- cypherpunks-legacy - lists.cpunks.org

Stego for Stegosaurs
by tcmay＠netcom.com 30 Aug '93

30 Aug '93

> Some of you have asked for more details about the interception of > encrypted digital dinosaurs. Alas, I don't know much more than I .. > S a n d y Frankly, I'm surprised no one has pointed out the obvious solution, so I guess I'll have to. Spielberg and Company clearly needed to protect their transmissions using the "Stego" program of Romana Machado. By packing the real content of the "Jurassic Park" communications into MPEG transmissions of "Barney," the circle would be completed. Just my least significant bit. -Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

1 0

JURASSIC CRYPTO
by Sandy 30 Aug '93

30 Aug '93

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, Some of you have asked for more details about the interception of encrypted digital dinosaurs. Alas, I don't know much more than I posted. The Cypherpunk in question is still out of the country, to the best of my knowledge. I have no contact information for him. When he gets in touch with me again, I'll suggest he post something about how the satellite feed was compromised. To me, the most important facts are that it could be done and that it was done, not how it was done. (Flame away, technoids.) S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Privacy issues and how to sell them
by Jamie Jamison 30 Aug '93

30 Aug '93

>From reading the group it seems to me that there is a need for two styles of data encryption. One style would be something similar to DES, it would be a standard cypher and would be used for encrypting items such as the files on your hard disk. The other would be a public key cypher and would be used for communicating between individuals. Now, as far as selling these two concepts goes one thing that might help is to point out the fact that not only is the government untrustworthy, in the sense that they abuse their power, but that they're also incompetent. Americans have an unfortunate tendency, at least in my eyes to, buy into catch-phrases such as "law and order" or "national security" in a completely uncritical fashion. However Americans also mistrust, and rightfully so, the competence of the government, so perhaps we should point out that since the government can't keep its own secrets very well that it obviously can't keep the secrets of 250 million citizens very well either, which is what the government would be attempting to do if SkipJack/Clipper/Capstone were made the national standard for encryption. Jamie Jamison WITH STANDARD DISCLAIMER

