December 2003 - cypherpunks-legacy

Wow.
by amanda＠intercon.com 17 Dec '03

17 Dec '03

Well, in the week or two since resubscribing to Cypherpunks, I've seen a trickle of postings about cryptography, security, and privacy, and a flood of insults, harangues, fighting words, and so on. Some of this reads more like a script from a Jerry Falwell TV spot than anything I recognize as "Cypherpunk" traffic. I don't care who's offended whom. I'm not interested in participating in a forum where the supposed topic is submerged underneath a lot of adolescent alpha primate chest-beating. I'm off to look for a mailing list where people are ACTUALLY DISCUSSING CRYPTOGRAPHY AND IMPLEMENTING CRYPTOSYSTEMS. This list may still be called "cypherpunks", but it doesn't have much cypherpunk left in it, as far as I can tell. Disgusted, Amanda Walker Senior Software Engineer InterCon Systems Corporation

1 0

Re: I beg you, PLEASE prove that 0.123456789101112131415 is IRRATIONAL (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Forwarded message: > Date: Sun, 19 Jan 1997 12:20:45 -0600 > From: Sir Robin of Locksley <tozser(a)stolaf.edu> > >Is it possible to prove that number 0.1234567891011121314151617181920... > >iz irrational? > > Most definately. All you need to do is prove that the set of this number is > uncountable, ergo is irrational. If you have friend who have done math in real > analysis they can explain more. irrational means 'not expressible as the ratio of two integers', this does not imply uncountable. Whether 0.12345678910111213... is irrational or not depends on how we choose to define a rational number where the denominator and numerator are both approaching infinity and how quickly those approaches occur. [ What is your definition of infinity/infinity ?] As alluded to before, 0.12345678910111213 = 12345678910111213.... / n (where n = infinity) 0.123456789101112... is certainly countable because by the definition of countable it must be 1-to-1 with the counting numbers (ie non-negative integers), which this one clearly is since it contains each positive non-zero integer (ie the set of numbers required to produce the number are clearly less, 1 less to be exact, than the counting numbers). > If you show me an algorythm that calculates the real number TT (=3.14.....) > I'll give you a Nobel Prize personally! c=2pi*r so, pi = c/2r You have a algorithm (ie recipe) for determining pi to whatever degree of precision you are willing to go to. If you insist on using a digital computer (whose domain of operation is limited to rationals by defintion) then you are doomed to fail. However, move to analog computers (eg a compass) and it can be quite easy to calculate, though not easy to plug into an equation. > Well, that is not entirely true... The length of any arbitrary line can be any > number, rational, natural, etc. Real numbers are the numbers that defy all > other categorization (they are not rational, irrational, natural, etc.) They > are complex and despite any instinctual perception, there are a lot of them! Complex numbers are not a member of the Reals, rather the Reals are a sub-set of the Complex. [ I recognize this is not what you meant but, "The slovenliness of our language makes it easier to have foolish thoughts." George Orwell ] VNR Concise Encyclopedia of Mathematics, 15th ed. ISBN 0-442-22646-2 pp. 74 "If every segment is to have a numerical measure as its length, then a new domain of numbers is needed, an extension to the domain of rational numbers. This new domain can no longer be constructed, as in the previous case, by number pairs. But hints for its construction are provided by a theoretical analysis of the measuring process for segments." A mathematicaly rigorous defintion of the class of numbers called 'Real' is that which equates the members of that set to the possible lengths of an arbitrary line segment. Jim Choate CyberTects ravage(a)ssz.com

2 1

Re: Enough is Never Enough -- pro-CDA alliances, from TNNN
by Dale Thorn 17 Dec '03

17 Dec '03

Dale wrote: > > This Donna Rice-Hughes couldn't possibly be the Donna Rice who sat on > > Gary Hart's lap for the famous picture, could she? > But of course... she was emotionally traumatized by the who experience > (or some such line) and is now 'reformed'. The mind boggles. I've gotten several confirmations on this, and no negatives, so.... What I remember is that Hart and Schweiker were on one of the intel committees in the early 1970's, working more-or-less side by side with Frank Church et al, uncovering the real dirty laundry of the CIA and its infiltration of nearly every college and important business and media in the USA. Hart's minor spillage to the press must have pissed someone off, so they got the famous picture with Rice in all the papers, and Hart's presidential bid went right down the toilet. Now this same girl is on the righteous team, like Chuckie Colson? Yeah, I believe it. My you-know-what is starting to pucker up.

