- cypherpunks-legacy@lists.ogf.org

Re: ANON: Chaining to Penet remailer
by nobody＠alumni.cco.caltech.edu 16 Apr '93

16 Apr '93

I am not very inclined to defend myself or my news.admin.policy postings, since saying someones an asshole seems to be what the group is for, but I am listening to the discussion and take seriously peoples crticisms and listening hard. FOr what it's worth, I said I was sorry but It pisses me off that when a nym tells some jerk to fuck off, everyone jumps all over me. EVen so, I'll listen to what people have to say since I don't want to lose access ... without the remailers I am Nowhere, Man. Isn't that ironic???

1 0

circling the wagons
by derek＠cs.wisc.edu 16 Apr '93

16 Apr '93

Assuming that the "Clipper chip" initiative isn't a teapot tempest, I suppose we'd better start sharpening our rhetorical knives. Privacy arguments and sheer outrage will be useful, but it seems to me that the "modern steganography" discussion from a few weeks back offers an irrefutable argument: By performing rather simple camouflaging, it is possible to make an encrypted message undetectable by encoding it in (images, voice, any other signal that could plausibly contain noise). This is rather easy to do, so those who REALLY want to hide what they're doing (terrorists, criminals, republican campaign staff) will still be able to do so. In fact, by encrypting the wrapper with your "Clipper" system, they look like they're hiding noting. All that you are buying is a false sense of security. derek