1 0

Talked to Phil Zimmermann....
by tcmay＠netcom.com 30 Aug '93

30 Aug '93

Cypherians, Phil Zimmermann was at our "Extropians Fifth Anniversary Party" in the Santa Cruz mountains yesterday and last night; Extropians are another mailing list/group, of course, but there is a substantial overlap between the groups. Several items of potential interest: 1. RSA did not know of the ViaCrypt deal until after it was signed last Sunday. ViaCrypt's license allows it to put whatever it wants around the RSA core....it has picked PGP as the wrapper. RSA can't really object to this, provided the RSA core is as the contract with ViaCrypt specifies. 2. Phil will carefully inspect the code, including the RSA part, and is confident no funny business is planned by ViaCrypt or anyone else. (I have to trust Phil on this matter more than any "panel" or the like....after all, he wanted to put trapdoors in, he could in the existing PGP--though of course this is highly unlikely to have been put in in the first place and to have remained undiscovered all this time.) 3. There's a bunch of confusing--to me--stuff about U.S. versions, European/foreign versions, what can and can't be exported and imported, the ITAR (International Traffic in Arms Regulations), and so on. Basically, there may be separate European versions, possibly using different code. Triple DES may be used in some versions (don't ask me for details....I'm not sure of the tradeoffs between DES and IDEA...perhaps the deal to use IDEA doesn't fit with a commercial version of PGP). 4. I showed Phil the MacPGP 2.3 program on my PowerBook 170. The "help" system especially impressed him (it does me, too). He is not closely connected with Zig F.'s Macintosh development. 5. Integrating PGP with mailers--the "elm" and MIME ideas that keep surfacing--is still being debated. Running PGP on a machine outside one's own control is always dangerous, but, let's face it, is how _many_ people are already using PGP and how many of the future corporate customers will be likely to use it. (The PGP secret key will then be found scattered around in backups, on other disks, etc. Even the manually-entered passphrase is *not sufficient*, as many systems have "scrypt" and similar keystroke-capture programs automatically recording all keystrokes. Even my Macintoshes capture all keystrokes ("Last Resort," "Thunder 7, etc., have such utilities). This is an unresolved issue! (Talk of using smartcards, RSA cards, Newton-like PDAs, etc., is one approach, but this moves away from ease of use by requiring specialized hardware.) 6. Ease of use remains a problem. Phil mentioned again that he sends a routine form letter out to all those who send him encrypted e-mail explaining that it may take him several days to get around to reading their messages...he has to do the same multi-step procedure of downloading to his local PC, quitting, saving the file, starting PGP, and so on. (Phil has never run PGP on a machine outside his control.) 7. Phil also wanted to talk about the political issues of RSA vs. PGP, about my concerns some months back that the battle for strong crypto would not be won with explicitly illegal programs, etc. I told him I thought the ViaCrypt deal was a nearly perfect solution to these concerns: individuals and corporations can now safely use PGP without the fear of asset forfeiture or criminal prosecution should a zealous prosecutor decide to "make an example" of them. A legal version of PGP is the goal many of us were seeking. A major win. I congratulate Phil for pulling this off. 8. Perhaps most ironically, David Sternlight (the neural net AI automatic posting program I mentioned a few days ago) has asked to be a beta site for the ViaCrypt program! Sternlight blesses ViaCrypt...the mind boggles. (To be fair to Sternlight--something many people may flame me for :-} --he never argued for a ban on crypto, or for restrictions, only that a "legal" or "unencumbered" version be used. Hence his involvement with RIPEM.) That's what I remember. The party started at 2 p.m. at the mountain-top home of Mark Desilets and lasted 'til well after 3 a.m....and may still be going. I didn't count, but there were probably at least a hundred people, including a dozen or more Cypherpunks. A real blast. -Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

2 1

no ftpd on soda.berkeley.edu ?
by Liam David Gray 30 Aug '93

30 Aug '93

Has anyone else tried to ftp soda in the past 2 days or so? I've been unable to establish a connection. I assume whoever maintains the Cypherpunks archive on this machine (is it Eric H.?) might be able to find out: Is there any ftpd running on it at the moment, and what's the expected downtime? Thanks. - Liam Gray lg2g+(a)andrew.cmu.edu

2 1

Re: CACM article "Clipping Clipper"
by ferguson＠fiber.sprintlink.net 30 Aug '93

30 Aug '93

On Sun, 29 Aug 1993 13:14:01 GMT, Lance J. Hoffman <hoffman(a)seas.gwu.edu> wrote - > Several people have asked me to post this for > those who do not get Communications > of the Association for Computing Machinery. > So here it is, reprinted with > permission from Communications of the ACM, > September 1993, volume 36, number 9. I would like to (firstly) extend my personal thanks to you for posting the article in sci.crypt, and (secondly) for expressing your opposition to the "key-escrow" initiative. I, and I am sure many others, appreciate your viewpoints on the entire fiasco and stand alongside you in opposition of this threat to personal freedom and privacy in the dawning new age of information. Your paper is well-written and presents the facts in a succint and indisputable fashion. I look forward to the seeing the issue in print, and any counter-point articles which may also appear in this issue. Cheers, _____________________________________________________________________________ Paul Ferguson Mindbank Consulting Group ferguson(a)fiber.sprintlink.net Fairfax, Virginia USA ferguson(a)icm1.icp.net

1 0

Re: Another BBS Seizure in Ha
by hkhenson＠cup.portal.com 30 Aug '93

30 Aug '93

Re this thread, I know someone on this list is also very active with EFF. Could John tell us if EFF is on this case? I would really be interested in such details as did the cops get warrants for all the email on the system? If they did not, it is Alcor or Steve Jackson all over again. (and several other cases which did not go very far because the cops found out how much trouble they were in. :) ) Keith Henson PS, EFF would seem like a good place to administer a defense fund.