1 0

INV_ade
by John Young 17 Dec '03

17 Dec '03

1-19-97. NYP: "At the New Frontier of Eavesdropping." Markoff. Many phone companies are now rushing to introduce new digital services that provide better sound quality. But when security standards were set for the new systems five years ago, technical experts from the Government discouraged the phone companies from building in coding systems that would be difficult to break. Moreover, the phone companies themselves decided that real privacy was not a major issue. "Time to market turned out to be more important than real security," said John Gilmore. Indeed, in recent weeks the supposedly secret formula for scrambling digital wireless phone calls was posted to an Internet mailing list. That virtually insures that hackers will soon create a way to modify scanners like the one the Martins used, making digital calls just as vulnerable as analog calls are today. "There's a period in which privacy prevails over surveillance, but it's never for very long." ----- INV_ade

1 0

.1234567891011... is irrational?
by Jim Choate 17 Dec '03

17 Dec '03

Hmmm, irrational means "not expressible as the ratio of two integers" and since the class of integers (I) includes the concept of infinity, .123456789101112131415 = 1234567891011121314... ------------------------ n where n -> infinity Jim Choate CyberTects ravage(a)ssz.com

1 0

Tomorrow
by jkurfis＠interserv.com 17 Dec '03

17 Dec '03

I_Love_SPAM, Hello, If you spend time on any of the online services or the internet then I have some exciting news. The Middle Income Financial Independence Club is now excepting new members. We are an online club of Middle Income people who have joined together to pursue our financial future from the information superhighway. If you would like membership information then please email me at jkurfis(a)interserv.com Start your online future today!

1 0

And who will "moderate" the windbag Sandfort?
by nobody＠replay.com 17 Dec '03

17 Dec '03

One of the biggest offendors in getting into long flamewars has always been Sandfort himself. Why am I not surprised that most of his recent posts have had nothing to do with crypto but a lot to do with his own flames about others? And at such length, oh vey! He said: "First, I did not use it as a legal term of art, so a legal dictionary is not appropriate. Second, I see no sustantive difference between "forejudgment" and my shorthand version (pre-judge). Third, I wrote "literal." Examine the etimology of the word for it's literal meaning. It's pretty obvious AND specific [ME.; OFr, /prejudice/ (Fr. /prejudice/); L praejudicium/, from /prae/, before, and /judicium/, a judgment, from /judex/, /judicgis/, a judge.] In other words, to pre-judge. Get it?" Blah blah blah yadda yadda yadda yadda yo momma wears army boots yadda yadda blah blah This longwinded flame is from a longwinded windbag. He proposes to screen the posts of others for "suitability" but flames others ("dont be such an ass" in another of this afternoon's posts from him) and resorts to long and boring dissections like this one. "I have no intention nor duty to satisfy everyone. That is not possible. I will use a "reasonable person" test. (I am, by the way, using this in the legal term of art sense.)" Who will moderate this "windbag"? He thinks the list is his. It may run on Gilmour's machine, but the "Cypherpunks" are not owned by Gilmour and Sandfort. "P.S. I talked to Gilmore about the holdup in getting started. He has been too busy to get the tech side going, but when he does, (a) everyone will be notifed as to the start date, and the test will still run for an entire month. Until then, it is (sadly) business as usual." Why was this new dictatoriul policy (especially making the moderated list the default, instead of offering the moderated list as a new option) announced to begin on January 11th, then? Gilmour is probly having second thoughts (a good thing) and is just dragging his feet. Disgusted.

1 0

Igor@home = Secret Squirrel
by Jim Choate 17 Dec '03

17 Dec '03

Hi all, I am motivated to post this, something I would normaly not do, because of the issue of trust of moderators that has arisen lately. Igor and myself were in a discussion about number theory last nite. We reached a point of impass. Igor made the suggestion that we bring the discussion to cpunks. I requested that we drop the issue and specificaly not bring it to cpunks. My reasoning had several facets. First, the position that I was in is probably wrong. My motivation was to examine the methodology of dis-proof (which I was disappointed with). Also, it is not a serious issue with me and whether my particular view is right or wrong is irrelevant. Cypherpunks is not the place for truly technical discussions (as is apparent with even a cursory glance). Traffic on this list practicaly drowns my ability to filter it and more drivel I (and probably you) don't need. And finaly, the discussion was fine for a Saturday afternoon discussion, I don't have the interest or time to carry it out over days or weeks, I have to work for a living. Igor agreed to drop the issue and not to bring it to the list. However, this morning I find Secret Squirrel posting some questions which are taken practicaly verbatin from my exchange w/ Igor. Seemed like a truly improbable event. Take it for what it's worth. "An appeal to authority is an appeal to a human being just like yourself who does not have your best interests at heart. What makes you believe they are able to resolve your problems better than yourself?" Jim Choate CyberTects ravage(a)ssz.com

2 1

Re: [STEGO] Sphere packings
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Tim C. May will fuck anything that moves, but he'd rather be fucking his own mother's dead body. \|/ (*,*) Tim C. May _m_-_m_

4 3

Re: Wow.
by i.am.not.a.number＠best.com 17 Dec '03

17 Dec '03

i have no doubt that a certain amount of the noise on this list is the work of agents provocateurs ... and we should just live with it because its entire intent is a certain kind of denial-of-service attack. just ket used to taking extra time and using the delete function a lot. there's still a lot on the list you don't get elsewhere. ah..... if i only had my natural lang. agent running! At 12:58 AM 1/19/97 -0500, Amanda Walker wrote: >Well, in the week or two since resubscribing to Cypherpunks, I've seen a >trickle of postings about cryptography, security, and privacy, and a flood >of insults, harangues, fighting words, and so on. Some of this reads more >like a script from a Jerry Falwell TV spot than anything I recognize as >"Cypherpunk" traffic. > >I don't care who's offended whom. I'm not interested in participating in a >forum where the supposed topic is submerged underneath a lot of adolescent >alpha primate chest-beating. > >I'm off to look for a mailing list where people are ACTUALLY DISCUSSING >CRYPTOGRAPHY AND IMPLEMENTING CRYPTOSYSTEMS. This list may still be >called "cypherpunks", but it doesn't have much cypherpunk left in it, as >far as I can tell. > >Disgusted, > >Amanda Walker >Senior Software Engineer >InterCon Systems Corporation > >

