- cypherpunks-legacy - lists.cpunks.org

Crypto crackdown - this i
by Duncan Frissell 17 Dec '03

17 Dec '03

R >They may not be able to prosecute you based on illegal evidence, but R >they can take everything you own and keep it until you are broke R >and homeless. Unless you are judgement proof. For a small fee, I am always willing to teach people how to become judgment proof (which is *not* the same thing as poor). Duncan Frissell ::Exclude *.gov --- WinQwk 2.0b#0

1 0

Newsgroup...
by Christian Void 17 Dec '03

17 Dec '03

So, is there a specific reason why someone hasn't created an <alt.cypherpunks> newsgroup? It seems appropriate, as most of the current mass amounts of traffic are dedicated to paranoia and bickering... Christian Void /T71 | "I don't like it, and I'm sorry I | VMResearch, Inc. cvoid(a)netcom.COM | ever had anything to do with it." | P.O. Box 170213 Tel. 1+415-807-5491 | -Erwin Schrodinger (1887-1961) | SF, CA 94117 * PGP v2.3a Public Key Available Via Finger *

1 0

Does this seem illegal to you?
by rees＠cs.bu.edu 17 Dec '03

17 Dec '03

Hi. Just picked this up from alt.dcom.telecom. Doesn't it seem like an illegal invasion of privacy to do something like this? Or maybe I just don't have the whole picture. Anyway, here it is: >GOING FROM A TO B. You're in your car. You're at A. You want to go >to B. You have no idea where B is. So you go to a Sprint payphone >and use its TeleMap service, give the telephone number of your >destination, and receive precise directions. (Tampa Tribune 9/12/93 >B&F 5) Of course, if you have a wrong phone number, that may be a >problem. You may go to C, wherever that is. -Dave (rees(a)cs.bu.edu)

3 3

WE'RE UNDER ATTACK
by L. Detweiler 17 Dec '03

17 Dec '03

First of all, the attacks on Moby Crypto (Grady Ward) and on PGP are *clearly* linked in the SAME systematic assault on cryptographic distribution, as S. Steele of EFF has indicated. Both the subpoenas were served by US District Court of Northern California, San Jose. The head attorney mentioned in both cases is Michael J. Yamaguchi. The subpoenas are virtually identical. Both mention W. P. Keane, Assistant attorney, and special agent Robin Sterzer. They appear to have been served on the same *day*, perhaps even the same *time*. (Rule X of systematic warfare: coordinate attack timing on all fronts.) Here is where the dissimilarity seems to start. Grady Ward was unequivocally being harassed by the *NSA* prior to this date as he reported on various newsgroups. Is the summons related to this NSA inquiry? It would be inconceivable at this point to believe that it wasn't. PGP & PRZ were being harassed by *customs officials* prior to this date, possibly under the complaints of PKP. Now, these two situations have been totally aligned in the simultaneous serving of the subpoenas. Is this a systematic assault by the NSA, PKP, or Customs Officials? Does it have something to do with the ink-still-drying agreement between PRZ and Viacrypt? Who convened the grand jury? *somebody* is targeting cryptographic distribution in a devastating initial two-pronged blow. The curious coincidence of clearcut NSA harassment of Moby Crypto on one hand and the PKP harassment of PGP on the other, *united* in the subpoena, with the chocolate ViaCrypt agreement timing on top, is extremely unsettling, and perhaps altogether the strongest fodder so far for NSA-PKP conspiracy theories. We must try to determine whose rules we are playing by. Is this a customs investigation? Treasury Dept.? The situation with NSA is that they don't really ever act directly, they always go through some other henchmen to do the dirty work. This smells like them. But the case of the NSA convening a grand jury does not appear to have a historical precedent. What's going on here? ATTACK PLAN At this early date it is impossible to formulate something sensible. Everyone is completely disoriented. This is like a grenade going off in the room. However, my initial reaction is that the subpoenas seem to be OVERBROAD. They could be argued by a competent attorney, given the simultaneous targeting of two completely disparate cryptographic enterprises, to represent an OUTRAGEOUS FISHING EXPEDITION. Isn't there a way to contest a subpoena in court? these legal mechanisms need to be employed IMMEDIATELY. what is the significance of the date June 1, 1991, the date back to which all cryptographic materials are requested? Does this have any meaning to PGP or some law? If anyone can figure out the meaning, it may be a route to a counterattack.