1 0

White House press release on encryption policy
by gnu 16 Apr '93

16 Apr '93

Note: This file will also be available via anonymous file transfer from csrc.ncsl.nist.gov in directory /pub/nistnews and via the NIST Computer Security BBS at 301-948-5717. --------------------------------------------------- THE WHITE HOUSE Office of the Press Secretary _________________________________________________________________ For Immediate Release April 16, 1993 STATEMENT BY THE PRESS SECRETARY The President today announced a new initiative that will bring the Federal Government together with industry in a voluntary program to improve the security and privacy of telephone communications while meeting the legitimate needs of law enforcement. The initiative will involve the creation of new products to accelerate the development and use of advanced and secure telecommunications networks and wireless communications links. For too long there has been little or no dialogue between our private sector and the law enforcement community to resolve the tension between economic vitality and the real challenges of protecting Americans. Rather than use technology to accommodate the sometimes competing interests of economic growth, privacy and law enforcement, previous policies have pitted government against industry and the rights of privacy against law enforcement. Sophisticated encryption technology has been used for years to protect electronic funds transfer. It is now being used to protect electronic mail and computer files. While encryption technology can help Americans protect business secrets and the unauthorized release of personal information, it also can be used by terrorists, drug dealers, and other criminals. A state-of-the-art microcircuit called the "Clipper Chip" has been developed by government engineers. The chip represents a new approach to encryption technology. It can be used in new, relatively inexpensive encryption devices that can be attached to an ordinary telephone. It scrambles telephone communications using an encryption algorithm that is more powerful than many in commercial use today. This new technology will help companies protect proprietary information, protect the privacy of personal phone conversations and prevent unauthorized release of data transmitted electronically. At the same time this technology preserves the ability of federal, state and local law enforcement agencies to intercept lawfully the phone conversations of criminals. A "key-escrow" system will be established to ensure that the "Clipper Chip" is used to protect the privacy of law-abiding Americans. Each device containing the chip will have two unique 2 "keys," numbers that will be needed by authorized government agencies to decode messages encoded by the device. When the device is manufactured, the two keys will be deposited separately in two "key-escrow" data bases that will be established by the Attorney General. Access to these keys will be limited to government officials with legal authorization to conduct a wiretap. The "Clipper Chip" technology provides law enforcement with no new authorities to access the content of the private conversations of Americans. To demonstrate the effectiveness of this new technology, the Attorney General will soon purchase several thousand of the new devices. In addition, respected experts from outside the government will be offered access to the confidential details of the algorithm to assess its capabilities and publicly report their findings. The chip is an important step in addressing the problem of encryption's dual-edge sword: encryption helps to protect the privacy of individuals and industry, but it also can shield criminals and terrorists. We need the "Clipper Chip" and other approaches that can both provide law-abiding citizens with access to the encryption they need and prevent criminals from using it to hide their illegal activities. In order to assess technology trends and explore new approaches (like the key-escrow system), the President has directed government agencies to develop a comprehensive policy on encryption that accommodates: -- the privacy of our citizens, including the need to employ voice or data encryption for business purposes; -- the ability of authorized officials to access telephone calls and data, under proper court or other legal order, when necessary to protect our citizens; -- the effective and timely use of the most modern technology to build the National Information Infrastructure needed to promote economic growth and the competitiveness of American industry in the global marketplace; and -- the need of U.S. companies to manufacture and export high technology products. The President has directed early and frequent consultations with affected industries, the Congress and groups that advocate the privacy rights of individuals as policy options are developed. 