- cypherpunks-legacy - lists.cpunks.org

Re: on privacy in digital communications
by karn＠qualcomm.com 24 May '93

24 May '93

>From UC.Edu!Benjamin.Britton(a)cdp.igc.org Mon May 24 06:12:53 1993 > Anyone >who has grown up wondering why they did not prosecute the assassination >of President Kennedy has reason to fear the "Clipper Chip" technology. Because the only credible suspect was killed two days later, and there is no provision for posthumous trials in the US? This reminds me of that great exchange in the movie "Sneakers" between Dan Ackroyd and Sidney Poitier. From memory: Ackroyd: "You know, the NSA shot Kennedy". Poitier: "What? Now you're telling me that the NSA was responsible for the JFK assassination??" Ackroyd: "No, they only shot him. He's still alive..." I think it would help enormously if we Cypherpunks stayed focused on our core issue: the use of strong cryptography to protect personal privacy against all potential intruders, private or government. It will not help us to gain mainstream acceptance to blur our image with fringe conspiracy theorists, gun nuts, survivalists and the like. Phil

1 0

Re: cypto + compression
by peb＠PROCASE.COM 24 May '93

24 May '93

>if you're just using compress and you make that known Yes, this is worth pointing out; the main idea is to keep the opponent from knowing the format. Increasing the entropy via compressions is good in its own right since it makes the encoding more complex and provides more stumbling blocks. Cypher chaining seems to be even better for confounding opponents, but I'll let someone else commment on that. Paul E. Baclace peb(a)procase.com

1 0

on privacy in digital communications
by geoffw＠nexsys.net 24 May '93

24 May '93

Here is a post from a friend of mine who has been following the Clipper debacle. He told me to post it to whatever groups would be interested. ----- Begin Included Message -----

1 0

Another license server begs for cryptanalysis
by gnu 24 May '93

24 May '93

I love these servers where "a short encrypted string" can enable access to all sorts of things... ---------------------------------------------------------------------------- The Florida SunFlash Third Party Announcements SunFLASH Vol 53 #30 May 1993 ---------------------------------------------------------------------------- Subject: Viman Software Ships LicenseServ 3.0 - License Manager Newsgroups: comp.newprod Contact: Vikram Duvvoori Organization: Viman Software, Santa Cruz, California Phone: (800) 827-4590 (USA, Canada, Mexico); Ph: (408) 459-0678 FAX: (408) 458-2862 email: info(a)viman.com Viman Software Ships LicenseServ 3.0 on all major workstations. Santa Cruz, CA., Th. April 29, 1993 - Viman Software today announced the release of its next generation of network license manager, LicenseServ 3.0, for all major workstation platforms (including Sun, HP, NeXT, IBM RS/6000, DEC, SGI, Apollo and IBM PCs). LicenseServ is a licensing software package that allows software developers to support a wide range of licensing options including usage based licensing and full-featured evaluation copies. Existing customers who have been shipping their products with LicenseServ for over a year now have been extremely satisfied with their experience. Some complex applications were licensed by earlier customers within a few minutes and were shipping globally within one week. With a comprehensive set of features at an affordable price, LicenseServ brings sophisticated licensing within the reach of even small software developers. LicenseServ is available on more than twenty Unix platforms. Integration is straightforward as it only involves adding a few (3 in many cases) function calls to the application code. The licensing is transparent to end-users and the tools which come with LicenseServ make license management simple for system administrators at the end-user sites. This release introduces several new licensing features along with function-level compliance with the LS API 1.0 - a recent standard in license management. Software vendors license their applications by linking them to the LicenseServ libraries. The vendors then have a rich set of choices. A small sample of the range of licensing options includes: - Personal/Group Licenses (restricting usage to a set of users/machines) - Component Licenses (licensing different modules within an application) - Shared licenses (several users/machines sharing a single license) - Site licenses (usage restricted to a particular site) - Version control (licensing different versions of the same software) The licenses can be customized for each of the copies shipped. The software can be restricted to a limited number of concurrent copies running on the network, or node-locked to a particular set of machines. The vendor can easily create full-featured demo copies of applications that can be sent with a "time-bomb" which would prevent them from running beyond a certain date. Extensions of this date, or upgrading the demo to a full release, could then be done by simply sending a short encrypted string over the phone or facsimile. The basic version, LicenseServ Standard, lists at $2000 for the first platform and $1000 for each additional platform. The advanced version, LicenseServ Extended, lists at $ 5000 for the first platform and $ 2000 for each additional platform. All prices include 1 year of free technical support, upgrades and a 30 day money back guarantee. Viman Software is headquartered at 1320 Mission Street, Suite 5, Santa Cruz, CA 95060, USA. For more information please send email to info(a)viman.com or call toll-free (800) 827-4590 (408-459-0678 outside North America) or send a fax to (408) 458-2862 ---------------- LicenseServ, LS API 1.0, Sun, HP, NeXT, IBM RS/6000, DEC, SGI, Apollo and IBM are trademarks of their respective owners.

