December 2003 - cypherpunks-legacy

[ADMINISTRATIVIUM] Zero-knowledge interactive proofs
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

In a jerk-off competition Tim Mayhem finishes second, third and fifth. \\\|||/// ======= | O O | Tim Mayhem \`___'/ _| |_

1 0

Re: Credentials without Identity--Race Bits
by Jill014＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-13 02:03:26 EST, cmcurtin(a)research.megasoft.com (C Matthew Curtin) writes: > Subj: Re: Credentials without Identity--Race Bits > Date: 96-12-13 02:03:26 EST > From: cmcurtin(a)research.megasoft.com (C Matthew Curtin) > Sender: owner-cypherpunks(a)toad.com > Reply-to: cmcurtin(a)research.megasoft.com > To: tcmay(a)got.net (Timothy C. May) > CC: cypherpunks(a)toad.com > > >>>>> "Tim" == Timothy C May <tcmay(a)got.net> writes: > > Tim> While it has been claimed by some that "crypto anarchy" means > Tim> that race won't matter, that cyberspace interactions will be > Tim> color-blind, this is misleading. > > Race bits, gender bits, etc., are all interesting possibilities. I > never thought about anyone wanting to do such a thing, but I suppose > that's likely. > > I've tended to think that as we become increasingly digital, issues > like race become less significant (perhaps because it generally isn't > immediately obvious in this medium). This doesn't mean that prejudices > go away, it means that they shift to stay with what is obvious. For > example, people who are unable to spell well (and don't spellcheck > email and usenet posts), or use excessively poor grammar are often > ridiculed for their lack of mastery of the language in which they're > writing. Basically, the prejudices and such continue with us, but > change, so as to remain based on things that are easily discernible. > > Tim> While many--probably most--users will care only for cyberspace > Tim> personna issues, and not meatspace personna issues of race, > Tim> color, height, weight, etc., this is not something built in to > Tim> anonymous transactions. > > As I'm replying, it's occurred to me that we've already got some sort > of persona "certificates" floating around now. (Such as the Geek > Code.) Imagine a field there to include race. Wouldn't take a lot to > do that, after all. > What is the "Geek Code?" > Of course, the implementation of a race bit system that can be trusted > is another issue altogether. Would the White Boyz Club then need to > have its own trusted arbitrator to introduce people of the same race > to each other? (AryanSign?) Is a more elaborate PGP-style web > of trust used? Hmm. So white Boyz Club excludes women to, is that correct?

2 1

Re: Redlining
by Jill014＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-13 02:36:46 EST, dthorn(a)gte.net (Dale Thorn) writes: > Subj: Re: Redlining > Date: 96-12-13 02:36:46 EST > From: dthorn(a)gte.net (Dale Thorn) > Sender: owner-cypherpunks(a)toad.com > To: EALLENSMITH(a)ocelot.Rutgers.EDU (E. Allen Smith) > CC: cypherpunks(a)toad.com > > E. Allen Smith wrote: > > From: IN%"dthorn(a)gte.net" "Dale Thorn" 12-DEC-1996 14:56:52.69 > > >Actually, there is not only good evidence for the environmental argument, > > >but you can reason it out yourself if you give attention to some things > > >that don't make it into most discussions on this topic. > > > Yes, there are strong arguments for the environment being the determining > > factor. there are also strong arguments (such as interracial adoption > still > > leaving blacks below the average IQ of adopted siblings) for it being > genetics. > > It is possible to understand intelligence as "pattern matching" skills, > without having to have attendant math and statistics to define it more > precisely or clinically. This understanding (if you have it) is the key > to knowing that Black persons do *not* have less IQ than White persons, > regardless of the standardized tests. Something I know about, as I've > scored in the top 1/1000 of one percent, etc. > Are you black?

1 0

KRA_gak
by John Young 17 Dec '03

17 Dec '03

12-12-96 "High-Tech Leaders to Facilitate Recovery of Encrypted Information Globally. Key Recovery Alliance Welcomes 29 New Members" The key recovery alliance has more than tripled its membership and identified its charter objectives. + expediting the widespread, global use of strong encryption + evaluating technologies that are flexible and scaleable to meet various changing commercial needs and policies + promoting interoperability between different key recovery and non-key recovery solutions + defining a commercial infrastructure for worldwide development of strong encryption + maximizing security for business To facilitate meeting these and other objectives, the alliance identified a series of working committees targeted to meet within the next 60 days. Soon after this 60-day period, the now 40-member alliance will re-convene to mark the progress of these committees and to identify future benchmarks and deliverables. The new members of the alliance are: America Online, Inc., Certicom, Compaq Computer Corporation, CygnaCom Solutions, Inc., Cylink Corporation, Data Securities International, Inc., First Data Corporation, Digital Signature Trust Company, Gradient Technologies, Inc., ICL, McAfee, Mitsubishi Corporation of Japan, Motorola, Mytec Technologies, Inc., Network Systems Group of StorageTek, Nortel, Novell, Inc., PSA, Price Waterhouse, Racal Data Group, Rainbow Technologies, SafeNet Trusted Services Corporation, Secure Computing, SourceFile, Sterling Commerce, Telequip, Unisys, Utimaco Mergent, and VPNet Technologies. "IBM SecureWay Framework To Accelerate Growth of Electronic Business" IBM announced a new framework which will advance secure electronic business by making it possible for diverse security offerings to work together. The IBM SecureWay Key Management Framework will let businesses use encryption products interchangeably. The new framework will provide for the easy adoption of new and existing key recovery technologies, while not disturbing existing cryptographic and other security functions and operations. It will effectively isolate the application from the unique properties of a specific key recovery implementation. A white paper describing the SecureWay Key Management Framework is available at http://www.ibm.com/security ----- KRA_gak (19 kb)

