- cypherpunks-legacy - lists.cpunks.org

Re: Federal Key Registration Agency
by William Knowles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 19 Jun 1996, Igor Chudov wondered: >Lucky Green wrote: > At 16:27 6/18/96, TM Peters wrote: > >Speaking to the Commonwealth Club of California in San Francisco, Reno said > >her plan would require people to register with the new agency the secret > >codes -- or "keys" -- they use to encrypt messages online. > >: The cat is out of the bag. Janet Reno is calling for mandatory Government >: Access to Keys. Not that her statement would surprise anyone on this list. >: Still, I believe the administration has never before publicly stated that >: people will be _required_ to deposit their encryption keys with the >: government. I wonder what the penalties for failure to comply with this >: requirement will be. > A couple of questions [admittedly, I am not the best expect in American > politics]: > 1) Is there anything real that individual citizens can do? Keep your PGP262.zip disks in ziplock bags and cache them in the backyard, forests,The golf courses. Get a GPS location and escrow the locations with with trusted friends using Secret Share. Payout to Jim Bell's AP service. Move to Canada? William Knowles erehwon(a)c2.org Finger for public key -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMcke1AURbnwsNLz5AQHmMQQA2TFznKaMSM9uayXkvpcq/SsYg1hLnNKW 4v+NKSAVoDSGyn96VPxH1zEDP+dHk2MS173ocIUcaCm3VzRbBp6qnukAzTjGxjns PVFFS5dsicx+wR4LFxWhUy/7fjvP6BUTLUwPvQGuXZyh8jof1uuL8FYXPtku6tSG a78TvfAgknU= =IZFJ -----END PGP SIGNATURE-----

6 5

Re: Noise: Re: Those Evil Republicans
by Duncan Frissell 17 Dec '03

17 Dec '03

At 02:49 PM 6/24/96 -0400, Hallam-Baker wrote: >If you had heard the whole speech rather than only the portion reported on CNN I read the reporting and excerpts in the Saturday Times. >you would know that you have entirely distored the meaning. The point being >made was that cyberspace is being promoted as a panacea for all ills, many of >which it is creating rather than curing. I wasn't aware of any ills being created by cyberspace. For one thing, it hasn't been around (as a big thing) long enough. The only impact it has had so far is to reduce TV watching and improve writing ability (from a very low base level) among its heavy users. That's a good thing. Any effects of disintermediation or shrinking of institutions (governments and corporations) as we discuss on this list haven't really happened yet. >Cyberspace is not a replacement for an >ecconomic policy, Newts idea of giving laptops to homeless people is not a >solution for poverty. Actually I think that this is quite obvious from the >quote you give. I assume that Clinton's statement was aimed at the neo-Luddites in the AFSCME. There are probably quite a few. Actually freedom of communications or free exchange of bits (cyberspace) and by analogy the free exchange of goods and services *are* an economic policy though of course a controversial one. >Given the experience of derregulating Savings and Loans institutions I don't >think the country could survive another round of deregulation. As Reagan said >"Gentlemen we've hit the jackpot" - and of course they had, S&L was not a >fiasco for certain people, just for the poor taxpayers. Yes the great inventor of deposit insurance FDR has a lot to answer for. But for his intervention, we taxpayers wouldn't have owed a dime for the S&L collapse. I expect quite a bit more de facto dereg as people become harder to control. A mere desire to regulate others unaccompanied by the ability to do so is so much noise. >> In the same speech in which he talked about people hunting ducks with rifles. >Damned unsporting eh? Isn't the NRA weapon of choice a surface to air missile? The NRA suggests shotguns. A rifle is much more sporting than a shotgun for assassinating quackers. Hard to hit them with rifles (even harder with SAMs). DCF "If the Internet is so easy to control, how come my sysop can't even control his little piece of it?"

