- cypherpunks-legacy - lists.cpunks.org

** 9/24 Ca. Dig. Sig. Working Group Meeting **
by Kaye Caldwell 17 Dec '03

17 Dec '03

Reposted from spki. - Bill -------- Apologies for duplicates - some of you I'm sure are on multiple notice lists for this. California Digital Signature Regulations Working Group sponsored by the Software Industry Coalition and CommerceNet THIS MEETING IS OPEN TO ANYONE WHO WISHES TO ATTEND However, please let me know if you will be attending via e-mail to: kaye(a)ix.netcom.com WHEN: Tuesday September 24, 1-4 PM WHERE: Sun Microsystems, 901 San Antonio Rd, (Building PAL-1) (corner of S. A. & Charleston, just off 101), Palo Alto Cancun Conference Room, 2nd Floor AGENDA I. Report on status of Secretary of State's Task Force - request for demos of technology in Sacramento II. Review of draft of our principle 1, suggestions for additional principles III. Review of current draft of outline of regulations IV. Review of draft Digital Signature Acceptance Procedures background paper V. Draft language for additional technologies For more information, e-mail Kaye Caldwell at kaye(a)ix.netcom.com or call 408-479-8743. Kaye Caldwell Software Industry Coalition Policy Director CommerceNet Adovocacy and Public Policy Committee Chair -------------------------------

1 0

Re: LEOs running anon servers?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:15 AM 9/20/96, "Michael Froomkin - U.Miami School of Law" <froomkin(a)law.miami. wrote: >This claim was made at a symposium held at Harvard by a sometime lecturer >at the National Defense college. He later denied it. Since lots of other >things he said in the same lecture were plainly false (more likely his >ignorance than a clever attempt to spread FUD), I wouldn't lose sleep over >it. > >Anyway, who cares -- you just use encryption and chaining and all is well. The coauthors (the other works for Science Applications) have never supplied evidence for the verbal claim, as Michael notes. From there paper, they seemed ill-informed, and apparently took most of their material from published Web pages (e.g., Raph Levien's). But I'm not as sanguine about chaining being enough. Think of it as a "percolation" problem, similar to finding a path through a network. To make this clear, if there are M remailers and N of them are "colluding" (whether NSA-controlled or working for Burger King), and one chooses O of them for a chain, what are the chances that one is compromised? To put some numbers on this, if there are 30 remailers and 15 are NSA-owned and one picks 5 remailers in a chain, there's a 3% chance that all the remailers picked are NSA-owned. And so on. A standard probability calculation. There are nuances to consider. Reputations of remailers (beliefs by others, a la Demptster-Shafer propagation of beliefs). Using one's self a remailer is always a nice touch. And so on. I do think there is almost no chance any of the "well-known" remailers are NSA or GCHQ-controlled, but the situation may change as remailers become less well-known and more fluidly instantiated, and as the NSA begins to take more serious notice of remailers than they apparently have so far. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: HipCrime as MetaSPAM
by James A. Donald 17 Dec '03

17 Dec '03

At 02:10 AM 9/15/96 -0700, Bill Stewart wrote: >5) "Anarchist Info" - sigh. Where do people get the idea that publishing >recipes for drugs and explosives is anarchist info? He didn't talk >about anarchy, or getting along without governments, or getting rid of them. >Also, he neglects to note that you can simply _buy_ potassium chlorate, >rather than having to (dangerously) boil down bleach and potassium chloride In addition: Potassium chlorate based explosives are not particularly safe or reliable, but worse than that, much worse, because of their relatively slow detonation rate, they are very ineffectual for smashing stuff and killing people, --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: did you go to school?
by HipCrime 17 Dec '03