1 0

Re: One time pads and randomness?
by i.am.not.a.number＠best.com 17 Dec '03

17 Dec '03

as i have writ before, the sources i have read say that digits of the transcendentals are THOUGHT to be uniformly and 'randomly' distributed --- in quotes because there are many criteria for randomness and i don't mean to imply a specific one. however, this supposision is no stronger than a conjecture. has not been proven, AFAIK. At 02:06 PM 1/18/97 -0600, Igor Chudov @ home wrote: >By the way, did anyone try to run "all randomness tests" on a sequence >of digits of, say, decimal representation of "e"? > >igor > >Blake Coverett wrote: >> >> > I want to use a one time pad pased crypto system. I understand that the >> > randomness of the pad genorator is key to security(other than lossing the >> > keys). What I want to know is if I use a psuedo-RNG that maybe repeats its >> > self every 1000 characters and use it to only encrypt messagase that are >> > 100's of charaters long, will this be a major security risk? >> >> I'm afraid you've fallen into one of the standard traps. A PRNG can *not* >> make a OTP no matter how you use it. >> >> The total amount of entropy in a PRNG is the amount of entropy in the seed >> you use to key it. All the other bits are directly derived from that seed. >> >> A true OTP is completely secure from an information-theory point of view >> because every byte has a full eight bits of entropy. A PRNG can never >> have this. >> >> Having said all this, it is possible to make a good cipher from a PRNG. >> RC4, for example, is exactly that and the variable sized key is the >> seed for the PRNG. It is however very difficult to come up with a >> good algorithm for that cryptographically sound PRNG and you would >> be much further ahead to use an existing one rather that trying to >> roll your own. >> >> > Say I create a 1 million character one time pad that passes all of the >> > randomness tests. It is "truely random". I place it on two computers. Now >> > when these two computers want to send email computer "A" grabs a chunk of the >> > one time pad starting at a random point and encrypts it. It labels the email >> > with the random starting point and sends it to "B". There "B" moves to the >> > random point and begins decryption. During to process both computers mark >> > that section of the OTP used so that they don't retransmit with it. I realize >> > this has a limited amount of messages before it is used up. But would this be >> > secure? Any suggestions, complaints, big gapping holes I missed? >> >> I don't see anything wrong as such, but there is nothing to be gained either. >> If your random data is real OTP material there is no need to skip to a random >> byte within it, just start at the beginning and use it in sequence. If your random >> data is the output of a PRNG like the above then random starting point doesn't >> buy you much additional security because the entire set of keying material can >> be recreated from the seed. It may increase the work-factor of searching for >> the key, but it also imposes the practical problem of keeping all that keying >> material secure. >> >> More importantly don't confuse statistically random with cryptographically >> random. Just because a bunch of bits passes all the randomness test >> you can think of doesn't mean it contains 100% entropy. Consider the >> digits of an irrational number like sqrt(2) or pi, the digits appear statistically >> random but they can be recreated from just a tiny bit of knowledge. >> >> A good litmus test is to ask yourself if there is any way you can >> reproduce those bits. If there is, they aren't a one time pad. >> (Of course even if you can't it doesn't mean they are good. :-) >> >> regards, >> -Blake >> > > > > - Igor. > >

1 0

Re: I beg you, PLEASE prove that 0.123456789101112131415 is IRRATIONAL
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

At 12:20 PM 1/19/1997, Sir Robin of Locksley wrote: >>Is it possible to prove that number >>0.1234567891011121314151617181920... iz irrational? > >Most definately. All you need to do is prove that the set of this >number is uncountable, ergo is irrational. If you have friend who >have done math in real analysis they can explain more. The set of this number contains one member - the number. Therefore, this is a countable set. A rational number is a number which can be described as a fraction in which the numerator and the denominator are integers. Jim Choate implied that "infinity" is an integer. This is not correct. The set of integers is said to be infinite. Infiniteness is a property of the set, not a member of the set. All rational numbers are expressible in a decimal form of finite length or in a decimal form which ends in a repeatable string of digits. (Consider the process by which each successive digit is found. It is a fraction of the denominator and some remainder with a zero added. The remainder is less than the denominator multiplied by the base, 10 in this case. When a remainder repeats, the state of the algorithm repeats, and its output will therefore be repeated. Since the remainder is bounded, the algorithm must repeat a state. Note that this holds regardless of the base used.) If our number, 0.1234..., does not repeat then it is not rational. Let's show that it does not repeat. If it repeats, there is a sequence of digits which repeats indefinitely. Such a sequence must be longer than the longest integer. (Because if it was part of an integer, the other parts of the integer would not always be the same and it couldn't repeat.) But, there is no longest integer. Therefore there is no repeating sequence. Therefore our number, 0.1234..., is not a rational number. Math Man