2 1

NIST proposes software key escrow development
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

Peter Wayner <pcw(a)access.digex.net> writes of the NIST announcements to develop software-based key escrow. I think it would be utmost folly for software developers to work with the NIST and NSA on this or invest any time or capital. The fundamental requirement for NSA approval is the implementation of Skipjack in *software* in such a way that the algorithm is *protected* like it is in the booby trapped Clipper chips-- that is, impossible to deduce. But this appears to be complete *fantasy*. Any such system must rely on some kind of a hardware approach. But then we're back to where we've started -- Clipper and Capstone. Only the NSA has enough inbred, insular self-delusion to propose that 'secure' software is even a *possibility*. These companies could better spend their time proving that Fermat's Last Theorem is FALSE. (Hey Cypherpunks! I KNOW! what we need is a Secure Clipper Encryption Server that handles encryption via Email! Let's get the NSA to run it! Then it would *really* be secure! <SMIRK>) Furthermore, anyone who submits to this development is giving the NSA valuable (free?) development time for the purpose of, fundamentally, a KEY ESCROW SYSTEM. Now, perhaps someone can explain to me why a software system for depriving us of our rights is superior to one in hardware? Doesn't anyone have the faint glimmer of the idea that NSA, the *premier* cryptographic agency in the *world*, with unsurpassed technological and engineering prowess in the area, would have already *figured out* how to do this if it was *at all* feasible? Personally, I think this stinks putridly of an NSA decoy to simply claim or suggest that they're responsive to alternative solutions. This is nothing but a *cruel mirage* in a *barren desert*. >At the end, the group owns the intellectual property rights to >what is discovered. This may be something patentable and it could >be worth some money. I don't know how likely this is, but it >seems possible. In fact, it is probably the reason many of the >participants are willing to enter into the project. yes, that's *exactly* what we need -- another software patent. But this is just a meaningless dangling carrot. (They damn well *better* have rights to whatever they develop under private capital.) >The role of NIST is both gatekeeper and fascilitator. They get >everyone together and occasionally push things along. In this >case, they'll also offer some technical assistance which will >include feedback from the NSA. Dennis Branstad said that this would >most likely take the form of Siskel and Ebert-like ratings of the >systems proposed. The NSA would suggest, "Yes" or "No" but they >probably wouldn't go into details. This is because the procedure >would be unclassified and the NSA usually won't relate technical >details without classifying them. Take a LOOK at what you've written, and ask if this project has ANY CHANCE of succeeding. The NIST is proposing that a lot of companies put in work into a key escrow system in software, that the NSA has ultimate overruling veto power with *no explanation* of negative answers. This all to come up with something that the NSA ultimately must *accept* under the whole point of the proposal. What's the POINT?! Yes, sign me up today to do DEVELOPMENT WORK for the NSA on a KEY ESCROW SYSTEM. Let's put in thousands of man-hours to come up with something as fundamentally feasible in principle as perpetual motion! All for the sheer joy of the thought the NSA *might* pat us on the back! how could this be anything but the most PRODUCTIVE and REWARDING experience?! A company would have to be INSANE to go with this as presented! >* Is this process intended to fail? Will NIST just keep saying that >software isn't good enough and that way they'll be able to answer >the criticism that hardware is too expensive? you mean the NSA -- and does that answer your question? >* How selective is the group formation process? Are people really >out for money? I think NIST would be overjoyed to hear that anyone outside of NSA consultants is interested. >* There are supposedly several other groups interested in participating. >Who are they? Is it RSA and PKP? RSA, PKP, RSADSI, Bidzos -- that makes at least four, right? the KGB would also like a secure software system. Sternlight & Denning would surely sign up. Just another dangling carrot -- or rather, an apple with a razor blade inside. >* Is a software process really that much more insecure than a hardware >based approach? Sure, it is easier to tamper with software, but given >that we can always tamper with the software shell around the Clipper >hardware, it shouldn't be _that_ much different. is an ASCII text file really that much more pliable than a silicon computer chip?! I'm trying to be gentle, but you simply don't seem to get it! the NSA wants a software implementation of Clipper that is TAMPERPROOF and INVISIBLE. This is like asking for a way to send locked lead safes through phone lines! it's based on a fundamentally *bizarre* premise! We *cannot* tamper with Skipjack in its present forms of use -- Clipper and Capstone -- they would not exist unless the NSA had the tamperproof technology. And the first rule of software is that it is 'TAMPERLADEN'! ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