17 Dec '03

message returned, then deleted (UNREAD) -- HTTP://www.HIPCRIME.com

1 0

Re: stealthy key exchange
by Bill Stewart 17 Dec '03

17 Dec '03

At 11:37 AM 9/19/96 DST, Bodo_Moeller(a)public.uni-hamburg.de (Bodo Moeller) wrote: >If both have public keys, what is the point of using Diffie-Hellman? >The two channels (Alice -> Bob and Bob -> Alice) are independent, so >they can use different session keys. Alice creates a random key K_A >and sends it to Bob (encrypted with Bob's public key). Alice uses K_A Diffie-Hellman gives you forward security - if an eavesdropper copies your message and later steals your secret keys, he can't decrypt it, because there's no encrypted session key to recover. To prevent man-in-the-middle attacks, sign your half-keys with your public key. There are some problems with this method - it requires several exchanges, so it's awkward to use for email (though you can do it.) Also, it does expose the signed keyparts, which reveals the public key used for signing, though you can play games to prevent this (e.g. negotiate the key, and send the signed keyparts encrypted with the public key, though if there _is_ a man-in-the-middle, the MITM can see this, and your connection will fail.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

"Confidential" medical databases
by Brad Dolan 17 Dec '03

17 Dec '03

AP, 9/19/96: Copies of a confidential computer disk containing the names of 4,000 AIDS patients were shipped anonymously to two newspapers by someone who claimed a [Florida] state health worker had been showing it on his laptop computer to friends outside a gay bar. William B. Calvert III, 35, of Treasure Island, was one of only three state Department of Health and Rehabilitative Services employees with authorized access to the confidential information. Calvert was suspended with pay Thursday as the Florida Department of Law Enforcement and HRS investigated the breach. "This is very serious. We are not aware of any breach of confidentiality of this magnitude," Jay Coburn of the AIDS Action Council in Washington, D.C. said Thursday. Nobody knows how many copies of the disk have been made, or who has them. If the allegations prove true, it could be the worst violation of AIDS confidentiality in history. [...] bd

1 0

Re: CNET Digital Dispatch Vol. 2 No. 38
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:12 AM 9/20/96, Rick Osborne wrote: >This week's c|net digital dispatch had the following top ten list. For >number 8, did they mean DES or is the EDS something I'm not aware of. I >figure it has to be because what does DES have to do with chat rooms? >>8. Perot's crack team of EDS hackers would get him >> in somehow. EDS = Electronic Data Systems, the company Perot formed in the 1960s. Acquired by General Motors, then spun off. Perot has not been connected to it for many years. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: 56 kbps modems
by John Gilmore 17 Dec '03

17 Dec '03

I checked the Rockwell home page, which has a pointer to the press release. It isn't very technical, but gives some good clues. It looks like they're doing an interesting trick. The modems aren't designed for use like traditional modems, where the same equipment is on each end. Instead, there is a digital interface on one side of the phone call (like at an Internet Service Provider). The consumer side modem has a traditional analog interface. The rest of this is speculation and fantasy on my part. So, think about it. The analog side will generate voltages and send them to the local central office, where they will be digitized and sent to the destination central office digitally. There, they will be patched into one channel of a T1 line (out of 24) and sent digitally to the ISP's "modem bank". Equipment is already available (and in use all over the uunet network) that plugs T1 into a board full of digital signal processors, decodes each of the 24 channels (each channel running any modem signalling protocol, or ISDN), handles PPP packet framing, and gateways the resulting packets to/from an Ethernet. Now for Rockwell's trick, you get the DSP's in the two modems to talk to each other. They can run some simple coding scheme (say ordinary 2400 baud modem for this example) to pass digital data back and forth while they're negotiating the full blown deal. First, the analog side sync's up with the clock for the 8000 samples/sec that the central office is digitizing (into 8-bit samples). You can do that by sending one voltage and then switching to another; the far side can tell you whether you switched on a sample-boundary or not (was there a sample "in between" before it settled to the new value?). OK, then, in each sample slot, the analog side can send one of 256 different voltages. The digital side can tell it the 8-bit values it received. Then fine-tune that to sending 128 different voltages, taking particular care around the ones that got distorted the first time. As long as you can find 128 distinct voltage levels that the central office will reliably digitize, you're done. You're sending 7-bit samples at 8000 samples/sec. Do something similar for the analog receive side, and you can start passing user data at 56K. If the robbed-bit stuff gets in the way of seeing 128 distinct voltage levels in every byte, you can send solid zeroes or solid ones in each direction and see which bits they're stealing out of which bytes. Use most of the 8 bits available in the other bytes (you can find e.g. 200 different voltage levels that will work), and in the stolen byte, you can find e.g. 100 voltage levels that work. This is more bits than using 128 voltage levels in every byte, and in fact you can probably get closer to 64 kbits/sec than to 56 kbits/sec, depending on the analog qualities of the wire to your central office. A nice trick! It won't speed up analog-modem-to-analog-modem connections, but those will increasingly be a smaller and smaller fraction anyway, as the digital infrastructure becomes cheap. And of course the 56K modems will just be DSP's with decent A/D and D/A interfaces, so they can run all the old analog protocols too, in the case that the phone line isn't digitized, or if they want to talk to an old modem. John

