December 2003 - cypherpunks-legacy

NetManage - Cylink Press Announcement
by Bob Williams 17 Dec '03

17 Dec '03

There are quite a few open issues regarding the reliability, interoperability, and licensing of public key technology. All parties interested in access to code for testing and comment please respond to this email address. Thanks Bob ------------ NETMANAGE, Inc. Press Release FOR IMMEDIATE RELEASE Contact: Donna Loughlin, NetManage, (408) 973-7171 Donna(a)netmanage.com NetManage Licenses Public Key Cryptography from CYLINK The Two Firms to Promote an Open Interface for Internet Security which Corrects Flaws and Eliminates Financial and Interoperability Barriers for Cryptography. Cupertino, California - September 19, 1995- NetManage, the leader in TCP/IP Applications for Windows and Internet productivity software, announced today that is has signed a licensing agreement with CYLINK Corporation for technology which incorporates the fundamental patents covering public key cryptography. NetManage will be providing support for public key authentication and data encryption as a fundamental component of its Chameleon Enterprise strategy. The two firms further announced that they plan to provide support for an open interface for Internet security which will address recent flaws found in cryptographic implementations used by Netscape Communications and other unpublicized security holes in existing Internet security protocols. The standard is further intended to eliminate the financial and interoperability barriers that have been holding back widespread use of public key cryptography on the Internet. In a separate announcement released yesterday, CYLINK announced that it had prevailed in a patent lawsuit with RSA Data Security which found that RSA had infringed U.S. patents held by CYLINK which cover all known implementations of public key technology. About Internet Security ----------------------- Establishing a secure Internet connection requires any computer software program to perform two functions: Authentication of the user, and bulk encryption of data. The Authentication phase allows two computers to verify that each party is who they claim to be, and that they are authorized to enter into a secure communications session. This is done via 'public key' technology, which was developed and patented originally by Stanford University and licensed exclusively by CYLINK Corporation. During the authentication phase the two computers also agree upon the encryption method to be used for bulk data transfer during the time the two computers are communicating data between one another. These ciphers can be implemented in either software or hardware, including PCMCIA cards. Popular encryption ciphers include DES, Triple-DES, SAFER, IDEA, Skipjack, RC-2 and RC-4 and are available from a variety of software and hardware vendors. Limitations of Current Internet Security Standards -------------------------------------------------- Current implementations of security protocols proposed as standards by Netscape Communications and RSA Data Security, Inc. include security flaws and fail to fully accommodate open and interoperable secure communications between computers which use different bulk encryption ciphers. These problems have limited the adoption of Internet security as a widespread interoperable feature of all Internet software and hardware products including end-user applications, servers, firewalls, and secure routers. NetManage and CYLINK, along with other major software and hardware developers, will be announcing next week the release of a publicly available security implementation which allows for plug & play interoperability for users of Internet security, and the endorsement of protocol extensions which improve the reliability of current proposed Internet security standards. This open implementation will not lock software or hardware developers into the use of encryption technology from any one vendor. Related APIs, key exchange technology, and encryption will be made publicly available to other software and hardware developers. Licensing will include source code and no per-copy royalty fees. About NetManage --------------- NetManage Inc., the fastest growing software company in the United States, develops markets and supports an integrated set of Internet-based applications, servers and development tools for Microsoft Windows, Windows 95 and Windows NT. NetManage software allows corporations to facilitate communication, sharing of information and collaboration between workgroups using Internet technology. The company's award winning products include Chameleon, Internet Chameleon and ECCO. NetManage is a public company, whose shares are traded on the NASDAQ under the ticker symbol NETM. Its products are sold world-wide by NetManage's direct sales force and authorized channel partners. About CYLINK ------------ CYLINK Corporation is the worlds largest provider of enterprise-wide network information security products and wireless communications. CYLINK is the exclusive holder of the fundamental patents which broadly claim the invention of public-key cryptography (Diffie-Hellman, Hellman-Merkle, and Helman-Pohling) and which were originally developed at Stanford University. Headquartered in Sunnyvale, California, CYLINK serves Fortune 500 companies, financial institutions and government agencies. Licensees of CYLINK technology include CISCO Systems, and other prominent hardware and software developers. # # #

