- cypherpunks-legacy - lists.cpunks.org

NIST's call for comments
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

cpsr.org's archive of comments is looking mighty thin, this close to the deadline. Is no one writing to NIST? ..or just not copying CPSR? /cpsr/crypto/clipper/call-for-comments: total 64 -rw-r--r-- 1 cpsr 1000 2574 Sep 24 16:09 campbell_comments.txt -rw-r--r-- 1 cpsr 1000 3221 Aug 24 21:46 denn_comments.txt -rw-r--r-- 1 cpsr 1000 22895 Sep 24 16:10 ellison_comments_may_93.txt -rw-r--r-- 1 cpsr 1000 6079 Aug 19 13:32 howland-comments -rw-r--r-- 1 cpsr 1000 2286 Aug 21 15:08 mcallister-comments -rw-r--r-- 1 cpsr 1000 1955 Aug 24 21:54 nate_comments.txt -rw-r--r-- 1 cpsr 1000 21934 Aug 19 13:33 notice-for-comments -rw-r--r-- 1 cpsr 1000 1536 Sep 24 16:10 oram-comments.txt -rw-r--r-- 1 cpsr 1000 1295 Sep 24 16:11 riordan-comments.txt ..and I've just mailed them my comments for this round, yet to show up in this directory. - Carl

1 0

Re: NIST Explains Clipper "Review"
by peb＠PROCASE.COM 17 Dec '03

17 Dec '03

An economic analysis would indeed be useful, especially if it led to poll-type question like "Would you be willing to pay $100 extra for a cellular phone to get secure communications that allowed government wiretaps?" Or as a sound bite: "At $100M+ a year, consumers and businesses are subsidizing government wiretapping at the minimum cost of $100,000 for each wiretap." At that price, the government might as well give $100k to the suspects under the condition that they stop doing whatever is considered illegal. ;^) Paul E. Baclace peb(a)procase.com

