- cypherpunks-legacy - lists.cpunks.org

Comments on binding cryptography (1)
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

Apologies for not reacting earlier; I have been away for six days. I found many reactions to the posting on binding cryptograhpy in my mail box, which I have read with interest. Here are my comments, excuse me if they are lengthy. First and foremost, I want to stress that the proposal primarily addresses the issue of providing information security. It does not want to solve the problem of criminals using encryption. I hope the following analogy may clear this (but please don't stretch the analogy too far). The government wants to offer citizens good transport, so they make public roads. Because some citizens endanger others through drunk driving, the government makes the rule that if you want to drive a car, you must be sober. If you want to drive on the public road, fine, don't drink. If you want to drink, fine, take a bike or cab or use public transport. Now, the binding cryptography proposal wants to provide law-abiding citizens with good crypto. (I'm currently not using any, because I don't have an easy to use and reliable system.) A government may establish an infrastructure for good crypto (like the public roads), with the requirement that you keep to the "binding" rule (like "don't drive drunk"). If you don't want to use the binding cryptography, fine, use another system (take a bike or cab). The system will not prevent criminals from using cryptography - it isn't meant to. Yes, criminals can use superencryption or other (mutually agreed upon) ways to use the system and yet be out of law-enforcement's reach, but they might as well use PGP in the first place. I do not want to see PGP outlawed, and I do not want to have PGP use be regarded as suspicious (just as I don't think it is suspicious if you take a cab late at night). Setting up a good information security structure can very well be compatible with having other means of information security. You ask why should the government offer good crypto, when it's already available? I think that cypherpunks are not average - they know about crypto and they can use it. The majority of the citizens, however, do not use crypto, because they don't understand it and because there's no easy-to-use and reliable standard. If the government were to offer this, it would make a difference to many people. Then, you say, it affects my privacy. As far as I see it, it does not. The binding cryptography system allows regular monitoring for compliance (like road police checking whether people are sober). It does not involve reading of messages. The only time messages are read is when law-enforcement agencies (LEAs) have a warrant and ask a TRP to hand over a session key. This is not fundamentally different from the present situation, where LEAs can wiretap with a warrant. Privacy will be protected more or less to the same extent as presently. If you don't agree with governments having the possibility of intercepting communications anyway, OK, that's your opinion. I have another opinion, and we needn't discuss further - this is not the issue. Then, if you say you don't trust your government, OK, I can see a point. Generally, I notice a difference between US and Europe in our views on the role of governments. That is legitimate, and something for each to discuss domestically. (Yes, Alex, IRT-gate is a good point, but at least it has led to a critical investigation by parliament and a more critical attitude with our judges in judging investigation methods.) (And Allen, if binding cryptography helps totalitarian governments in arbitrarily monitoring all communications, I oppose this. China uses video cameras in Lhasa to monitor potential demonstrations of Tibetans. I oppose this, and I blame the Chinese government for it, not the inventor of video cameras.) I feel at least that allowing TRPs to decrypt single communications if the LEA has a court warrant is better protection than escrowing my private key with the government. Also, choosing your own TRP allows you better protection than having to use a government-chosen one. On the other hand, I think there should be some regulation on TRPs, if only to address liability issues. I think a government certification of TRPs would not be a bad thing, if this is done in an open, flexible and preferably independent way - for instance a semi-govenmental "TRP approving authority" (the same way we have data protection authorities who monitor compliance with data protection legislation). Again, we may have different opinions on this given the difference between US and Europe. Someone pointed out that a TRP could be corrupted and collaborate with the law-enforcement agencies. Then, all sessions would be read by the LEA. Indeed, this is a threat to be taken into account. At least the binding alternative is better protection against collaborating TRPs than key-escrow, as at least it leaves communications from before the corruption unharmed. Moreover, the system allow easy change of TRP, so the moment you notice something weird about this TRP, you choose another one. It's really a matter of trust. Finally, I get the impression that some cypherpunks feel the law-enforcement problem to be a problem of "them" as opposed to us. I - and this is my personal opinion - feel it is "my" problem as well. I live in a society with which I am generally satisfied, not the least because we have a rule of law. Tracing criminals is my concern as well. I am not happy that, in some ways, I have to give up some freedom, but I think it is worth while. I would not mind using a government-offered crypto system that uses binding cryptography. All I want is that it is a good system and I want to be sure I trust my TRP. I would prefer it if no such system were needed, but if it helps in protecting me from criminals, I can live with it. Bert-Jaap --------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 466 8101 Center for Law, Administration and facs +31 13 466 8149 Informatization, Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------------------- Postbus 90153 | This world's just mad enough to have been made | 5000 LE Tilburg | by the Being his beings into being prayed. | The Netherlands | (Howard Nemerov) | --------------------------------------------------------------------- http://cwis.kub.nl/~frw/people/koops/bertjaap.htm ---------------------------------------------------------------------

