- cypherpunks-legacy - lists.cpunks.org

Re: Effects of S.314 (Communications Decency Act)
by Michael Sattler 17 Dec '03

17 Dec '03

>Can anyone confirm this S.314 thing? It sounds an awful lot like >the "modem tax" and other urban legends. S 314 IS 104th CONGRESS 1st Session To protect the public from the misuse of the telecommunications network and telecommunications devices and facilities. IN THE SENATE OF THE UNITED STATES February 1 (legislative day, January 30), 1995 Mr. Exon (for himself and Mr. Gorton) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To protect the public from the misuse of the telecommunications network and telecommunications devices and facilities. Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled, SECTION 1. SHORT TITLE. This Act may be cited as the `Communications Decency Act of 1995'. SEC. 2. OBSCENE OR HARASSING USE OF TELECOMMUNICATIONS FACILITIES UNDER THE COMMUNICATIONS ACT OF 1934. (a) Offenses: Section 223 of the Communications Act of 1934 (47 U.S.C. 223) is amended-- (1) in subsection (a)(1)-- (A) by striking out `telephone' in the matter above subparagraph (A) and inserting `telecommunications device'; (B) by striking out `makes any comment, request, suggestion, or proposal' in subparagraph (A) and inserting `makes, transmits, or otherwise makes available any comment, request, suggestion, proposal, image, or other communication'; (C) by striking out subparagraph (B) and inserting the following: `(B) makes a telephone call or utilizes a telecommunications device, whether or not conversation or communications ensues, without disclosing his identity and with intent to annoy, abuse, threaten, or harass any person at the called number or who receives the communication;' and (D) by striking out subparagraph (D) and inserting the following: `(D) makes repeated telephone calls or repeatedly initiates communication with a telecommunications device, during which conversation or communication ensues, solely to harass any person at the called number or who receives the communication; or'; (2) in subsection (a)(2), by striking `telephone facility' and inserting `telecommunications facility'; (3) in subsection (b)(1)-- (A) in subparagraph (A)-- (i) by striking `telephone' and inserting `telecommunications device'; and (ii) inserting `or initiated the communication' and `placed the call', and (B) in subparagraph (B), by striking `telephone facility' and inserting `telecommunications facility'; and (4) in subsection (b)(2)-- (A) in subparagraph (A)-- (i) by striking `by means of telephone, makes' and inserting `by means of telephone or telecommunications device, makes, knowingly transmits, or knowingly makes available'; and (ii) by inserting `or initiated the communication' after `placed the call'; and (B) in subparagraph (B), by striking `telephone facility' and inserting in lieu thereof `telecommunications facility'. (b) Penalties: Section 223 of such Act (47 U.S.C. 223) is amended-- (1) by striking out `$50,000' each place it appears and inserting `$100,000'; and (2) by striking `six months' each place it appears and inserting `2 years'. (c) Prohibition on Provision of Access: Subsection (c)(1) of such section (47 U.S.C. 223(c)) is amended by striking `telephone' and inserting `telecommunications device.' (d) Conforming Amendment: The section heading for such section is amended to read as follows: `obscene or harassing utilization of telecommunications devices and facilities in the district of columbia or in interstate or foreign communications'. SEC. 3. OBSCENE PROGRAMMING ON CABLE TELEVISION. Section 639 of the Communications Act of 1934 (47 U.S.C. 559) is amended by striking `$10,000' and inserting `$100,000'. SEC. 4. BROADCASTING OBSCENE LANGUAGE ON RADIO. Section 1464 of title 18, United States Code, is amended by striking out `$10,000' and inserting `$100,000'. SEC. 5. INTERCEPTION AND DISCLOSURE OF ELECTRONIC COMMUNICATIONS. Section 2511 of title 18, United States Code, is amended-- (1) in paragraph (1)-- (A) by striking `wire, oral, or electronic communication' each place it appears and inserting `wire, oral, electronic, or digital communication', and (B) in the matter designated as `(b)', by striking `oral communication' in the matter above clause (i) and inserting `communication'; and (2) in paragraph (2)(a), by striking `wire or electronic communication service' each place it appears (other than in the second sentence) and inserting `wire, electronic, or digital communication service'. SEC. 6. ADDITIONAL PROHIBITION ON BILLING FOR TOLL-FREE TELEPHONE CALLS. Section 228(c)(6) of the Communications Act of 1934 (47 U.S.C. 228(c)(6)) is amended-- (1) by striking `or' at the end of subparagraph (C); (2) by striking the period at the end of subparagraph (D) and inserting a semicolon and `or'; and (3) by adding at the end thereof the following: `(E) the calling party being assessed, by virtue of being asked to connect or otherwise transfer to a pay-per-call service, a charge for the call.'. SEC. 7. SCRAMBLING OF CABLE CHANNELS FOR NONSUBSCRIBERS. Part IV of title VI of the Communications Act of 1934 (47 U.S.C. 551 et seq.) is amended by adding at the end the following: `SEC. 640. SCRAMBLING OF CABLE CHANNELS FOR NONSUBSCRIBERS. `(a) Requirement: In providing video programming unsuitable for children to any subscriber through a cable system, a cable operator shall fully scramble or otherwise fully block the video and audio portion of each channel carrying such programming so that one not a subscriber does not receive it. `(b) Definition: As used in this section, the term `scramble' means to rearrange the content of the signal of the programming so that the programming cannot be received by persons unauthorized to receive the programming.'. SEC. 8. CABLE OPERATOR REFUSAL TO CARRY CERTAIN PROGRAMS. (a) Public, Educational, and Governmental Channels: Section 611(e) of the Communications Act of 1934 (47 U.S.C. 531(e)) is amended by inserting before the period the following: `, except a cable operator may refuse to transmit any public access program or portion of a public access program which contains obscenity, indecency, or nudity'. (b) Cable Channels for Commercial Use: Section 612(c)(2) of the Communications Act of 1934 (47 U.S.C. 532(c)(2)) is amended by striking `an operator' and inserting `a cable operator may refuse to transmit any leased access program or portion of a leased access program which contains obscenity, indecency, or nudity. -----------------------------------------------------------------------+ Michael Sattler <msattler(a)jungle.com> San Francisco, California | Digital Jungle Consulting Services http://www.jungle.com/msattler/ | | You couldn't get a clue during the clue mating season in | a field full of horny clues if you smeared your body with clue musk | and did the clue mating dance. - Edward Flaherty |