1 0

A Netscape Server implementation error
by Andrew Roos 17 Dec '03

17 Dec '03

Hi Sameer Thanks in advance for the T-shirt, and I like the Web site. On the subject of Netscape implementation errors, I note that the SSL protocol specification states in section 5.6.1 (CLIENT-MASTER-KEY) that "It is also an error if CLEAR-KEY-LENGTH is non-zero and the the CIPHER-KIND is not an export cipher". However, I note that Netscape Commerce Server 1.1 will happily accept a "secure" connection using the non-export cipher SSL_CK_RC4_128_WITH_MD5, even if the CLEAR-KEY-LENGTH is set to 16 and the *entire* master key is sent unencrypted. Here is an extract from an SSL session with www.netscape.com which illustrates the oversight: ------------------------------- Start of Session --------------------------- (1) The session was initialised as normal, and the following values were exchanged in the SERVER-HELLO and CLIENT-HELLO: Challenge: a2 ff 2e 94 8d f9 f4 e2 2c f6 bd ae 7f 47 db 6c Connection id: ef 47 3b 44 db d9 8d 1a f0 da 3e 14 73 97 a3 1f (2) I then sent the following CLIENT-MASTER-KEY message, which is reproduced in full: SSL Record Header: 80 9a Message type: SSL_MT_CLIENT_MASTER_KEY 02 Cipher kind: SSL_CK_RC4_128_WITH_MD5 01 00 80 Clear key length: 16 00 10 Encypted key length: 128 bytes 00 80 Key arg length: 0 00 00 Clear key data: the *entire* master key sent in the clear af 24 2e e8 2b b1 75 d1 27 a2 b8 76 8b 49 c3 f3 Encrypted key: this is a zero-length block formatted using PKCS#1 block type 2 and encrypted under Netscape's public key. Since it contains no data, an eavesdropper would not need to decrypt it in order to decrypt the rest of the session. af 24 2e e8 2b b1 75 d1 27 a2 b8 76 8b 49 c3 f3 9b 9b 0b ff cd e8 2f 2c 0d 16 4e 90 73 26 4e e7 e0 3f 45 8a ce 9a 21 d6 2a 6b b8 9a 20 4e bc cf d0 01 36 86 1c db e0 8b a8 e3 4c 9b 15 11 ea 95 b1 50 3f c9 42 9a 97 77 0f 9d 29 97 7e 87 1b 8f 77 b6 c9 c6 53 90 5b 74 4c 92 99 62 ad 8b bf 4c 28 ac 1b 11 32 64 56 c9 f0 d5 6f c9 89 6b 55 3f b9 42 aa 7b 7c f0 a1 89 93 22 13 46 e2 58 63 23 b2 51 83 92 76 46 05 65 87 86 5b 52 5a d1 02 ee (3) I calculated the session keys in the normal manner, using the master key which was sent entirely in the clear. The result was: Client read key: 14 3e 84 a6 54 57 d6 51 94 cf 54 f5 5a 29 4a ef Client write key: 9d e1 16 77 92 ee 89 f2 2d 30 c2 a2 e1 77 9f 5d (4) Instead of disconnecting, the Netscape server sent the following reply (the header has been removed): 28 40 00 75 b8 d6 60 68 f5 cf ba 65 78 49 35 83 d3 3a b5 d3 81 23 2d f8 7d c6 f8 47 4d 0c 62 c3 b4 This was decrypted using the client read key to give the following SERVER_VERIFY message: Message Authentication Code: 7b 95 2a 84 a1 55 fc 59 32 6b 53 ec e0 1d 80 4a Message type: SSL_MT_SERVER_VERIFY 05 Challenge data (which agrees with the challenge sent in the CLIENT-HELLO): a2 ff 2e 94 8d f9 f4 e2 2c f6 bd ae 7f 47 db 6c (5) The negotiation phase of the protocol was concluded with encrypted CLIENT-FINISHED and SERVER_FINISHED messages as per normal. (6) I sent the encrypted HTTP command "GET / HTTP/1.0" and received the following text (after decryption, stripping MAC and header, etc: HTTP/1.0 200 OK Server: Netscape-Commerce/1.1 Date: Tuesday, 19-Sep-95 21:15:23 GMT Last-modified: Tuesday, 19-Sep-95 21:14:09 GMT Content-length: 5278 Content-type: text/html Followed by the Netscape home page, which included the following statement: Find out how Netscape is responding immediately to upgrade customers and minimize risk of future threats. (7) Having obtained the warm, fuzzy feeling I so desired, I closed the connection secure in the knowledge that my secrets were safe with Netscape. -------------------------------- End of Session ----------------------------- This shows that Commerce Server 1.1 is prepared to accept a "secure" connection which is completely insecure as the entire master key has been sent in the clear and an eavesdropper could decrypt the session without any cryptanalysis. This does not mean that sessions between "well-behaved" browsers and Netscape servers are insecure, since the browser will send all 16 bytes of the key encrypted. Neither could it be used for an active attack, since if a new master was substituted for the one sent by the client, this would be detected during authentication of the SERVER-VERIFY message. However, it would provide an opportunity for a malicious browser supplier to "doctor" secure browsers so that they sent all (or part) of the master key in the clear, even when using non-export ciphers. (Of course there are better ways to do this; the "random padding" of PKCS block type 2 comes to mind). Although this is not nearly as important a result as Ian and Davids, it is the first server hack, so can I have another T shirt? :-) Andrew ________________________________________________________________ Andrew Roos <andrewr(a)vironix.co.za> // C++ programmers have class (but not much inheritance) PGP Fingerprint: F6 D4 04 6E 4E 16 80 59 3A F2 27 94 8B 9F 40 26 Full key at ftp://ftp.vironix.co.za/PGP-keys/AndrewRoos