2 1

Re: "Filegate" may be good news for us
by minow＠apple.com 17 Dec '03

17 Dec '03

>The current flap over the Clinton Administration's request for and receipt >of FBI dossiers is being called "Filegate." The Administration has claimed >the requests were innocent, and based on outmoded Secret Service lists. The >Secret Service denies this, and says the list did not come from them. ... >Why is this good news for us? (Besides the partisan issue of embarrassing >and degrading the current government, which is always a good thing.) > >Because it underscores how difficult it is, even with ostensible >safeguards, to control the distribution of dossiers, secret files, and >surveillance reports. Another reason is that it shows the problems with sensitive data even if people have *legitimate* access to that data (i.e., assuming that there was no mischief involved. Ignoring all privacy issues, escrowed encryption keys will be extremely valuable as they will allow insight into financial transactions. Thus, they will be very attractive targets for economic espionage. Martin Minow minow(a)apple.com

1 0

Sen. Specter and Kerry move to delay crypto legislation
by Declan McCullagh 17 Dec '03

17 Dec '03

Two things: 1. The letter was copied to Mark Heilbrun, and a phone number is helpfully provided below. 2. D'Amato was copied to encourage him to claim jurisdiction over part of this legislation, yank it into the banking committee, and delay, delay, delay. -Declan declan(a)well.com -------------------------------------------------------------------------- United States Senate Select Committee on Intelligence June 7, 1996 SSCI #96-2219B The Honorable Patrick J. Leahy United States Senator Senate Russell Building, Room 433 Washington, D.C. 20510-4502 Dear Pat: We write to express our concerns about legislation you have sponsored which would impact directly upon federal encryption policy, including export control policy. Recognizing that American innovation in encryption technology is unequaled, we appreciate the need to balance US economic competitiveness with the need to safeguard national security interests. As such, it is our belief that this legislation requires careful study and reflection and that the Senate and the Congress as a whole should proceed with caution until all of the implications of such an initiative are fully discerned. Along these lines, it is our understanding that industry representatives are currently meeting with the Administration to discuss new policy initiatives to address this issue. Also, both the Congress and the Administration have undertaken to conduct a thorough analysis of a two-year congressionally-mandated study on federal encryption policy that was facilitated by the National Research Council. We therefore feel that your legislation initiative at this time is premature. We appreciate your efforts to bring some needed clarity to United States policy in this area and wish to keep the lines open for discussion and debate on this important issue. The staff point of contact on this issue is our Committee Counsel, Mark Heilbrun, who can be reached at 224-1700. Sincerely, Arlen Specter J. Robert Kerrey Chairman Vice-Chairman cc: The Honorable Alfonse D'Amato Chairman, Senate Committee on Banking --------------------------------------------------------------------------

2 1

Re: FW: Bashing "Wired"
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:32 AM 6/21/96 -0700, you wrote: >And notice that increasingly the "journalists" are the quoted thinkers and >strategists in important areas? Someone majors in English, starts writing >for "Netizen" or "HotWired," and the next thing you know they're debating >crypto policy with Conrad Burns and Dorothy Denning. We're in an age where >the medium truly is the message You don't think the rest of the press is truly any better, do you? At least on the net, you get to see the horse's mouth on a bad day, and sometimes you can even meet the people and track down the rumors hat eventually become headlines, and pull the wool over your own eyes. Dorothy Denning may know a lot of mathematics about cryptography, but that doesn't make her any more fit to decide what policies the government ought to enforce than I am. She'll get the technical details correct far more often than Senator Burns, as would most people here, but being a trained ethicist would perhaps be more relevant than being a trained mathematician - it doesn't take that much technical explanation to know that crypto lets you have private conversations. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Dispel Authority!

2 1

Re: Federal Key Registration Agency
by jim bell 17 Dec '03

17 Dec '03

At 12:09 AM 6/22/96 -0700, Bill Stewart wrote: >Actually, it may even be low - Cray-type supercomputers aren't particularly >designed for the bit-twiddling you need to do DES well. An application- >specific cracking machine can do it several orders of magnitude faster >for a smaller amount of money. Wiener's design was two orders of magnitude >more cost-effective than the two previous designs (Peter Wayner's content- >addressible-memory design and somebody-from-DEC's GaAs chip design were >both about $50M for a 1-day crack), and those were substantial breakthroughs >when they came out. It would be foolish to use GaAs to build a DES-cracker. If there's one thing we've learned from the fact that microcomputers have "won" against mainframes, and massively-parallel computers have "won" against super-speed scalars, it is that it is much, much cheaper to build 10 transistors of speed "1", than 1 transistor at speed "10." Presumably, they can get the same amount of work done. The main thing that kept vector (parallel) machines back in the 70's and 80's was the problem of subdividing programming tasks into hundreds or thousands of such tasks, suitable for such a machine. That "problem" is no problem at all for DES cracking, since trying large numbers of codes is inherently a decomposable problem. It seems likely that the most economical solution would be to build the cracker on a not-quite state-of-the-art fab, say a 0.5 micron facility, purchased from some semiconductor company who has one too many old fabs. The costs of the hardware would be amortized already, and the product would be sufficiently fast to help minimize the parallelism required. Jim Bell jimbell(a)pacifier.com

