September 2000 - cypherpunks-legacy

CDR: 128-bit netscaoe v4 for bellsouth.net
by Sonny 06 Sep '00

06 Sep '00

hello I would like to know if Netscape communictor version 4.* is available for bellsouth.net with 128-bit encryption. Pleas Email me

2 1

CDR: Re: Germans to tax PCs for Lars
by Craig Brozefsky 06 Sep '00

06 Sep '00

Adam Langley <agl(a)linuxpower.org> writes: > Is this really a bad thing? Music is becomming a public > service. When author cannot control their works (as is happening > now) the works basically become a public service - and the way > public services are funded is by govt taxes.= If they stop trying > (and failing) to control content and just use this - well it's not > perfect - but it's better than a DMCA/UCITA world. it is naive to think that this tax is going to stop them from pursuing their UCITA/DMCA led efforts to completely control the works they distribute in order to destroy "fair use" and reap as much money as possible from consumers. This tax is just icing on the cake for them, a welcome revenue stream. -- Craig Brozefsky <craig(a)red-bean.com> "Revolution begins by giving things and social relationships their real names". -- L. Trotsky

2 1

DCSB: RSA Expiration Fundraiser for EFF, Downtown Harvard Club of Boston
by R. A. Hettinga 06 Sep '00

06 Sep '00

-----BEGIN PGP SIGNED MESSAGE----- The Members of The Digital Commerce Society of Boston, <Rent this Space* :-)>, and The Internet Bearer Underwriting Corporation In Celebration of the EXPIRATION OF THE RSA PATENT invite the Digital Commerce Community to cocktails and an evening fundraiser for the recent litigation efforts of THE ELECTRONIC FRONTIER FOUNDATION Special Guests to Be Announced Wednesday Evening September 20, 2000 5:30 to 8:30 PM The Downtown Harvard Club of Boston One Federal Street, 38th Floor Boston Free hors d'oeuvres Cash Bar Beautiful views of Boston Harbor at night Requested minimum donation $35 The event's goal is $10,000 RSVP (or for *sponsorship :-)), Robert Hettinga, Moderator, The Digital Commerce Society of Boston, <mailto: rah(a)ibuc.com> The Club's new dress code is "Business Casual", whatever *that* means... -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQEVAwUBObZiU8UCGwxmWcHhAQEcxAgAhABrdq+bcxPDMYcjyaYDFFkPq3s8Ymnk 6SqQmqWRTOaK7+cK+AVXuleNtSk13EMPRBtOLq56HRQH3Ea8/GpW8Oe1xpXQJf/c 4ASX4FfApS78jP+9qFVLiN6F8xqUKCJMDSaa0nqwbmc4XBzMMpHCNKFhWEdYqur9 Mkf8N7IYJcItPbpMcC6QUoNTVg1wQLt3rptZnsEyHyTWgge2z1lRO8Jt38m6NfS9 5ZPem8IkUpYjcIpqQVw2DhsoRO6v/jYZxeulNHty26hxbME2RnLfxEMuaCoqq5aM zWPkRLMSyhYqo0POsSpOLg1FjA6wgMA0GTi0BbeDKqWGsSH25Av5Fw== =o7iR -----END PGP SIGNATURE----- -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

DCSB: RSA Expiration Fundraiser for EFF, Downtown Harvard Club of Boston
by R. A. Hettinga 06 Sep '00