1 0

ACTIVIST ALERT
by ssimpson＠eff.org 17 Dec '03

17 Dec '03

ACTIVIST ALERT - The Government Is Messin' With Your Privacy! Computer Professionals for Social Responsibility (CPSR) posted the following call for comments to the Net. As the deadline for comments on the proposed Escrow Encryption Standard (CLIPPER/SKIPJACK) looms near, EFF wholeheartedly supports CPSR's work to bring attention to the proposal and encourages everyone who reads this to respond with comments. We have added a sample letter and additional information at the end of the CPSR post. ==================== text of CPSR post ==================== Call for Clipper Comments The National Institute of Standards and Technology (NIST) has issued a request for public comments on its proposal to establish the "Skipjack" key-escrow system as a Federal Information Processing Standard (FIPS). The deadline for the submission of comments is September 28, 1993. The full text of the NIST notice follows. CPSR is urging all interested individuals and organizations to express their views on the proposal and to submit comments directly to NIST. Comments need not be lengthy or very detailed; all thoughtful statements addressing a particular concern will likely contribute to NIST's evaluation of the key-escrow proposal. The following points could be raised about the NIST proposal (additional materials on Clipper and the key escrow proposal may be found at the CPSR ftp site, cpsr.org) * The potential risks of the proposal have not been assessed and many questions about the implementation remain unanswered. The NIST notice states that the current proposal "does not include identification of key escrow agents who will hold the keys for the key escrow microcircuits or the procedures for access to the keys." The key escrow configuration may also create a dangerous vulnerability in a communications network. The risks of misuse of this feature should be weighed against any perceived benefit. * The classification of the Skipjack algorithm as a "national security" matter is inappropriate for technology that will be used primarily in civilian and commercial applications. Classification of technical information also limits the computing community's ability to evaluate fully the proposal and the general public's right to know about the activities of government. * The proposal was not developed in response to a public concern or a business request. It was put forward by the National Security Agency and the Federal Bureau of Investigation so that these two agencies could continue surveillance of electronic communications. It has not been established that is necessary for crime prevention. The number of arrests resulting from wiretaps has remained essentially unchanged since the federal wiretap law was enacted in 1968. * The NIST proposal states that the escrow agents will provide the key components to a government agency that "properly demonstrates legal authorization to conduct electronic surveillance of communications which are encrypted." The crucial term "legal authorization" has not been defined. The vagueness of the term "legal authorization" leaves open the possibility that court- issued warrants may not be required in some circumstances. This issue must be squarely addressed and clarified. * Adoption of the proposed key escrow standard may have an adverse impact upon the ability of U.S. manufacturers to market cryptographic products abroad. It is unlikely that non-U.S. users would purchase communication security products to which the U.S. government holds keys. Comments on the NIST proposal should be sent to: Director, Computer Systems Laboratory ATTN: Proposed FIPS for Escrowed Encryption Standard Technology Building, Room B-154 National Institute of Standards and Technology Gaithersburg, MD 20899 Submissions must be received by September 28, 1993. CPSR has asked NIST that provisions be made to allow for electronic submission of comments. Please also send copies of your comments on the key escrow proposal to CPSR for inclusion in the CPSR Internet Library, our ftp site. Copies should be sent to <clipper(a)washofc.cpsr.org>. =================== end of CPSR post =================== EFF joins with CPSR in urging you to send your comments to NIST as soon as possible. To help get your creative juices flowing, we're attaching a sample letter. You will probably want to personalize any letter you actually send. And because time is so tight, EFF has set up an Internet address where you can send your electronic comments in lieu of mailing them through the U.S. Postal Service. Send your letters to: cryptnow(a)eff.org We will be printing out all letters and hand-delivering them before the deadline, so please make sure to send us any letter you want included no later than 8pm on Monday, September 27. If you would like additional background materials, you can browse the pub/EFF/crypto area of our anonymous ftp site (ftp.eff.org) The original solicitation of comments can be found there and is called NIST-escrow-proposal. DO NOT WAIT TO WRITE YOUR COMMENTS! TIME IS SHORT! ====================== <<your name>> <<your organization>> <<your street address>> <<your city, state, zip>> <<date>> National Institute for Standards and Technology (NIST) ATTN: Proposed FIPS for Escrowed Encryption Standard Technology Building, Room B-154 National Institute of Standards and Technology Gaithersburg, MD 20899 Mr. Director: I am writing to oppose the Proposed Federal Information Processing Standard (FIPS) for and Escrowed Encryption Standard, docket # 930659-3159. Encryption is vital for the protection of individual privacy in the Information Age. As more and more personal information flows around electronic networks, we all need strong encryption to safeguard information from unwanted intrusion NIST should not be moving forward with technical standards specification until critical policy decisions are made. These policy issues include: o Continued Legal Use of All Forms of Encryption: When the Clinton Administration announced the Clipper Chip, it assured the public that this would be a purely voluntary system. We must have legal guarantees that Clipper isn't the first step toward prohibition against un-escrowed encryption. o Legal Rights of Escrow Users: If people choose to deposit their keys with the government or any other escrow agent, they must have some legal recourse in the event that those keys are improperly released. The most recent draft of the escrow procedures specifically states, however: "These procedures do not create, and are not intended to create, any substantive rights for individuals intercepted through electronic surveillance, and noncompliance with these procedures shall not provide the basis for any motion to suppress or other objection to the introduction of electronic surveillance evidence lawfully acquired." Leaving users with no recourse will discourage use of the system and is a tacit acceptance of unscrupulous government behavior. o Open Standards: People won't use encryption unless they trust it. Secret standards such as Clipper cannot be evaluated by independent experts and do not deserve the public trust. In addition, the current proposed technical standard is incomplete. It should not be approved until futher comment on the complete proposal is possible o Operating Procedures Unclear: The full operating procedures for the escrow agents has yet to be issued. Public comment must be sought on the complete procedures, not just the outline presented in the draft FIPS. Even the government-selected algorithm review group has declared that it needs more information on the escrow process. o Identity of Escrow Agents: The identity of one or both of the escrow agents has not been firmly established. o Algorithm Classified: Asking for comments on an algorithm that is classified makes a mockery of citizen participation in government decision-making. NIST will be involved in making many critical decisions regarding the National Information Infrastructure. The next time NIST solicits public comments, it should be ready to accept reply by electronic mail in addition to paper-based media. Sincerely, <<name>> <<title>> ****************************** Sarah L. Simpson Membership Coordinator Electronic Frontier Foundation 1001 G Street, NW Suite 950 East Washington, DC 20001 202/347-5400 tel 202/393-5509 fax

