December 2003 - cypherpunks-legacy

RE: The virus I got...
by Mullen Patrick 17 Dec '03

17 Dec '03

You already had the Monkey (or whatever) virus. It was not included in the file distributed to the list. The file was a pure Trojan, not infector. PM _______________________________________________________________________________ From: Internaut on Thu, Dec 19, 1996 3:30 Subject: RE: The virus I got... From: Mark Rosen[SMTP:mrosen@peganet.com] Sent: Wednesday, December 18, 1996 04.37 PM >Oh, and as far as I know, no virus was installed, >though you should check for one just for good measure. There was one, though I don't remember what it's name was. Maby it was Monkey. I already deleted it. --Internaut

2 1

RE: !! Point 'n Crypt -- Win95 Privacy for Everyone !!
by Peter Trei 17 Dec '03

17 Dec '03

> From: Walt Armour <walt(a)blarg.net> > Subject: RE: !! Point 'n Crypt -- Win95 Privacy for Everyone !! > Security through obscurity is no security at all. > > As for PnC (actually, the scCryptoEngine beneath it), we get the 40 bits > from the 56 bits by nulling out the high nybble of every other byte. > > walt > > ---------- > From: Peter Trei[SMTP:trei@process.com] > Would you mind telling us just how you expand the 40 key to the 56 > bits needed for DES? (Security through obscurity has a bad rep on > this list). For many methods of doing so, 40bit DES is NOT > secure against a motivated individual's attack. > > Peter Trei > trei(a)process.com Thanks for being so forthcoming! There are methods for using 40 bit keys that are a lot better than this. My contention stands: 50 200MHz Pentiums *WILL* crack this overnight. A single 100 MHz Pentium will do it in a month. (This assumes a known plaintext attack in EBC or CBC mode). Not utterly trivial, but well within the means of a motivated individual. Peter Trei trei(a)process.com

1 0

EFF: Bernstein court declares crypto restrictions unconstitutional
by Rich Burroughs 17 Dec '03

17 Dec '03

> COURT DECLARES CRYPTO RESTRICTIONS UNCONSTITUTIONAL > Free Speech Trumps Clinton Wiretap Plan > >December 18, 1996 [snip] This is the best news that I have heard in some time :) Congrats to John, EFF, Cindy Cohn, and the other counsel for Professor Bernstein. I am very much looking forward to seeing that decision... Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb U.S. State Censorship Page at - http://www.teleport.com/~richieb/state dec96 issue "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

passphrase protection (was: Re: [PGP-USERS] Security LeakPrograms)
by Dave Del Torto 17 Dec '03

