- cypherpunks-legacy - lists.cpunks.org

Re: "Protect the children" as passphrase to Constitution
by Bill Stewart 17 Dec '03

17 Dec '03

At 05:35 PM 8/10/95 -0700, Tim wrote: >- Clinton's Executive Order today which limits advertising of cigarettes, .... >(Oh, and one amazing detail: the possible issuance of I.D. cards to all of >those under the age of 18. Besides being useful for things like curfews, What!?!?!?! I guess I'm not totally surprised - registration of all children has been high on Clinton's agenda ever since he's been in the White House. One of the more blatant examples was the child vaccination proposals - which first started out as "take over the vaccination system and register all kids so we can remind their parents to get their shots", and gradually included less and less control and funding of vaccination while retaining the registration. Sigh. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- Storyteller makes no choice - soon you will not hear his voice. His job was to shed light, and not to master. RIP, Jerry

2 1

Australia, EU crypto ill news, crypto wars
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Just read this on comp.risks, by Ross Anderson (via a couple of people). A crypto relevant forward if any is relavent IMO, especially this bit: Ross Anderson <rja14(a)cl.cam.ac.uk> writes: > ... While at the conference, I found out that a classified meeting > took place this March in Germany between the signals intelligence > agencies of the developed countries, plus Australia and South Africa, > at which the assembled spooks agreed to press their governments to > bring in escrow and/or weak crypto. You realise, of course, that this means war, Tatical replies? a) Lobbying - hopeless IMO, they aren't interested in listening, the politicos are just too easy to manipulate and the "masses" aren't clueful enough of what crypto means to understand the implications, or even notice. b) pretty good stego - possible technical solution c) independant states of cyberspace :-) declaration of independence c) enforced or "enabled" by b) looks good to me. Perhaps some literary skilled cpunk would care to compose a suitable reply for PGN to add to risks. Adam ---------------------------------------------------------------------- Date: Tue, 1 Aug 1995 20:36:29 -0400 (EDT) From: "Lance J. Hoffman" <hoffman(a)seas.gwu.edu> Subject: Australia next to ban PGP Date: Tue, 01 Aug 1995 15:29:05 -0400 From: Dave Farber <farber(a)cis.upenn.edu> Subject: Australia next to ban PGP [unverified info ...] From: rja14(a)cl.cam.ac.uk (Ross Anderson) Australia's proposed crypto policy: (1) Banks will get key escrow (2) Other Australian residents will be forced to use weak crypto Source: talk by Steve Orlowski, Assistant Director, Australian attorney general's department, given at the Cryptography Policy and Algorithms Conference, Queensland University of Technology, last month. p 34: `the needs of the majority of users of the infrastructure for privacy and smaller financial transactions can be met by lower level encryption which could withstand a normal but not sophisticated attack against it. Law enforcement agencies could develop the capability to mount such sophisticated attacks. Criminals who purchased the higher level encryption products would immediately attract attention to themselves.' He mentioned that his department considered itself a suitable repository for the government central decrypting unit, which would decrypt traffic for local police forces. He also wants to escrowed keys for banks and other organisations allowed to use strong crypto. Centralising the wiretap capability with the AG is represented as a useful safeguard against abuse of power by local police forces. It would be presented as a `data recovery' facility in order to reassure the voters. Centralisation will enable the AG to acquire the capability to use ``more sophisticated techniques in circumstances where the key cannot, for whatever reason, be recovered from escrow''. So the technical parameters would appear to be: 40 bit keys for the masses, 56-bit escrowed keys for the banks, and a Wiener machine sitting in Orlowski's office. Belt, braces and string. Curiously enough, he quotes a `Review of long Term Cost Effectiveness of Telecommunications Interception' as saying that ``Encryption by targets of their communications (both voice and data) is not considered as a problem for TI at present in Australia'' and goes on to say that ``there has been comparatively little market for voice encryption products, although they have been readily available''. He even produces some good arguments for the EFF, such as that much of the intelligence comes from the call log data and from calls to third parties such as airlines and hotels which are not encrypted. He also says that the OECD countries will hold a meeting on National Cryptography Policies later this year. While at the conference, I found out that a classified meeting took place this March in Germany between the signals intelligence agencies of the developed countries, plus Australia and South Africa, at which the assembled spooks agreed to press their governments to bring in escrow and/or weak crypto. Australia seems rather eager to lick Uncle Sam's boots on this issue. I wonder what the payoff was?