3 The Administration is committed to working with the private sector to spur the development of a National Information Infrastructure which will use new telecommunications and computer technologies to give Americans unprecedented access to information. This infrastructure of high-speed networks ("information superhighways") will transmit video, images, HDTV programming, and huge data files as easily as today's telephone system transmits voice. Since encryption technology will play an increasingly important role in that infrastructure, the Federal Government must act quickly to develop consistent, comprehensive policies regarding its use. The Administration is committed to policies that protect all Americans' right to privacy while also protecting them from those who break the law. Further information is provided in an accompanying fact sheet. The provisions of the President's directive to acquire the new encryption technology are also available. For additional details, call Mat Heyman, National Institute of Standards and Technology, (301) 975-2758. - - --------------------------------- QUESTIONS AND ANSWERS ABOUT THE CLINTON ADMINISTRATION'S TELECOMMUNICATIONS INITIATIVE Q: Does this approach expand the authority of government agencies to listen in on phone conversations? A: No. "Clipper Chip" technology provides law enforcement with no new authorities to access the content of the private conversations of Americans. Q: Suppose a law enforcement agency is conducting a wiretap on a drug smuggling ring and intercepts a conversation encrypted using the device. What would they have to do to decipher the message? A: They would have to obtain legal authorization, normally a court order, to do the wiretap in the first place. They would then present documentation of this authorization to the two entities responsible for safeguarding the keys and obtain the keys for the device being used by the drug smugglers. The key is split into two parts, which are stored separately in order to ensure the security of the key escrow system. Q: Who will run the key-escrow data banks? A: The two key-escrow data banks will be run by two independent entities. At this point, the Department of Justice and the Administration have yet to determine which agencies will oversee the key-escrow data banks. Q: How strong is the security in the device? How can I be sure how strong the security is? A: This system is more secure than many other voice encryption systems readily available today. While the algorithm will remain classified to protect the security of the key escrow system, we are willing to invite an independent panel of cryptography experts to evaluate the algorithm to assure all potential users that there are no unrecognized vulnerabilities. Q: Whose decision was it to propose this product? A: The National Security Council, the Justice Department, the Commerce Department, and other key agencies were involved in this decision. This approach has been endorsed by the President, the Vice President, and appropriate Cabinet officials. Q: Who was consulted? The Congress? Industry? A: We have on-going discussions with Congress and industry on encryption issues, and expect those discussions to intensify as we carry out our review of encryption policy. We have briefed members of Congress and industry leaders on the decisions related to this initiative. Q: Will the government provide the hardware to manufacturers? A: The government designed and developed the key access encryption microcircuits, but it is not providing the microcircuits to product manufacturers. Product manufacturers can acquire the microcircuits from the chip manufacturer that produces them. Q: Who provides the "Clipper Chip"? A: Mykotronx programs it at their facility in Torrance, California, and will sell the chip to encryption device manufacturers. The programming function could be licensed to other vendors in the future. Q: How do I buy one of these encryption devices? A: We expect several manufacturers to consider incorporating the "Clipper Chip" into their devices. Q: If the Administration were unable to find a technological solution like the one proposed, would the Administration be willing to use legal remedies to restrict access to more powerful encryption devices? A: This is a fundamental policy question which will be considered during the broad policy review. The key escrow mechanism will provide Americans with an encryption product that is more secure, more convenient, and less expensive than others readily available today, but it is just one piece of what must be the comprehensive approach to encryption technology, which the Administration is developing. The Administration is not saying, "since encryption threatens the public safety and effective law enforcement, we will prohibit it outright" (as some countries have effectively done); nor is the U.S. saying that "every American, as a matter of right, is entitled to an unbreakable commercial encryption product." There is a false "tension" created in the assessment that this issue is an "either-or" proposition. Rather, both concerns can be, and in fact are, harmoniously balanced through a reasoned, balanced approach such as is proposed with the "Clipper Chip" and similar encryption techniques. Q: What does this decision indicate about how the Clinton Administration's policy toward encryption will differ from that of the Bush Administration? A: It indicates that we understand the importance of encryption technology in telecommunications and computing and are committed to working with industry and public-interest groups to find innovative ways to protect Americans' privacy, help businesses to compete, and ensure that law enforcement agencies have the tools they need to fight crime and terrorism. Q: Will the devices be exportable? Will other devices that use the government hardware? A: Voice encryption devices are subject to export control requirements. Case-by-case review for each export is required to ensure appropriate use of these devices. The same is true for other encryption devices. One of the attractions of this technology is the protection it can give to U.S. companies operating at home and abroad. With this in mind, we expect export licenses will be granted on a case-by-case basis for U.S. companies seeking to use these devices to secure their own communications abroad. We plan to review the possibility of permitting wider exportability of these products.