17 Dec '03

In Reply to the Message wherein it was written: >I have just in the last few minutes realized how I need to bring attention >to the security level of my own computer or PGP means NOTHING in terms of >protection. Indeed, Floyd: the dirty little secret is that passphrase protection is a more serious weakness than almost any other factor. I don't just mean dictionary attacks: those are way too expensive if you can just grab a text stream saved to an invisible file on an unsuspecting user's net-accessible machine. The new generation of PGP software (3.x) includes several new prompts/enhancements to the passphrase entry process: perhaps subsequent releases could take those even further into the realm of system-level monitoring. >PZ writes in the manual about the inability to fully wipe, etc. >when using virtual memory but this problem I just encountered in security >goes beyond that, I believe. >I have been installing a Macintosh program, FileGuard, which adds several >levels of security. I knew about and had used the invisible extension >HiddenOasis that saves EVERY keystroke made on the machine. I started doing an informal survey of all key capture utilities (on all platforms) a couple of years back, but there were so few utilities publicly available back then, very few respondents came back at me with items to list. It occurred to me then that if there _were_ persons trying to grab passphrases from an individual's machine, it would be a significant advantage to have "invisible" keystroke monitors and for all knowledge of the existence of such utilities to remain a closely-guarded secret (from, say, the laptop of an FBI counter-intelligence instructor suspected of selling secrets to foreign agents for a few hundred thousand dollars, or something improbable like that). However, it's not the "good guys" we mainly need to be concerned with: there is a great deal of industrial espionage that needs some sunshine. The viability of personal privacy software in the marketplace is threatened if such utilities spread: as a responsible company protecting both the public's interest and our own company's survival, we need to plan for very sophisticated passphrase attacks and constantly educate users about this danger. That having been said, this invisible "HiddenOasis" item you mention is a new one to me: I'd like a copy to test in our lab and my interest in hearing about everyone's favorite keycapture utility is rekindled. Maybe my boss will let me devote, oh, about 0.73% of my time to this. ;) PGP's engineers have already spec'ed out some good defenses against subtle attacks like ion migration (memory burn-in), and with everyone's help (we can't watch every security leak, that's why we need you guys!), we can continue to work up defenses against such wee beasties. Any whistleblowers are also invited to drop a dime: my public key is widely available (even clickable) through the header URL above and we still have anonymous remailers in this country. Nudge-nudge, say no more, etc. [elided] >To my surprise as I set user priveledges with FileGuard, I saw a previously >unnoticed folder far from my root directory called, "Ghostwriter." This gives new meaning to the term "spook"... >I rummaged through it and many, most of the files therein (900k of files) >showed various passwords I had consdered absolutely uncompromised in >plaintext. It's quite a shocking feeling to realize what defaults are built into some popular commercial apps, isn't it? :/ You don't often see "insignificant" items like this get mentioned in any popular reviews either. It could be that even more users out there are ignorant of this issue than there are sysadmins who haven't read up on the SYN attack. >It turns out that the spell-check program, SpellCatcher [elided] created >these files which (from the manual), "For the Ghostwriter feature, Spell >Catcher saves a continuous stream of keystrokes to a text file inside the >SPEL CATCHER FOLDER." The manual does mention disabling Ghostwriter before >typing a "sensitive password." But offers no way to PERMANENTLY shut this >feature OFF. [elided] If confirmed, this is an absolutely unconscionable design flaw, IMHO. Anyone who has a specific comment (include URLs if possible), please mail me and put "passphrase protection" somewhere in the subject line. <"mailto:ddt@pgp.com?subject=passphrase protection"> I'll collect them, filter to our engineers where appropriate and eventually, when we have enough for a decent matrix, I'll either post a summary on our website or write up an informational RFC. dave ________________________________________________________________________ Dave Del Torto +1.415.524.6231 tel Manager, Strategic Technical Evangelism +1.415.631.0599 fax Pretty Good Privacy, Inc. http://www.pgp.com web

1 0

thread?
by danalogi＠videotron.net 17 Dec '03

17 Dec '03

can we read this thread as a newsgroup somehwre? or it's avaible only as remail? fred.

1 0

Re: Pretty Lousy Privacy
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

At 06:19 AM 12/19/96 -0800, you wrote: :John H West wrote: :> Are Dr DVT & Ray Arachelian the same pair who relentlessly :> spammed the Net about three years ago. [snip] How soon can we expect Turkish and Armenian language modules for this beta? What is status vis-a-vis export? Thanks for the effort. Cordially, Alec PGP Fingerprint: Type bits/keyID Date User ID pub 1024/41207EE5 1996/04/08 Alec McCrackin <camcc(a)abraxis.com> Key fingerprint = 09 13 E1 CB B3 0C 88 D9 D7 D4 10 F0 06 7D DF 31

5 10

RE: permanent invasion of privacy
by Blanc Weber 17 Dec '03

17 Dec '03

From: Dale Thorn Maybe if you got off your ass and did something worthwhile for society, things would really change for the better. But I won't hold my breath. ............................................................. Don't be so presumptious, Dale. I could be a secret cpunk NSA tentacleH^H^H^H^agent on the list trying to discourage people from pursuing certain ideas - like yours, for example. .. Blanc (LOL) > >