1 0

Numbers we cannot talk about
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

At 10:48 PM 1/18/1997, Secret Squirrel wrote: >Is it REALLY true that there are real numbers that cannot be >generated by any algorithm? Some guy said that since the set of >algorithms is countable, but the set of real numbers is more than >countable, there must be some numbers for which there is no >algorithms that generate them. There are sets of real numbers whose existence we can prove, but which we cannot otherwise describe. This is more extreme than being "generated by an algorithm". We can't even tell somebody which numbers to generate! (I take "to generate" here to mean "to compute a decimal approximation.") The set of real numbers is uncountable as is the set of subsets of the real numbers. Yet, we have only countably infinite ways to describe sets of numbers. All sets of numbers which we can describe can be described with a finite set of symbols. (Human beings are unable to distinguish between an infinite number of states.) The set of combinations of this finite set is infinite, but countable. "What we cannot speak about we must pass over in silence." - Ludwig Wittgenstein, closing line of "Tractatus Logico-Philosophicus" See the early pages of "Godel's Incompleteness Theorems" by Raymond M. Smullyan for a better exposition. Math Man

1 0

KeyKOS related system lecture at Stanford
by Bill Frantz 17 Dec '03

17 Dec '03

I received the following from Jonathan. Those of you who are interested in KeyKOS should know that his system, EROS, is an architectural descendent of KeyKOS. --------------------------------------------- Date: Sun, 19 Jan 1997 15:13:11 -0500 From: "Jonathan S. Shapiro" <shap(a)eros.cis.upenn.edu> To: ... Subject: Talk info NOTE TIME CORRECTION I'll be giving a talk on Wednesday at Stanford in the EE380 seminar. Details on the seminar can be found at http://www-leland.stanford.edu/class/ee380/ under 'winter 1996'. The location and time are: Wednesday at 4:15pm Hewlett Packard Auditorium (Room B1) Gates Computer Science Building Stanford Univeristy The basic structure of the talk will be: explain what active networking means, and why confinement and fault isolation are required. (the problem) identify the properties needed for confinement and fault isolation proofs, what capabilities are, and why non-capability systems do not have these properties (why we need them) describe the objects named in EROS/KeyKOS, and why these are the right choices for high performance (how to get performance) show how this system might be used to construct an active networking router or endpoint. (how to use them for this problem) I'm still working on the talk, so the order may get rearranged. Hope to some or all of you there. Jonathan

1 0

Re: Monitoring the monitors [Was: Gilmore and Sandfart suck big dicks]
by Dave Hayes 17 Dec '03

17 Dec '03

> In other words, can I separate the censored email without having to > have two accounts? You can write a program to read both the censored and uncensored email, and do a diff. You wouldn't have to see it, and it could be done so that a "fake" address subscribes to the censored list. Maybe I should offer this as a service to the uncensored list? ;-) ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet None should say "I can trust" or "I cannot trust" until they are the master of the option of trusting or not trusting.

1 0

infinity & set membership
by Jim Choate 17 Dec '03

17 Dec '03

Hi all, "The least upper bound of a set of real numbers is often called the supremum, the greatest lower bound its infimum. In general the supremum and infimum of a set ARE MEMBERS OF THE SET or at least LIMITS OF SEQUENCES OF MEMBERS OF THE SET." [capitalization is mine] In this case the suprenum is infinity. Introduction to Calculus and Analysis Courant and John Vol. 1, pp. 97, Section e. 1965 Edition Library of Congress: 65-16403 Jim Choate CyberTects ravage(a)ssz.com

1 0

'Monster' numbers
by Jim Choate 17 Dec '03

17 Dec '03

Hi, In reference to numbers which you can't describe, if you examine the work they are ALL in the Complex domain, none of them are Real's. Complex numbers deal with areas, not with lengths. If there existed a Real for which we could not describe this would imply that we could not draw a line of that length. Something which is clearly contrary to the axiomatic assumptions of lines and their construction (ie points have no dimension, only position, and lines are infinite sequences of points). A clear Complex example of a 'monster' is Sierpenski's Gasket. It fills an area but has no measurable surface area. Jim Choate CyberTects ravage(a)ssz.com

1 0

The NSA's influence on New Zealand crypto policy
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