1 0

Phil Zimmermans's statement (reposted)
by bart＠netcom.com 17 Dec '03

17 Dec '03

Date--Sun, 19 Sep 1993 13:38:44 -0500 From--Philip Zimmermann <prz(a)columbine.cgd.ucar.edu> Subject--Zimmermann statement on PGP investigation Some of you may have received my Internet message of a couple of days ago about the ongoing U.S. Customs investigation of the exportation of PGP, which has now progressed to the level of Federal Grand Jury subpoenas. This earlier message was intended by me for distribution to a very small group of friends who previously communicated their concern about me and the investigation and asked to be kept informed. I did not send the message to anyone outside this group. Unfortunately, I did not adequately assert my desire that the message not be further disseminated. It appears that the message has gone completely public. This was not my intention. My lawyer, Phil Dubois, has been in touch with the Assistant U.S. Attorney (William Keane) assigned to the investigation. We have no reason to believe that Mr. Keane is anything other than a professional and reasonable person. He made it clear that no decision has been made regarding any prosecution of anyone for any offense in this matter. Such decisions will not be made for some time, perhaps several months. Mr. Keane also made clear his willingness to listen to us (me and my lawyer) before making any decision. It appears that both Mr. Keane's mind and the lines of communication are open. My fear is that public dissemination of my message will close the lines of communication and put Mr. Keane into an irretrievably adversarial position. Such a result would not serve any of our interests. My lawyer tells me that nothing irritates a prosecutor more than being the subject of what he perceives to be an orchestrated publicity campaign. He also tells me that his nightmares involve FOAs (Friends Of the Accused), invariably people with good intentions, doing things on their own. I understand that the issues involved in this investigation are of the greatest importance and transcend my personal interests. Even so, I would rather not turn an investigation into a full-scale federal prosecution. I ask that everyone keep in mind that the government's resources are limitless and that mine are not. Speaking of resources, many of you have offered help, and I am grateful. Those wishing to contribute financially or otherwise should contact either me or Philip L. Dubois, Esq., at dubois(a)csn.org or by phone at 303-444-3885 or by mail at 2305 Broadway, Boulder, CO, 80304. Mr. Dubois has just got on the Internet and is still learning how to use it. Donated funds will be kept in a trust account, and all contributions will be accounted for. If this whole thing somehow goes away with money left in the account, the balance will be refunded to contributors in proportion to the amounts of their contributions. This message can be widely circulated on public forums. Philip Zimmermann prz(a)acm.org 303 541-0140 ------------------------------

1 0

a picture of the Clipper?
by nate＠VIS.ColoState.EDU 17 Dec '03

17 Dec '03

I seem to remember there being a picture of the clipper chip in Popular Science or something.... does anyone remember where this picture is? -nate -- +-------------------------------------------------------------------- | Nate Sammons email: nate(a)VIS.ColoState.Edu | Colorado State University Computer Visualization Laboratory | Finger nate(a)monet.VIS.ColoState.Edu for my PGP key | #include <std.disclaimer> | Always remember "Brazil" +----------------------+

1 0

The "mpack" MIME encoder has just been released.
by Derek Upham 17 Dec '03

17 Dec '03

The newsgroup comp.sources.reviewed has just released the sources to "mpack", a utility for encoding binary files into a MIME-compliant format, then mailing them to recepients or posting them to a newsgroup. "munpack", a utility for decoding the files, is also included. The package is supposed to work on MS-DOS and MacOS systems (and it's quite small), so people playing with PGP might be able to get some use out of it. Derek (the other other Derek) Derek Lynn Upham University of British Columbia upham(a)cs.ubc.ca Computer Science Department ============================================================================= "Ha! Your Leaping Tiger Kung Fu is no match for my Frightened Piglet Style!"

1 0

Thanx 4 the help! (PGP SIGNED MESSAGE)
by Zeek 17 Dec '03

17 Dec '03

Wait!! Ok, I've got it! "pgp -sta +clearsig=on <file>" ! Big thanks to those of you that refreshed my memory. bye. -z (kevink)

1 0

hi
by BRADLEY ROBERT WESTON 17 Dec '03

17 Dec '03

Hi. I don't know if this address connects to anyone or anything, but I am giving it a shot. I saw an article in Wired and then another one in the 25th anniversary edition of Whole Earth, and wanted to get in touch with you all. #1 Thanks for exisiting....... I am real glad someone is on the side of the angels technologically #2 Please put me on a list to get news. I prowl the newsnet very occasionally, but I don't have a lot of time to do so and I am still climbing up the looooong learning curve of internet. I am quite willing to pay for good info feed from you. #3 Please help me get a clean copy of PGP. I guess thats all I want to throw out unencrypted.....thanks...I want to help. Wes Bradley The return address is my e-mail address at university of colorado where I am a student in aerospace engineering. Thanks again.