1 0

FWEE!: alt.prematurity
by internaut＠aol.com 16 Apr '93

16 Apr '93

*/ Ladies & Germs, /* Certain cpunks have called for the immediate establishment of alt.whistleblowerson Usenet. I have noted a certain respect for engineering matters in these notes, but a lack of acknowledgement for the "other" business involved in setting up a serious whistleblower service. I beg your attention for a moment whilst I toss in my two cents: As I am the person doing some of the legwork to establish the body of Users/Subscribers for the alt.wb service (in my spare time), I would like to request that this action NOT be taken at this time. I am as anxious as anyone to see this become a reality, but I have learned over the years that both information services and sex can be ruined by prematurity. You're welcome to screw up your sex lives by cumming in your pants too soon, but PLEASE don't give saddle this potentially IMPORTANT information service a huge birth defect by putting it out before I am ready. There, I've admitted it, I am not ready yet (nor are the Users). If it flies before I can set up the org's that will take advantage of it, it would not be a good thing, IMHO. I have mentioned prematurity before this and have been roundly ignored, to my chagrin. Alas... I am not suggesting that we can't begin exPERimenting in SOME way to get the technology right, but I AM saying that we have a LOT of work to do if we want this service to mean anything. On the other hand, if we're just a bunch of engineers jacking off over our ideas, and not true crusaders trying to invent a new method for busting sniveling government weasel-embezzelers, then who am I to stop y'all? Gee, Dave, just _why_ is it a bad idea right now? - Not enough people are educated enough to use it. I have spoken with Congressional staffers, media people and several activist orgs. They all need either email accounts, PGP software and some readme files (or all three) before they can take advantage of any WB info. They're not even sure how to approach the issue of verification and we'll have to help them with this concept. Imagine Picasso pitching the wonders of Assymetry to an audience of People Who've Never Heard of Painting. - We haven't figured out who'll be polled to send in msgs and exactly HOW we'll offer them some sort of anonymity and what they need to do afterward. It should be a select group at first, but we have not established the guidelines for this service. Putting it out without any kind of guidelines could be disastrous. This is the Trusted Reputation Issue. Please do not underestimate this. - Not a single cpunk has yet submitted any suggestions to me for the Guidelines as I have asked twice. Not one person. Do that first, O Verbose Ones! After we build such a document and have prominent people (such as Nicholas Johnson, former FCC head under L.B.Johnson - "eh... no relation") sign statements of support based on it (as discussed before, with I think, nearly unanimous approval), then we can more _safely_ proceed. Have you heard of the Declaration of Independence? They prepared that document well, got all their Ducks in a Row and it's lasted for over 200 years. How many decades do you think a good WB system could last/evolve for? I ask only that you engage your long-range vision for a moment. - Except for good ol' John Gilmore, no one has sent me their pubkey for the list of volunteers after I publicly requested same some weeks back. Belly up to the Bar, Dewds. - ? There are other excellent reasons to keep it in our collective pants for a while, but if THESE don't convince you, then perhaps I am asking the wrong group of folks to help get this started properly. I suggest that we set up a dummy area and begin to conduct some experiments ala Tim May's F117A bogus post. Hopefully, this will allow our more impatient members to spew to their heart's delight while the rest of us continue with the legwork and phonework to give it social armor. Anybody can put a box out on the street and say "everybody put your complaints in here," but it takes some real thinkers to put out a serious whistleblower system. Lastly, I ask your forgiveness for all my sins... dave PS: Only kiddin', I never sin. Well, hardly ever these days. Well, pretty often then, but I keep it to a few times a day. OK, well, maybe hourly, but I'm really acting in the best interest of everyone. OK, I lied, I sin and sin and sin every second of my existence. ...So sue me!

