- cypherpunks-legacy - lists.cpunks.org

Re: Letter of the law
by rdew＠el.nec.com 17 Dec '03

17 Dec '03

Ken, I guess I was thinking about the NSA, recording the message and deciding to make an example. They seem to do that occassionally just to keep the rest of us folks 'in line'. I can't see the INS even understanding what they were looking at, even if you showed them. "My, my, my! All those bits are really in that little box?" You have to understand the difference between a 'large possibility' and a 'fat chance', yes? Now, drugs! That they understand ... But a PKI key? Or, a file?? Or, a crypto program (especially renamed)??? What piece of this trick question am I missing? Bob De Witt, rdew(a)el.nec.com The views expressed herein are my own, and are not attributable to any other source, be it employer, friend or foe. > From jkwilli2(a)unity.ncsu.edu Tue Feb 17 10:56:22 1998 > X-Authentication-Warning: c00954-100lez.eos.ncsu.edu: jkwilli2 owned process doing -bs > Date: Tue, 17 Feb 1998 13:56:29 -0500 (EST) > From: Ken Williams <jkwilli2(a)unity.ncsu.edu> > X-Sender: jkwilli2(a)c00954-100lez.eos.ncsu.edu > To: Bob De Witt <rdew(a)el.nec.com> > cc: cypherpunks(a)toad.com > Subject: Re: Letter of the law > X-Copyright: The contents of this message may not be reproduced in any form > X-Copyright: (including Commercial use) unless specific permission is granted > X-Copyright: by the author of the message. All requests must be in writing. > X-Disclaimer: The contents of this email are for educational purposes only > X-Disclaimer: and do not reflect the thoughts or opinions of either myself > X-Disclaimer: or my employer and are not endorsed by sponsored by or provided > X-Disclaimer: on behalf of North Carolina State University. > MIME-Version: 1.0 > > On Tue, 17 Feb 1998, Bob De Witt wrote: > > >Doesn't the act of taking it across the border, in the laptop, constitute > >an act of export?? > > well, yes, of course. that was taken for granted in my comments. > likewise, if you go to a tattoo parlor and get the infamous 4 line > crypto-sig tattooed on your ass, then you are classified as a munition, > and you cannot leave the US. > > the only relevant question here regards the odds that a US Customs officer > is going to want you to drop your drawers and bend over... > ;-) > > ken > > >> >>I'm in El Paso Texas... so close to the border > >> >>I can see Old Mex outside my window as I write this.. > >> >>I'm over there nearly every day for lunch ( I actually > >> >>walk there from my house it's so close) If I write > >> >>a crypto program on my laptop over there and ftp > >> >>it to a web page I have on a server outside the US > >> >>will I have avoided the foolish export regs?? > >> >>Does anyone know of someone trying this before?? > >> > > >> >My guess is this: > >> > if it has the name of a US citizen in the copyright > >> >notice, it will be assumed to have been made in the > >> >US. if the morons even go after you. you still may have > >> >a plausable excuse if ever taken to court. > >> >after all, you "exported" youself, which is a perfectly > >> >legal thing to take out of the country, and "yourself" > >> >accidentally spewed a copy of something that couldn't > >> >cross the border. > >> >I don't think anybody has tried this and been challenged. > >> >then again, a lot of us don't have the opportunity. > >> >It's easier to ask forgivness than permission... > >> >Another easier excuse would be to publish it freely in > >> >hardcopy form, and just "happen" to have somebody end up > >> >"typing" in your source code abroad, making a legit > >> >international copy... > >> >-Anon2 > >> > >> i would think that the big question here, legally, is whether or not you > >> would be ustilizing a US ISP and/or cellular provider to make the upload > >> of the crypto program to the foreign server via ftp. as long as all the > >> packets stay outside of US borders, in other words, as long as you don't > >> use a US ISP and cellular provider, then i don't see how you would be > >> violating any laws in this case. > >> > >> Regards, > >> > >> TATTOOMAN > >> > >> http://152.7.11.38/~tattooman/ > >> > >Bob De Witt, > >rdew(a)el.nec.com > >The views expressed herein are my own, > >and are not attributable to any other > >source, be it employer, friend or foe. > > > > > > TATTOOMAN > > /--------------------------[ TATTOOMAN ]--------------------------\ > | ORG: NC State Computer Science Dept VP of The E. H. A. P. Corp. | > | EML: jkwilli2(a)adm.csc.ncsu.edu ehap(a)hackers.com | > | EML: jkwilli2(a)unity.ncsu.edu ehap-secure(a)hackers.com | > | WWW: http://www4.ncsu.edu/~jkwilli2/ http://www.hackers.com/ehap/ | > | FTP: ftp://152.7.11.38/pub/personal/tattooman/ | > | W3B: http://152.7.11.38/~tattooman/w3board/ | > | PGP: finger tattooman(a)152.7.11.38 | > \----------------[ http://152.7.11.38/~tattooman/ ]----------------/ > > >