2 1

Re: Elliptic curves
by aga 17 Dec '03

17 Dec '03

On Fri, 13 Dec 1996, Dr.Dimitri Vulis KOTM wrote: > >From cypherpunks-errors(a)toad.com Fri Dec 13 00:43:05 1996 > Received: by bwalk.dm.com (1.65/waf) > via UUCP; Fri, 13 Dec 96 01:34:42 EST > for dlv > Received: from toad.com by uu.psi.com (5.65b/4.0.061193-PSI/PSINet) via SMTP; > id AA22158 for cypherpunks; Fri, 13 Dec 96 00:43:05 -0500 > Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id TAA05349 for cypherpunks-outgoing; Thu, 12 Dec 1996 19:07:54 -0800 (PST) > Received: from zifi.genetics.utah.edu (zifi.genetics.utah.edu [155.100.229.31]) by toad.com (8.7.5/8.7.3) with ESMTP id TAA05344 for <cypherpunks(a)toad.com>; Thu, 12 Dec 1996 19:07:47 -0800 (PST) > Received: (from bin@localhost) by zifi.genetics.utah.edu (8.8.3/8.6.9) id UAA13495 for cypherpunks(a)toad.com; Thu, 12 Dec 1996 20:07:52 -0700 > Date: Thu, 12 Dec 1996 20:07:52 -0700 > Message-Id: <199612130307.UAA13495(a)zifi.genetics.utah.edu> > To: cypherpunks(a)toad.com > From: nobody(a)zifi.genetics.utah.edu (Anonymous) > Comments: Please report misuse of this automated remailing service to <complaints(a)zifi.genetics.utah.edu> > References: <850408570.510393.0(a)bexcol.demon.co.uk> > Subject: Re: Elliptic curves > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > Admin(a)bexcol.demon.co.uk writes: > > > You are all a bunch of faggots. Faggot cannot be allowed on usenet as > > dictated by the great dr. Grubor. > > > > Fuck you all. > > 1. Cypherpunks is not on usenet. > The fuck it ain't. They are at least two newsgroups out there that carry every piece of e-mail that goes to the cypherpunks list. > 2. Faggots created and run Usenet, and there's nothing a pathetic, > powerless little boy like you can do about it. > This may be true, up until now, but the faggots are now getting kicked off of the new UseNet. There are just TOO MANY faggots like Peter Berger and Tim May and John Gilmore runnung around to allow this faggot subculture to continue. > 3. I enjoy your pathetic little displays of despair about not having > any control over usenet. Please keep whining to the mailing lists > to remind us all of what a pitiful little loser you are. > These faggot cypherpunks are not worth wasting your time on, unless you are ready to take their fucking ass to court and cross-examine them. ARE YOU A FAGGOT, Peter Berger? -- ANSWER THE QUESTION !!! (The faggots must answer this question when you get them on the stand.) That Tim Skirvin is also a faggot, so I have been told by his schoolmates. Has he been fucked in the ass by anybody on this list?

1 0

Re: In Defense of Anecdotal Evidence
by Rob Carlson 17 Dec '03

17 Dec '03

On Thu, 12 Dec 1996 14:12:23 -0800, Huge Cajones Remailer wrote: >Statistics are a useful tool, but they have their problems. Their >accuracy is often in doubt. Most scientific data comes with an error >analysis so you can tell what the figure means. For some reason >statisticians never do this so we cannot tell whether their numbers >are accurate to within 0.1%, 1.0%, 10%, or even worse. > >There are many other problems. For instance, users of statistics >assume they have a random sample, even in cases where that is far from >clear [ List of other problems deleted ] Of course, anecdotal evidence also suffers from all of these problems. And in greater magnitude. This is true since it is a special case of statistical evidence. With a non-random sample set of one and no controls for observer bias. >The advantage of first hand experience is that it is primary evidence. >You know it's true because you were there and saw it. I have seen women cut in half and rabbits made to appear in an empty hat with my own eyes. I'm quite sure neither of these is true. Humans are poor observers. The data processing unit is easily fooled. Many people make a living off of this fallability such as magicians and politicians. The observer is also tainted by previous experience(or lack of) and individual needs. This leads to bias unavoidable in even the most honest and reliable observers. Statistical methods are used to control for this. Double-blind techniques are one example. Humans also have a need to make conclusions when insufficient evidence is available. Witness the number of people who have an opinion on the innocence of OJ Simpson based on <2 minutes/day condensation of the evidence. >The advantage of anecdotal evidence (in the sense we have been using >it) is that the person who is telling you the anecdote was there and >saw it. You can cross-examine them and get a full understanding of >the evidence provided. The reporting of evidence involves different issues. If you want to believe that women are actually cut in two or that politicians are telling the truth anytime their lips are moving, thats one thing. If you want to tell me its true because you personally observed it, thats quite another. Given the failures of humans as observational tools, your story is unverifiable by me. Perhaps through effective cross examination I can prove you wrong, but I can never prove you right with such a technique.That will require other evidence outside the control of the observer ( statistical is just one available ). Evidence that can be verified independently by many observers increases the reliability. Experiments and polls can be done by me thus eliminating your bias. Independent verification can also check for errors and check the parameters under which the evidence is true. Studies are done with certain assumptions and controls. The evidence loses its reliability when removed from this context. This doesn't make studies or statistical evidence true. Just more reliable than anecdotal evidence. Humans who will lie about their observations will also produce flawed studies. Again the former (anecdotal) is unverifiable, but I can check the latter (statistical) independently. I also don't believe polls can be used to determine the truth. They can only tell what a mass of people believe. And then only if done correctly. To make this on topic, how does this apply to cryptography and crypto-politics? This issue is a foundation of our discussions here. Shall we accept anecdotal evidence such as the "If you only knew what we knew" arguments? What is more reliable: IPG's claims that their product is an OTP because they say it is or Bruce Schneier's book that can be used to point out the fallacy's in their claims? Relying on anecdotal evidence makes you susceptible to the magicians of the world. The honest ones use mirrors and their need is to entertain you enough to get your money. The rest use anecdotal evidence and emotional arguments (verbal misdirection?). Their needs are left as a test of the reader's naivete. Rob Carlson <robc(a)xmission.com>