2 1

White House announcement on encryption--FORWARDED
by tcmay＠netcom.com 16 Apr '93

16 Apr '93

Cypherpunks, Here's a message from sci.crypt that's of relevance to us in several ways. I assume from its length, seriousness, and wording that it's not a spoof...I can't check the White House's signature! Some messages: 1. It tells us what Denning and Rivest were probably actually working on when they floated their "trial balloons" last summer and fall. 2. A goverment-sanctioned phone encryption technique has implications for the phone encryption topics we've discussed at the Cypherpunks meetings (notably with Paul Rubin and Whit Diffie). 3. As always, end-to-end encryption, bypassing such schemes as this, is looking better and better. 4. It is not clear if the government scheme will legally preclude other encryption schemes. 5. I expect a lively debate will soon take place in sci.crypt. Newsgroups: sci.crypt Path: netcom.com!netcomsv!decwrl!uunet!dove!csrc.ncsl.nist.gov!clipper From: clipper(a)csrc.ncsl.nist.gov (Clipper Chip Announcement) Subject: text of White House announcement and Q&As on clipper chip encryption Message-ID: <C5L17v.GH5(a)dove.nist.gov> Sender: news(a)dove.nist.gov Organization: National Institute of Standards & Technology Distribution: na Date: Fri, 16 Apr 1993 15:19:06 GMT Lines: 282 Note: This file will also be available via anonymous file transfer from csrc.ncsl.nist.gov in directory /pub/nistnews and via the NIST Computer Security BBS at 301-948-5717. --------------------------------------------------- THE WHITE HOUSE Office of the Press Secretary _________________________________________________________________ For Immediate Release April 16, 1993 STATEMENT BY THE PRESS SECRETARY The President today announced a new initiative that will bring the Federal Government together with industry in a voluntary program to improve the security and privacy of telephone communications while meeting the legitimate needs of law enforcement. The initiative will involve the creation of new products to accelerate the development and use of advanced and secure telecommunications networks and wireless communications links. For too long there has been little or no dialogue between our private sector and the law enforcement community to resolve the tension between economic vitality and the real challenges of protecting Americans. Rather than use technology to accommodate the sometimes competing interests of economic growth, privacy and law enforcement, previous policies have pitted government against industry and the rights of privacy against law enforcement. Sophisticated encryption technology has been used for years to protect electronic funds transfer. It is now being used to protect electronic mail and computer files. While encryption technology can help Americans protect business secrets and the unauthorized release of personal information, it also can be used by terrorists, drug dealers, and other criminals. A state-of-the-art microcircuit called the "Clipper Chip" has been developed by government engineers. The chip represents a new approach to encryption technology. It can be used in new, relatively inexpensive encryption devices that can be attached to an ordinary telephone. It scrambles telephone communications using an encryption algorithm that is more powerful than many in commercial use today. This new technology will help companies protect proprietary information, protect the privacy of personal phone conversations and prevent unauthorized release of data transmitted electronically. At the same time this technology preserves the ability of federal, state and local law enforcement agencies to intercept lawfully the phone conversations of criminals. A "key-escrow" system will be established to ensure that the "Clipper Chip" is used to protect the privacy of law-abiding Americans. Each device containing the chip will have two unique 2 "keys," numbers that will be needed by authorized government agencies to decode messages encoded by the device. When the device is manufactured, the two keys will be deposited separately in two "key-escrow" data bases that will be established by the Attorney General. Access to these keys will be limited to government officials with legal authorization to conduct a wiretap. The "Clipper Chip" technology provides law enforcement with no new authorities to access the content of the private conversations of Americans. To demonstrate the effectiveness of this new technology, the Attorney General will soon purchase several thousand of the new devices. In addition, respected experts from outside the government will be offered access to the confidential details of the algorithm to assess its capabilities and publicly report their findings. The chip is an important step in addressing the problem of encryption's dual-edge sword: encryption helps to protect the privacy of individuals and industry, but it also can shield criminals and terrorists. We need the "Clipper Chip" and other approaches that can both provide law-abiding citizens with access to the encryption they need and prevent criminals from using it to hide their illegal activities. In order to assess technology trends and explore new approaches (like the key-escrow system), the President has directed government agencies to develop a comprehensive policy on encryption that accommodates: -- the privacy of our citizens, including the need to employ voice or data encryption for business purposes; -- the ability of authorized officials to access telephone calls and data, under proper court or other legal order, when necessary to protect our citizens; -- the effective and timely use of the most modern technology to build the National Information Infrastructure needed to promote economic growth and the competitiveness of American industry in the global marketplace; and -- the need of U.S. companies to manufacture and export high technology products. The President has directed early and frequent consultations with affected industries, the Congress and groups that advocate the privacy rights of individuals as policy options are developed. 