April 1993 - cypherpunks-legacy

I don't take it personally...
by tcmay＠netcom.com 30 Apr '93

30 Apr '93

Just to let you folks know, I don't take some of the comments I've been seeing here (and in e-mail) personally. That is, I fully understand that emotions run high around these topics, especially about PGP, the Clipper Chip, and patents on software. This list is for discussion, even heated discussion. We're not here to just complain about things we all despise, like the Clipper chip...for that you can read sci.crypt. I've posted my thoughts and suggestions in this spirit. I'm not in a policy-making position (how many of us are?), so some of the stronger comments about how I'm reorienting the Cypherpunks list seem, well, inappropriate. That others have said much the same thing says this is a legitimate issue to discuss on this list. By the way, I responded at length to Matthew J Miszewski's posting because that's the one I saw first. The equally well-written critiques of my points by Lance Dettweiler and Hal Finney did not arrive at my site until sometime after 2 a.m. this morning, when I last checked...though they were written and posted half a day earlier than Matt's posting. Odd delays we're having. I won't answer their point-by-point critiques, as I think my follow-up to Matt and the various other posts by Eric, Pat Farrell, Stanton M., and others have gotten the issues aired. Just to repeat, I'm not in the thrall of RSA or anyone else. I just think the issues are much larger. I'm not saying we shouldn't use PGP, nor am I suggesting Jim Bidzos should serve arrest warrants at our Cypherpunks meetings (I got a kick out of that really "over the top" charge...I took no offense1). I don't set policy for you folks. Nobody does. I'm just one more voice. Discussion won't hurt this list--if it can, then we're really in trouble. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, smashing of governments. Higher Power: 2^756839 | Public Key: in a state of flux! Waco Massacre + Big Brother Wiretap Chip = A Nazi Regime

1 0

npr report
by jet＠nas.nasa.gov 30 Apr '93

30 Apr '93

from the NPR report: > "The mechanism is very much like what the real estate agents do with > houses. Right, they take you to show you a house and they don't have a > key to that house in their pockets. But they get to the house, and > there's a lock box hanging on the front door. And they have a master key > in their pockets, and they open the lock box, and take out the key to the > door, and open the front door, and go in and show you the house." This is a *wonderful* analogy. Imagine if one could not buy a set of locks for their house w/o buying the government lock-box to go beside the front door.

1 0

PGP vs. RSADSI--what conflict?
by fnerd＠smds.com 30 Apr '93

30 Apr '93

Cypherpholks-- Neither abandoning PGP nor antagonizing RSADSI seem necessary to me. This letter makes a 3/4 page summary of that belief after which I mention some interesting side issues. Eric Hughes' understanding of the situation confirms my intuitions-- RSADSI pretty much has to either act the way it's acting or else just roll over. and They seem agreeable to a technically good PGP/RSAREF connection. but That's work. On the middle point, in particular I don't think they'll insist we use DES or a slow engine. For people who don't get why those restriction seem to be there but aren't, I suggest rereading Eric's article. Although I have strong feelings about the patent issue, and although it affects the privacy issue, I definitely put the privacy issue first. Given that it seems we can separate the two issues, I don't see why we shouldn't. Although I agree with Tim that being non-confrontative with RSADSI is smart, I don't see PGP and RSADSI as quite so hard to reconcile as he seems to: > If the government ever outlaws strong crypto, you can be sure I'll be > using outlaw crypto. The difference with the current situation is > that crypto per se has not yet come under regulation.) And PGP per se is not outlaw. Only the current version and lack of license. Let's conceptually separate PGP, Phil's RSA/MD5 engine (PGRE?), and using/ distributing PGRE in the USA. Only the third is a problem with RSADSI. > ...bootleg > crypto (which is what PGP will remain in this country unless and until the > courts overturn the patents or RSA suddenly decides to cave in)... Pshaw. Until it's worked out. No "sudden caving in" is needed. Tim, you were the one who reported that Jim Bidzos was sounding agreeable. > Furthermore, neither Phil nor any other members of the development team are > likely to ever make any money with this ^^^^ PGRE Phil could finally solicit shareware fees. Now the side issues: There could conceivably be an issue in the future for people working with RSAREF--who have SEEN THE CODE--and then wanting to develop other crypto stuff later. People have attempted to avoid this legal hassle in the past by setting up a "clean room" where only specs and interfaces are known... RSAREF is copyrighted stuff, right?, which puts you in a slightly different legal position when you have it/distribute it. Assuming PGP gets a license to be shareware, I see this being less of a problem than the current situation. But even if PGP gets some kind of license, would individuals still have to sign agreements with RSADSI? I feel more serious about personal agreements than copyrights or patents. Will it be the standard RSAREF individual license? Does it require you to *act as if* they had rights some of us care about them not having? (Rights to the specific code don't bother me too much.) > (isn't e-mail great?...Stanton posts it, and Jim Bidzos, the > Pres. of RSA responds...no lawyers were needed, no lengthy delays.). At the CFP conference that Tim missed ~{;o), Cliff Stoll was remarking that eventually all sorts of nasty things happen related to the net--except lawsuits. We guessed that the availability of the quick, public response might have a lot to do with that. Here we have a threat; can anyone think of an example of an email-related suit that was carried through? -phnerd, er, fnerd quote me --fnerd(a)smds.com (FutureNerd Steve Witham)