2 1

Re: Downsizing the NSA
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Sun, 28 Jan 1996 02:04:52 -0800, Tim wrote: [..] >However, as Phill notes, the NSA and other intelligence agencies are now in >that most dangerous of positions: a powerful agency or department casting >about for something to do. >Spying on citizens and keeping the keys to their private communications and >diaries is not an appropriate option. >AT&T is downsizing, IBM downsized a while back, so why couldn't the NSA >just do the right thing: admit that the Soviet threat is no more, >congratulate the victors, and downsize by 20,000 employees? Perhaps they are worried about the implications of putting thousands of cryptographers into the private sector? And what if you were one of them? You'd probably have a hard time using or publishing anything classified. Not to mention the usual governmental conflict-of-interest work rules (for low-level employees the standards of who you can work for after leaving the government is a lot stricter than if you were a cabinet member). Just a thought.

1 0

Slip over non-slip ports
by fc＠all.net 17 Dec '03

17 Dec '03

(please respond directly to fc(a)all.net and not to the list) I am looking for a way to run slip over a telnet connection on a local Ethernet. Does anyone know of any freely available software that allows me to start a SLIP connection over a telnet channel? -> See: Info-Sec Heaven at URL http://all.net/ Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Of course. My signature was bad. I got a message in response to a request I made to someone for their public key. I wanted to check the signatures that they included with their posts to cypherpunks, but their key was not on the keyservers. The key they included was completely unsigned, and when I use it to validate their previous posts as well as the message they sent which included the key, the signatures come back as bad, the contents of the file changed. Names are appropriately withheld (I hope). As I understand the bcc: definition, only I and the first smtp server this message hits should know who it's to. I don't know if anyone else reading this mailing list needs this info, but just in case... here's my reply to the message. At 10:03 PM 1/28/96 -0800, you wrote: >Sorry, I'm a newbie to Internet, and also the Internet usage of PGP. I just >participated in a local keysigning meeting, so maybe my key will find its >way to a server. Don't worry about being a 'newbie'. Everyone starts somewhere. However, your key will usually not 'find its way' to a server without you specifically sending it. The keyserver I usually use is accessed by sending a mail message which fits the following format. As far as I know, all the keyservers use this format to add or update keys in their databases. You only have to send it to one keyserver, and it will propagate to all the others. I have indented the text so that no handlers decide to interpret it as a new message. - - To: pgp-public-keys(a)pgp.iastate.edu - - Subject: ADD - - - - -----BEGIN PGP PUBLIC KEY BLOCK----- - - Version: 2.6.2 - - - - [key deleted to protect the innocent] - - - - -----END PGP PUBLIC KEY BLOCK----- >I'm sorry to have to admit that I don't even know how to do this! Newbie >alert! If you don't admit you don't know something, nobody will usually tell you how to do it. Also, you should sign your own key. That will make it harder to forge, I think. The reasons were spelled out in a couple of the web pages I read, but I've forgotten them. It has something to do with either a denial of service attack or a man in the middle attack, or both. The command to do this is: pgp -ks 0xHEXKEYID Honestly, I've only just begun to use pgp myself. Also, you should add your e-mail address to the user-id of your key. The command to do so is: pgp -ke 0xHEXKEYID You will be asked if you wish to add a user id to the key. Say yes, and give it your e-mail address. What this does is it allows people who are using pgp-enabled mailers to directly encrypt messages to you without choosing your key manually. The reason that I have not encrypted this message to you using the key you provided is that when I extracted the key and re-checked your message, the signature was no good. I've found that (using eudora) I must turn off the word wrap feature of my mailer to allow for good signed messages out. Of course, having said this, I'll probably not get a good signature on this message. Let me know if it signs ok. Now, I have a question. Which attack(s) is/are a person vulnerable to when distributing an unsigned public key in the open? Could this actually be a complex man-in-the-middle attack? Am I paranoid? -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQzROLTS4SjerN/RAQGLNwP8DMXP1BLdeygfEaBF//lYZHkxWGFaFx9L R59KJQ/VaYVU/Q17bFDhXyCztu2IRlzLhBqno+5uHsZTL01M3D1dyXGDBvlxY+FB kNaClKzeXYqA3Or7Ny2mcgyZW/bGXA6v3Z+RQgDuVrXsJz5wGP/UxBU3Ppr05+qL i+5KB2efLxA= =iXlS -----END PGP SIGNATURE-----

