- cypherpunks-legacy - lists.cpunks.org

Wrong Address???
by Roger H Tancrell 17 Dec '03

17 Dec '03

To Cypherpunks: In the last couple days, I have received many, many e-mail messages. How did I get your your group list??? Perhaps, you have the wrong "Roger". Please remove my name. Thanks. Roger Tancrell

1 0

Re: [LEGAL] Crypto as Contraband?
by James A. Donald 17 Dec '03

17 Dec '03

-- At 06:20 PM 3/6/98 -0800, Tim May wrote: > How could any "outlawing of unescrowed crypto" conceivably > deal with this vast amount of distributed software? Will a > user of RSA's MailSafe program face jail time for using a > program he legally bought in 1991 (as I did)? > > More questions than answers. Can anybody help me to > understand the legal issues? You are getting out of date. As the rule of law dissolves, legal issues become insignificant, and will in due course vanish altogether. For example nobody knows what are the "legal issues" with putting strong crypto on a web site, as I have done. According to what the legislation says, what I have done is completely in accord with legislation. Indeed, it is completely in accord with US legislation simply to post the stuff. on any server inside the US, the foreigner doing the download is violating the legislation, not the person who put it up. I have gone considerably further than is required by legislation, though not nearly as far as some others have gone. But mere legislation counts for less and less these days. If you read the business press, you will frequently read them complain of cases where the distinctions between executive, legal, and judicial powers are effectively dissolved, and penalties are in effect adminstratively applied for undefined offences, or retrospectively and administratively defined offences, often in ways that appear to personally enrich those administering these quasi judicial powers. Generally this sort of thing is only applied to people who are unpleasant and unpopular. Tobacco companies, junk bond merchants whose businesses have been more profitable for themselves than for many of their investors, and the like. Of course this creates a large vested interest in demonizing more and more people, so that more and more people can be dealt with in this fashion. Similar measures are applied not only to alleged recreational drug distributors, but to lawyers who defend alleged recreational drug distributors, but the business press tends to report such cases less. Meanwhile formerly totalitarian countries, such as China and Cuba, where there used to be no such things as laws, merely some people having the power to harm other people, power exercised in accordance with rules that those subject to this power were forbidden to know, are moving towards the rule of law. It used to be that if someone imprisoned in Cuba were to discover the actual reason for his imprisonment, he might possibly suffer some draconian additional punishment for improper possession of state secrets. In a fully totalitarian state, the regime does not have rules for most people, merely goals and desires. If some desire is not fulfilled, the masters will go around killing people more or less at random until somebody fulfills that desire, or until they have killed so many people that they suspect that what they desire is not readily achievable, or sometimes until they simply run out of people who might be able to assist in fulfilling that desire. For example all people possessing certain skills and experience were wiped out by Stalin, and in Cambodia everyone connected to the jute industry in any way. Such rules as exist only apply to the privileged, to those administering the terror, not to those terrorized. Crypto legislation is likely to resemble the announcement of a desire, rather than the announcement of rules and restrictions likely to fulfill that desire. Indeed, the proposals we have so far seen are desires, not rules. As you point out, that desire cannot be fulfilled, except by means that further radically undermine the rule of law. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG KheXnmd1kekBNA4gB1wyUeQgjPT7Y26FWeajCBIR 43jg9sJBVPllkPf+Yt2ByoAf/sIdt9xbXwh/wMV+Z

1 0

Final CFP: 5th ACM Conference on Computer and Communications Security
by Gene Tsudik 17 Dec '03