1 0

Re: PGP on soda.berkeley.edu
by geoffw＠nexsys.net 30 Apr '93

30 Apr '93

> > It follows, doesn't it, that Jim Bidzos would be forced to apply similar > legal pressure to the Cypherpunks leadership to get them to remove PGP from > their site, a site which may be one of the leaders worldwide in distributing > PGP. > > Now we see Tim suggesting (in the spirit of "pancritical rationalism"? I'm > not so sure...) that we move away from PGP, and Eric offering arguments > showing why Bidzos has to do what he is doing. > > Is there a connection? Are Tim and Eric under pressure from Bidzos to get > PGP off their site? I don't know, but they would certainly be likely > targets for Bidzos' efforts, and so it is understandable that they may be > feeling personal discomfort. But I'd like to hear more about the > relationship with Bidzos. > > Hal > I think you are being a little paranoid. I clearly see the points that Eric and Tim are making. RSA is not going to "roll over" for us. If they did, it could mean the end of their company. Jim out of detante, might not be sending us (the Regents of UC to be exact) a letter because of the potential ramafications (both legal, and publicity wise) It would not be a good move for RSA or for cypherpunks, but if this issue heats up, he may be forced into this stance, which is one I'm convinced by meeting the man, that he personally would not like to take, but WOULD take if it came down to us or the companies patents being made null and void from failure to enforce them. I think he is passing over us for the time being, unless media attention causes him to do otherwise, remember he would sent "the letter" to the regents of UC Berkeley they are the one's who own soda, not the cypherpunks. I think we have to decide whether we are promoting PGP or an individuals right "to affordable secure cryptography" I for one will continue to use PGP until something better comes along. I'd be willing to give RSA $50 - $100 for the right to use the software, in this case BECAUSE THE ISSUE OF PRIVACY IS MORE IMPORTANT TO TO ME THAN THE ISSUES OF WHETHER SOFTWARE IS PATENTABLE. Now this does not mean that I don't believe in free software but if we don't stop the stuff that the feds are doing right now, the other issues won't make any difference. What founding father said "If we all don't hang together we will surely hang seperately" ------------------------------------------------------------------------------- NEXUS SYSTEMS/CYBERTRIBE-5 : Voice:(415)965-2384 Fax: (415)327-6416 Editor/Instigator/Catalyst : Geoff White <geoffw(a)nexsys.net> Production Crew : Universal Movement Trinity <umt(a)nexsys.net> "They might stop the party, but they can't stop the future" --PGP Public key available upon request-- AT&T:Phones with Big Brother Inside, Just say "NO" to the Clipper wiretap chip! -------------------------------------------------------------------------------