For nearly a year I've been involved in an ongoing battle with several government departments and the odd intelligence agency in an attempt to clarify NZ's position on the export of crypto software. The whole story has now got about as far as it can go, so I thought I'd share it with others. I've been trying to get the media to take an interest in this, but noone really seems to care... if anyone knows any journalists who might be interested in it, feel free to pass it on. I've got more details including names of contact people and phone numbers in case anyone needs to verify parts of the story. The main players are: The Government Communications Security Bureau (GCSB), a New Zealand intelligence agency (for US readers, the GCSB is the NZ subsidiary of the NSA). The foremost authority on the GCSB is Nicky Hager, who recently published the book "Secret Power" which documents their activities. The Defence Signals Directorate (DSD), an Australian intelligence agency (the Australian version of the NSA). The Ministry of Foreign Affairs and Trade (MFAT), a New Zealand government department. New Zealand Customs. Cyphercom Solutions, a New York company which produces financial/online commerce systems. Kiss Audio Video, an Australian video production company. Orion Systems, a New Zealand company which produces medical information and communication systems for transmitting medical information. Myself (Peter Gutmann) and cryptlib, my free encryption library http://www.cs.auckland.ac.nz/~pgut001/cryptlib.html In April 1996 I got a call from someone who worked for Cyphercom Solutions, a New York company who wanted to use my cryptlib encryption library in a project they were working on. Their lawyers wanted them to obtain an official, physically exported copy so that there wouldn't be any complications later on if the source of the software were ever called into question. The application involved financial transaction processing, and they had received indications from the NSA that it would be looked on favourably in terms of getting export permission. Somewhat strangely though, they were given the distinct impression that to get anywhere, they'd need to play ball with the NSA, even though it was NZ software being exported from NZ, where the NSA should have no jurisdiction. At this point a brief explanation of the export law situation in NZ is in order. The Customs Act of 1996, Section 54, "Prohibited Exports", states that "The Governor-General may from time to time, by Order in Council, prohibit the exportation from New Zealand of any specified goods or goods of a specified class or classes" (followed by a list of specific conditions on prohibitions). There's no further information in the Customs Act, but NZ Customs have a short publication "New Zealand Customs Fact Sheet: Export Prohibitions and Restrictions" which contains, among such curious items as cat skins and a large list of agricultural products which can't be exported without going via the appropriate government department, the item "Strategic goods such as computers, navigation and marine equipment, firearms, ammunition, explosives, military aircraft and vessels". The responsible government department is the Ministry of Foreign Affairs and Trade (MFAT, pronounced "em-fat"). Apparently computer software comes under the same classification as computers (MFAT extends the Customs definition of "Strategic goods" to cover "Computer technology, information security systems, and telecommunications equipment"). The entity within MFAT which handles this is the International Security and Arms Control Division, who are advised by the Government Communications Security Bureau (GCSB), the New Zealand NSA subsidiary. Once you get past the part where NZ Customs are involved, the whole setup is run like the mafia. Nothing is ever written down, everything is done verbally. Although it took only a paragraph to describe how this works, it took more than two months of work to find out in practice. Unless you know exactly who to ask for information, noone has ever heard of these restrictions. A search of NZ legal databases found nothing. Several IP lawyers had never heard of these restrictions. Noone seemed to know anything about any restrictions. (In an October newsletter, MFAT retroactively gave themselves jurisdiction over this area, this is covered further down). An initial discussion with MFAT revealed that NZ Customs tend to apply restrictions based on the old COCOM rules, which have been superseded by the Wassenaar agreement. For this reason export permits are required for shipments to certain eastern european countries, certain middle eastern countries, and the current UN politically-incorrect-country club. Export to countries other than that would be unlikely to require a permit. In May, Cyphercom therefore decided to try to export the software to the US and Singapore. Initially MFAT said this was OK. Then at the last minute they changed their minds and imposed the following restrictions: - No encryption algorithms except single DES. - Keysize limited to 64 bits (this is peculiar, I assume it's to stop me from using tricks like key-dependant S-boxes and DESX, which I'd discussed in email with people in the US some time ago). - Definitely no triple DES (this was specifically mentioned). - Export limited to object code only (so the key size couldn't be changed). The text of the message (with a few names removed) is: "The Secretary of Foreign Affairs and Trade has no objection to the export of the XXX financial package, as detailed in the following application from YYY, *provided that* the library of encryption algorithms is limited to DES (but not triple DES) and any required hash algorithms, dated 15 May 1996". In the accompanying description of the library, every single algorithm except DES and the hash algorithms have been crossed out. Note that this is for export to the US, which has its own export restrictions anyway (the same thing was done for the Singapore export). Inquiries by lawyers in the US indicated that there had been a flurry of communication between the NSA and the GCSB over this (as one person - not one of the lawyers BTW - I talked to put it, "When the NSA says 'Bend over', the GCSB says 'How far?'"). The NSA might as well have signed the export (non-)permit themselves. The story from the US lawyers was that there was "repeated intervention of the NSA" and that "NZ is out of its depth, it was terrified of offending the US". >From the information I've been able to gather the whole thing seems to have been initiated by the GCSB rather than the NSA, who were afraid to do anything