- cypherpunks-legacy - lists.cpunks.org

ANNOUNCEMENT: Digest Version Changes Hosts
by Alan B. Clegg 17 Dec '03

17 Dec '03

The digest version [cypherpunks-d] of the cypherpunks mailing list has been moved to a faster host. Previously it was under the care of majordomo(a)gateway.com, but it has been moved to the care and feeding of majordomo(a)hidden-foes.gateway.com. The new machine has a big more disk, a bit more processor, and is on the fast end of a T1 [the other was at my home on the good 'ole shared 28.8k SLIP]. ANYWAY----> If you were subscribed to the digest version already, you are still there. If you would LIKE to subscribe to the digest version, just send e-mail to 'majordomo(a)hidden-foes.gateway.com' with the line 'subscribe cypherpunks-d' in the BODY. The digest is created every 40k [or about 2-3 times/day it seems]. Please let me know directly if there are any problems with this new system. BTW, the first issue after moving to the new system will be Volume 2, Issue 1. Thanks, -abc

1 0

Mandatory ID in California?
by Ian Goldberg 17 Dec '03

17 Dec '03

>From "The Daily Californian", Wed., 25 October, 1995, page 3: <snip> "Police were called to the scene by an officer who passed Burton and smelled marijuana smoke, Phelps said. The officer believed it was coming from Burton's cigarette. "The officer issued a citation to Burton for smoking marijuana and requested to see identification. Burton refused to show identification and argued that smoking marijuana is legal in Berkeley, Phelps said. "The officer, in accordance with police policy, arrested Burton for refusing to properly identify himself." <snip> That last sentence seemed ominous to me... - Ian

1 0

Info: Elementrix POTP
by Dana W. Albrecht 17 Dec '03

17 Dec '03

Forwarded from sci.crypt: In article <45t9oh$6vd(a)newsbf02.news.aol.com>, whmurray(a)aol.com (WHMurray) writes: > In article <45qkp5$8rh(a)netaxs.com>, grendel(a)netaxs.com (Michael Handler) > writes: > > >It > >looked somewhat like a stream cipher that generates its key by measuring > >packet lag over TCP/IP. General consensus was that any key determined > >from public information wasn't secure. > > It uses a new symmetric message key for each message. The key for message > n is a function of that for message n-1 modulated by the content of > message n-1. However, it operates at the message layer, not the TCP/IP > layer. In a given population, everyone in the population can begin with > the same key. As messages are exchanged between any two parties in the > population, they end up with a key which is unique to them. The system is > synchronous. If any traffic between two parties is lost, they must > re-synch; keys between each of the parties and other parties will not be > affected. > > The idea is novel and useful. It will be resistant against most > attackers. It is much less resistant to attacks by nation states that > could have a record of all traffic among all parties. Of course it is not > an OTP nor is it more secure than other modern systems. If anything, it > is a little less so, at least against those who have all of the traffic > and to the extent that more than two parties start with the same initial > key. Of course, its strength is to permit all members of the population > to begin with the same key while ensuring that members of the population > are safe from each other. It also ensures that compromise of the initial > key is not sufficient to read traffic. One must have all the intervening > traffic. Thus, if one comes to the party late, learning the initial key > will not enable one to read current traffic. > > >OTOH, I saw a press-release on Cypherpunks a week or two back that > >claimed Whitfield Diffie and David Kahn had both examined the algorithm > >under NDA, and both were blown away by it. OTOOH, I don't know how much > >Diffie and Kahn know about TCP/IP. > > Diffie knows enough; Kahn less. However, both are geniuses and know what > they need to know. As to their being "blown away," I tend to doubt it. > The idea is useful but not revolutionary. > > >We'll know for sure when they release the details of the spec. And, if > >they go to the logical conclusion of all this secrecy and they *don't* > >release the spec, it won't be worth a bucket of warm snake oil. > > If they have applied for a patent and if the effectiveness of the scheme > does not rely upon secrecy of the scheme, then of course there is no > reason for secrecy. They sent me an evaluation copy of the program and > have been fairly open in discussing it. (No one has suggested an NDA or > even that there were any secrets involved.) While for security I would > rather have Lotus Notes or Secure Exchange, for ease of administration > this program has advantages. > > The product is interesting and less bogus than your meters might lead you > to believe. Few of us would like to have our products evaluated strictly > on the basis of press releases and reports. > > I believe that the scheme infringes patents of which I am aware. > > >

1 0

Internet Security Review
by Doug Hughes 17 Dec '03

17 Dec '03

Just got a copy via mail today. Boy, Dorothy Denning seriously dings Tim May in this issue. Interesting reading to know what the other side is up to nonetheless. She uses some reasoning that will be compelling to many. Doug Hughes Engineering Network Services doug(a)eng.auburn.edu Auburn University

