- cypherpunks-legacy - lists.cpunks.org

Eerie silence....
by fergp＠sytex.com 07 May '93

07 May '93

Gee, what happened guys? I've had nary a stick of mail all today. Don't tell me the mail server crashed? Cheers. Paul Ferguson | Uncle Sam wants to read Network Integrator | your e-mail... Centreville, Virginia USA | Just say "NO" to the Clipper fergp(a)sytex.com | Chip... -------------------------------+------------------------------ I love my country, but I fear it's government.

2 1

ITAR info
by fergp＠sytex.com 07 May '93

07 May '93

Mike Godwin <uunet!eff.org!mnemonic> writes - > The best person on the Net to ask about the ITARs is, IMHO, > Lee Tien, the lawyer handling John Gilmore's cryptography-related > litigation. Lee can be reached at tien(a)well.sf.ca.us. Mr. Tien, I have bothered Mike Godwin and Shari Steele to the point of no return in legalese. (Blame them for pointing me in your direction.) Actually, I'm quite curious of the ITAR restrictions of cryptologic software/hardware legislation currently on the books and the chances of it being scaled back in light of the current "Clipper" fiasco. I'm well aware of the legal provisions within USC Title 18, and the ECPA but have no idea of additional transcripts that exist that the Dept. of State which have been circumscribed to regulate and tariff. Would you be so kind as to enlighten me (us) of the ITAR stuff that many of us have heard so much about? I know Phil Zimmerman has made limited mention of ITAR restrictions, so I think that we need to first lift the veil of ignorance. Thanks for your anticipated response. Cheers. Paul Ferguson | Uncle Sam wants to read Network Integrator | your e-mail... Centreville, Virginia USA | Just say "NO" to the Clipper fergp(a)sytex.com | Chip... -------------------------------+------------------------------ I love my country, but I fear it's government.

1 0

Legal Net News
by fergp＠sytex.com 07 May '93

07 May '93

Due to the increasing demands of external activities, Legal Net News will discontinue being sent on a mailing list. My apologies go out to all of you who sent subscription requests. Legal Net News will, however, continue to be compiled, produced, released and archived on a regular basis. It can be found at the following locations: Publicly Accessable BBS's ------------------------- The SENTRY Net BBS Arlington Software Exchange Centreville, Virginia USA Arlington, Virginia USA +1-703-815-3244 +1-703-532-7143 To 9,600 bps To 9,600 bps The Internet ------------ Legal Net News is available at the following archive site(s)- tstc.edu (161.109.128.2) Directory: /pub/legal-net-news Login as ANONYMOUS and use your net ID (for example: fergp(a)sytex.com) as the password. The most recently released issue was volume 1, issue 4 dated 6 May, 1993 and is in the following formmat: Filename Filename Compressed ASCII Vol 1, Issue 1 LNM0493.ZIP LNM0493.TXT Vol 1, Issue 2 LNN0102.ZIP LNN1.002 Vol 1, Issue 3 LNN0103.ZIP LNN1.003 Vol 1, Issue 4 LNN0104.ZIP LNN1.004 Thanks for the interest. Cheers. Paul Ferguson | Uncle Sam wants to read Network Integrator | your e-mail... Centreville, Virginia USA | Just say "NO" to the Clipper fergp(a)sytex.com | Chip... -------------------------------+------------------------------ I love my country, but I fear it's government.