without NSA approval. The GCSB went to the NSA and asked them what they should do, the result was the (non-)permit. A DSD person also later told a reporter that the GCSB had gone to the DSD and asked them "Would you allow the export under these conditions?". The DSD said "No". Shortly before this, the Canadian government, which follows the same export guidelines as New Zealand (dual-use technology under the Wassenaar agreement), had ruled that cryptlib was exportable to anywhere except the previously mentioned restricted countries, with no permit necessary, and no need to apply for a permit: "Application No.278466 covering cryptographic software proposed for export to England, this software is not controlled according to Canada's ECL. Therefore, provided the product noted in this application is not of US origin within the meaning of the ECL item 5400, these goods may be exported to any country, except Libya and Angola, without an export permit. Please note that most goods to Iraq are still prohibited at this time, as well". The interesting thing about the Canadian decision was that I was contacted twice by Canadian export controls people who asked me a number of very detailed questions about the software, whereas MFAT managed to come to their decision without ever examining the encryption software or talking to its author. As far as I've been able to tell MFAT had very little to do with the decision: They have to follow the GCSB's advice, and the GCSB won't do anything without the NSA's permission. The opinion from lawyers in NZ was that they were acting far outside their authority. In any case in late May two copies of the software on 3.5" disks were sent out by a large accounting firm acting for Cyphercom, one to the US and one to Singapore as provided for in the export permit. At about the time the original export appeal was lodged, the GCSB had told another NZ company, Orion Systems, that they couldn't export a product with the encryption necessary to protect patient medical data, lab results, patient referrals, and so on, without obtaining an end user certitificate for each user. To sell a copy to just the one overseas site which the inquiry was about would have required otaining two thousand certifications from all the end users. Larger sites with ten thousand users are not unknown. This meant that Orion would have had to somehow obtain 2000 signed declarations from users just to allow the exchange of medical records (this tactic has also been successfully used by the US government to effectively block certain software exports by US firms). Orion didn't even bother going to MFAT, because if the GCSB required these impossible-to-meet conditions then going to the next level down in the chain of command would make no difference. After chasing my way around a number of government departments I talked to some people in the Ministry of Commerce who advised that the best way to resolve this craziness was to write to MFAT and inform them that the Canadian government had ruled that the library was freely exportable and that there was no reason for them blocking the export, and ask under what authority the export was being blocked. This letter was sent to MFAT in mid-September (incidentally, the way government departments refer to the GCSB is wierd. Noone ever says "the GCSB", it's always "another government department" or "an organisation which I won't name", as if there was some belief that using The Dreaded Name will cause evil to descend upon the person who utters it, much like the use of the work J*h*v* or Lovecraft's "He Who Is Not To Be Named"). Anyway, at this point, things started to get weird. At about the time I wrote the letter, I was FedEx'd an NDA sent from lawyers representing PGP Inc (a US encryption software vendor) to Orion Systems, sent in a standard FedEx letter envelope. It was intercepted by NZ Customs and opened, and the contents examined, before I got it. This wasn't the usual random (and quite rare) "Examined by Customs" spot check, the letter had a large red "Customs - Hold" sticker on it with an LAX flight number, so I assume they knew in advance what they were looking for. NZ Customs couldn't tell me why it was intercepted, but seemed a bit surprised that the letter had been opened. They said that they may have been "acting on information". In early October, about a fortnight after I sent the letter to MFAT questioning the export refusal and asking for clarification on what law they were using to block the export (and many months after the export itself), the Australian parent of the US company who wanted the export got a call from the Australian Ministry of Defence (it was actually the DSD, but they generally identify themselves as Ministry of Defence just like NSA employess are always identified as Department of Defence rather than NSA). This company, Kiss Audio Visual, are a video production house who have nothing at all to do with encryption software (or, in fact, anything but video production and graphics design, which they are very good at). They were called by Alan Owen of the DSD who said that they had been informed that NZ Customs had intercepted a shipment containing a high-security encryption product which was being illegally exported from New Zealand. According to the story, when NZ Customs went back to the party who exported the software, they claimed it was on behalf of Kiss. The Managing Director of Kiss called the Ministry of Defence to make sure this was actually for real, and they confirmed that it was. This story has several very large holes in it: - NZ Customs never intercepted anything. The package containing the disks arrived in the US unopened, there was no "high-security encryption product" on the disks, and a Customs person has verified that NZ Customs have never intercepted any crypto software shipped overseas. - There was no illegal export of any kind. All the necessary permissions had been obtained from MFAT before the disks were shipped. - The export was performed by Cyphercom, not Kiss. Kiss happens to be the parent company, but (apart from a few business discussions carried out over international phone links), there was no other connection between Kiss and Cyphercom. Alan said that this export had very serious consequences, and that they would be coming to Melbourne to talk to Kiss at 2pm the next day. The Kiss Director immediately called Cyphercom in the US, and they discussed having serious quantities of lawyers present at the meeting, and taking the whole story to the media. The visit was cancelled without any explanation. Who says governments never listen to their