- cypherpunks-legacy - lists.cpunks.org

Clipper III questions
by Eric Murray 17 Dec '03

17 Dec '03

The recent CDT policy post sez of Clipper III: >* Access to keys internationally "would be provided in accordance with > destination country policies and bilateral understandings." This reminds me of the understanding between CIA/NSA and their counterparts in British Intelligence. Both sides are prohibited from spying within their own countries borders but are encouraged to spy in other countries. Both would very much like to spy on their own citizens (for legitimate law encorcement/national security reasons only, of course). So, they have a simple system in place. The British spy on the American citizens that the Americans want spied on and then turn over the intercepts. The Americans do the same for the British in Britain(*). Sometimes they lie to each other or withhold material, but that's what spy organizations do all the time. If Clipper III passes and the OECD gets their member nations in line with what the American miliary wants, I predict a similar system will evolve. "Destination country policies" will allow decryption of incoming GAKked messages from non-citizens. After all, they have no rights, do they? Cooperating intelligence agencies will then exchange intercepts. Presto Chango, pesky privacy rules vanish right before your eyes! Of course this is in our best intrest, we must fight against terrorisim with all methods possible. The ends justify the means. A question: What happens if a company decided not to go along with Clipper III? Can they still ship the "old" 40-bit-style GAKware unimpeded? Or will there be a slow tightening of the rules to force compliance? The existing way of doing things depends to a large degree on a set of "common practice" which the NSA doesn't have written down. For example you won't find the 40 bit limit written anywhere in ITAR, and if you want to export something that's already been approved elsewhere (i.e. another implementation of SSL) you still have to go through the approval process. (*) this comes from "The War Aginst the Jews" which is worth reading. Sorry I can't find my copy at the moment, maybe someone who's got it handy will provide authors/ISBN. Capsule review: covers government dirty dealing from the early 1900s on, mostly British and American. Concentrates on Jews and Israel of course but they seem to have been the brunt (sometimes the instigator) of a lot of the dirty pool that governments have played. -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

3 2

DESCrack keyspace partitioning
by geeman＠best.com 17 Dec '03

17 Dec '03

What about the heuristics of partitioning the keyspace? Seems to me that a _subset_ of all possible keys is much more likely to appear than a random selection from an equidistributed population 0..2^56. (P)RNG's just aren't that likely to produce a key of 010101010..... nor 001100110011... etc etc and I have been thinking about how one might formalize and exploit this randomness property to increase the probability of finding the key sooner. So a keysearch strategy should be something other than a partitioning of 2^26 into N bins with a linear search within each bin. I realize that it is POSSIBLE that a key of 1010101010... was used, (excluding weak keys from consideration) ---- but I have seen "certifiable" RNG's and, God Bless 'em, they just dont ever produce anything with any predictability. Is not the lack of predictability a predictable, and therefore exploitable, attribute? Any thoughts here? ----------

9 9

Re: Fw: Re: ITAR satellite provision
by jim bell 17 Dec '03

17 Dec '03

At 02:05 PM 10/3/96 -0400, Michael Froomkin - U.Miami School of Law wrote: >Alas, a common fallacy. > >You have committed a prohibited export when the stuff lands outside the >USA....It's not illegal when it goes up ("by reason of the launching" and, >e.g. *stays up* in orbit) but it is illegal when it comes down abroad. Sure about that? The regulation said something like "launch vehicle" or "launch," apparently indicating that a "launch vehicle" could actually be exported, THEN launched, etc, without violating ITAR. And since the regulation does not go into any detail about the "launch", other than it is a "launch" (and does not explicitly prohibit landing subsequent to launch) the implication is that there is no prohibition. I still think the regulation was just written sloppily. Jim Bell jimbell(a)pacifier.com

2 1

EzStego in Java!: Now Disappearing At A Site Near You
by romana＠glamazon.com 17 Dec '03

17 Dec '03

EzStego, my tool for "steganography made easy", now has its own web site at http://www.fqa.com/ezstego/ EzStego is currently alpha software. Use it at your own risk. It is a reimplementation in Java, with much improvement, of my notorious shareware product, Stego. EzStego is also shareware. I have made the source code available for peer review and verification. EzStego and EzSteggy are (C) Romana Machado 1996. All rights reserved. Romana Machado romana(a)fqa.com http://www.fqa.com/romana/ http://www.glamazon.com/