1 0

Bernstein case in the White House press conference
by John Gilmore 17 Dec '03

17 Dec '03

"What do you mean? Of course the Emperor is wearing clothes!" John http://library.whitehouse.gov/Briefings.cgi?date=0&briefing=0 December 19, 1996 PRESS BRIEFING BY MIKE MCCURRY 1:37 P.M. EST THE WHITE HOUSE Office of the Press Secretary ______________________________________________________________ For Immediate Release December 19, 1996 PRESS BRIEFING BY MIKE MCCURRY The Briefing Room 1:37 P.M. EST MR. MCCURRY: I sit up here with no information to give, empty. Throw this thing away, this is useless. (Laughter.) I spent the whole morning running around, just like you guys do, running around trying to find somebody who knows something. And I found a whole lot of people who knew nothing. ...several pages deleted... Q Mike, the Post story on the encryption -- federal court decision on encryption software -- can you say what that does to the government's rule-making effort and its plans to -- MR. MCCURRY: I am told that folks at Justice are trying to figure that out. They're analyzing the opinion now and seeing what impact it has. The preliminary read that I've got from them is that it should not have any impact on it because of the way the case is structured and the opinion was drawn. But they're looking at it more carefully now. Q Mike, any comment on The New York Times report that the United States is cracking on war criminals in Bosnia? ....a page deleted... Q Thank you. MR. MCCURRY: Thank you, Helen. See you all tomorrow. Maybe we'll have some real news tomorrow for a change. (Laughter.) THE PRESS: Thank you. END 2:05 P.M. EST #289-12/19

1 0

Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At the last meeting references were made to processors which only execute encrypted code. Decryption occurs on chip. If each chip has a unique public/secret key pair, and executes authenticated code only, there are some interesting implications. Software piracy becomes difficult, if not impossible. Code is sold on a processor by processor basis. Code for a different physical processor cannot be decrypted or executed. Even if it is feasible to determine the secret key stored on the chip, software piracy is still hard because it is not possible to execute the code on another chip without authenticating it. One could execute the code on another architecture entirely using an emulator, but there would be a performance price paid. It wouldn't be worth the trouble for most software. The manufacturer of the encrypted-code processor would protect its instruction set using intellectual property law. Given the high price of a fab, it is entirely feasible to stop anybody from building a new architecture which can execute the code about as fast as the encrypting-code processor. Viruses are not feasible if the authentication is strong. Retrieval of the secret key is quite difficult. Since the results of the decryption never leave the chip, the recent attacks against smart cards do not work. (In the case of an error, the authentication fails and the code does not execute. No information has to leave the chip.) I would be interested to hear comments and corrections. Peter Hendrickson ph(a)netcom.com

5 4

Code+Data separation
by ph＠netcom.com 17 Dec '03

17 Dec '03

Allowing code and data to reside in the same areas of memory is a nice convenience, but it makes security harder to implement because it means code is modifiable and data can be created which just happens to do bad things if it is executed. Are there any modern processors which keep the code and data separated? Peter Hendrickson ph(a)netcom.com

3 2

Re: "Cypher punks'" sexual preferences
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

> Bruce Schneier <schneier(a)counterpane.com> writes: > > > John Gilmore just called me. > > Is Bruce gay? Bruce has a very strange look in his eyes. Perhaps he never has sex with anyone. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

3 5

Re: We won the Bernstein case.
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Simon Spero <ses(a)tipper.oit.unc.edu> writes: > On Wed, 18 Dec 1996, Bruce Schneier wrote: > > > John Gilmore just called me. There should be info on it on the EFF website > > real soon now. > > shehechianu vekiyemanu hevigianu lazman hazeh... No wonder Jewhater Timmy May (fart) is rapidly approaching apoplexy! Omeyn. There probably will be an orgy at the NYC punks meeting tonight, which I'm not going to attend, not being a queer "cypher punk". > So does this mean that anything can be exported as long as it's in source > code, or is object code covered as well? Try to find Judge Patel's district on the map. Hint: North California is covered, North Carolina (and North Dakota) ain't. > Simon > > --- > Queen's Own Cypherpunk Regiment / 82nd Chairborne - Gilmour's Irregulars Pathetic queens indeed. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: controlling web "cookies"
by Andrew Loewenstern 17 Dec '03

