- cypherpunks-legacy@lists.ogf.org

IMPORTANT--WE WON......NOT!
by tcmay＠netcom.com 17 Apr '93

17 Apr '93

Sandy Sandfort looks on the bright side. Unfortunately, I can't agree with him. He writes: >FIRST, THE BAD NEWS--The government wants to control encryption. >Though they are playing coy about it, it's clear that eventually >they will try to ban "the good stuff." It's clear Zimmermann, >and others, have gotten their attention. > >NOW, THE GOOD NEWS--I t d o e s n o t m a t t e r. The game >is over. We won. The government may engage in holding actions, >but it still doesn't matter. What we have here, is the State's >pitiful attempt to make the best of a bad situation. This >amazing "policy" announcement is a tacit admission of defeat. > >HOW CAN I BE SO SURE?--The cat is out of the bag. Free, mil spec >data encryption is readily available to all. Within a year, >equivalent voice encryption freeware will join it. There is no >way the government can stuff the encryption cat back in the bag. >They can pass their laws. We will do as we please--and they will >help us. ...rest of post elided.... Drugs are freely available on nearly every inner city street corner. The "cat is out of the bag," as you say. And yet.... - the War on (Some) Drugs.... - mandatory hard time for first offenses (ask the Santa Cruz kid doing 10 years without parole for possession of some amount of acid...the weight of the blotter paper kicked it up to the 10-year level) - civil forfeiture... "We find a roach, we get your yacht." - midnight raids, often killing innocent citizens (ask the Malibu retired guy who got zapped by the Feds...turns out they'd already greedily started to divvy up his land to various parks...and of course he was totally innocent--and now dead) - "D.A.R.E."-type brainwashing of children, encouraging them to turn in their parents ...and so on. You should all know about these things, on this of all days (16 April 1943, 50 years ago, was the discovery of LSD). Restricting crypto means the government has a big club they use to threaten, intimidate, force cooperation, etc. Just like with taxes, drugs, and everything else they control. Under the civil forfeiture laws, my assets (which I depend on to live out the rest of my life on!!) could be seized if the government suspects I'm using "illegal crypto." Not under current laws, but certainly under the laws that follow from the "Clinton Clipper." Anyone with assets to seize--a house, a business, a stock account--becomes a fair target. > > But never doubt it, W E H A V E W O N. > No, but we haven't lost yet. -Tim -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

1 0

ANON: Chaining suggestions
by Hal 17 Apr '93

17 Apr '93

Will Kinney suggests a form of anonymous return address in which "Request-Remailing-To" headers are nested and encrypted, then used for addressing. This is a fine idea, Will, but we're way ahead of you on this. This approach has been used ever since we added encryption to the remailers. Karl Barrus even wrote a script specifically for constructing anonymous addresses like this. It's available from the Cypherpunks ftp site. (soda.berkeley.edu, /pub/cypherpunks. I think the file is something like "scripts.tar".) The problem with this in practice is, first, that the return address block is rather large, especially if more than one level of nesting is used (often 10, 20 lines or more); and second, that it does not lend itself to automatic use of the "reply" function. Instead, the replier has to cut and paste this block of text from the message he's replying to and put it in the right place in his own message. And he has to be instructed in how to do this. (Karl's script adds the instructions when it creates the return address.) This is pretty complicated. This is why Eli suggested (based on suggestions from Eric Hughes) that at least Julf's remailer be enhanced so instead of just mapping, say, an12345 to joe(a)foo.com, it would map to a Cypherpunks return address of the type Will is describing - a block of encrypted text. People could then have the convenience of automatic replies to an12345 along with the security of a chained address. I don't think the idea quite works in this form, since I don't see how messages to Julf get translated to an12345. Presumably only messages from one specific user should get posted under this ID (the user whose address is buried in the encrypted return address to which Julf's remailer will forward replies). Perhaps another set of commands is needed to tell the remailer what ID to use to post under. By the time you do this much I don't think that what you have bears much resemblence to Julf's current software. I am stymied in doing experimentation in this area by one fundamental problem. I do not have the power to create user ID's on any systems which I use, so I can't create pseudonym accounts. I have tried various tricks. For example, I sent mail with a "Reply-To:" of "hal(a)alumni.caltech.edu (Pseudonym 12345)". I hoped that if someone did a reply to this mail, it might come to me with that whole field in the "To" line, and I could then parse it for the pseudonym number. That didn't work on the particular reply mailer that I used; it stripped the comment field in parentheses. The one other idea I've had is to put something at the beginning of the Subject: line, so if the user remailed a message with a Subject: of "How's it going, Jack?" it would actually go out as "Subject: (P12345) How's it going, Jack?". Then when they reply it will probably come back as "Subject: Re: (P12345) How's it going, Jack?" or something similar, and I can parse for the (Pxxxxx). This might work pretty often but munging the Subject line is bad for news posting since a lot of news readers sort by subject line. I could put the (Pxxxxx) at the end but it might get truncated? Maybe not. I wonder if anyone knowledgable in mail systems could suggest a relatively robust way of setting up outgoing headers so that return mail will (A) come back to me (hal(a)alumni.caltech.edu in this case) and (B) be marked in some unique way that would let me do a pseudonym mapping. Any ideas would be appreciated. Hal Finney 74076.1041(a)compuserve.com

