- cypherpunks-legacy - lists.cpunks.org

Why I Don't Use PGP
by tcmay＠netcom.com 30 Oct '92

30 Oct '92

Why I Don't Use PGP -- The Top 10 Reasons (from the David Lettercrypt Show) (...drum roll...) 10. Because I use a Mac and the Mac version is not out yet. 9. Because the Mac version may NEVER be out. 8. Because my old IBM PC won't read the 3.5" diskettes my Mac puts out. 7. Because downloading encrypted files with ZMODEM, writing them to DOS format (with Apple File Exchange), hauling out my Toshiba 1000SE laptop and firing it up, loading the 3.5" diskette, and then running PGP takes 5 minutes per message. 6. Because after doing all of the above, I usually get "This is not a PGP file," due to some obscure mistranslation somewhere along the way. 5. Because I barely have the time to read and respond to my ordinary e-mail, let alone decrypt mail, respond (on my DOS machine), and then reverse the above procedure. 4. Because I'm not yet convinced it is needed. It will be someday, but not for right now. (Getting PGP volume up is a great idea...it's the actual decryption that's a pain. Maybe we ought to send dummy messages.) 3. Because ideally our mailers should handle this in a push-button way (I know about the security flaws in having a nonlocal host machine, such as my NETCOM host, do the PGP procedure...I am hoping that someone will write something that transparently "reaches down" into my machine and triggers the computation locally on my machine--and I need a Mac version, of course. Probably an off-line Newsreader for the Mac, like Nuntius, is needed.) 2. Because I don't give out my PGP key (generated on my Toshiba) to all of those who have e-mailed me about it (especially in the wake of my postings about the Denning proposal). The last thing I want is more e-mail from people I've never met, sending me their encrypted secrets of the universe. (...and the Number One reason I don't use PGP?.....) 1. Because computers were supposed to make my life easier, and they haven't. Well, that's enough reasons. I guess I'm just lazy, or have higher priorities than to spend 5 frustrating minutes per mail message. Ironically, I'm not alone. I have heard that even Phil Zimmerman lets his PGP-encrypted messages pile up in his incoming mail, due to the hassles. As Eric Hughes has noted, it is precisely this pain that will cause improvements to be made. -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP 2.0 and MailSafe keys by arrangement.

1 0

Subscribe
by edgar＠spectrx.Saigon.COM 30 Oct '92

30 Oct '92

I got this address off Extropians. Sorry if there's a separate "request" address I should be using, but I don't know what it is. Please add me to your mailing list. Please use one of these addresses: Internet: edgar(a)spectrx.saigon.com UUCP: szebra!spectrx!edgar The address in the network header may not work. I'm familiar with how PGP 2.0 works, including some bugs. I'm trying to start a low-cost public key registry, which can verify public keys independent of the network. Here is my signed 512-bit public key: -----Type bits/keyID Date User ID -----pub 512/4F0C47 1992/09/26 Edgar W. Swank <edgar(a)spectrx.saigon.com> -----sig! 67F70B 1992/10/14 Philip R. Zimmermann <prz(a)sage.cgd.ucar.edu> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.02 mQBNAirEvxwAAAECAMUkLHrx6JH45BMd4bxZDNQO3HrLmhZSvsHJzLH9+90BTbuX 3Kvo0pSLCh98m2Abu/LtoHDggJOKxRGee+5PDEcABRG0KUVkZ2FyIFcuIFN3YW5r IDxlZGdhckBzcGVjdHJ4LnNhaWdvbi5jb20+iQCVAgUQKtu1h+J13g7/Z/cLAQFg nAQAjRlKmmSvDMZUWKM2BQFmpqHBiaCg7OLKEFng9pZGx2qzYHCZOL+a9A0exN9P RAtV6bEm9+F8VoOEpVyF346XJwwE1e/13IETHFi7Jd9fbjsw8voQFqz69X2p8xoE LxYtqSlwfOQ3S7JOyyx4/p04fG/JZuRJicVaUIRlDKHJPJ0= =tsbS -----END PGP PUBLIC KEY BLOCK----- -- edgar(a)spectrx.saigon.com (Edgar W. Swank) SPECTROX SYSTEMS +1.408.252.1005 Silicon Valley, Ca