1 0

FAQ
by meyer 24 May '93

24 May '93

Damned line noise zapped this last time just as I was about to send it. I don't think it went (uustat apparently knew nothing of it), so here it is again: >From Eric Raymond's draft FAQ: >The Cypherpunks list exists to build and propagate privacy software. Our >aim is to give you the tools to communicate with other people and computers >in ways snoopers cannot tap. > >2. What are the essentials of privacy software? > a. Public-key cryptosystems for secure communication. > b. Unforgeable electronic signatures for message authentication. > c. DC-net or similar protocols to thwart spoofing. Privacy extends to more than just invulnerability to eavesdropping upon one's communications. One may have private records which are viewed only by oneself, and never communicated. A cryptosystem suitable for encryption of such non-communicated information need not be a public-key cryptosystem. Thus: 2 d. Cryptosystems for protecting privately-held information against unauthorized access.

1 0

on privacy in digital communications
by Benjamin.Britton＠UC.Edu 24 May '93

24 May '93

_______________________________________________________________________________ On Privacy in Digital Communications Taxpayers, legislators, social and governmental leaders do not yet realize that use of the "Clipper Chips" would make their most intimate, most highly private and proprietary information completely accessible through online information links to organized crime, foreign governments and the American national intelligence community. Anyone who has grown up wondering why they did not prosecute the assassination of President Kennedy has reason to fear the "Clipper Chip" technology. There is no need for absolute intrusability into the private lives or public records of American citizens. On the contrary, responsible governmental efforts should seek to rebuild such privacy by outlawing databases based on Social Security numbers and by codifying legal remedies against businesses which have illegally compromised public or private information. We should move, not away from citizens' rights in the new age of computing; rather we should use a blend of American democracy and high technology to make sure we retain the rights guaranteed to us by the American Constitution. It should be made illegal to encode a database of personnel information based on the Social Security numbers of the individuals. Such databases are inherently inaccurate and encourage covert searches for private information. Alphabetic listings of individuals names can be encoded with a unique key by an institution holding a database of personal information, for purposes of information retrieval. This key should be enciphered on a timely basis, such as during annual board meetings, by individuals in positions of legal responsibility in the organization. If the key is leaked by the organization, legal suit should be able to be brought to determine how the leak occurred, to punish the offenders if appropriate, and to establish a new key to the database with participation from the prosecuting judge and the defendant. Database encoding with this new key should then be legally required and enforced, and periodic encipherment of the code by the database holders should continu! e as before. A new function of law enforcement will need to develop; police, rather than being some of the greatest abusers of private information held in data networks, will have to become the enforcers of privacy and data security. If the police don't want to do this job, or if they feel they cannot, they should be fired and new police willing and able to guarantee the rights of citizens should be hired. Data security in cyberspace is a real concern, not only for the federal government, but also for local governments, businesses and individuals. The police will enforce the laws only if the laws are established, and they can serve as guardians of private data and personal information if such responsibilities are levied upon them. Data security, personal privacy, and the gross abuses of digital databases in the hands of white collar criminals are issues which lie at the heart of America's present malaise. If the government of the United States is not morally capable of taking on the challenge of instituting privacy in digital communications, we may look forward to years of gross criminality and abuses of human rights which will make the S&L scandals of the 1980's pale by comparison. But no government intent on enslaving the citizens who continuingly create it can stand. If our representatives in the Federal government cannot squirm free of the grips of organized crime, we may look forward to a distant national revolution. But no country, intent on guaranteeing the rights of its citizens, run by leaders with moral