citizens? (The DSD side of the story is that they were rather busy that day and didn't have time to carry out their investigation). The implications of this are interesting. Despite the fact that MFAT had already (in effect) denied permission for the export, someone with the ability to listen in to international phone conversations had used discussions about the export to fabricate a story about NZ Customs with which the Australian government could harass Kiss, who had done nothing wrong and in fact had nothing to do with the whole affair (unfortunately I don't have any proof of the phone-conversation monitoring, but I can't see how anyone could possibly have connected Kiss with Cyphercom except for the phone conversations - they simply have nothing else in common). Apparently whoever was pulling the strings saw it necessary to bypass MFAT entirely in an attempt to suppress the encryption software (this does not inspire confidence in the working relationship between MFAT and the unnamed agency. The identity of the unnamed agency was later revealed by the DSD - see below). Also in October, an article "Trade in Strategic Goods - An Update" in MFAT's "Business File" publication, Vol.3, No.7 made specific mention that MFAT were in charge of controlling the export of encryption hardware and software. It's pretty certain that this special mention was motivated entirely by attempts to export cryptlib, because MFAT stated in a letter to me that they'd never encountered anything like this before, so the claim that: "..the most commonly affected exports from New Zealand are of encryption hardware and software..." is distinctly peculiar. The last time anyone checked (a KPMG report from mid-1994) NZ had no restrictions on the export of crypto. Some time between mid-94 and October 1996, export controls (or at least some vague mention of controls) appeared, with MFAT having jurisdiction. I suspect this was in October 1996, *after* the whole export/non-export fiasco took place. In any event the article contains some rather curious comments. "Run-of-the mill exports have usually been processed within 48 hours". MFAT have now taken 9 months without showing any results, causing considerable financial hardship for Cyphercom who are unable to ship a product or even obtain a sample copy for demonstration to customers. "New Zealand... is helping to limit the spread of increasingly sophisticated military technology and weapons of mass destruction". Whether software to protect financial transactions and medical records counts as "sophisticated military technology" or "weapons of mass destruction" is unclear. In late October I called MFAT to see what the delay was in replying to my earlier letter, and received a reply the following week. In their reply, MFAT stated that the export (non-)permit was in fact not final, and was still under consideration, which was at odds with what they had told Cyphercom and with the wording of the permit itself (see above). The letter also states: "We made it clear that it would take some time, as the application dealt with a relatively new area in terms of our export controls, and was in a rapidly changing and advancing field. We... are currently discussing it and other issues it raises with relevant government departments". (the "relevant government department" is the GCSB, this has been confirmed by the DSD). I interpret this paragraph to mean "We're making up the rules as we go along". The Canadian government certainly didn't seem to have any of these problems when they covered the same issue. MFAT declined to answer my question as to whether this portion of NZ's foreign trade policy was being controlled by US intelligence agencies. In early January 1997, Kiss were informed by the same Ministry of Defence/DSD person (Alan Owen) that he and an associate would again be flying in from Canberra to talk to them, using as justification the same fictitious story about NZ Customs that they had used before. They spent about two hours at Kiss, saw that they were indeed a video production house (and nothing but a video production house), and left. Before they left, they told the Kiss people that the source of the story about NZ Customs was "their counterparts in NZ" (the GCSB). Kiss had a lawyer present to witness this. The implications of this are pretty scary. The GCSB first used their position to impose impossible-to-meet conditions on Orion and influence MFAT to indefinitely delay export of software which isn't export-restricted anyway (or at least not by any known NZ law) and which the Canadian government had already ruled wasn't export restricted. However, not content with this, they then fed a fictitious story to the Australian government to convince them to begin an investigation into a company which had done nothing wrong, and had very little to do with the whole issue. Foreign competitors of NZ companies will ship their encryption products within 15 minutes of a credit card order being received. The GCSB, by employing all sorts of devious measures, has managed to suppress distribution of the same software by NZ individuals and companies. Under their influence, MFAT have now spent nine solid months brooding over the export of one single copy of equivalent encryption software without showing any results. This has had the effect of protecting overseas markets for exploitation by foreign competitors... by a ministry supposed to be in charge of promoting NZ trade. To summarise, the situation is as follows: 1.There is absolutely no way that anyone could reasonably be expected to find out about what to do with crypto software in New Zealand. NZ Customs have been extremely helpful throughout this affair, but had to keep deferring to MFAT, where everything stops. Even the people charged with enforcing export conditions don't know what it is they're supposed to be enforcing. If it wasn't for a number of lucky coincidences and occasionally knowing or running into the right people, I still wouldn't know any more about the situation. 2.Anyone trying to follow the vaguely-defined, possibly nonexistant rules, at least in New Zealand, is opening themselves up to government harassment, no matter how hard they try to follow whatever rules and regulations someone in the government comes up with. The only safe way to distribute crypto software seems to be to either distribute it over the Internet, or to make sure you have enough media and political contacts to raise hell over any ensuing mail interception, possible phone tapping, government investigations, bogus stories about crimes being committed, and other niceties which may crop up.

