- cypherpunks-legacy - lists.cpunks.org

[Fwd: Fwd: Engineers] Fwd: Engineers
by EFF 17 Dec '03

17 Dec '03

1 0

proposal: commercial data recovery
by Adam Back 17 Dec '03

17 Dec '03

If we take the design goal of designing a commercial data recovery system which is not GAK compliant, we can most succinctly state this design goal as the task of ensuring that: - at no point will any data transferred over communications links be accessible to anyone other than the sender and recipient with out also obtaining data on the recipient and/or senders disks I think we can distill the design principles required to meet the design goal of a non-GAK compliant Corporate Data Recovery (CDR) down to ensuring that: 1. no keys used to secure communications in any part of the system are a-priori escrowed with third parties 2. second crypto recipients on encrypted communications are not used to allow access to third parties who are not messaging recipients manually selected by the sender 3. communications should be encrypted to the minimum number of recipients (typically one), and those keys should have as short a life time as is practically possible Included in 2) is the principle of not re-transmitting over communication channels keys or data re-encrypted to third parties after receipt -- that is just structuring -- and violates design principle 2. With these three principles you still have lots of flexibility because you can escrow storage keys, do secret splitting of storage keys, and store keys encrypted to second storage accessors on the local disk for stored data recovery purposes. As an additional bonus, principle 3 adds extra security against attackers gaining access to encrypted traffic after the fact -- the recipient no longer has the key -- this is a form of forward secrecy. Systems designed to the CDR design principles are of significantly less use to GAKkers than PGP Inc's GAK compliant Commercial Message Recovery (CMR) design. The CDR design significantly hinders the take up of GAK if widely deployed. Design principle 3 -- forward secrecy -- is inherently hostile to GAKkers, and is the strongest statement you can make against GAK: you are purposelly _destroying_ communications keys at the earliest possible moment to ensure that GAKkers can not obtain the keys by legal and extra-legal coercion, black mail, and rubber hose cryptanalysis. The whole system translates into the Feds having to come and physically take your disk to obtain information about you, which is much better than GACK, and not what the GAKkers are interested in at this point. The GAKkers would like to install themselves, and coerce companies into installing for them (via GAKker/USG/NSA/NIST organised efforts such as the 56 bit export permit for companies installing key escrow; and efforts such as the Key Recovery Parners Alliance (KRAP)). I fear that PGP Inc's CMR proposal inadvertently meets most of the NIST/NSA specified KRAP requirements. What the GACKers want is systems where they can perform routine key word scanning and fishing expeditions into your communications from the comfort of their offices, without your knowledge. This is push button Orwellian government snooping. Within the constraints imposed by the CDR design principles, there is plenty enough flexibility to acheive the commercial data recovery functionality to similarly weak levels of enforcability as achieved by the CMR design. Weak levels of enforceability are appropriate because there are other exceedingly easy bypass routes: super-encryption, and walking out of the office with a DAT tape. I would like to organise a collaborative effort to write a white paper discussing how to implement various functionalities using the CDR design principle. Then I would like to see discussion of which set of these functionalities which best acheive the user requirement for company data recovery. Lastly I would like to see a collaborative development effort to provide a example implementation of a CDR system which can be used as a discussion point for the OpenPGP standardisation process. I suppose the best place to discuss this process is the IETF forum for discussion of the OpenPGP standard, the OpenPGP mailing list (subscribe by sending message body "subscribe ietf-open-pgp" to "majordomo(a)imc.org"). I have already had people express in email to me their interest in doing this. Those people can speak up if they want to. Technical input is sought from people opposed to GAK compliant software, and from PGP Inc, and others defending PGP's GAK compliant CMR proposal. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

12 23

Here's the info you requested
by 84903020＠ix.netcom.com 17 Dec '03

17 Dec '03

<HTML><PRE><BODY BGCOLOR="#000000"><FONT COLOR="#00FFFF" SIZE=3> Everybody loves Mr. Chicken! Kids are going wild over Mr. Chicken. Parents laugh hysterically at the sight of him. Why spend $50 on toys that your kids forget about the next day when for pennies they can have a Mr Chicken that they'll enjoy for months? For full details, Email MrChicken(a)answerme.com </FONT><FONT COLOR="#000000" SIZE=3>

1 0

Freeh says FBI doing great, supports Weaver killer
by Declan McCullagh 17 Dec '03