gopher site
by Karl Lui Barrus 17 Dec '03

17 Dec '03

I forgot to mention I will take suggestions for what to place at the gopher site - for example, what 10 or so Clipper articles from the archives at soda.berkeley.edu MUST be available? I haven't read them all and won't have the time for the forseeable future to do so. Pointers and suggestions to other docs and files are welcome. Should I put stuff like appropriate rfc's and documentation (pgp and ripem, etc.) or not? All of this is subject to disk space and it may be I'll give preference to shorter items. I am leaning towards including the rfc's for PEM and the two for Rivest's MD4/MD5 hash algorithms. -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu keyID: 5AD633 hash: D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 "One man's mnemonic is another man's cryptography" - my compilers prof discussing file naming in public directories

2 1

software key escrow ruse
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

Isn't it obvious? 1. People try to do key escrow in S/W (rather than refuse to play along with key registration) 2. By doing so, they lend apparent approval to the idea of registration. 3. The S/W effort fails, of course. 4. Conclusion: S/W encryption is no good and must be abandoned because you can't do key registration that way. It is important not to entertain the notion of registration, even as an academic exercise, lest the effort be used to claim that some reasonable person believes key registration is OK. - Carl

1 0

Re: NIST proposes software key escrow development
by doug＠netcom.com 17 Dec '03

17 Dec '03

an12070(a)anon.penet.fi said: >I think it would be utmost folly for software developers to work with the NIST >and NSA on this or invest any time or capital. Clearly this is true for cypherpunk sw developers, but others see an opportunity to make some bucks. >The fundamental >requirement for NSA approval is the implementation of Skipjack in >*software* in such a way that the algorithm is *protected* like it is in >the booby trapped Clipper chips-- that is, impossible to deduce. > >But this appears to be complete *fantasy*. Any such system must rely on >some kind of a hardware approach. Not necessarily. Zero knowledge proof techniques, for instance, can be applied to make source code as impenetrable as one wishes. This tends to carry a heavy runtime overhead, of course. And even hardware solutions can be reverse engineered. In fact, it's guaranteed to happen eventually. Triple layer metal interconnect chips can be selectively peeled via ion beam etching to reveal them to scanning tunneling electron microscope probing. Camouflage in the form of unnecessary functional units that mask actual operation can be uncovered by data flow analysis. Such a project would be extremely expensive...but someone will eventually do it. The Mafia or the KGB, for instance, if no one else. >Doesn't anyone have the faint glimmer of the idea that NSA, the *premier* >cryptographic agency in the *world*, with unsurpassed technological and >engineering prowess in the area, would have already *figured out* how to do >this if it was *at all* feasible? I think everyone assumes that the NSA is technologically several steps ahead of the game at all times, and clearly they have their own agenda. Some people just don't see their hidden agendas as threatening. C'est la vie. I think it makes for a very interesting chess game, myself. The NSA is attempting checkmate, but they're not strongly enough positioned to do so. In chess parlance, it's a bluff, but one with enough steel behind it to force a response, which gives them a minor but real tactical advantage. The obvious counter-response is to advance a pawn towards queening...which is already in progress. I'm reasonably happy with what the NSA appears to be doing in regard to foreign intelligence gathering; it's their domestic agenda that threatens the constitution. But that's in the nature of spook organizations. "Eternal vigilance is the price of liberty." Doug

3 3

analysis: attack PKP driven? significance of June 1, 1991
by L. Detweiler 17 Dec '03