1 0

Re: I beg you, PLEASE prove that 0.123456789101112131415 is IRRATIONAL (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > One can construct the reals from the rationals quite easily using any > of several well-known methods, such as equivalence classes of Cauchy > sequences, or Dedikind cuts. So you are saying that the Reals are a subset (ie can be constructed from) of the Rationals? I can create a number which is not representable by the ratio of two integers from two numbers which are representable by ratios of two integers? That's a nifty trick indeed, I am really impressed. Cauchy produced a test for testing convergence. I fail to see the relevance here, but please expound... Dedekind Cut: "Thus a nested sequence of rational intervals give rise to a seperation of all rational numbers into three classes." Just exactly where does this allow us to create Reals? Jim Choate CyberTects ravage(a)ssz.com

1 0

Dedikend Cut's and such
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Did a little research, Dedekind Cut's and such use Integers to define a SPECIFIC Real to a arbitrary BUT FIXED resolution. They do not define the set of Reals. Jim Choate CyberTects ravage(a)ssz.com

2 1

Re: GSM crypto upgrade? (was Re: Newt's phone calls)
by azur＠netcom.com 17 Dec '03

17 Dec '03

For voice calls, it is not possible to merely insert a more secure crypto function (e.g., IDEA) inside the less secure A5 crypto, unless the GSM base station's protocol is aware the subscriber unit is using the more secure crypto. Otherwise, when the GSM base station unwraps the A5 encrypted data stream, which it assumes will contain digitized voice packets in the clear, it will not find what its looking for and will be unable to convert the packets to a circuit-switched voice signal. If, as I have previously stated, the subscriber instead uses the data port of his instrument and establishes a data link with his payload protected by the more the secure crypto this is entirely feasible. -- Steve PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Steve Schear (N7ZEZ) | Internet: azur(a)netcom.com Lamarr Labs | Voice: 1-702-658-2654 7075 West Gowan Road | Fax: 1-702-658-2673 Suite 2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Internet, electronic currency and wireless development 1935 will go down in history! For the first time a civilized nation has full gun registration! Our streets will be safer, our police more efficient, and the world will follow our lead in the future! --Adolf Hitler

2 1

Re: Numbers we cannot talk about
by Paul Elliott 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > > At 10:48 PM 1/18/1997, Secret Squirrel wrote: > >Is it REALLY true that there are real numbers that cannot be > >generated by any algorithm? Some guy said that since the set of > >algorithms is countable, but the set of real numbers is more than > >countable, there must be some numbers for which there is no > >algorithms that generate them. > > There are sets of real numbers whose existence we can prove, but which > we cannot otherwise describe. This is more extreme than being > "generated by an algorithm". We can't even tell somebody which > numbers to generate! (I take "to generate" here to mean "to compute a > decimal approximation.") > > The set of real numbers is uncountable as is the set of subsets of the > real numbers. Yet, we have only countably infinite ways to describe > sets of numbers. > > All sets of numbers which we can describe can be described with a > finite set of symbols. (Human beings are unable to distinguish > between an infinite number of states.) The set of combinations of > this finite set is infinite, but countable. > Perhaps the axioms in set theory that tells us that the integers have an uncountable number of subsets is, in point of fact, false. Perhaps only those subsets of the integers that can be described by an algorithm exist (actually, contrary to what the usual axioms of set theory assert). We know that the set of axioms which tell us that there are unaccountably many reals can be satisfied by a countable model! (Downward Louwenheim Skolem Tarski theorem.) I know that Standard mathematical axioms yields lots of interesting results, but when it talks of the infinite and we are dealing with a practical subject like cryptography or even physics it should not be taken too seriously. (With respect to uncountable sets.) - -- Paul Elliott Telephone: 1-713-781-4543 Paul.Elliott(a)hrnowl.lonestar.org Address: 3987 South Gessner #224 Houston Texas 77063 -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: cp850 iQCVAgUBMuKlNvBUQYbUhJh5AQHZowP/SHm45xKIM5byi4J44tF6ySCilei8ZNC4 f9XgN+VKIQ/Q09tOSnZoRo6e29KKTqV4wxrSCONNu5D691q1atXFw3Z9pdly3INM Qk3NxxLu+NtldkaaIEkt67s7vri6QORw23gyZmIPOLDQPJZk0LG2wcxxZb6cXOIw dO4ry2cGOus= =CJDs -----END PGP SIGNATURE-----

3 2

Re: IMDMP: SOURCE CODE RELEASE ANNOUNCEMENT
by aidas＠ixsrs4.ix.netcom.com 17 Dec '03

17 Dec '03

On Sun, 19 Jan 1997, Igor Chudov @ home wrote: > i agree with dale thorn that you are sandy sandfort. > > igor Believe what you will. You only prove the old saying that goes simply, "People are stupid." Exactly why, aside from the obvious unwarranted and inaccurate assumption, is left as an exercise to the reader. Think of it as an intelligence test.

3 3

[CRYPTO] One-time pads
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

Timmy May is a pimply dweeb sitting at a computer chortling at his own imagined cleverness. )))) )) OO Timmy May 6 (_) `____c

1 0

Re: Monitoring the monitors [Was: Gilmore and Sandfart suck
by Ross Wright 17 Dec '03

17 Dec '03

On or About 19 Jan 97 at 17:37, Dale Thorn wrote: > Somebody correct me if I'm wrong. We already get the censored stuff > on the alleged-to-be "unedited" list, so by looking at the censored > list only, we can do the subtraction more reliably than Sandfort. > > Just the censored list is needed, not the cut-out stuff, as far as I > know. I disagree. Or I don't quite understand what you are saying. I want to see the moderated list and I want to see what was removed. So since I was automatically given the Moderated List, I just put in a subscription, under a different address, so I can easily see what was removed. Of the three lists that now exist: unedited, edited, and removed posts, I would chose to remove the unedited version so that I can keep my eye on what the moderators decide I should not see. That gives me an insight into what they think. Ross =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

2 1