1 0

PUBLIC_KEYS pre-Backbone topology
by tomj＠f111.n125.z1.FIDONET.ORG 30 Oct '92

30 Oct '92

Here's a nerd message from PUBLIC_KEYS echo conference showing activity and growth. This conference has been around about three weeks. GLOSSARY: node host conference newsgroup echo newsgroup message article 1:222/333 FidoNet address (ie. host site address) backbone a somewhat formal high-throughput systems that carry a large proportion of echos. Only very popular echos are carried on the backbone; low traffic ones the member sites deliver their own mail (we don't ahve corp. sugardaddies like most internet/uucp sites, I pay Pac Bell each month...) The hideous unreadable gunk is a sort of 'traceroute' of generated message traffic during some period of time, and tends to show the topology. Echomail is a completely distributed, redundant database. Moderation is not physically possible (there is a thing called groupmail that is, but we're not using it). It shows who connects to whom. There is at least one human reader/poster at each node (the sysop); my guess would be about 1.5 average for this subject. Why did I mail this to cypherpunks list? To show the amount of interest in PGP, and demystify FidoNet somewhat. here's the current report from msgs posted here: PATHS: Maintain and report PATHS a message takes within an echo Copyright (C) 1991, Graham J Stair. All rights reserved. Release 1b for DOS (16th June 1991, 15:59) {-? for help} Message directory : \msg\pkey\ Checked on : Sat Oct 24 18:13:40 1992 Number of nodes : 53 Number of messages : 778 Earliest message : Sat Oct 03 20:04:12 1992 Latest message : Sat Oct 24 17:06:42 1992 Messages per week : 260.9 1:374/14 (180 of 774) |-}1:374/26 (44 of 53) | |-}1:322/603 (5 of 5) | |-}1:374/12 (1 of 1) | |-}322/6 (4 of 4) |-}1:216/21 (32 of 53) | |-}216/80 (0 of 21) | |-}273/219 (0 of 3) | | |-}1:273/219.4 (1 of 1) | | |-}1:273/937 (1 of 1) | | |-}1:273/219.1 (1 of 1) | |-}1:143/269 (18 of 18) |-}1:374/98 (3 of 6) | |-}1:374/46 (3 of 3) |-}1:100/520 (11 of 11) |-}1:285/27 (26 of 44) | |-}30102/20 (18 of 18) |-}1:170/109 (18 of 18) |-}1:105/36 (20 of 39) | |-}1:105/68 (6 of 6) | |-}1:105/290 (13 of 13) |-}135/71 (0 of 19) | |-}1:135/907 (19 of 19) |-}1:396/1 (5 of 8) | |-}203/23 (0 of 2) | | |-}125/125 (0 of 20) | | |-}125/20 (0 of 11) | | | |-}1:125/209 (8 of 8) | | | |-}1:125/54 (3 of 3) | | |-}1:125/33 (1 of 9) | | |-}1:308/60 (8 of 8) | |-}109/25 (0 of 1) | |-}1:2601/100 (1 of 1) |-}1:234/1 (40 of 40) |-}1:377/14 (56 of 78) | |-}1:377/3 (19 of 19) | |-}377/15 (0 of 2) | | |-}1:377/15.1 (2 of 2) | |-}1:377/33 (1 of 1) |-}163/438 (3 of 9) | |-}1:163/518 (3 of 3) | |-}1:243/3 (3 of 3) |-}1:125/180 (54 of 112) | |-}1:125/111 (38 of 38) | |-}1:125/185 (2 of 2) |-}1:2200/101 (2 of 2) |-}1:135/340 (52 of 52) |-}1:312/2 (16 of 16) |-}1:106/7550 (33 of 33) |-}2:253/513 (2 of 2) |-}1:261/1136 (1 of 1) |-}374/92 (0 of 1) |-}374/13 (0 of 1) Notes: If a node does not appear in this report, it could mean... a) It did not have a message entered from it. b) It did not have a message pass through it to get to the top node. c) Its mail processor doesn't update the ^APATH: kludge with its address. If any feeds change, the report will be unreliable. [converted from high ASCII lines to low ASCII characters by CONV004.ZIP] -30- if we show up in FIDONET.NA tomorrow, everyone stand-by to switch over to Backbone feeds. this ALWAYS take a couple weeks to settle down. cut your direct links as soon as you get confirmation of link from your Backbone source. if you don't get confirmation first, you will probably miss traffic as the Backbone doesn't do rescans. we will get a few dupes. this is inevitable with a private to Backbone changeover and no one should get excited about it. just be sure to pull your direct plug as soon as traffic flows from your Backbone source or you get confirmation of feed, whichever comes first. thanks. TTFN. Chris --- DB 1.50/001027 * Origin: Rights On! - Privacy #1 Right! - Titusville_FL_USA (1:374/14) SEEN-BY: 106/1555 109/25 124/1 125/20 28 33 111 125 180 185 1212 170/610 203/1 SEEN-BY: 203/23 205/10 209/209 374/14 396/1 ;;; -- tomj - via FidoNet node 1:125/555 UUCP: ...!uunet!hoptoad!kumr!fidogate!111!tomj INTERNET: tomj(a)f111.n125.z1.FIDONET.ORG

