December 2003 - cypherpunks-legacy

PGPTools
by m＠BlueRose.com 17 Dec '03

17 Dec '03

I don't have ftp access here. Could some kind person please email it to me? M

1 0

PGP
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

I was wondering if anyone has an answer to a question on PGP.... About how many calculations does it take to crack a 1024 bit key? If someone has limitless time, money, etc., they can break it...but how many calculations does it take? Also, there is a password used to protect the keyrings. Assuming a strong password how many calculations does that take to break? If there isn't some special method, an assumption that leads nowhere, just how much "brute force" effort is really required? Thanks, Dave

2 1

Re: Linear Cryptanalysis of DES - New Developments by Matsui
by markh＠wimsey.bc.ca 17 Dec '03

17 Dec '03

> > On Jan. 27, at the Japanese Conference on Cryptography and Information > Security, Mitsuru Matsui of Mitsubish presented a known plaintext > attack on the full 16-round DES. It requires 2^43 plaintext-ciphertext > pairs, and breaks the scheme in 50 days on 12 HP9735 workstations. > > I have absolutely no more information at this point. I will post again > when I know something else. I would _really_ like to see this paper. Does anyone have a preprint or copy they'd be willing to share? Mark -- Mark Henderson markh(a)wimsey.bc.ca (personal account) RIPEM MD5OfPublicKey: F1F5F0C3984CBEAF3889ADAFA2437433 ViaCrypt PGP Key Fingerprint: 21 F6 AF 2B 6A 8A 0B E1 A1 2A 2A 06 4A D5 92 46 cryptography archive maintainer -- anon ftp -- wimsey.bc.ca:/pub/crypto

1 0

Comments Requested for preso outline
by jdblair＠nextsrv.cas.muohio.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Fellow c*punks, I plan on creating several informational sessions on net legal issues here at Miami University. Use of E-mail has risen considerably in just the last year. Most users of this e-mail have no idea how the words move from their screen to the screen of the addressee, much less government attempts to regulate cryptography. I want to create an overview of no more than an hour (hopefully shorter) that will cover many of the important issues involved. The meetings will be followed by PGP distribution and key generation on Mac and MS-DOS platforms. The following outline is "version 0.1" of what I would like to explain. Unfortunately, I believe the outline needs to be considerably edited. The main problems are 1) Keeping interest, and 2) Making concepts of cryptography understandable for people who are not mathematicians or programmers. I would appreciate any input, criticisms, suggestions any of you have. Mainly, I'm looking for ideas about the best way to teach a basic, conceptual understanding of public key cryptography and digital signatures. I don't expect every person who shows up to start encrypting their communications. What I aim to do is increase awareness, mainly about the activities of their government, and to distribute PGP. These will be people interested in the future of the net as end users, not as code- writers or hackers. I want to educate them about the policies, being formed now, that will affect the net for decades. - -john. - --------------------------------cut here------------------------------- 1) Basic overview of the net. o There is, currently, no "Internet Inc." o The Internet started as a cold war problem: How do you communicate after a nuclear attack? Electronic Mail: How do the words go from your screen to your friend's screen? o broken up into ASCII packets and sent towards the destination this ASCII could be intercepted and read by numerous people along the way Why should you be worried about your privacy? o low cost of information archiving o low cost of key-word scanners o ease of implementation, at least along backbones (in our area, OARnet) o the backbones are often funded, or operated by government agencies o you use envelopes in reality, why not in Cyberspace? 2) How do you keep communications private?: Overview of encryption o encryption is hiding data in plain site o plaintext -> key -> ciphertext relationship o symmetric ciphers > requires a secure channel for key transmission > limited to governments, corporations > ex: DES, used by banks for wire transactions o public key ciphers > does not require a secure channel for key transmission > relationship of public/private keys > overview of a transmission > conceptual description of Alice and Bob communicating (diagrams) o signing methods > what is a digital signature? > what can they be used for? > verifying the integrity of a message o What makes an algorithm secure? > peer-reviewed, public algorithm > security in vast key-space, not in secret algorithm o Software you can use > PGP > demonstrate key generation, data encoding/decoding > various other schemes, probably Curve Encrypt (IDEA) 3) Legal Issues o government regulation > What is the NSA? > Export Laws > Clipper/Skipjack o What is Clipper? > government designed hardware encryption for voice and data > secret algorithm > government backdoor > created to allow tapping of communications by drug dealers, terrorists, etc. o what does it mean for you? o why won't it work? > smart criminals won't use it > government checks on key use probably inadequate o what can you do? > distribution of letter to the president, congress, representatives > encourage algorithm distribution > EFF info 4) Software distribution, Key generation o Mac and MS-DOS PGP o Curve Encrypt -----BEGIN PGP SIGNATURE----- Version: 2.3 iQBVAgUBLU2L+hD3efpluabZAQHzEwH8DPrdnDfG2zVXAD/MV+21+m6iinT7DN1+ PshKBLAE/UfZCjlplGgZGaHBY+8O9gQ/XsCUp5HDJRLKSxzVvCGKEg== =53C1 -----END PGP SIGNATURE-----

1 0

please unsubscribe
by Mack Knopf 17 Dec '03

17 Dec '03

Unfortunately, I just can't handle all the mail and mailing the automatic server didn't work. So, please unsub! Thanks.

