- cypherpunks-legacy - lists.cpunks.org

Re: So, what crypto legislation (if any) is necessary?
by Rich Burroughs 17 Dec '03

17 Dec '03

tcmay(a)got.net (Timothy C. May) wrote: [snip] > Jim's argument (?) could be turned in all sorts of ways: "Your Honor, there > is nothing I can find in the Constitution that says I can't drive on the > left side of the road at 125 miles per hour." Indeed, there is nothing > laying out detailed traffic laws. And so on. [snip] Or a right to privacy, for that matter. It's not stated anywhere explicictly in the Bill of Rights -- the courts have patched together a legal framework for it. Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb Protest the CDA - Join the EFF's Blue Ribbon Anti-Censorship Campaign! See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon

1 0

Re: Bad news from Judge Richey
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

At 11:33 PM 3/25/96 tcmay wrote: ------------------- jim bell: >talk to Jim Bell about implementing a program using encryption that doesn't >_need_ to be exported...legally anyway. tcmay: You're coming perilously close to actually calling for the killing of a federal judge. My recollection is that a couple of folks have been arrested and charged for calling for the killing of judges. ------------------- Any half-wit falling for Bell's agent provocateur setup will do hard time, or maybe get popped by his twitchy TLA watchers. The son-of-a-bitch's baiting with pigeons, no question. He's too myopic to see he's setting up falcons for gutting by high-circling eagles, who'll claw him too. Bell's going down blind-sided with his gulls, all easy prey.

1 0

Random Number Testing (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi Fred, Forwarded message: > Subject: Random Number Testing > Date: Tue, 26 Mar 1996 18:00:26 -0800 (PST) > From: Fred <admin(a)dcwill.com> > > The limitation seems to be in the testing process. > > An inviolable rule of test and measurement is that the testing process > must have a higher degree of accuracy and precision than is expected from > the item under test. If all you have is a non-graduated stick one meter > long, you can't measure increments of less than one meter unless you add > some additional resolution to the system (such as a human's judgment > that the object is four sticks, plus about another third of a stick, > long). Not if I am allowed geometry. I believe such situations are a test of lateral thinking more than any fundamental insite into nature. > > Our ability to synthesize pseudo-random data, and the degree to which > it approaches true random data, is limited by our ability to discern > between the two. If the best testing process available yields the > same results for the output of a true RNG and a particular PRNG, what > can be done to improve the randomness of the PRNG? How could we tell > the difference based on the data itself? What are you defining as random? The definition I use in practice is basicly that if I am given 100% intelligence on a stream of numbers the odds of my succesfully choosing the next number is never higher than chance. All data is random (by definition) until the pattern(s) can be discerned. In this context pseudo-random has a definite meaning, namely that it takes a long time to amass enough information about the data stream to break the chance boundary. The question quickly becomes, how do you test various sequences against one another for robustness? It seems to me that it has to be done statisticaly. One aspect of this is what I call the 'ghost' pattern. In short, in the process of analyzing some random data a pattern is found. Is it possible that there could be more than one pattern (ie interpretation) of the data? Is it possible for a data stream to contain two (or more) messages coherently? If a message does contain two or more coherent messages, how does this affect the size of the data? Can this occur only on messages above a certain size?

1 0

vogon punk haiku
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

looking down his nose, Senator Exon banned it Haiku's not a crime Rights groups lobbying politicians waffl"ing Cypherpunks write code At First Virtual tense hot alien in barn encrypts no message Later releases in some communications there are signatures digicash tokens no one knows what you're buying follow the money Senator Exon! Imminent Death of the Net! GIFs at eleven! what they cannot read they don't want to let you say you must encrypt it Crypto power tools cannot be exported yet? how can they stop them? Freeh is watching you Big Brother is watching you NSA listens #ifdef crypto you cannot export this code #endif crypto if code is outlawed bhgynjf jvyy unir cevinpl talking to their friends Beating a dead horse idle thoughts typed on a train need more ideas Senator Exon And the horse he rode in on ******* indecent #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