06 Sep '00

-----BEGIN PGP SIGNED MESSAGE----- The Members of The Digital Commerce Society of Boston, <Rent this Space* :-)>, and The Internet Bearer Underwriting Corporation In Celebration of the EXPIRATION OF THE RSA PATENT invite the Digital Commerce Community to cocktails and an evening fundraiser for the recent litigation efforts of THE ELECTRONIC FRONTIER FOUNDATION Special Guests to Be Announced Wednesday Evening September 20, 2000 5:30 to 8:30 PM The Downtown Harvard Club of Boston One Federal Street, 38th Floor Boston Free hors d'oeuvres Cash Bar Beautiful views of Boston Harbor at night Requested minimum donation $35 The event's goal is $10,000 RSVP (or for *sponsorship :-)), Robert Hettinga, Moderator, The Digital Commerce Society of Boston, <mailto: rah(a)ibuc.com> The Club's new dress code is "Business Casual", whatever *that* means... -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQEVAwUBObZiU8UCGwxmWcHhAQEcxAgAhABrdq+bcxPDMYcjyaYDFFkPq3s8Ymnk 6SqQmqWRTOaK7+cK+AVXuleNtSk13EMPRBtOLq56HRQH3Ea8/GpW8Oe1xpXQJf/c 4ASX4FfApS78jP+9qFVLiN6F8xqUKCJMDSaa0nqwbmc4XBzMMpHCNKFhWEdYqur9 Mkf8N7IYJcItPbpMcC6QUoNTVg1wQLt3rptZnsEyHyTWgge2z1lRO8Jt38m6NfS9 5ZPem8IkUpYjcIpqQVw2DhsoRO6v/jYZxeulNHty26hxbME2RnLfxEMuaCoqq5aM zWPkRLMSyhYqo0POsSpOLg1FjA6wgMA0GTi0BbeDKqWGsSH25Av5Fw== =o7iR -----END PGP SIGNATURE----- -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

CDR: Weekly updates at Cactus Cactus
by Cactus 06 Sep '00

06 Sep '00

Come join the party at Cactus Cactus! http://www.cactus-cactus.com/

1 0

RSA Security releases RSA algoritm into public domain two weeks e arly. [cpunk]
by Trei, Peter 06 Sep '00

06 Sep '00

Wednesday September 6, 8:03 am Eastern Time Press Release SOURCE: RSA Security Inc. RSA Security Releases RSA Encryption Algorithm into Public Domain 'c = m(e) mod n' Made Available Two Weeks Early BEDFORD, Mass., Sept. 6 /PRNewswire/ -- RSA® Security Inc. (Nasdaq: RSAS - news) today announced it has released the RSA public key encryption algorithm into the public domain, allowing anyone to create products that incorporate their own implementation of the algorithm. This means that RSA Security has waived its rights to enforce the patent for any development activities that include the RSA algorithm occurring after September 6, 2000. Represented by the equation "c = m(e) mod n," the RSA algorithm is widely considered the standard for encryption and the core technology that secures the vast majority of the e-business conducted on the Internet. The U.S. patent for the RSA algorithm (#4,405,829, "Cryptographic Communications System And Method") was issued to the Massachusetts Institute of Technology (MIT) on September 20, 1983, licensed exclusively to RSA Security and expires on September 20, 2000. "So much misinformation has been spread recently regarding the expiration of the RSA algorithm patent that we wanted to create an opportunity to state the facts," said Art Coviello, chief executive officer of RSA Security. "RSA Security's commercialization of the RSA patent helped create an entire industry of highly secure, interoperable products that are the foundation of the worldwide online economy. Releasing the RSA algorithm into the public domain now is a symbolic next step in the evolution of this market, as we believe it will cement the position of RSA encryption as the standard in all categories of wired and wireless applications and devices. RSA Security intends to continue to offer the world's premier implementation of the RSA algorithm and all other relevant encryption technologies in our RSA BSAFE® software solutions and we remain confident in our leadership in the encryption market." For nearly two decades, more than 800 companies spanning a range of global