3 The Administration is committed to working with the private sector to spur the development of a National Information Infrastructure which will use new telecommunications and computer technologies to give Americans unprecedented access to information. This infrastructure of high-speed networks ("information superhighways") will transmit video, images, HDTV programming, and huge data files as easily as today's telephone system transmits voice. Since encryption technology will play an increasingly important role in that infrastructure, the Federal Government must act quickly to develop consistent, comprehensive policies regarding its use. The Administration is committed to policies that protect all Americans' right to privacy while also protecting them from those who break the law. Further information is provided in an accompanying fact sheet. The provisions of the President's directive to acquire the new encryption technology are also available. For additional details, call Mat Heyman, National Institute of Standards and Technology, (301) 975-2758. --------------------------------- QUESTIONS AND ANSWERS ABOUT THE CLINTON ADMINISTRATION'S TELECOMMUNICATIONS INITIATIVE Q: Does this approach expand the authority of government agencies to listen in on phone conversations? A: No. "Clipper Chip" technology provides law enforcement with no new authorities to access the content of the private conversations of Americans. Q: Suppose a law enforcement agency is conducting a wiretap on a drug smuggling ring and intercepts a conversation encrypted using the device. What would they have to do to decipher the message? A: They would have to obtain legal authorization, normally a court order, to do the wiretap in the first place. They would then present documentation of this authorization to the two entities responsible for safeguarding the keys and obtain the keys for the device being used by the drug smugglers. The key is split into two parts, which are stored separately in order to ensure the security of the key escrow system. Q: Who will run the key-escrow data banks? A: The two key-escrow data banks will be run by two independent entities. At this point, the Department of Justice and the Administration have yet to determine which agencies will oversee the key-escrow data banks. Q: How strong is the security in the device? How can I be sure how strong the security is? A: This system is more secure than many other voice encryption systems readily available today. While the algorithm will remain classified to protect the security of the key escrow system, we are willing to invite an independent panel of cryptography experts to evaluate the algorithm to assure all potential users that there are no unrecognized vulnerabilities. Q: Whose decision was it to propose this product? A: The National Security Council, the Justice Department, the Commerce Department, and other key agencies were involved in this decision. This approach has been endorsed by the President, the Vice President, and appropriate Cabinet officials. Q: Who was consulted? The Congress? Industry? A: We have on-going discussions with Congress and industry on encryption issues, and expect those discussions to intensify as we carry out our review of encryption policy. We have briefed members of Congress and industry leaders on the decisions related to this initiative. Q: Will the government provide the hardware to manufacturers? A: The government designed and developed the key access encryption microcircuits, but it is not providing the microcircuits to product manufacturers. Product manufacturers can acquire the microcircuits from the chip manufacturer that produces them. Q: Who provides the "Clipper Chip"? A: Mykotronx programs it at their facility in Torrance, California, and will sell the chip to encryption device manufacturers. The programming function could be licensed to other vendors in the future. Q: How do I buy one of these encryption devices? A: We expect several manufacturers to consider incorporating the "Clipper Chip" into their devices. Q: If the Administration were unable to find a technological solution like the one proposed, would the Administration be willing to use legal remedies to restrict access to more powerful encryption devices? A: This is a fundamental policy question which will be considered during the broad policy review. The key escrow mechanism will provide Americans with an encryption product that is more secure, more convenient, and less expensive than others readily available today, but it is just one piece of what must be the comprehensive approach to encryption technology, which the Administration is developing. The Administration is not saying, "since encryption threatens the public safety and effective law enforcement, we will prohibit it outright" (as some countries have effectively done); nor is the U.S. saying that "every American, as a matter of right, is entitled to an unbreakable commercial encryption product." There is a false "tension" created in the assessment that this issue is an "either-or" proposition. Rather, both concerns can be, and in fact are, harmoniously balanced through a reasoned, balanced approach such as is proposed with the "Clipper Chip" and similar encryption techniques. Q: What does this decision indicate about how the Clinton Administration's policy toward encryption will differ from that of the Bush Administration? A: It indicates that we understand the importance of encryption technology in telecommunications and computing and are committed to working with industry and public-interest groups to find innovative ways to protect Americans' privacy, help businesses to compete, and ensure that law enforcement agencies have the tools they need to fight crime and terrorism. Q: Will the devices be exportable? Will other devices that use the government hardware? A: Voice encryption devices are subject to export control requirements. Case-by-case review for each export is required to ensure appropriate use of these devices. The same is true for other encryption devices. One of the attractions of this technology is the protection it can give to U.S. companies operating at home and abroad. With this in mind, we expect export licenses will be granted on a case-by-case basis for U.S. companies seeking to use these devices to secure their own communications abroad. We plan to review the possibility of permitting wider exportability of these products. -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available.

