June 1993 - cypherpunks-legacy@lists.ogf.org

Cypherpunks do what?
by fergp＠sytex.com 02 Jun '93

02 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- I'm all for cypherpunk code-writing; I'm all for crypto for the masses. In fact, I'm working it on a real-time basis, boys and girls. Somehow, I feel a bit slighted, and it goes a little beyond myself, if it need be known. I'm really not stupid enough to squeak without provocation. :-) I'd like to, additionally, see a sub-paragraph in the FAQ concerning non-code-writing exploits, such as the tedious task of accosting politicos. Is this not a desired activity? I shudder to think that cypherpunks would corner themselves in a manner which would exclude political maneuvers. IMHO, any cypherpunk who would close themselves off from political fire is either brilliant or idiotic, dependent upon method or mentality. Me -- I'll take the questionable route; I would rather get the answers I seek, sow the seeds of incongruity and ask questions of pertinent people. I'm asking that Eric Raymond add to "What do Cypherpunks do?" lineage, "Cypherpunks also do a lot of monkey-wrench work." We also run political gauntlets. We also draw attention, while other projects are accomplished. We also encourage other politico brethren of internationalities to join us in our struggle for electronic and cryptographic independence. We also interface with those turkeys on capitol hill (non-caps). Cypherpunks do more than write simple code -- we set precedence, we deliver technology. Cheers. -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLAwBGpRLcZSdHMBNAQHGIQP/YxBKfkjehoJawjExagITkr7emoEp3eMq wnj2Vp54dh8C8wfNdf+ovbT8siOfIT135ucLZQLDifLqp/iUgpnwk80Ur0427WSP Leb/UmLDm8HNO3gLyjDZ4YeLH++/qBiFb3Ej2+6ACyMc4wIUCXwKLnp1Ov3+E9vY 3Tjb25WVtXQ= =pLmj -----END PGP SIGNATURE----- Paul Ferguson | The future is now. Network Integrator | History will tell the tale; Centreville, Virginia USA | We must endure and struggle fergp(a)sytex.com | to shape it. Stop the Wiretap (Clipper/Capstone) Chip.

1 0

[daemon@ATHENA.MIT.EDU : FYI: White House EMail]
by marc＠Athena.MIT.EDU 02 Jun '93

02 Jun '93

------- Forwarded transaction [5834] daemon(a)ATHENA.MIT.EDU (Dave Farber) Commercialization & Privatization of the Internet 06/01/93 20:26 (90 lines) Subject: FYI: White House EMail Date: Tue, 1 Jun 1993 20:25:47 -0500 From: Dave Farber <farber(a)central.cis.upenn.edu> To: com-priv(a)psi.com THE WHITE HOUSE Office of Presidential Correspondence ______________________________________________________________ For Immediate Release June 1, 1993 LETTER FROM THE PRESIDENT AND VICE PRESIDENT IN ANNOUNCEMENT OF WHITE HOUSE ELECTRONIC MAIL ACCESS Dear Friends: Part of our commitment to change is to keep the White House in step with today's changing technology. As we move ahead into the twenty-first century, we must have a government that can show the way and lead by example. Today, we are pleased to announce that for the first time in history, the White House will be connected to you via electronic mail. Electronic mail will bring the Presidency and this Administration closer and make it more accessible to the people. The White House will be connected to the Internet as well as several on-line commercial vendors, thus making us more accessible and more in touch with people across this country. We will not be alone in this venture. Congress is also getting involved, and an exciting announcement regarding electronic mail is expected to come from the House of Representatives tomorrow. Various government agencies also will be taking part in the near future. Americans Communicating Electronically is a project developed by several government agencies to coordinate and improve access to the nation's educational and information assets and resources. This will be done through interactive communications such as electronic mail, and brought to people who do not have ready access to a computer. However, we must be realistic about the limitations and expectations of the White House electronic mail system. This experiment is the first-ever e-mail project done on such a large scale. As we work to reinvent government and streamline our processes, the e-mail project can help to put us on the leading edge of progress. Initially, your e-mail message will be read and receipt immediately acknowledged. A careful count will be taken on the number received as well as the subject of each message. However, the White House is not yet capable of sending back a tailored response via electronic mail. We are hoping this will happen by the end of the year. A number of response-based programs which allow technology to help us read your message more effectively, and, eventually respond to you electronically in a timely fashion will be tried out as well. These programs will change periodically as we experiment with the best way to handle electronic mail from the public. Since this has never been tried before, it is important to allow for some flexibility in the system in these first stages. We welcome your suggestions. This is an historic moment in the White House and we look forward to your participation and enthusiasm for this milestone event. We eagerly anticipate the day when electronic mail from the public is an integral and normal part of the White House communications system. President Clinton Vice President Gore PRESIDENT(a)WHITEHOUSE.GOV VICE.PRESIDENT(a)WHITEHOUSE.GOV ### ------- End of Forwarded Message ------ End of Forwarded Message --[5834]-- ------- End forwarded transaction