2 1

Your Papers Please!!! (fwd)
by Lucky Green 17 Dec '03

17 Dec '03

[Hmm, why the hell does pine add the .sig at the beginning of the message?] -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President. ---------- Forwarded message ---------- Date: 15 Oct 1996 07:57:21 -0700 From: Johann Opitz <Johann_Opitz(a)smtp.svl.trw.com> To: ca-firearms(a)lists.best.com Subject: Your Papers Please!!! WASHINGTON (Reuters) - The Supreme Court Monday (10-7-96) let stand a precedent-setting ruling that states may establish roadblocks for the chief purpose of intercepting illegal drugs. [...] The case arose out of roadblocks Florida law enforcement officials set up on four state highways near the Georgia border in January 1984. [...] About 2,100 vehicles passed through the roadblocks, of which approximately 1,300 were stopped. In all, one person was arrested for the possession of illegal drugs while 61 traffic-related citations were also issued. [...] A federal judge dismissed the lawsuit and a U.S. Court of Appeals in Atlanta agreed. It said the chief purpose of the operation was to intercept drugs, but ruled the state does have the power to conduct roadblocks to check drivers' licenses and vehicle registrations. [...] The attorneys for the motorists urged the Supreme Court to hear the case, saying law enforcement officials around the country were likely to adopt similar temporary, unannounced roadblocks for drugs. But the high court sided with the state of Florida, denying the appeal without any comment or dissent. ======================== Speaking of roadblocks >>>> [ The police officer who wrote the following shows what we have to look forward to. I guess the Supreme Court has decided it is OK to violate our rights just as long as we are all _equally_ violated. -- lk ] Posted to texas-gun-owners by Joe Horn <6mysmesa(a)1eagle1.com> ------------------------------------------------------------------------ Speaking of roadblocks, Saturday, the New Mexico State Police had one set up on NM#404, (14 officers and one Sgt.) stopping all traffic both ways on a desert mountain pass between El Paso and White Sands. When I was stopped, a courteous automaton approached, hand on pistol and asked for my DL and insurance card, and did a visual search of my car. Immediately angered and resentful of this State intrusion and violation of my rights, I handed him the requested documents, and having checked my paperwork, he looks through the window at the back seat area and asks me "what's under the blanket?" I told him his search was going to have to be limited to what he could see as I was not granting a consent search beyond what he could see through the windows of my vehicle after illegally stopping me at this roadblock. Illegal? Pull over there and talk to the nice officers, says he. Yes I said, stopping people for searches in the pretext of seeing their paperwork. Says he: the court said it's OK (in limited roadblocks )as long as we stop everyone. Says I, the court is wrong and it's still unconstitutional, you do not have a warrant and I have broken no law. To me, the fact they did NOT ask for vehicle registration indicated they were fishing. The robot calls his Sgt. over, who takes over and warns me that this can become very unpleasant, and at this point, I show him my retired badge and ID, asking how unpleasant is that? He then says, why didn't you say something, you coulda been gone by now? I told him that I am a plain citizen and suggest he knows what he's doing is wrong and that it's a pure fishing expedition. He angrily said:(and he really surprised me) "Hey, I'm just doing what I'm told, now get outta here before I decide to ruin your day". They cut me loose and drove off, keeping my Ithaca 37 which was under the blanket and 1911A1 under the center console. My point is that this is out of control, and folks are going to start getting hurt in these little European-like (where are your papers?) roadblocks, fishing for whatever they can find. If I didn't have masterbadge and I.D., I would have been illegally and unconstitutionally searched against my will. Very few people have a badge to get them out of something like this, and deferring to intimidation by armed authority, most will have their rights violated. My sense of the roadblock personnel was that excepting the Sgt., they didn't know they were wrong or didn't care. The average age of the officers was late 20's early 30's. Now that they're going to start these around schools, and I assure you that it will be in as high handed a manner as they can manage. Many people don't see or don't want to see what's happening to the Constitution or our human rights recognized by that Constitution, or the Police State being assembled right around the Constitution, in the name of the "drug war" or the "chirrun". It's here and it's here now and if you don't strenuously object to these searches and roadblocks whether for DUI, Drivers License/Insurance/ guns/drugs, and drive your political reps nuts about it, sooner or later you will get the anal probe of an illegal search in the name of the "drug war" or for guns near schools. Of course those that like and feel safer with more unenforceable, useless law and more intrusion (with no effect on criminals, just the violation of honest citizens rights) may you be hoisted on your own petard, and soon. As I waited in line to be searched in this desolate and remote desert location, I reflected on my extensive police and military training and experience and thought that these roadblocks are really quite vulnerable out there in the desert so far from backup. Quite vulnerable......It's going to get ugly one day when folks decide they've had enough. And if statists don't think it can happen here, just visualize a larger scale resentment of the "man" beyond Watts. Like the black minority, the white minority within the white majority has it's limits in absorbing the abuses and effects of the ever intrusive Police State. What really bothered me, (in spite of my training and familiarity with police operations) was my own barely repressible reaction of fear, being trapped, resentment, mistrust, disrespect and intense dislike and the powerful urge to immediately, actively and physically resist this infringement of my right of unrestricted and peaceful travel. Fortunately, I didn't have to act because unlike most of my fellow citizens, I had a retired peace officer's badge. What about those that feel like that and do not have a get-outta jail/roadblock exit badge? I guess we'll soon find out when some get stopped and fight rather than have their rights violated. It's no longer a matter of if this is going to happen, just when. regards Joe Horn List retired cop and no longer proud of it. ======================== The War on Drugs is so wonderful -- I know that it is only a few more years before the "swastika" or the "hammer & sickle" will be flying from the government's flag poles from the East Coast to the West Coast. And in the name of saving all the children from the gun crimes - we'll all have been so disarmed by the War on Guns, which was born out of the War on Drugs, that we won't be able to stop the tyrants. But to use the words of socialists, of social engineers -- "it's for the better good of the community, the state, the nation, the people". Yes, being the good socialists and social engineers that the Drug Warriors are, the better good of the collective always takes precedence over individual rights, over freedom and liberty. I truly wish Hayek was wrong -- but if wishes were horses, beggers would ride. -Johann A Classical Liberal == Johann Opitz (w) johann_opitz(a)smtp.svl.trw.com == (h) johannp(a)aimnet.com == All Disclaimers Apply (to protect my employer) ==