2 1

Unlicensed net.psychotherapy
by Damaged Justice 17 Dec '03

17 Dec '03

[somewhat snipped from raw lynx dump] Daily Double Scoop Graphic Just enough Net news. By John Motavalli Is Psychotherapy On The Net Legal? HOW DOES ONE OFFER PSYCHOLOGICAL HELP ONLINE? Very cautiously. The issue of whether the practice of psychology or psychiatry online is legal still appears to be a bit unclear. Psychologists have to be licensed to practice in each state. If they're doing psychotherapy over the Internet, and they're offering therapy to people in states where they're not licensed, are they breaking the law? Sacramento psychologist Ronald L. Mann, Ph.D., has a [8]site, allowing a visitor to "e-mail a question (about anything from relationships to career changes)." This service costs you $20 a question. Dr. Mann, who is licensed in California only, said he's not breaking the law because he is not offering psychotherapy online. "Technically, psychotherapy is about exploring unconscious thoughts and feelings and making interpretations about these earlier memories, feelings, and linking them to present circumstances," Mann said. "I'm uncomfortable (professionally and personally) doing psychotherapy on the Internet. I think people need a personal face-to-face relationship that will provide emotional support when they get into intense powerful emotional material. I can't offer that through e-mail. What I can offer is good sound educational advice and point them in a good direction." Doug Fizel, deputy director of public affairs at the [9]American Psychological Association in Washington, D.C., said the question of the legality of online psychiatry is under study. "That really has not been worked out yet within the APA," he said. "It does really raise a lot of good questions, as to whether someone in California can legally offer therapy to someone in New York. You also have to ask whether someone can truly enter into a genuine therapeutic relationship online." Mann noted a recent correspondence he had with a young man who has some personal problems. "He is in college, and he has very poor self-esteem. He's really anxious in his relationships with other people, he has trouble sustaining relationships. We talked (by e-mail) about what it takes to have comfortable relationships with other people, and early childhood issues." I said this sounded like psychotherapy. "I know it's not psychotherapy," Mann replied. "I could have said, 'Why don't we do this [a treatment process]. I didn't. I actually think psychotherapy wouldn't work very well via e-mail." Adds Fizel, "It's more a question of ethical practice -- the difference between law (which a state would determine) and ethical practice (determined by an organization like ours)." He concludes that "So far, the questions have been raised, but the answers haven't been found." 8. http://www.ronmann.com/ 9. http://www.apa.org/

1 0

Unabomber ?
by John Young 17 Dec '03

17 Dec '03

Bill, Both the Times and Post report that only the Post is publishing the FC-piece. I'm scanning it now and will offer it in a while -- it's a long, long pole. I'll ask by this post if someone wants to offer it FTP, I can only do multiple e-mail bites from this hole.