1 0

New NIST/NSA Revelations
by Dave Banisar 07 May '93

07 May '93

New NIST/NSA Revelations Less than three weeks after the White House announced a controversial initiative to secure the nation's electronic communications with government-approved cryptography, newly released documents raise serious questions about the process that gave rise to the administration's proposal. The documents, released by the National Institute of Standards and Technology (NIST) in response to a Freedom of Information Act lawsuit, suggest that the super-secret National Security Agency (NSA) dominates the process of establishing security standards for civilian computer systems in contravention of the intent of legislation Congress enacted in 1987. The released material concerns the development of the Digital Signature Standard (DSS), a cryptographic method for authenticating the identity of the sender of an electronic communication and for authenticating the integrity of the data in that communication. NIST publicly proposed the DSS in August 1991 and initially made no mention of any NSA role in developing the standard, which was intended for use in unclassified, civilian communications systems. NIST finally conceded that NSA had, in fact, developed the technology after Computer Professionals for Social Responsibility (CPSR) filed suit against the agency for withholding relevant documents. The proposed DSS was widely criticized within the computer industry for its perceived weak security and inferiority to an existing authentication technology known as the RSA algorithm. Many observers have speculated that the RSA technique was disfavored by NSA because it was, in fact, more secure than the NSA-proposed algorithm and because the RSA technique could also be used to encrypt data very securely. The newly-disclosed documents -- released in heavily censored form at the insistence of NSA -- suggest that NSA was not merely involved in the development process, but dominated it. NIST and NSA worked together on the DSS through an intra-agency Technical Working Group (TWG). The documents suggest that the NIST-NSA relationship was contentious, with NSA insisting upon secrecy throughout the deliberations. A NIST report dated January 31, 1990, states that The members of the TWG acknowledged that the efforts expended to date in the determination of a public key algorithm which would be publicly known have not been successful. It's increasingly evident that it is difficult, if not impossible, to reconcile the concerns and requirements of NSA, NIST and the general public through using this approach. The civilian agency's frustration is also apparent in a July 21, 1990, memo from the NIST members of the TWG to NIST director John W. Lyons. The memo suggests that "national security" concerns hampered efforts to develop a standard: THE NIST/NSA Technical Working Group (TWG) has held 18 meetings over the past 13 months. A part of every meeting has focused on the NIST intent to develop a Public Key Standard Algorithm Standard. We are convinced that the TWG process has reached a point where continuing discussions of the public key issue will yield only marginal results. Simply stated, we believe that over the past 13 months we have explored the technical and national security equity issues to the point where a decision is required on the future direction of digital signature standards. An October 19, 1990, NIST memo discussing possible patent issues surrounding DSS noted that those questions would need to be addressed "if we ever get our NSA problem settled." Although much of the material remains classified and withheld from disclosure, the "NSA problem" was apparently the intelligence agency's demand that perceived "national security" considerations take precedence in the development of the DSS. From the outset, NSA cloaked the deliberations in secrecy. For instance, at the March 22, 1990, meeting of the TWG, NSA representatives presented NIST with NSA's classified proposal for a DSS algorithm. NIST's report of the meeting notes that The second document, classified TOP SECRET CODEWORD, was a position paper which discussed reasons for the selection of the algorithms identified in the first document. This document is available at NSA for review by properly cleared senior NIST officials. In other words, NSA presented highly classified material to NIST justifying NSA's selection of the proposed algorithm -- an algorithm intended to protect and authenticate unclassified information in civilian computer systems. The material was so highly classified that "properly cleared senior NIST officials" were required to view the material at NSA's facilities. These disclosures are disturbing for two reasons. First, the process as revealed in the documents contravenes the intent of Congress embodied in the Computer Security Act of 1987. Through that legislation, Congress intended to remove NSA from the process of developing civilian computer security standards and to place that responsibility with NIST, a civilian agency. Congress expressed a particular concern that NSA, a military intelligence agency, would improperly limit public access to information in a manner incompatible with civilian standard setting. The House Report on the legislation noted that NSA's natural tendency to restrict and even deny access to information that it deems important would disqualify that agency from being put in charge of the protection of non-national security information in the view of many officials in the civilian agencies and the private sector. While the Computer Security Act contemplated that NSA would provide NIST with "technical assistance" in the development of civilian standards, the newly released documents demonstrate that NSA has crossed that line and dominates the development process. The second reason why this material is significant is because of what it reveals about the process that gave rise to the so- called "Clipper" chip proposed by the administration earlier this month. Once again, NIST was identified as the agency actually proposing the new encryption technology, with "technical assistance" from NSA. Once again, the underlying information concerning the development process is classified. DSS was the first test of the Computer Security Act's division of labor between NIST and NSA. Clipper comes out of the same "collaborative" process. The newly released documents suggest that NSA continues to dominate the government's work on computer security and to cloak the process in secrecy, contrary to the clear intent of Congress. On the day the Clipper initiative was announced, CPSR submitted FOIA requests to key agencies -- including NIST and NSA -- for information concerning the proposal. CPSR will pursue those requests, as well as the pending litigation concerning NSA involvement in the development of the Digital Signature Standard. Before any meaningful debate can occur on the direction of cryptography policy, essential government information must be made public -- as Congress intended when it passed the Computer Security Act. CPSR is committed to that goal. *************************************************** David L. Sobel CPSR Legal Counsel (202) 544-9240 dsobel(a)washofc.cpsr.org