The Law Loft: Surviving the Biometric I.D. Card
by tcmay＠got.net 17 Dec '03

17 Dec '03

Though some will petulantly claim that this has "nothing to do with crypto," I think the report on legislation which may lead to new levels of national identification is very apropos to the themes of this list. A national ID card could be tied in to the CDA and other such legislation: the "Internet Driver's License" we are worried about. This would also facilitate the criminalization of anonymous remailers. (I noticed at a local night spot large posters announcing the city's "Zero Tolerance" policy for passing a drink to a minor. Imagine the same folks passing laws about the criminalization of giving access to a minor....) Here's the forwarded article: > Path: we.got.net!news.oz.net!newshub.internex.net!news.Stanford.EDU!agate!overload.lbl.gov!news.kreonet.re.kr!news.dacom.co.kr!nntp.coast.net!news.kei.com!news.texas.net!usenet > From: klynch(a)intrepid.net > Newsgroups: misc.survivalism > Subject: The Law Loft: Surviving the Biometric I.D. Card > Date: Thu, 21 Mar 1996 09:34:25 GMT > Organization: Texas Networking, Inc. > Lines: 148 > Message-ID: <4ir7hj$391(a)nntp.texas.net> > NNTP-Posting-Host: klynch.intrepid.net > X-Newsreader: Forte Free Agent 1.0.82 > > -------------------------------- > Here is the latest Alert from The Law Loft. Sorry its > late. > > If you are benifitting by this information, please don't just > keep it to yourself - share it with someone immediately. And > perhaps you can Fax Suzanne and Pete a thank you and ask > them what you can do to help. > > This work is pretty lonely and grinding. And oh so few ever thank > you for it. Of course that's not why their doing it. > > Many of you could do the same thing I'm doing. You can listen to > 7.435 MHz at 8:00 pm EST and take notes from The Law Loft. You > can FAX them a request to send you information. You can then pass > it on to others. > > When you don't see anything from me out here, you can pitch in and do > it. This is late, because I had no other choice but to catch an early > train. > > Throw away the "boob" tube and stop wasting your precious little time > that we have left to learn and work together. Invest in a good > Short-Wave radio with a built in tape machine. I use the Radio Shack > DX-392 portable receiver. NO LICENSE REQUIRED TO LISTEN. > > Check out other fine alternative news programs on 5.065 between 6:00 > pm EST and 12:00 midnight week nights. > > Please help us - do your little part. > > For Freedom, > Kerry > http://www.intrepid.net/~klynch/uslaws.html > --------------------------------------------- > H.R. 2202 Immigration Bill > > Special Alert II > > March 19, 1996 [Please note this date when reading - Kerry] * * * * * > * * * > > H. RES. 384 bringing H.R. 2202 and 17 proposed amendments to the floor > passed today in the House. Debate on the bill and amendments > continues tomorrow. Vote on amendment number 4 is expected tomorrow: > > The picture in the House of Representatives grows darker. H.R. 384 > bringing H.R. 2202, the Immigration bill, to the floor for a vote > along with 17 proposed amendments passed easily by wide majority in > today's session. > > Work on amendments including Congressman McCullum's amendment no. 4 > will start up again tomorrow. We estimate that the vote on amendment > number 4 will occur about 3:00 pm EST. > > Both the House and Senate bills are intended to bring us some form of > universal biometric identifier i.d. card either in the form of a new > social security card or a passport linked to biometric identifier > birth certificates and drivers' licenses: > > The House bill, H.R. 2202, if passed will bring in the biometric > identifier slowly with greater subtlty than the Senate version. The > biometric identifier is clearly in the picture here. Here's why: > > 1) The report of the U.S. Commission on Immigration entitled U.S. > Immigration Policy: Restoring