1 0

drugs for sale
by tom.jennings＠f111.n125.z1.FIDONET.ORG 29 Oct '92

29 Oct '92

A cross posting from FidoNet PUBLIC_KEYS. It would be nice if some other cypherpunks could join the PUBLIC_KEYS echo. ;Date 29 Oct 92 11:28:07 From: Jesse David Hollington@1:125/33 To: Arol Ambler@1:125/111 Subject: Test >----------------------- Do not change this line -----------------------------< AA> Anyway, anyone who is concerned can always use some method that hides the AA> fact that any secret content is even being communicated. (Variations on AA> read every fifth word to see the real message, or other standard AA> methods). It's funny you should bring that up. One of the major proponents of encryption here in Region 12 posted the following in the Regional Sysop Echo some time ago... ============================================================================= Having said that, I also wonder whether this insistence upon having everything in plain text isn't fostered by some sysops as a means of receiving information that they otherwise wouldn't be privy to. If one is truly paranoid ( *not* that I would fall into that category in anyone's wildest dreams...ahem), one should worry about why some netmail is read so assiduosly by passthrough systems in the first place. Fortunately, even mail that I send direct to nodes is quoted back and often passes through a whole variety of systems for their inspection and review. Since almost all of my netmail is incredibly innocent there might always be the possibility that some of it will come back to hover like a bad dream in some creative complaint. In broader legal terms, every other communication system avoids eavesdropping on mail. P.S. To understand how powerless you are to prevent encrypted text, read the leftmost letter of each sentence in the last three paragraghs downwards...ahem. =========================================================================== He raises a valid point. Sysops who are so paranoid about encrypted mail being sent through their systems should realize that they are really powerless to prevent it if somebody is determined enough to send a coded message to somebody else. I've sought legal opinions in Canadian law (I don't know how it is in the U.S.) and I've discovered that the less I know about mail passing through my system, the safer I am. If I keep every message on my system, and read them all, then I can be held liable if somebody routes something illegal through my system and it slips by me. If I kill all passthrough mail, and read nothing except what is addressed to me, I am operating under common carrier status, and can't be held liable any more than Federal Express or UPS could. As a result, it's actually better to *encourage* people to send encrypted mail through your system. The belief that if people are sending encrypted mail they're doing something wrong is a fallacy... then again, I'm preaching to the converted here. Cheers, Jesse. --- Maximus 2.01wb * Origin: On a Clear Disk You Can Seek Forever (1:225/1) -- tom jennings - via FidoNet node 1:125/555 UUCP: ...!uunet!hoptoad!kumr!fidogate!111!tom.jennings INTERNET: tom.jennings(a)f111.n125.z1.FIDONET.ORG