2 1

Re: An interesting tidbit in Information Week Magazine
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> The government's information superhighway team is finally > coming together. Commerce Secretary Ron Brown last week named > the National Information Infrastructure Advisory Council. > Members include Craig Fields, chairman of MCC; Mitch Kapor, > chairman of the *Electronic_Frontier_Foundation* and > co-creator of Lotus 1-2-3; nathan Myhrvold, senior VP for > advanced technology at Microsoft; Bert Roberts, chairman of > MCI; and John Sculley, former chairman of Apple. Interesting stuff, though it really belongs on comp.eff.org.talk or other netnews groups rather than in cypherpunks; we've talked about it a bit, but the major cypherpunk issues are encryption policy and how much we'll be able to engage in free speech if the state-capitalists manage to steal the nets from the emerging free market. (Oh, wait, that's flame bait, isn't it? Sorry :-) Followup-To: comp.org.eff.talk -- Thanks; Bill # Bill Stewart AT&T Global Information Systems, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Re: Matsui-san Attack
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> ]> of a new attack by Mitsuru Matsui of Mitsubishi that requires 2^43 > ]> *known* plaintexts, not chosen ones. The note I received says that it > ]> ``breaks the scheme in 50 days on 12 HP9735 workstations''. This was > ]> presented last week at the Japanese Conference on Cryptography and > ]> Information Security. Fortunately, attacks requiring large quantities of known or chosen plaintext aren't very relevant to secure email, since typically each message has a different randomly-selected key used only for that message; even if you discover the key, it isn't used in previous or future messages so the compromise is limited. A 1GB message gives about 2^27 8-byte texts, and if you have that much known plaintext, you probably don't need to decrypt the rest :-) On the other hand, if someone had a known-or-chosen plaintext attack on a public-key algorithm, that would be interesting, since you can generate as much chosen plaintext as you want. > 50 days on 12 HP9735 = 600 days on a single HP9735 > The 735 has a pretty fast Mflop rating (compared to Sun, IBM, SGI, PC, and > Macs). Using a comparable breaker on the average machine, it is going > to take two years to "break the scheme". > That leaves two years to create stronger/tighter strategies. Crypto usually cares more about integer MIPS than MFLOPS. I'm not up on current HP models, but 12 HP machines should cost between $100K and $1M, which makes this attack close to the second-best attacks on DES, which will break a key in a day for ~$30-50M - Peter Wayner's design used Content Addressable Memory, and somebody from DEC designed and I think built a Gallium Arsenide DES chip. The best is Michael Wiener's design using CMOS gate arrays, which should be able to break a key in about 3-4 hours for $1M. Doing this well with general-purpose hardware is impressive. But, yes, this means your PC will still take a while to crack DES; on the other hand, the NSA has probably been building massively parallel DES-crackers for a few years, and is more likely to try to break secure email than most amateurs. :-) Bill # Bill Stewart AT&T Global Information Systems, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Re: 2-way anonymous via SASE
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Hal Finney writes: > From: "Jon 'Iain' Boone" <boone(a)psc.edu> > > So, you use a chain of anonymous-id's to set up your return-path? > > Unfortunately, return-paths are not exactly the strong point of the > current cypherpunks remailers :-). That is what much of the discussion > in this thread has discussed: how to best allow for convenient but secure > return paths. Yeah; the only solutions I've seen so far either give you some persistence, like anon.penet.fi, or no replies, or have generally been pretty ugly, requiring rapidly-increasing numbers of messages to set up chains of anonymous IDs, or use broadcast, like the Blacknet "post to Usenet" or DCnets. AIR-MAIL may be a start. It seems to need something that supports a small but >1 number of replies to make a non-ugly system, which means either some kind of Time-To-Live or destruct messages from one or both ends need to be supported. Bill

1 0

PGP keyid collisions?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

I had discussed the benefit of putting PGP keyID or fingerprint in signatures to reduce spoofing for people who distribute by finger or unreliable keyservers, though obviously signatures are what gives you the confidence that a key is valid. Hal points out that brute-forcing a 24-bit Key-ID isn't all that hard; the usual formulas tell you what fraction of numbers are prime in the desired range, though without looking them up I'd expect it would take around 2**30 - 2**35 tries to find a specific one; I suppose this means the NSA has already done it :-) > I understand there is already at least one 24-bit collision on the > public key servers, not unexpected given a few thousand keys. I assume PGP does the right thing, except in cases of pilot error (e.g. doing key lookup by KeyID) ? Even if it does, this has some design impact on systems using random public-private key generation for meet-me remailer cutouts. Bill # Bill Stewart AT&T Global Information Systems, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

