- cypherpunks-legacy - lists.cpunks.org

Re: DoD Asks Me to Stop Quoting From the Congressional Record
by tcmay＠got.net 17 Dec '03

17 Dec '03

(A copy of this message has also been posted to the following newsgroups: alt.censorship, alt.privacy,comp.org.eff.talk,misc.legal) In article <61l7cn$rc$1(a)gail.ripco.com>, glr(a)ripco.com (Glen Roberts) wrote: > I received a letter yesterday from the Office of the Secretary of > Defense. It politely asked me to stop quoting from the U.S. > Congressional on my website, and I presume they are also asking me > not to include such quotes on my radio show or print publications. > > Keep your eye out for a copy of their letter and my response... > I'll be anxious to see it. Certainly they have no legal footing, as the Congressional Record is just that, a record of what our elected Congress is doing and saying. The CR is, as we all know, widely available and meant to be quoted. This is why things, including a lot of nonsense (actually, _mostly_ nonsense) is "read into the Record." Or simply submitted to the CR for inclusion. As for any possible military secrets being disclosed, this is what closed hearings are for. Not that I necessarily approve of how many closed hearings there are, but this is what they're meant for. It would be consistent with trends of the past few decades if the Congressional Record becomes subject to secrecy laws. Hell, if were a Congresscritter I know I'd certainly want some of my stupid remarks stricken from the record and discussion of them banned. Let us know what happens. By the way, if the DoD pushes on this issue, you may find using mirrors of the CR, with pointers, another way to go. Don't actually quote the offending secruts, just give pointers to them. But quoting the CR is almost certainly fully legal. --Tim May -- The Feds have shown their hand: they want a ban on domestic cryptography ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

InfoWar Epilogue 0 (Part III of 'The True Story of the InterNet')
by A. Hoir 17 Dec '03

17 Dec '03

1 0

InfoWar Epilogue 0 / TEXT
by A. Hoir 17 Dec '03

17 Dec '03

---------------------------------------------------------------------------- ---------------------------------------------------------------------------- The True Story of the InterNet Part III InfoWar Final Frontier of the Digital Revolution Behind the ElectroMagnetic Curtain by TruthMonger <tm(a)dev.null> Copyright 1997 Pearl Publishing ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- InfoWar Table of Contents * Epilogue * d'Shauneaux ---------------------------------------------------------------------------- Epilogue ---------------------------------------------------------------------------- Gomez surveyed the wreckage with a discerning eye, before turning toward the mountains in the distance and fixing upon them with a penetrating stare that burned like a laser toward the chief target of his hatred, wherever they might be. "They are finished." he said, with certainty, turning to the Commander of his Dark Forces, and instructing him, "Now finish them!" ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- d'Shauneaux Except that you have spent literally a lifetime involved in a world of shadows, where even those things which are not done with mirrors are resonating indeterminately and obliquely, then you have little hope of ever recognizing the true depth to which the world you live in is ruled by secrecy, subterfuge and intrigue. Unless, of course, you are a follower of an ancient sage named Dilbert, and are steeped in the history and lore of Office Politics, in which case you undoubtedly already have all of the tools you need to understand what I am about to tell you. (And could probably even teach an old dog-foot soldier such as myself a few new tricks.) The lineage of the Author, as well as those of d'Shauneaux and Rom Dos, were each given information on a basis, not of 'need to know,' but more along the lines of 'need to figure out.' (That's 'decrypt' or 'decipher' for you CypherPunks.) The reason for this was that, at the time of the formation of the Circle of Eunuchs, the Evil One not only had his tentacles spread throughout society in general, and the computer industry, in particular, but had also made great progress in 'encrypting' Reality, so to speak. Even the Magic Circle did not fully realize the extent or import of this for quite some time, but they did recognize that they were playing 'catch-up' and needed not only to learn from the past, but also to reach toward the future. The Circle of Eunuchs, not being restrained by the need for absolute control and coordination of their efforts, as the Dark Allies were, made an astounding amount of penetration into the highest levels of the computer industry, in a short period of time. The individuals involved, working on their own or in small guerrilla cells, were able to 'move camp' at an instant's notice, changing the direction and focus of their entire career, if need be, which was of great benefit in such a quickly burgeoning technology. Despite their astounding success in placing their ersatz players in the midst of some of the most sensitive arenas of Gomez's grand technological game, the Circle of Eunuchs knew that they lacked possession of the key that would unlock the doors of deceit and allow them to expose the malfeasance underlying the technology that was increasingly ruling both the bodies and minds of all mankind. Then, something extraordinary happened A no-name individual who would have had to raise his station in life in order to become known as a bit-player in the computer arena suddenly became the target of a full-scale attack by the Dark Forces over a seemingly insignificant program called Pretty Good Privacy. Phil Zimmerman ---------------------------------------------------------------------------- "The Xenix Chainsaw Massacre" "WebWorld & the Mythical Circle of Eunuchs" "InfoWar (Part III of 'The True Story of the InterNet') Soviet Union Sickle of Eunuchs Secret WebSite ----------------------------------------------------------------------------