17 Dec '03

[note, I have rerouted this thread from coderpunks to cypherpunks where it is more appropriate...] Adam Shostack writes: > Posting hacks like this, while fun, tells the bad guys > (in Washington) how we're going to bypass their next > bits of nonsense. > A number of cute hacks posted to cypherpunks after > Clipper II were defended against in Clipper III. So > don't post your cute hacks against systems until they're ok'd > by the government or deployed. Part of the reason past Clipper schemes haven't been deployed is because they had been shown not to work! I say if there are weak spots, keep punching holes in them. While Washington is spinning around trying to come up with a new-and-improved version, keep deploying good strong crypto and working the free-speech/civil-liberties angle in the courts. By the GAKers come up with a workable solution (which is probably impossible given the politics involved in global-GAK) it will be too late. andrew

1 0

"Cryptography Policy and the Information Economy" draft available
by Matt Blaze 17 Dec '03

17 Dec '03

I've got a new draft available of my critique of US cryptography policy and its impact on the future of the "information economy". It summarizes comments I made to a recent meeting of the Computer and Communications Industry Association, and is an updated version of testimony I gave to the Senate commerce committee earlier this year. Postscript is at ftp://ftp.research.att.com/dist/mab/policy.ps ASCII text is at ftp://ftp.research.att.com/dist/mab/policy.txt -matt

1 0

Bernstein (export laws unconstitutional) decision update
by John Gilmore 17 Dec '03

17 Dec '03

The full text of the decision is available at: http:/www.eff.org/pub/Privacy/ITAR_export/Bernstein_case/Legal/961206.decision It's still full of scannos, but we wanted to get it out to you-all ASAP. After further consultations with the attorneys, we are not sure whether the decision has nationwide impact or whether it is limited to the Northern District of California (which includes SF and Silicon Valley). Your Mileage May Vary -- check with your lawyer. I hear from reporters that the Administration plans to announce its reaction to the case this evening. John

4 3

Phil Zimmermann interviewed by Brock Meeks on ISP-TV
by ISP-TV Main Contact 17 Dec '03

17 Dec '03

*** ISP-TV Program Announcement: MEEKS UNFILTERED WITH PHIL ZIMMERMANN DECEMBER 25, 1996 Few men have influenced the face of public cryptography in this decade as much as Phil Zimmermann, creator of the PGP encryption software program and Chairman of the Board and Chief Technical Officer of the Pretty Good Privacy corporation. Public cryptography, however, is more than just clever software. It has become a battleground for individual privacy and the role of the government in having access to private communications. For three years, Zimmermann was the target of a criminal investigation by the US Customs Service, who assumed that United States munitions export laws were broken when PGP spread outside the US. The investigation was finally closed in January 1996, without any charges being filed. Far from being silenced, Zimmermann is now a respected voice for Netziens and privacy advocates, frequently called upon by the media and Congress for his views. Please join ISP-TV and "Meeks Unfiltered" on December 25, 1996, at 8 PM ET for a 30 minute interview between Brock N. Meeks, publisher of CyberWire Dispatch, and Phil Zimmermann. We'd like to call it our Christmas gift to the Net. This video interview can be viewed on the ISP-TV main CU-SeeMe reflector at IP 205.197.247.33, or other ISP-TV affiliate reflectors listed at http://www.digex.net/isptv/members.html See URL http://www.digex.net/isptv for more information about the ISP-TV Network. To obtain Enhanced CU-SeeMe software, go to: http://goliath.wpine.com/cudownload.htm