2 1

Copyright violations
by alzheimer＠juno.com 17 Dec '03

17 Dec '03

Agence France Presse: Tuesday, December 10, 1996 Visa to Launch Trial Electronic Money Services in Tokyo Visa International said Tuesday it would experiment with electronic money services in central Tokyo [Shibuya district] for about 18 months from June 1998 with Japanese commercial banks and credit card companies. The US-headquartered international credit card firm said it would be the world's largest experiment in terms of the size of participating companies and cards to be issued. The project will be joined by five Japanese commerical banks -- Bank of Tokyo-Mitsubishi Ltd., Dai-ichi Kangyo Bank Ltd., Fuji Bank Ltd., Sumitomo Bank Ltd., and Tokai Bank Ltd. Five Japanese credit card companies, including Credit Saison Co. Ltd. DC Card Co., Sumitomo Credit Service Co., Million Card Service Co. and UC Card Co., will also take part in the trial. Visa said it hoped to use the experiment to assess commercial feasibility and customer affordability before introducing full electronic money services. Visa plans to install its electronic money terminals and issue more than 100,000 cards, including those with built-in integrated circuits, for the experiment. Visa said it had already conducted an electronic money experiment in Atlanta during the Summer Olympic Games. The company is also preparing to try similar systems in Hong Kong and Australia. American Banker: Thursday, December 12, 1996 REPORTER'S NOTEBOOK Home Financial Network Offers Web Software By DREW CLARK The house lights dimmed and music started blaring. Smoke billowed out from the stage and red-and-white lights flashed onto an audience of thousands. Despite the rock-concert atmosphere, complete with an emcee peering out from giant video screens like a live-action "Max Headroom," most of the audience in the Dallas Convention Center Arena was in suits. Welcome to Retail Delivery '96, the new-wave Bank Administration Institute conference covering all that is new and exciting in financial services technology. Having grown into banking's biggest convention, with more than 7,000 people and some 350 exhibiting companies, Retail Delivery made bold promises. Promotional brochures said it would go "beyond the buzzwords." Frank Feather, the Canadian banking consultant in the Max Headroom role, said the event would "unlock the secrets of how to make real money off technology." When the "virtual" Mr. Feather introduced Robert W. Gillespie for the keynote speech last Wednesday, the KeyCorp chief executive officer drew a laugh from the audience by declaring: "This may be the way to start shareholder meetings." Mr. Gillespie and the master of ceremonies were the first of a parade of speakers referring to the dramatic change the industry is undergoing. Mr. Gillespie captured the spirit by describing how his company, the "New Key," is evolving in three directions: national consumer finance, corporate banking, and community banking. His multimedia computer presentation took the audience through a virtual branch and displayed video clips of KeyCorp executives including Steve Cone, its renowned marketing strategist. Mr. Gillespie showcased a marketing campaign so unified that the voice of Anthony Edwards, the company's star ad spokesman, is also heard when consumers dial into KeyCorp call centers. Branding is big in retail banking, nowhere more than at Banc One Corp. The point was reinforced by Kenneth T. Stevens, chief executive of Banc One Corp.'s retail group, who previously worked at Pepsico and its Taco Bell subsidiary. "Strong brands get winning price-earning multiples," he said, which translate into easier entry into new markets and the ability to resist competitive attacks. "Historically, banks didn't need branding because of location," Mr. Stevens said. "With the leveling of competition, the control of brand names will be essential." He said banks' problems are typified by the jumble of logos on automated teller machines -- a stark contrast to the clarity of Coke and Pepsi. Despite such doses of high-level retail strategy, technology held center-stage. The enthusiasm about it was palpable, fueled by the appearances of executives from the Silicon Valley companies Intel Corp. and Sun Microsystems Inc. Generally admonishing the audience to get on the highway before it's too late, both spoke to banking issues. Intel executive vice president Frank Gill demonstrated remote banking with interactive video; Sun CEO Scott McNealy was critical of bankers' willingness to turn technology management over to others. "I can see a forestry company outsourcing information systems because their assets are in the ground," Mr. McNealy said. "But a bank's assets are information. Outsourcing (for banks) is a self-imposed lobotomy. It's like Budweiser outsourcing beer manufacturing." At the closing session Friday, Mr. Feather came out from behind the big screens to discuss his own keys to the future. Foremost, he said, is the Internet -- "the biggest thing ever in human history. It is not a technology, but a socio-economic system changing the way we live." Yet some bankers still "don't get it," Mr. Feather said. They prefer to think of the Internet as a passing fad, like the videophone, or an important but slowly evolving technology. Referring -- though not by name -- to Citicorp chairman John Reed and his prediction that full electronic banking would not be mainstream for 50 to 75 years, Mr. Feather dismissed it with a barnyard epithet. He suggested Citicorp is just trying to throw its competition off-balance. Mr. Feather's counterprediction: Within 25 years, there will be no full- service branches or tellers in North America. "Tens of thousands of branches will be closed, the entire distribution system will be rationalized," he said.