1 0

Re: do NOT escrow communications keys
by Anonymous 17 Dec '03

17 Dec '03

Adam Back <aba(a)dcs.ex.ac.uk> writes: > I'm arguing that you should not backup, or escrow communications keys, > and that you should backup storage keys. Euphemism alert: when we are talking about the kind of data recovery we like, we call it "backup". When we are talking about the kind we don't like, we call it "escrow". Schneier did the same thing: Bruce Schneier: > Key escrow = someone other than the author or the intended recipient of the > message being able to decrypt it. > > There are valid reasons for data backup, but they have nothing to do with > crypto key recovery. You don't actually mean that you should backup storage keys, you mean you should provide a means for someone other than the user to decrypt that stored data. Schneier means the same thing with regard to "data backup". > (forward secrecy) This could be a good idea, particularly in terms of old keys leaking out, but it needs more work. It's not clear that any of the forward secrecy methods will work for email. You can't easily do a DH key exchange via email because of the multiple messages. Maybe you could piggyback on ordinary messages, and after a few have been exchanged, you can get a DH key for the next message, but this is very complicated. Synchronization isn't guaranteed with email, neither is reliable delivery. > (untransferable signatures) This is also a good idea, but it needs more work, too. There is a big education problem here. People barely understand the implications of regular digital signatures. Now you are throwing this new kind in, which guarantee the message came from another person, but aren't binding. What happens when an employee receives a message from a supplier signed with that kind of signature? Can he make a decision on that basis, or not? In paper business correspondence, there is no such distinction. A signed letter is transferable. Go beyond this and business will be scratching its heads. It's a solution looking for a problem. There may be patents on these technologies, too. > (re-encrypting email with an escrowed key for archival) This is going to require special archival software and special actions on the part of users. You won't be able to do it as a transparent plugin. The user can't save his mail the regular way (with some email packages), he has to remember to (also?) save it to the business access archive. If he forgets, the business owner has lost access. There will be extra training costs, and people will have to change their habits. Besides being more complex to design and implement, it will be harder to sell to customers.