17 Dec '03

Final Call for Papers Fifth ACM Conference on Computer and Communications Security San Francisco, California November 3-5, 1998 Sponsored by ACM SIGSAC Papers offering novel research contributions in any aspect of computer security are solicited for submission to the Fifth ACM Conference on Computer and Communications Security. Papers may present theory, technique, applications, or practical experience on topics including but not limited to access control authentication accounting and audit mobile code security applied cryptography data/system integrity cryptographic electronic commerce intrusion detection protocols key management privacy and anonymity intellectual property protection information warfare secure networking secure operating systems viruses and worms security management distributed systems security database security smart-cards and secure security verification PDAs Accepted papers will be presented at the conference and published by the ACM in a conference proceedings. Outstanding papers will be invited for possible publication in ACM Transactions on Information and System Security. Instructions for paper submissions: Submitted papers must not substantially overlap papers that have been published or that are simultaneously submitted to a journal or a conference with a proceedings. Papers should be at most 15 pages excluding the bibliography and well-marked appendices (using 11-point font and reasonable margins on 8.5'x11' paper), and at most 20 pages total. Committee members are not required to read the appendices, and so the paper should be intelligible without them. Papers should be submitted in a form suitable for anonymous review (no author names or affiliations). * Send via email to reiter(a)research.att.com a plain ASCII text message containing the title and abstract of your paper, the authors' names, email and postal addresses, phone and fax numbers, and identification of the contact author. * In addition, submit your paper using ONE of the following two methods. o Electronic submission (preferred): Instructions for submitting your Postscript paper by e-mail can be obtained from http://www.research.att.com/~reiter/ccs5/esub.html or by sending email to ccs98(a)research.att.com with the Subject line containing "HELP". It is strongly recommended that you electronically submit your paper at least five days in advance of the submission deadline, to allow us adequate time to verify that we can print your paper (and if not, to allow you to submit your paper in hardcopy to be received by the submission deadline). We cannot be held responsible for papers that we cannot print. OR o Hardcopy submission: Send eighteen (18) copies of your paper to the program chair at the address below with a cover letter indicating that your paper is a submission for the 5th ACM Conference on Computer and Communications Security, and listing the authors' names, email and postal addresses, phone and fax numbers, and identifying the contact author. Submissions received after the submission deadline will be rejected without review. Where possible all further communications to authors will be via email. Paper submissions due: April 3, 1998 Acceptance notification: June 5, 1998 Final papers due: July 16, 1998 Instructions for panel proposals The conference may include panel sessions addressing topics of interest to the computer security community. Proposals for panels should be no longer than five (5) pages in length and should include possible panelists and an indication of which of those panelists have confirmed participation. Send two (2) hardcopies of your proposal to the program chair at the address below with a cover letter indicating that your proposal is for the 5th ACM Conference on Computer and Communications Security, and listing the proposers' names, email and postal addresses, and phone and fax numbers. Panel proposals due: May 1, 1998 Acceptance notification: June 5, 1998 Steering committee chair: Ravi Sandhu, George Mason University General chair: Li Gong, JavaSoft Program chair: Mike Reiter AT&T Labs, Room A269, 180 Park Avenue Florham Park, NJ 07932-0971 USA phone: +973-360-8349 Awards chair: Jacques Stern, ENS/DMI Publication chair: Stuart Stubblebine, AT&T Labs Publicity chair: Gene Tsudik, USC ISI Program committee: Martin Abadi, DEC SRC David Naccache, Gemplus Bill Cheswick, Lucent/Bell Labs Hilarie Orman, DARPA/ITO Carl Ellison, Cybercash Avi Rubin, AT&T Labs--Research Ed Felten, Princeton University Pierangela Samarati, Universita di Milano Paul Karger, IBM T.J. Watson Gene Tsudik, USC ISI Steve Kent, BBN Corporation Paul Van Oorschot, Entrust Technologies Ueli Maurer, ETH Zurich Bennet Yee, UCSD Cathy Meadows, Naval Res. Lab Moti Yung, CertCo For more information, visit http://www.research.att.com/~reiter/ccs5 or http://www.isi.edu/~gts/cfp.html

1 0

Re: Why Americans feel no compulsion to learn foreign languages
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:22 AM 3/28/96 -0800, Timothy C. May wrote: >... In any case, the issue is not the >classes taken by _some_ (the few percent who study Russian, Japanese, >Mandarin, etc.), but the topic of this thread: "Why Americans feel no >compulsion to learn foreign languages." I, at least, want to know something of the language of the countries I travel in. Being able to get a meal or a room for the night is useful. As a rock bottom minimum, I want to know the phrases: Hello, Good by, Please, Thank You, More beer please, and Where's the bathroom. The look of pleased surprise on the face of the Budapest resident when I said "Thank you" to in Hungarian as he gave up his seat to me because I was loaded down with caving equipment is something I still treasure. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Blanc Weber writes: > Perry, here's a question for you, and I am seriously interested in your > answer: [...] > what, then, would you yourself consider proper for discussion here? > [in the context of digital cash discussion] I'd say that anything directly dealing with digital cash, its implications, deployment, and technical issues associated with it. General discussions of whether the Federal Reserve is a bunch of evil old men and the like are what are out of bounds. This means: "How does blinding work" and "Do you think that digital cash systems will hurt bank regulatory supervision" are fine things to talk about but "Do you think the Federal Reserve issues counterfeit money" are not. Perry