1 0

Re: Whom can you trust with your keys -- government version
by Peter Trei 17 Dec '03

17 Dec '03

> From: Hal Abelson <hal(a)martigny.ai.mit.edu> > Date: Thu, 12 Dec 1996 15:29:25 -0500 > To: cypherpunks(a)toad.com > Subject: Whom can you trust with your keys -- government version > Reply-to: hal(a)MIT.EDU > -----BEGIN PGP SIGNED MESSAGE----- > > > The Commerce Department draft crypto export regulations (see > http://www.steptoe.com/commerce.htm) include the following stipulation > on Key Recovery Agents: > > > Evidence of an individual's suitability and trustworthiness [to > act as a key recovery agent] shall include: > > (i) Information indicating that the individual(s): > > (A) Has no criminal convictions of any kind or > pending criminal charges of any kind; > > (B) Has not breached fiduciary > responsibilities (e.g., has not violated any > surety or performance bonds); and > > (C) Has favorable results of a credit check; > or, > > (ii) Information that the individual(s) has an active > U.S. government security clearance of Secret or higher > issued or updated within the last five years. > > It's nice to know that we can trust ex-cons, frauds, and deadbeats to > hold our keys, provided that they have obtained a Secret clearance. Sorry, but you're mistaken. There is an implied AND between (i) and (ii), not an OR. Curiously, it looks like I may be eligible to run an GAK service. Peter Trei trei(a)process.com

1 0

ASM vs portable code [WAS: Re: Java DES breaker?]
by Peter Trei 17 Dec '03

17 Dec '03

Ray Arachelian <sunder(a)brainlink.com> wrote: > On Wed, 11 Dec 1996, Dr.Dimitri Vulis KOTM wrote: > > > I happen to have a Sparc 20 box and a Linux box and a SCO box, and ActiveX > > won't work on any of those. I also work with a bunch of other equipment > > that's much faster than a PC, but doesn't run browsers. (Most of it is not > > connected to the 'net for security reasons, but that's besides the point.) > > Right, and Active X, if those machies were on the web, would not be > supported. > > > If Bill's client is sure to run the platforms that MS IE runs on, then this is > > not a consideration. > > Correct, however there is one thing you have forgotten... (next paragraph) > > > Interpreted FORTH bytestream (which is what Java is) may be "doing quite well" > > when drawing GUI gizmos and widgets, but it can't get anywhere near the > > performance of hand-optimizer assembler that you can stick into ActiveX. > > While ActiveX does support hand optmized assembler, there are Java > JustInTime compilers which take JVM bytecodes and turn'em into raw > assembler. They aren't hand optimized, they are natively compiled code, > but they are native code non the less. A good optimizing compiler may > not be 100% as cool and as fast as hand optmized code, BUT it'll be > almost as fast. And Java will run on just about EVERY platform out there. > And that is a bigger, more important point than a 10%-25% increase in > power over non-optimized code. > > Besides, I'm not arguing AGAINST an ActiveX client, there's no reason > why there can't be both Java and ActiveX clients out there since there is > both a compatibilty issue and a speed increase with ActiveX. While I'm reluctant to ever find myself in the same corner as Vulis, he has a point. As one of the few folks on this list who actually writes code, I say that hand-optimized assembler will beat machine generated code every time. I have figures to back me up. As some of you know, I've been working on a DES key recovery tool. I'm have both portable C and x86 assembler versions. They are currently identical, except that the guts of the DES round is written in "C" in one, and hand-optimized Pentium assembler in the other. For this test, I modified the code to cut out the delays associated with incrementing the key schedule, leaving the most of the crunching in the DES decryption. Both versions were compiled under Visual C++ 4.0, with Optimizations set to 'Maximize speed', and inlines to 'any suitable', and run on a 90MHz Digital Celebris 590 under WinNT 3.51. Averaging several runs: "C": 102,300 crypts/sec ASM: 238,000 crypts/sec With Java, it's possible to add native code methods to the interpreter, though this requires extra work by the user - it's harder than 'click on this link to run my reely kool applet'. This violates the Java sandbox, and requires the user to make trust decisions on the methods they are adding. ActiveX lets you add and run native code with a click, but again involves trust decisions. My philosophy is 'the more the merrier'. I'd like to see people work on DES Key Recovery on a large number of platforms - we just need to standardize on the input and output formats. Peter Trei trei(a)process.com Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

4 3

Credentials without Identity--Racey Bits
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 05:30 AM 12/13/96 -0500, Jill heatedly wrote: :So white Boyz Club excludes women to, is that correct? By definition, you steaming dreamboat. Drop me a note, kitten. XXOO Snookums