BlackNet - what is it?
by Roy Franz 17 Dec '03

17 Dec '03

Hi, I have seen BlackNet referred to several times. Could someone say a few words about it? Thanks, Roy ----------------------------------------------------------- Roy B. Franz rbfranz(a)ucdavis.edu Software Engineer Viewgraphics, Inc

1 0

Re: BlackNet - what is it?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Blacknet wasn't real; it was a posting Tim May anonymously posted advertising network support for various illegal services, including where to send your digicash blackmail or ransom payments and the like. Basically to try to get us to think about the implications of the technologies we're developing and potential for abuse and paranoia. On the other hand, maybe it wasn't *really* Tim May anonymously posting it, and the Tentacles of Detweiler will be posting GIFs of you and your friends talking to notorious politicians to alt.your.mother and releasing that new virus with your name on the banner page unless you help Eric start a digibank to deposit some ransom money in. :-) Bill,or someone like him

1 0

Re: 4th ammendment and Cryptography
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

I'll second Phil Karn's recommendation of Caroline Kennedy's book, though I do remember it having somewhat of a liberal "Government is Good" bias. Unless I'm mixing it up with another book I read around the same time, it's also the one place where I've seen a recent 3rd Amendment case. The case was interesting largely because 3rd Amendment cases are very rare; the U.S. government hasn't quartered troops in people's homes except during the War Between The States, when it was ignoring the Constitution and Bill of Rights anyway. The issue was a prison guard strike, in which the National Guard was brought in to replace striking guards until the contract dispute was settled. Guards at the prison had rooms there for sleeping and off-duty use, and the National Guard, which is part of the military, used them during the strike. The guards contended that this was quartering troops in their homes. I think the government won the case rather than the prison guards, since it was really stretching the point. Phil's concerns about not freaking people out by emphasizing that the Second Amendment is designed to make overthrowing governments possible are well-placed (notwithstanding the fact that it's true.) It may be good rhetoric to use at a pro-gun meeting, though a lot of the NRA people I've met tend to get upset by the word "anarchy", but the general public just barely tolerates duck hunting and really has no desire for violent revolution, and frankly, neither do I. We're trying to go for their hearts and minds here, and issues like privacy, freedom of speech, and Big Brother tapping your phone are a lot more attractive to most people. Even the ideas that private communications can make government obsolete and that obsolete institutions can fail are pretty scary to people who've been educated in government schools, and associating crypto-privacy with the more extreme radically-correct side of the Gun Nuts will lose them - especially when there *are* legitimate concerns about use of anonymity and digicash for blackmail, ransom, and funding of real terrorists, plus the government's favorite drug dealer scare. Besides, walking around making unattributed quotations from the writings of the Founding Fathers tends to get you treated like David Koresh or at the very least Michael Milken.... Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Re: PGPkeys (ftp access)
by Doodeck 17 Dec '03

17 Dec '03

> Subject: PGPTools > From: m(a)BlueRose.com (M Carling) > I don't have ftp access here. Could some kind person please email it > to me? I don't have ftp (or Internet) access either. Try using one of BITFTP (BITnet FTP I think) services. Automated info response will be send to you upon sending mail with message body containing word "help" (without quotes) to one of the following addresses: bitftp(a)pucc.princeton.edu or bitftp(a)pucc.bitnet (located in USA) bitftp(a)plearn.edu.pl or bitftp(a)plearn.bitnet (located in Central Europe) Just before onset of twenty first century such ftp 'access' may seem ridiculous but it really works as I have transferred megabytes of data this way. Good Luck ! Doodeck.

1 0

Cypherpunk article in NY Newsday
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

There's a decent cypherpunk piece in today's New York Newsday. It was written by Joshua Quittner, who apparently attended the most recent meeting out in CA. It's more or less the usual, very upbeat and supportive, with some quotes from Eric H. and remarks on digibanking basics, Clipper, etc. --Dave.

