry is that hostile governments, drug barons, terrorists and money launderers will have a field day using networks or information highways built and maintained by the US or, for that matter, the European Union. But here is the rub. Anyone who wants to use government-funded information highways in future may be forced to use the lacklustre encryption technology provided by the intelligence agencies, complete with a backdoor access for official eavesdropping. Simon Davies, of Privacy International, a consultancy, has no doubt this will happen. ''A Wild West frontier - self-regulated by ethics and culture - has evolved in the computer communications business and now that the stakes are getting higher, government is trying to muscle in.'' It is widely predicted that by the end of the century about 50 per cent of world trade will be in services and that much of this will be carried out via computer- linked databases communicating across continents at the speed of light. It is this lucrative trade which the NSA intends to protect and oversee. The Internet system has already been identified by the Clinton Administration as the basis of a new information superhighway. If that should happen, organisations such as Computer Professionals for Social Responsibility and the Electronic Freedom Foundation fear that future access to the networks could be restricted to users of an encryption product developed by the NSA - which ironically enough is called Tessera. The fear is that the freewheeling, anonymous access that hundreds of thousands of individual network users enjoy at the electronic frontier may end. To the outrage of users in the US and elsewhere, the Administration recently backed the NSA's plans to ensure that the agency will always be able to intercept and decode messages sent over computer and telephone lines. The privacy concerns are by no means confined to US computer users. Anyone who has every logged onto a bulletin board or computer service like Compuserve or Internet could be affected. The Administration has played up the law and order side of the debate, arguing that advanced encryption will be used by criminals and terrorists. Al Gore, the Vice- president, announcing the new policy at the beginning of February, said: ''Our policy is designed to provide better encryption to individuals and businesses, while ensuring that the needs of law enforcement and national security are met.'' However many leading experts in cryptography, computer security and privacy in the US do not agree and said so in a letter to President Clinton last month asking him to withdraw the NSA's proposal. That appeal failed to avert the decision to back the Tessera and since then a petition organised by Computer Professionals for Social Responsibility has been signed by more than 1 million people who have sent their complaints by electronic mail to the President. There is no parallel debate taking place in the European Union, but the intelligence agencies here are just as busy trying to ensure that the information highways of the future can be monitored. Jacques Delors, president of the EU Commission, sees data highways as being key to future competitivity and job creation. Before long individuals will be able to hook up to the highway for all sorts of transactions, from renting a movie to view at home to swiping a smartcard through a reader at the doctor's surgery to bring up an entire medical history. The real business will of course be conducted by service companies, from banks to insurers to market traders. For these companies privacy and security are of growing concern, to which the NSA has responded with its relatively cheap encryption devices. But Tessera, which fits into the back of a computer, will also identify the user and has a special built-in ''trapdoor'' that will allow the NSA to eavesdrop on E-mail and other messages. Another cryptographic device known as the Clipper Chip can be used to scramble telephone and fax communications while giving the security services the same ability to eavesdrop with the help of a special electronic key, held in ''escrow'' by the government agencies. Government agents will be able to obtain the ''keys'' upon presentation of what has been vaguely as ''legal authorisation''. These ''keys'' will be held by two ''escrow agents'' and would enable the government to access the private voice transmissions. A similar device known as Capstone would be used for data sent via computer modem. The Administration hopes its encryption devices will at some stage have to be universally used by US industry. However, the outpouring of vehement objections from the computer industry, telephone companies and privacy groups in the US may have shaken the Administration and some computer professionals say that the NSA's encryption technology has no chance of being accepted in the market place. Sharron Webb of the National Computer Security Organisation is one of those leading the fight against the spy agency's encroachment into the world of computer communications. ''If the US government has a hand in setting up the information superhighways here, they may require users to use Tessera to participate, it is then only a matter of time before foreign users are brought on board as well.'' Already the signs are that big business will knuckle under in the face of fierce pressure from the US Administration. The largest American telephone company, AT&T, has agreed to buy the NSA's technology and to include it in scrambling devices which sell for about $ 1,000 ( pounds 680) each. Other companies are expected to follow suit, especially if they wish to maintain their lucrative contracts with the federal government. What remains unclear is how the EU and individual European governments intend to react to the US moves. So far the US is looking only to American companies and their overseas subsidiaries to use the new encryption technology. But sooner or later decisions will have to be made that affect European users. The smart money is on the EU adopting the Tessara philosophy, but with different electronic keys for each country's eavesdropping agencies.