3 2

Re: NSA and Netscape Crack
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim wrote: >> If the "flaws" are being found by our group, as John notes, just what is >> the NSA doing in the _second_ role it is supposed to have, it's "COMSEC," >> or communications security, role? and then Thomas wrote: >Gee Tim, NSA is "helping" us out by creating Clipper and new key escrow >mechanisms ;) > >"I'm from the NSA, I'm here to help your crypto..." In the relatively short time I've been on this list, Cypherpunks have bruted, and then found a weakness in, two kinds of Netscape software. [A fine public service, IMO. Congrats to all involved.] I don't expect to know NSA's specific brute-force capability, but does anyone know if the NSA has *ever* found a glaring weakness in software and then told its author(s) or owner(s) about it? Do "we" perform the "COMSEC" role Tim was speaking of better than the NSA? JMR -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMF9VHW1lp8bpvW01AQFZkwQAiQWJMfdP+5v0CozYH59ZGWUhpaKxgX15 vdVCdSzHgaN6sj5aLVL4yRI0bkVe/6nJ8I4Nj9cYS5K5AgbcmiRDLvEulc0Y+mwr B9rQBUcX7hM6lA+tEk2UpiGmR1xdh2U0Qpu93zT8T7MZtIc5dRReKeT21OXl4W96 NX4iONaceGY= =2nmI -----END PGP SIGNATURE----- Regards, Jim Ray "Censorship reflects society's lack of confidence in itself. It is a hallmark of an authoritative regime." -- Justice Potter Stewart ----------------------------------------------------------------------- PGP key Fingerprint 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 Key id. # E9BD6D35 James Milton Ray <liberty(a)gate.net> ----------------------------------------------------------------------- Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf _______________________________________________________________________

1 0

KEEP YOUR EYES ON YOUR MAILBOX ....
by rewards＠t-1net.com 17 Dec '03

17 Dec '03

/////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. //////////////////////////////////////////////////////////////////////////////// I have been a business owner for over 30 years, involved in various things, and I have found different strategies for making money, working at home.... I thought you might like to know, this really works, if you will only try it... For more information send e-mail to max(a)answerme.com

1 0

http://www.c2.org/hacknetscape/critique.phtml
by sameer 17 Dec '03

17 Dec '03

My response to netscape's press release. -- sameer Voice: 510-601-9777 Community ConneXion FAX: 510-601-9734 An Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org (or login as "guest") sameer(a)c2.org

1 0

Accept Major Credit Cards...Online Merchant Accounts!
by cag1465＠onestopshop.net 17 Dec '03

17 Dec '03

Hi there, Credit Cards are the universal currency of the Internet, and, if you want to do business online, you need to be able to Accept Visa, Mastercard and American Express cards on your Web site. Trouble is, many banks wont give merchant status to businesses that are new, home-based or located in cyberspace instead of a real-world storefront or mall. Thats why were pleased to present a special offer from USConnect, a major merchant account provider thats helping companies like yours get merchant status on the Net. The benefits include: * 2% Discount Rate * No Monthly Minimum Billing Fee * No Statement Fee if No Sales Made for the Month * Money Available in 2 Business Days * Windows-Based or Macintosh Compatible Credit Card Processing Software (Available) * Shopping Cart System To Take Orders Securely Right On-Line (Available) * Referral Program - $100-$200 Rewards For Each Referred Account *And Much, Much More. . . .! I invite you to browse our website for more information and registration: Go to: Accept Credit Cards Online Apply now and start your cash flowing today! If you wish to be removed from our mailing list, please click "PLEASE REMOVE" and type REMOVE in the subject field.

