- cypherpunks-legacy - lists.cpunks.org

No Subject
by nobody＠eli-remailer 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- I don't think the idea of a "virtual server" for anonymity will really accomplish much. Even if you somehow manage to spread the software over several machines, you still need to publicize the entry and exit points for remailing requests. If the net police determine to shut down the server, they can go after those machines which are publically known to be the places where the anonymous messages come from and shut them down. Sure, if you have a network of machines you might be able to bring another one online pretty quickly to replace this one which has been shut down. But then the net police can go after that one. And so on. You'd get the same effect just by having a bunch of conventional remailing servers, only announcing one of them publically, and then having each one come online only after the one before it got shut down. The hard part in either of these scenarios is collecting more people who will run anonymity servers. I don't see that doing tricky stuff with virtualizing the calculations helps you much. Similarly, trying to put a machine at an unknown site, or perhaps in a friendly country, won't necessarily help. If the machine itself is inaccessible, the net police will go after its feeds, the points at which it connects into the network. Look at what happened to Julf. His machine was safe, sitting in a back room of his house. They went after his net feeds instead. The real answer is to publically defend remailers. I argue for remailing servers on the basis of preventing traffic analysis. Most people accept that the use of encryption is justified for email in order to protect individual privacy. I claim that remailing servers extend this protection to include not only the content of a message, but its destination as well. The net does little today to keep the facts private about whom you communicate with. Remailers provide that confidentiality. If we had enough remailers that we could confidentally run a virtualized system, knowing that we could keep brining them online faster than they could be shut down, I'd argue that a better use of those resources would be to publically identify all of the remailers and let them all operate on their own. This would provide a united front to oppose the anti-privacy forces, giving political strength to our goals. Hal Finney 74076.1041(a)compuserve.com -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAtoGqgTA69YIUw3AQGFeQQAsnAHwZpe+BRzhp9umLJzWJDFgcHYYYwu Bp5GJI2LmhQWB1pNluLxupW/ZZZqlO78HApOcU9jL/eFEhZakoAd4RJPVBjXpadm w1vkfSDQ6qXKnPyj28FM1sm3eSyfRu3evAd8+MfGNFOlCeyrYNfya6G3OBOcwpf1 bJFe7upKVVQ= =8apG -----END PGP SIGNATURE-----

4 3

"Newsweek" Article on Clipper and Encryption
by tcmay＠netcom.com 02 Jun '93

02 Jun '93

The following appeared in this week's "Newsweek," June 7, 1993, p. 70. Our own Eric Hughes is briefly quoted. Any mistakes are the fault of either me or my OCR program. The Code of the Future Uncle Sam wants you to use ciphers it can crack Forget the castle. If only Queen Elizabeth had given Chuck and Di a thumbnail-size computer chip for their wedding, she would have been spared reading in the London tabs how her son" wanted to live in [his lover's] trousers," among other excerpts from taped phone conversations. Instead, the chip would have converted their words into "hsssssss." No signal analyzer, no supercomputer, no wiretap could have decoded the white noise. The device that works this reputation-saving magic is called a Data Encryption Standard (DES) chip, and there's no practical way to crack it. That's what America's supersecret spymasters, the National Security Agency, intended when they designed the cryptographic system in the 1970s with IBM. While that delights industry and privacy advocates, it's come back to haunt the government: wiretaps are useless against any suspect using a DES-encrypted phone. So in April the Clinton administration announced it was backing the NSA in its push to impose a universal encryption standard to which the Feds alone would hold the keys. The agency argues that's the only way to ensure it will always be able to decode foreign communications. Civil libertarians and corporations don't see it that way. Says computer-security expert Eric Hughes of Berkeley," The government is saying, 'If you want to lock something up, you have to [give us] the key'." No one doubts that the nation's voice, data, electronic mail and other communications need locks, and fast. Industrial spies grab fax, e-mail and other computer and microwave transmissions out of the air. Hackers broke into Internet, a world-wide computer network, 773 times last year, 90 percent more than in 1991. Hackers also peek into computers that hold medical records, credit-card purchases, even video rentals. Cellular phones offer as much privacy as going on "Oprah." The FBI can't keep up with all the cybercrime. Secret codes can, and since World War, II codes have been based on algorithms--formulas that transform one set of numbers into another. NSA's new chip, to be used in a secure phone sold by AT&T, encrypts computer transmissions and phone conversations with an algorithm so complex "it would take a CRAY YMP [supercomputer] over a billion years to solve," says Raymond Kammer of the National Institute of Standards and Technology (NIST), which worked with NSA on the algorithm. Yet the principle is simple. A sending phone and a receiving phone electronically choose one algorithm, out of millions, for their conversation (diagram). The only way to unscramble the resulting 10001100101s is to obtain the "keys," which will be held by two agencies chosen by the attorney general. The agencies-this is the part NSA likes-would give them to officials who have the requisite wiretap warrant. But industry has a couple of problems with this. First, NSA has yet to explain how the chip works, so outside verification that it's hackproof will have to wait. Worse, with millions of NSA chips in use, the agencies holding the keys would have to store them on computers, which are vulnerable to recreational hackers, foreign spooks and industrial spies. For now, no one is forced to use the NSA chip. But manufacturers who put a rival chip into, say, their modems would likely be denied government contracts, as well asexport licenses for the NSA-proof products. Even that may not appease the spymasters. "No one rules out a mandatory encryption standard," says NIST spokesman Mat Heyman. That's industry's greatest fear, which NIST will attempt to allay in meetings this week. And next week Rep. Edward Markey holds hearings on whether NSA can keep the keys to its codes safe from hackers. Or even Fleet Street. SHARON BEGLEY with MELINDA LIU in Washington and JOSHUA COOPER RAMO