1 0

Newsweek Clipper Coverage
by L. Detweiler 01 Jun '93

01 Jun '93

Under `Society -- Technology' in Newsweek of June 7 1993 p.70 appears the headline `The Code of the Future' subhead `Uncle Sam wants you to use ciphers it can crack'. This 1 page article is pretty ambitious for what it tries to cover. The figure shows a flowchart for encryption over a phone using a key. (Not particularly illuminating. In particular the role & point of the key is ambiguous.) At the bottom 1/4 page we have a sidebar ``Great Moments in Cryptography' with 1st known encryption (Egyptian), the Zimmerman Telegram role in WWI, the Japanese Purple breakthrough prior to Pearl Harbor (the picture is apparently Friedman holding the machine), and finally Nov 4 1952 (a day that will live in infamy), Truman creates the NSA, `master of math based codes'. The article notes in the lead-in a cute & useful `hook' for the public & popular role of cryptography I have been drawing for a long time for nontechnical friends, saying that with it Queen Elizabeth could have been spared the spectacle of the steamy Prince Charles phone revelations and eavesdroppers would have heard nothing but a hiss, and `no signal analyzer, no supercomputer, no wiretap could have decoded the white noise.' Fortunately, they attribute this `reputation saving magic' not to Clipper but a DES chip. ``That's what America's supersecret spymasters, the NSA, intended when they designed the cryptographic system in the 70s with IBM.'' (glaring errata; their involvement has always been officially claimed as *secondary* and *subsidiary* to IBM's, if even at all. But, it is an error in our favor.) Article doesn't mention Clipper by name, but says it was essentially a response to the unbreakable aspects of DES using key system. Eric Hughes, `computer security expert [at] Berkeley': ``The government is saying, `If you want to lock something up, you have to [give us] the key'.'' Next, the motivation. Our networks are insecure, Internet ``broken into 90 percent more times than 1991'' (where'd that little statistic come from? Gene Spafford?). Security of medical records, credit-card purchases, video rentals, cellular phones at stake. NSA chip used by AT&T would take a supercomputer over a billlion years to solve, says R. Kammer of NIST. Problems: NSA hasn't revealed the algorithm so nobody knows if its `hackproof'; agencies holding keys are vulnerable to `recreational hackers, foreign spooks, and industrial spies.' Here comes the gut-wrencher. ``For now now one is forced to use the NSA chip. But manufacturers who put a rival chip into, say, their modems would likely be denied government contracts, as well as export licenses for the NSA-proof products. Even that may not appease the spymasters. ***No one rules out a mandatory encryption standard,'' says NIST spokesman Mat Heyman.***'' Is that quote from the point of view `our concerns on this have not been allayed' or in the vein `all the NSA henchmen I know are chomping at the bit to legislate a monopoly or outlaw non-Clipper chips'? Overall, I'd say a favorable article that covers the basics, and rather excellent editing given the severe space limitation (less than many newspaper articles). Written by Sharon Begley with Melinda Liu in Washington and Joshua Cooper Ramo. * * * Cypherpunks, I'm extremely concerned about these little quotes popping up in the media. Just a few days ago we hear in the Washington Post: > Administration sources said that if the current plan doesn't >enable the NSA and FBI to keep on top of the technology, then Clinton >is prepared to introduce legislation to require use of its encryption >technology, which is crackable by the NSA, and to ban use of the >uncrackable gear. > "It's an option on the table," said a White House official. I sure hope that `official' has absolutely nothing to do with Clipper, but that's unlikely. It seems to me these are the sounds of a slow, sinister rumbling underway. Sometimes quotes like these are `floated trial balloons' but other times they are grotesque flickers of real internal machinations. The more I hear them the more I think they are in the latter category. So far, the administration and media just don't `get it' that a firestorm is in the making over any hair-thin deviation from the standard of `no domestic regulation of encryption'. If NSA & the administration thinks that the Clipper brouhaha was containable, just wait until they go a nanometer past it in the wrong direction. Actually, a Supreme Court case on cryptography issues seems in some ways to be inevitable. Wow, I'd say there'd probably be enough artillery to seriously damage NSA in that confrontation. Cypherpunks, I'd like to compile a list of all quotations on the `regulation of domestic cryptography' topic. That way we'll have a propaganda poster all ready if any idiot bureacrat thinks they can thumb their nose any further. I have the original announcement text and the Washington Post text above. It seems to me that an NIST representative claimed there were `no plans' to outlaw other cryptography. Where was that? Can everyone send me whatever they have on this topic? P.S. Many tx. to E.H. for the thorough and excellent collection in soda.berkeley.edu:/pub/cypherpunks/clipper. - - - For reference, here are the original Orwellian weasel words form the April 16 announcement: Q: If the Administration were unable to find a technological solution like the one proposed, would the Administration be willing to use legal remedies to restrict access to more powerful encryption devices? A: This is a fundamental policy question which will be considered during the broad policy review. The key escrow mechanism will provide Americans with an encryption product that is more secure, more convenient, and less expensive than others readily available today, but it is just one piece of what must be the comprehensive approach to encryption technology, which the Administration is developing. The Administration is not saying, "since encryption threatens the public safety and effective law enforcement, we will prohibit it outright" (as some countries have effectively done); nor is the U.S. saying that "every American, as a matter of right, is entitled to an unbreakable commercial encryption product." There is a false "tension" created in the assessment that this issue is an "either-or" proposition. Rather, both concerns can be, and in fact are, harmoniously balanced through a reasoned, balanced approach such as is proposed with the "Clipper Chip" and similar encryption techniques.