1 0

Privacy As Roadkill
by f_griffith＠ccsvax.sfasu.edu 17 Dec '03

17 Dec '03

>Date: Mon, 31 Jan 1994 12:37:12 -0800 (PST) >From: Dave Wren <dwren(a)olympus.net> >Subject: Privacy As Roadkill >To: "libernet(a)Dartmouth.edu" <libernet(a)Dartmouth.EDU> >Errors-To: owner-libernet(a)Dartmouth.EDU >Sender: owner-libernet(a)Dartmouth.EDU >Reply-To: libernet(a)Dartmouth.EDU >Precedence: bulk >X-Mailing-List: libernet(a)Dartmouth.EDU > > >---------- Forwarded message ---------- >Date: Sun, 30 Jan 1994 21:00:50 -0800 >From: "Brock N. Meeks" <brock(a)well.sf.ca.us> >To: com-priv(a)psi.com >Subject: Privacy As Roadkill > > > >Jacking in from a "Private No More" Port: > >Washington, DC -- If privacy isn't already the first victim of >roadkill along the information superhighway, then it's about to be. > >A law enforcement panel addressing the Administration's Information >Infrastructure Task Force Working Group on Privacy told a public >meeting here last week that it wanted to "front load" the National >Information Infrastructure with trap door technologies that would >allow them to easy access to digital conversations; eavesdropping >on any conversation or capturing electronic communications >midstream. > >But only for "the bad guys." Us honest, hard working, law abiding >citizens have nothing to fear from these law enforcement agencies >selling out our privacy rights to make their jobs easier. Nope, we >can rest easy, knowing that child pornographers, drug traffickers >and organized crime families will be sufficiently thwarted by law >enforcement's proposed built-in gadgetry for the national >information infrastructure. > >There's just a small problem: Law enforcement agencies, any law >enforcement agency, has yet to prove it needs all these proposed >digital trap doors. In fact, according to a U.S. Assistant >Attorney appearing on the panel, "Right now most law enforcement >personnel don't have any idea what the NII is." > >Gore Gives Go Ahead >=================== > >Panel members, representing the Justice Dept., FBI and U.S. >Attorney's office, said that they took Vice President Gore's >promise that the White House would work to ensure that the NII >would "help law enforcement agencies thwart criminals and >terrorists who might use advanced telecommunications to commit >crimes," as tacit approval of their proposals to push for digital >wiretap access and government mandated encryption policies. > >Gore buried those remarks deep in a speech he made in Los Angeles >earlier this month when the Administration first fleshed out how it >planned to rewrite the rules for communications in a newer, perhaps >more enlightened age. Those remarks went unnoticed by the >mainstream press. But readers here were forewarned. > >Fuck Ross Perot's NAFTA-induced "giant sucking sound." That >"thump" you just heard was Law Enforcement running over the privacy >rights of the American public on its way to the information >superhighway. The real crime is that the collision barely dented >the damn fender. > >This cunning and calculated move by law enforcement to install >interception technologies all along the information superhighway >was blithely referred to as "proactive" law enforcement policy by >Assistant U.S. Attorney, Northern Dist. of California Kent Walker. >Designing these technologies into future networks, which include >all telephone systems, would ensure that law enforcement >organizations "have the same capabilities that we all enjoy right >now," Walker said. > >With today's wiretap operations, the Feds must get a court to >approve their request, but only after supplying enough evidence >warrant one. But Walker seemed to be lobbying for the opposite. >Giving the Feds the ability to listen in first and give >justification later was "no big difference," he said. Besides, "it >would save time and money." > >It's Us vs. Them >================= > >For Walker privacy issues weighed against law enforcement needs are >black and white, or rather "good guys" vs. "bad guys." For >example, he said the rapid rise of private (read: non-government >controlled) encryption technologies didn't mean law enforcement >would have to work harder. On the contrary, "it only means we'll >catch less criminals," he said. > >But if law enforcement is merely concerned with the task of "just >putting the bad guys in jail," as James Settle, head of the FBI's >National Computer Crime Squad states, then why are we seeing an >unprecedented move by government intelligence agencies into areas >they have historically shied from? Because law enforcement >agencies know their window of opportunity for asserting their >influence is right now, right at the time the government is about >to take on a fundamental shift in how it deals privacy issues >within the networks that make up the NII, says David Sobel, general >counsel for Computer Professionals for Social Responsibility >(CPSR), who also spoke as a panel member. > >"Because of law enforcement's concerns (regarding digital >technologies), we're seeing an unprecedented involvement by federal >security agencies in the domestic law enforcement activities," >Sobel said. > >Sobel dropped-kicked this chilling fact from behind the closed >doors of the Clinton Administration into the IITF's lap: For the >first time in history, the National Security Agency (NSA) "is now >deeply involved in the design of the public telecommunications >network." > >Go ahead. Read it again. > >Sobel backs up his claims with hundreds