1 0

Re: support for "crack DES"
by jim bell 17 Dec '03

17 Dec '03

At 01:26 PM 10/3/96 +0000, Omegaman wrote: >Considering the situation -- considering that RSA has even signed on >to this scheme -- I'd have to say that I don't give a rat's ass what >Bill Gates claims. If Micro$oft bucks the system, I'll gladly >applaud their stand. > >The situation is not good at all. > >Cracking DES (whether distributed or through a hardware crack, or >both!) seems critical at this point. Just remember that it would be far better to make the crack look easy, than to make it look hard. quantity 9000+, $1,000 Pentiums for a year (plus maybe $500,000 in electricity) looks "hard." 1000 dedicated chips (whether they be FPGA or custom or...) for 1.5 months or so looks "easy." The latter crack looks far more likely to be repeated. The former is OBVIOUSLY a stunt. Jim Bell jimbell(a)pacifier.com

2 1

Esther Dyson: Pro-crypto in Poland
by Joel McNamara 17 Dec '03

17 Dec '03

I'm in Warsaw doing some consulting for a local ISP and got invited to an Internet conference last night targeted toward government ministry officials. Even though I speak no Polish, I decided to go because Esther Dyson was one of the keynotes. The three day conference is being held outside of Warsaw. The location has to be one of the most unique conference settings I've ever seen. How about in a classroom of what appeared to be the government police training barracks. Guarded gates, barking German shepherds in kennels, and armed, marching cops in camo fatigues. Interesting. Got to suggest it to the DefCon folks instead of Vegas. Anyway, not knowing what Esther was going to talk about, I started to smile when she launched into a very pro-crypto (as in anti-key escrow) presentation. Through a translator, she did a good job of covering most of the issues near and dear to Cypherpunks's hearts. She closed with urging the Polish officials to make their own decisions regarding privacy and crypto, and not be swayed by the actions of the US government. Someone in the audience asked what the average American thought of the ongoing crypto controversy. Esther answered correctly, that they're mostly clueless. Of course I had to stand up and mention the grassroots Cypherpunk efforts just to let folks know not everyone besides EFF is idly standing by (I think my host did a pretty good job of translating). Esther's comment was that Cypherpunks weren't average. You decide if that was a compliment or not. I don't know. Despite the bashing she got on the list about anonymity, I was impressed. Presenting the issues in a very logical and rational manner to government officials in "crypto-neutral" territory counts for something in my book. Anyway, based on all of the nonsense going on in the US, it's interesting to be in an environment where there are strong concerns about privacy and government abuses by the average citizen. I think Americans have taken for granted many things, that only living under a repressive regime would make them appreciate. Joel