1 0

speaking of data on music CD's
by Peter Shipley 29 Oct '92

29 Oct '92

speaking of messages that can be passwd on musical CD's, I thought this might be of some amusement -Pete ------- Forwarded Message Return-Path: cambler(a)nike.calpoly.edu Received: by ts2.TFS.COM (5.51/1.00 (TRP - mailsrv)) id AA27917; Tue, 27 Oct 92 03:00:31 PST Received: from zeus.calpoly.edu by tfs.COM (5.61/1.00 (TRP - gateway)) id AA04680; Tue, 27 Oct 92 03:00:21 -0800 Received: by nike.calpoly.edu (5.61-AIX-1.2/1.0) id AA167170; Tue, 27 Oct 92 03:00:19 -0800 Date: Tue, 27 Oct 92 03:00:19 -0800 From: cambler(a)nike.calpoly.edu (Christopher J. Ambler, Phish) Message-Id: <9210271100.AA167170(a)nike.calpoly.edu> To: shipley Subject: Re: laser Here, check this out: Okay, here's the scoop. At the end of the new Information Society CD, there's a 3 minute track (track 12) that's called "300BPS N81" ... Well, I was curious, so I hooked the thing up to a phone line here, tied my modem's carrier detect high, and played with the gain. After 4 or 5 tries, THIS IS WHAT I GOT. - --- begin ath1 OK ato CONNECT 300 SO WE'RE SUPPOSED TO PLAY IN CURITIBA IN 18 HOURS, BUT OUR BUS IS BEING HELD HOSTAGE BY THE LOCAL PROMOTERS. THEY'VE FORMED SOME UNHOLY ALLIANCE WITH THE BRAZILIAN COUNTERPART OF ASCAP; THE PRS. APPARANTLY THE PRS HAS THE LEGAL POWER TO ARREST PEOPLE, AND THEY WANT A PIECE OF THE NATIONAL TOUR PROMOTER'S MONEY. THE LOCAL SECURITY FORCE, "GANG MEXICANA", HAS BEEN BOUGHT OUT FOR 1800 CRUZADOS AND A CARTON OF MARLBOROS EACH. THE ONLY FACTION STILL OPERATING IN OUR DEFENSE IN "BIG JOHN", OUR PERSONAL SECURITY MAN, AND HE'S HIDING IN HIS ROOM BECAUSE A LOCAL GANG IS OUT FOR HIS BLOOD BECAUSE OF A 1982 KNIFING INCIDENT IN WHICH HE WAS INVOLVED. OUR 345-POUND ROAD MANAGER, RICK ONLY HAD THIS TO SAY: "YOU WANTED THE LIFE OF A ROCK STAR!". PAUL, JIM AND I REALIZED THAT THIS WAS ONE SITUATION WE WERE GOING TO HAVE TO GET OUT OF OURSELVES. WE CONVENED A HASTY CONFERENCE IN THE NOVOTEL LOBBY. PAUL SUGGESTED CONTACT- ING OUR NATIONAL TOUR PROMOTER IN SAO PAULO, BUT WE REMEMBERED THAT HE WAS IN RECIFE WITH FAITH NO MORE, WHO HAD JUST ARRIVED FOR THEIR BRAZILIAN TOUR. WE THOUGHT ABOUT CONTACTING OUR BRAZILIAN RECORD COMPANY IN RIO, BUT THEY WEREN'T HOME. OUR EVER-DILIGENT AMERICAN MANAGER WAS ARRANGING HELP OF NUMEROUS FORMS, BUT HE WAS IN NEW YORK, AND JUST TOO FAR AWAY TO GET ANYTHING MOVING IN TIME. AND THERE WERE 6000 KIDS IN CURITIBA WHO JUST WOULDN'T UNDERSTAND. WE KNEW IT WAS TIME FOR ACTION. PAUL WENT UP TO THE PRS GUYS AND INVITED THEM INTO THE BAR TO DISCUSS IT LIKE CIVILIZED MEN OVER A FEW BRAZILIAN DRINKS, OFFERING EACH OF THEM A CIGAR ON HIS WAY. THE AMUSED PRS HEAVIES SEEMED TO LIKE THE IDEA OF A FEW FREE DRINKS, EVEN IF THEY KNEW THEY WOULD NEVER GIVE US OUR BUS BACK. WHEN PAUL WINKED AT JIM AND I ON HIS WAY IN, WE WENT INTO ACTION. I STOLE OFF TO MY ROOM TO PREPARE WHILE JIM WENT INTO ACTION. CREEPING CAREFULLY THROUGH A SERVICE DUCT, HE MANAGED TO GAIN A VANTAGE POINT SOME THREE