2 1

Re: America as a Shake Down Extortion State
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ryan Anderson wrote: >Tim May wrote: >>The debate over crypto almost certainly fits this pattern. If and when a >>domestic ban on crypto is likely to pass and be signed, companies like RSA >>and PGP will face extinction. This will then "incentivize" executives of >>these companies to release funds, in the form of campaign > >Actually, I think it's a little more likely that they'll get disgusted with >Congress, and collect some money for the ACLU to use to pay their lawyers in >the instant filing of the consitutionality challenge. > >Seems to be a much more productive way to spend your money (long-term). Bullshit! Fuck the lawyers! By wasting time and money in the courts bickering about the stupid laws that buffoons in Congress pass in order to justify their existence, we are only ignoring the real issue: you cannot use the system to change the system. What amazes me is the amount of time and energy well-intentioned folks piss away trying to convince legislators to "do the right thing". By paying attention to these idiots, we are in effect legitimatizing their actions. If enough people come to their senses and ignored this bogus legislation, we will all be much better off in much less time. Tim May wrote elsewhere: >Face it, Amerika is basically a Mafia shake-down operation, with the power >of the State used to shake down protection money. > >This is why I favor crypto anarchy: by concentrating on ignoring laws and >deploying technology, this extortion state system is bypassed. Exactly. Spend the money on deploying the technology. Don't waste it lining the pockets of scum legislators and their litigious brethren. The big question is do PGP, RSA, Netscape et al have the balls to stand up for themselves and tell the DC politcos to fuck off? We can only hope... [ Imastun ] - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzQ+SNwAAAEEANhUVaFtM+8ZLhEhur55LhN0m/aUyemwVExEq96RUXkQlvBw H45ZcEMYzml7k2hM84rQiJEd/BPi18dhtXykz0vYqmke6BKDiAsR95ik+Jm3XXMU OQgHo0+asRJ85BOG+jm3424e4vY5/eTFaExNISW5T8XD+qgRgnC/ZQW0eQF1AAUR tBZJbWFzdHVuIDxsaWJlcnR5QHJpc2s+iQCVAwUQND5KIXC/ZQW0eQF1AQESOwP+ MPNlXlv/hzqoAaqXu4RpNR02XcMLOB5DwhG1pLij3Tt6uYfRqZul8eJ9LxvQ0R/R eT7g+j3dNpjcOSdCci4VYAPfdBK78esgDIn61cOiN29fGRwjJOO5rup9RvXBQt+T +Sf7D1gYlr/aDUGKMiBGGZhx2git7zpL7uqnvQn0WY8= =bXK7 - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBND5M5HC/ZQW0eQF1AQE4HwP+JJ1eiIFGVguO5PwRsRl0gAiVxYiSGpHP 6h8le1QAgNJTlCz7C/ObNjVmtHnw6vjcYewLXSsnF59cRPakAD/Y4NLSLP/vPzWk gbx6t9X8hb0vC2LWOA/UcXZQBoqfLEXexm4LehKU0LpDL7ggy6SBw8PDEOr3InSh f15W51XTv/0= =OBNd -----END PGP SIGNATURE-----

3 2

Spammers Plan Backbone
by Ross Wright 17 Dec '03

17 Dec '03

http://www.zdnet.com/chkpt/adt1010nk/www.anchordesk.com/story/story_1343.ht… Yippie! Spam wars intensify as bulk emailers plan own Internet backbone. AOL, other ISPs threaten to fight back. Spam is FREE SPEECH!!!! =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: (408) 259-2795

2 1

GAK for PGP 2.6.2
by Anonymous 17 Dec '03

17 Dec '03

GAK fans! Here's a patch to PGP 2.6.2 to force it to encrypt all messages to the FBI key. Patch crypto.c thusly: 2339a2340 > ++i; /* Count FBI key */ 2368a2370,2372 > /* encrypt to FBI */ > keys_used = encryptkeyintofile(g, "<leaf(a)fbi.gov>", keybuf, keyfile, > ckp_length, keys_used); That's it. Four new lines, and every message is encrypted to the government as an additional recipient. Don't let the FBI see this. If so, we'll be <ominous voice> "one step from GAK". Add a few SMTP filters and we're doomed.