1 0

The new PEM release supports non-authoritarian certificates
by gnu＠cygnus.com 01 Jun '93

01 Jun '93

You can generate your own certificates using the new PEM code from TIS. This, in some ways, models the PGP "web of trust" model. At least it's a lot closer than the original PEM "you trust us, we don't trust you" model. They have also done something with the email address space, but I'm not sure what. Previously PEM required that you abandon your Internet email address and use an X.400 based address in certificates and such. More details will be available when the PEM release is out for FTP (within days, I think). John

1 0

Re: Verifying Privacy as an Upload/AI?
by peb＠PROCASE.COM 01 Jun '93

01 Jun '93

>From marc(a)GZA.COM Tue Jun 1 15:44:15 1993 >But if you don't give me the password, the guy >holding the phone has some very unpleasant looking surgical equipment Alarm systems use duress codes for this that trigger a silent alarm when the password is entered. I'm not sure the proposed system here (a capability system) could have an extra channel that the bad guys don't know about. Using a hierarchy of escrow agents would be interesting--then by calling me up for part of the key would require me to get back to you after I called up the person at the next level. (Note that a hierarchy is a special case of a general graph, so the webs of trust idea is important here (could provide some redundancy).) Now, back to Steve's actual question, >From: fnerd(a)smds.com (FutureNerd Steve Witham) >given that you SEEM to be inside a secure system, how can you know >that you are not inside a simulation Ultimately, there is no proof you are not currently a simulation on a big computer. Why is time travel is not possible? It's too expensive on the current platform. (E.g, if SimEarth inhabitants could time travel, you would have a hard time keeping track of what they did and your machine would slow down considerably). On an upload, how many people can be in the same room? Can you make arbitrary video phone calls? Anything that stretches the compute resources could potentially make the bad guys impatient and blow their trojan horse universe. Paul E. Baclace peb(a)procase.com