1 0

ASM vs portable code [WAS: Re: Java DES breaker?]
by Peter Trei 17 Dec '03

17 Dec '03

Sorry if this is a repeat - I got a rather opaque 'delivery failure' message when I first sent it. - pt Ray Arachelian <sunder(a)brainlink.com> wrote: > On Wed, 11 Dec 1996, Dr.Dimitri Vulis KOTM wrote: > > > I happen to have a Sparc 20 box and a Linux box and a SCO box, and ActiveX > > won't work on any of those. I also work with a bunch of other equipment > > that's much faster than a PC, but doesn't run browsers. (Most of it is not > > connected to the 'net for security reasons, but that's besides the point.) > > Right, and Active X, if those machies were on the web, would not be > supported. > > > If Bill's client is sure to run the platforms that MS IE runs on, then this is > > not a consideration. > > Correct, however there is one thing you have forgotten... (next paragraph) > > > Interpreted FORTH bytestream (which is what Java is) may be "doing quite well" > > when drawing GUI gizmos and widgets, but it can't get anywhere near the > > performance of hand-optimizer assembler that you can stick into ActiveX. > > While ActiveX does support hand optmized assembler, there are Java > JustInTime compilers which take JVM bytecodes and turn'em into raw > assembler. They aren't hand optimized, they are natively compiled code, > but they are native code non the less. A good optimizing compiler may > not be 100% as cool and as fast as hand optmized code, BUT it'll be > almost as fast. And Java will run on just about EVERY platform out there. > And that is a bigger, more important point than a 10%-25% increase in > power over non-optimized code. > > Besides, I'm not arguing AGAINST an ActiveX client, there's no reason > why there can't be both Java and ActiveX clients out there since there is > both a compatibilty issue and a speed increase with ActiveX. While I'm reluctant to ever find myself in the same corner as Vulis, he has a point. As one of the few folks on this list who actually writes code, I say that hand-optimized assembler will beat machine generated code every time. I have figures to back me up. As some of you know, I've been working on a DES key recovery tool. I'm have both portable C and x86 assembler versions. They are currently identical, except that the guts of the DES round is written in "C" in one, and hand-optimized Pentium assembler in the other. For this test, I modified the code to cut out the delays associated with incrementing the key schedule (this is not in assembler yet, and slows down the assembler version about 30%), leaving the of the crunching in the DES decryption. Both versions were compiled under Visual C++ 4.0, with Optimizations set to 'Maximize speed', and inlines to 'any suitable', and run on a 90MHz Digital Celebris 590 under WinNT 3.51. Averaging several runs: "C": 102,300 crypts/sec ASM: 238,000 crypts/sec With Java, it's possible to add native code methods to the interpreter, though it requires extra work by the user - it's harder than 'click on this link to run my reely kool applet'. This violates the Java sandbox, and requires the user to make trust decisions on the methods they are adding. ActiveX lets you add and run native code with a click, but again involves trust decisions. My philosophy is 'the more the merrier'. I'd like to see able to people work on DES Key Recovery on a large number of platforms and modes - we just need to standardize on the input and output formats. Peter Trei trei(a)process.com

2 1

ITARs effects
by Adam Shostack 17 Dec '03

17 Dec '03

I cross posted the ITAR proposed rev pointers to Firewalls. In addition to an entertaining rant, Marcus posted this: ----- Forwarded message from Marcus J. Ranum ----- >From mjr(a)mail.clark.net Thu Dec 12 17:38:57 1996 Message-Id: <199612122240.RAA10556(a)mail.clark.net> Comments: Authenticated sender is <mjr(a)mail.clark.net.> From: "Marcus J. Ranum" <mjr(a)mail.clark.net> Organization: V-ONE Corp Baltimore office To: adam(a)homeport.org Date: Thu, 12 Dec 1996 17:42:00 +0000 Subject: that doc.... Priority: normal X-mailer: Pegasus Mail for Win32 (v2.42a) You posted a pointer to that document. It was quite interesting. I see that the feds are making INDIVIDUALS responsible for ENFORCING export laws!!! Read carefully: (9) Export of encryption software. The export of encryption source code and object code software controlled for EI reasons under ECCN 5D002 on the Commerce Control List (see Supplement No. 1 to part 774 of the EAR) includes downloading or causing the downloading, of such software to locations (including electronic bulletin boards and Internet file transfer protocol and World Wide Web sites) outside the U.S., and making such software available for transfer outside the United States, over radio, electromagnetic, photo optical, or photoelectric communications facilities accessible to persons outside the United States, including transfers from electronic bulletin boards and Internet file transfer protocol and World Wide Web sites, or any cryptographic software subject to controls under this regulation unless the person making software available takes precautions as adequate to prevent unauthorized transfer of such code outside the United States. This provision applies both to the uploading and downloading of such software. For purposes of this paragraph, the following shall constitute adequate precautions to prevent unauthorized transfer: This implies that putting something up for FTP == export. Holy shit. mjr. ----- Marcus J. Ranum, Chief Scientist, V-ONE Corporation Work: http://www.v-one.com Personal: http://www.clark.net/pub/mjr "I'll have time to be laid back when I'm laid out on a slab" ----- End of forwarded message from Marcus J. Ranum -----

6 7

Re: Elliptic curves--hot stuff here
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 05:18 AM 12/13/96 -0500, my baby, Jill, wrote: :Please tell the faggots to stop being so sexist. : :Jill : OK, all you faggots stop being so sexist. :Just what is it about these queers that makes them hate women so much :anyway? Are they jealous of us sexy women because their boyfriends :may want us? Oh, yea, and all you sexy hot AOL chicks stop turning on all the queers' boyfriends. P.S.: Jill, come up and see me sometime. I'm ready to start over if you are. XXOO Snookums

1 0

RSA Laboratories seeks contributions for the "next generation" of PKCS
by John Gilmore 17 Dec '03