2 1

PGP CAKware & IETF controlled Open-PGP standard
by Adam Back 17 Dec '03

17 Dec '03

One aspect of PGP's controversial CAK system in pgp5.5 that I have not seen discussed is the standardisation aspects. How does the introduction of corporate access to keys (CAK), and government access to keys (GAK) features fit into the IETF framework? Are PGP Inc's CAK features intended to be part of the now IETF controlled Open-PGP standard? What is the IETF's stance on politics having influence on security? A weakly comparable example might be perhaps the IPSEC standardisation process, and the effect of export regulations on key sizes. Are IPSEC key sizes allowed to be restricted in the standards so that IPSEC products can be exportable? Now some would argue, and with some justification, that emails sent using company equipment are the property of that company. However there are other considerations also. Expectation of privacy is one. The negative aspects of a society in which most companies have become little brother institutions, becoming small versions of what many of us are fighting: mandatory government access to keys, big brother wanting the ability to read all traffic. I would be somewhat concerned if PGP Inc's recently announced the key escrow functionality becomes part of the Open-PGP standard, because it will set a bad precedent, and possibly force others who would otherwise wish to implement to the open-PGP standard to also implement features useful to secret service special interests in enforcing mandatory domestic government access to keys, or implement only partly compatible systems. I need hardly comment that such an eventuality is not in the interests of the internet community. Specific questions relating to the standard are perhaps: - Are the certificate flags informing the recipient that communications to a key is escrowed, and that email which is not encrypted to the escrow key will be bounced expected to be part of the Open PGP standard. - Can a conforming application ignore the key escrow flags? - Or must a conforming application display a suitable warning perhaps such as: WARNING: the person whose key you are using has the misfortune of being forced to use software supplied by a company which has sold out to key escrow, therefore you data may be read by others than your intended recipient. and perhaps a note tacked on to the email for the recipient to read: SAY NO TO KEY ESCROW. Boycot little brother and big brother. Don't buy PGP Inc software. or must conforming applications be more polite. Aside from the snide remarks about key escrow, I am concerned about PGP's actions harming internet privacy, and helping indirectly the introduction of mandatory key escrow which the US administration and UK secret service and department of trade and industry are pushing. A system which implements all the features necessary for mandatory key escrow as a business solution may indirectly help the mandatory key escrow proponents. Plausible events which might happen in such an event might be: - companies encouraged to use (or penalised for not using) open-PGP corporate escrow compatible systems - service providers also encouraged to use such systems - companies legally required to use such systems, and hand copies of corporate master keys to government (corporate escrow then becomes government escrow for business communications) - ISPs and individuals legally required to use such systems, and hand copies of corporate master keys to government (full blown mandatory key escrow) I am concerned about the possibility that the IETF might be steered by PGP Inc into putting features into the Open-PGP standard which are not in the interests of the internet community. Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

3 4

Re: Defeating MITM with Eric's Secure Phone
by Mix 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Adam Back wrote: >Monty Cantsin writes: >> My apologies if this has already been discussed, but wouldn't this be >> a straightforward solution? > >John Kelsey described the same system. > >[adding hex passphrase digits exchanged via PGP to display digits] > >> Any flaws? > >See my other recent post in this thread... I think it doesn't work >because Mallet can recover the passphrase. You must remember that >when Mallet is actively doing a MITM attack he knows the digits on >the display of each party. With that info he can recover the >passphrase by subtracting. Then he can give Alice the correct >checksum for the link A<->M and Bob the correct checksum for the link >M<->B. Oh, I get it. Thanks. And now I get why people want to assign passwords to each digit. Mallory has no way of knowing all the mappings, even when one is revealed. Just to get a feel for what this looks like, a table like this one could be exchanged in advance of each telephone call. (Nothing here is my invention, of course.) The columns are used once successively for each digit. 0: Tientsin bedeviling Menominee bonneted coincides quotation 1: handling Bernadine prouder Navaho fittingly Swinburne 2: degrading Puritanizes allophone acquaint jack renditions 3: clientele homo Verderer diskettes overview surmounts 4: delimiting probes sobering modulating situated jelly 5: bewail reflex multistage plastics stigmata scandal 6: Genoa divider synonym bipeds tale denominators 7: aborts carbons welding amalgam chain innovation 8: salvaging Fargo transitional relishes Ozarks meditations 9: overlapping Tehran desperation initiated intimidate beggars A: whereby muffins Soddy miniatures diagnostic proportionment B: flour pistils aback despatched Rydberg tales C: lifespan sallying Arianist kindness side corporal D: wrongs nervousness minting totaller feather copyrightable E: intoxicated Yukon Boyd response ingredients numismatist F: stairway imitation consulted printably anesthetizes interval This has about 85 bits of entropy assuming the words are randomly selected from a pool of 20,000. As Mallory only gets one try, those are very good odds. This is completely practical and secure because the table is easy to generate and exchange. (Not that an in-band method wouldn't be way cool!) Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEUAwUBND56bpaWtjSmRH/5AQGcfQf3Y8tpnovD2tVVqUdJwHBg4ZgKfulxP2EH nuXSuvg7eMJ1veHw3ObmsiA+MzPzoBbrEkYM6u5TN3U+ytZbb5A/ogvD3fZepwhW Sns5l0J6y5gK4nRd9AqvU7MBp21iugJy6VEPwQzKwTIj/lkUydKeODluZSOqatyL NHr9qdZQrvvzsmvRL6EGvf2yEmYTeLg5XscLWPIyyA24jEMJNUXyQ5+W6bTx3Pxc aUBiSbVtoYIJDGKdzNGUu7QtlQP0DSQ+81kW4R86CreFx7H8rwRdr7dpwgTMADgZ ps2Nj0M71x9R8W9Jukg1eBw/xoyihldEo4SGrpDECv+Iawu+HSgZ =CEWV -----END PGP SIGNATURE-----