1 0

DES VS SKIPJACK
by radatti＠cyber.com 17 Dec '03

17 Dec '03

I found part of a paper on DES VS Skipjack using gopher but could not find the remainder. Does anyone know where I can ftp this document from or have any other information about this subject. PS: Skipjack in the form of Clipper is expected to become a FIPS. DES was given a 5 year extention of it's FIPS status then it dies leaving only.... Pete Radatti radatti(a)cyber.com

1 0

Civil Rights
by Jim choate 17 Dec '03

17 Dec '03

Seems to me that a 'right' as is being discussed should be 'Civil Right'. When used in this context I believe a suitable definition would be the following: Civil Right A characteristic granted to a citizen of a country which is beyond the normal law making ability of that countries governing body. In effect it grants a citizen the ability to make decisions and act on them without regulation or permission being required by the government. It in effect says that there are certain facets of an individual which are outside the normal operations of a government and can not be regulated or otherwise controlled through legistlative means.

1 0

Re: RoboFest 5
by jim＠Tadpole.COM 17 Dec '03

17 Dec '03

The T1 line isn't absolutely 'there' .. yet. We're fighting SW Bell.

1 0

Proposal: Another emergency session of Cypherpunks
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

Summary: Maybe it's time for another emergency session of Cypherpunks to discuss policy in the aftermath of the double whammy announcements of Tessera/Clipper II and the new and even more dangerous Digital Telephony Bill. After the Clipper announcement last April, we had a special emergency meeting of Cypherpunks. Heavily attended, lots of discussion. This time around, we most knew things like Tessera and a new Digital Telephony Bill were coming, but the actuality of them has now been made real. The "ban on encryption" hasn't yet happened, but more and more roadblocks (another digital highway stupid metaphor?) are being erected. For example, any service provider, university network, hardware maker, etc., who fails to make transmissions "readable" faces $10,000 a day penalties under my reading of Digital Telephony. This could make an awful lot of service providers wary of _anything_ that doesn't look like plain old English chitchat...they may just cancel the accounts of anyone doing anything "funny." (Yes, there are probably ways to skirt these reactions, but it means pushing encryption underground, into tricks using stegonagraphy, superencryption, and less publicizing of one's PGP keys. Not a good thing. I agree with Perry Metzger that _public use_ or encryption is the best approach, practically and morally. Hiding the use of it keeps it "ghettoized.") So, I propose that we reorient our next Cypherpunks meeting (Saturday, March 12th, I presume) to deal with these issues. Some topics: * Legal overview of the Digital Telephony Bill. If Mike Godwin could link up with the other D.C.-area folks (Pat Farrell, Paul Ferguson, etc.), and then have a link to our meeting, this would be ideal. * When could Digital Telephony become law and what would be the implications? * Ditto for Tessera, Capstone, etc. * Status of Voice-PGP efforts....when will SoundBlaster-type software be available? What about encrypted IP packets on workstations instead? (Recall the impressive DES-encrypted conference call the 3 Cypherpunks groups had at the emergency Clipper meeting last April.) (I've heard talk--no pun intended--of several "Voice-PGP" projects, using SoundBlaster hardware, CELP, DSPs, etc., but no software seems to be available right now. How much longer do we have?) * How to fight these proposals, or work around them. It'd also be nice if some of the outlying groups (Cambridge, MA, Washington, D.C., London, Colorado, Austin) could link up with us at least briefly. (If we started at noon, California time, that would be fine for the East Coasters, but 8 or 9 p.m. for the Londoners....does the London group still meet?) This is just an idea. Let's discuss it. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