1 0

CLIPPER: Remember Big Brother!
by Matthew J Miszewski 30 Apr '93

30 Apr '93

Cypherpunks, I have taken contention with Tim's suggestions and was glad to see the comprehensive response. And the following critiques. But I fear that AT&T and the NSA may be lovin' our discontent with each other. I still disagree with Tim on a few contentions and will post them later. But I now understand more clearly his position and far sightedness. While I did my part to start this dissent, I now hope that we can reconcentrate on the current emergency. CLIPPER! Im not saying we should quash dissent, but just cool the flames and remember our current situation. There are many facets of patent law which we may not be able to solve right now. [Eric, I am working on your research request, thanx!]. Please don't let a provacative post by a forward looking thinking derail *both* of our ultimate goals. There is a time and a place for this debate. However, I feel now we must attack the _real_ enemy. So, please, step back and remember that if we fall divided, NO ONE will voice opposition to the WIRETAP CHIP, and we can all set our calandars back to 1984. Respectfully Dissenting, Matt mjmiski(a)macc.wisc.edu

1 0

Introduction...
by Sy Verpunc 30 Apr '93

30 Apr '93

To whoever it was at Ohio who just fingered this account... (whether it's one of us or the obligatory NSA mole :-) [oops, no, the NSA mole works out of uunet.ca, right?]) - I'll save you the bother - it's not a cunning alias, it's just a spare account I created so I don't get all this stuff in my real mailbox; I have an account for every mailing list I'm on. If you want to mail me under my normal account, it's the rather obvious gtoal(a)gtoal.com Graham

1 0

Re: PGP on soda.berkeley.edu
by pfarrell＠cs.gmu.edu 30 Apr '93

30 Apr '93

Hal, I think you are being overly paranoid. Jim Bidzos must protest the use of PGP. If he doesn't, he will lose the ability to claim that companies have to pay for RSA. He has publicaly, and repeatedly, stated that the ITAR is a crock. Don't wave a flag infront of the bull. He has personally told me that he is very interested in a RSA approved program that is PGP compatible. He simply can NEVER say that PGP is OK. If we are to say to the politicians that normal folks need strong encryption, then we have to start without being labled criminals for violating the US laws. If I remember, you are not in the US, so it is fine to ignore Bidzos. I can not write my congressman and saw Clipper is bad, PGP is good when use (and development) of PGP is against the law. We could argue that the law is bad. I can agree. But changing the law will take so long that RSA will be illegal. Then when I use it, it will be grounds for a search warrent. Pat Pat Farrell, Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science, George Mason University, Fairfax, VA

1 0

HELP! Some nut is threatening to sue!
by Stanton McCandlish 30 Apr '93

30 Apr '93

Due to my posts to sci.crypt and elsewhere that I was distributing PGP, I recieved the following, and after that a very biased textfile on the dangers of having PGP and how terrible it is. Can anyone verify that this is a real threat? Last I heard PGP *MIGHT* violate a patent, but that this had not been decided yet. Please reply soon, and by direct email. If it is the Real Shit, I don't think they are going to give me long to ditch PGP... :( Begin forwarded msg -----------------------------------------------------