1 0

Re: Crypto: Systems & Application Developers Wanted
by Greg Broiles 17 Dec '03

17 Dec '03

At 07:11 PM 10/15/96 -0400, Mark Aldrich wrote: >On Sat, 12 Oct 1996, SPYRUS wrote: > >> SPYRUS, the leading provider of cryptographic tokens (PC cards & >> Smart Cards), with associated systems and applications software, is >> looking for engineers with the following qualifications to work >> with >> our Secure Applications Group in San Jose, CA: >Uh, excuse me, but doesn't SPYRUS in fact market a Fortezza card? The >very same card being used by the Evil Empire to spread diseased and impure >so-called "cryptography" (with GAK permanently embedded into it) to the >uninformed minions? Uninformed? It's right in their name: SPY-R-US. Just don't tell Toys 'R Us, they've been on a trademark litigation jag lately. (but it might save everyone some time if they added "Not concerned about the long-term effect your work has on the quality of human life & freedom" to the list of qualifications required.) -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

Japan imposing crypto export restrictions!
by nobody＠replay.com 17 Dec '03

17 Dec '03

Another Cypherpunks exclusive! Bowing to US pressure, the Japanese Ministry of International Trade and Industry (MITI) has quietly made changes to Japanese crypto export regulations. In the past, export of crypto products from Japan was unregulated. The exporter had to file a pro-forma export declaration with MITI. The new regulations, imposed in recent weeks without public announcement, require the exporter to state the ultimate recipient of the crypto product. MITI then conducts a lengthy approval process that can take many weeks. It is widely assumed that the US used the thread of trade sanctions to bring about this 180 degree turn in the attitude of the Japanese government. The new regulations apply to exports from Japan to all countries, including the US. --anon