4 3

Party with the Nextropians! at Nexus-Lite!
by plaz＠netcom.com 17 Dec '03

17 Dec '03

MEET THE NEXTROPIANS: WE ARE HERE AND NOW AMONG YOU __________________________________________________________________________ Romana Machado - Geoff Dale - David Gordon - Nick Szabo - Russell Whitaker We can't call ourselves Nexus-Lite any more. When Dave Gordon moves in, we'll have tied the most populous nexus* of all recorded history. The residents of Nexus-Lite (but getting heavier by the minute), an Extropian intentional community, invite you to a Nexus Naming Potluck Party. Prizes for the best name for our Nexus will be awarded. We are also celebrating Housemistress Romana's appearance in WIRED and bOING bOING, describing her excellent shareware program, Stego! Thanks for your excellent articles, Sandy! Dress for the future, bring a friend. Flip a coin; heads bring food, tails bring drink. When: Saturday, March 12, 1994, 7.p.m (after the Cypherpunks meeting, until an indeterminate time on the following day) Where: 21090 Grenola Drive, Cupertino CA (See Obligatory Crude Ascii Map Attached Below) Tel: (408) 253-1692 *nexus (neks-us) n. A place where extropians** live in comfort for mutual profit, and work on extra credit assignments without fear of reprisal. **extropian (eks-tro-pee-an) 1) n. A boundlessly optimistic futurist who will live forever or die trying. 2) n. Exactly like a human, only much, much better. 3) n. A champion in the war against entropy. 4) adj. Any way cool thing an extropian would like. nextropian (neks-tro-pee-an) 1) n. An extropian who lives in a nexus. 2) Welcome to the Next Level. DIRECTIONS: Nexus-Lite is located at 21090 Grenola Drive in Cupertino. Geoff Dale's phone number (in case you get lost) is 408-253-1692. >From 280: Take the Saratoga/Sunnyvale (Or DeAnza Blvd, its all the same thing) Exit (which is actually the 85 South detour). Turn north on DeAnza (aka Saratoga/Sunnyvale Road) at the exit (a left turn if you are coming from San Francisco; right if you are coming from San Jose). Turn left at Homestead; go three blocks to N. Stelling, take left (at the McDonalds). (Note: North Stelling is called Hollenbeck on the other side of Homestead. Don't be fooled!) >From 101: Take 85 south and exit at Homestead; turn left onto Homestead. Proceed several blocks (you will pass a high school); then turn right on N. Stelling. Once on N. Stelling: Right at first light: Greenleaf First left, Flora Vista First Right on to Grenola Dr 21090 (mnemonic: anagram for Beverly Hills zip code) is a tannish house on left with a high roof that slopes toward the street. Park on the street -- in the direction of traffic, or you may get a $15 ticket. This has happened. OBLIGATORY CRUDE ASCII MAP (not to scale; up is not north): /\ || ^ ^ || (85) | | || | | || |Hollenbeck | /|| | | <----++---/ /-- (Homestead) ---+------------------+------------------> || | | || |N.Stelling | || | | || | DeAnza|Saratoga/Sunnyvale || | | <=========/ /== (280) =======] | [================+==================> || | || | || ^ | || | | Greenleaf \/ <----------+-------+-----------------> | | Flora Vista| | | | | | Grenola | | <-------------+ | *=21090 | | | | V V Excelsior! Forward, onward, upward, outward, and every which way but loose! Once more into the future dear friends!