of pages of previously >classified memos and reports obtained under the Freedom of >Information Act. The involvement of the NSA in the design of our >telephone networks is, Sobel believes, a violation of federal >statutes. > >Sobel's also concerned that the public might soon be looking down >the throat of a classified telecommunications standard being >created. Another move he calls "unprecedented," is that if the >NSA, FBI and other law enforcement organizations have their way, >the design of the national telecommunications network will end up >classified and withheld from the public. > >Sobel is dead bang on target with his warnings. > >The telecommunications industry and FBI have set up an ad hoc >working group to see if a technical fix for digital wiretapping can >be found to make the Bureau happy. That way, legislation doesn't >need to be passed that might mandate such FBI access and stick the >Baby Bells with eating the full cost of reengineering their >networks. > >This joint group was formed during a March 26, 1992 meeting at >FBI's Quantico, Va., facilities, according previously classified >FBI documents released under Freedom of Information Act. The group >was only formalized late last year, working under the auspices of >the Alliance for Telecommunications Industry Solutions (ATIS). The >joint industry-FBI group operates under the innocuous sounding name >of the Electronic Communications Service Provider Committee >(ECSPC). > >The ECSPC meets monthly with intent of seeking a technological >"solution" to the FBI's request for putting a trap door into >digital switches that would allow them easy access to those >conversations. To date, no industry solution has been found for the >digital wiretap problem, according to Kenneth Raymond, a Nynex >telephone company engineer, who is the industry co-chairman of the >group. > >Oh, there's also a small, but nagging problem: The FBI hasn't >provided a concrete basis that such solutions are needed, Raymond >said. CPSR's Sobel raised these same points during the panel >discussion. > >The telecommunications industry is focused on "trying to evaluate >just what is the nature of the [digital access] problem and how we >can best solve it in some reasonable way that is consistent with >cost and demand," Raymond said. One solution might be to write >digital wiretap access into future switch specifications, he said. > >If and when the industry does find that solution, do you think the >FBI will put out a press release to tell us about it? "I doubt it >very much," said FBI agent Barry Smith with the Bureau's >Congressional Affairs office. "It will be done quietly, with no >media fanfare." > >Is it just me or are these headlights getting REALLY close? > >The FBI's Settle is also adamant about trap door specifications >being written into any blue prints for the National Information >Infrastructure. But there's a catch. Settle calls these "security >measures," because they'll give his office a better chance at >"catching bad guys." He wants all networks "to be required to >install some kind of standard for security." And who's writing >those standards? You guessed it: The NSA with input from the FBI >and other assorted spook agencies. > >Settle defends these standards saying that the "best we have going >for us is that the criminal element hasn't yet figured out how to >use this stuff [encryption and networks in general]. When they do, >we'll be in trouble. We want to stay ahead of the curve." > >In the meantime, his division has to hustle. The FBI currently has >only 25 "net literate" personnel, Settle admitted. "Most of these >were recruited 2 years ago," he said. Most have computer science >degrees and were systems administrators at time, he said. > >You think that's funny? Hell, the Net is a still small community, >relatively speaking. One of your friends is probably an FBI Net >Snitch, working for Settle. Don't laugh. > >Don't Look Now, Your Privacy Is Showing >======================================= > >The law enforcement establishment doesn't think you really know >what you expect when it comes to privacy. > >U.S. Attorney Walker says: "If you ask the public, 'Is privacy >more important than catching criminals?' They'll tell you, 'No.'" > >(Write him with your own thoughts, won't you?) > >Because of views like Walker's, the Electronic Communications >Privacy Act (ECPA) "needs to be broader," said Mike Godwin, legal >services counsel, for Electronic Frontier Foundation, speaking as >a panel member. The ECPA protects transmitted data, but it also >needs to protect stored data, he said. "A person's expectation of >privacy doesn't end when they store something on a hard disk." > >But Walker brushed Godwin aside saying, "It's easy to get caught up >in the rhetoric that privacy is the end all be all." > >Do you have an expectation of privacy for things you store on your >hard disk, in your own home? Walker says that idea is up for >debate: "Part of this working group is to establish what is a >reasonable expectation of privacy." > >That's right. Toss everything you know or thought you knew about >privacy out the fucking window, as you cruise down the fast lane of >the information superhighway. Why? Because for people like >Walker, those guardians of justice, "There has to be a balance >between privacy needs and law enforcement needs to catch >criminals," he says. > >Balance, yes. Total abrogation of my rights? Fat chance. > > >Meeks out... > > > > > >