3 2

Re: "Right to Privacy" and Crypto
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 7:40 PM 10/15/96 +0000, attila(a)primenet.com wrote: > the first sort of stands, but consider that the right > to privacy and the freedom of speech should also include > the right NOT to speak --that has been gutted by the > rulings on the fifth. The limits on free speech in the workplace, and their gradual extension to non-work environments make me think the first is going down the tubes too. ------------------------------------------------------------------------- Bill Frantz | Tired of Dole/Clinton? | Periwinkle -- Consulting (408)356-8506 | Vote 3rd party. I'm | 16345 Englewood Ave. frantz(a)netcom.com | Voting for Harry Browne | Los Gatos, CA 95032, USA

1 0

Comment on binding cryptography (2)
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

Adam Back wrote: >Hey Bert-Jaap, I had you down as one of the good guys, what caused you >to fold :-) It's nice to hear I was listed as a good guy. Maybe I can regain some credit if I explain why I co-published the binding cryptography proposal ;-). I haven't yet made up my mind how the crypto problems for law enforcement are to be addressed. It's my Ph.D. subject, and all I can say at present is that the issue is complex. That is why I want there to be as much information on the issue as possible. I don't say I agree with key-escrow, GAK or binding crypto, nor with demanding a suspect to decrypt, but I want to know all there is to know before I make up my mind. Having a new proposal helps putting things into perspective. At least the binding crypto proposal shows (as other proposals have) that there's no need to escrow your private keys, and that's a point. Also, as I said in my first comments, binding crypto isn't meant to solve the crypto problem, it is "merely" meant to provide a trustworthy crypto system with some safeguard. Finally, to my mathematician's sense of aesthetics, binding crypto is an elegant proposal. It merits publication in its own right. Not because I think it should be established, but because I think it should be known. Bert-Jaap --------------------------------------------------------------------- Bert-Jaap Koops tel +31 13 466 8101 Center for Law, Administration and facs +31 13 466 8149 Informatization, Tilburg University e-mail E.J.Koops(a)kub.nl -------------------------------------------------- Postbus 90153 | This world's just mad enough to have been made | 5000 LE Tilburg | by the Being his beings into being prayed. | The Netherlands | (Howard Nemerov) | --------------------------------------------------------------------- http://cwis.kub.nl/~frw/people/koops/bertjaap.htm ---------------------------------------------------------------------

1 0

Re: mail software for multiple addrs
by Ross Wright 17 Dec '03

17 Dec '03

On or About 15 Oct 96 at 18:46, Vladimir Z. Nuri wrote: > 1. multiple internet providers > 2. multiple email accounts > 3. multiple mailing lists How about Pegasus? =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