1 0

The Politics of Mistrust 2
by John Young 17 Dec '03

17 Dec '03

Thanks to Replay, The Washington Post series on "The Politics of Mistrust" simmers at: http://www.replay.com/young/ Today's second article of six is, "Who's in Control? Many Don't Know or Care." Politics is "a waste of my time. They're cutting each other down, just playing childish games. It's confusing nonsense, like two little kids on a schoolyard," says Temera Porter, a computer chip inspector in Beaverton, Oregon. "When I voted last I wrote in that George Carlin should be president, I really did." A sidekick report tells of Rush's 20m dittoheads' wishes to rid DC of George Carlin's Who's, fuck, shit ...

1 0

Re: more RANTING about NSA-friendly cpunks
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 07:58 PM 1/29/96 +0800, Bruce Murphy wrote: >In message <199601282104.NAA10926(a)netcom3.netcom.com>, > "Vladimir Z. Nuri" wrote: >> >> >In message <199601262011.MAA17408(a)netcom16.netcom.com>, >> > "Vladimir Z. Nuri" wrote: >> >> >> >> has anyone *tried* just ignoring the ITAR wrt crypto and seeing what >> >> would happen? the gubbermint blindly thinks that cyberspace will >> >> inevitably bring the wrath of four horsemen of the infocalypse, but aren't >{snip} >> > >> >Zimmerman. >> >{snip} >> Zimmermann supports my contention, as I wrote in the post. NOTHING >> happened to him. it is conceivable this same result could have >> been arrived at (government drops investigation) if he never even >> hired a lawyer. >> >> Zimmermann is a perfect example of what may be counterproductive >> hysteria on *our* side, toward advancing crypto. if Zimmermann >> cannot be prosecuted, and is not prosecuted, where are the ITAR "teeth"??? >> > >Nod. You may have a point there... > >I'll tell you what, seeing as I *can't* export cryptostuff against >ITAR, what say *you* do it. Lots of it. And if nothing happens to you, >well and good. >OTOH the cause needs a few martyrs. >Packrat (BSc/BE;COSO;Wombat Admin) Packrat, I agree with the (likely) implications of your (tongue-in-cheek?) commentary. The fact that "nothing happened to Zimmermann" is scant hope to us. If ITAR is causing cryptosystems to not be built, merely due to FUD (fear, uncertainty, and doubt) then it is actively harming us. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQz8y/qHVDBboB2dAQGmRwP/YJPpzwQ4pZU3QZcSNNzKSz2kOEml1a9x nV8wWDj019NLrPE0u1sKhsSkDu8QYeaAtSr3NnSMTK+DlLkuV7SKyXg6k/Pk3uWL xqEmWNCM8+rTXyP2FuflD3w+HCe0oCRt2AzmclzUwlalTP2gY2bfKeAAawCdubST FKZFFdlWNG0= =Is7T -----END PGP SIGNATURE-----