1 0

Archiving mail-lists...
by jazz＠hal.com 17 Dec '03

17 Dec '03

I would be interested in a discussion on the mail-list on this issue. Please refrain from sending personal mail. In particular do you think such a archive without every members permission is un-ethical? Unethical, hell; illegal is closer to it. I retain the copyright to everything I post; although implicit permission to redistribute to the mailing list is granted when I send to cypherpunks(a)toad.com, I have granted no permission to anyone else to use my intellectual property (i.e. my posts, valuable or not) for any other purpose. Would a archivist necessarily need the permission of the mail-list sponser? In an actively-moderated group (i.e. where the moderator chooses which messages to forward, constructs digests, etc.) the moderator possesses a copyright on the collection of material (but not on the material itself); if you were republishing a substantial part of the collection (in your case, all of it) you'd need rights to the collection copyright also. Study copyright law (including the Berne Convention, to which most nations having Usenet sites are signatories). Understand what you're getting yourself into. Jason

8 18

Re: 4th ammendment and C
by Duncan Frissell 17 Dec '03

17 Dec '03

W >it's also the one place where I've seen a recent 3rd Amendment case. The Third Amendment. Answer to the question "What Amendment of the Bill of Rights *doesn't* the US Government violate thousands of times a day?" W >but the general public just barely tolerates duck hunting and W >really has no desire for violent revolution, and frankly, neither do W >I. Not violent revolution. Just an alternative source of authority or defense. A reality check on tyranny. A badge of sovereignty. You can't be sovereign without weapons. W >We're trying to go for their hearts and minds here, and issues like W >privacy, freedom of speech, and Big Brother tapping your phone W >are a lot more attractive to most people. The whole point of this list is that we can achieve a technological fix for the "problems of human interaction." We can free ourselves and others without changing anyone's mind. That changes of ideology can follow new technologies and the social institutions they spawn. W >Even the ideas that private communications can make government obsolete W >and that obsolete institutions can fail are pretty scary to people W >who've been educated in government schools, and associating W >crypto-privacy with the more extreme radically-correct side of the Gun W >Nuts will lose them. Then the bulk of the population has a lot of frights coming and we are providing a public service by letting them confront their fears early in the game. What we are doing is predicting not advocating. If social changes increase people's personal liberties, their liberties are increased whether we point them out or not. In any case, our sort of analysis is creeping into the straight business press (particularly Forbes) and when C. Wright Wriston (former Citibank CEO) writes a book like "The Twilight of Sovereignty" how off the wall can we be? W >especially when there *are* legitimate concerns about use of W >anonymity and digicash for blackmail, ransom, and funding of real W >terrorists, plus the government's favorite drug dealer scare. These people could use existing techniques but mostly don't. Can you *believe* the WTC bombers getting their dough by an open wire transfer from the BRD? W >Besides, walking around making unattributed quotations from the W >writings of the Founding Fathers tends to get you treated like W >David Koresh or at the very least Michael Milken.... I don't remember Mike quoting the Founding Parents. His only mistake was copping a plea. DCF Western Civilization didn't invent tyranny, slavery, racism, or the oppression of women. What it did do is eliminate those evils (to the extent they have been eliminated). The rest of the world should be damn grateful and if they're not we should return them to the ancient tyrannies from which we so recently rescued them. Would serve them right. --- WinQwk 2.0b#1165

1 0

Re: archiving on inet
by jazz＠hal.com 17 Dec '03

17 Dec '03

So if I sell (at a profit) a netnews feed to subscribers via modem, it is not copyright infringement, but if I sell the same data on a CDROM, you cliam copyright infringement. Yep. When you're providing a netnews feed, you're acting as a node in a store-and-forward network. A CD-ROM is not a part of a store-and-forward network; it is a permanently fixed repository of information. You can't hold up a netnews feed in a courtroom and point at it saying "there it is"; you *can* do so with a CD-ROM. So I suppose you want to give some kind of list of what types of media are acceptable for transmitting netnews feeds, and which are not? A CD-ROM isn't a medium for transmitting netnews feeds; it's a permanently fixed copy of the contents of such a feed. Static versus dynamic; permanent, ephemeral. Is this hard to understand? The plain and simple fact is: When you post a message to usenet, you do so with the expectation that others will receive it. You can have no way of knowing or limiting who may get it; that is given by the nature of the network. Usenet news is, and is intended to be, publicly accessable information. If there is something you don't want distributed, then DON'T POST IT! Learn a little about law; while you're at it, learn a little about usenet. When you post a message to usenet, you have tossed it into a flood-routed store-and-forward network. You implicitly give permission for copying appropriate to the propagation of messages in that network. You neither grant permission nor withhold permission for Fair Use. Everything else, though, is not granted unless explicitly granted. If I post a message, under the terms of the Berne Convention and current US copyright law, a recipient was not granted the right to print a copy and publish it in a book. What makes you think I granted them permission to publish a copy in a CD-ROM? The only permission I granted was that they could (a) read it and (b) forward it via usenet protocols. Jason

14 36

Re: PGP keyid collisions?
by Hal 17 Dec '03

17 Dec '03

From: wcs(a)anchor.ho.att.com (bill.stewart(a)pleasantonca.ncr.com +1-510-484-6204) > Hal points out that brute-forcing a 24-bit Key-ID isn't all that hard; > the usual formulas tell you what fraction of numbers are prime in the > desired range, though without looking them up I'd expect it would take > around 2**30 - 2**35 tries to find a specific one; I suppose this > means the NSA has already done it :-) Right, but the point is that you have to search for a prime q anyway; PGP's algorithm is basically to repeat q += 2 until you find a q which is prime. It uses a sieve to speed this up a lot. I was pointing out that you can basically change the 2 to a 2^24, still use a sieve, and find a key just about as fast. So matching an existing key ID should not take much if any longer than just generating a PGP key in the first place. > > I understand there is already at least one 24-bit collision on the > > public key servers, not unexpected given a few thousand keys. > > I assume PGP does the right thing, except in cases of pilot error > (e.g. doing key lookup by KeyID) ? Even if it does, this has > some design impact on systems using random public-private key generation > for meet-me remailer cutouts. > Bill PGP actually uses a 64-bit key ID internally, only displaying the lower 24 bits for conciseness. It would be practically impossible to get a 64-bit key ID collision by accident (well, almost impossible, anyway). However, the technique I mentioned could easily generate such collisions. PGP does check for the case of matching key ID and does something, but I forget what. 24-bit key ID matches shouldn't have any effect except for, as Bill says, extracting/deleting keys based on key ID. Hal