1 0

New NIST/NSA Revelations (by CPSR)
by Dave Banisar 06 May '93

06 May '93

New NIST/NSA Revelations Less than three weeks after the White House announced a controversial initiative to secure the nation's electronic communications with government-approved cryptography, newly released documents raise serious questions about the process that gave rise to the administration's proposal. The documents, released by the National Institute of Standards and Technology (NIST) in response to a Freedom of Information Act lawsuit, suggest that the super-secret National Security Agency (NSA) dominates the process of establishing security standards for civilian computer systems in contravention of the intent of legislation Congress enacted in 1987. The released material concerns the development of the Digital Signature Standard (DSS), a cryptographic method for authenticating the identity of the sender of an electronic communication and for authenticating the integrity of the data in that communication. NIST publicly proposed the DSS in August 1991 and initially made no mention of any NSA role in developing the standard, which was intended for use in unclassified, civilian communications systems. NIST finally conceded that NSA had, in fact, developed the technology after Computer Professionals for Social Responsibility (CPSR) filed suit against the agency for withholding relevant documents. The proposed DSS was widely criticized within the computer industry for its perceived weak security and inferiority to an existing authentication technology known as the RSA algorithm. Many observers have speculated that the RSA technique was disfavored by NSA because it was, in fact, more secure than the NSA-proposed algorithm and because the RSA technique could also be used to encrypt data very securely. The newly-disclosed documents -- released in heavily censored form at the insistence of NSA -- suggest that NSA was not merely involved in the development process, but dominated it. NIST and NSA worked together on the DSS through an intra-agency Technical Working Group (TWG). The documents suggest that the NIST-NSA relationship was contentious, with NSA insisting upon secrecy throughout the deliberations. A NIST report dated January 31, 1990, states that The members of the TWG acknowledged that the efforts expended to date in the determination of a public key algorithm which would be publicly known have not been successful. It's increasingly evident that it is difficult, if not impossible, to reconcile the concerns and requirements of NSA, NIST and the general public through using this approach. The civilian agency's frustration is also apparent in a July 21, 1990, memo from the NIST members of the TWG to NIST director John W. Lyons. The memo suggests that "national security" concerns hampered efforts to develop a standard: THE NIST/NSA Technical Working Group (TWG) has held 18 meetings over the past 13 months. A part of every meeting has focused on the NIST intent to develop a Public Key Standard Algorithm Standard. We are convinced that the TWG process has reached a point where continuing discussions of the public key issue will yield only marginal results. Simply stated, we believe that over the past 13 months we have explored the technical and national security equity issues to the point where a decision is required on the future direction of digital signature standards. An October 19, 1990, NIST memo discussing possible patent issues surrounding DSS noted that those questions would need to be addressed "if we ever get our NSA problem settled." Although much of the material remains classified and withheld from disclosure, the "NSA problem" was apparently the intelligence agency's demand that perceived "national security" considerations take precedence in the development of the DSS. From the outset, NSA cloaked the deliberations in secrecy. For instance, at the March 22, 1990, meeting of the TWG, NSA representatives presented NIST with NSA's classified proposal for a DSS algorithm. NIST's report of the meeting notes that The second document, classified TOP SECRET CODEWORD, was a position paper which discussed reasons for the selection of the algorithms identified in the first document. This document is available at NSA for review by properly cleared senior NIST officials. In other words, NSA presented highly classified material to NIST justifying NSA's selection of the proposed algorithm -- an algorithm intended to protect and authenticate unclassified information in civilian computer systems. The material was so highly classified that "properly cleared senior NIST officials" were required to view the material at NSA's facilities. These disclosures are disturbing for two reasons. First, the process as revealed in the documents contravenes the intent of Congress embodied in the Computer Security Act of 1987. Through that legislation, Congress intended to remove NSA from the process of developing civilian computer security standards and to place that responsibility with NIST, a civilian agency. Congress expressed a particular concern that NSA, a military intelligence agency, would improperly limit public access to information in a manner incompatible with civilian standard setting. The House Report on the legislation noted that NSA's natural tendency to restrict and even deny access to information that it deems important would disqualify that agency from being put in charge of the protection of non-national security information in the view of many officials in the civilian agencies and the private sector. While the Computer Security Act contemplated that NSA would provide NIST with "technical assistance" in the development of civilian standards, the newly released documents demonstrate that NSA has crossed that line and dominates the development process. The second reason why this material is significant is because of what it reveals about the process that gave rise to the so- called "Clipper" chip proposed by the administration earlier this month. Once again, NIST was identified as the agency actually proposing the new encryption technology, with "technical assistance" from NSA. Once again, the underlying information concerning the development process is classified. DSS was the first test of the Computer Security Act's division of labor between NIST and NSA. Clipper comes out of the same "collaborative" process. The newly released documents suggest that NSA continues to dominate the government's work on computer security and to cloak the process in secrecy, contrary to the clear intent of Congress. On the day the Clipper initiative was announced, CPSR submitted FOIA requests to key agencies -- including NIST and NSA -- for information concerning the proposal. CPSR will pursue those requests, as well as the pending litigation concerning NSA involvement in the development of the Digital Signature Standard. Before any meaningful debate can occur on the direction of cryptography policy, essential government information must be made public -- as Congress intended when it passed the Computer Security Act. CPSR is committed to that goal. *************************************************** David L. Sobel CPSR Legal Counsel (202) 544-9240 dsobel(a)washofc.cpsr.org