2 1

Clipper
by RYAN Alan Porter 02 Jun '93

02 Jun '93

Just out of curiosity, does anyone on the cypherpunks list posess the technical skills that would be necessary to begin a project of hacking out a pin compatible version of the Clipper that didn't have the backdoors once the chip is out, a la AMD and CYRIX? If not, it would seem that we need to get some hardware geeks involved, as well as all of these software people around here, since crypto issues are moving more and more into the hardware, VLSI playing field. ("Cypherpunks write code.... and microcode"??) It would seem that one of the most direct ways to attack Clipper would be to pull another PGP, just create a chip that acts just like one, but a chip that we understand and we designed. There would be totally different problems involved, the Feds could much more easily seize chip production facilities, design would be more difficult, free distribution would be more difficult... I think that it would be quite possible, however. I mean, if an attack is truly to be made on the Clipper, writing letters to feds certainly won't help, the only thing that will help is making their proposal ineffective and uneconomical. Think about it, if a truly secure chip existed, it's sale would be almost certain; all of the 'criminals' that the feds are so afraid of would be sure to find us and buy one, not to mention every self respecting cypherpunk and cyberpunk in the universe, law enforcement agencies might even get into buying black market chips to protect themselves from escrow leaks... Also, if all of these shady types that the feds are using for their tactical arguments have truly secure chips anyway, all of the aformentioned arguments are rendered moot. So I guess the really important question is: does anybody know how to reverse engineer a chip and build a duplicate, pin-compatible device from the ground up while hiding from the feds the whole time and still managing to make a living? I guess that's a pretty rough question, but hey, this is war, right? -Ryan the Bit Wallah

1 0

eavesdropping druggies
by Phil Karn 02 Jun '93

02 Jun '93

Today's San Diego Union Tribune has a locally-written article on the investigation into the murder of the Mexican cardinal by drug gangs. The title is "Drug gangs eavesdrop on rivals", and begins as follows:L "TIJUANA - The two rival drug gangs whose attempts to kill each other's leadership have left a Mexican cardinal and six others dead apparently have been using sophisticated electronic gear to monitor each other's movements, Mexican authorities reported yesterday. "In addition to the assault rifles, grenades and police and army uniforms being discovered in a series of safe houses, Mexican federal police are reporting finding devices designed to trace and monitor calls made from cellular telephones. "They also are finding sophisticated communications-monitoring equipment, walkie-talkies, tape recorders and pages upon pages of documents." The article continues with other developments in the investigation unrelated to electronic eavesdropping. A few (semi-serious) thoughts come to mind: 1. Perhaps the government doesn't want secure telephones in the hands of the drug lords not so much because it will thwart wiretapping by law enforcement, but because it will protect the gangs from each other -- and they aren't inhibited by Constitutional requirements. 2. Gee. I thought the cellular eavesdropping problem was completely solved by the recent ban on cellular-capable scanners. 3. I can't wait for the Federales to discover computers with PGP in one of these safehouses. And when it does, expect all hell to break loose in the crypto propaganda war. Phil