METERS ABOVE THE BUS, AND DROPPED CAREFULLY ONTO THE ROOF. AFTER USING HIS ALL-PURPOSE SWISS ARMY KNIFE (AFFECTIONATELY KNOWN AS THE "SKIT KNIFE") TO JIMMY OPEN THE ROOF HATCH, HE WENT THROUGH THE DARKENED INSIDE OF THE BUS AND REMOVED THE INSIDE ENGINE SERVICE PANEL. USING SOME SPARE ELECTRONIC PARTS HE FOUND WHILE ON AN ISLAND IN THE AMAZON, HE WIRED THE ENTIRE BUS FOR REMOTE CONTROL, NOT UNLIKE A REMOTE CONTROL TOY CAR. AT THIS POINT, HE ASKED HIMSELF "NOW HOW SHALL I GET OUT OF HERE?!?" PAUL WAS HAVING DIFFICULTIES OF HIS OWN. "COULDN'T YOU SEE YOUR WAY CLEAR TO LETTING US FULFILL OUR CONTRACTUAL OBLIGATIONS IN CURITIBA? THINK OF THE KIDS!" THROUGH OUR TRANSLATOR, FABIO, THE PRS MAN, ALDO, SAID; "NO. YOU AMERICANS THINK YOU OWN THE WORLD. HAH! WE'LL BURN DOWN OUR RAIN FOREST IF WE DAMN WELL PLEASE. WE NEED ROOM FOR COWS!! WE WANT A MACDONALD'S ON EVERY... OH, SORRY, YES ANYWAY, NO. WE NEED 40% OF YOUR CONCERT RECEIPTS TO GIVE TO DAVID BOWIE." HE SAID, WINKING TO THE LOCAL PROMOTER, PHILLIPE. AS PAUL CONTINUED THIS ELABORATE DISTRACTION, JIM EFFECTED AN ESCAPE FROM THE HEAVILY GUARDED BUS BY CRAWLING DOWN INTO THE CARGO BAY, CUTTING A HOLE IN THE FLOOR WITH THE SWISS ARMY KNIFE'S ARC-WELDER, SLIPPING INTO THE MANHOLE COVER SITUATED UNDER THE BUS, AND WALKING UP INTO THE HOTEL'S BASEMENT FROM THERE. JIM CALLED UP TO ME IN MY ROOM AND GAVE THE SIGNAL. WE WERE NOW TO MEET AT THE BACK ENTRANCE, WITH OUR TECH GUYS. BUT FIRST, PAUL WOULD NEED SOME HELP GETTING AWAY FROM HIS UNWELCOME GUESTS, AS THINGS WERE GETTING UGLY. "HE SAYS HE HAS LOST HIS PATIENCE, AND THAT HE CAN THINK OF OTHER WAYS OF EXACTING PAYMENT FROM YOU KURT AND JIM PHYSICALLY." OUR TREMBLING INTERPRETER SAID. THE MOMENT HAD COME. JIM BEGAN OPERATING THE BUS FROM HIS BACK ENTRANCE VANTAGE POINT. AS THE REMOTE-CONTROLLED BUS LURCHED TOWARDS THE PARKING LOT EXIT, THE SUPERSTITIOUS SECURITY YOUTHS FLED IN TERROR. PAUL WAS PULLING ANXIOUSLY ON HIS COLLAR AS THE PRS MAN BEGAN DESCRIBING HIS COLLECTION OF WORLD WAR II NAZI CERIMONIAL KNIVES WHEN A SUDDEN CRASH SPLIT THE TABLEAU. JIM HAD PURCHASED ME THE GIFT OF A COMPLETE BLACK NINJA STEALTH ASSASSIN OUTFIT IN ARACAJU. I HAD BEEN GEARING UP AND CRAWLING THROUGH THE AIR CONDITIONING DUCTS ALL THIS TIME. AS I CRASHED THROUGH THE CHEAP IMITAION- STYROFOAM HUNG CEILING TILES, SKATES FIRST, I FLASHED NINJA STARS ALL ABOUT ME. IN THE ENSUING PANIC, PAUL ESCAPED TO THE PRE-ARRANGED BUS PICK-UP POINT. UNFORTUNATLEY, MY SKATES WERE A POOR CHOICE OF FOOT GEAR FOR ESCAPING OVER THE BROKEN GLASS. OF THE TABLE I HAD LANDED ON. WERE IT NOT FOR THE CONFUSION AND THE NINJA-STAR-INFLICTED WOUNDS DELIVERED TO THE BAD GUYS, I WOULD HAVE BEEN SET UPON WHILE FOUNDERING ON THE GLASS-STREWN CARPET. AS IT HAPPENED, HOWEVER, I LEAPT THROUGH THE OPEN DOOR OF THE CAREENING BUS AS IT DEPARTED THE CITY OF MARINGA FOREVER. IF ONLY WE HAD MANAGED TO GET OUR EQUIPMENT IN THE BUS, TOO . . . EVERY WORD OF THIS STORY IS TRUE. - KURT HARLAND} NO CARRIER ------- End of Forwarded Message