authority and free will, would seek consciously to hand the people over as slave/cattle to the organizers of international criminal cartels. The "Clipper Chip" technology as outlined in ! national press releases would guar antee and constitute such a wholesale handover of Americans. It would codify, promulgate and direct the destruction of privacy rights for all individuals by guaranteeing the availability of all information to anyone wealthy and corrupt enough to buy it. The alternative course is for our government to turn around completely, to build ways of defending the privacy of the individual against unnecessary search and seizure. The term privacy and its root word private will take on new meanings in the coming years. For example, records containing the votes you have cast in public elections during your life may be considered private, although the public institution of government is your only guarantor of that privacy. Goverment acts (supposedly) as conscious guarantor of the privacy and security of your participation in public affairs. They could certainly make the same efforts to secure your tax information, your demographic information, your legal records, your personal information derived during security background checks by intelligence agencies; but they do not. They encode all this with your social security number guaranteeing its accessibility to international criminal cartels operating outside the control of our government. The term "privatization" has come into vogue through its promotion by the international monetary fund during the 1980's (and continuing today); it has meant the han! ding over of publicly guaranteed e nforcement of citizens' rights to private individuals not accountable through democratic processes. Such handovers are a public concern, because they threaten the structure of legal enforcement which is the original reason for a democracy. Privatization conflicts with privacy, because it is through the self-interest of private citizens involved in participation in legal processes of government, such as through election to public office or participation in jury duties, that make a democracy work for the welfare of its individual citizens. When control is taken out of the hands of the public and handed over in the form of privatization, no citizen, except he or she who controls the private company, may defend their legal rights successfully and without preemption by default. The government exists to enable citizens' participation; such participation must be an inherent part of securing personal privacy in digital communications. I suggest that computing necessitates a reaction from government, and that reaction should properly be to defend the rights of citizens, including the right to privacy. A change in direction is called for; our government should support individuality. Public participation is essential to establish that no one has the right to our privacy. One may envision a 21st century public ceremony of encoding the National Database: A one-year-old child taps on a keyboard, and nationwide in realtime others do alike. This would be no guarantee of privacy, but far better than a quarantee of no privacy. Benjamin J. Britton May 24, 1993 Assistant Professor Electronic Art, Fine Arts University of Cincinnati Benjamin.Britton(a)uc.edu ________________________________________________________________________________

1 0

PGP: Environment protection for UNIX
by stig＠netcom.com 24 May '93

24 May '93

Phil & Cypherpunks: Here's a little program that demostrates a fairly simple way to immprove pgp security on multi-user systems.... main (int argn, char **argv, char **envv) { for ( ; *envv ; ++envv) { if (!strncmp(*envv,"PGP",3)) { char *c=*envv; while (*c) *c++=' '; } /* end of if */ } /* end of for */ system("printenv"); sleep(10); } It deletes from it's own environment any environment variable that begins with the string "PGP". It ain't bullet-proof but just by grepping the environment of netcom, I've identified several PGP users: yonder nickt centaur henderso This hack would prevent that... 'Course for UNIX, PGPPATH should default to $HOME/.pgp anyway. Not doin' the work I oughta be doing, Stig... /* Jonathan Stigelman, Stig(a)netcom.com, PGP public key on request */ /* fingerprint = 32 DF B9 19 AE 28 D1 7A A3 9D 0B 1A 33 13 4D 7F */

1 0

Re: cypto + compression
by bbyer＠BIX.com 24 May '93

24 May '93

In-Reply-To: <199305212303.AA21876(a)joes.GARAGE.COM> > In fact there are not. You can test this out; use PGP to encrypt any > file you please, and then use any compression software you like to > compress it. You will get no significant compression. I don't know if there will be any new redundancies or not, but PGP compresses it's output so you would naturally get no further compression. Ben Byer <bbyer(a)bix.com>