2 1

1984 deja vu
by Arthur Abraham 17 Apr '93

17 Apr '93

If you haven't heard about John Markoff's article yet, it' cause you've been spending all your time reading Cypherpunks instead of the front page of the Friday NY Times... read it now. There's an awful lot to be said about this article, mostly we know what it is, and mostly we agree about it. This a major social issue that must be corrected, so here's my proposal: ==> DON'T POST ANYTHING ABOUT THE MARFKOFF ARTICLE. <== We shouldn't waste time writing each other letters that we'll learn nothing by reading. We should spend that same time writing to newspapers, congress people, phone companies, Clinton, Gore, and anybody else who thinks they can get away with this because they feel the citizenry either doesn't care about or doesn't understand the issues. What I want to see in re this issue on this list is something I don't already know, like the name and address of AT&T's president's secretary -- s/he'll complain to the prez if enough privacy mail arrives. Be imaginative, be active, rattle cages, but telling me how pissed you are won't change a thing, except to decrease the time we're both spending on doing something effective. Be effective. Please. -a2.

1 0

New versions of encryption software released
by Peter Meyer 17 Apr '93

17 Apr '93

I suppose I could use a fig leaf to cover the price of this software so that this posting might seem less "commercial", but - what the hell - this isn't sci.crypt and we're not concerned with maintaining academic purity. This encryption software is available *now*. You might consider shelling out a few bucks (which allows you to make use of the result of a few years' work) before the govt. makes it illegal to buy, sell or use encryption software. New Version Release Announcement Dolphin Software releases three new versions of MS-DOS encryption software Dolphin Software's data encryption software has been released in two new versions, Dolphin Encrypt (V. 2.11) and Dolphin Encrypt Advanced Version (V. 2.10). The encryption routines are also available as a C function library. Both Dolphin Encrypt and the Advanced Version use a symmetric key encryption process to encrypt data on MS-DOS computers, and can encrypt multiple files with a single command. File pathnames are supported and there is extensive error checking. If you wish to transmit encrypted data as email then Dolphin Encrypt can be told to output the encrypted data as text. There is no limit on the size, the type or the number of files. Files are normally compressed during encryption. Screen output can be sent to a file or to a printer for a record of operations. The encryption process, described in detail in the documentation, relies partly on the RSA Data Security, Inc., MD5 Message Digest Algorithm. The Advanced Version has all of the features described above, and also encrypts whole floppy disks. All common disk sizes are supported and are automatically recognized. Additional command line options are supported, including the options of echoing or not echoing the encryption key during entry. There is a decrypt-and-display-only option (with no plaintext written to disk). The Advanced Version can be run silently from another application program to encrypt or decrypt files. It has a script language (with if-else-endif) which allows automation of frequently-performed, complex or conditional operations. The Advanced Version comes with utility programs to read multiple text files, compare files, purge files and wipe a disk clean of data; these can be called from scripts. The Dolphin Encryption Library is a C function library containing functions for encrypting and decrypting blocks of data in memory (from 1 byte to about 10K in size). Complete source code is included. Dolphin Encrypt is priced at $64.00 and the Advanced Version at $128.00. The function library is available for licensing to developers. For more information contact Dolphin Software at 4815 W. Braker Ln. #502, Austin, TX 78759 (phone 512-479-9208).