1 0

What do cypherpunks use?
by J. Michael Diehl 02 Jun '93

02 Jun '93

Since Cypherpunks write code, I thought it might be interesting to find out what kinds of systems cypherpunks USE. If you would be so kind as to fill out the included questionaire, I'll summerize. Thanx in advance. What kind of system do you use? What OS do you use? What mail reader do you use? Which online services do you use? Do you use pgp? Which version? If you use a personal computer, what communications program do you use? +-----------------------+-----------------------------+---------+ | J. Michael Diehl ;-) | I thought I was wrong once. | PGP KEY | | mdiehl(a)triton.unm.edu | But, I was mistaken. |available| | mike.diehl(a)fido.org | | Ask Me! | | (505) 299-2282 +-----------------------------+---------+ | | +------"I'm just looking for the opportunity to be -------------+ | Politically Incorrect!" <Me> | +-----If codes are outlawed, only criminals wil have codes.-----+ +----Is Big Brother in your phone? If you don't know, ask me---+

1 0

Re: request for cryptanalysis tools
by nobody＠eli-remailer 02 Jun '93

02 Jun '93

Eric Hughes asked about the piece of software I'm cryptanalyzing... > Could you post a more complete pointer to this? The program is "ncrypt". Available on garbo.uwasa.fi, /pc/crypt/ncrypt31.zip About pub/cypherpunks/cryptanalysis... I'll post anything useful that I write... > The directory is there as much to inspire the writing of such software > as it is to distribute it. Point taken! -cire

1 0

Re: [daemon@ATHENA.MIT.EDU : FYI: White House EMail]
by smb＠research.att.com 02 Jun '93

02 Jun '93

Glad to hear the White House in on the net, but where's the PEM certificate for those addressses?

1 0

Cypherpunks do what?
by fergp＠sytex.com 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- I'm all for cypherpunk code-writing; I'm all for crypto for the masses. In fact, I'm working it on a real-time basis, boys and girls. Somehow, I feel a bit slighted, and it goes a little beyond myself, if it need be known. I'm really not stupid enough to squeak without provocation. :-) I'd like to, additionally, see a sub-paragraph in the FAQ concerning non-code-writing exploits, such as the tedious task of accosting politicos. Is this not a desired activity? I shudder to think that cypherpunks would corner themselves in a manner which would exclude political maneuvers. IMHO, any cypherpunk who would close themselves off from political fire is either brilliant or idiotic, dependent upon method or mentality. Me -- I'll take the questionable route; I would rather get the answers I seek, sow the seeds of incongruity and ask questions of pertinent people. I'm asking that Eric Raymond add to "What do Cypherpunks do?" lineage, "Cypherpunks also do a lot of monkey-wrench work." We also run political gauntlets. We also draw attention, while other projects are accomplished. We also encourage other politico brethren of internationalities to join us in our struggle for electronic and cryptographic independence. We also interface with those turkeys on capitol hill (non-caps). Cypherpunks do more than write simple code -- we set precedence, we deliver technology. Cheers. -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAwBGpRLcZSdHMBNAQHGIQP/YxBKfkjehoJawjExagITkr7emoEp3eMq wnj2Vp54dh8C8wfNdf+ovbT8siOfIT135ucLZQLDifLqp/iUgpnwk80Ur0427WSP Leb/UmLDm8HNO3gLyjDZ4YeLH++/qBiFb3Ej2+6ACyMc4wIUCXwKLnp1Ov3+E9vY 3Tjb25WVtXQ= =pLmj -----END PGP SIGNATURE----- Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0

[daemon@ATHENA.MIT.EDU : FYI: White House EMail]
by marc＠Athena.MIT.EDU 02 Jun '93

