- cypherpunks-legacy - lists.cpunks.org

Re: Last nail for US crypto export policy?
by Steven Bellovin 17 Dec '03

17 Dec '03

It is dangerously naive to label this success the ``last nail for US crypto export policy''. Everyone concerned with this issue, from the NSA to the FBI to anyone who wants to use crypto, understands this and accepts it. 40-bit keys are good for protection against casual snooping, and nothing more -- and no one is going to claim that you need supercomputers to crack them. In fact, I assert that the U.S. government is *happy* about these results -- because it's going to push folks towards wanting stronger crypto for export. The only problem, of course, is the terms under which such code can be exported... I'll go further -- in my opinion, the only reason the government doesn't want DES to fall just yet is that alternatives aren't ready. That is, the banks and financial institutions, and for that matter the government agencies, have not converted to 3DES or Clipper or what have you, and can't do so on short notice; the commercial products they need just aren't ready yet. No one wants to risk a loss of confidence in the financial system. Two years from now, though, when some key escrow products are ready, it may be a different story.

1 0

Re: Last nail for US crypto export policy?
by Dan Geer 17 Dec '03

17 Dec '03

Steve Bellovin writes: It is dangerously naive to label this success the ``last nail for US crypto export policy''. Everyone concerned with this issue, from the NSA to the FBI to anyone who wants to use crypto, understands this and accepts it. 40-bit keys are good for protection against casual snooping, and nothing more -- and no one is going to claim that you need supercomputers to crack them. In fact, I assert that the U.S. government is *happy* about these results -- because it's going to push folks towards wanting stronger crypto for export. The only problem, of course, is the terms under which such code can be exported... I'll go further -- in my opinion, the only reason the government doesn't want DES to fall just yet is that alternatives aren't ready. That is, the banks and financial institutions, and for that matter the government agencies, have not converted to 3DES or Clipper or what have you, and can't do so on short notice; the commercial products they need just aren't ready yet. No one wants to risk a loss of confidence in the financial system. Two years from now, though, when some key escrow products are ready, it may be a different story. Steve is absolutely right on the money, particularly about the likely happiness on the government side. The true explanation of the current effort is a testimony to the strategic skill of the regulators, but it is not as represented aloud. Export controls are meaningless without domestic use restrictions and domestic use restrictions will never pass the test of the First Amendment. Therefore, in an effort to obtain what cannot be obtained politically, this administration makes the following ploy: (1) Withhold from American companies the wherewithal to compete internationally by crippling the products they may export; (2) Offer to those companies that will include the functional equivalent of domestic use restrictions in their products a competitive advantage that could never otherwise withstand any fairness test; (3) Declare the resulting imposition of domestic use controls to be the "voice of the marketplace" and "voluntary." This is as shameful as saying that a rape victim was "asking for it." --dan

1 0

Re: Libel & the 1st Amendment
by Declan McCullagh 17 Dec '03

17 Dec '03

A couple points: * The 1st Amendment does protect some lies. If I say "Jim Choate is a Venusian albatross," the statement is probably (?) a lie, but I doubt you'll prevail in a libel suit. What damages do you have? That's the key, I believe -- the statement has to lower you in the opinion of others. * Many 1st Amendment experts don't believe in the legal concept of libel. It is, they say, a rich man's game -- if I'm libeled by the NYT, I'm probably not going t be able to sue them, but Donald Trump can. Moreover, if I don't have the resources to sue but the statement is libelous, it creates a *presumption* in the minds of the readers that the article is certainly true. (If it were not, I would have sued, right?) * The concept you may be searching for is consensual speech, which I believe a society should tolerate. Libelous speech isn't consensual, though obscenity is. -Declan On Tue, 28 Jan 1997, Jim Choate wrote: > > Hi, > > It has been asserted by at least one member that the 1st Amendment protects > libelous or other defamatory speech. > > This is hokem. The 1st most certainly does not protect lies in any form. It > protects opinion, this is distinctly different then stating a untruth about > some party or distribution of material with the attributation to them > without their permission. > > No civilized society can exist that permits lies and other defamations of > character and expect to survive for any length of time. Simply for no other > reason than contracts and other such instruments would not be worth the > paper they were printed on. Let alone any laws or other issuances from the > government itself. > > > ARTICLE I. > > Congress shall make no law respecting an establishment of religion, > or prohibiting the free exercise thereof; or abridging the freedom of > speech, or of the press; or the right of the people peaceably to assemble, > and to petition the Government for a redress of grievances. > > > Where in there do you see a right to lie, cheat, or steal? If it did, it > would be a lie because it would not protect the very freedom it says it is. > > > Jim Choate > CyberTects > ravage(a)ssz.com > > >