7 13

Re: Effects of S.314 (Communications Decency Act)
by jpp＠markv.com 17 Dec '03

17 Dec '03

For my congresional 'representatives'. S.314 is not a moral bill. Making the owner of a computer (or computer network) responsible for what its users store (or transmit) is like making the owners of a parking lot responsible for what is stored in the cars parked there. It just isn't moraly reasonable. S.314 is un-American. America has always been a place where speach is freeest. We have consistently held the expression of ideas to be one of the very most important rights. To hold the owner of a buliten board responsible for the illegal messages posted to it, is to force the buliten board owner to become a government censor in all but name (and wages). It effectively ends the bulliten board's use as a venue of free speach. S.314 is harmfull to America. The kind of 'chilling effect' this bill wil place on the computer (networking) industry would put american companies at a serious disadvantage. Could I really operate an airline reservtion system for a large airline if I could be held liable for illegal information transmitted using my equipment? No. Could I operate the masive software and hardware networks that the phone system requires? No. But, I bet the company I own in Mexico, or in Canada could. They aren't burdened with such (artificially created) liabilities. Or perhaps I could get a special waiver from my friends in Washington. Hmmm. How much will these sorts of 'work arounds' cost american bussiness? S.314 is not enforceable. There is no certain way to tell if a file of data is an illegal one. Stegnography and cryptography, along with the fact that what a bit means depends on which programs are used to interpret it, mean that even this message could be porno, terrorist threats, or arangements for drug trafficing. Imagin searching all the cars in your parking lot for drugs. Very expensive, and not very reliable. Tons of drugs travel past just such inspection sites each year. Now imagine how tough it would be if the drugs could be turned into perfectly normal steal in the body panels of the vehicles! That is what stegnography and cryptography do to data. Turn perfectly 'awfull' data into data perfectly indistinguishable from noise, and then hide the noise as indistinguishable-from-inocent 'errors' in other data. Concider the spelling in this message -- convert each word into a bit -- 1 if it is speled right, 0 if not. Or how about spacing, or, punctuation -- Hmmm. Now supose we add otras idiomas, aux eble muchos languages en cxiu mesagxon. Will computer (network) owners be responsible for the spelling, punctuation, language, word choice, and grammer of all the electronic mail sent, received, and stored? S.314 is bad for *your* career. If you vote to support it, I will vote against you in upcoming elections. I will work to impeach you. I will never employ you, I will not read your memoirs, I will not do business with you in any way what so ever. I urge you to think twice, and then vote no on S.314. j'