1 0

National Security Agency
by tcmay＠netcom.com 28 Oct '92

28 Oct '92

Cypherpunks of the world, encrypt! Enclosed below is a posting I made to debunk Denning's claim that the proposed key registration is needed to thwart criminals. P.S. I still need more comments on how the Hackers session on crypto should go. I've gotten some good private e-mail, but little debate here on the list itself. --Tim Newsgroups: sci.crypt,comp.org.eff.talk,alt.conspiracy Path: netcom.com!tcmay From: tcmay(a)netcom.com (Timothy C. May) Subject: Re: A Trial Balloon on Registered Keys Message-ID: <1992Oct29.022842.8177(a)netcom.com> Organization: Netcom - Online Communication Services (408 241-9760 guest) X-Newsreader: Tin 1.1 PL5 References: <1992Oct28.214920.15601(a)tessi.com> Date: Thu, 29 Oct 1992 02:28:42 GMT Some comments about the National Security Agency (NSA) and why it wants to restrict wide use of encryption. George Mitchell (george(a)tessi.com) wrote: : Now it's my turn to go out on a limb. I believe that all the parti- : cipants in this discussion would agree that: When the Government : can show, through legitimately obtained evidence, that a particular : encrypted communication relates to a crime, then they can, after : the fact, subpoena the plaintext of that communication. What : most of us object to is having to yield the keys before the fact. Agreed. The current procedure for subpoenaing documents works fairly well. But Prof. Denning's comments clearly indicate the concern is with catching terrorists, kidnappers, subversives, and other such types _in the planning stage_. That is, wiretapping and surveillance. And I'll got out on a limb, too. My suspicion, and that of many others, is that the case of the FBI catching terrorists before the act in the U.S. (and there's a well-known case of a Japanese Red Army terrorist caught in the Midwest several years ago) reveals the sources the FBI uses. The NSA is the likely source. Only the NSA listening in on millions of telephone conversations (not banned by any law...the laws you hear about on wiretapping and surveillance mostly deal with the FBI, law enforcement, and, supposedly, the CIA. The NSA is almost completely exempt from such laws.). If you haven't yet read James Bamford's "The Puzzle Palace," run out and get a copy and read it. You'll see why former DIRNSA General Odom called Bamford "an unindicted felon." (Why in the eyes of the National Security Establishment, that is.) SIGINT OPERATION MINARET, begun in 1969 when Nixon declared the "War on Drugs," brought the NSA together with the FBI, CIA, BNDD (Bureau of Narcotics and Dangerous Drugs, precursor to DEA) to launch a series of new surveillance programs. In May 1970 the NSA extended routine surveillance to _pay phones_ in suspect areas (sound familiar, with the Digital Telephony Bill?). The release of the Pentagon Papers in 1971 revealed the extent of FBI and NSA elsur (electronic surveillance) on U.S. citizens. OPERATION SHAMROCK goes back even further. Beginning in 1945, the FBI and NSA (its precursors, actually, such as Army Signal Corps, etc.) cooperated to monitor dissidents, radicals, authors, etc. It was not until October 1973 that about-to-be-fired Attorney General Elliot Richardson (now fighting for INSLAW in a very similar case, which Prof. Denning ought to read about) ordered the FBI and the CIA's "Security Service" (aptly named SS) to stop requesting NSA surveillance material. In 1977 the Justice Department recommended against prosecution of the FBI and NSA employees engaged in Shamrock and Minaret. Few Americans understand how pervasive is the NSA's listening system. COINTELPRO, Huston Plan, RCA Global (provided copied of all telegrams for 40 years!), FINCEN, and so many other keywords! Huge antennas in West Virginia, in Idaho, and elsewhere (mostly located near major satellite downlinks). Read Bamford's book. Then be afraid....be _very_ afraid. Understand that there are virtually no laws governing the NSA's surveillance of fax machines, modems, the Internet (including all of these postings, obviously), voice phones, telex and TWX, and on and on. Because of the "national security" role, wide lattitude is given. No doubt some criminal plans are uncovered. The NSA detected, it has been admitted, the planned bombing of the Berlin discotheque that led to the '86 raid on Libya. (However, the bombing still occurred...draw your own conclusions.) But is it worth the price? Now there is talk of using the NSA's formidable listening abilities for economic espionage against our economic opponents! Is it any wonder the NSA is scared sh..less over the spread of secure and untappable communications systems? Be afraid, be _very_ afraid. -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP 2.0 and MailSafe keys by arrangement.