3 2

Re: IPSEC goes to RFC
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> sdw(a)lig.net (Stephen D. Williams) wrote: > > > I really like the idea of using DNS for (public I assume) keys... ghio(a)cmu.edu (Matthew Ghio) wrote: > I don't. > > Public keys in the DNS is a bad idea because it makes it difficult to > update the database, especially in large organizations. When a host's > key is issued or changed then they would have to get the nameserver > admin to change it for them. This could become a major problem/ > inconvenience for many, many people. The host should be able to give > its own key in response to a query. That key could, of course, be > signed by any number of trusted signators to guarentee authenticity. I also like the idea of DNS-based public key distribution, but what Matthew said is true. What about this: Let the DNS-Server export the address of a machine which runs the public-key-database for this domain, similar to the MX record for the mailserver. If you need the public key for a person identified by the email address or for a host identified by hostname or IP address, you could ask the DNS server where to get the public key. The database host could run any program suitable to local requirements and export public keys with a certain protocol... Hadmut

1 0

Re: More "S-1" foolishness
by Hal 17 Dec '03

17 Dec '03

The other thing I noticed that really makes me question this is that G1 only uses 4 of its 8 input bits. As I wrote, it is equivalent to parity(i&0x17). A bit is a terrible thing to waste, and it is hard to imagine why it would do this intentionally. G1 may not be that important an element of the cipher but why throw away four bits? It is possible I suppose that the F and G boxes are not the ones used in the "real" version of whatever cipher this is, so this apparent weakness and the ones which Matt has pointed out may not be that significant. Hal

3 2

SSL bruting progress (was: Crypto-relevant flame interruption)
by aba＠dcs.exeter.ac.uk 17 Dec '03

17 Dec '03

Fred <admin(a)dcwill.com> wrote on cpunks: > Would someone be so kind as to provide a status report on the > planned SSL attack? Last word was that codework was still underway, > but I might have missed something relevant to this project amidst > all of the noise about excessive list noise. There has been no public announce. This is due to a desire to make real sure it's going to work before announcing. So, we're working on it. Software is basically all there, but we're experiencing difficulties, like during a trial run no key for Hal's challenge seems to be being found, even though the same software finds test keys. We've not managed to isolate the cause of it, as (two people) have nearly swept the entire keyspace (heh they had a bit of spare compute) and no key has been forthcoming so far. Give it a few more days - until monday - and if no key is found we've got problems, 3 possible outcomes looming: a) we find the key to Hal's challenge and go whoopee! Request a 2nd challenge from Hal? and announce a public sweep to see how fast it can be done. b) something is wrong with the interpretation or the gathering of the SSL session data Hal based his challenge on (difficult to see as there are numerous fixed fields which tally with the SSL spec.) c) software problems (also difficult to see, the software in all cases (3 separate versions) finds the keys of examples provided by Andrew Roos (ie he generated a key manually, so we know where to start for testing purposes)). The likelihood of a) happening is receding, as the last key space gets ticked off. More news next week. Adam

2 1

Clinton to resign?
by Brad Dolan 17 Dec '03

17 Dec '03

Associated Press reported on August 10, 1995: President Won't Resign But... (WASHINGTON) President Clinton wasn't about to give a serious answer when he was asked Thursday if he might resign. The question came from veteran columnist Sarah McClendon, who asserted that some legislators from the left and right were trying to push him out of office. [...] "Well, if you promise to run off with me I might," Clinton responded, ... "But otherwise, I can't think of any reason." - - - - - - - - - - Repeat after me: There's nothing to those crazy conspiracy theories. There's nothing to those crazy conspiracy theories.....

2 1

TIM MAY IS A CYPHERWEENIE
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

I think we ought to just throw TIM MAY out of the list. let's EXCOMMUNICATE HIM. its becoming increasingly clear that he is the source of all our problems. I mean, isn't it obvious that our progress has stalled? who has written any code within the last 3 days? if we got rid of him, it would be EVOLUTION IN ACTION. this is ERIC HUGHES' mailing list, and eric hughes knows how to write some decent code. I mean, TCM's signature doesn't even have any geek code, and he hasn't changed it in 4 years or so, at least since my last grandparent died (and she was considerably more skillful at programming than TCM by knowing how to make toast). get rid of all the pricks who continually spout and spew conspiracy theories. let TCM go and find himself a new mailing list. that would be a fair comeuppance if he found that he couldn't learn to do squish because he doesn't have the slightest clue. he's a leech, a parasite, sucking on the work of others, pretending that he is at the forefront of our cause when he is only at the forefront of maniacal egomania. what has he contributed to the cause? SQUAT. just a lot of ranting about conspiracy theories and his Stock Pick of the Week crap. "the web is really growing. people should focus on it". well, THANK YOU VERY MUCH, MR. BRILLIANT COMMENTATOR AND VISIONARY, T.C.MAY, I would have never have THOUGHT of that in a zillion years, but now that you point it out, I GUESS YOU'RE RIGHT.