Credibility talks openly about the use > of biometric identifiers for driver's licenses on page 65. Key > language throughout the report dealing with fraudulent use of > identifying documents also leads to only one place - introduction of > the biometric identifier form of identification. > > 2) The NarcOfficer, official publication of international narcotics > enforcement officer association in its September/October 1995 issues > states point blank that a universal biometric identifier system is > intended for use by everyone on the planet. > > 3) The Senate bill formerly S. (unumbered) now split into S. 269 and > S. 1361 in sections 111-116 talks about birth certificates with > fingerprint or other biometric data'. The same section talks about > new driver's licenses with fingerprint or other item of biometric > data'. > > 4) The Hoke Amendment to H.R. 2202 added by the House Judiciary > Committee talks about a demonstration pilot project with a reliable, > easy to use, confirmation mechanism'. > > > 5) The McCullum amendment, no.4 on the calendar of amendments to H.R. > 2202 talks about creating an official document that offers the best > possible security against counterfeiting, forgery, alteration, and > misuse'. And provides for creating a new social security card that > would be as secure against fraudulent use as United States passport'. > Part of the catch here is which version of the passport? The Senate > bill provides for the creation of anew fraud resistant passport. > > The McCullum amendment would make the new technology binding on all > social security cards issued after January 1, 1999. Beginning on > January 1, 2006, all employers would be required to verify employment > eligibility with the new social security card. > > Any way you cut it, this is too much authority to invest in any > government! > > Our founding fathers knew that only way to be free and remain free is > to constrain the power of the government. As John Dickinson said in > 1768 in Letters from a Farmer in Pennsylvania: "For who are a free > people? Not those, over whom government is reasonably and equitably > exercised, but those, who live under a government so constitutionally > checked and controlled that proper provision is made against it being > otherwise exercised". > > Creation of a mandatory, universal biometric identifier identification > system lets the genie out of the bottle. It would gut the 4th > Amendment's right of provacy and let the government surveil and > control us instead of vice versa. > > What to do now: > > We need at least 100,000 phone calls and faxes in Washington by > tomorrow. We may not win in the House but we have to try. Remember > if we build up steam now in the House our chances will be better later > in the Senate. > > Contact your congressman tonight by fax (best) or tomorroww by phone > (good). Argue with him, politely. He might think that just because > amendment 4 says it won't be used as a universal identifier, that > amendment 4 and the bill are okay. Remind him what happened to the > social security card. It was supposed to be voluntary too in the > beginning. > > As time permits, contact as many congressmen as you can in California, > New Mexico, Arizona, Florida, and Illinois. These congressmen are > going to be under especially heavy pressure to pass the bill no matter > what it says. You can use the toll-free numbers for your call: (800) > 962-3524, (800) 972-3524, or (800) 872-8513. > > Tell them we want to keep the 4th Amendment to the Constitution and > the only way to do that is to kill the 4th amendment to the bill. > Tell them that we are not at all amused by the hidden joke of using an > amendment 4 to kill the 4th Amendment to our Constitution. No, no, no > to any version of the biometric identifier! Vote no to H.R. 2202! > > Suzanne Harris > The Law Loft > Los Angelos, CA > (818)-305-7613 > 7.435 MHz (Short-Wave) 8:00 pm EST Week nights.