1 0

(fwd) Registering "Assault Keys"
by tcmay＠netcom.com 28 Oct '92

28 Oct '92

Cypherpunks, Things have gotten truly exciting. The posting I made alerting sci.crypt readers to the plans of the Crypto Establishment has generated something close to a hundred responses! And lots of private mail for me (moral support, questions, etc.). Dorothy Denning, in what writer correctly called a "spirited defense" of her proposal, acknowledged the truth of my posting and then went on to embellish her plan. I urge you all to read her well-written comments, if only to see how the Establishment views crypto technology. Several members of this list have also written cogent comments. My latest article is included below, for those of you who may not have Net access. Newsgroups: sci.crypt,comp.org.eff.talk,alt.privacy,talk.politics.guns Path: netcom.com!tcmay From: tcmay(a)netcom.com (Timothy C. May) Subject: Registering "Assault Keys" Message-ID: <1992Oct28.235027.28039(a)netcom.com> Organization: Netcom - Online Communication Services (408 241-9760 guest) X-Newsreader: Tin 1.1 PL5 Date: Wed, 28 Oct 1992 23:50:27 GMT Registering "Assault Keys" -- How the Proposal to Register Encryption Keys Has Ominous Parallels to Gun Control The recent proposal that encryption keys be registered with the government has some natural and terrifying implications. (For those to whom this proposal is new, strange, or disturbing, please see the debate raging mainly in the newsgroup "sci.crypt".) Once the principle is established that private communications, letters, faxes, modem transmissions, etc. must be in a form readable--under court order, as Dorothy Denning's proposal goes--by the government, and that "public key encryption" keys must be registered with the authorities, then we can expect the following: * _Classes_ of encryption keys, with some especially strong (in a cryptograhic sense) keys being declared "assault keys," just as certain classes of semiautomatic rifles have been branded "assault weapons" and subjected to media villification and even confiscation by the authorities. In analogy with firearms, there may be "Class 1" dealers in "dangerous" keys. * There may even be _bans_ on the registration (and hence use) of certain classes of algorithms and key lengths. For example, "civilians" may be allowed to use DES, but not RSA. Or the key length may be restricted in various ways. * Strict controls over the types of algorithms allowed. After all, what use will a key be if the government can't run the algorithm? This, by the way, will be another way to control the spread of encryption technology: if only licensed, inspected, and approved algorithms are acceptable to the key registration authorities, innovation and experimentation will suffer. This may make RSA Data Security, Inc., very happy, as it may get the "franchise," while users of bootleg/contraband/experimental algorithms like PGP 2.0 ("Pretty Good Privacy") face severe sanctions. * Spot checks will have to be done to ensure compliance. This may be done in various ways, such as by randomly checking bitstreams and demanding the sender open the message. (Note: Many have posted that this would not be possible. Untrue. The Rehnquist Supreme Court ruled a couple of years ago that the police could enter a bus and ask the passengers to "voluntarily" accept a search of their baggage. Failure to volunteer, so reasoned the court, constituted probable cause for a search! "Catch-22" meets "1984.") * The penalties for noncompliance, or for hiding encrypted messages inside other messages, will likely be severe, else widespread civil disobedience and claims of "ignorance" will result. (Personally, I _expect_ widespread noncompliance. Many people will even flaunt their noncompliance, encrypting truly innocuous messages that few courts, they will hope, will convict them for. Here in California, the noncompliance rate for registration of those evil "assault weapons" is estimated to be as high as 80%.) (My best guess is that the "RICO" (Racketeer-Influenced and Corrupt Organizations Act) and civil forfeiture approaches will be used to simply seize the equipment of anyonone caught sending messages without the suitable seals of approval. Such seizures, used with suspected gun sellers, suspected X-rated video sellers, suspected drug dealers. and so on, have had a profoundly chilling effect.) * A registration system, even if well-intentioned and secured against casual government snooping (and some of the multi-party escrow systems may help do this), will still _greatly complicate_ the use of encryption and will forestall certain very exciting applications of cryptology. Many of the new proposals, for things like anonymous credentials to protect privacy, for digital cash, and for cryptographic voting systems, essentially require the _dynamic_ generation of keys! That is, keys are generated frequently as part of the protocols...there is not single static "public key" that one generates once and then takes down to the crypto equivalent of the DMV for registration. * As with guns, true criminals will of course ignore these laws. Computer networks are already being used for messages that evade wiretaps (as one example, a Mafia guy in New Jersey, on the run, used a well-known computer service to communicate untraceably with his wife), that are used for laundering information and money, and so on. Taking encryption away from citizens will do nothing. I urge readers to get involved in this debate. "If encryption is outlawed, only outlaws--and the NSA--will have encryption." -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP 2.0 and MailSafe keys by arrangement.