17 Dec '03

June 1 1991 is the date that both the MobyCrypt and PRZ subpoenas reach to. What is the significance? the early indication: this is the date of the 'official' release of PGP 1.0. C'punks: upon further reflection this dual assault seems to be ostensibly PKP motivated/driven. It is possible the prior NSA harassment of Moby Crypto was just a shocking coincidence. As reported on this list by D. Barnes <cman(a)io.com>, NSA had been prodding Austin Code Works (Maria Nekam) over DES export many months prior to this date. Does ACW currently deal with cryptographic software? how is it NSA was bugging them *months* ago? did Grady Ward indicate that long ago publicly (Usenet) his intent to use them as a publisher? This reminds me of stories of censorship of Yardley from Kahn (The Codebreakers) and censorship of Kahn reported by Bamford (Puzzle Palace) -- somehow, the NSA just *knows* when publishers are coming out with information related to cryptography or the NSA (I wonder how? <wink, wink>). We need more information: - how long has the NSA been harassing Austin Code Works? - does Austin Code works currently deal with cryptographic code? - or is this all entirely due to Grady Ward's Moby Crypto project? - was NSA complaining about (1) DES or (2) something else? export? - how did NSA find out that Austin Code Works was involved with Moby Crypto? On the other hand, the evidence that this is primarily PKP motivated seems to be in the primarily *PGP* and *RSA* oriented aspect of the subpoena queries. My current pet theory is that PKP has seen Grady Ward talking about his cryptographic recipe book on newsgroups (Bidzos has been known to track and respond on sci.crypt) and lumped him in an accusation & complaint, filed with the customs office, that ITAR laws on cryptographic export of cryptographic algorithms have been violated -- hence the investigation by a customs agency, the PGP 1.0 release date, the Viacrypt timing, etc. Maybe PKP got the impression that G. Ward was including RSA Source code -- has he said so on Usenet? -- this would be very inflammatory for them. RSA has virtually *no* international protection, all the patents only apply in the U.S. Finally, there is some other peripheral evidence regarding PRZ in this line I'm not really at liberty to state. that's the current 'conventional wisdom', anyway, subject to nanosecond fluctuation. Point: I think this new episode will without any doubt resolve whose side PKP is on. They've successfully remained in the shadows, like the NSA, until now, but like the NSA is discovering, continuing this will be impossible... Another point: remember the amazing scrutiny given to the E911 document, its *exact* and *precise* path of geneological distribution and leaking in the court proceedings and subsequent literature (e.g. B. Sterling, Hacker Crackdown)? I suspect, very soon, the same laserlike magnifying-glass pinpoint attention is going to be focused on exactly *who* first made PGP available *internationally* outside the U.S. -- anyone who can come forward with information on this (it all appears to have transpired in 1991) will be momentously affected. I don't know if this can be traced as effectively, however. The tracks are bit cool, and some people may not want to exactly *announce* this information.

2 1

So. Calif. Cypherpunks Outreach
by jkhastings＠aol.com 17 Dec '03

17 Dec '03

"State Evader" comes out of the Green Dragon Tavern BBS (213) 365-1132 pseudonym closet to shamelessly promote his upcoming speeches at the H.L. Mencken Forum and the Libertarian Party of CA Region 62 Los Angeles Westside: ------------------------------------------------------------ State Evader = J. Kent Hastings Assistant Director of the Agorist Institute, "Techtics" columnist for the Tactics of the Movement of the Libertarian Left newsletter, internet cypherpunk, and ham radio operator WA6ZFY. Both speeches will be on the topic: "Cyber Cash: Free Market Money Comes of Age" I will talk about untraceable digital cash, public-key cryptography, spread-spectrum radio, un manned vehicles, and the latest government actions that threaten everyone's privacy: The Clipper/ Skipjack key escrow agents and the subpoenas served to the Austin Code Works and ViaCrypt for all PGP, RSA export info. -------------------------------------------------------------- Mencken info: (310) 289-3234 (reserve now!) L.P. info: (310) 477-6491 -------------------------- Mencken location: The Old Spaghetti Factory 5939 Sunset Blvd near Hollywood Freeway in L.A. Wednesday September 22, 1993 6:30 Libatio ns, 7:00 Dinner, 8:00 Speaker, 10:00 Adjournment First time "virgins" reserved: $3 -------------------------------------------------- L.P. of CA Region 62 L.A. Westside: Chris's Italian Restaurant 10105 Venice Blvd. at Clarington Ave Thursday, September 23, 1993 Cocktails 6:30, Dinner 7:00, Talk 8:30 Not sure if admission is charged. ---------------------------------------------- Kent - <jkhastings(a)aol.com>

1 0