1 0

(Fwd) DIGITAL CASH IN AN ELECTRONIC WORLD -Reply
by Kawika Daguio 17 Dec '03

17 Dec '03

Sir, I am still lurking on the Information Railroad(TM) I am still trying to preserve privacy while maintaining accountability for all parties. Technical solutions are insufficient, no matter how innovative. My greatest problem today is the lack of sophistication of decisionmakers. Very few people understand the technology, economics, and politics of electronic commerce. Keeping governments from making the wrong decisions is difficult. Keeping bankers from doing the same is even more difficult. Most of the discussion occurs between bank marketing and R&D types. Compliance, operations, security, risk management, and legal counsel units within banks are often uninformed about the efforts of the technology delivery groups. It is also difficult to offer financial services to the new world. It is not easy to "know your customer," evaluate risks, and price the risks when you cannot verify their identity or reach them easily. Bankers prefer orderly environments to anarchy. So do governments. ****Extremely Personal Observation***** So do I. I like privacy, I do not need true anonymity nor do I wish to engage in significant interaction or be exposed to anonymous persons. IF SOMEONE WEARING A HOOD OR A MASK COMES TO MY DOOR THEY WILL BE AUTOMATICALLY VIEWED AS AN IMMEDIATE THREAT. I may classify non-anonymous persons as threats after evaluating available information. Banks and governments will similarly look askance at those who wish to wear masks when engaging in commerce. Respectfully, Kawika Daguio THE ABOVE ARE MY PERSONAL OBSERVATIONS NO ONE IN SHOULD ATTRIBUTE THE SENTIMENTS EXPRESSED TO THE ASSOCIATION OR OUR MEMBERS. >>> Timothy C. May <tcmay(a)got.net> 10/22/95, 11:19pm >>> I saw this on the Cyberia list. Those of you near Washington, D.C. may find this worth attending. By the way, one of the speakers, Kawika Daguio, was once on this list (and may still be, though I haven't seen posts from him in a while). --Tim May >Date: Sun, 22 Oct 1995 17:04:32 -0400 >Errors-To: thardy(a)mail.wm.edu >Reply-To: cyberia-l(a)warthog.cc.wm.edu >Originator: cyberia-l(a)listserv.cc.wm.edu >Sender: cyberia-l(a)warthog.cc.wm.edu >Precedence: bulk >From: "Cleveland Thornton" <thornton(a)legalbits.com> >To: Multiple recipients of list <cyberia-l(a)warthog.cc.wm.edu> >Subject: (Fwd) DIGITAL CASH IN AN ELECTRONIC WORLD >X-Listserver-Version: 6.0 -- UNIX ListServer by Anastasios Kotsikonas > > >For those in the Washington, DC area, you may find the following >meeting of interest, > > > >------- Forwarded Message Follows ------- >Date: Sat, 21 Oct 1995 21:54:36 -0400 (EDT) >From: Andrew Grosso <agrosso(a)access.digex.net> >To: Cleveland Thornton <cthornto> >Subject: Please Post > > THE FUTURE OF MONEY: > DIGITAL CASH IN AN ELECTRONIC WORLD > > The evolution of money has now completed >a one hundred eighty degree turn from the point >where our economy began: from a barter marketplace; >to paper currency; and, today, to pure information >exchanged globally over telecommunications lines. >Money is digital, and can be created, utilized, >and transmitted by individuals and companies, as >well as by governments. > > On Thursday, November 2, at noon, the >Computer Crime Subcommittee of the ABA will host >a luncheon program which will examine the birth >and promise of digital cash. The speakers repre- >sent all three of the important organizations >participating in this venture: designers, bankers, >and governments: >

1 0

Internet Security Review
by Connie Sadler 17 Dec '03

17 Dec '03

Subject: Internet Security Review Date: Mon, 23 Oct 1995 15:20:23 PST A1-type: DOCUMENT Importance: normal >Just got a copy via mail today. Boy, Dorothy Denning seriously dings >Tim May in this issue. Interesting reading to know what the other side >is up to nonetheless. She uses some reasoning that will be compelling to >many. >Doug Hughes Engineering Network Services >doug(a)eng.auburn.edu Auburn University Doug, Could you possibly expand on this a little bit? I don't usually see this publication. Thanks! Connie

