- cypherpunks-legacy - lists.cpunks.org

Ninth Amendment and privacy??
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

grendel(a)netaxs.com (Michael Handler): > control to anyone except married couples. The Supremes said that this was > an undue invasion of privacy, and that there *was* a Constitutional right > to privacy. They neglected to specify exactly where it was, though. ;) > However, they suggested that it was held somewhere under the Ninth Amendment. Amendment IX (1791) The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people. C'est tout. Sounds very clearly like a right to privacy to me ;-) ----------------------------------------------------------------------------- Rishab Aiyer Ghosh They came for the Jews, and I was silent because I was not a Jew; rishab(a)dxm.ernet.in They came for the Trade Unionists, and I did not protest, because I did not Voice/Fax/Data +91 11 6853410 belong to a trade union; Voicemail +91 11 3760335 They came for the Catholics, and I said nothing because I was not a Catholic; H 34C Saket And then they came for me. New Delhi There was no one left to say anything... INDIA ----Father Niemoeller

1 0

Re: Black Eye for NSA, NIST, and Denning
by Hal 17 Dec '03

17 Dec '03

It was my understanding from what was posted here and on sci.crypt that Clipper chips were only going to be given to phone manufactureres who had an approved design. This would mean no pre-encryption of messages, and no hacks to defeat the LEAF block, would be allowed. It's not clear to me whether the same restrictions apply to the use of the Tessera plug-in card. It sounds, from what was posted here, like Blaze was able to feed sample LEAF's at his card until it accepted one. Is that correct? If so, apparently users of such cards have access to low-level functions which would allow this kind of trick to be used. Unless there is some way to get a supply of Clipper chips to allow you to make Clipper-compatible phones which still protect privacy, then all this theorizing is not too useful. I am inclined to agree with Deadbeat that if you want to give the impression that you are using Clipper on your phone calls (to blend in, to keep a low profile) but at the same time you want the key escrow not to work, then pre-encryption is a superior strategy to Matt Blaze's idea. Matt's trick only hides the session key if both sides are using it. And even in that case it appears to require particular key manage- ment techniques that may not be standard (one side provides the session key, or it is negotiated but both sides wait 30 minutes to talk). So it does seem that some pre-arrangement will be necessary in practice to allow Blaze's approach to successfully hide the session key. It's true that the Blaze technique hides the unit id, preventing traffic analysis. But that could be a negative. Playing paranoid, suppose that Clipper traffic is routinely decrypted with the family key. Then the fact that someone is using bogus LEAF's might be evident because the unit id would change with each call. Using pre-encryption makes you look like a good little boy until they bring out the escrowed keys. (Of course, they're not supposed to troll LEAF's, any more than they're supposed to break escrow, but I'm assuming that the former will be easier and more likely than the latter.) Hal

3 2

JOB POSTING: InterNex
by geoffw＠nexsys.net 17 Dec '03

17 Dec '03

Forgive my posting this here but I figure that I might just get someone who has the skillset and the sensibilities to understand the potential future issues that a service provider might have to deal with around "privacy issues" anyway: --------------------------------------------------------------------------- MANAGER OF NETWORK OPERATIONS [This is NOT an entry level position] InterNex is seeking a versatile and dynamic individual to be a hands-on senior technical leader in our rapidly growing Network Operations Center. This multifaceted job will involve all aspects of network and system administration and management in a TCP/IP based, public internet. You will have a leadership role in the design and construction of a wide area internet that incorporates high bandwidth technologies such as ISDN, Frame Relay, T1, SMDS, and ATM. You will participate in the design, construction, and maintenance of a variety of network devices and software that generate and sustain the growing area of Cyberspace for which InterNex is responsible. You will also support in-house development, including creating tools to facilitate network management, perform connection billing, implement bandwidth management, and automate new user configuration. The successful candidate will also provide technical expertise to customers with varying levels of technical sophistication and support other members of the InterNex team. You should have good writing skills and be able to communicate clearly. This job requires proven proficiency with Sun System Administration skills, a solid working knowledge of the IP protocol suite, router configuration, SMTP/Sendmail, SNMP, DNS configuration, Perl, C/C++ program porting, and firewall construction. Experience with Windows, Novell, Macintosh, X.500, ATM are pluses. Knowledge of Telco systems, and project leadership skills are desirable. Commitment to teamwork is an essential aspect of the job. More than four years previous system experience is required. A degree in computer science or a related field is desirable. InterNex is located in the highly desirable mid-peninsula community of Menlo Park. Close to Stanford University, on the edge of Silicon Valley, 35 minutes from the Pacific Ocean and San Francisco. InterNex offers a high quality of life and a team of professionals dedicated to setting new standards of excellence in technology and customer service. Compensation package includes salary, health care and stock options and is based on experience and performance reviews. For immediate consideration, please e-mail your resume (ASCII and postscript) to personnel(a)internex.net, or fax it to (415) 473-3062. No phone calls please. InterNex Information Services is a rapidly growing Internet service provider start-up that specializes in helping businesses do business on the Internet. We provide our customers One-Stop-Shopping for high-bandwidth connectivity utilizing leading edge technology. We also address the need for Internet presence by providing electronic publishing services such as WWW, Gopher, WAIS, FTP, and custom servers. InterNex is an equal opportunity employer.