1 0

Proposal for anon chaining
by jthomas＠coconut.mitre.org 16 Apr '93

16 Apr '93

KINNEY WILLIAM H <kinney(a)spot.colorado.edu> writes: > Recent traffic on anonymous remailers/servers: > > >From: Eli <ebrandt(a)jarthur.claremont.edu> > >> From: Hal <74076.1041(a)CompuServe.COM> > >> This method of posting does not allow you to receive replies. I have set > >> "nicknames" for these two accounts as "Untraceable account" which will appear > > >in the "From" line on the postings. Hopefully that will offer a clue that > > >the normal reply mechanism doesn't work. Maybe the nickname should say so > >> more explicitly? > > > > > >The security provided by this technique could be provided without > >the IMHO serious disadvantage of having no return address. Eric's > >hybrid approach, where a pseudonym server hands mail to an remailer > >chain, is secure (barring sophisticated traffic analysis) if you > >trust the last remailer in the chain. Julf, have you thought about > >whether you want to do something like this? > > > Hal > > Here's an idea I haven't seen suggested before, which would remove the need > for a pseudonym server: > > [Description of chain-encrypted header info, separated from message text] > > This seems to me to be a very robust pseudonymous mail system which > could be implemented by relatively minor changes to the existing Cypherpunk > remailer structure. It has the additional advantage of being decentralized > and maintenance-free. It could be used for pseudonyms on net news, e-mail, > wherever, and could presumably be integrated in some way into Julf's > anon server. > Yes, this would seem to be the way to do this, and this type of nested-encrypted routing information is what I was referring to as an "SASE" in my front-end/back-end anonymous posting design. There are some drawbacks, however. Traffic analysis by watching a remailer's feed, and seeing messages come in and go back out is much easier, since the message _text_ is unchanged from one remailer to the next. In fact, however, such traffic analysis is not difficult with the present system, since message lengths can be used to correlate messages going in and out, and the remailers aren't getting enough traffic to do much internal "mixing" to avoid obvious FIFO behavior. The obvious solutions are a remailing protocol that supports padding out messages to a few "standard" lengths, and increasing the remailer traffic, perhaps with dummy messages. But this doesn't help in the above case, when routing information is separate from message text, and not known to the sender (except for the first hop). One possible solution relies on the fact that each remailer must know the next hop a message will take. When the remailer is forwarding mail with separately encrypted header information, it will append some random bits to the message, then encrypt it with the next remailer's public key. (Note that if the appending of random bits is skipped, the system provides no security against traffic analysis, since the adversary can simply try encrypting incoming messages with various remailers' public keys, then watch to see if that message comes back out). I've got some more ambitious ideas for this (encrypted return addresses as a MIME content-type?), but I think the version outlined above could be implemented pretty easily, although I admit I haven't really read through the remailer scripts. I'll take a crack at it as soon as I get my Linux box (a couple weeks) if people think it's a good idea. Joe

1 0

Dorothy Denning's friends strike
by Perry E. Metzger 16 Apr '93

16 Apr '93

To: cypherpunks(a)toad.com, libernet(a)dartmouth.edu, extropians(a)gnu.ai.mit.edu [Libernet readers -- please do not follow up on libernet, as it is only for announcements. All readers -- please do not CC lists you are not on with replies.] According to a front page article in today's New York Times, the Clinton Administration is going to be releasing a standard encryption technology that commercial users will be encouraged to adopt that involves having the government keep copies of "back door" keys associated with every device deployed. The article is entitled, with unintentional irony, "Communications Plan to Balance Government Access with Privacy". The article indicates that the move is "inteded to resolve a long standing dilema[...] how to preserve the legitimate right for businesses and citizens to use codes [...] without letting criminals and terrorists conspire beyond the reach of the law". The implications are obvious. Perry Metzger

1 0

ANON: Chaining to Penet remailer
by Hal 16 Apr '93

16 Apr '93

Well, after a fair amount of experimentation I have learned who the mysterious an10757(a)anon.penet.fi is. It's me. Or, more specifically, it is my remailer operating at hal(a)alumni.caltech.edu. If you send mail from this remailer to anon.penet.fi for posting or remailing it is identified as comin from an10757, the same address used in the post by "Nowhere, Man". This address is different from the address I get if I just send to ping(a)anon.penet.fi from that account. I think the reason is that the mail sent from the remailer is identified as comin from "nobody" instead of "hal" in the From: field. This causes Julf's remailing software to assign a different anonymous ID. I don't see any problems with this (not right away, anyway) and in fact it seems to me to be a desirable feature. I think we should document this for people who want to use the Penet remailer for posting, in a more untraceable way. Send mail to either: hal(a)alumni.caltech.edu (posts as an10757(a)anon.penet.fi) hfinney(a)shell.portal.com (posts as an19579(a)anon.penet.fi) Have as the first lines of your message: :: Request-Remailing-To: anon(a)anon.penet.fi X-Anon-To: news.admin.policy Follow this with a blank line, then your message. Put whatever newsgroups you like (separated by commas) after X-Anon-To. This method of posting does not allow you to receive replies. I have set "nicknames" for these two accounts as "Untraceable account" which will appear in the "From" line on the postings. Hopefully that will offer a clue that the normal reply mechanism doesn't work. Maybe the nickname should say so more explicitly? I believe this approach would work with most of the other Cypherpunks remailers. The one thing for remailer operators to watch out for is what is put in the From: line when the remailer sends it. You want it to be different from your regular account name or else your anonymous ID will be used for all messages through that remailer. Naturally, this is vulnerable to abuse. If "Nowhere" or someone else continues to post obscenities and flames then Julf may have to block off all of our cypherpunks remailers, which would be unfortunate. Until there are more remailers I think anonymous posters need to continue to exercise some self- restraint. Hal