1 0

Re: Microsoft ammunition
by Lucky Green 17 Dec '03

17 Dec '03

At 12:49 PM 3/28/97 -0800, Bill Frantz wrote: > Whether your personal files are stored on a >local disk or on a server doesn't matter. What matters is whether random >downloaded code (again, Java or ActiveX doesn't matter) can use your >authority to read/modify those files. The ActiveX model of, "It's signed >by XYZ Corp. Of course it's safe." is so much bullshit.* The Java >approach of running untrusted code in a safe box is better, but doing it by >validating the safety of object code requires trusting a large complex >verifier. JavaSoft has moved into the right direction. Their JECF is largely capabilities based and in fact, Java security in general in moving towards capabilities. That won't help you against attacks via the underlying insecure OS, such as Windows 95/NT, MacOS, or UN*X which the typical user will be running, but it is miles ahead of the initial sandbox model. >* See Norm Hardy's paper, "The Confused Deputy", which I believe is still >available through the EROS page at the University of Pennsylvania. I was a talk by Norm that made me see the light. Secure computing requires capabilities. And there is anecdotal evidence that it was Norm who indirectly pointed JavaSoft to the solution to their leaking sandbox problem. Time for my usual plug: if you are unfamiliar with capabilities based operating systems or don't know why they are the only currently available solution to a whole host of computer security problems, do a search for "KeyKOS". It should get you started. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

2 1

Re: Money Laundering Conference
by Robert Hettinga 17 Dec '03

17 Dec '03

At 12:13 pm -0500 on 3/30/97, Black Unicorn forwarded to DCSB: > This is a formal invitation to you to attend the upcoming 8th > International Oceana Conference on Money Laundering, The Caribbean & Latin > America, Cybercrime, Financial Crytography and International ^^^^^^^^^^^^^^^^^^^^^ Wonder where they got *that* from? :-) > Financial Crimes on May 6-7, 1997 at the Sonesta Beach Resort and Casino > Curacao, Curacao, Netherlands Antilles. This conference sponsored by > Oceana Publications, Inc. in cooperation with the > Association of International Bankers of the Netherlands Antilles (IBNA), > The Association of the Compliance Officers of the Netherlands Antilles > (CONA), and the Centre for International Financial Crimes > Studies, College of Law, University of Florida will provide global and > regional coverage of Money Laundering and International Financial Crimes. > > > (See, http://www.oceanalaw.com/seminar/ml2toc.htm) Hey!!! There's an *echo* in this room. What's the propagation delay here? Say, what, 3 months? Sheesh. Don't ever look behind you. They might be gaining... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