1 0

bank wiretapping law
by an224850＠anon.penet.fi 17 Dec '03

17 Dec '03

a law that allows government interception of banking data for intelligence/counterespionage purposes without notification... Date: Sun, 22 Oct 1995 03:11:05 -0400 (EDT) From: The Gate <gate(a)id.WING.NET> Subject: Foreign Intelligence To Become Alien Intelligence To: snet-l(a)world.std.com The following post make me think. What if the goverment could decide to interpret the meaning of the word foreign however they wanted. They could then say that anyone dealing with extra-terrestrials were foreigners, or that anyone not aligned with their thinking was a foreigner. I think that's the direction they're taking. Lee On Sat, 21 Oct 1995, Brad Dolan wrote: > > > ---------- Forwarded message ---------- > Date: Fri, 20 Oct 1995 18:07:35 -0700 > Subject: Lack of secrecy in U.S. Banks > > > I ran across an interesting fragment of the U.S. Code. > > Apparently, the Federal Government may access any banking records > whatsoever if the Director of the FBI (or the Director's designee) > certify that the information is sought for "foreign intelligence > purposes." Further, it is illegal for anybody to disclose that the > records were turned over to the government, or even sought. I do not > know the penalties for disclosure. > > The Attorney General appears to set guidelines for the dissemination > of the information obtained through this law. Note that if banking > privacy is violated for reasons which are not related to > counter-intelligence operations, the victim is unlikely to be in a > position to seek relief from the courts because the privacy violation > is likely to remain secret. > > I've enclosed the law below. I'm not a lawyer, so it raises more > questions than it answers. Perhaps the more skilled readers on the > list will be able to deduce the implications. > > The U.S. Code is available at http://www.pls.com:8001/his/usc.html > > This particular law is available at the improbable URL: > http://www.pls.com:8001/cgi-bin/taos_doc.pl?unix+0+uscode+17566+query+a+Gov… > > Here is the law itself: > > -CITE- > > 12 USC Sec. 3414 01/24/94 > > -EXPCITE- > > TITLE 12 - BANKS AND BANKING > CHAPTER 35 - RIGHT TO FINANCIAL PRIVACY > > -HEAD- > > Sec. 3414. Special procedures > > -STATUTE- > > (a)(1) Nothing in this chapter (except sections 3415, 3417, 3418, > and 3421 of this title) shall apply to the production and > disclosure of financial records pursuant to requests from - > (A) a Government authority authorized to conduct foreign > counter- or foreign positive-intelligence activities for purposes > of conducting such activities; or > (B) the Secret Service for the purpose of conducting its > protective functions (18 U.S.C. 3056; 3 U.S.C. 202, Public Law > 90-331, as amended). > (2) In the instances specified in paragraph (1), the Government > authority shall submit to the financial institution the certificate > required in section 3403(b) of this title signed by a supervisory > official of a rank designated by the head of the Government > authority. > (3) No financial institution, or officer, employee, or agent of > such institution, shall disclose to any person that a Government > authority described in paragraph (1) has sought or obtained access > to a customer's financial records. > (4) The Government authority specified in paragraph (1) shall > compile an annual tabulation of the occasions in which this section > was used. > (5)(A) Financial institutions, and officers, employees, and > agents thereof, shall comply with a request for a customer's or > entity's financial records made pursuant to this subsection by the > Federal Bureau of Investigation when the Director of the Federal > Bureau of Investigation (or the Director's designee) certifies in > writing to the financial institution that such records are sought > for foreign counterintelligence purposes and that there are > specific and articulable facts giving reason to believe that the > customer or entity whose records are sought is a foreign power or > an agent of a foreign power as defined in section 1801 of title 50. > (B) The Federal Bureau of Investigation may disseminate > information obtained pursuant to this paragraph only as provided in > guidelines approved by the Attorney General for foreign > intelligence collection and foreign counterintelligence > investigations conducted by the Federal Bureau of Investigation, > and, with respect to dissemination to an agency of the United > States, only if such information is clearly relevant to the > authorized responsibilities of such agency. > (C) On a semiannual basis the Attorney General shall fully inform > the Permanent Select Committee on Intelligence of the House of > Representatives and the Select Committee on Intelligence of the > Senate concerning all requests made pursuant to this paragraph. > (D) No financial institution, or officer, employee, or agent of > such institution, shall disclose to any person that the Federal > Bureau of Investigation has sought or obtained access to a > customer's or entity's financial records under this paragraph. > (b)(1) Nothing in this chapter shall prohibit a Government > authority from obtaining financial records from a financial > institution if the Government authority determines that delay in > obtaining access to such records would create imminent danger of - > (A) physical injury to any person; > (B) serious property damage; or > (C) flight to avoid prosecution. > (2) In the instances specified in paragraph (1), the Government > shall submit to the financial institution the certificate required > in section 3403(b) of this title signed by a supervisory official > of a rank designated by the head of the Government authority. > (3) Within five days of obtaining access to financial records > under this subsection, the Government authority shall file with the > appropriate court a signed, sworn statement of a supervisory > official of a rank designated by the head of the Government > authority setting forth the grounds for the emergency access. The > Government authority shall thereafter comply with the notice > provisions of section 3409(c) of this title. > (4) The Government authority specified in paragraph (1) shall > compile an annual tabulation of the occasions in which this section > was used. > > -SOURCE- > > (Pub. L. 95-630, title XI, Sec. 1114, Nov. 10, 1978, 92 Stat. 3707; > Pub. L. 97-320, title IV, Sec. 432(b), Oct. 15, 1982, 96 Stat. > 1527; Pub. L. 99-569, title IV, Sec. 404, Oct. 27, 1986, 100 Stat. > 3197.) > > -REFTEXT- > > REFERENCES IN TEXT > Public Law 90-331, as amended, referred to in subsec. (a)(1)(B), > is Pub. L. 90-331, June 6, 1968, 82 Stat. 170, as amended, which is > set out as a note under section 3056 of Title 18, Crimes and > Criminal Procedure. > > -MISC2- > > AMENDMENTS > 1986 - Subsec. (a)(5). Pub. L. 99-569 added par. (5). > 1982 - Subsec. (b)(2). Pub. L. 97-320 struck out ''of'' after > ''financial institution''. > > -SECREF- > > SECTION REFERRED TO IN OTHER SECTIONS > This section is referred to in sections 3402, 3409, 3421 of this > title. > __________________________________________________________________________ > > --****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION*** Your e-mail reply to this message WILL be *automatically* ANONYMIZED. Please, report inappropriate use to abuse(a)anon.penet.fi For information (incl. non-anon reply) write to help(a)anon.penet.fi If you have any problems, address them to admin(a)anon.penet.fi

