Tuesday, August 26, 1997

New York Times - New Subtle Bug Infests PGP

In other recent news, computer hackers at the Hacking In Progress conference also announced that they had scanned in a paper copy of the source code of PGP 5.0. The company released the source code to lessen the fears of users that a secret backdoor may have been inserted in the software.

Paper copies of the software were exported because the United States government has never objected to the export of paper. The paper versions are more obviously protected by the First Amendment than the electronic versions.

Sunday, August 10, 1997

Who's Hacking Whom? HOPE Springs in Manhattan

Melding Minds and Passions in the Global Bit Stream

What Galls a Hacker Most? The Metrocard

Cypherpunks list - CFP: What the Hack '05 and Blind Signature Expiration Party

HIP '97 and the Summer that surrounded it represented a pivotal event in my and many other attendee's lives. 1997 was the peek of the Crypto Wars: while strong cryptography was spreading rapidly throughout the world from authors outside the U.S., most, if not all, I consider dear friends, the U.S. Government continued to insist on imposing draconian export regulations. 3DES? 1024-bit RSA? Forget it.

In about May '97, PGP, Inc. released printed copies of the PGP 5 source code in full compliance with the U.S. export regulations in effect at the time. Electronic copy was illegal, but printed books were fine. Having attended the source code release event, at a Cypherpunks meeting, I walked away with two copies of the printed source. The source code books spanned many boxes. I hurt my back lifting those heavy boxes into the trunk of my car. My back to this day never fully recovered. Equally in compliance with the export laws, I immediately fedexed those boxes at my own expense to individuals in Europe standing by with scanners equipped with sheet feeders to OCR the source.

Three months later, the OCR effort had stalled. While most pages had been OCR'ed, passing the per-page checksums, many pages remained unprocessed. In some cases this was because one of the numerous proof readers failed to return the result. In the more challenging cases it was because the checksum differentiated between spaces and tabs. We learned that consumer-level OCR programs are dismal at differentiating between 5 or 6 leading spaces. Or a tab.

At HIP '97 on a camp ground near Amsterdam, many breakthroughs happened.

...

My precise words, if I recall correctly, were: "Come Hell or high water, before HIP is over, the proofreading of the PGP source code *will* be completed". Followed by a call for non-U.S. citizen volunteers to report to the Cypherpunks tent to finish the job. And finish the job they did. Visualize a scene most akin to "The Matrix", with a gaggle of volunteers frantically working on a row of computers held up by beer crates, writing scripts to brute force the OCR output past the checksums, while a raging party with dancers literally hanging off the rafters took up the core of the tent space, music blasting from the sound system in the early morning hours. Special thanks go to Ian Grigg, who lead the team of volunteers.

On the last day of HIP, the last page of the PGP 5 source had passed the last checksum. As the volunteers retired to bed after in most cases over 48 hours of straight work, one lone hold-out decided that now that the source code had been legally exported and turned into electronic form, somebody ought to compile it. He proceeded to compile the PGP 5 source on a PC that I had hand-carried to HIP in my luggage. The source compiled without errors. I was sound asleep at the time. By the time I woke up, cryptography had entered a new era: the U.S. Government, and in fact the entire world, woke up to a day from which on the only path remaing to stem the flow of strong crypto out of the U.S. was to ban books. And even the staunchest advocates of cryptographic export regulations knew that albeit the U.S. Supreme Court Justices may perhaps be bamboozled by declarations of the dangers of this new "Internet" thing, banning books was a proposal not in the least novel to the Court, standing no chance of meeting with the Justices approval.

Cornered into an untenable position and with no help from the courts in sight, the U.S. Government eventually acknowledged the inevitable and relaxed the exports laws for strong cryptography to the point of insignificance in January of 2000.

Saturday, August 9, 1997

A Community Sprouts In a Culture That Resists It

RADIO: interview with the Cypherpunks

PGP is a program protected by American law. This means that you are not allowed to export the program in its electronic form. The cypherpunks found a way around this problem, and think they'll have a legal running copy of PGP 5 this weekend.

Flickr - Image 7 - 8:9:97

Friday, August 8, 1997

Cypherpunks do it on paper

Exporting cryptology techniques from the USA is a criminal offense under the arms export law. You can go to jail for quite a long time for that. A lot of software is covered by this law, including for instance the Netscape versions using 128 bit encryption.

PGP, being encryption based, is covered by the law. The existing copies of PGP 5, floating on some FTP servers are therefore completely illegal since the program has been developed in the US.

What IS legal, however, is exporting the source code on paper. This has been done for the 8000 pages of the PGP source code. A print was taken out of the country - completely legally - and is in the process of being scanned and recompiled.

This is not without problems of course.

  • The first is organizational meaning you have to get 80 people to scan one hundred pages each and verify them.

  • The second problem is technical: the scans are not perfect. To help detecting errors in the scans, an intelligent checksum is added to the end of each page. If this checksum gets through undamaged, comparison with the checksum after scanning gives the line numbers where errors occurred. If the error is a simple one, like a '1' mistaken for an 'l' it is easily detected this way, but there are for instance problems detecting the differences between a tab and a number of spaces.