1 0

Re: Code+Data separation
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Allowing code and data to reside in the same areas of memory is >a nice convenience, but it makes security harder to implement >because it means code is modifiable and data can be created which >just happens to do bad things if it is executed. > >Are there any modern processors which keep the code and data separated? > >Peter Hendrickson >ph(a)netcom.com I believe those that follow a Harvard architecture do this. -- Steve

1 0

Re: EFF: Bernstein court declares crypto restrictions unconstitutiona
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

jai(a)mantra.com (Dr. Jai Maharaj) writes: > On Thu, 19 Dec 96 11:37:58 EST, > in message <Z2Z7yD10w165w(a)bwalk.dm.com>, > dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) wrote: > > I find it highly amusing how John "asshole censor" > > Gilmore claims credit for himself and his discredited > > EFF, as if they had anything to do with Patel's > > ruling. > > What a maroon. > > John Gilmore <gnu(a)toad.com> writes: > > > >> COURT DECLARES CRYPTO RESTRICTIONS UNCONSTITUTIONAL > >> Free Speech Trumps Clinton Wiretap Plan > >> [...] > > Trying to steal glory from freedom martyr Zimmerman, I > see. The EFF were kicked out of, or their operation > severely reduced on CompuServe, was it not a few years > ago? The EFF lost whatever little credibility is had left when John "asshole censor" Gilmore (spit) admitted to content-based plug-pulling. What a jerk. P.S. I wonder if Bon Giovanni is an EFF supporter. He sounds like one - clueless and untruthful jerk, seeking to silence his mental superiors... --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Mr. throw@yourself.up
by Psionic Damage 17 Dec '03

17 Dec '03

Try Pingin' his ass! Teach him a lesson. At 06:39 AM 12/19/96 -0500, you wrote: > > ><HTML> ><BODY> ><CENTER> ><A HREF="http://www.geocities.com">Postage paid by: <IMG SRC="http://www.geocities.com/pictures/newgeobt.gif"></A></CENTER> ></BODY> ></HTML> > > >-----BEGIN PGP SIGNED MESSAGE----- > >He's some little turd at telnor.net. Probably >rex(a)telnor.net > Throw ftp://ftp.telnor.net/pub/firewall/downloaders.HTM >into your favorite browser. The ftp server is world writable too. > Fuckin' IRC scum. > Oh yeah. > Merry Christmas. > > >jamie >- ------------------------------------------------------------------------------ >jamie(a)comet.net | Comet.Net | Send empty message > | Charlottesville, Va. | to pgpkey(a)comet.net > | (804)295-2407 | for pgp public key. > | http://www.comet.net | >"When buying and selling are controlled by legislation, the first things >to be bought and sold are legislators" -P.J. O'Rourke. >- ------------------------------------------------------------------------------ > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 > >iQEVAwUBMrkpX/MDfTuunU79AQEeogf+Lq4bmq3klEUXHyMAozReqBJgX55AshYs >SKh+dZUSEd4kXGM2zDbApLyO8htzxVlpMfcql8ra//9S55OqIOrI3EaVlm3MJ1jt >q0oBLM93SNPUmExVAiR38LEybPi7m8qWpfPj6xQUrt20Jlh3FG1aZJJW0JxW1vHP >QwsZCbp2QKifCYA+ej404HdsVjfPoC/IyTcZ/QTi5BOcXMLRbjkfLb3XuVjPfuiE >5wrqqVnXmQpGOp9Pd1yUHvGUYcxKIRBqx23IwaxcIpfONtWsDfTlZixLGZNVOjc8 >SJmbOukE+KeOSJRElwrJFuWVTB+qtTyif9qksopmuj6vsCQpbrQ94g== >=aDfS >-----END PGP SIGNATURE----- > > pSIONIC dAMAGE Zer0 Faith Inc. www.geocities.com/SiliconValley/Heights/2608 H/P/A/V/C ANTIVIRUS/COUNTERSECURITY "ONLY THE ELITE SURVIVE!"