2 1

Sun patch pulled (was Re: HP & Export of DCE)
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

I noticed that Sun's latest libc patch (101759-04) is empty. Previous versions contained the complete U.S. version of libc, including the tres-dangerous DES and crypt functions. In the current rev only the README remains, presumably because: EXPORT INFORMATION: This patch includes code which performs cryptographic functions, which are subject to U.S. export control, and must not be exported outside the U.S. without prior approval of the U.S. government. Prior export approval must be obtained by the user of this patch. So, you might ask, what fixes is Sun not distributing??? (Rev 04) 1190985 gethostbyname() can trash an existing open file descriptor. 1182835 portmapper silently fails with version mismatch by PC-NFS client 1219835 Syslog(3) can be abused to gain root access on 4.X systems. Yup, that's right. The syslog hole that was so well publicized by CERT will remain open indefinitely because the ITAR makes it illegal for Sun to distribute the fix! So did HP and Sun spontaneously, simultaneously develop crypto awareness, or is some gummint dweeb whispering threats in their ear?

3 2

CJR for perl-RSA t-shirt
by Raph Levien 17 Dec '03

17 Dec '03

Here is a draft of the CJR I intend to file, for the perl-RSA t-shirt. Please check it over for technical inaccuracies or other problems. It should sound quite familiar, as I have shamelessly ripped off the CJR that Phil Karn filed for the Applied Cryptography book. Let me know what you think! Raph ======================================================================= ATTN: Maj Gary Oncale - 15 Day CJ Request U.S. Department of State Office of Defense Trade Controls PM/DTC SA-6 Room 200 1701 N. Fort Myer Drive Arlington, VA 22209-3113 Fax +1 703 875 5845 ATTN: 15 Day CJ Request Coordinator National Security Agency P.O. Box 246 Annapolis Junction, MD 20701 Subject: Mass Market Software with Encryption - 15 Day Expedited Review Requested Subject: Commodity Jurisdiction Request for perl-RSA t-shirt, an encryption program INTRODUCTION This is a Commodity Jurisdiction Request for mass market software with encryption capabilities. The name of the software product is "perl-RSA t-shirt", by Adam Back. It is published in the form of a t-shirt by Joel Furr, 916 W. Trinity Ave, #10, Durham NC 27701. I have no DTC registration code. I have reviewed and determined that this t-shirt, the subject of this CJ request, meets paragraph 1 of the "Criteria for Determining the Eligibility of A Mass Market Software Product for Expedited Handling." I base this determination on the following facts: a) this t-shirt is readily available from Joel Furr, and has been shipped in quantity of several hundred copies, thus qualifying it as mass market software; b) sufficient documentation is included to allow installation and use by any end user capable of typing in the software, or scanning the bar code, and running it. Additional documentation is available on the Internet World Wide Web at http://dcs.ex.ac.uk/~aba/rsa/ . To my knowledge the author and publisher provide no "product support" as that term is generally understood; and c) the t-shirt contains encryption software source code listings that provide confidentiality. A duplicate copy of this CJR has been sent to the 15 Day CJ Request Coordinator. DESCRIPTION The t-shirt contains an implementation of the RSA asymmetric cryptographic algorithms. Furthermore, instructions, in the form of a terse usage string, are given for using the implementation to provide confidentiality. The source code of the implementation is featured both as four lines of text and also as a bar code, making the t-shirt machine readable as well as machine washable. The algorithm is implemented in the Perl scripting language, and will run on any standard Unix configuration that includes both an implementation of the Perl language and the common "dc" (desk calculator) program. Two copies of the shirt are included with the filing of this CJ request. ORIGIN OF COMMODITY This t-shirt originates in the United States. While the primary author is a citizen of the United Kingdom, living in England, other contributors to the work are citizens of the US living in the US. The publisher is a United States citizen living in the United States. The t-shirts are manufactured and printed in the United States. The cryptographic algorithm implemented in this t-shirt comes from various sources, at various times, and was produced with both private and public sources of funding. The source code implementation contained in the t-shirt also comes from a variety of countries, including Australia, Canada, the United States and the United Kingdom. The algorithm is thought to be designed for private and commercial civilian use. The t-shirt is currently publicly available from Joel Furr, at a list price of $12.36, including shipping and handling. More ordering information is available on the Internet World Wide Web at http://www.danger.com/ad-perl.html . CURRENT USE The t-shirt is intended as an implementation of the RSA cipher for those who wish to incorporate encryption into their communications. The small size of the implementation makes it particularly useful in contexts in which existing cryptographic infrastructure is not available. Examples of the commercial use of the cipher implemented include integrity verification, authentication and confidentiality of electronic mail, computer software, voice, video and other information in digitized form. For example, the cipher is used either by itself for email privacy, and also as a component in other protocols that provide privacy and authentication, including PGP (Pretty Good Privacy), S/MIME (Secure Multipurpose Internet Mail Extensions), MOSS (MIME Object Security Services), PEM (Privacy Enhanced Mail), and SSL (Secure Sockets Layer). The uses of this cipher have not changed significantly over time, although their popularity has grown substantially. Their present military utility is unknown, except that it is believed that the algorithm is not approved for the protection of US classified information. SPECIAL CHARACTERISTICS There are no military standards or specifications that this t-shirt is designed to meet. There are no special characteristics of the t-shirt, including no radiation-hardening, no ballistic protection, no hard points (the t-shirt is only available in soft 100% cotton), no TEMPEST capability, no thermal and no infrared signature reduction capability (in excess of that provided by a typical black cotton t-shirt), no surveillance, and no intelligence gathering capability. The t-shirt does not use image intensification tubes. OTHER INFORMATION I recommend that this t-shirt be determined to be in the jurisdiction of the Commerce Department. I believe that it qualifies for the general license GTDA for General Technical Data to All Destinations, because it qualifies as "publicly available". ATTACHMENTS I have enclosed two copies of the t-shirt, included with the primary filing of this CJ request. Sincerely, Raphael L. Levien