But very soon, after two months of work by 80 people, all Europeans, certainly no Americans - it is illegal for them to work on the translation, the program is nearly ready, so probably this weekend you can download and enjoy a LEGAL version of PGP.

Field of Wired Dreams: If You Build It, They Will Camp

Thursday, August 7, 1997

Hacking in Progress 1997

Narrator: Besides the decryption of data, the encryption is an important subject. The Cypherpunks introduce their mission as part of their several talks and workshops. Powerful encryption software is subject to military export restrictions in the United States. In order to legally export a new version of PGP, Pretty Good Privacy, the source code had to be transformed into print text. Thus, PGP could be exported legally as a book. Outside the U.S., the printed code was scanned and turned into software again by many volunteers.

Man: So that when some government says, "No, you can't have encryption, you little citizens," "Look, excuse me. We've already got it. Go away."

[applause]
The Program of Hacking In Progress
Cryptography overview PGP is a very popular tool for encryption and signing with number-theoretical methods like RSA or ElGamal. But there are more powerful applications of these and other algorithms, developed since the revival of cryptology in 1976:
  • blind signatures, electronic coins
  • authentification, the Kerberos system
  • anonymous communication through MIXes
  • electronic votes
  • calls for tenders via net
  • playing poker via net without getting cheated
  • authentification without transferring any information: zero-knowledge
  • exchanging information simultaniously
  • sharing secrets
  • quantum cryptology
This talk by Nils Toedtmann will introduce these applications, the used protocols and algorithms, including a discussion of their in)security.

2,000 Hackers, 6 Million bps, 800,000 Watts, 12 Toilets

Sunday, August 3, 1997

Cypherpunks list - Re: Tim Speaks the Truth / Re: Joichi Ito as a Junior Policeman

May: Wise up, Joichi. You live in society more totalitarian than anything we fear. Japanese citizen-units under video surveillance and afraid to speak out. And surveillance and espionage technology deployed by your fascist governmet--a term I mean literally, not casually--will worsen things dramatically.

The only "cooperation" with them is to seek their annihilation.

Cypherpunks list - Re: Tim Throws a "Leaner" / Re: Tim Speaks the Truth

May: ...he should hope to hell that he wakes up and realizes that not even in Japan can journalists--which is what I thought he once was, or claimed to be--serve on Ministry committees to decide how citizen-units may communicate!

...

I have cited the First, Second, and other provisions of the Constitution for the 5 years of this list. That I would prefer an even more anarchistic, market-oriented system than we now have, or that I dislike the hundreds of thousands of laws passed over the last 50 years, is no reason not to use the protections of the Constitution.  And the line between an anarchocapitalist and a strict constuctionist is fine indeed. Anyone who thinks this is "deceitful" is probably one of those folks who says, "Oh, yeah, well if you dislike government why don't you just refuse to drive on public roads? Some people are just born stupid. 

Cypherpunks list - Re: Tim Misfires / Re: Joichi Ito as a Junior Policeman

Ito: Really, what I am try to do is two things:

1) Make sure that Japan makes the right decision about crypto policy so that they do no stifle commercial development of crypto or put at risk national and individual security/privacy by implementing a weak system because of political pressure or domestic surveilance requirements.

2) Make sure that Japan does not repeat the US "Hacker Crackdown" and more recent Australian crackdowns which I think can cause a rift between hackers and society.

Cypherpunks list - Tim Misfires / Re: Joichi Ito as a Junior Policeman

TruthMonger: It is clearly up to Joichi Ito to decide how he can best work toward cypherpunk goals under his system of government, but he would do well to listen to those on the list who have seen more than a few crusaders sink into the swill when they make the mistake of talking to the piggies too close to the trough.

Cypherpunks list - Re: Joichi Ito as a Junior Policeman
Ito: Because, it would be much better to have it say, "we don't want key escrow." My position on the study group is much more like making a testimony in congress. Unlike the US, once a bill hits the floor, it is very hard to participate. I have to participate while it is still in the ministry level.

...

If you want to view me as "co-opted" that's fine. Without me, you would not have gotten Gilmore, Carl Ellison, or Whit Diffie's voice on the record during the study group hearings.

Friday, August 1, 1997

Cypherpunks list - Joichi Ito as Junior Policeman

May: And why are you helping to write a report that will be the "official position" of the Japanese cops?

... 

And why are working for the "Self Defense Force" (the Japanese DOD, for those not familiar with the terminology).

The JDF is notoriously militaristic. You should reconsider this.

And Cypherpunks should be very careful about "advising" an obviously co-opted member of the Japanese military and police establishment. 

Cypherpunks list - thanks...
Ito: It [i.e., Ito's report] should end up being the Japanese National Poice [sic] Agency's official position on Key Escrow, Certification Authorities, and several other issues.

38th Chaos Communication Congress