1 0

IMPORTANT--WE WON
by Sandy 17 Apr '93

17 Apr '93

_________________________________________________________________ FROM THE VIRTUAL DESK OF SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FIRST, THE BAD NEWS--The government wants to control encryption. Though they are playing coy about it, it's clear that eventually they will try to ban "the good stuff." It's clear Zimmermann, and others, have gotten their attention. NOW, THE GOOD NEWS--I t d o e s n o t m a t t e r. The game is over. We won. The government may engage in holding actions, but it still doesn't matter. What we have here, is the State's pitiful attempt to make the best of a bad situation. This amazing "policy" announcement is a tacit admission of defeat. HOW CAN I BE SO SURE?--The cat is out of the bag. Free, mil spec data encryption is readily available to all. Within a year, equivalent voice encryption freeware will join it. There is no way the government can stuff the encryption cat back in the bag. They can pass their laws. We will do as we please--and they will help us. THEY WILL *HELP* US?--The Administration's plan will have one, unintended, result. It will give legitimacy to privacy through encryption. Legitimacy will beget usage. And usage will mean TRAFFIC. Our securely encrypted messages will be hidden in plain sight. Whispers in a wind tunnel. One digitally encrypted phone call sound just like another--no matter what algorithm is used. A PLOY FOR THE PARANOID--Still think the Secret Service is going to get you? No problem. Just *PRE-encrypt* your phone or data communications with your home-made encryption unit, before you re-encrypt it using the government approved model. ("Hey, I don't know why you couldn't use your back door key to eavesdrop on my secure phone. Sounds like a personal problem to me.") THE ELECTRONIC FRONTIER FOUNDATION IS RIGHT, TOO--Yes, we can rejoice because we won. But it is still important to continue the fight against the State's last gasps. Even when the government is in random-walk mode, it's still possible to get stepped on. They have lost, but they can still do us plenty of damage. We should continue to press them on all fronts to secure our victory. But never doubt it, W E H A V E W O N. S a n d y _________________________________________________________________ PLEASE RESPOND TO: ssandfort(a)attmail.com (except from CompuServe) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

No Subject
by nobody＠pmantis.berkeley.edu 17 Apr '93

17 Apr '93

With regard to the White House's attempt to force the "Clipper" on you: I guess the time has come for the Cypherpunks to break their 'political teeth'. This issue is squarely on point with the purpose of the cpunks and needs to be addressed. The best thinkers on these topics are on this list (as are many libertarian thinkers). The Cypherpunks have gotten a fair amount of media play as of late and I think those interested in privacy and security are frothing at the mouth. I know in general cpunks dont believe in the necessity for leaders, but leader'ship' is a different matter. I believe that there are people here with the knowledge to fight against this proposal. So, Cypherpunks, step to the political plate. > In the past, it has >been possible to preserve a government capability to conduct >electronic surveillance in furtherance of legitimate law >enforcement and national security interests, while at the same time >protecting the privacy and civil liberties of all citizens. Just some levity to start off with :-) >The Attorney General of the United States, or her representative, >shall request manufacturers ... I read this differently than does Tim. "shall" coupled with "request" actually equals ambiguity and seems not to compel anyone. Im sure that the language was meant to confuse though. >In making this decision, I do >not intend to prevent the private sector from developing, or the >government from approving, other microcircuits or algorithms that >are equally effective in assuring both privacy and a secure key- >escrow system. Well, the door does still appear to be open for private circuit development and a better escrow system (better?). This does lend credence to the opinion that this may just be a very forceful suggestion and not an order per se. >The Attorney General shall make all arrangements with appropriate >entities to hold the keys for the key-escrow microcircuits >installed in communications equipment. Gotta agree with Tim that this appears to be an incredibly obvious backdoor to all telecommunications equipment. This should be made clear in any public statements about this document. > The Attorney >General shall review for legal sufficiency the procedures by which >an agency establishes its authority to acquire the content of such >communications. OK. This might be the key to the downfall of this proposal. The Govt appears to be showing its weak hand here. They have either not thouroughly addressed the legal concerns or they are standing on shaky legal ground. I believe there could be a number of problems (legally speaking) with the proposal. Seperation of Powers, Commerce concerns, penumbra Right to Privacy, etc just to name a few. Well, I guess Im off to the library to research another interesting, yet inapplicable directly to my legal studies, topic. (As if I dont spend enough time in the library) I guess if she's gonna review the legal sufficiency there should be no problem with me 'parallel processing' that same information. > Further, the Attorney General >shall utilize funds from the Department of Justice Asset Forfeiture >Super Surplus Fund to effect this purchase. Surplus...what happened to the defecit? :^) In general I believe that this event calls for a public expression of intellectual disagreement. An assertion of the power of the ideas expressed on this list will put the Cypherpunks in the discourse of public policy. Obviously, it should be well thought out and expressed in the most positive way. Calm, cool, calculated response will gain the cpunks respect, a knee jerk, emotional response will only get our ideas ignored. If politics doesn't work there also appears to be an economic out. Creating REAL encryptive circuits whose keys are not held by the government but rather by the owner. Private enterprise and a result to our concerns for liberty appear amenable. So any hardware cypherpunk hacks, get out your tools. Finally, a simple analogy. The current state of the law does not require me to register the key to my home with a government agency so that they can gain access to my home in a more efficient way if they feel the need. I keep the key and the control (until they break down my door). In that case, the value is placed on my freedom, not the efficiency with which the police could access my private communications. There are reasons that search warrents were 'initially' difficult to acquire and reasons why it should be difficult to access my home (i.e. they must break down my door.) Those reasons dealt with the severity of encroachment upon my privacy and rights thereto. In fact, that is the reason given for the remaining formalistic requirements of the necessity of prior judicial consent for warrents. No, the judge does not ponder long and hard about whether to give the warrent. Rather, the purpose is to give the officers pause. The ritual is designed to make the parties involved at least ponder the severity of their actions. This proposal would only make invasions of our privacy easier to achieve and eliminate obstacles in the way of officers, giving them even less time to ponder the severity of their encroachment. //////////////////////////////////////////////////////////////////////////////// VOLTAIRE Studying the law, Finding the flaws, Creating a light, Out of the night! //////////////////////////////////////////////////////////////////////////////// Tim- Aren't we closer than 10 mins. to midnight???????

