- cypherpunks-legacy - lists.cpunks.org

Fireworks expected, missed at Senate crypto hearing
by declan＠well.com 17 Dec '03

17 Dec '03

Date: Thu, 25 Jul 1996 21:05:31 -0500 To: fight-censorship+(a)andrew.cmu.edu From: declan(a)well.com (Declan McCullagh) Subject: Fireworks expected, missed at Senate crypto hearing Sender: owner-fight-censorship(a)vorlon.mit.edu Precedence: bulk Contrary to the Reuters report excerpted below, there weren't any fireworks at today's ProCODE crypto hearing before the full Senate Commerce committee -- at least during the first panel when the spooks testified. (I skipped out before the second, which had industry folks.) Just more of the same, though we heard less about child pornographers and more about terrorists. And Sen. Slate Gorton (R-Wash) jumped on the committee staff for leaning too far *away* from national security interests in their summary of the legislation. Most amusing point: Sen. Larry Pressler waved a copy of the floppy with the _Applied Cryptography_ source and couldn't remember what it was called. "Um, I can't export, um, this, um," he mumbled. "Cassette," he decided it was. (Even his committee staffers smirked at that.) The FBI's Louis Freeh kept mouthing the same tired old line: "No reasonable person can envision a lawless information superhighway. It was never meant to be that. We need cops there, as we need them elsewhere. The problem is the proliferation of unbreakable encryption." He said it's "not too late" to stop the spread. After the first panel ended, a gaggle of a half-dozen camera crews waylaid Freeh in the hallway outside. The FBI director fled down the stairs. The crews split into teams. Half took the elevator and half pursued on foot. Downstairs, Freeh shot through the security checkpoint into the safety of a waiting Chevy Suburban. Why were they dogging the guy? They didn't care about crypto -- they wanted a comment about the TWA flight, and Freeh wasn't talking. He didnt' mention it at all during the hearing... -Declan -------------------- Fireworks Expected at Encryption Hearing July 25, 1996 WASHINGTON (Reuter) - After sailing through two quiet subcommittee hearings, a bill to relax restrictions on computer encoding faces a much choppier ride before the full Senate Commerce Committee on Thursday. The committee will hear from some of the Clinton administration's big guns on crime and national security, including FBI Director Louis Freeh and William Crowell, deputy director of the National Security Agency. Software manufacturers and some in Congress argued at earlier hearings that current export restrictions on encryption programs -- which code and decode information -- cost American companies billions in lost sales overseas. [...] Senate bill 1726, the Promotion of Commerce Online in the Digital Era Act of 1996, would abolish most export restrictions and prohibit mandatory key escrow. Vice President Al Gore told reporters at a press conference July 12 that the proposal, known as the ``pro-code'' bill, is ``unacceptable.'' [...] Clinton administration officials have said they favor less radical reform. Officials are expected to reject the conclusions of a study released in May by the National Research Council. The council concluded that encryption export restrictions should be relaxed and rejected key escrow as unworkable. [...]

1 0

Re: Fireworks expected, missed at Senate crypto hearing
by jim bell 17 Dec '03

17 Dec '03

At 09:19 PM 7/25/96 -0500, Declan McCullagh wrote: >Just more of the same, though we heard less about child pornographers and >more about terrorists. And Sen. Slate Gorton (R-Wash) jumped on the >committee staff for leaning too far *away* from national security interests >in their summary of the legislation. What does that mean? As opposed to what? (Gorton's my Senator, and I'm going to give a little feedback to his local office...) >The FBI's Louis Freeh kept mouthing the same tired old line: "No reasonable >person can envision a lawless information superhighway." I guess that makes me an unreasonable person! > "It was never meant to be that." Well, that's just the problem...for _him_! Sometimes actions lead to hard-to-predict outcomes. >We need cops there, as we need them elsewhere. The problem is >the proliferation of unbreakable encryption." He said it's "not too late" >to stop the spread. Wishful thinking! Not only is it too late now, it was too late with Clipper I was proposed. Jim Bell jimbell(a)pacifier.com