2 2

(fwd) Re: PGP Pass Phrase Security
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

I thought this FAQ from Grady Ward (sometimes on our list, sometimes not) might fit with the discussion of password and passphrase security. There's a lot of crunching needed to determine if a selected passphrase has enough entropy. (And to some extent, it is not computable to determine if a string has entropy L, as a sufficiently clever attacker may realize a seemingly complex string actually is much simpler, more predictable, lower entropy than other analyses might suggest.) As others have said, using these sources for passphrases is a Bad Idea: - phrases from popular songs (and several levels of permutations) - famous quotes (and permutations, e.g, "Four scored but seven didn't" is not a very good passphrase, in comparison with "Fully weaSSel lampshop 3856fq3") - lines from novels, television These all have much less entropy than the "shocking nonsense" that many recommend. Memorizing good passphrases is expected to be hard. Personal information leaks bits. Finding personal information that is meaningful to one, but has not been revealed to others (or included in databases) is tough. Anyway, here is Grady's FAQ on this: PASSPHRASE FAQ V. 1.0 1 November 1993 '"PGP," warns Dorothy Denning, a Georgetown University professor who has worked closely with the National Security Agency, "could potentially become a widespread problem.' -- (E. Dexheimer) Comments to: Grady Ward, grady(a)netcom.com Contributors: John Kelsey, c445585(a)mizzou1.missouri.edu (Appendix A.) RSA Data Security (Appendix C. The MD5 Algorithm) Jim Gillogly (Appendix D. The Secure Hash Algorithm) FAQ: How do I choose a good password or phrase? ANS: Shocking nonsense makes the most sense With the intrinsic strength of some of the modern encryption, authentication, and message digest algorithms such as RSA, MD5, SHS and IDEA the user password or phrase is becoming more and more the focus of vulnerability. For example, Deputy Ponder with the Los Angeles County Sheriff's Department admitted in early 1993 that both they and the FBI despaired of breaking the PGP 1.0 system except through a successful dictionary attack (trying many possible passwords or phrases from lists of probable choices and their variations) rather than "breaking" the underlying cryptographic algorithm mathematically. The fundamental reason why attacking or trying to guess the user's password or phrase will increasingly be the focus of cryptanalysis is that the user's choice of password may represent a much simpler cryptographic key than optimal for the encryption algorithm being used. This weakness of the user's password choice provides the potential cryptanalytic wedge. For example, suppose a user chooses the password 'david.' On the surface the entropy of this key (or the number of different equiprobable key states) appears to be five characters chosen from a set of twenty-six with replacements: 26^5 or 1.188 x 10^7. But since the user is apparently biased toward common given names, which a majority appear in lists numbering only 6,000-7,000 entries, the true entropy is undoubtedly much closer to 6.5 x 10^3, or about four orders of magnitude smaller than the raw length might suggest. (In fact this password probably possesses a much smaller entropy than even this for the very common name "david" would be one of the first names to be checked by an optimized dictionary attack program.) In other words the "entropy" of a keyspace is not a fixed physical quantity: the cryptanalyst can exploit whole cultural biases and contexts, not just byte frequencies, digraphs, or even whole-word correlations to reduce the key space he or she is trying to explore. To thwart this avenue of attack we would like to discover a method of selecting passwords or phrases that have at least as many bits of entropy (or "hard-to-guessness") as the entropy of the cryptographic key of the underlying algorithm being used. To compare, DES (Data Encryption Standard) is believed to have about 54-55 bits (~4 x 10 ^16) of entropy while the IDEA algorithm is believed to have about 128 bits (~3.5 x 10^38) of entropy. The closer the entropy of the user's password or phrase is to the intrinsic entropy of the cryptographic key of the underlying algorithm being used, the more likely an attacker would need to search a substantially larger portion of the algorithm's key space in order to rediscover the key. Unfortunately many documents suggest choosing passwords or phrases that are distinctly inferior to the latest method. For example, one white paper widely archived on the internet suggests selecting an original password by constructing an acronym from a popular song lyric or from a line of script from, for example, the SF movie "Star Wars". Both of these ideas turn out to be weak because both the entire script to Stars Wars and entire sets of song lyrics to thousands of popular songs are available on-line to everyone and, in some cases, are already embedded into "crack" dictionary attack programs (See ftp.uwp.edu) However, the conflict between choosing an easy-to-remember key and choosing a key with a high level of entropy is not a hopeless task if we exploit mnemonic devices that have been used for a long time outside the field of cryptography. With the goal of making up a passphrase not included in any existing corpus yet very easy to remember, an