1 0

Lack of reporting on CALEA and Encryption issues ...
by Ernest Hua 17 Dec '03

17 Dec '03

I must first say that your program is one of the finest in news reporting, and I tune in every day. However, nothing is perfect, and your program is no exception: I am very concerned by the lack of reporting on CALEA (the US $500 Million Digital Telephony bill) and the continuing maneuvering by the Clinton administration on the encryption issue. Two years ago, FBI Director Louis Freeh managed to slip a $500 Million wire tap bill into the Congressional budget using last-minute sneaks. (He and his predecessors had tried unsuccessfully for several years to do it in the full light of open democracy, so this was the only way they could force it down American's throats.) After seeing this pass, many Congress members refused to fund it because the FBI continued to violate terms of CALEA which required full accounting to Congress of how the wire tap capacities were to be designed and used. When the figures were finally published, the public balked. Not surprisingly, Freeh had to resort to the same last-minute maneuvers to sneak in funding for CALEA this year. If the news media had reported either incident (or both), I would probably not be so upset, but the news media completely ignored this horrible abuse of the democratic process. The same goes for the encryption issue. It is clear that all present and past administrations have sided strongly with law enforcement and national security agencies, and have refused to allow for the proliferation of strong encryption despite the fact that it is probably the single biggest technical obstacle to Internet commerce and personal privacy. Again I would not be so upset if they let the issue be decided in the full light of democracy rather than behind closed doors using the "if you only knew what we knew, you would agree with us" argument. This sentiment is precisely echoed by the Congressional study done by the NRC on national cryptographic policy. The Clinton administration was hoping that the two year study would buy time and would eventually agree with its opinion, and when it did not, the Clinton administration dismissed it as uninformed, despite the fact that most of the NRC panel did get the infamous "secret briefing" by the NSA. Basically, they are not open to reason on this issue; they are open to one and only one idea: that law enforcement and national security agencies having guaranteed access to information when they want it, and they don't care about the technical or the privacy implications. Oh .. and by the way, they want access to all information, not just that which crosses national borders. The significance of these two issues are difficult to summarize in a sound bite. The best I can think of is to watch the Tom Clancy movie "Clear and Present Danger". While watching this movie, note how the CIA finds the telephone conversations of the drug dealer's agent. That sort of capability is called "drift net fishing" (for obvious reasons). "drift net fishing" was not possible in the old days of wire taps because the phone company barely kept enough written logs to find the cables and the wires, let alone figure out exactly where they go. The problem is especially difficult in older/larger cities where phone company technicians often tap a wire (for normal services) wherever it works. By the FBI's estimates, each physical wire tap costs on the order of $50K. Basically, the huge cost barrier (in man power) kept the government's powers in check. Enter the digital and wireless age, and suddenly every signal from every phone, beeper, computer and other neato gadgets are sent all over the place. True, it has become more difficult to figure out where a signal is routed, and that is what the FBI complained about. On the other hand, it has become infinitely easier to intercept communications without detection because every transmission is just a perfect verbatim copy of the original. Suddenly, the cost of monitoring a phone is not so high. If the routing capability is there, the FBI agents can sit in their comfortable offices and press the right buttons, and the contents of the call is duplicated at their desks. Of course, they don't have to have real people monitoring such calls; they can have voice analysis computers do it. They can search for anything that sounds like "bomb" or "kill" or "shoot" or "blow up". In the Clancy movie, such "drift net fishing" capability is clearly being used for good purposes, and I certainly applaud that. I hope that all of the leading edge technologies used by our law enforcement and national security agencies are used for good purposes. But that is not what history tells us. History tells us that such technologies are oblivious to the morals and ethics of their masters. Even in the older days of wire tapping techniques, the FBI was able to illegally intercept communications of civil rights leaders and other "dangerous" elements of society. Therefore, to grant the government capabilities that would enable "drift net fishing" on our own citizens is setting a very dangerous precedence. What if the FBI decides to search for "democratic" or "republican" or "pro-choice" or "pro-life"? What if they search for "muslim" or "jewish" or "christian"? These are the real dangers of CALEA and encryption restrictions. The boogie men that will plan bomb attacks and kidnap children have always found a way to do it, and some have gotten away, without any help from encryption or secure telephones. If the law enforcement and national security agencies truly want to save lives and promote public safety, there are many other issues and problems to deal with, and they are wasting valuable time with these two issues; other the other hand, if they just care about keeping and enhancing their abilities to be omniscient, then their current behavior is quite consistent with that goal: 1. Lies and misrepresentations: a. Louis Freeh now claims that CALEA will cost $2 billion. b. The CALEA slush fund Freeh got passed at the last minute of this Congress is actually unlimited. c. Despite their promises of full reporting, they have actually succeeded in defeating all the reporting clauses in CALEA, again, thanks to this last minute sneak. d. Clinton, Gore and company have consistently denied that they intend to restrict domestic encryption. However, if you listen to Gorelick, Freeh, Reno, Crowell and others, you will find out that they absolutely against domestic encryption. 2. Beaurocratic maneuvering: a. Spent 3 years "investigating" Phil Zimmerman and then dropped without comment. b. Used every trick in the book to keep ITAR encryption rules from ever being directly considered for Constitutionality. (NSA internal counsel believes it will not withstand such a legal challenge.) c. Refused to clearly define what is exportable and what is not. (Keep it confusing so that most will stay away just to be safe.) Also refused to clearly define what is "export", given that encryption is just algorithms and information in the purest form. I appeal to you, as a respected news organization, to investigate this in detail and expose the facts and let the public decide. Thank you. Ern

1 0

Re: WINDOWS NT ????
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Thu, 03 Oct 1996 19:47:06 +1030, Petr Snajdr wrote: > is Windows NT secured system ? No. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

4 4

[ANNOUNCEMENT] Cyclic codes
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Now is the time for all good little boys to cum in Timmy May's big mouth.