1 0

Re: firewalls and CKE (fwd)
by Adam Shostack 17 Dec '03

17 Dec '03

Marcus Ranum posted this to firewalls. Contains some interesting technical arguments against key escrow at the firewall level. ----- Forwarded message from Marcus J. Ranum ----- >From firewalls-owner(a)GreatCircle.COM Mon Mar 25 21:26:27 1996 From: "Marcus J. Ranum" <mjr(a)clark.net> Message-Id: <199603252204.RAA01115(a)clark.net> Subject: Re: firewalls and CKE To: mckenney(a)smiley.mitre.org (Brian W. McKenney) Date: Mon, 25 Mar 1996 17:04:41 -0500 (EST) Brian W. McKenney writes: >I missed the jist of the original message The gist of the first message was that software key escrow is here, and it is the greatest thing since the discovery of fire. :) Granted, it's nice that someone has found a way of convincing the government to let them export good crypto, but in this particular application it makes no sense. >For the firewall-to-firewall encryption >scenario, the data recovery component (DRC) may be a machine that >intercepts (in real-time) the traffic and then decrypts the data (recovers >the data). The interception of encrypted data makes sense for this type of >communication since the data is not really stored on the firewall (it is >wrapped/unwrapped quickly). [the intercepted packet may be copied and then >decrypted] That's completely brain-damaged if you think about it for a second. Let's suppose I have a file and it is unencrypted. I FTP it through my SKE-equipped firewall to the Paris office. My file gets transparently encrypted as it is broken into packets and sent across the 'net. Then - what - someday I need the file back so I get the escrowed key and reassemble the file from raw packets? That's dumb! I dunno about you but I'd just recover the clear file from a backup tape. :) Firewall-to-firewall encryption is a link-layer security technology. It encrypts data in transit: before it leaves and after it arrives you *already* have a clear-text un-escrowed version of the data. If I have a corporate requirement to "escrow" my telnet sessions then I'll use a version of telnet that logs keystrokes. But I can't see any reason (unless I'm a spook) to de-archive, de-escrow, and reassemble a telnet session for archival purposes. It gets worse since all the "escrowed" packets will be mishmoshed in with DNS queries (all "escrowed") and NFS packets and lordy knows what else. If it came to having packet records, why not simply log all packets *before* they get encrypted at the firewall, while they are still in the clear? Easier, no? At least LOTUS' "key escrow" approach is openly designed for the spooks and doesn't pretend to add value to the end user. I appreciate that TIS has made a successful deal with the devil to export some strong encryption, but it's unfortunate that they're showcasing it in a way which makes absolutely no sense at all. It's a shame, because basically we're seeing smart people doing technically goofy things in order to comply with some ridiculous laws. mjr. ----- End of forwarded message from Marcus J. Ranum -----

1 0

Returned mail: User unknown
by Ben Srour 17 Dec '03

17 Dec '03

Spelling is the KEY to life. >>X-Sender: issup5@mail >>Date: Mon, 26 Feb 1996 11:32:17 +0200 >>To: "cypherpunks(a)toad.com" <cypherpunks(a)toad.com> >>From: Nibiru <nibiru(a)columbus.co.za> >>Subject: unsubscrive >>Sender: owner-cypherpunks(a)toad.com >> >>unsubscrive cypherpunks >> >> >>------------------------------------------------------------------- >>NIBIRU >>E-Mail : nibiru(a)columbus.co.za >>South-Africa >>-------------------------------------------------------------------- >> >> >> > >