effective technique is one known as "shocking nonsense." "Shocking nonsense" means to make up a short phrase or sentence that is both nonsensical and shocking in the culture of the user, that is, it contains grossly obscene, racist, impossible or other extreme juxtaposition of ideas. This technique is permissable because the passphrase, by its nature, is never revealed to anyone with sensibilities to be offended. Shocking nonsense is unlikely to be duplicated anywhere because it does not describe a matter-of-fact that could be accidentally rediscovered by anyone else and the emotional evocation makes it difficult for the creator to forget. A mild example of such shocking nonsense might be: "mollusks peck my galloping genitals ." The reader can undoubtedly make up many far more shocking or entertaining examples for himself or herself. Even relatively short phrases offer acceptable entropy because the far larger "alphabet" pool of word symbols that may be chosen than the 26 characters that form the Roman alphabet. Even choosing from a vocabulary of a few thousand words a five word phrase might have on the order of 58 to 60 bits of entropy -- more than what is needed for the DES algorithm, for example. When you are permitted to use passphrases of arbitrary length (in PGP for example) it is not necessary to further perturb your 'shocking nonsense' passphrase to include numbers or special symbols because the pool of word choices is already very high. Not needing those special symbols or numbers (that are not intrinsically meaningful) makes the shocking nonsense passphrase that much easier to remember. If you are forced to use, say, a Unix password utility that permits only passwords of restricted length, one good strategy is to process a your secret passphrase using MD5 or SHA, then UUENCODE the result and select your shorter key from the output. See Appendix C and D for actual MD5 and SHA source implmentations. Appendix A. For software developers For software developers designing "front-ends" or user interfaces to conventional short-password applications, very good results will come from permitting the user arbitrary length passphrases that are then "crunched" or processed using a strong digest algorithm such as the 160-bit SHS (Secure Hash Standard) or the 128-bit MD5 (Message Digest rev.5).[See following Appendices] The interface program then chooses the appropriate number of bits from the digest and supplies them to the engine enforcing a short password. This 'key crunching' technique will assure the developer that even the short password key space will have a far greater opportunity of being fully exploited by the user. John Kelsey writes: "I think it's a really good idea to use a randomly-generated salt to generate a key from a password, and that this salt should be as large as possible. Basically, this is to keep an attacker from spending lots of computer power *once* to generate a dictionary of likely keys. If users use good techniques to choose passwords, this won't matter much, but if they don't, this may save them from having their encrypted files or transmissions routinely read. The simplest scheme I can see for this is simply to prepend a 128-bit salt (generated as strongly as possible) to each encrypted file. Generate the key from the password by pre- filling a buffer with the 128-bit salt, then XORing in the keyed- in password, or by appending the key to the keyed-in password. Then, run SHA or MD5 or whatever to get the key. A secondary point: Adding a random salt ensures that people who use the same password/passphrase for lots of files/transmissions don't get the same key every time. Since most successful attacks against modern encryption schemes use *lots* of ciphertext from the same key, this might add some practical security, at relatively low cost." --John Kelsey, c445585(a)mizzou1.missouri.edu Appendix B. A tool to experimentally investigate entropy A practical Unix tool for investigating the entropy of typical user keys can be found in Wu and Manber's 'agrep' (approximate grep) similarity pattern matching tool available in C source from cs.arizona.edu [192.12.69.5]. This tool can determine the "edit distance," that is, the number of insertions, substitutions, or deletions that would be required of an arbitrary pattern in order for it to match any of a large corpus of words or phrases, say the usr/dict word list, or over the set of Star Trek trivia archives. The user can then adjust the pattern to give an arbitrary high threshold difference between it and common words and phrases in the corpus to make crack programs that systematically vary known strings less likely to succeed. It is often surprising to discover that a substring pattern like "hxirtes" is only of edit distance two from as many as forty separate words ranging from "bushfires" to "whitest." Certainly no password or phrase ought to be chosen as a working password or phrase that is within two or fewer edit distance from a known string or substring in any on-line collection. Appendix C. & D. not included for bandwidth reasons -- Grady Ward | For information and free samples on | "Look!" grady(a)netcom.com | royalty-free Moby natural language | -- Madame Sosostris +1 707 826 7715 | development core rules, run: | A91F2740531E6801 (voice/24hr FAX) | finger grady(a)netcom.com | 5B117D084B916B27 .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