1 0

How far would this extend...
by mark＠coombs.anu.edu.au 28 Oct '92

28 Oct '92

With regard to the FBI bill, the definition of electronic communication provider is rather vague IMHO. It seems to cover a BBS, any unix site (or equiv) etc. (I deleted the article so I cant quote it) Anyway if the above is true will this mean all machines that electronic communication traverses have to have a 'backdoor' so the gov can sit in their offices and run through the mail spool as root? :) Or log into any BBS and do the same? There hasnt been any talk of it as such, probably because they can do it fairly easily anyhow, but it just seems like another loophole in their (the FBI's) favour. _Sometimes_ I'm glad Im an aussie. Mark

1 0

One-time pads and DC Nets
by tcmay＠netcom.com 27 Oct '92

27 Oct '92

"Nobody" writes about the dining cryptographers protocol. We talked about it at length at our first face-to-face meeting, but the subject has barely come up on this list. People should read the Chaum articles in the handout, and the excellent tutorial by Jurgen Bos, also in the handout. It is truly exciting stuff, much more so than the usual "classical cryptography" that we mostly talk about here on this list. Part of my great concern about the public key registration proposal is that it will, if enforced, kill off many of these approaches that rely on dynamically changing keys and digital pseudonyms. If there's interest out there in the DC Net approach that "Nobody" so nicely summarized, I'll forward some articles I wrote a while back for another list. --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP 2.0 and MailSafe keys by arrangement. -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP 2.0 and MailSafe keys by arrangement.

1 0

Keystone
by Eric Hughes 27 Oct '92

27 Oct '92

Ah. A small PGP subset. You hadn't mentioned this. When you said you weren't requiring the user to run PGP, I assumed key generation must occur on the board. As for your fatal flaw I hadn't spotted, I had spotted it, and the location of the private key was the critical point. If the key is on the BBS, the message goes out in the clear. Look, it boils down to this. If the message traffic to the BBS is to be encrypted, then the user has to generate a key on his own machine and decrypt it on his own machine. There's no way around that. But the user interface problem can be solved. Just make a bunch of .com files which do nothing but spawn pgp by invoking the correct arguments. Very simple; a few lines of C is all. Even the PGPPATH can be set before the spawn. It's an easy encapsulation. It will run a bit slower for load time, but not appreciably. And you won't have to recompile PGP from the distributed executables. Eric

6 9