1 0

Ban spam outright?
by Roderick Simpson 17 Dec '03

17 Dec '03

There is an interesting debate going on between Jamie Love and Scott Hazen Mueller over how to deal with the problem of email spam (does this constitute as one?) in Brain Tennis right now. Mueller would like to get rid of spam outright, while Love's organization is on the verge of recommending spam labeling legislation to the US Congress. Go to www.braintennis.com to take a look. Also, drop in to the open discussion area: http://www.braintennis.com/cgi-bin/interact/replies_all?msg.33709 Best, Rod R o d e r i c k S i m p s o n rod(a)wired.com A s s o c i a t e P r o d u c e r T h e H o t W i r e d N e t w o r k www.braintennis.com www.wiredsource.com

1 0

Ahem... 'virus'?
by Dagmar the Surreal 17 Dec '03

17 Dec '03

Let's get a few things straight here before we go any further... I field enough calls from the clooless at work trying to warn me about getting the 'Good Times Virus' in my email without having to worry about yet another meme floating around about email virii. 1. Can anyone show that the .com file replicates? It MUST reproduce itself to be called a virus last time I checked. It looks like a trojan horse to me. 2. How many of you people are using Microsloth Internet Mail? It was mentioned a LONG time ago (I think here, in fact) that there was a major mental lapse on the part of the programmers when designing it because single-clicking a piece of mail will view it, while DOUBLE-CLICKING the mail will execute it (and any attached files!). Most people double-click EVERYTHING in Windoze, and this is why it nailed so many people. I'm surprised I hadn't seen this done sooner. If you think it only got a few of the M$IM users, think again. I'll bet there's a LOT of them out there who are 'suffering in silence' because their computer is completely kaput, or sitting in a shop waiting for someone like me to wipe the hard drive and reinstall everything. Please, if there's going to be another damn meme about email virii, let it NOT be from a list I consider to be at least a LITTLE more enlightened than the hordes of AOL (l)users out there. ---------- Dagmar the Surreal (not actual size) "The Internet is Full. Go Away." -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzK50XQAAAEEAMoJsT9Rwbd28VUGhag2fOl+QrTnltqHrN2/7CBMy6kcnaba 8j3HIsNY6NzE/62iV67n6uCTlt6r3/ZosZL4RXYerH06bDOAfWZ6AYn6d0OO+vgi sghnFXiUfknU0h7A88R7z4uRRpZNkU0NXL/svZjrL+cOiMRnQUAqcwqI8ynFAAUR tCREYWdtYXIgdGhlIFN1cnJlYWwgPGRhZ21hckBlZGdlLm5ldD4= =34r7 -----END PGP PUBLIC KEY BLOCK-----

2 1

Re: EFF: Bernstein court declares crypto restrictions unconstitutiona
by root＠ace.cnl.com.au 17 Dec '03

17 Dec '03

1 0

Re: "I've Always Wondered..."
by Jason Durbin 17 Dec '03

17 Dec '03

Dimitri Vulis KOTM (dlv(a)bwalk.dm.com) Thu, 19 Dec 96 09:50:27 EST wrote: Rabid Wombat <wombat(a)mcfeely.bsfs.org> writes: > On 10 Dec 1996, Secret Squirrel wrote: > > > Still, this brings up an interesting point: Considering the special > > > abilities of many of the principals here, is there something especially > > > tasty in store for those net predators who spam this list? > > > I've always imagined something _very_ special happens to their accounts, > > > but I may just be a hopeless romantic, I dunno... > > > If not, why not? > > Even c'punks are busy at times. > He he he. Clearly, "cypher punks" like Paul Bradley, Ray Arachalian, and > Timmy May suffer from too having too much free time. Idle minds are the > root of sexual perversion or some such. Regulars of the Cypherpunk mailing list would be well advised to pay no attention to Dimitri Vulis who is in the latter stages of dementia caused by the syphillus he contracted from his wife Marina. How sad. Of course, in his rare lucid moment, he lies just for fun. So, enjoy. :) jd