1 0

Re: CAK as a really bad form of corporate networking
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: >My conclusion is that PGP for Business does very little for real >corporate access in "hit by a truck" situations, as most of these >critical files (fill in the blanks , but thinkof chip design files, >source code for programs , lab notebooks , etc .) are simplyNOT ever >e-mailed. And if they are e -mailed , this is completelya tertiary >issue. One should also ask who is managing the company and why. It is never a good policy to leave important components of the company in the hands of particular people for long periods of time. While people die relatively infrequently, they do often become frustrated or angry and leave the company. For instance, one really has to ask what is going on when a programmer doesn't check in his or her code for six months. And one really has to wonder how useful that code is going to be to anyone. My policy has been to discard half completed work when people leave. It's just cheaper to start anew than to clean up and debug undocumented code which nobody understands. In general, the case where "important documents" have to be retrieved from a departed employee's desk or computer are fairly uncommon. And the case where it is necessary to intercept a departed employee's e-mail is pretty much non-existent. >So who is the real customer for PGP for Business and its form of >plaintext recovery? I am looking forward to hearing the precise mechanisms behind PGP, Inc.'s change in tune. Were some of those investors shills? In terms of governmental expenditures, it would cost nothing to flood PGP with great investment deals. It would probably cost less than Clipper itself. And all of the former troublemakers can be quietly ridden down and finally trained to accept the saddle of good stock deals and contractual obligations. If that was the mechanism, it's pretty slick and to be admired by sportsmen everywhere. It is the sense of Monty Cantsin that a number of readers of the list are downplaying PGP Inc.'s actions because they hold the character of certain people involved with the company in high regard. This is probably an error. Character must be judged by actions. The actions are clear. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBND6DcJaWtjSmRH/5AQEDGwf+Pl0xusD2oBzrqOFkBrV92NHswJJ6VbuQ akNVAaBz+gNnXy2Zt7Pfa09nqibW9qbzd3pbJh8v7djOwtqQSJXN7uZA0JVF2mii oLR5jwh9bpNRSvElaJLRmcGMY3RKighl1rcwfxAjbmJjEI6nSjcaELPNpPCMZEfT cEehlxC5R4f9oikQJc4VNg/MVo89P9ckT9wtbdd4S4ZOFArxHvGlw+bW/hwlpDNE fIZBy8BlJqir+BSZGLkSwOOvuAwozMCQSM/VFj6aDNiNTA3bQ8xHGyaapRci7dVX ZleOrYWsdAt25R9yt79T9Mcu8tKuvbfl245gxHSrOReODG89gOT/vw== =FLvb -----END PGP SIGNATURE-----

1 0