1 0

Re: gack vs. key escrow vs. key recovery
by jim bell 17 Dec '03

17 Dec '03

At 05:33 PM 10/3/96 -0700, Vladimir Z. Nuri wrote: >cpunks, a note about recent developments in "key recovery" initiative. > >I think cpunks as a group should reconsider very seriously their >own positions on cryptography and come up with something more >sophisticated than "any government bill or plan associated with >crypto is evil" which is the functional equivalent of the ideology >behind many recent posts. We don't think they're all NECESSARILY evil...they just turn out that way. Whose fault is this? >what is the precise difference between gack, key escrow, and >key recovery? Phase of moon? Season? Maybe it has something to do with the 11-year sunspot cycle? Bi-millenialism? >TCM has argued that the administration is muddying >the issue by manipulating the terminology. perhaps so, but I feel >that cpunks are equally guilty, by branding anything that emanates >out of the government as inherently orwellian. do you always have >to have an enemy? is the government always going to be your >enemy, no matter what they do? The government seems to be BEHAVING as if it is always going to be our enemy. Whose fault is that? >I have posted here before that many companies find the concept >of "key recovery" highly acceptable and even desirable. the >basic question is, what does this mean to wiretapping and >search warrants and subpoenas? >it is clear we are coming to a fork in the road at this moment. And it is our goal to not "get forked." >there are going to be two types of cpunk opinions based on recent >developments. > >1. those who feel that wiretapping was illegitimate from the >start and are working to make wiretapping impossible. confronted >with a legal search warrant/subpoena etc. for personal data, >they would not hand over keys. they would "superencrypt" in >systems that do etc. That's me... >2. those who feel that there is such a thing as a legal warrant >or subpoena for information protected by cryptography keys, and >would agree that this logically means that governments will be >getting access to "key recovery" infrastructures. On the contrary: The existence of a "legal warrant" doesn't mean that the government ought to (or even can) get access to data via a "key recovery" system. It's been mentioned numerous times that there are plenty of things that could be done (multiple encryption; encryption of GAK'd key; foreign key escrow with no request cooperation, etc) to prevent this. >personally I am leaning toward 2, because I feel that we already >live in such a society, We also live in a violent, oppressive society. Does this mean that we shouldn't try to fix its problems? > and that it is not orwellian. Pollyanna, meet Eric Blair. > companies are going to lean toward (2). No, they're going to lean towards yet another system, (3), whatever suits them. > I do agree >that the gov't has the potential to twist this process to evil >ends, If it had not had the desire to "twist this process to evil ends" government wouldn't have interfered with the natural development of key-keeping systems which serve only the key owner, not anyone else. > but that has always been true of everything about democratic >government, and the recipe for 200+ years has always been >and remains "eternal vigilance". in other words, I am in favor >of some kind of mechanism by which the government can obtain >keys via subpoenas/warrants. And I am in favor of some kind of mechanism by which the government can be destroyed by ordinary citizens. >cpunks, I think we should try to clarify our terms and come to >some conclusions. > >those who continue to pursue (1) are going to be perceived as >more and more radical and extremist, because arguably it is not >even a system we have today or one that was ever devised. I'd disagree with that. I've devised a system... >remember, the constution guarantees >freedom from *unreasonable* search and seizure, but never >prohibited search and seizure in the first place!! apparently >at least our found fathers believed that "reasonable" search >and seizure was a wholly legitimate function of government, >based on this wording. I guess that means that anything they call "reasonable," you'll agree with? Hint: Between about 1932 and 1968, wiretaps in the US were ILLEGAL. Nevertheless, they were done anyway, by the telephone company on request by the cops. (they were not admissible in court, however.) Question: Should we define the standard of 'reasonable' on the opinion of a group of people (cops, officials, politicians) who have a proven habit of using illegal techniques to get information? Apparently, cops are unwilling to let illegality get in their way. I'd say, on the whole, cops must have a rather enormous motivation to get wiretaps, and only a fool would think that this would fail to motivate them to adjust their standard of "reasonableness." >regarding (2): the government may actually help bring crypto >to the masses via the post office and other routes. are >cpunks going to continue to hold the simplistic, reactionary, >knee-jerk, black-and-white opinion that "anything with the >word 'government' in it is evil"? "if the government is doing >something, then we must sabotage it"? So far, such an opinion would fit the facts far better than anything you've said so far. Jim Bell jimbell(a)pacifier.com

1 0