1 0

Re: archiving on inet
by lefty＠apple.com 17 Dec '03

17 Dec '03

Kirk Sheppard asks > >Finally what is the tangible difference between storing usenet postings >on a hard disk for an indefinite time, or on a cd-rom, or a cd that is >re-writable, or tape or any other storage device? Not very much I would >argue. I don't believe that _storage_ is the issue at all. If I purchase a copy of a book, I don't believe that I'm violating copyright by making an archival copy of it _for_ _my_ _own_ _use_. If I start distributing or selling copies to other people, however, that's a different matter. -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

2 1

new, improved remailer GUI
by nate＠VIS.ColoState.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have added some features to the remailer GUI I built in Mosaic. It now has a radio button for choosing to use the CP remailers, and toggle switches for selecting remailers. It's also been moved, and the old one is no longer there, so don't use it. it's new location is: http://monet.vis.colostate.edu/~nate/mailer.html Give it a try, and tell me what you think. BTW, this one is fully open for business, so use it as much as you like! - -nate - -- +-----------------------------------------------------------------------+ | Nate Sammons <nate(a)VIS.ColoState.Edu> <nate(a)yuma.ANCS.ColoState.Edu> | | Colorado State University Computer Visualization Laboratory | | Data Visualization/Interrogation, Modeling, Animation, Rendering | +-----------------------------------------------------------------------+

1 0

clipper petition
by Brian D Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- CPSR sends: Electronic Petition to Oppose Clipper Please Distribute Widely >On January 24, many of the nation's leading experts in >cryptography and computer security wrote President Clinton and >asked him to withdraw the Clipper proposal. >The public response to the letter has been extremely favorable, >including coverage in the New York Times and numerous computer and >security trade magazines. >Many people have expressed interest in adding their names to the >letter. In response to these requests, CPSR is organizing an >Internet petition drive to oppose the Clipper proposal. We will >deliver the signed petition to the White House, complete with the >names of all the people who oppose Clipper. >To sign on to the letter, send a message to: Clipper.petition(a)cpsr.org >with the message "I oppose Clipper" (no quotes) >You will receive a return message confirming your vote. - From noclipr(a)snyside.sunnyside.com Tue Feb 1 08:39:20 1994 Date: Tue, 1 Feb 1994 08:39:14 -0800 From: clipper.petition(a)snyside.sunnyside.com (via CPSR automation) Subject: Your petition regarding opposition to Clipper Apparently-To: Brian D Williams <talon57(a)well.sf.ca.us> Your name has been added to the petition asking President Clinton to withdraw the Clipper proposal. We will deliver the signed petition to the White House at the end of the project. If you have any comments or questions, please email us at clipper(a)washofc.cpsr.org. "We have not yet begun to Encrypt!!" Brian Williams Extropian Cypherpatriot "Cryptocosmology: Sufficently advanced comunication is indistinguishable from noise." --Steve Witham -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLU6xXtCcBnAsu2t1AQHs8wP/cpftWyNnUtvEBcp5SuY/YR9h45DO/W7H VlgiVXf/aiOULr0dCMgJdu5BhoeV/C6MXEP0xfPNPSsk4JbpO2bn0yfcDLT69heU 9dGPE1ygVZsX4bOesk8s9eTaE+vSGpQcHXaotGrTWXo5Zsi7SFqdhraJEXFx9wnb g6lln31WF1A= =O1C5 -----END PGP SIGNATURE-----

1 0

Re: archiving on inet
by Jim choate 17 Dec '03

17 Dec '03

> > Jim - > > >Where is this agreement that it is ok to distribute material through a 'stor e- > >and-forward' network stated in the copyright law? I would be very interested > >in the proviso that exempts such networks from liability. > > It's not embedded in the law; as I said, it's an implicit permission I grant > when I post a message to such a network. Just as, when you buy a program on > a floppy disk, you are implicitly granted the right to copy it from the disk > into your computer's memory in order to run it: the nature of the work > requires that specific type of copying. There's nothing new there. > > >The bottem line is that when I got my feed I was not asked to sign any kinjd > >of waiver releasing any material that I generate from copyright infringement > >as long as it was on a hard drive (or any other media). I did not sign any > >kind of contract at all as a matter of fact. Legaly I still retain my right > >of copyright on every bit on every drive (whether magnetic or otherwise) in > >the internet and even your personal drive if you transfer the mail and other > >material to it for offline processing. > > One more time. The nature of the work and your chosen distribution medium > (netnews) requires a variety of copying for it to work: store-and-forward > for propagation, copying into the memory of my system and onto my screen so > I can read it. You grant permission to do that implicitly when you make the > work available by that mechanism. > > Once I have received the copy you have implicitly authorized me to have, > what I can *do* with that copy is governed by the Copyright Act and its fair > use exemptions. I can use it for purposes of scholarship (i.e. I can keep it > in an online or paper folder and refer to it later) and I can excerpt pieces > for critique, among other things. What I *cannot* do is redistribute it by > any other mechanisms and for any purpose other than your initial netnews > distribution. > > I have spent a lot of time studying this part of the law. Really. I already > heeded my glib advice about reading the damn copyright act. Have you? > > Jason > when I buy a software program the copyright notice specificaly states that I am allowed to make copies for backup purposes. Some of them notices on high- dollar packages even tell me how many I can keep and whether I can keep them on a network or not.