1 0

Re: Bad Signatures
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 18:12 6/22/96, geoff wrote: >> Further, it makes philisophical/political sense to me to have >> verification distributed. Every node should be doing it's own >> security. > >I am not convinced. For a mailing list it makes sense for all members >to be aware of message integrity problems. Not all cypherpunks have >your lisp package or Pronto Secure which make signature verification of >the 10-20 pgp signed messages per day on the list a non trivial task. If you think about the issue in more detail, you will realize that having a third party do signature verification is no more useful than having a third party do your encryption for you. In other words, not only is it not useful, it is downright dangerous, since it provides you with a false sense of security. If someone wishes to bounce messages that don't verify back to the originator, great. But please do not further add to list traffic by bouncing these messages to the list. Thanks, -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Disclaimer: My opinions are my own.

1 0

Re: Sen. Specter and Kerry move to delay crypto legislation
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:15 AM 6/22/96 -0700, someone anonymous wrote: >Don't confuse Kerry and Kerrey. This was not Kerry from >Massachusetts. Kerry from Mass seemed to have mixed feelings about it. One one hand, he wants more business for his state, but on the other, he's got a military background and is concerned about the so-called legitimate needs of law enforcement. # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Distract Authority!

1 0

Re: Win95 Blowfish Implementation
by Deranged Mutant 17 Dec '03

17 Dec '03

On 22 Jun 96 at 19:49, Perry E. Metzger wrote: > Actually, MD5 has no restrictions on it at all. Its one thing RSA DSI > is nice about. Copies of the code are everywhere on the net, and are > totally unrestricted. I thought they asked for an acknowledgement in manuals or the programs usage or title message that it used RSA's MD5 implementation, *if* you used their source code. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Zimmerman/Viacrypt
by Rich Burroughs 17 Dec '03

17 Dec '03

At 01:25 AM 6/15/96 PDT, Edgar Swank <edgar(a)Garg.Campbell.CA.US> wrote: [snip] >Seems to me an employer has a perfect right to monitor his employee's >work product, for which he's being paid a salary and using the >employer's equipment (like business PGP). If the employee doesn't >like it, he's free to seek employment elsewhere (or start his own >business). Or he's free to encrypt all his personal Email at home >with a personal copy of ViaCrypt or a copy of free PGP. Sometimes these workplace privacy issues are really hard for me to come to a clear decision on. I don't know how many of you have been in a workplace where someone quit by just walking out in the middle of the day, but I have. Things would have been really messy had the person left encrypted data lying around that the company had no key for. It probably wouldn't have been hard to get a judge to make the employee give up the key (after getting the judge to understand what the hell encryption is...), but the time lost might have had a real impact on project deadlines. I'm not sure what the answer is, but I have a feeling that as an employer I probably wouldn't want to provide encryption that I had no key for. What if an employee died suddenly, and I needed access to their records/email? Perhaps a somewhat enlightened employer could opt to split the escrowed key up and pass it along to several people in the office, to help prevent management from just spying on everyone. Phil's feelings about PGP are a different matter, though. If he feels it shouldn't be used that way, and that Viacrypt has violated their agreement, then he should pursue it, IMHO. It doesn't necessarily follow that he's just using it as an excuse to wrest the commercial version from them. He may feel they really have gone beyond what was agreed upon. I suppose it will be up to the courts to decide whether the escrow system is a "back door" or not. Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon U.S. State Censorship Page at - http://www.teleport.com/~richieb/state New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0