1 0

Re: Crypto + Economics + AI = Digital Money Economies
by szabo＠netcom.com 17 Dec '03

17 Dec '03

I wholeheartedly agree with Tim that economics should play an important role in analyzing cryptographic protocols. It lets us step back and ask what features are important, and in general what we are trying to accomplish: usually something very different than the military uses of cryptography that have given rise to the current methodologies. To economics, especially game theory, I add a vast body of knowledge about human relationships, especially those involving commerce, that civilization has accumulated over the years: law, especially business law. If we step back and look at what many cypherpunks are trying to achieve, a major idealistic theme is a Ghandian cyberspace where violence can only be make-believe, whether in Mortal Komat or "flame wars". Cypherpunks want our telephone networks, Internet businesses, etc. to be both protected from force, and not dependent on force for their existence. Our 20th century information commerce systems, from publishing to credit cards, have often been very dependent on the threat of violence, usually law enforcement, to protect intellectual property rights, deter fraud, collect debts, etc. There is no utopia in sight where such threats can be completely eliminated, but we can recognize that they exist and carefully work to reduce our dependence on them. In a far more practical vein, the dawn of international commercial networks that criss-cross hundreds of jurisdictions with complex, obscure, and often contradictory regulations, gives rise to a vast market opportunity for substituting, where possible, network security mechanisms for law enforcement dependencies. The recent discoveries in cryptographic protocols provide us with a rich toolbox for solving these problems. Perhaps the most fundamental building block of business law is the contract. Strongly related to Tim's ontology of money is an area I have developed quite extensively called _smart contracts_. The terms of contractual relationships can often be formalized and standardized, and then performed via network-based protocols. These protocols, along with economic incentives, protect the performance of the contract from both fraud by the principals and attack from third parties. This is also the basic task of law enforcement in commercial law; thus smart contracts when successful reduce dependence on law enforcement as well as losses to fraud and cracking. Of special interest to cryptologists is that the principles of contract provide us with a methodology for the use of cryptography that is very different from, and potentially far more lucrative than, the traditional military paradigm. I have much more to say about these things in my essays under http://www.digicash.com/~nick/, and in a forthcoming article for _Extropy_. Nick Szabo szabo(a)netcom.com

1 0

New Kid On The Block
by Aleph One 17 Dec '03

17 Dec '03

Aleph One / aleph1(a)dfw.net http://underground.org/ KeyID 1024/948FD6B5 Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01 ---------- Forwarded message ---------- Date: Tue, 19 Sep 95 14:25:20 PDT From: Bob Williams <bobw(a)netmanage.com> To: "Larry J. Hughes Jr." <hughes(a)indiana.edu>, Adam Shostack <adam(a)bwh.harvard.edu> Cc: ssl-talk(a)netscape.com Subject: Re: details on security bug? The problems with SSL extend beyond the random number generation hole widely publicized in the press today. SSL 2.0 poses both financial and interoperability barriers to widespread use of Cryptography that will be addressed in the very near future. ------------------------------- NETMANAGE, Inc. Press Release FOR IMMEDIATE RELEASE Contact: Donna Loughlin, NetManage, (408) 973-7171 Donna(a)netmanage.com NetManage Licenses Public Key Cryptography from CYLINK The Two Firms to Promote an Open Interface for Internet Security which Corrects Flaws and Eliminates Financial and Interoperability Barriers for Cryptography. Cupertino, California - September 19, 1995- NetManage, the leader in TCP/IP Applications for Windows and Internet productivity software, announced today that is has signed a licensing agreement with CYLINK Corporation for technology which incorporates the fundamental patents covering public key cryptography. NetManage will be providing support for public key authentication and data encryption as a fundamental component of its Chameleon Enterprise strategy. The two firms further announced that they plan to provide support for an open interface for Internet security which will address recent flaws found in cryptographic implementations used by Netscape Communications and other unpublicized security holes in existing Internet security protocols. The standard is further intended to eliminate the financial and interoperability barriers that have been holding back widespread use of public key cryptography on the Internet. In a separate announcement released yesterday, CYLINK announced that it had prevailed in a patent lawsuit with RSA Data Security which found that RSA had infringed U.S. patents held by CYLINK which cover all known implementations of public key technology. About Internet Security ----------------------- Establishing a secure Internet connection requires any computer software program to perform two functions: Authentication of the user, and bulk encryption of data. The Authentication phase allows two computers to verify that each party is who they claim to be, and that they are authorized to enter into a secure communications session. This is done via public key technology, which was developed and patented originally by Stanford University and licensed exclusively by CYLINK Corporation. During the authentication phase the two computers also agree upon the encryption method to be used for bulk data transfer during the time the two computers are communicating data between one another. These ciphers can be implemented in either software or hardware, including PCMCIA cards. Popular encryption ciphers include DES, Triple-DES, SAFER, IDEA, Skipjack, RC-2 and RC-4 and are available from a variety of software and hardware vendors. Limitations of Current Internet Security Standards -------------------------------------------------- Current implementations of security protocols proposed as standards by Netscape Communications and RSA Data Security, Inc. include security flaws and fail to fully accommodate open and interoperable secure communications between computers which use different bulk encryption ciphers. These problems have limited the adoption of Internet security as a widespread interoperable feature of all Internet software and hardware products including end-user applications, servers, firewalls, and secure routers. NetManage and CYLINK, along with other major software and hardware developers, will be announcing next week the release of a publicly available security implementation which allows for plug & play interoperability for users of Internet security, and the endorsement of protocol extensions which improve the reliability of current proposed Internet security standards. This open implementation will not lock software or hardware developers into the use of encryption technology from any one vendor. Related APIs, key exchange technology, and encryption will be made publicly available to other software and hardware developers. Licensing will include source code and no per-copy royalty fees. About NetManage --------------- NetManage Inc., the fastest growing software company in the United States, develops markets and supports an integrated set of Internet-based applications, servers and development tools for Microsoft Windows, Windows 95 and Windows NT. NetManage software allows corporations to facilitate communication, sharing of information and collaboration between workgroups using Internet technology. The company's award winning products include Chameleon, Internet Chameleon and ECCO. NetManage is a public company, whose shares are traded on the NASDAQ under the ticker symbol NETM. Its products are sold world-wide by NetManage's direct sales force and authorized channel partners. About CYLINK ------------ CYLINK Corporation is the worlds largest provider of enterprise-wide network information security products and wireless communications. CYLINK is the exclusive holder of the fundamental patents which broadly claim the invention of public-key cryptography (Diffie-Hellman, Hellman-Merkle, and Helman-Pohling) and which were originally developed at Stanford University. Headquartered in Sunnyvale, California, CYLINK serves Fortune 500 companies, financial institutions and government agencies. Licensees of CYLINK technology include CISCO Systems, and other prominent hardware and software developers. # # #