17 Dec '03

From: Ray Sidney <ray(a)RSA.COM> To: "'e-payment(a)bellcore.com'" <e-payment(a)bellcore.com>, "'firewalls(a)greatcircle.com'" <firewalls(a)greatcircle.com>, "'ietf-otp(a)bellcore.com'" <ietf-otp(a)bellcore.com>, "'ietf-pkix(a)tandem.com'" <ietf-pkix(a)tandem.com>, "'ipsec(a)ans.net'" <ipsec(a)ans.net>, "'www-security(a)ns2.rutgers.edu'" <www-security(a)ns2.rutgers.edu> To: "'rsa-licensees(a)rsa.com'" <rsa-licensees(a)RSA.COM>, "'swan-dev(a)rsa.com'" <swan-dev(a)RSA.COM>, "'smime-dev(a)rsa.com'" <smime-dev(a)RSA.COM> Subject: RSA Laboratories seeks contributions for the "next generation" of PKCS Date: Fri, 13 Dec 1996 10:07:47 -0800 Comments and suggestions are invited for the next generation of the Public-Key Cryptography Standards, the intervendor specifications developed starting in 1991 by RSA Laboratories in conjunction with industry and universities. The Public-Key Cryptography Standards were established to provide a catalyst for interoperable security based on public-key cryptographic techniques, and they have become the basis for many formal standards and are implemented widely. With several years' experience and review, and with many new developments in cryptography since 1991, it is now time to update PKCS. Suggestions are invited in the following areas: * improvements to the current suite of standards * contributions for new standards, including standards for transport and local storage of personal information such as private keys and certificates, and standards for platform-independent cryptographic programming interfaces PKCS documents are low-level standards stating precisely how one may accomplish specific cryptographic or cryptography-related tasks. Most are concerned with specifying byte-level recipes (often in ASN.1) for formatting various types of data (such as a block which is to be RSA-encrypted), rather than making general security-related recommendations ("An RSA modulus should be at least XXX bits long."). RSA Laboratories is actively soliciting suggestions and contributions for the "next generation" of PKCS from now until the end of April 1997. If you have written up a document detailing extensions you've made to an existing PKCS, and you feel that others could benefit from the use of your extensions, then we'd like to see your document. If you have an idea for a new PKCS, we'd like to hear that, too. And if you have something somewhere in between, send it along; of course, detailed, well-developed contributions are generally preferred. Suggestions should be sent either to the pkcs-tng(a)rsa.com mailing list (you can subscribe to this list by sending email with "subscribe pkcs-tng" in the message body to majordomo(a)rsa.com; unsubscribe with "unsubscribe pkcs-tng") or to pkcs-editor(a)rsa.com, whichever is deemed more appropriate. Current PKCS documents are: PKCS #1: RSA Encryption Standard. PKCS #3: Diffie-Hellman Key-Agreement Standard. PKCS #5: Password-Based Encryption Standard. PKCS #6: Extended-Certificate Syntax Standard. PKCS #7: Cryptographics Message Syntax Standard. PKCS #8: Private-Key Information Syntax Standard. PKCS #9: Selected Attribute Types. PKCS #10: Certificate Request Syntax Standard. PKCS #11: Cryptographic Token Interface Standard (CRYPOKI). The above documents are available from RSADSI's web site, and links to them may be found at http://www.rsa.com/rsalabs/pubs/PKCS/. All contributions received shall be examined, and, if appropriate, a workshop (or several workshops) shall be held to further determine the content of the "next generation" of PKCS.

1 0

Enigma
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Tim C. Mayonnaise, a product of anal birth, appeared with a coathanger through his head. /\_./o__ Tim C. Mayonnaise (/^/(_^^' ._.(_.)_

1 0

ITAR -> EAR; loss of First Amendment Rights.
by Peter Trei 17 Dec '03

17 Dec '03

Reading the proposed new rules, what disturbs me most deeply is the statement: - start quote - 16. Section 734.7 is amended by revising paragraph (b) to read as follows: 734.7 Published information and software. * * * * * (b) Software and information is published when it is available for general distribution either for free or at a price that does not exceed the cost of reproduction and distribution. See Supplement No. 1 to this part, Questions G(1) through G(3). Note that encryption software controlled under ECCN 5D002 for "EI" reasons on the Commerce Control List (refer to Supplement No. 1 to part 774 of the EAR) remain subject to the EAR even when publicly available. Accordingly, such encryption software in both source code and object code remains subject to the EAR even if published in a book or any other writing or media. - end quote - It appears that we will now have the unique situation that a book which contains cryptographic info or source code will be illegal to export or sell to a non-citizen, without getting export permission. I am not aware of any prior time when the government attempted to claim that printed material, freely available in bookstores and newsstands to US citizens, became contraband when sold or given to a non-citizen. Who's responsible for enforcing this? The vendor? The clerk at Barnes & Noble? The publisher? If the latter, how many publishers will take the risk of printing books with crypto information? Will Wiley pull "Applied Cryptography" from the shelves? This doesn't just chill free speech, it dunks it in liquid helium. It's difficult to think of clearer case of prior restraint. ----------------- Peter Trei trei(a)process.com Disclaimer: I am not speaking for my employer.