PGP 2.6 legal_kludge
by Richard Johnson 17 Dec '03

17 Dec '03

nobody wrote: > Also, concerning the PGP 2.3a/2.6/2.6ui controversy, is the only "problem" > with 2.6 the fact that after 9/1/94 it will start reporting an incompatible > version number that will make its output unreadable by older versions? If > so, and if source code is available, why couldn't the date checking routine > be located in the source code and simply commented out, then the whole > thing recompiled? Because the license prohibits nuking the "legal_kludge". You wouldn't want to violate the MIT PGP 2.6 license, now would you. ;-) Rich

2 1

Re: TEMPEST Jamming
by Jeff Gostin 17 Dec '03

17 Dec '03

root%pig.jjm.com%jjmhome.jjm.com(a)jjmhome.toad.com (0000-Super User(0000)) writes: >> On Sun, 3 Jul 1994, Jeff Gostin wrote: I most certainly did _NOT_. Someone followed-up to what I wrote. He wrote it. --Jeff

1 0

Pass Phrases
by Joseph Block 17 Dec '03

17 Dec '03

Maybe I'm just being a little dense about this. If I am the only person who knows what pair of texts I'm using and what permutation algorithm, and what the random number I'm going to salt the pass phrase with, and where I'm going to put the random digits, how is it insecure? Say I use the following two key phrases The Quick Brown Fox Jumps Over The Lazy Dog Oh Be A Fine Girl Kiss Me I decide my method is going to be first letter of each word of the first phrase, last letter of each word of the second phrase I get THQEBAFLJSOMTHLEDA I then throw in 1701 as follows 1701THQ1EBA7FLJ0SOM1THL1EDA7 Without knowing the phrases, method, or number, what makes this insecure? I'm not deliberately trying to be dense, I'd like to know why I shouldn't use this sort of mnemonic method to remember the pass phrase. jpb(a)gate.net

4 4

RE: ACAPULCO H.E.A.T.
by Blanc Weber 17 Dec '03

17 Dec '03

From: Sandy Sandfort Gooder News: Lots of shots of Alison Armitage in swim suits. ........................................ Oh, good. I feel safer now. Blanc

1 0

Question for PGP Gurus
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

PGP gurus, I don't follow the ins and outs of PGP very closely, and I can't find anything on this directly in my archived articles. Someone has told me that pre-MIT versions of PGP may have compromised security because "the session key is hashed solely from the plaintext." Is this true? What's the significance? Is there any weakness? Thanks, --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

3 2

Re: Pass Phrases
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 20:15 1994/07/03 -0700, Eli Brandt wrote: >> If I pick a verse of a song that makes it easy to remember. > >Aaaaaaagh! ... .. NSA must have an interesting collection of literature on line. They need high bandwidth (but not rapid) access to it. This could be the beginning of a new business if they ever turn their swords into plowshares. Conversely if anyone aspires to digitize a great deal of literature I am sure that NSA would subscribe, thus seeding a new industry. I seem to recall something about a Midwest university beginning to digitize a large body of literature.

2 1

RE: FW: A third voice re: science and spirit
by Blanc Weber 17 Dec '03

17 Dec '03

From: <nobody(a)shell.portal.com> "Ingore"? Is that anything like an "AlGore"? Is that a verb to describe the state of the country, as in "we've just been INGOREd"? ........................................ Could be, if you want it to be. But it could also be part of some shocking, nonsensical AlGoreYTHM. Blanc

1 0