1 0

Re: ECPA reports
by Dave Banisar 06 May '93

06 May '93

> > I was re-reading USC Title 18 (Crimes and Criminal Procedure) > when I came across this snippet. Are these reports available > under the Freedom of Information Act? If so, I'd be interested > in examining them. The reports should be available from any federal depository library and many law libraries. The administrative office told me early this week that the new volume for 92 will be out in a few weeks. A Congressional source tells me that new figures are even higher than last year, upto the mid 900 range, which is the highest number ever reported. Dave Banisar CPSR Washington Office

1 0

DIGICASH: freely available article
by zane＠genesis.mcs.com 06 May '93

06 May '93

I'm looking for a freely distributable article about digicash & anonymous remailers. I want to have this information available for the libertarian party of Missouri convention... (Something along the lines of the article in _Extropy_ would be nice, but I want something which I can copy MANY MANY times..) -- | Sameer Parekh-zane(a)genesis.MCS.COM-PFA related mail to pfa(a)genesis.MCS.COM | | Apprentice Philosopher, Writer, Physicist, Healer, Programmer, Lover, more | | ----STOP THE WIRETAP CHIP/BIG BROTHER PROPOSAL!---MAIL ME FOR DETAILS! __/ | "Be God" - Me __ "Specialization is for Insects" - Robert A. Heinlein__/ \_____________/ \___________________________________________________/