industries have turned to RSA Security as a trusted, strategic partner that can provide the proven, time-tested encryption implementations and resources designed to speed time to market. These companies, including nearly 200 so far in 2000, rely on RSA BSAFE® security software for its encryption implementation and value-added services for a broad range of B2B, B2C and wireless applications. During the past 17 years, RSA Security has incorporated the concepts represented by the RSA algorithm into its RSA BSAFE cryptographic software. The company has made continuous enhancements to the way the algorithm has been implemented, including a number of performance improvements and optimizations, not reflected in the original patent, for a wide range of software applications, operating systems and chip designs. RSA Security also is an industry leader in developing standards on the robust application of encryption technologies for solving real-world problems. These core standards, known as the Public Key Cryptography Standards (PKCS), form the underpinnings of today's most widely used communication methods. In recent years, encryption technology has taken on an entirely new level of importance in the world of business and consumer technology, and RSA Security continues to be a leader in the industry. Once the province of a small group of technologists and mathematicians, new developments have raised the profile of encryption among a broad range of audiences. Moving forward, electronic signature legislation, export regulation and the pending selection of the Advanced Encryption Standard (AES) all will contribute significantly to encryption playing a key role in the further expansion of e-commerce initiatives for B2B, B2C and extended enterprise applications. For more information regarding the RSA algorithm and a free RSA algorithm t-shirt, visit www.rsasecurity.com/total-solution. About RSA Security Inc. RSA Security Inc., The Most Trusted Name in e-Security(TM), helps organizations build secure, trusted foundations for e-business through its RSA SecurID® two-factor authentication, RSA BSAFE encryption and RSA Keon® public key management systems. With more than a half billion RSA BSAFE-enabled applications in use worldwide, more than seven million RSA SecurID users and almost 20 years of industry experience, RSA Security has the proven leadership and innovative technology to address the changing security needs of e-business and bring trust to the new, online economy. RSA Security can be reached at www.rsasecurity.com. NOTE: This press release contains forward-looking statements relating to the role of the RSA algorithm encryption and the expansion of e-commerce. Such statements involve a number of risks and uncertainties. Among the important factors that could cause actual results to differ materially from those indicated by such forward-looking statements are delays in product development, technical difficulties, software bugs and errors, competitive pressures, changes in customer and market requirements and standards, market acceptance of new technologies, technological changes in the computer industry, general economic conditions and the risk factors detailed from time to time in RSA Security's periodic reports and registration statements filed with the Securities and Exchange Commission, including without limitation RSA Security's Annual Report on Form 10-K filed on March 15, 2000 and its Quarterly Report on Form 10-Q filed on August 14, 2000. RSA, BSAFE, Keon and SecurID are registered trademarks, and The Most Trusted Name in e-Security is a trademark of RSA Security Inc. All other products and services mentioned are trademarks of their respective companies. SOURCE: RSA Security Inc.