3 2

Would you send money to Gary Rasmussen ?
by peter.allan＠aeat.co.uk 17 Dec '03

17 Dec '03

Gary Rasmussen (RagyR(a)aol.com) replies to me as below: Have people got a view on the second question ? I've had no contact with Gary before and he may very well be honest; but there's proper trust and there's stupidity. > Hi Peter, > > > I'm looking for Kahn's book. Have you an acccurate price now? > > A lot of copies (about 100) have been sold since .... > > > > (And is there anyone I'd know who'd suggest I send you money ?!) > > Good question, but very hard to answer since I don't know who you > know. Can tell you that I operate Classical Crypto Books primarily as > a service for other members of the ACA. Two possible references are > the current and past ACA presidents: > > jimg(a)mentat.com (Jim Gillogly, ACA President 1996-1998) > 75542.1003(a)CompuServe.COM (Randy Nichols, ACA President 1994-1996) > > Operating CCB is not my main occupation (by day I'm a scientist working > for MIT's Lincoln Lab). Can also say proudly that in 1.5 years of operating > CCB I haven't had any complaints. > > Please let me know if you have other questions or would like a complete > copy of the CCB catalog. > > Best Wishes, > Gary Rasmussen > Classical Crypto Books

1 0

[Privacy] Airline background checks...
by aaron＠herringn.com 17 Dec '03

17 Dec '03

WASHINGTON (CNN) -- Under plans to overhaul the airline security system, making a plane reservation would trigger an instant profile of a passenger's background, including past travels and possible criminal history information. [...] Government should pay The committee, made up of 23 industry, government and public interest groups, suggested the federal government, not the airline industry, pay for the increased security measures. It estimated the proposals would cost $9.9 billion over the next 10 years. "It's not an airline or airport problem. It's a national security problem," Lally said. "Airports and airlines are surrogate targets. The real targets are the policies and government of the United States." [...] http://www.cnn.com/US/9612/13/airline/index.html

1 0

THE CRYPTOCRACY'S PLAN TO PSYCHOCIVILIZE YOU
by nobody＠replay.com 17 Dec '03

17 Dec '03

http://www.nwlink.com:88/~dbader/

2 1

Chek it out
by Zer0.Faith.Inc.＠website.chek.it.out 17 Dec '03

17 Dec '03

www.geocities.com/SiliconValley/Heights/2608 It's Kool, but still under construction.

1 0

Wired Integrity
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

The latest issue of Wired has a nice article about Sameer Parekh and C2Net. What is troubling is that it is written by Sandy Sandfort who works at C2Net. There is no indication of this in the vicinity of the Wired article. The Little Green Man

2 1

From Houghton-Mifflin MIS regarding the ongoing self-mailbombing
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A lesson in stupidity. - -rich [Forwards from impeccable intermediate sources snipped; if you REALLY need to confirm, mail me.] - ------- Forwarded Message OK. I used to work in the MIS department of Houghton Mifflin, and still am good friends with the upper MIS people. In fact I had dinner with them last night. Although the promotion is/was real, PLEASE DON'T SEND THEM ANY MORE EMAIL. The mail gateway is throttling with the incoming mail - we had a long talk last night over how to aleviate this problem. They've gotten alittle over 100k messages in 1 week. The mail server is currently a SPARC 5 w/ 64MB RAM and a gigabyte of swap, and is so hosed that they're switching in an Ultra2 tonight to try to handle the load. The lesson here is: don't do a marketing ploy without first consulting your Tech people. Apparently, the whole thing was cooked up by one of the departments, who neglected to tell MIS. Also, for those of you who might possibly work in industry in the future and are looking for a way to gather email addresses or do some kind of promotion like this, USE WEB HITS. The average email coming in to HMCo is about 4kb, requires disk space, and requires a vfork() of sendmail to deliver. A typical Http hit runs less than 100bytes, is served by a threaded httpd server, and requires very little disk access. Anyway, this is just a note to please spare my friends at HMCo. The kids are going to get all the donations promised, and my friends have enough headaches. Thanks! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMrHJDJNcNyVVy0jxAQH98wH/RA2dc5bLz3KbX0JoyVha5+XoppMSgNtB 8MvVemU5iOeBRrJTENo1bj6OYx8b7ie8E95OUsBy9Kx0RpFfpOmBSA== =QdmN -----END PGP SIGNATURE-----

1 0

Re: Would you send money to Gary Rasmussen ?
by jimg＠mentat.com 17 Dec '03

17 Dec '03

Yes, I've sent Gary Rasmussen (RagyR, Classical Crypto Books) money and received books. He's prompt and honest, in my experience, and even offered to refund my money on the latest edition of Kahn's "The Codebreakers" when I pointed out that there's very little new info in it (16 pages), and it's not integrated with the text, nor does it include the copious footnotes that make the original so valuable. I met him at the most recent American Cryptogram Association meeting, and he was efficient and personable there as well. In fact, I just sent him another $69.95 today for the Handbook of Applied Cryptography -- the ACA member price. His price breaks are usually much deeper for ACA members; evidently the margin is lower for modern low-volume professional texts like this than for the classical ones I usually buy. Jim Gillogly jim(a)acm.org > From: peter.allan(a)aeat.co.uk (Peter M Allan) > > > (And is there anyone I'd know who'd suggest I send you money ?!)