1 0

Re: archiving on inet
by mcb＠net.bio.net 17 Dec '03

17 Dec '03

Jason Zion writes: > Yep. When you're providing a netnews feed, you're acting as a node in a > store-and-forward network. A CD-ROM is not a part of a store-and-forward > network; it is a permanently fixed repository of information. You can't hold > up a netnews feed in a courtroom and point at it saying "there it is"; you > *can* do so with a CD-ROM. > > So I suppose you want to give some > kind of list of what types of media are acceptable for transmitting > netnews feeds, and which are not? You seem awfully confident about something that has never, to my knowledge, been litigated at the appellate level. The difference you posit between a netnews feed and a CD-ROM seems very tenuous to me -- not the kind of thing I would feel supreme confidence in trying to convince a judge of. As far as "holding something up" and saying "there it is", I could do the same thing in court with a hard disk containing a news spool and a CD-ROM drive containing a CD with a copy of a news feed. Set up two windows side-by side and they have the same article in them, right down to the Message-ID, byte count, even a CRC or SNEFRU checksum. *Now* try to convince the court they are different animals for copyright purposes... > A CD-ROM isn't a medium for transmitting netnews feeds; it's a permanently > fixed copy of the contents of such a feed. Static versus dynamic; permanent, > ephemeral. Is this hard to understand? Yes, very. And I have been in computing since 1975 and a licensed attorney since 1981. So I think it is fair to say that if I find this murky and confusing, and believe that copyright law does not divide these types of cases into neat little boxes, then others may as well. > The plain and simple fact is: When you post a message to usenet, you do > so with the expectation that others will receive it. You can have no > way of knowing or limiting who may get it; that is given by the nature > of the network. Usenet news is, and is intended to be, publicly > accessable information. If there is something you don't want > distributed, then DON'T POST IT! > > Learn a little about law; while you're at it, learn a little about usenet. > When you post a message to usenet, you have tossed it into a flood-routed > store-and-forward network. You implicitly give permission for copying > appropriate to the propagation of messages in that network. You neither > grant permission nor withhold permission for Fair Use. Everything else, > though, is not granted unless explicitly granted. > > If I post a message, under the terms of the Berne Convention and current US > copyright law, a recipient was not granted the right to print a copy and > publish it in a book. What makes you think I granted them permission to > publish a copy in a CD-ROM? The only permission I granted was that they > could (a) read it and (b) forward it via usenet protocols. Except that it is extremely difficult to put one's finger on "Usenet protocols". *Most* people are using (for example) RFC1036-compliant Netnews article formats and either NNTP or UUCP for transport. BUT, this certainly does not apply to everybody -- some people read newsgroups as e-mail (SMTP, UUCP, QuickMail, cc:mail, Lotus Notes, etc.). Some people receive netnews feeds in the form of magnetic tape; some as large batched file transmissions on IBM mainframe networks. Some get news articles via friends who operate informal "clipping services" and save and print articles of interest and send them via snail-mail. Some people archive newsgroups and put them on FTP/gopher/WWW/WAIS server where they may be indexed and retrieved years later. I would not want to have the burden of convincing a court that any of these are beyond the purview of "Usenet" and thus, in your scheme, implicitly copyright infringements. It is not that I vehemently disagree with any of the points made above -- who knows what will eventually evolve as a legal standard? -- I just think that it is a wildly unsettled area and pronouncements of bright-line criteria in the absence of relevant legislation *or* jurisprudence is fatuous at best. -- Michael C. Berch mcb(a)net.bio.net / mcb(a)postmodern.com

1 0

Re: archiving on inet
by lefty＠apple.com 17 Dec '03

17 Dec '03

>Usenet copyrightable? I still doubt it. Of course, the only way to >find out is to file a very expensive lawsuit. Most posters would not find >their postings worth the expense to sue on copyright. Only a very rich >dilletante, or someone less rich who is a fanatic on the subject is >likely to do so. Also, you would have a hard time answering the >difference between charging for a usenet feed and charging for a cd-rom, >again I see little difference except that one is more prompt in time than >the other. But, again, my newsfeed from a BBS which might be 24 hrs >delayed, and my netcom account which is much faster and a cd-rom differs >only as to time removed from the original posting. So, would you argue, on the same grounds, that you didn't believe that a movie delivered into your home via a cable feed could be copyrighted? How about a movie on a laser disk? Do you understand that there's is a difference between personal use, which does not infringe copyright, and redistribution, which does? Are you _sure_ you're an attorney? -- Lefty (lefty(a)apple.com) C:.M:.C:., D:.O:.D:.

2 1