1 0

Clipper- Who's Fooling Who
by jp＠jep.pld.ttu.ee 17 Dec '03

17 Dec '03

It simply is not possible for them to have ACCIDENTALLY OVERLOOKED such a thing as 16 bit CRC. Let us assume, that 2 distinct users want to initiate clipper connection. They will have their secret keys generated inside chips and as key distribution is not a part of clipper they can happily use DH or whatever to do it, meaning that they still are the only ones to know them. To be able to intercept these keys clipper chips have ( presumably ) skipjack cipher to make LEAFS. Now cipher must take arguments data and key. But we assume, that Chips have Family key, but not Master key ( such a thing would have been nonsense- you cannot rely on one key for all chips ), meaning that they share no global knowledge except SJ algorithm. So, for other chip to make difference between RIGHT and WRONG LEAF it has shared secret, meaning session key and LEAF. What could have been simpler than using these 2 components and SJ to generate cryptographic checksum? Nothing, execpt that this checksum is of no use to goverment- it does not know shared secrets, so it cannot use this checksum anyway. BUt that is not such a big pr oblem - line noise and checksums can be applied externally. So why not use session key and SJ, generate a 80 BIT checksum and append it to LEAF. I do not believe that it would make SJ useless because of cancellation :-) The proposed scheme would look like this: Sa, LEAFa, Sb, LEAFb the session keys and LEAFs of a and b 1. A and B generate and exchange keys 2. A sends to B SJ(LEAFA,Sb), LEAFA 3. B verifyes it and takes into use Sa. ,the same thing in opposite directions. Rather EASY not to implement it. Now they did not do it. Instead they used only 16 bits. Weird. Unless... OK, SJ has no backdoors, but somehow manages to send the parts of LEAF fields maybe 0.5 bits per one SJ coded user data block. (it is always possible to compress data that much ) That would change the things. We would be happy about our checksum and they would be really happy about (us) US. A little media now and then - it's for advertisment. Just think that This 16 bits did not make SJ weaker, meaning people who would have used it for sequrity will do so anyway. The i-do-not-know class will switch over to it because of if-I-want-I-can-crack-it( or buy device or have it installed or whatever). I'm Looking for a partner Someone who gets things fixed Think about it seriosly do you want to get rich? OK for Pet Shop Boys, but NSA??? JP from TTU

1 0

Applied Cryptography
by NetSurfer 17 Dec '03

17 Dec '03

Aloha, CP's: Periodically there have been people seeking copies of Schneier's "Applied Cryptography". I've found a source you can order them from electronically if you are so inclined. "Applied Cryptography", by Bruce Schneier 0-471-59756-2 $44.95 Wiley Books Stacey's Bookstore - staceysbks(a)aol.com Softpro - softpro(a)csns.com Reiter's Scientific & Professional Books - bks(a)reiters.com Quantum Books - quanbook(a)world.sto.com Softpro - softpro(a)world.std.com -NetSurfer #include standard.disclaimer >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> == = = |James D. Wilson |V.PGP 2.4: 512/E12FCD 1994/03/17 > " " " |P. O. Box 15432 |finger for key / Viacrypt Reseller > " " /\ " |Honolulu, HI 96830 |====================================> \" "/ \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