1 0

wimsey.bc.ca archive is back on line
by markh＠wimsey.bc.ca 01 Jun '93

01 Jun '93

Due to a disk failure the anonymous ftp cryptography archive at wimsey.bc.ca (/pub/crypto) was off line for a couple of months. Well, it is back. (If you haven't used it before, we're on the other end of a slip link, so be please be patient, downloads take a while). As usual I'm asking that this archive not be used to illegally export cryptographic products from Canada and the U.S. -- Mark Henderson markh(a)wimsey.bc.ca (personal account) RIPEM key available by key server/finger/E-mail MD5OfPublicKey: F1F5F0C3984CBEAF3889ADAFA2437433

1 0

things
by bakunin＠gnu.ai.mit.edu 01 Jun '93

01 Jun '93

In re: tested telexes for those who don't know, telexes have been made 'secure' by use of a simple testing system for, say, banks to 'wire' money with. This extant paradigm gives me hope that electronic contracts are coming. In re: Wilde, ptui Pascal, SCHMASCAL. "Schlup.. schlup schlup." -WSB In re: govmnt nastiness Well, gee, I thought Carter was a pig, too. Lookit East Timor. But as Slick Willie goes, I dunno. I believe propagation of technology may outflank any intentions he may have. Maybe. be cool, michael

1 0

Re: Clipperpunks Write Code?
by Clark Reynard 01 Jun '93

01 Jun '93

Actually, I think that writing letters is somewhat useful; especially those of us who aren't very good at writing real code. I plug cypherpunks a bit in a Phrack article I just finished concerning my bust by the police a few years back; maybe you'd like to check it out, since it may be YOU if this damn Clipper thing goes through. This makes me glad I voted Marrou/Lord, and that I resisted the temptation to be suckered by that sellout bastard Clinton. I was worried that he would turn out to be a Jimmy Carter, but it's far worse than that. Carter, at least, had some human decency. Clinton has turned into the nightmare resurrection of Lyndon B. Johnson, and is probably stupid enough to get us into a war. Damn all politicians. If any of you read the Phrack article (I will not forward my article to the cypherpunks list, as it is well over 100K; those who wish to check it out can see it when and if it comes out; in all likelihood, Phrack 43, which is due to be out in a week or so), and believe that there is another publication which might be interested in it (I am willing to re-write for lay-persons); send me the info. Anyone who just absolutely can't WAIT to read it can request a copy from me, and I'll send it in three parts. While my article touches only tangentially on the issue of encryption (and my experience with weak encryption and with NOT having encryption), it may be of interest. Simply for your interest in cryptography, it is apparent that we are about to face a McCarthyesque witch-hunt. The government has already defined the terms of this conflict, and has declared war on basic human liberty. We must act accordingly. I advocate that the Clipper algorithm be discovered, if at all possible, by the comparison of the unlimited plaintext/ciphertext pairs which will be available to anyone with a Clipper phone and a computer, and the skills for differential cryptanalysis and/or IC Reverse Engineering. If the algorithm is made public, anonymously, within a year, and in so many copies that it is impossible to stop its distribution in electronic or samizdat form, Clipper is doomed. And it must be doomed. It's them or us. ---- Robert W. Clark Just Say No! to the rclark(a)nyx.cs.du.edu Big Brother Chip

1 0

Re: Verifying Privacy as an Upload/AI?
by peb＠PROCASE.COM 01 Jun '93

01 Jun '93

I think you are headed in the right direction wrt a capability system, however, they are predicated on tamper proof hardware. Since you stipulate human being copying and torturing (sounds like tampering to me), I think this is not ultimate privacy. Hmm, perhaps you should set up a key escrow system (!) so that you need to call your most trusted friends to assemble your session key. The session key works only once, assuming a tamper proof, capability system. When you call them, they can quiz you on your mental and physical health to determine whether they should give you the keys...thus limiting the ability of a torturer. Paul E. Baclace peb(a)procase.com

2 1

Re: Verifying Privacy as an Upload/AI?
by fnerd＠smds.com 01 Jun '93

01 Jun '93

Just want to reinforce that my question is not how can an AI or upload BE secure, but how can they KNOW that they are secure. That is, given that you SEEM to be inside a secure system, how can you know that you are not inside a simulation that actually has a trap door? -fnerd

1 0