1 0

Re: The NSA Visits Compendium
by Rich Salz 17 Dec '03

17 Dec '03

perhaps we can get epic or eff to archive copies of export requests? Perhaps companies would be willing to file copies of "we asked to export this" after the decision was made?

1 0

Similar Lists
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Looking for recommendations for any other mailing lists which allow one to stay current, on similar topics... Thanks, KTO

1 0

A secure cryptosystem with a 40-bit key?
by Scott Brickner 17 Dec '03

17 Dec '03

I've been reading a bit recently on constructed languages like Esperanto. I came across one that developed out of something called "LOGLAN" that was published in Scientific American in the early sixties. The current active project is called "Lojban". It has one really curious property that gave me an idea for an interesting symmetric-key cryptosystem. All "native" Lojban words are of entirely predictable forms. "Root" words are all five characters containing three consonants and two vowels in one of two patters (CCVCV and CVCCV). "Structure" words have four forms (VV, CV, CVV, and CV'V). "Combining forms" have two forms (CVC and CV'C). All other words are not "native" words (being either proper names or borrowed words). The upshot of this is that there is a fixed limit on the size of the Lojban dictionary of 249500 words (given 17 consonants and five vowels). The grammar of the language is *so* regularized that they are able to give a YACC description for it. A message written entirely using native Lojban words can be encrypted in a codebook fashion where the particular codebook to be used is a permutation of the dictionary represented by an 40-bit number (18 bits to permut the "root word" list, 10 bits for the "structure word" list, and 12 bits for the "combining form" list). This system has the interesting property that *any* plaintext with the same grammatical structure is a potential encryption of a given cyphertext. This is similar to some more usual cryptosystems which operate at the lexical level but which are designed to create this effect, but has the curious side effect that it is *very* easy to determine a false-key which makes the transmitted message say nearly anything you want, thus making mandatory key escrow systems irrelevant. When you want to send the message "attack at dawn", you devise a grammatically identical message, "party 'til you puke" (which is grammatically identical in Lojban), generate a random key, as well as the key representing a similar permutation, but with "attack" and "party" exchanged, "puke" and "morning" exchanged, and so forth. Transmit the message with the false key in the LEAF field (or report it to your government-approved escrow agency) and government eavesdroppers get the wrong message. Other eavesdroppers get a grammatically correct, but apparrently nonsensical message ("drink by brick"). There's still the problem of borrowed words and proper names, which remain problems in any codebook approach, but represents a small portion of the language, and the words which represent individual letters are part of the "structure words" category, and could be sent spelled-out. This works well in Lojban because it never changes word forms based on grammatical usage. Most natural language declensions and conjugations would make the encrypted message ungrammatical, and make it *much* more difficult to determine a false key for the LEAF field. The irregularity of word forms makes the dictionary much more complicated, too. Comments?

3 4