3 2

Re: Produce 7 Hertz Frequency
by Paul S. Penrod 17 Dec '03

17 Dec '03

On Thu, 25 Jul 1996, Jerome Tan wrote: > Does anyone know how to produce a 7 hertz frequency? > > Well, you can pick up most any project book that deals with 555 IC timers and there is some kind of circuit there dealing with frequency counting or generating. The question really is how strong a signal do you want ? ...Paul

1 0

Re: Apps: Unix for Windows 95
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

unix doesnt have to be $$$$$$$$ you can pick up a shareware version of unix (all the power features in it) called linux. Info magic sells nice cd sets. Goto your local microcenter... or search the net for linux (warning..about 80 googleplex hits will come up hehehe)

1 0

Re: Produce 7 Hertz Frequency
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:56 AM 7/26/96, Mike Duvos wrote: >I'm not sure what this gentleman's application is. If I wanted >a 7 hz signal, I would take my handy dandy programmable digital >signal generator, press the "sin" button, and punch in "7" on >the numeric keypad. > >Am I missing something here? What does "sin" have to do with the number 7? Oh, you must mean the movie "Se7en," in which the Se7en deadly sins were central to the plot. I get it. The seven deadly sins are the seven deadly hurts. (Cos I know about sin.) Ironic that the original message was from Jerome Tan, eh? Someone must've trigged this whole thread. I fear we're going in circles. "Kenneth, what is the frequency?" --Dan Rather Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Unix under Windows 95
by Duncan Frissell 17 Dec '03

17 Dec '03

See: http://www.windows95.com/apps/unix.html For a collection of Unix software ported to Windows 95. The PERL 5.0 works better for me under 95 than under Unix (but I probably don't know Unix. Unix Plea: Could some Unix Guru out there give me (privately) a simple alias statement or whatever that would automatically forward mail for a named user(a)host.com to another email address somewhere in the world. DCF