1 0

No Subject
by Mike Godwin 06 May '93

06 May '93

>From jberman Thu May 6 18:23:32 1993 Received: from [192.77.172.140] (bush.eff.org) by eff.org with SMTP id AA08608 (5.65c/IDA-1.4.4/pen-ident); Thu, 6 May 1993 18:23:09 -0400 Date: Thu, 6 May 1993 18:23:09 -0400 Message-Id: <199305062223.AA08608(a)eff.org> To: eff-board, eff-staff From: jberman (Jerry Berman) Subject: LETTER TO PRES CRYTO Status: OR This is the letter to the President dated 5/6/93 on Cryptography and Clipper Chip from the digital privacy and security working group. PLEASE CIRCULATE BROADLY. For further information, contact jberman(a)eff.org (202-5449237) >The President >The White House >Washington, D.C. 20500 > >Dear Mr. President: > > On April 16 you initiated a broad industry/government review of >privacy and cryptography policies. We applaud your efforts to develop a >greater understanding of these complex issues. With the end of the Cold >War and the rapid evolution of technology in the computer and >communications industries, a comprehensive review of our communications >security policies such as you have directed is sorely needed. As the world >becomes linked by a myriad of interconnected digital networks, and computer >and communications technologies converge, both government and the private >sector need to evaluate information security and privacy issues. Of course, >any overall policy must recognize the authorized law enforcement and >national security needs, and must evaluate the impact on American >competitiveness. > > The Digital Privacy and Security Working Group -- a coalition of >communications and computer companies and associations, and consumer and >privacy advocates -- was formed almost a decade ago when Congress undertook >a review of technology and security policy. That review led to the >Electronic Communications Privacy Act of 1986. Subsequently, many members >of the Working Group served on the Privacy and Technology Task Force that >Senator Leahy charged with examining these and similar issues in 1991. > > While we recognize the importance of authorized national security >and law enforcement needs, we believe that there are fundamental privacy >and other constitutional rights that must be taken into account when any >domestic surveillance scheme is proposed. Moreover, it is unclear how your >proposal and the overall review of cryptography policy will impact on U.S. >export controls. Over the past two years, the Digital Privacy and Security >Working Group has held numerous meetings at which both public and private >sector representatives have exchanged technical and legal information with >the law enforcement community on just such issues. > > In the White House press release of April 16, the Press Secretary >stated that you have "directed early and frequent consultations with >affected industries...and groups that advocate the privacy rights of >individuals..." Our group of over 50 members -- from computer software and >hardware firms, to telecommunications companies and energy companies, to >the American Civil Liberties Union and the Electronic Frontier Foundation >-- requests the opportunity to participate in developing policy on the >broad range of security and privacy issues being considered, including >appropriate encryption techniques. We believe that our membership has the >breadth and depth of expertise and experience that would allow us to >provide an excellent forum for the development of new policies in these >areas. > During the past few weeks, the Working Group has met several times >to identify issues that need to be addressed. Several aspects of the >Administration's encryption proposal warrant further discussion, including, >but not limited to: > > o whether a key escrow system will produce the desired law >enforcement results; > o the level of strength and integrity of the algorithm and >the security of the key escrow system; > o the advisability of a government-developed and classified >algorithm; > o its practicality and commercial acceptability; > o the effect of the proposal on American competitiveness and >the balance of trade; > o possible implications for the development of digital >communications; and, > o the effect on the right to privacy and other constitutional >rights. > >A detailed list of our questions relating to this subject is being prepared >to facilitate this dialogue. > > We are making our views known to officials within your >Administration and Members of Congress as the review begins. We would >welcome the opportunity to participate in the review process and look >forward to working with you and your Administration on this important issue >in the coming months. Representatives of the Digital Privacy and Security >Working Group are anxious to meet with your staff at their earliest >convenience to establish a consultation process. > > Sincerely, > >abcd, The Microcomputer Industry Association >Hewlett-Packard Company >Advanced Network & Services, Inc. IBM >American Civil Liberties Union Information Technology Association of America >Apple Computer, Inc. Information Industry Association >AT&T > Iris Associates >Business Software Alliance >Lotus Development Corporation >Cavanagh Associates, Inc. >McCaw Cellular Communications >Cellular Telephone Industry Association MCI >Computer Professionals for Social Responsibility >Microsoft Corporation >Computer & Business Equipment Manufacturers Association RSA Data Security, Inc. >Computer & Communications Industry Association Software Publishers >Association >Crest Industries, Inc. Sun Microsystems, Inc. >Digital Equipment Corporation Toolmaker, Inc. >EDUCOM Trusted Information Systems >Electronic Mail Association >United States Telephone Association > > Electronic Frontier Foundation/Coordinator > Contact: Jerry Berman 202/544-6906 > >