17 Dec '03

WASHINGTON (AP) - FBI Director Louis Freeh today declared his agency "in great shape" despite a recent spate of public relations embarrassments and said he has no plans to step down from his job. Timothy McVeigh's conviction for the Oklahoma City bombing, the capture of CIA shooting suspect Mir Aimal Kansi of Pakistan and other recent successes have helped restore public confidence in the FBI, he told reporters today. The agency's image has suffered in recent years in the wake of a variety of controversies, including its conduct in the investigation of the Atlanta Olympic bombing, allegations that its crime lab had mishandled evidence and accusations that he had failed to fully brief the White House on China's alleged efforts to contribute money to U.S. political campaigns. "I think in large part that we're past it," Freeh said of the FBI's public relations problems. "We will always be controversial. ... But I think that how the FBI responds to those problems is what's important." In an April edition of Newsweek, an article quoted Freeh as saying he had considered quitting his job. But today, Freeh said he may even serve out his 10-year term. "I'm staying on," he said. "I've got no current plans to leave." He also said the FBI is close to hiring a new assistant director for the crime lab, choosing from a list of candidates that includes "world-class scientists." He also said the FBI continues a vigorous investigation of a June 1996 bombing that killed 19 American airmen in Saudi Arabia, despite the fact that Hani al-Sayegh, a Saudi dissident, had reneged on an agreement to provide information on the case. "His reneging on that agreement is not a serious setback to our own investigation," Freeh said. The FBI will continue to stand behind Lon Horiuchi, an FBI sharpshooter charged last month by local authorities with involuntary manslaughter for the shooting death of Vicky Weaver, wife of white supremacist Randy Weaver, during a deadly standoff in Idaho, Freeh said. "We fully support him," Freeh said. "It was a horrible tragedy. It was a mistake on his part, but we believe he was acting as he was trained to do. He was within the scope of his authority. ... He reasonably believed at the time that what he was doing was proper."

4 3

GAO's Chaos Cryptosystem Algorithms
by Nobuki Nakatuji 17 Dec '03

17 Dec '03

Do you want Gao's chaos cryptosytem's thesis written in English ? If you want it,Please send check or money order of 50 dollar to me. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

Re: Credit Card might-as-well-equal SSN (fwd)
by Lindsay Haisley 17 Dec '03

17 Dec '03

I was under the impression that using a SSN for identification purposes was illegal. A while back I went to a company that rented sound equipment to pick up some equipment for a job, and was asked for my SSN as part of my credit application. I told them that I believed that it was illegal to require an SSN and they said, in effect, if you want to rent from us, you have to give us your SSN. When I got home, I called the Social Security Administration office in Austin and after being bounced around among lots of people who knew absolutely nothing about the subject, I finally reached someone who informed me that this practice is perfectly legal as long as you're not >required< to give your SSN. Since I didn't, in theory, have to do business with these folks, they therefore apparently had every right to require my SSN as a condition of doing business with them. In point of fact, when the incident occurred, it was getting late, I had to have the equipment for my job, and so I gave them what they wanted. At 09:35 PM 9/10/97 -0500, Jim Choate did speak as follows.... >>Questions: Is this for real? How wide spread is this? What does U-Haul do >>with your SSN? How difficult is it for someone (company) to get your SSN >>when you use your credit card? > >Did you ask if it was a U-Haul requirement or a Texas one? > >If you've ever given your SSN when applying for a credit card, >you can be pretty sure they've got your SSN in the credit report. >Perhaps if you've got a secured debit card of some sort >you've been able to keep it separate from your other credit history, >if any, but most people have slipped at least once, or had an account >at a bank that collected the SSN for tax reasons and then included it >in credit reports. Lindsay Haisley (______) FMP Computer Services (oo) "The bull fmouse(a)fmp.com /------\/ stops here!" Austin, Texas, USA / | || 512-259-1190 * ||---|| * * * * * * ~~ ~~ http://www.fmp.com

1 0

New Member Registration
by somebody＠somewhere.com 17 Dec '03

17 Dec '03

A Message From Mr. T Account Login: killer Account Password: instinct This message has been auto-generated - No need to reply

1 0

Mondex
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Timmy May's IQ is lower than the belly of a pregnant snake. _ o |<)_/# Timmy May TT <T

2 1

InfoWar 4 (Part III of 'The True Story of the InterNet')
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

A Message For You
by emailing＠tnlb.com 17 Dec '03

17 Dec '03

/////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. //////////////////////////////////////////////////////////////////////////////// 25 Million Email Addresses On CD-ROM At a rate of even 5,000 addresses per hour, it will take a dedicated computer and Internet connection 24 hours, 7 days a week, 30 days a month, to collect 3,600,000 addresses At this rate, it would require seven months to extract 25,000,000 addresses. If you are marketing on the Internet and want to use bulk emailing for your business, this special offer should be of interest to you. Our 25-Million Email Address List is being made available through this special offer for only $199. That's right - 25-Million Addresses for only $199. To order this CD-ROM, simply call us at (812) 597-1000 and ask for Offer Number 199-CD. $199 for this large of a list is a real bargain and will not last for long. So, call today - 812-597-1000 Due to the huge response we've had to this limited-time offer, our telephone lines have been very busy accepting incoming orders. So, please be patient when calling as this offer will not last very long. Remember, ask our operator for Offer #199-CD.

1 0