1 0

Re: standard for stegonography?
by Jef Poskanzer 17 Dec '03

17 Dec '03

On reflection, it seems that some users will want an interoperable standard, and other users will want complete stealth. So what I'll do is add a bunch of switches to pnmstego and pnmdestego, so that the user can specify all sorts of different formats. Letting the switches default will get you a simple interoperable mode, so you can send stuff to people without prior arrangement or put stuff on an ftp server; but an attacker will be able to extract the bits and try to decrypt them. Specifying things like offsets and bit-usage schedules will mean that the attacker won't even be able to extract the bits; but the settings you use will be equivalent to that much more key material that you have to communicate or remember. --- Jef

2 1

Security of andrew.cmu.edu anon-server?
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

What kind of encryption is the anonymous contact system at andrew using? I think someone said that it used a home-brew cipher. How secure might such a system be against cryptanalysis (or just brute force key searches?) Or has it been changed to use something like DES or IDEA? (In the former case, DES, it might not be completely secure, unless you used 3DES or something.) If someone could break the code, they could find out _EVERYONE'S_ mail address that ever posted using an anon address from that remailer...

2 1

More crypto in real life...
by Alan (Miburi-san) Wexelblat 17 Dec '03

17 Dec '03

[The following is excerpted from RISKS digest. I have sent mail to Valente asking him to be more specific about what kind(s) of encryption they use for their authentication routines. I am slighly worried by the somewhat naive statments in this posting. --AW] Date: 17 Jan 1994 20:09:29 -0800 From: "Luis Valente" <luis_valente(a)genmagic.genmagic.com> Subject: Safety in Telescript Phil Agre's message of January 6th ("Wild agents in Telescript?") brings up some very good points. In this message I would like to describe some of the safety features of Telescript that are used to prevent both ill-intentioned scripts (e.g., worms, viruses) and buggy scripts from damaging a Telescripted network. 1) The Telescript language is interpreted, rather than compiled. Thus, Telescript programs cannot directly manipulate the memory, file system or other resources of the computers on which they execute. 2) Every Telescript agent (i.e, Telescript program that can move around a Telescript network) is uniquely identified by a telename. A telename consists of two components: an authority which identifies the "owner" of the agent (e.g., the Personal Communicator from which it originated) and an identity which distinguishes that agent from any other agent of the same authority. The authority component is cryptographically generated and cannot be forged. Thus, when an agent is transferred from one Telescript engine to another, it is possible to verify (using cryptographic techniques) that the agent is indeed of the authority it claims to represent. (N.B.: a Telescript engine is a program capable of interpreting and executing Telescript programs). 3) Every Telescript agent has a permit which limits its capabilities. Permits can be used to protect users from misprogrammed agents (e.g., an agent that would otherwise "run away" and consume resources for which the user would have to pay) and to protect Telescript service providers from malicious agents. Two kinds of capabilities are granted an agent by its permit. The first kind is the right to use a certain Telescript instruction, e.g., the right to create clones of itself. The second is the right to use a particular Telescript resource and by which amount. For example, an agent is granted a maximum lifetime, a maximum size and a maximum overall expenditure of resources (called the agent's allowance), measured in teleclicks. An agent's permit is imposed when the agent is first created and is renegotiated whenever that agent travels to an engine controlled by a different administrative authority. If the agent exceeds any of its quantitative limits, it is immediately destroyed by the Telescript engine where it is executing. 4) Telescript agents move around a Telescript network by going from one Telescript place to another. Telescript provides an instruction -- go -- that gives agents this travelling capability (if granted by their permit, of course). Places are Telescript programs in their own right. Before accepting an incoming agent, a place can examine the agent's telename, permit and class (N.B.: an agent represents an instance of a Telescript class; thus, the class of the agent represents the "program" that the agent executes. Like authority names, class names cannot be forged). Based on that information, the place can do any the following: a) Do not allow the agent to enter. b) Allow the agent to enter but only after imposing upon it a permit more restrictive than the one it currently holds (e.g., the agent is only allowed to consume 100 teleclicks while in this place). c) Allow the agent to enter and execute under its current permit. 5) When a Telescript process (agent or place) interacts with another Telescript process, the telename and class of the former is available to the latter. This enables Telescript applications to control who can interact with them and in what ways. I hope this (brief) description of some of the more pertinent security features of Telescript will help Risks readers understand how we've addressed the issues raised in the NYT article and in Phil's message. -Luis Valente, General Magic, Inc. ------------------------------

1 0