1 0

Re: the public key minefield
by smb＠research.att.com 17 Dec '03

17 Dec '03

Doesn't a patent have to have enough information for a person skilled in the art to construct a prototype? I publish for the first time here my invention. I will patent it with in a years time. Striped Vegetables ---- This isn't enough for anyone to do anything. If I were more specific, I might have something patentable, but then by claims wouldn't be as broad. If you figured out how to make an anti-gravity device. That device would be patentable. The concept of "anti-gravity" device is not patentable. If I could duplicate the effect of your anti-gravity device without using any of the same novel mechanisms. My device would be separately patentable. You seem to have missed my earlier summary of how patents are structured. A separate part of the patent from the claims describes how to build the claimed device. The claims aren't supposed to.

1 0

Big Brother Inside Stickers
by Christian D. Odhner 17 Dec '03

17 Dec '03

Cypherpunks, Although it seems the clipper chip's start-of-production date has been delayed, it appears to me at least that it's eventual implimentation is inevitable, and close at hand. At that time, a little civil disobediance may be in order. I have made arrangements to produce 8,800 (that's the minimum, I don't think we'll use more than that) "Big Brother Inside(tm)" stickers for the price of 137.95, including shipping and handleing, etc. I am of course quite willing to send quantities of stickers for free to those that want them, however donations to defray my costs would be _greatly_ appreciated, and will allow me to start putting out my Cypherpunks teeshirt much sooner <hint hint> ;) The stickers are one inch by one inch square, made of clear vinal with a dark blue foreground (If there is a consensus that the foreground should be some other color I'll change that) and I'm useing the _Excellent_ Logo designed by Matt Thomlinson <phantom(a)u.washington.edu>. If you would like some stickers, email me with the approximate number of stickers you would like, your input on the foreground color, your snailmail address, and how much money (if any) you plan to send me. Assumeing I get a few offers for contributions (like I said, if you don't have the money I'll send 'em to you anyway) I'll send in the order now, and trust that the checks (or cash, or other forms of income) will show up. My next project is a CP tshirt. On the front will be "Cypherpunks: There's Safety in Numbers." and on the back:"Big, Big, _PRIME_ Numbers!". (Sorry, I forgot who suggested that one... :} ) and in the background will be a wraparound extended-tcmay-style list of related words and ideas. For about triple the regular price you can get your pgp public key in RAD64 format on the back also. Sounds crowded, but I think it'll work ok. Don't hold your breath for it though, I expect at least a month before I get around to that. BTW, although I am open to sugestions (In EMAIL please, not on the list) for the tshirt, in the end if you don't like my ideas, just make your own. This weekend I have two days off IN A ROW! (sunday+monday) so I am planning to try building a little truely random number generator with a serial port connection. Anybody who has serious suggestions or advice please email me. And last but certainly not least... My Remailer policy is as follows: 1) I don't read mail that goes through my remailer. None. 2) I have been keeping logs on the remailer in a failed effort to fix the encrypted message handleing, but I have mostly given up until I have a chance to learn PERL better so those logs will be removed and turned off before I send this message. 3) In otherwords, no logs are being kept (by me) 4) The computer the account is on does not belong to me, however the sysadmins know of the remailer and have agreed to refer any complaints they receive back to me. If they ask me to remove it, I will do so. 5) Any list shorter than five items is stupid. Well, that about wraps things up for now. Happy Hunting, -Chris. ______________________________________________________________________________ Christian Douglas Odhner | "The NSA can have my secret key when they pry cdodhner(a)indirect.com | it from my cold, dead, hands... But they shall pgp 2.3 public key by finger | NEVER have the password it's encrypted with!" "If guns are outlawed, only the government will have guns." -E. Abbey My opinions are shareware. For a registered copy, send me 15$ in DigiCash. Key fingerprint = 58 62 A2 84 FD 4F 56 38 82 69 6F 08 E4 F1 79 11 ------------------------------------------------------------------------------

1 0