1 0

PC Techniques June/July 1994 V5 #2
by NetSurfer 17 Dec '03

17 Dec '03

The above issue's cover page is on "Encryption - Key to a Secure Future" It has several articles re encryption, and included the Wiley Books section (which also had Applied Cryptography on the cover page of its pull-out section) from which I quoted as a source for the book. On the Editor's Notepad (Page 4) there are two paragraphs of note. "If the cyberpunk {sic their spelling} crowd ever created a medal for mad courage in the face of insuperable odds, that medal should go to John Gilmore, who has just filed a Freedom of Information Act (FOIA) request for _the entire Clipper encryption key database_, now being compiled by the Feds for use in their demented Clipper system. Gilmore and his attorney have studied Clipper and the FOIA in detail and have found no exemptions that would apply to the key database. They've scratched together some donations and are taking the government to court under FOIA for refusing to release the database to them. "The Feds always win, even if they have to break their own laws to do it. Nevertheless, Gilmore & Co. may slow the project down some, and we can all savor the irritation they will doubtless cause the Powers in the process --- Also from the same page: _No Code Overseas_ "Asinine Federal regulations concerning the export of cryptographic tech- nology means that code diskettes for this issue destined for overseas subscribers will not contain any of the encryption-related code. Our First Amendment prevents the Feds from censoring printed material in the magazine, but software on diskette is not protected that way. There's nothing we can do. Vote _against_ your representatives this fall, regardless of party; that's the only thing that gets their attention. On Page 6 Jeff Duntemann KG7JF has another full page re Clipper and gives full and "express permission to freely print and distribute this editorial electron- ically in the cause of defeating the Clipper initiative." On page 12 they list the source as available on Compu$erve GO CLMFORUM and see Lib 16. Also Turbo User Group Library sells the PC Techniques archive listing disks at 206-779-9508. Who knows, they might slip up and have the code available there... On page 24, Bruce Schneier has an article "Secret Sharing" - perhaps if you ask you can get his OK to include it here. Page 35 has an article on "Simple Encryption via XOR" by Mark R. Parker. For those of you feeling the werewolf need to rip something apart in an electronic feeding frenzy, this should keep you sated for a millisecond or two... <hehe> Also, in the June issue of Upside ("The Business Magazine for the Techno- logy Elite" - their title), the Editor-In-Chief, Eric Nee, has a commentary entitled "Keep Big Brother Out." Guess what it is about, kiddies... Over the last few months I've been colleting articles on DSP's from the many trade rags I get. I'd be happy to send one copy to someone who is seriously interested in this and willing to scan them in etc. to share with like-minded CP'sters. Aloha from Paradise {lost} -NetSurfer #include standard.disclaimer >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> == = = |James D. Wilson |V.PGP 2.4: 512/E12FCD 1994/03/17 > " " " |P. O. Box 15432 |finger for key / Viacrypt Reseller > " " /\ " |Honolulu, HI 96830 |====================================> \" "/ \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

1 0

Re: Why it is legal to export PGP under ITAR
by Vance Cochrane 17 Dec '03

17 Dec '03

| Nice try, but NEVER confuse a dictionary definition with a legal definition. | | In article <199405280642.XAA05875(a)jobe.shell.portal.com>, | <nobody(a)shell.portal.com> wrote: | >The US ITAR law exempts many things from export restrictions, among them, | >materials availiable in public libraries. It gives no special definition for a | >library. My American Heritage Dictionary defines "library" as, among other | >things, "An orginized collection of recorded data arranged for ease of use." | >IOW, an ftp site. Which means that if a program is available from a public ftp | >site, you're legally allowed to export it. :) I am not a lawyer so don't scorch me... Where does one obtain a legal definition if it is not in Blacks Law Dictionary? Isn't the next source a "regular" dictionary? ...thats what they do on Perry Mason ;-) vec