2 1

Re: Police protection
by mbriceno＠aol.com 24 May '93

24 May '93

> I've never felt safer than in such places [where lawabiding citezens are armed], and most would say > most such places are desirable, compared to say Washington DC > or New York where guns have been outlawed for ages. Except for > of course, those in the hands of the state and the criminals. > > Why in the world would you say otherwise? -- > > I think because he's thinking of places like Beirut, Somalia, Bosnia, > and so on. You know -- places without any effective central > government. Perhaps my post needed some clarification: I do not believe that a lawfull governmental police force becomes unneccessary once we hand every citizen a gun. Just as the police can not grant an unarmed public's security, an armed populace alone is no guarantee for safe streets. Only the combination of a well prepared public working together with a responsible government can make our lifes truely safe from infringementes by anti-social individuals. I beleive that if people were allowed to used crypto in all communication and carry a gun at all times, crime-be it street crime or white collar- would be reduced to levels far below the present rate. --Marc

1 0

draft FAQ
by esr＠snark.thyrsus.com 24 May '93

24 May '93

Here's the first draft of the FAQ. You'll see that it's basically a frame, an outline, and an intro. If you can fill in one of the sections, please do so and mail it to me. --- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION --- This is the Cypherpunks FAQ. It explains the projects and purposes of the Cypherpunks mailing list. It is also intended to serve as a general introduction to privacy and encryption issues. For details on the technical and theoretical aspects of computer cryptography, see the sci.crypt FAQ, available for FTP from rtfm.mit.edu (18.172.1.27) in the directory pub/usenet-by-group/sci.crypt. The cypherpunks archive is available for FTP at soda.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany, including the most up-to-date version of this FAQ. This FAQ is maintained by Eric S. Raymond <esr(a)snark.thyrsus.com>; send additions and corrections to that address. Sections contributed by others are credited to individual authors. We gratefully acknowledge, in addition, feedback and comments from David Mandl <dmandl(a)lehman.com> and Eric Hughes <hughes(a)soda.berkeley.edu>. 1. Why cypherpunks? Because privacy is essential to freedom. If the government (or any other oppressor that behaves like one) can effectively monitor communications, it can control or suppress them. And it will do so, because the natural tendency of controllers is always to seek more control. The government cannot be relied on to protect your privacy rights. Nor can anyone else --- certainly not your employer, or the corporations that want to know all about you so they can sell you things. Given half the chance, governments and corporations will always push for security standards that protect *them*, but not *you*. Computer technology can help protect you against would-be snoopers, but only if somebody is sufficiently smart and dedicated to build the tools. The Cypherpunks list exists to build and propagate privacy software. Our aim is to give you the tools to communicate with other people and computers in ways snoopers cannot tap. 2. What are the essentials of privacy software? a. Public-key cryptosystems for secure communication. b. Unforgeable electronic signatures for message authentication. c. DC-net or similar protocols to thwart spoofing. 3. What are the potential applications of good privacy software? a. Secure communications. b. Digital cash. c. Electronic voting. d. Electronic contracts. e. Secure anonymous remailers and posters. f. <more?> 4. What are the key algorithms, tools, and implementations for privacy software? a. RSA b. DES c. Clipper/Capstone/DSS d. PGP e. Possible non-RSA trapdoor functions. 5. What are the social and political implications of good privacy software? a. Drastically lower transaction costs for trade. b. Expansion of the counter-economy. c. Disempowerment of government. d. Anonymity for whistleblowers. 6. What are the legal, political, and technical obstacles? a. The Clipper/Capstone/DSS power grab. b. The RSA patent and the PGP/RSA fight. c. RSA's base problem may not be NP-complete. 7. What can I do to help? a. Work on cryptographic software. <this subsection should list current projects> b. Agitate against the Clipper/Capstone/DES standard. c. Promote the use of encrypted communication, help spread PGP and other appropriate tools far and wide (both to help get a better foothold to thwart the Clipper monopoly and its ilk, and to work towards making crypto as commonplace as envelopes). To join the cypherpunks mailing list, send a request to: cypherpunks(a)toad.com Working with us could be your best shot at stopping Big Brother. So if you have skills to contribute, act now. The freedom you save could be your own. --- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION ---- DRAFT VERSION --- -- >>eric>>

1 0