1 0

Re: Traffic Jams on the Internet
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:54 PM 3/27/96 -0500, Mark M. wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >On Tue, 26 Mar 1996, E. ALLEN SMITH wrote: > >> It occurs to me that it would be good if people sent in some >> non-governmental/hierarchial solutions to this problem, such as ones using >> digital cash as "postage" for prioritized mail. > >I read an article on various Internet pricing schemes a while ago and one >of the ideas was a pretty clever solution. Internet services would be >classified according to their bandwidth requirement and need for >interactivity. The cost per byte of e-mail might be very cheap whereas the >cost per byte for videoconferencing might be more. There's no real way to >rip off this scheme, because if you try to send an e-mail and classify it >as "high priority" it is more expensive. The phone companies have dealt with this kind of problem for years. For example, there are issues of phase jitter and bit error rate that they deal with all the time. If anything, they don't quite understand the email type communication of, "Oh, anytime in the next 10 minutes, and tell me if it doesn't get thru and I'll send it again." In ATM, these characteristics are bundled into what is called Quality of Service. That, along with bandwidth, make a reasonable basis for charging. Email is a bit like flying standby, while video is more like the Concorde. IMHO, the only long-term solution to the problem of bandwidth allocation involves markets. Markets feed cost information back to the users and give the providers incentive to improve service. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: ITAR double standards?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:20 PM 3/27/96, Asgaard wrote: >I believe in this parallel thesis. As was reported from the dec -95 >OECD meeting in Paris: > >>The statement from SHELL International is interesting. >>They can accept 'a trustworthy international key escrow >>infrastructure based on X.509 certificates' but they also >>need to 'protect their assets against Government intelligence >>gathering, organised crime, civil unrest and data privacy >>legislation obligations'. Indeed, there are _many_ reasons for multinational and/or non-U.S.-based companies to be suspicious of the United States or any of its minions holding the keys to confidential business information. Bamford's "The Puzzle Palace" reports on many incidents in which U.S. agencies intercepted business transactions for various reasons. Even of allies, as in the case when one of the NSA's SIGINT antennas picked up a message from the U.K. government to the ambassador in Vienna alerting him to the coming devaluation of the pound. (A great opportunity for Ollie North and his covert ops boys to make some extra millions by currency speculation.) Likewise, ITT routinely cooperated with the FBI and pre-NSA surveillance agencies to supply the traffic of corporations and businessmen. Given that even nominal allies spy on each other (Pollard spied on the U.S. for Israel, Chobetsu routinely spies on U.S. companies in Japan, France bugged Air France jets to spy on U.S. businessmen, etc.), I just don't see any international agreements that protect adequately. And when I say "nominal allies," consider that many in Washington have been saying in recent years that Japan is America's "real" enemy! (I certainly don't endorse this view...they're all a bunch of rascals.) I believe the obvious flaw in the whole key escrow debate, the flaw that is so obvious it seldom gets discussed, is that it is expected that the U.S. will be the holder of keys. Or its minions in Europe and Asia. Flawed, irretrievably. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: The Law Loft: Surviving the Biometric I.D. Card
by Hal 17 Dec '03

17 Dec '03

I have been surprised not to hear more about this aspect of the immigration reform laws. Unfortunately the alert which Tim forwarded is out of date, and I believe the reforms did pass in some form. I view biometric identification as a very disturbing development and I'd like to hear more about the wording of the bills as finally passed. If they really want to give people a card which proves their legal residence in the US, a less intrusive approach is possible. Rather than set up a database of all employees, and/or give each person an official identity card, instead have people come and prove their residency, then give them a card with the biometric information and a blind signature. No other information goes on the card, no information goes into a database. The signature is a certificate testifying that the person with the particular thumbprint is legal to work in the US. The card can't be transferred since no one else has that thumbprint. But no identifying information is recorded. There is no advantage in people coming in twice to get more than one card since their print will be the same each time, so no database is needed. A simpler approach dispenses with the blind signature and just issues a regular signature on the thumbprint or other biomarker. This is about as good since proving residency will probably require at least an incidental display of identity papers, so you are already trusting the agency not to log you, and you can just as easily trust them not to log the signature. This is an approach which accomplishes the goal with a minimal intrusion into people's privacy. I don't know how it compares with current biometric concepts - maybe this is similar to what they are proposing, minus the database. But there is a general principle that government regulations should use the least restrictive means where they violate people's rights, such as the seriouss privacy violations in the current proposals. So I think it should be possible to make a strong argument that privacy protecting alternatives which accomplish the objective must be considered. The key concept is to unlink identity from the credential. That is the crucial idea of credentials, one which has not yet pentrated the popular consciousness. Maybe we need to start pushing it more. You don't have to prove your identity to prove you have certain qualifications. There is no need to tie everything to a central identifier. A system of dispersed, stand-alone credentials will be far better at protecting privacy. Blind signatures can help protect against cheating, but policy can work too, especially when credentials are issued by a public agency on a large scale, so systematic and secret record keeping is impractical since so many people are involved. I know a lot of people will oppose even this form of biometric information, which is not tied to identity. Perhaps we could have some discussion on the degree to which people see this kind of system as a privacy threat. If the credential concept is new we could discuss that, too. Hal

2 1