02 Jun '93

------- Forwarded transaction [5834] daemon(a)ATHENA.MIT.EDU (Dave Farber) Commercialization & Privatization of the Internet 06/01/93 20:26 (90 lines) Subject: FYI: White House EMail Date: Tue, 1 Jun 1993 20:25:47 -0500 From: Dave Farber <farber(a)central.cis.upenn.edu> To: com-priv(a)psi.com THE WHITE HOUSE Office of Presidential Correspondence ______________________________________________________________ For Immediate Release June 1, 1993 LETTER FROM THE PRESIDENT AND VICE PRESIDENT IN ANNOUNCEMENT OF WHITE HOUSE ELECTRONIC MAIL ACCESS Dear Friends: Part of our commitment to change is to keep the White House in step with today's changing technology. As we move ahead into the twenty-first century, we must have a government that can show the way and lead by example. Today, we are pleased to announce that for the first time in history, the White House will be connected to you via electronic mail. Electronic mail will bring the Presidency and this Administration closer and make it more accessible to the people. The White House will be connected to the Internet as well as several on-line commercial vendors, thus making us more accessible and more in touch with people across this country. We will not be alone in this venture. Congress is also getting involved, and an exciting announcement regarding electronic mail is expected to come from the House of Representatives tomorrow. Various government agencies also will be taking part in the near future. Americans Communicating Electronically is a project developed by several government agencies to coordinate and improve access to the nation's educational and information assets and resources. This will be done through interactive communications such as electronic mail, and brought to people who do not have ready access to a computer. However, we must be realistic about the limitations and expectations of the White House electronic mail system. This experiment is the first-ever e-mail project done on such a large scale. As we work to reinvent government and streamline our processes, the e-mail project can help to put us on the leading edge of progress. Initially, your e-mail message will be read and receipt immediately acknowledged. A careful count will be taken on the number received as well as the subject of each message. However, the White House is not yet capable of sending back a tailored response via electronic mail. We are hoping this will happen by the end of the year. A number of response-based programs which allow technology to help us read your message more effectively, and, eventually respond to you electronically in a timely fashion will be tried out as well. These programs will change periodically as we experiment with the best way to handle electronic mail from the public. Since this has never been tried before, it is important to allow for some flexibility in the system in these first stages. We welcome your suggestions. This is an historic moment in the White House and we look forward to your participation and enthusiasm for this milestone event. We eagerly anticipate the day when electronic mail from the public is an integral and normal part of the White House communications system. President Clinton Vice President Gore PRESIDENT(a)WHITEHOUSE.GOV VICE.PRESIDENT(a)WHITEHOUSE.GOV ### ------- End of Forwarded Message ------ End of Forwarded Message --[5834]-- ------- End forwarded transaction