2 1

WARNING: Pointer article to soc.whistleblowers debate
by rclark＠nyx.cs.du.edu 16 Apr '93

16 Apr '93

The news software has been activated. David Tale has accepted the article, sans a paragraph specifying a procedural point (which I didn't think would fly, anyway) and bagging alt.sex and alt.drugs from the discussion, but keeping many others; I think if I hadn't put those two in, he might have knocked out a few I was serious about. So, in any case, the article, in a modified form, partially by me and partially by Tale, is now posted to news.announce.newgroups, and the debate shall begin shortly. Those of you who consider this newsgroup a beneficial and good thing, and who wish to discuss its implementation and name and other germane issues, should immediately go to news.groups and begin posting like lunatics. Those of you who consider this newsgroup a menace to society should go to news.groups and post scathing articles about my sexual preferences. (Humor, of course.) In any case, I have not identified myself as a cypherpunk or, for that matter, as an Extropian, not having the boundless arrogance to presume that cypherpunks all share my opinion of the methods of implementing this; so those of you who do agree with me, or disagree only on procedural points, should post your opinion; people have a larger tendency to vote YES when they think others agree with them. Also try to avoid excessively inflammatory postings (on the order of "You fucking moron, how DARE you disagree with me."), as these will tend to garner a bunch of NOs. I don't mean be a total schmuck and bend over backwards for a flaming, but flame back in a constructive spirit and without senseless _ad hominem_ attacks. I hope that this group can be created with as little sturm and drang as possible, but if it _does_ require sturm OR drang OR both, heat may need to be applied. Again, post whether or not you agree. And don't send votes yet, of course. I'll just junk them, according to net.law. If the cypherpunks wish to present this as a cypherpunk issue, or if individuals wish to support it as individuals, feel free. I'm not going to attach the name 'cypherpunk' to it myself because, not to be rude, it would further politicize an already highly-politicized issue. However, if we'd be more effective as THE DREADED Extropians/Cypherpunks bloc, which I don't think is necessarily the case, feel free. It's not my net. Apologies are extended for the lengthy crosspost, but it shall be the last crosspost; further discussion ought to occur in news.groups. And battle plans in cypherpunks, if we even need battle plans. With any luck, there won't be a battle. If we sneak this in by acclamation without a flamewar or controversy, we're ENTRENCHED. NOBODY can stop us, or any other people who could utilize this most valuable resource. But I'm not holding my breath on that one. Although I cross-posted mainly to groups with a large population of potential YES voters, and ignored, say, news admin hangouts, those who would oppose this are sure to find out about it; but I think we can muster sufficient political clout to pass this. Me? I'm currently going to enlist some old friends from talk.bizarre. . . Don't worry, they're not the current crop but the same crowd that passed comp.protocols.tcp-ip.eniac. I'll ask for as little inflammatory material as possible, like I did here, but I don't want this to become any more of a flamewar than necessary, and, again and for the last time, would prefer it didn't end up that way at all. End of crosspost. We now return you to your regular round of discussing radix sorts and monozygotic recessives. Thank you. ---- Robert W. Clark rclark(a)nyx.cs.du.edu PGP signature available by mail or finger

1 0

SOURCE to Macintosh PGP 2.2 released
by grady＠netcom.com 15 Apr '93

15 Apr '93

Complete Symantec THINK C 5.0.4 source code including projects and user documentation is available via anonymous FTP from: netcom.com [192.100.81.100] in directory pub/grady file is type ASCII, Compact Pro .sea processed with BinHex 4.0. MGET MacPGP2.2src.sea.hqx MGET MacPGP2.2srcSIGNATURE HQX file is digitally signed by me; verification of signature via public key servers or by phone. Please distribute this code widely -- read the READ ME file included with the package.

1 0