3 2

Re: Apple planning to use Clipper chip?
by lefty＠apple.com 30 Aug '93

30 Aug '93

Tim May writes: >> >> The fact that Apple is reviewing the "key escrow" proposals probably >> implies other hardware makers are as well. This suggests a whole >> behind-the-scenes movement to get Clipper/Skipjack/Capstone key escrow >> chips designed into PCs, probably in the communications/modem/network >> subsections. >> To which Stig responds >It's quite fortunate, then, that the PC market is not monopolized as the >Macintosh market is. and Nate Sammons rejoins: >I think it signals a time to look into other platforms... The new >Silicon Graphics Indy looks quite good right about now. > >Just imagine the stickers we could put on those babies! > >"Big Brother built-in!" "Big Brother Inside!" come to mind, >among others. Now, first off, I'm not the one who originally propogated this rumor. And, as near as I can tell, rumor is exactly what it is. I would hope that people would make a minimal effort to obtain some facts before coming to conclusions. Just a suggestion, mind you. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

1 0

Re: Practical security, Internet commercialization, etc.
by nobody＠rosebud.ee.uh.edu 30 Aug '93

30 Aug '93

At 8:38 PM 8/27/93 -0700, Nick Szabo wrote: >Paul Ferguson: >> The biggest threat to any security, on any basis, is the threat of >> human nature. The chances of someone factoring your PGP encoded >> message is somewhere in the range of slim-to-none, but the chances >> of someone (you) -physically- compromising their key is much, much >> higher. > >I'd like to strongly second this >The most important >cypherpunks issues are being almost completely ignored by these academics: >practical implementation of remailers, most issues dealing with software- >based digital cash, reliable key handling, trustworhy key distribution, >construction of "webs of trust", implementation of these schemes with >all of their pitfalls (legal, social, etc.), commercialization, etc. > >In most of these cases, the protocols (ciphers, remailing mixes, >digital cash, etc.) can theoretically be "broken" by a powerful >agent, but the real question is what practical, cheap steps can we take >to make things more expensive for those with little respect for our >privacy or liberty. Yeah, its an arms race, and we don't have time to wait for the ultimate weapon. Similarly, it doesn't matter how ultimate the weapon is in the hands of someone who doesn't know how to use it. I wish that the generic security advice was separate from the IBM-flavored instructions in the PGP manual. It's very tedious for a Mac user.

1 0

Apple planning to use Clipper chip?
by tcmay＠netcom.com 30 Aug '93

30 Aug '93

A disturbing rumor/tidbit from the party I just finished discussing: Someone from Apple Computer said that Apple has been making "input" on the Clipper/Skipjack/Capstone/whatever thing and _endorsed_ the idea (or at least someone representing Apple did). Apple even discussed the pricing and said that if the Clipper/Skipjack chip could be sold to them for less than $30, they could "design it into every Mac." Phil Zimmermann was listening when this was said, and he was as shocked as I was. Can anyone on this list confirm or refute this report? (I don't want to name the Apple guy--several were at the party--unless he wants me to. But since he's not on the Cypherpunks list...) The fact that Apple is reviewing the "key escrow" proposals probably implies other hardware makers are as well. This suggests a whole behind-the-scenes movement to get Clipper/Skipjack/Capstone key escrow chips designed into PCs, probably in the communications/modem/network subsections. Speculatively, this could be a worse "fait accompli" than the Clipper proposal for phones, since not many people are planning to buy new secure phones, but a huge number of new Macs and PCs will be bought. (I assume folks can "wire around" the Skipjack/Capstone subroutines in some way, probably more easily than mods to the Clipper phones can be made. After all, it's software. So I don't claim the Feds will automatically be successful.) Many of us believe the "other shoe will drop" when a new Crime Bill (like the Biden Bill of a while back) is proposed, and key escrow is made mandatory for data systems. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. Note: I put time and money into writing this posting. I hope you enjoy it.

4 5