1 0

WebWorld 21
by Bubba Rom Dos 17 Dec '03

17 Dec '03

1 0

Re: PRESS REPORT - IMPORTANT
by Toto 17 Dec '03

17 Dec '03

Huge Cajones Remailer wrote: > > Anonymous writes: > > > > *** London Times, 30/03/1997 *** > > > > >Factoring problem broken: > > > > > >One of the main systems used by computer privacy > > >programs around the world such as those used on > > >the internet to prevent third parties eavesdropping > > >on credit card transactions has been proven insecure, > > >The RSA algorithm, based on the difficulty of "factoring" > > >large numbers appears to have a weakness, a press > > >release by the IACR (International Association for cryptologic > > >research) reads as follows: > > A little early for April Fools'. "Sergei Ripov" indeed. I did a search through the online edition for anything to do with encryption, RSA, algorithms, etc., and nothing came up for the last few months. Maybe it's in the April 1st edition. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Looking for a c'punk volunteer in the East Bay
by John Gilmore 17 Dec '03

17 Dec '03

Date: Fri, 21 Mar 1997 17:54:11 -0800 (PST) From: Dennis Derryberry <dennis(a)eff.org> To: gnu(a)toad.com John - do Cypherpunks like to play superhero and help people who are being hacked? A woman called who says someone had rboken into her system reprogrammed certain controls causing her to be instantly trackable whenever she logged in, no matter what account she used, no matter from where, etc. She says it happens *every* time. Law enforcement is baffled and has no advice (surprise, surprise). She said the FBI even recommended she hire a hacker to play along with the culprit and see if they couldn't catch him that way. So, if you or anyone you know is interested in a weekend sporting event, you can reach Debra Wellman at the home of her mother 510 855 9744 I spoke with her on the phone. She is not crazy, just frustrated. Dennis -- Dennis Derryberry Executive Administrator Electronic Frontier Foundation Web: http://www.eff.org tel: 415 436 9333 x104 fax: 415 436 9993 email: dennis(a)eff.org

2 1

Bank for International Settlement (BIS) report on bitbux
by John Gilmore 17 Dec '03

17 Dec '03

From: Pete Yeatrakas <pyeatrakas(a)wespay.org> For those of you interested in security of electronic money, you may want to browse the Bank on International Settlement (BIS) page and read a report issued in 1996. BIS is the organization of G-10 central banks (e.g., in the US, Federal Reserve Bank Board) who meet to discuss international payments issues. The excerpt below is the first paragraph from http://www.bis.org/publ/cpss18.htm announcing the study of "security of electronic money," available in pdf format. BIS 1996 annual report (http://www.bis.org/publ/cpss19.htm) also provides detailed information about each country's payment system (currency in circulation, number of ATMs and financial institutions/branches, GDP, population - 1990 through 1995) and concludes with a comparative analysis of those countries (with currency compared in US dollars). This is a valuable resource for the student of European and US payment systems. (BIS home page is http://www.bis.org ) Best Regards, Peter Yeatrakas "Committee on Payment and Settlement Systems SECURITY OF ELECTRONIC MONEY FOREWORD In November 1995, the central bank Governors of the Group of Ten (G-10) countries commissioned a series of studies on specific issues related to electronic money, in view of the potential importance of this new form of money and its implications for monetary policy, consumer protection and payment systems. These studies were carried out by the Committee on Payment and Settlement Systems (CPSS). For the examination of the security aspects of electronic money schemes the CPSS sought the assistance of the Group of Computer Experts, which established for that purpose the Task Force on Security of Electronic Money, chaired by Mr. Israel Sendrovic from the Federal Reserve Bank of New York. At their meeting in July 1996 the G-10 Governors discussed the various reports that had been commissioned and agreed on the publication of the present report on Security of Electronic Money. The report is not necessarily intended to represent the official views of the Governors."