1 0

Re: In Defense of Anecdotal Evidence
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Hats off to Rob Carlson for a great article! At 9:54 AM 12/13/1996, Rob Carlson wrote: >On Thu, 12 Dec 1996 14:12:23 -0800, Huge Cajones Remailer wrote: >>Statistics are a useful tool, but they have their problems. Their >>accuracy is often in doubt. Most scientific data comes with an >>error analysis so you can tell what the figure means. For some >>reason statisticians never do this so we cannot tell whether their >>numbers are accurate to within 0.1%, 1.0%, 10%, or even worse. >> >>There are many other problems. For instance, users of statistics >>assume they have a random sample, even in cases where that is far >>from clear > >[ List of other problems deleted ] > >Of course, anecdotal evidence also suffers from all of these >problems. And in greater magnitude. This is true since it is a >special case of statistical evidence. With a non-random sample set of >one and no controls for observer bias. Excellent point. On the other hand, if everybody operates correctly based on their own (non-random) experience in general the right outcomes will occur. This is rational if the tertiary statistical evidence is unreliable. What you are implicitly assuming is that the studies one reads were done honestly and competently. Yet, the chain of evidence is rather weak. Typically, we don't even know the people who did the study. Given the many contradictory results obtained by social statisticians, we have substantial evidence that there is something wrong with their methods or their application. Another way to judge the experts is through selected in depth studies of their work. I have not found the results to be encouraging. >>The advantage of anecdotal evidence (in the sense we have been using >>it) is that the person who is telling you the anecdote was there and >>saw it. You can cross-examine them and get a full understanding of >>the evidence provided. > >The reporting of evidence involves different issues. If you want to >believe that women are actually cut in two or that politicians are >telling the truth anytime their lips are moving, thats one thing. If >you want to tell me its true because you personally observed it, >thats quite another. > >Given the failures of humans as observational tools, your story is >unverifiable by me. Perhaps through effective cross examination I >can prove you wrong, but I can never prove you right with such a >technique. That will require other evidence outside the control of >the observer ( statistical is just one available ). Occasionally we may teach somebody else about something they observed and change their mind. This is not the same thing as proof, but it is worthwhile. In other cases, we may have beliefs about the integrity of our observer. We may believe that they will not intentionally lie. That means we can separate out their interpretations from the exact details they can recall. Even if our correct interpretation is not accepted by the observer, that does not imply that we can learn nothing of interest. >This doesn't make studies or statistical evidence true. Just more >reliable than anecdotal evidence. I should make clear that I have not ruled out statistical evidence as a tool. We have to be aware of its limitations. >Humans who will lie about their observations will also produce flawed >studies. Again the former (anecdotal) is unverifiable, but I can >check the latter (statistical) independently. Actually, it is cheaper and easier to develop an understanding of the reliability of anecdotal evidence. Often we may have known the observer for some time and be able to form theories about their character and ability to accurately interpret what they have seen. We can ask them what they saw on different occasions and see if we get about the same story back. We can think about whether the person has intentionally lied in the past and, if so, under what circumstances. We can ask ourselves what motivation the person might have to lie. Is there any benefit to giving a particular story? >Relying on anecdotal evidence makes you susceptible to the magicians >of the world. The honest ones use mirrors and their need is to >entertain you enough to get your money. The rest use anecdotal >evidence and emotional arguments (verbal misdirection?). Their needs >are left as a test of the reader's naivete. What needs are satisfied by the white cloaked priests of social science? Which of their needs are satisfied by their work? Very few of these people are independent. They are often paid by people whose interest in the truth is in question. That means that the temptation to fudge (and humans find ways to rationalize such actions) is very powerful. The people preparing the statistical studies are often interested in the fame associated with career advancement. None of this is conducive to the search for truth. >Evidence that can be verified independently by many observers >increases the reliability. Experiments and polls can be done by me >thus eliminating your bias. Independent verification can also check >for errors and check the parameters under which the evidence is true. >Studies are done with certain assumptions and controls. The evidence >loses its reliability when removed from this context. I have serious doubts about these methods. I am not a statistician, so there is a possibility that I am simply ignorant. However, I would expect that if these methods of determining the accuracy of the statistics were effective, that it would be possible to provide some sort of error analysis. When we get a figure for the GDP we know that it is highly unlikely to be exactly correct. What is the probability that it is low by 10%? I fail to see how the figure can even be useful without this information. In the case of a complex study involving the measure of biases to adjust the final conclusions, it would be most useful to discuss the probability that the bias was not measured correctly. This must surely affect our final results, especially when many biases and other measurements are combined. Red Rackham

1 0

Appropriate Topics for Cypherpunks
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

At 9:54 AM 12/13/1996, Rob Carlson wrote: >To make this on topic, how does this apply to cryptography and >crypto-politics? This issue is a foundation of our discussions here. >Shall we accept anecdotal evidence such as the "If you only knew what >we knew" arguments? What is more reliable: IPG's claims that their >product is an OTP because they say it is or Bruce Schneier's book >that can be used to point out the fallacy's in their claims? I'm sure Rob Carlson already realizes this, but just in case let's be very clear that a discussion of the value of anecdotal evidence is so on topic to this list that it isn't funny. We are talking about trust models. The reason that the Net is a fundamental threat to the established social order is that it will probably result in a worldwide change in trust models. For one thing, we are now learning just how venal and corrupt the world leadership really is. At the same time, cross-border relationships and trust are flourishing. The rise of anonymous identities raises the question of how we can "trust" somebody we have never met. This immediately leads to the question of why we trust other people we haven't met, such as the President, or scientists, or whomever. It turns out our reasons for "trusting" these people are not as solid as some of us once believed. The attempts to crush strong cryptography - especially if it implies anonymity with strong authentication - is an attempt to undermine the trust developing between disparate groups of people. And, in a sense, that is what politics has always been about: the subversion of trust between groups of people so they can be played off each other for the benefit of the few. Back to what is appropriate to this list: What the cypherpunks is suffering right now is not an excess of well written articles that are off topic. I suggest that anybody who feels very strongly that they are not seeing articles of the appropriate content follow Rob Carlson's example and show the rest of us how it is done. Red Rackham

2 1