1 0

Re: Distributed DES crack
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 10:30 7/23/96, Matt Blaze wrote: >My estimate is that an FPGA-based machine that can do a single DES key >every four months (eight months to exhaust the whole keyspace) could >be built with off-the-shelf stuff for comfortably under $50k (plus >labor, plus software development costs). A prototype board should cost >under $1000 and will help prove the concept and get a more accurate cost >estimate. I expect to build such a prototype machine myself, and, if it >works as I expect, maybe the whole thing. I am willing to financially contribute to the project. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: www.anonymizer.com
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:53 PM 7/25/96 -0700, mpd(a)netcom.com (Mike Duvos) wrote: >I had occasion to try www.anonymizer.com recently, and noticed >that it does not make SSL connections to other Web servers, nor >does it seem to accept them from the user. > >Is there some technical reason for this? If I wish to grep the >Web without my browsing habits becoming known to someone >monitoring my Net connection, https://www.anonymizer.com with 128 >bit encryption would probably be a good thing to connect to. I suspect the primary reason is "that takes work we haven't done yet" rather than anything more cryptographic :-) However, there are a couple of theoretical problems with doing it as well. 0A) Suppose You and Webserver are secure by definition (because otherwise you're hosed anyway....) 0B) Let -s- denote an SSL connection and --- denote a non-SSL connection. 0C) A connection from You-s-Webserver is as secure as SSL. 1) A connection from You-s-Anonymizer-s-Webserver is less secure, because any flaw or breakin or dishonesty or compromise of the Anonymizer compromises the security of your connection. 1A) You may get ripped off or arrested if the Anonymizer's compromised 1B) The Anonymizer may be liable if you get ripped off through it. 2) An SSL connection may carry a certain amount of indentification data across it (I'm speculating a bit), which isn't really what you want in an Anonymizer. 3) A connection You-s-Anonymizer-s-Webserver may not always work the same as You-s-Webserver, because the latter may make assumptions about the connection that don't hold with the former. 3A) Of course, that's also true with non-SSL connections*, but there's less likely to be money riding on the deal. 3B) In particular, there may be different identification data passing across the Anonymized connection than the non-Anonymized. 3C) You may trust the Anonymizer and not the Webserver, or vice versa, and SSL probably isn't designed to do both correctly. 3D) The Webserver may trust the Anonymizer and not You, or vice versa, and SSL probably isn't designed to handle those correctly either. 4) The Anonymizer may have different encryption types/strengths than You or the Webserver. 4A) If You only do 40-bit RC4 and the Anonymizer can do 3DES, the Webserver may think it's got a secure connection when your end is weak - especially a problem if the Anonymizer is a popular wiretap target. This can be remedied by having the Anonymizer only make https: connections to Webservers at the same strength as its connection to You, which either requires annoyingly complex programming (bad) or a cheap hack like running several Anonymizer servers, one with wimpy encryption and one with strong encryption. 4B) If You have a strong crypto connection to the Anonymizer and the Webserver only has wimpy RC4/40, there isn't any good way for the Anonymizer to tell you about it - so your browser may be happily telling you it's got a two-toothed 3DES/RSA-2048 connection while it's really just RC4/40/RSA-512. 4B1)And that happy Java+JavaScript application your browser is running can check that it's got the MachoCrypto flag set and send your credit card number and Secret Plans to the Secret Plan Evaluation Service Website, which is a Bad Move... 4B2)Maybe you could program the Anonymizer to check out https:URLs to see what kind of crypto they support, and return anonymizered URLs that use the different-strength Anonymizers referred to in 4A. Not sure this would always work. 5) The extra RSA encryption from using SSL would probably cause a non-trivial amount of extra load for the anonymizer machine. Summary: Having said all that, I'd probably still like to have it. <<<<>>>> * Frames, for instance, do bizzare things when anonymized, at least with Netscape 3.0b5. Frames are, of course, _evil_, and are banned by the CDA, and anyone who uses them should be flamed mercilessly and forced to use Lynx on a 24x80 monochrome display until he or she repents and sees the error of their ways, and if that doesn't work they should be exiled to AOL with only Microsoft Word Internet Assistant. But that's a flame for another day.... <<<<>>>> # Thanks; Bill # Bill Stewart +1-415-442-2215 stewarts(a)ix.netcom.com # http://www.idiom.com/~wcs # Confuse Authority!

2 1

RE: Bandwidth
by root 17 Dec '03

17 Dec '03

I guess the statement about this being an "active" list was a little understated - however it did not mention anything about being used as a personal forum for petty bickering. I have a slow link (see 9600bps) to the internet and have been watching messages steadily trickle in for the past two or three hours concerning Rush and a "wager" between two people - I notice that they copy the other interested party as if they would not receive it via the list like EVERYONE ELSE DOES! Maybe I'm opening myself up for a flame - I might even deserve it if this discussion in fact does have something to do with cryptography and or related bits of information. If it does - please let me know (private mail is fine - you can even copy the list if you feel everyone deserves to see me ripped to shreds). My 2 cents, Al - No, not like Bundy!

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

On 7/25/96, Louis Freeh said: - - In the Aldrich Ames spy case, where Ames was told by his Soviet - handlers to encrypt computer file information to them. - - - In a child pornography case, where one of the subjects used - encryption in transmitting obscene and pornographic images of children - over the Internet. - - - In a major drug-trafficking case, where one of the subjects of one - of the court-ordered wiretaps used a telephone encryption device which - frustrated the surveillance. - - - Some of the anti-Government Militia groups are now advocating the - use of encryption as a means of preventing law enforcement from - properly investigating them. Thats 4 count em FOUR horsemen. Have a nice day.

1 0