2 1

Re: Analysis of proposed UK ban on use of non-escrowed crypto.
by Kent Crispin 17 Dec '03

17 Dec '03

On Mon, Mar 31, 1997 at 01:20:02PM -0500, Ray Arachelian wrote: > On Thu, 27 Mar 1997, Kent Crispin wrote: [...] > > > The only legal support needed for digital signatures > > > is for the courts to recognize that digital signatures > > > are equivalent to their analog counterparts. > > > > The *only* legal support? This is a *big* deal, and the issues are > > very complicated. Handwritten signatures and digital signatures are > > really quite different. > > I claimeth not lawyerhood, but IMHO, it can stand up in court if both > parties agree to it by analog signatures infront of a notray. I can comment, and I am not a lawyer -- I in fact know of one such case, where one large organization signed a MoU with another one that agreed that PGP signatures would be valid authorization for work orders and selected other transactions. This can be useful where the organizations in question have a long term relationship, and they are willing to go to the expense of drafting such a contract. > > > This could > > > be binding if the two parties sign something that says > > > "If I use PGP to sign a document I agree to allow that > > > document to be treated as if I signed it." (IMHO) > > > > Sure. It's been done, in fact. However, pairwise contracts with > > everyone you do business with is not going to cut it. You need laws > > for this. > > Not if it is agreed by all parties involved and their lawyers to honor > such signatures. (IMHO) Suppose I offer to sell you my car for $1000. We are not going to manually sign a contract to accept our pgp keys on a contract to sell the car, we will just do the total deal with manual signatures. Title will be transferred at the Department of Motor Vehicles with manual signatures. Smog certificates will be signed with manual signatures. It isn't worth the time and trouble to set up any kind of a special arrangement for digital signature for one time or sporadic, low volume transactions. Not until there is a legal infrastructure in place will we be able to do that. > > > [...] > > > > > > > 4) Businesses, especially large businesses, will (and do) > > > > want common standards for key and DS management. > > > Yeah, and they also want standards for software. [...] > > > > This is pair-wise contracting again. Note, incidentally, that > > standards concerning signatures are of a different order than > > standards concerning office software. There far more pressing > > liability issues with digital signature. > > Really? you must not have been gotten infected by the slew of Word and > Excel viruses out there. Might be a very good lawsuit against Micro$oft > that they allowed such things to happen. Not a chance. > Standards for a company are standards for a company. Which standard has > more weight or importance is up to that company. Sure, it is on a bigger > scale that installing XYZ OfficeWare and getting your ass fired, but it > is still a standard. We're not talking about standards for a company, we are talking about standards between companies, and government agencies. > Is there any reason that a specific company CAN'T decide to use PGP? (or > PEM, or some other scheme) if it so choses? All kinds of reasons. A Title Insurance company isn't going to be able to use digital signatures on Deeds of Trust without court approval, to just pick an example out of the air. [...] > > These are company signature > > keys, also used for encrypting email, so the company escrows all the > > secret halves of the keypairs. (There is no privacy issue here -- > > these are all company keys used for company business, all the > > encrypted documents are company documents.) > > So what's the problem? You hire people to keep track of assigning, > escrowing, and signing keys for your employees. You have IS staff and > security staff to watch for breeches. You can automate tons of this with > good written scripts that automatically scan all email for valid > signatures and raise alarms when signatures don't match. So what's the problem? Your answer is the problem: "You hire people...You have IS staff...You can automate etc" > Where is this not useful? For a small company a locked safe is plenty. > For a large company, you hire HR/Security folks to be your "Key Agents" > or whatever. This costs *money*. There is no reason to use digital signature unless it saves you *money*. A business isn't going to invest in DS infrastructure, especially of the scale you describe, just because they think it's fun. [...] > > > > Many commercial "standards" are legal standards, supplied by the > > government. In fact, the whole legal infrastructure of business law > > is really, when you get right down to it, a set of legally mandated > > standards. Standards are all over the map, when it comes to legal > > status. > > Because there are laws that force such standards on the company. This is a terribly simplistic view of things. Businesses also make good use of the level playing field that is provided by laws. -- Kent Crispin "No reason to get excited", kent(a)songbird.com the thief he kindly spoke... PGP fingerprint: B1 8B 72 ED 55 21 5E 44 61 F4 58 0F 72 10 65 55 http://songbird.com/kent/pgp_key.html

1 0