1 0

ECPA reports
by fergp＠sytex.com 06 May '93

06 May '93

I was re-reading USC Title 18 (Crimes and Criminal Procedure) when I came across this snippet. Are these reports available under the Freedom of Information Act? If so, I'd be interested in examining them. This extract is from Title 18, Part I, Chp. 119 (Wire and Electronic communications interception of oral communications), Sec. 2519 (Reports concerning intercepted wire, oral or electronic communications) paragraphs (inclusive) 2 & 3. 8<----- Begin snippet ------- (2) In January of each year the Attorney General, an Assistant Attorney General specially designated by the Attorney General, or the principal prosecuting attorney of a State, or the principal prosecuting attorney for any political subdivision of a State, shall report to the Administrative Office of the United States Courts- (a) the information required by paragraphs (a) through (g) of subsection (1) of this section with respect to each application for an order or extension made during the preceding calendar year; (b) a general description of the interceptions made under such order or extension, including (i) the approximate nature and frequency of incriminating communications inter- cepted, (ii) the approximate nature and frequency of other communications intercepted, (iii) the approximate number of persons whose communications were intercepted, and (iv) the approximate nature, amount, and cost of the manpower and other resources used in the interceptions; (c) the number of arrests resulting from interceptions made under such order or extension, and the offenses for which arrests were made; (d) the number of trials resulting from such intercep- tions; (e) the number of motions to suppress made with respect to such interceptions, and the number granted or denied; (f) the number of convictions resulting from such interceptions and the offenses for which the convictions were obtained and a general assessment of the importance of the interceptions; and (g) the information required by paragraphs (b) through (f) of this subsection with respect to orders or extensions obtained in a preceding calendar year. (3) In April of each year the Director of the Administra- tive Office of the United States Courts shall transmit to the Congress a full and complete report concerning the number of applications for orders authorizing or approving the interception of wire, oral, or electronic communications pursuant to this chapter and the number of orders and extensions granted or denied pursuant to this chapter during the preceding calendar year. Such report shall include a summary and analysis of the data required to be filed with the Administrative Office by subsections (1) and (2) of this section. The Director of the Administrative Office of the United States Courts is authorized to issue binding regulations dealing with the content and form of the reports required to be filed by subsections (1) and (2) of this section. 8<------- End snippet ---------- Paul Ferguson | Uncle Sam wants to read Network Integrator | your e-mail... Centreville, Virginia USA | Just say "NO" to the Clipper fergp(a)sytex.com | Chip... -------------------------------+------------------------------ I love my country, but I fear it's government.

2 1

HIDE: Alpha version of JFIF steganography available
by Derek Upham 06 May '93

06 May '93

I've got a working version of a JPEG steganograpy program. It uses modified cjpeg/djpeg sources to stick arbitrary files in JPEG images and then extract them. It needs testing. The files are in ftp.cs.ubc.ca:pub/pickup/jsteg. There is a copy of the JPEG-v4 sources (or use your own), a context-diff of the source changes (use "patch -p0" in the directory above the sources), and a test ".jpg" file. Assuming everything works correctly, running djpeg -crypt filetoread.txt miyazaki.jpg > /dev/null will extract the steganized text into the file "testout.txt" and dump the PPM file. (The extracted text should be an exact copy of the "USING" file in the JPEG-v4 distribution.) To steganize a file, use cjpeg -crypt filetohide.txt image.ppm > image.jpg or replace "image.ppm" with "-G image.gif", etc. If "cjpeg" reports that it's unable to inject the file, compress the file or use a higher "-Q" parameter. In general, the stegfile needs a final JPEG file that's at least eight times larger. Derek "Naaaaaaaaaaah, Quess isn't stupid. A vicious, vindictive, underhanded, slimy, double-crossing, self-deluding, daddy-hunting, family-killing, conscienceless, callous, sexually repressed, Electra Complex victimized, self-interested, snot- ty, obnoxious little preadolescent whining B*T*H, yes. But she's not stupid."

1 0