1 0

a cypherpunk's clipper reaction
by Eric Hughes 17 Apr '93

17 Apr '93

Fellows: I will, in the coming weeks have much more to say on the matter of this Clipper chip proposal. For now, however, I have only one thing to say. No compromises. Eric

1 0

white house blunder
by Timothy Newsham 17 Apr '93

17 Apr '93

Even though the white house proposal may seem bad it could be used to your advantage in some ways: swap keys with someone else... if serial number isnt sent in transmission this takes gives a big headache when they try to decrypt your stream. use another encryption before sending to clipper chip... this way everything looks normal, and if they are playing according to the rules (cross fingers) they dont know anything is fishy until they try to get a warrant and decrypt. First keys wont match. When they do find the correct key they'll decrypt and get a file encrypted in another system. This might be great for averting suspicion of using another crypto- system. Everyone will be using clipper, and your message will look like its from the clipper chip. It wont look like an RSA file or DES'ed voice or whatever. The chip gives you a opaque (hopefully) envelope to put things into.

1 0

White House Encryption idea
by treason＠gnu.ai.mit.edu 17 Apr '93

17 Apr '93

Well, this all sounds fine and dandy, but... 1) They are not passing out the algorithym, and I dont trust ANYONE to tell me its secure. I am not a cryptographer, so it wouldn't help any if they gave the code to me, but it just being out there for public perusal helps me to think it IS secure. I trust no payola. 2) It is very possible that the 'criminal' effort may be able to modify these devices so that there is no possiblility for the agencies to decrypt their trasmissions (If it IS truly secure with no backdoors or decyphering possibilities) in which case, it can only harm the law abiding. 3) It allows the government the ability to determine WHAT encryption method industry uses, and they should be able to have a choice. Those who understand this very misleading comment will understand, those who do not, will prolly never be able to. 4) No explanation of what the 'key' contents are composed of (numbers, letters, alphanum, characters, some odd cyphercode???) is even implied. 5) No explanation of how the key is propegated or if it will even be needed for the remote site is mentioned. How are the remote sites going to decypher your cyphersounds(text)? There was no mention of further releases in information...is this all we get? treason@gnu

2 1

Re: Key Registration and Big Brother--Time to Fight!
by George A. Gleason 17 Apr '93

17 Apr '93

Instead of a conference call in clear voice, how about doing it online from the various meetings, and encrypted? What would it take to set up a broadcast encryption system that will work in chat mode...? A conference call in clear voice is almost certain to be monitored, and I would bet that it would yield a whole lot more high-grade intelligence than we would usually expect: first of all, voices of all participants (for later use in voiceprint recognition surveillance), second, all the background discussions, and third, a lot of the kind of deliberation and working-through-things that ordinarily gets filtered out by the process of posting things to this list. Yes, they can theoretically send visitors to our meetings. But realistically this is more labor intensive and potentially risky than recording a conference call which has all the meetings on line. Let's not go leaving any huge holes, please...! -gg

1 0