3 2

other Lexis-Nexis databases
by bryce＠digicash.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A brief search of www.lexis-nexis.com reveals a few interesting details: 1. You can look up people in P-TRAK by SSN. 2. There are many other databases of personal information, including: a. "REZIDE", "searchable by congressional district, area code plus exchange, county, state, metropolitan statistical area (MSA) and dominant market area (DMA)" and "providing a detailed demographic portrait [...] including age, income, race, ethnicity, household composition, employment", a "White/Blue collar index" and a "family life-cycle code". b. "DCEASE", giving information including SSN about dead people. c. An assets database identifying real-estate or FAA-registered aircraft owned by people. d. Something called "P-FIND" which is advertised as "having greater detail [than P-TRAK] with regard to the individual's household (value of home, number of dependents)". This one appears in a newsletter from 1994, so the service may be discontinued (although of course the data still exists...). It would be a fun experiment and a good cypherpunk publicity stunt to test Lexis-Nexis out. Pick a demo victim, e.g. a journalist who is honest, smart and concerned about such issues, but not one who is too famous or rich. Use Lexis-Nexis (and possibly other resources) to learn all that you can about him/her. If he/she lives in a sparsely-populated area a narrow enough REZIDE search might give income, number of persons in household, marital status, age, schooling, ethnicity, vehicles owned, and employment, and that would be with a single search. Compile everything you know and send it to the victim, explaining how you got the information. Regards, Bryce -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMkJQCUjbHy8sKZitAQFb8AL/f2yQWv1R4QcftBF4khw0DZrd/szZqte3 UQ0HvjtAdjiVee7aLiumljMUqyMOzsXQlkWKh1/JXmbgVAVrsJGhZEFCyqbheUwP eqhP1QEYVHfjueQy1FlSb7U3f+VI2tzk =mky+ -----END PGP SIGNATURE-----

1 0

REJ_ect
by jya＠pipeline.com 17 Dec '03

17 Dec '03

9-20-96. NYP Page One: "Cellular Industry Rejects U.S. Plan for Surveillance. Police Want Technology That Pinpoints Wireless Users Within a Half-Second." Markoff. The wireless communications industry voted yesterday to reject Government-backed technology that would make it possible for law enforcement agencies to keep closer tabs on cellular phone users. DoJ wants to be able for the first time to determine the location of a cellular phone caller within a half-second and almost instantly monitor the status of cellular-phone voice mail, conference calls and other wireless communications features. Yesterday's vote by a subcommittee of a network operators and manufacturers group called the Telecommunications Industry Association, came in response to a technical document the F.B.I. has been quietly circulating to industry executives since April. Known as the Electronic Surveillance Interface, the document specifies what wireless communications monitoring data must be accessible to law enforcement officials with a court warrant. ----- http://jya.com/reject.txt (8 kb) REJ_ect

1 0