3 2

Tough Choices: PGP vs. RSA Data Security
by Hal 30 Apr '93

30 Apr '93

-----BEGIN PGP SIGNED MESSAGE----- I thought Eric's analysis of RSADSI/PKP's position was interesting, but I have to take issue with a couple of points: > Premise: RSADSI created RSAREF in order to license individuals. This seems to assume that RSADSI needs to "license" individuals in order to allow them to use the patent. But I don't think this is the case. RSADSI can simply say that individual, non-commercial use of the patents is permitted by them. In fact, they do say that, apparently. As Pat Farrell reported today: > I found that PKP has two simple philosophies: (1) they have a valid patent, > and you must agree to this fact and (2) if you make money, they make > money. I understand that the FAQ from RSA confirms this, that non-commercial, personal use of the patent is OK. (Actually, I don't think this first point, that "you have to agree that their patent is valid" is in the FAQ. I think this was added specifically because the PGP documentation criticizes the patent.) So, it does not seem to me that they had to take _any_ specific action in order to "license" individuals to use their patent non-commercially. They simply had to say, as they already said, that such use is not considered infringing. > Since they don't make any money from it, there's > no reason for them to spend much money paying lawyers to draft license > agreements for products which bring in no income. Therefore they want > all non-income uses of the patents to be filtered through a single > license. Again, there is no need for them to pay lawyers to set up a host of different "non-income" licenses. There is no need to "filter" all such uses through a single package. Rather, a general blessing of non-commercial use should be adequate. > Assertion: The reason that RSADSI requires that individual licenses be > mediated through RSAREF is that non-commercial software is inevitably > used in commercial contexts. Allow personal, non-commercial use does not mean they lose any rights to sue companies which make money off the patent. If a non-commercial product (like PGP) is used in a commercial context then both Phil and Jim may be expected to go after them. This therefore is not at all a reason for RSADSI to require individual licenses to be mediated through RSAREF. Doing that gives them no rights that they didn't already have. > Remember, their main business is > licensing. All software used in a commercial context must be > licensed, otherwise their main business is imperiled. Were they to > make separate licenses for every low end product, they would be in the > same situation as if they licensed individuals--high overhead, small > return. Therefore, they license RSAREF to companies; this allows > RSADSI to economically offer licensed use for all such low end > software packages. Here Eric is apparently talking about commercial use. I think our discussions are in the context of personal, non-commercial use. We should clearly separate these two issues. Where a putatively non-commercial product, whether RIPEM or PGP, is used in a commercial situation then PKP and/or PRZ may choose to take legal action. But the non-commercial situation can be dealt with without restricting users to use RSAREF. In short, Eric has not persuaded me (at least) that RSADSI was in any way forced to restrict non-commercial users to use the RSAREF package. Their general policy of permitting personal, non-commercial use, and demanding that "if you make money, we make money" are more than adequate without RSAREF entering the picture at all. Hal Finney 74076.1041(a)compuserve.com -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK+ExaKgTA69YIUw3AQErDQP/ZMqrgzTm/j2T5xkbLCruCdVfd+a/U9tk aNNE8687LMZsC9RSxh6me60zWEQag1DnLqOA5zhn+9kbQ3HbYsc58oc/5vNgJwEe lAfcRImykqdIq3PLWgGyvhqqBsOib/k9uL8+OijcdYmsnLciDN8z4IdREDDKn7zu w83hCzV7BDc= =zAQ6 -----END PGP SIGNATURE-----

1 0

List of remailers 4/30/93
by Karl Barrus 30 Apr '93

30 Apr '93

-----BEGIN PGP SIGNED MESSAGE----- Q1: What cypherpunk remailers exist? A1: 1: hh(a)pmantis.berkeley.edu 2: hh(a)cicada.berkeley.edu 3: hh(a)soda.berkeley.edu 4: nowhere(a)bsu-cs.bsu.edu 5: ebrandt(a)jarthur.claremont.edu 6: hal(a)alumni.caltech.edu 7: remailer(a)rebma.mn.org 8: elee7h5(a)rosebud.ee.uh.edu 9: phantom(a)mead.u.washington.edu 10: hfinney(a)shell.portal.com 11: remailer(a)utter.dis.org 12: 00x(a)uclink.berkeley.edu 13: remail(a)extropia.wimsey.com NOTES: #1-#4 remail only, no encryption of headers #5-#12 support encrypted headers #13 special - header and message must be encrypted together #7,#11,#13 introduce larger than average delay (not direct connect) #12 public key not yet released ====================================================================== Q2: What help is available? A2: Check out the pub/cypherpunks directory at soda.berkeley.edu (128.32.149.19). Instructions on how to use the remailers are in the remailer directory, along with some unix scripts and dos batch files. Mail to me (elee9sf(a)menudo.uh.edu) for further help and/or questions. ====================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK+FaUYOA7OpLWtYzAQHAkwP/XeYgJtC+oSWPkg84wMrkWUjuim7vMPgm XVpf90hvHyMy7dJbmCliQachBMV2/5ddgTipISdYzD3xeExIVNYOPruuQLSCDhrC 1zXpsqHlTUw9gppem58NoUPuQl2OP2vSUyWf12yxFpfTQ7Qg3gQ7GBiROa8xuaoC 31IzbfsvqE0= =iMsm -----END PGP SIGNATURE----- /-----------------------------------\ | Karl L. Barrus | | elee9sf(a)menudo.uh.edu | <- preferred address | barrus(a)tree.egr.uh.edu (NeXTMail) | \-----------------------------------/

1 0