1 0

Re: "Cryptography Policy and the Information Economy" draft available
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 04:11 PM 12/19/96 -0500, Matt Blaze wrote: >I've got a new draft available of my critique of US cryptography >policy and its impact on the future of the "information economy". >It summarizes comments I made to a recent meeting of the Computer >and Communications Industry Association, and is an updated version >of testimony I gave to the Senate commerce committee earlier this >year. > >Postscript is at ftp://ftp.research.att.com/dist/mab/policy.ps >ASCII text is at ftp://ftp.research.att.com/dist/mab/policy.txt Matt, I liked your draft except for one thing. You never mentioned that the government has never established a legal right to access the cleartext of an encrypted communication or file. Perhaps the most severe flaw in the GAK proposals is that I as a citizen wish to attempt to keep secrets from the government and to force them to take me to court to get a judge to demand that I release those secrets -=- while their proposals are trying to prevent me from even attempting such. - Carl -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMrn+WlQXJENzYr45AQFrFgQAp2jfB3EOLJoOKHIpTne7D4cwL1KzPcRg VoELRWDGS1RkgK5cSgLl9ASWZ7TdcMRiQUbDPMoffMi3UWlfIpomdsHq+E4HE/U+ 6CS+cpUfw/eSwBYkotCfETMAHymknu/o06QYfBX0TQsN/2XOC52xXEd9Nb/8xjUW c4RETw8Os8A= =nkcy -----END PGP SIGNATURE----- +------------------------------------------------------------------+ |Carl M. Ellison cme(a)cybercash.com http://www.clark.net/pub/cme | |CyberCash, Inc. http://www.cybercash.com/ | |207 Grindall Street PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 | |Baltimore MD 21230-4103 T:(410) 727-4288 F:(410)727-4293 | +------------------------------------------------------------------+

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:18 PM 12/19/1996, Ben Byer wrote: >> At the last meeting references were made to processors which only >> execute encrypted code. Decryption occurs on chip. >> >> If each chip has a unique public/secret key pair, and executes >> authenticated code only, there are some interesting implications. > Let's see... What about this scenario: > Alice gets a contraband copy of PGP 4.0 off the Internet. Since the > public-key algorithm is publicized so that people can encrypt software > to a chip, PGP 4.0 has the ability to encode/decode/generate keys for > the chip. Alice generates a public key/private key pair 0x12345678, > in software. Alice goes to www.microsoft.com and orders Office '99 > online, and tells Microsoft "Hi, my name is Alice, my credit card > number is 31426436136778 and my PGPentium's public key is 0x12345678." > Microsoft unwittingly sends Alice a copy encrypted to 0x12345678, for > which she has the private key to. Alice decrypts Office '99, and > reencrypts it with public key of her PGPentium, as well as the keys f > all her friends. The software vendor would be wise to check that the public key was legal. It would be a simple matter for the manufacturer to publicize all public keys that had been installed on chips. > Does the authentication defeat this? I'm sort of waving my hands around when I say "authentication". One approach is for the manufacturer to authenticate software submitted by approved vendors. The vendors are then tasked with encrypting it for the correct processor. > Our computers would only run software from Microsoft? Scary. There are all sorts of nifty deals that could be made. Microsoft could commission a special run of the processors which only run Microsoft approved software. Machines using these processors could be given away or sold at a steep discount. You could also timestamp the software so that it only runs for a given length of time. This will encourage people to upgrade regularly. ;-) The processors could also support metering. The processor could support some sort of API for the software to tell it how many computrons had been used and stop it from running after they run out. This means that light users or evaluators of software pay relatively low prices while heavy users pay high prices. This is a great deal for all concerned. Right now software vendors try to do this with clever deals, but it's crude at best. Peter Hendrickson ph(a)netcom.com

4 3