1 0

Re: Help A Novice Understand
by werner＠mc.ab.com 17 Dec '03

17 Dec '03

> >[about Sternlight...] > Someone said that Sternlight is a high-placed govt official. I don't believe this. I think he is a retired old fart with a home computer and an internet acct. Sternlight is neurotic. Detweiler is psychotic. I don't think Sternlight has been a factor in this mailing list, except that people who read the Usenet crypt groupts and comp.eff.talk.org. have had to deal with his posts alot, and some may be assuming that everyone on this list is quite familiar with his name. Detweiler, and posts about Detweiler, dominated this list for awhile. I hope this doesn't start up again, especially about Sternlight, since he never even posts to this list. Unless it has something to do with cypherpunk issues, of course. tw

1 0

Re: 6/6 New Yorker anti-crypto propaganda
by jktaber＠netcom.com 17 Dec '03

17 Dec '03

Forwarded message: > From owner-cypherpunks(a)toad.com Mon Jun 6 03:51:24 1994 > Date: Mon, 6 Jun 1994 01:10:22 -0500 > From: Anthony Garcia <agarcia(a)sugar.NeoSoft.COM> > Message-Id: <199406060610.AA10841(a)sugar.NeoSoft.COM> > To: cypherpunks(a)toad.com > Cc: agarcia(a)sugar.NeoSoft.COM > In-Reply-To: "Bradley W. Dolan"'s message of 05 Jun 94 21:00:47 EDT <940606010046_71431.2564_FHA46-1(a)CompuServe.COM> > Subject: Re: 6/6 New Yorker anti-crypto propaganda > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > New Yorker writer says: > [Many clueless things, including:] > The net poses a fundamental threat not only to the authority > of the government, but to all authority, because it permits > people to organize, think, and influence one another without > any institutional supervision whatsoever. > > Oh, Dear. We Certainly Can't Let That Happen. > > Sigh. This gentleman obviously needs to be regrooved. Does anyone > have his net address? > > -Anthony Garcia > agarcia(a)sugar.neosoft.com > "Wacos In Cyberspace: Hear, hear!" > Well, as I read that sentence in isolation, it is true, and a Good Thing. I will be concerned if the author is urging "institutional" supervision. Guess I gotta go read the New Yorker now. Sheesh, you guys, you get me to read the Atlantic Monthly, now the New Yorker. I hope they have gotten away from their dilatory style, and that the cartoons are still good, if I gotta waste my money this way.

1 0

Sternlight & PGP
by greg＠ideath.goldenbear.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Derek Atkins writes: > [about Sternlight...] > > He campaigns tirelessly, endlessly, and repetitiously > > against PGP, and against crypto for the masses. > Actually, this should be "about PGP [possibly] infringing on > patents".. He made a PGP key, but when the patent issues came up, he > destroyed everything. Now that 2.6 is out and santified by all > parties concerned, he has created a new key, which is on the > keyservers! Derek's list is incomplete; Sternlight also alleged that there were "copyright problems" with PGP, insinuating that some of the code in PGP had been copied (or derived from) RSAREF code - he backed down pretty quickly when asked for substantiation. He also wrote to the administrators of US-based FTP sites, suggesting that PKP/RSADSI was contemplating legal action against them if they didn't stop making PGP available via FTP. I suspect (but cannot prove) that he was also the person who reported those FTP sites to Bidzos, thus creating the lawsuit threat that he then pretended to protect the FTP sites from. He also recently wrote to Netcom administrators, encouraging them to take action against a user who included a public key marked 2.3a in his .plan file. -----BEGIN PGP SIGNATURE----- Version: 2.5 iQCVAgUBLfN7yX3YhjZY3fMNAQEUPQP9EZHEiYMAO4Z3ZuRJ/YgThX6CCNlqARic hFVgZX9kU2xfbKeJsJfBAXJvQDCbq7AOK6uuWIF+2VTb9gt7WcYe4nZiRoWe77v+ /QAYbuefLTGMjhneQ43ZFU3HIYDvzkZBmeZk0jtSzdWafhflnRxaBlFjzAjx1WTS +8uE9isIqAo= =V+Ix -----END PGP SIGNATURE-----

1 0