3 2

Re: RSA Security releases RSA algoritm into public domain two weeks early. [cpunk]
by Bill Stewart 06 Sep '00

06 Sep '00

When will we see the first RSAREF-compatible public-domain code? At 10:10 AM 9/6/00 -0400, Trei, Peter wrote: >Wednesday September 6, 8:03 am Eastern Time > >Press Release > >SOURCE: RSA Security Inc. > >RSA Security Releases RSA Encryption Algorithm into Public Domain > >'c = m(e) mod n' Made Available Two Weeks Early > >BEDFORD, Mass., Sept. 6 /PRNewswire/ -- RSA® Security >Inc. (Nasdaq: RSAS - news) today announced it has released the >RSA public key encryption algorithm into the public domain, >allowing anyone to create products that incorporate their own >implementation of the algorithm. This means that RSA Security has >waived its rights to enforce the patent for any development >activities that include the RSA algorithm occurring after >September 6, 2000. Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

4 3

CDR: Aldrich Ames might go free; .gov security still lax, etc...
by sunder 06 Sep '00

06 Sep '00

>From SLF: http://thescotsman.co.uk/world.cfm?id=TS00133394&d Moscow poised to offer Cold War-style spy swap Chris Stephen In Moscow REPORTS in Russia suggest Moscow is preparing to offer the United States a Cold War-style "spy swap" involving the release of an American businessman charged with espionage in return for the convicted spy Aldrich Ames. A Moscow newspaper, Sevodnya, yesterday quoted a source in Russias security service, the FSB, as saying they were considering offering to swap the businessman, Edmond Pope. He is accused of trying to buy plans for the same top secret torpedo, the Squall, that was being tested by the Kursk submarine when it exploded and sank last month. <SNIP> http://www.bergen.com/morenews/fake200009026.htm Investigators with phony ID easily breach security checks Sunday, September 3, 2000 By TAMARA LYTLE Special from The Orlando Sentinel WASHINGTON -- Investigators used phony law-enforcement identification available on the Internet and elsewhere to breach security at some of the nation's most sensitive agencies, including the CIA, the FBI, and the Departments of Justice and State. The investigators breezed into 18 federal facilities, Orlando International Airport, Washington's Reagan National Airport, and the U.S courthouse in Orlando simply by flashing fake badges and credentials. In some cases they were able to claim they had firearms but still bypass metal detectors and other screening. <SNIP> http://www4.zdnet.com/intweek/stories/news/0,4164,2620091,00.html Big Brother Is Watching . . . What You Buy August 28, 2000 8:19 AM ET By Lisa Dempster In his nightmarish novel 1984, George Orwell envisioned a future in which the merest hint of privacy would be treason and protagonist Winston Smith would be cowed into embracing truth in his telescreen. The year in question came and went, but could Orwell's bad dream become our reality two decades later? What kind of privacy protection will we be able to expect from the Internet in 2004? Picture this: Retinal scans, fingerprint readers built into your mouse and voice recognition software able to nail your identity down to the roots of your genetic code. Great for keeping your identity a secret from advertising piranhas, but do you really want your bank or online health-care provider to store such intimate information? Unlike Orwell's dour Smith, who struggled to conceal his thoughts and feelings from Big Brother, privacy advocates predict our biggest concern in four years' time will be camouflaging ourselves from corporate behemoths devoted to discovering our every purchasing peccadillo - and pandering to it. <SNIP> http://www.idg.net/go.cgi?id=306483 UPDATE: MS Word documents can be tracked on Web by Peter Sayer, IDG News Service\Paris Bureau August 31, 2000, 07:53 Creators of Microsoft Word documents can use the application's well-documented ability to include Web hyperlinks in documents to remotely track who is reading a them, according to a study by the Denver-based Privacy Foundation published Wednesday. Users of Microsoft's word processor have been able to embed graphics in their documents for the best part of a decade, but only in versions of the program since Word 97 have users been able to replace a bulky, memory-hogging graphic with a short URL (Uniform Resource Locator) pointing to the location of the graphic on a Web server. Each time the document is opened, the computer sends an HTTP (Hypertext Transfer Protocol) request to the Web server asking for the graphic in order to display it. <SNIP> -- ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :Surveillance cameras|Passwords are like underwear. You don't /|\ \|/ :aren't security. A |share them, you don't hang them on your/\|/\ <--*-->:camera won't stop a |monitor, or under your keyboard, you \/|\/ /|\ :masked killer, but |don't email them, or put them on a web \|/ + v + :will violate privacy|site, and you must change them very often. --------_sunder_(a)_sunder_._net_------- http://www.sunder.net ------------

1 0

CDR: DCSB: RSA Expiration Fundraiser for EFF, Downtown Harvard Club of Boston
by R. A. Hettinga 06 Sep '00

06 Sep '00

--- begin forwarded text

1 0

CDR: Re: Is kerberos broken?
by Sampo A Syreeni 06 Sep '00

06 Sep '00

On Fri, 1 Sep 2000, Steven Furlong wrote: >I used to work for a full-text indexing company. (So I can argue from >a position of authority, and you can't dispute anything I say. ;-) ) >The problem of indexing and matching text is not a hard problem in the >mathematical sense, but it quickly becomes computationally gruesome. I know, I know. No essential difference between text and pure binary data except a more limited alphabet and even lower mean entropy per symbol sent. >For myself, I often use as pass phrases memorized phrases from >literature. Which ones? Well, I read four languages, and I do the >number/letter and symbol/letter substitutions, so I feel secure even >revealing that clue. Good for you. Most people never go to even that much trouble. But I still think that dictionary searches on, say, all consequtive subsequences of 6-200 characters in the top 100 most likely to have been read books of a given adversary, with common variations (suppression of punctuation, all upper and lower case, adjunction of numbers below from 0-999 in the beginning and end of the phrase, all caps with first capital and vice versa, for the phrase and all words etc.) does not get too hard too fast, especially if we have statistics of people's habits which allow us to work the more likely candidates (like all lower case with little extra changes) first. And it *is* likely to work for the majority of adversaries. I also conceed to your point: serious crypto buffs like most people on this list would probably have little to fear from such attacks... Sampo Syreeni <decoy(a)iki.fi>, aka decoy, student/math/Helsinki university

3 3