2 1

Re: Over-reacting?
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:22 PM 1/28/96 -0800, Alan Olsen wrote: >The reason for the killfiling is your habit of adding multiple additional >mailing list into the To: and cc: list. I have seen more than one post >where you have added a Libritarian list and the "Democracy Now Channel 2' >list into the fray, not to mention other individuals. THAT is why you are >getting the golden killfile, not your association with Jack "Acid" Hammer. >(Though that may help...) Hmmm.. It's odd that nobody has ever warned me of this before. (Another spoof?) That's why I'm using the term, "over-reacting." -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQyDUvqHVDBboB2dAQFduAQAlas9DMaiatiYd51WKepEzLGPBWl4I9+2 FNOUzoQoy3OQ+wdk7lT1FFqvrDqSqviIj8MZ6j7/7ENO55W6D8AiN2fFXBbd3iY5 7krA13rTlx6N8ztvqE2+QY0/0RMtHZV6mLOR0SdbedOahUMc6/8qxF1auvJTxtJq 5qU3zS+71IQ= =9edM -----END PGP SIGNATURE-----

1 0

Re: The French do some things right...
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:01 PM 1/26/96 -0800, Timothy C. May wrote: >One thing I have been hoping for as America's scandal-fixated society asks >whether Bill inhaled, whether Rush has a mistress, whether Madonna's >grandmother is really shacked up with a 19-year-old musician...one thing I >have been hoping for is that the American public will say "Enough!" This is one I've never worried about. As I look around at work and see the disorderd personal lives and body piercings of my fellow workers, it is obvious that the amount of that sort of social control that is being applied is way down. And since fewer and fewer of us will have to (be able to) work for large soulless bureacracies as these things are ruthlessly downsized by the market, we will have much greater choice of employers. One would have to be really way out on one of the unfortunate tails of a bell curve distribution to be unable to find someone to work with. DCF