1 0

Newsweek Clipper Coverage
by L. Detweiler 01 Jun '93

01 Jun '93

Under `Society -- Technology' in Newsweek of June 7 1993 p.70 appears the headline `The Code of the Future' subhead `Uncle Sam wants you to use ciphers it can crack'. This 1 page article is pretty ambitious for what it tries to cover. The figure shows a flowchart for encryption over a phone using a key. (Not particularly illuminating. In particular the role & point of the key is ambiguous.) At the bottom 1/4 page we have a sidebar ``Great Moments in Cryptography' with 1st known encryption (Egyptian), the Zimmerman Telegram role in WWI, the Japanese Purple breakthrough prior to Pearl Harbor (the picture is apparently Friedman holding the machine), and finally Nov 4 1952 (a day that will live in infamy), Truman creates the NSA, `master of math based codes'. The article notes in the lead-in a cute & useful `hook' for the public & popular role of cryptography I have been drawing for a long time for nontechnical friends, saying that with it Queen Elizabeth could have been spared the spectacle of the steamy Prince Charles phone revelations and eavesdroppers would have heard nothing but a hiss, and `no signal analyzer, no supercomputer, no wiretap could have decoded the white noise.' Fortunately, they attribute this `reputation saving magic' not to Clipper but a DES chip. ``That's what America's supersecret spymasters, the NSA, intended when they designed the cryptographic system in the 70s with IBM.'' (glaring errata; their involvement has always been officially claimed as *secondary* and *subsidiary* to IBM's, if even at all. But, it is an error in our favor.) Article doesn't mention Clipper by name, but says it was essentially a response to the unbreakable aspects of DES using key system. Eric Hughes, `computer security expert [at] Berkeley': ``The government is saying, `If you want to lock something up, you have to [give us] the key'.'' Next, the motivation. Our networks are insecure, Internet ``broken into 90 percent more times than 1991'' (where'd that little statistic come from? Gene Spafford?). Security of medical records, credit-card purchases, video rentals, cellular phones at stake. NSA chip used by AT&T would take a supercomputer over a billlion years to solve, says R. Kammer of NIST. Problems: NSA hasn't revealed the algorithm so nobody knows if its `hackproof'; agencies holding keys are vulnerable to `recreational hackers, foreign spooks, and industrial spies.' Here comes the gut-wrencher. ``For now now one is forced to use the NSA chip. But manufacturers who put a rival chip into, say, their modems would likely be denied government contracts, as well as export licenses for the NSA-proof products. Even that may not appease the spymasters. ***No one rules out a mandatory encryption standard,'' says NIST spokesman Mat Heyman.***'' Is that quote from the point of view `our concerns on this have not been allayed' or in the vein `all the NSA henchmen I know are chomping at the bit to legislate a monopoly or outlaw non-Clipper chips'? Overall, I'd say a favorable article that covers the basics, and rather excellent editing given the severe space limitation (less than many newspaper articles). Written by Sharon Begley with Melinda Liu in Washington and Joshua Cooper Ramo. * * * Cypherpunks, I'm extremely concerned about these little quotes popping up in the media. Just a few days ago we hear in the Washington Post: > Administration sources said that if the current plan doesn't >enable the NSA and FBI to keep on top of the technology, then Clinton >is prepared to introduce legislation to require use of its encryption >technology, which is crackable by the NSA, and to ban use of the >uncrackable gear. > "It's an option on the table," said a White House official. I sure hope that `official' has absolutely nothing to do with Clipper, but that's unlikely. It seems to me these are the sounds of a slow, sinister rumbling underway. Sometimes quotes like these are `floated trial balloons' but other times they are grotesque flickers of real internal machinations. The more I hear them the more I think they are in the latter category. So far, the administration and media just don't `get it' that a firestorm is in the making over any hair-thin deviation from the standard of `no domestic regulation of encryption'. If NSA & the administration thinks that the Clipper brouhaha was containable, just wait until they go a nanometer past it in the wrong direction. Actually, a Supreme Court case on cryptography issues seems in some ways to be inevitable. Wow, I'd say there'd probably be enough artillery to seriously damage NSA in that confrontation. Cypherpunks, I'd like to compile a list of all quotations on the `regulation of domestic cryptography' topic. That way we'll have a propaganda poster all ready if any idiot bureacrat thinks they can thumb their nose any further. I have the original announcement text and the Washington Post text above. It seems to me that an NIST representative claimed there were `no plans' to outlaw other cryptography. Where was that? Can everyone send me whatever they have on this topic? P.S. Many tx. to E.H. for the thorough and excellent collection in soda.berkeley.edu:/pub/cypherpunks/clipper. - - - For reference, here are the original Orwellian weasel words form the April 16 announcement: Q: If the Administration were unable to find a technological solution like the one proposed, would the Administration be willing to use legal remedies to restrict access to more powerful encryption devices? A: This is a fundamental policy question which will be considered during the broad policy review. The key escrow mechanism will provide Americans with an encryption product that is more secure, more convenient, and less expensive than others readily available today, but it is just one piece of what must be the comprehensive approach to encryption technology, which the Administration is developing. The Administration is not saying, "since encryption threatens the public safety and effective law enforcement, we will prohibit it outright" (as some countries have effectively done); nor is the U.S. saying that "every American, as a matter of right, is entitled to an unbreakable commercial encryption product." There is a false "tension" created in the assessment that this issue is an "either-or" proposition. Rather, both concerns can be, and in fact are, harmoniously balanced through a reasoned, balanced approach such as is proposed with the "Clipper Chip" and similar encryption techniques.

1 0