Re: AW: binding cryptography
by roy＠sendai.scytale.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In your mail, you write: > That is correct. Sorry that the BTW-statement is so evident. Some people > did not understand that if you *do* agree, then you *can* be breaking any > rules... Which of course implies that to be effective, the system can't allow anyone to opt out. > >Which they will, and presumably already do. Therefore, your proposal > >does not and cannot hamper criminals. Therefore, your proposal only > >hampers law abiding citizen-units' access to uncompromised crypto. > > I do not agree. For instance, the encryption possibilities of wordperfect, > and MS-word are weak; my mail-system (ms-exchange) does not have any > encryption at all. The security of these important Custom of The Shelf > products can and will be enhanced.. And as I pointed out above, the system only works when compromised-key crypto is all that is available. Where there are more secure options available, people will choose them. Your example is a good one: WordPerfect, MS Word and MS Exchange may well choose key-compromised crypto to gain the approval of the state. Thus, those products will never have real security. I can't agree that key-compromised crypto is secure at all, as it requires that some third party hold key (or the means to recover keys). You may argue that the supposed TRP can actually be trusted. I'm not willing to grant that trust without good cause. In the case of governments, I'm simply not willing to grant that trust at all. (to be fair, I acknowledge that the USA is not the Netherlands, and you may not understand Americans' distrust of our government) > The point is that public available systems should *aid* not them in their > criminal activities, let them search for alternatives. Compare it with the > legislation we have here on the sell of guns. You sort of say: hey, that > does not help cause criminals will get it somewhere. I say, that is true, > but it will make their lifes more difficult, or maybe I should say less > easy. My point is that I, as a member of the public, should not be restricted in *my* choices. Just as gun control laws make it harder for me to lawfully purchase and own a gun, your proposal makes it harder for me to lawfully obtain strong cryptography. The obvious difference is that guns are capable of inflicting fatal damage to humans, where cryptography is not. > >Registration plates do not "stop criminals". Locks do not "stop > >criminals" (although they might slow a criminal down). Neither will > >compromised crypto "stop criminals". But all the above impinge on my > >liberty. Am I to give up yet another freedom? > > Our system slows down criminals too, or maybe I'd better say does > not speed them up. And it also makes me more vulnerable. You are asking me to compromise my own security because some other person might abuse his own capability. Will you also ask that I allow my muscles to atrophy to the point where I cannot inflict damage with a blow from my fist, because others might decide to fight? It is important to remember that cryptography is 100% defensive. It _cannot_ be used in an offensive manner. Any plan to weaken or restrict cryptography is a plan to disallow defenses. How can you ask me to leave myself vulnerable to attackers? > We believe our system gives a solution in which every democratic > country on his own implement to their middle, without losing > connectivity with countries that think otherwise. Repressive states will endeavor not to allow connectivity with non-repressive states. Your plan only facilitates the repressors. Thus, you offer weapons of repression to governments. Still think it's such a good idea? - -- Roy M. Silvernail [ ] roy(a)scytale.com DNRC Minister Plenipotentiary of All Things Confusing, Software Division PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMmRoQxvikii9febJAQHOvAQAhzUvsJapB+lBWM0MNjkOPFg0PtIFIKID 7uhWjzQ7Lwp7WlCeiqcB9+AdZuQMxAC/cq4uJai98jv8/5ba3t1uPiLMIx+ytSAN q8UURDF3CWaX5TAzrC0OvdPUc+LONXVBebX0PMtwHaGZfsJWnebschJA36zRIY8Z in8xv1t78Z8= =GITW -----END PGP SIGNATURE-----

1 0

[Noise] Re: [*CORRECTED* POINTER] On Vulis' net background (fwd)
by Douglas B. Renner 17 Dec '03

17 Dec '03

On Tue, 15 Oct 1996, Rabid Wombat wrote: > Still more on this rather silly topic: > (Hey - at least I put "noise" on it) :) Definitely needed. :) SORRY* I typo'ed the most incriminating link - the following should work: http://www.math.harvard.edu/~verbit/scs/cranks/from-Shlomo.html#vulis (This is a fellow with a rather long & amazing history of net abuse. It's amazing enough to warrant a look. There is a sub-section titled "Who is Dimitri Vulis" that most CP readers would find shockingly familiar. It explains _quite_ a bit.)

1 0

RE: mail software for multiple addrs
by blanc 17 Dec '03

17 Dec '03

I use Win95 and Exchange for email, which works as follows: In Exchange you can set up separate user "profiles", for which you enter all the info for any number of different ISP accounts, including the phone number for access, login name, and also password, if you wish. Then when you open up Exchange you can select which account you want to connect to. You can have a default connection, but after you've downloaded the email from one service, you can then select a different service to connect to and get your mail from there, and so on. Each selection of a service provider will automatically: 1. dial the service 2. log you in 3. enter your password, or allow you to enter it manually each time 4. download your mail 5. disconnect There are bars at the top of the Exchange email list of messages by which you can sort your mail according to Sender, Subject, To, From, Date Sent, Date Received, Attachments, Level of Importance, etc., according as you click on each so-entitled bar. Then you can highlight the messages and put them into folders and sub-folders. Each provider brings up its own window of user-created folders. At this time Exchange does not provide automatic filtering or "rules" to send certain messages to particular folders unless you're connected to an Exchange server, but there is a nifty new mail package front-end coming out very soon which will do this. Then it will be possible to indicate that you want all your Cypherpunk mail going to the 'cpunk' folder, or messages from certain individuals going into a folder by their name (or you can send their email to the 'Delete' folder and set this folder to automatically delete all those messages when you exit the mail program). With Win95 you can also connect to a service provider through a semi-GUI interface for shell-access only (called Hyperterminal, similar to a telnet window) and use whatever software the provider offers (like Pine), and this will appear in all text, except that you can set automatic connections. You can create multiple icons with their own separate automatic connections for this type access as well. Internet Explorer 3.0 also offers mail features similar to Netscape, but they're also still comparatively simple (limited) . .. Blanc

1 0