1 0

Re: EU Data Protection
by Bill Stewart 17 Dec '03

17 Dec '03

>At 7:13 PM 8/11/95, Derek Bell wrote: >> I think you miss an important point; your opinion is subjective, but >>data can relate to objective facts (e.g. credit records). Would you take the >>same stance if a credit bureau claimed that you couldn't pay back half the >>loans you took out? There's a difference between what information you maintain for internal purposes and what information you give to other people. I don't really _care_ what nonsense a credit bureau may have in their internal records, only what they tell other people about me. If they somehow think I'm a bankrupt Communist space alien, but tell their credit-rating customers that my credit looks ok, it's not my business. If they use their own internal records to decide that _they_ don't want to lend me money, well, somebody else will get my business; it's in their interest to be accurate. A more interesting question is whether reporting credit transactions in private communications with their data customers constitutes libel if they inaccurately say bad things about me, and do I have a right to force them to tell me. Tim May thinks this kind of forced speech violates the US Constitution; I'm less bothered by laws telling corporations what to do (since corporations are fictional creations of the state) than by laws telling human-owned businesses or individual humans what to do. Tim May replies: >Think about it: the name "data privacy" sounds good, at first blush, but >what it really means is that my records are not private, that my records >are inspectable by government agents to see if I have stored any illegal >facts or correlations. Yeah. If you register your computer and its data with the Data Police, they have the right to inspect it. If you _don't register, that gives them reasonable suspicion to believe that you might have "illegally unregistered data" on the machine, so they have the power to inspect it. Kind of like proving you're not a witch.... #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #--- Storyteller makes no choice - soon you will not hear his voice. His job was to shed light, and not to master. RIP, Jerry

1 0

Re: PRZ encrypted voice software release imminent
by sbryan＠maroon.tc.umn.edu 17 Dec '03

17 Dec '03

At 10:59 am 8/11/95, Vladimir Z. Nuri wrote: [snip] >>I can't violate my NDA, but PGPFone will be a *major* revolution for >>communication security. I would not be surprised to see several hundred >>thousands of users. PGP will plale in comparison. > >I sincerely doubt this. if someone could find a way of doing >voice encryption through simple idiotproof hardware adapters >(I am thinking of cups that you could attach to any standard phone) [snip] Am I the one of the few who thinks that PGPFone is the biggest CypherPunk event for years? I think it will be even more significant if we get strong encryption built into the low level infrastructure of Internet as Perry and others are pursuing but that isn't an event that will be big news next week. A lot of people who don't usually think or talk about fundamental issues of privacy and technology will be doing so next week. I hope that some of the people here who have contacts in the press are ready to say useful and clarifying things to reporters who would be just as happy to concentrate on usual suspects (drug dealers, et al). On the speculation of attaching cups to a standard phone I think this has an air of unreality. To apply strong encryption you need a digital signal. That doesn't necessarily imply a computer but sufficiently powerful computers are going into people's homes at an astonishing rate already. I use MegaPhone on my Quadra 660av at home and I can't wait to try out PGPFone. Even without PGPFone I have thought for a while that computer based telephony is getting ready to take off. Combining CallerID, customized call handling, high quality speakerphone capability and a truly useful personal directory (TouchBase Pro is too sluggish, but getting there) there were already the ingredients of substantive usefulness. If you can add in street maps fetched with an AppleEvent or even a QTVR enhanced map then you get something that might make even an AT&T ad envious. Adding complete privacy (relative to previous levels available) and possibly authentication makes this a very big event. +---------------------------------------------------------------------- |Steve Bryan Internet: sbryan(a)maroon.tc.umn.edu |Sexton Software CompuServe: 76545,527 |Minneapolis, MN Fax: (612) 929-1799 |PGP key fingerprint: B4 C6 E2 A6 5F 87 57 7D E1 8C A6 9B A9 BE 96 CB +----------------------------------------------------------------------

1 0

No Subject
by Ford Prefect 17 Dec '03

17 Dec '03

I think we ought to just throw TIM MAY out of the list. let's EXCOMMUNICATE HIM. its becoming increasingly clear that he is the source of all our problems. I mean, isn't it obvious that our progress has stalled? who has written any code within the last 3 days? if we got rid of him, it would be EVOLUTION IN ACTION. this is ERIC HUGHES' mailing list, and eric hughes knows how to write some decent code. I mean, TCM's signature doesn't even have any geek code, and he hasn't changed it in 4 years or so, at least since my last grandparent died (and she was considerably more skillful at programming than TCM by knowing how to make toast). get rid of all the pricks who continually spout and spew conspiracy theories. let TCM go and find himself a new mailing list. that would be a fair comeuppance if he found that he couldn't learn to do squish because he doesn't have the slightest clue. he's a leech, a parasite, sucking on the work of others, pretending that he is at the forefront of our cause when he is only at the forefront of maniacal egomania. what has he contributed to the cause? SQUAT. just a lot of ranting about conspiracy theories and his Stock Pick of the Week crap. "the web is really growing. people should focus on it". well, THANK YOU VERY MUCH, MR. BRILLIANT COMMENTATOR AND VISIONARY, T.C.MAY, I would have never have THOUGHT of that in a zillion years, but now that you point it out, I GUESS YOU'RE RIGHT.

4 3