1 0

The Lotus Position
by Timothy C. May 17 Dec '03

17 Dec '03

At 4:03 AM 1/20/96, Bill Stewart wrote: >40-unknown-bit RC4 may take a week for an ICE workstation or a herd of >net-coordinated workstations, but it would be much faster to crack on >a specialized machine actually designed for RC4. I think Eric's estimate >was $25-50K for a machine that could do it in 15 minutes, built out of >programmable gate arrays. That's not $10,000/crack, or $584, but $0.25-.50. >Would they crack all the keys they wanted for a quarter each? Sure; >at that rate it's probably cheaper to crack them than read them >(though in reality they'd feed most of them to keyword scanners.) I take it as self-evidently true that NSA would spend the relatively small amount of money to build a dedicated key cracker...probably at least several for each major cipher. "In this room, where we used to have the famed acre of Crays, now we have tenth of an acre of superfast custom key crackers." (Yes, I know the Crays are used for other things besides key cracking. In fact, their main use probably is not for crypanalysis. Also, I'm not talking about cracking ciphers that are essentially uncrackable with any amount of compute power, I'm talking about cracking specific instances of ciphers with NSA-approved key lengths.) To consider just how _cheap_ such a dedicated machine is to them, consider that in the late 50s and early 60s they built the "Harvest" machine, in conjunction with IBM and based to some extent on IBM's "Stretch" machine, as I recall. (Bamford has a bunch of stuff on it, and our own Norm Hardy worked on it for IBM in the early 60s...he gave a good talk at a Cypherpunks meeting on how big it was, how much it cost, its capabilities, etc.) The Harvest machine, and its ancillary units, such as the world's largest and fastest tractor tape drive, cost something like $100 million in today's dollars, according to Norm and others. And Harvest was still running in 1975-6, when it was finally replaced by the Cray 1. NSA also funded the early efforts that later became Control Data Corporation (CDC), and NSA was a major customer of Seymour Cray's CDC 6600, and the later 7600 (and maybe even the ill-fated Star). NSA and AEC were also the early customers for the Cray-1, of course. This gives you some feel for what kind of expenditures "the Fort" is prepared to make when it sees the need. And the black budgets of other intelligence agencies, as described in Richelson's excellent books and other books (such as "Deep Black," an unauthorized history of the National Reconnaissance Organization), can only be described as "stupefyingly large." A surveillance satellite can run upwards of $1.5 billion, so spending a tiny fraction of that to decrypt what you've sniffed out of the airwaves is a gimme. The deep black budget is estimated to be something like $25 billion a year. Recall that the Wiretap Bill _alone_ provided for up to $500 million for compliance measures. Clearly the FBI somehow view their surveillance capabilities as being worth at least this much to them, and probably a lot more. Throw in the budgets for the DEA, IRS, FinCen, FBI, BATF, and all the other agencies fighting the Four Horsemen and the citizen-units who stray outside the drawn lines, and it's clear that NSA could budget several hundred million dollars *each and every year* for breaking its "approved ciphers." Like many, I take it for granted that 40-bit RC4 can be broken for "small change." Moreover, my guess is that foreign traffic is routinely cracked if it is encrypted. After all, it's the encrypted traffic that is likeliest to be interesting. (Sure, some dumbos like Pablo Escobar speak in the clear on cellphones, but the correlation is definitely in the direction of encrypted traffic being likelier than unencrypted traffic to contain interesting stuff. This will become even more the case as more people become educated and as crypto gets built into more things...this is the intelligence and law enforcement communities' worse nightmare.) A $25,000 machine. 4 cracks per hour, 100 per day, and 36,000 per year. Running for an active life of several years (before being replaced, of course, by something several times faster/cheaper), there you have the $0.25 per crack that Bill cites above. Even at 100 times this estimate, it's cheap. (Not for random vacuuming, but for anything targetted, even casually.) And think of what just a few percent of the "Harvest" budget buys you: 100 of these machines. Several million cracks per year. And from these cracks, think of the correlations, the contact lists, and the further targetting that can be done. [Sidebar: One thing that bothers me about any of these LEAF-related schemes--and I don't know if and how the Lotus scheme checks both ends for compliance, etc.--is that they are fundamentally at odds with remailers which hide the origin. If remailers are allowed to continue to exist, schemes involving LEAF fields won't work. Unless I've forgotten how these things work in the couple of years since I last looked at Clipper et. al. in depth. So, I expect a move against remailers as part of the campaign. And with no remailers, if this could ever be enforced, the ability to make contact lists based on random decryption is frightening.] Back to their 100 machines.... My guess is that they haven't even bothered to buy this many machines, that the intelligence they get from a few tens of thousands of cracks is more than enough to point to further leads, to trigger additional HUMINT, etc. But even if the estimates are off by orders of magnitude, we know that a 40-bit RC4 can be cracked in ~hours with ~hundreds of Sun-class machines. (Personally, I think it obvious the NSA has at least speeded up this work factor by at least a factor of ten.) This is also essentially a minor consideration compared to the amount of work done in ordinary wiretaps. And in a few years, 40-bit RC4 will be even more ludicrously weak. The Lotus position is untenable. --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Internet Casino Lottery - Enter at No Cost
by casinofun＠who.net 17 Dec '03

17 Dec '03

Enter at No Cost! The time has come to enjoy casino games from the comfort of your home. Find out where to play all of your favorite casino games online securely. Blackjack, Craps, Slot Machines, Roulette, Baccarat, Bingo & Much More! The best odds. Huge pay-outs. Top-Rated Customer Service. For more information, reply below IMMEDIATELY and you will be GUARANTEED TO RECEIVE between $25.00 and $10,000.00. What better way to visit the best Casino's on the Internet? Use their dollars and enjoy the best online Casino's the world has to offer. If you enjoy Casino gaming then this is for you. You need to reply today for more information and guaranteed acceptance. You must respond NOW at OffshoreCasinoLottery(a)bigfoot.com and type "SHOW ME THE MONEY" in the Subject line of the message.

1 0