4 5

Re: Yeo, Pea-brained Imbecile
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"peponmc(a)fe3.rust.net" "Michael Peponis" 19-MAR-1996 10:17:59.06 >Given the plethera of reports like this, I will start maintaining a list of >country that will not be given access to my site, no FTP, no HTTP, no nothing, >on top of that, I will hard code into all the new versions of my network aware >programs to check for a domain subfix, if it is on of the black list, the >software will not function. I would suggest making an exception for material that the country in question _doesn't_ want available... you don't want to do their work for them. Of course, if that it's from a .gov-type site in that country (kind of hard to tell without the domain, but...), that's another story. >Filtering works both ways, they filter out the political and sex groups on >their end, we filter out the technical information on ours, I hope they enjoy >what is left, which is not much. This brings up the related topic of filtering mail lists the other way around. There have been times that I've wanted to email everyone on a mailing list _except_ one or two people. It's massively inconvenient to try to do this without automated software, for a large mailing list. Therefore, I'd be interested in majordomo/listserv/whatever modifications that would enable doing so. Of course, for anything significant having seperately encrypted messages to each person (as per that thread a bit back on encrypted mailing lists) would be necessary. -Allen

1 0

Re: So, what crypto legislation (if any) is necessary? (Was List O' , shame)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:32 PM 3/25/96 -0500, Black Unicorn wrote: >All it would take is one anti-trust case with encryption as a concealing >method and people would be busting down doors at night looking for PGP. Back in the dark ages, IBM built an audio messaging system. It was quite popular in "cave of the winds" (IBM headquarters) because it allowed busy executives to leave audio memos for each other without needing a secretary to type them. Since storage was limited, and old messages were purged from the system it also had the effect that anti-trust discovery would have nothing to discover. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

2 1

Re: About Triple DES ......
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:24 PM 3/26/96 -0600, you wrote: > Please let me know if TRIPLE DES is regulated by the same rules than >the others criptography systems in USA. > We want to use it here in National Autonomous University of Mexico, so >we don't want to get jailed. I don't know about Mexican law. US persons are not supposed to export it without government permission, but that's not very relevant. Mexican law may or may not restrict import or use of crypto; better check with someone local. (I haven't heard anything saying that it _does_ restrict it - I just don't know either way.) > In case we can use it somebody knows where can i get the source code ?? That part's easy - DES source is available on ftp.ox.ac.uk, and also on ftp.dsi.unimi.it and ftp.funet.fi. There may be specific triple-DES code there, but if not, triple DES is just Encrypt(Key1, Decrypt(Key2, Encrypt(Key3, Message))) so you can easily write a subroutine to do that. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 1995: Chat rooms, espresso, and Linux 1996: Exon, melatonin, and Java.

2 1