1 0

Re: ftp://www.brooks.af.mil/pub/unix/utils/des.tar
by Carl Ellison 17 Dec '03

17 Dec '03

>From: Rich Salz <rsalz(a)osf.org> >Date: Mon, 18 Sep 1995 13:11:46 -0400 > >Would someone from outside the US try to download the above file? >It would be, at least, amusing if an Air Force site were in violation >of the ITAR (their README notwithstanding). I know several people in the armed forces who are firmly on our side rather than Freeh's or NSA's -- so I wouldn't find it amusing to get a USAF person in trouble just because he/she is USAF. - Carl

2 1

Re: Netscape's random numbers
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Congrats, nice job! Yes, well done. >The Netscape license explicitly prohibits decompiling (except where such >prohibition is illegal). When this hits the media it will be important >to avoid being tarred with the "hacker breaks rules and breaks in" brush. >More subtly, it's probably a bad idea to call into question the overall >business model of client binaries on the net. > >Instead, emphasize importance of open code, public reviews, ability to >link in your own code that meets public specs, etc. All of these things >the Internet was designed to do, and U.S. ITAR regulations are designed >to prohibit (globally, anyway). And also that the bad guys will never >play by the rules. And re-emphasize that solutions are possible, just >that the U.S. government prevents them from being deployed in a global >economy. Before we go to the news, perhaps we should demonstrate the exploitation of this hole. It would certainly make selling this story a whole lot easier. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBgAwUBMF27PHIf3YegbdiBAQGI7AJXY5d2Su52MWXrh6tP20vOai/Rsbd6+oqx urWUP34wPv5dqMv1Mw6XDlstX5Q3KmOMeTOjAwcjuJXY5Z3RhkL0gi0nMBUS/IdZ b/GN =vhHo -----END PGP SIGNATURE----- Dietrich Kappe | Red Planet http://www.redweb.com Red Planet, LLC| "Chess Space" | "MS Access Products" | PGP Public Key 1-800-RED 0 WEB| /chess | /cobre | /goedel/key.txt Web Publishing | Key fingerprint: 8C2983E66AB723F9 A014A0417D268B84

5 4

Re: Stay issued; modified stay to follow (fwd)
by Cypherpunks Maintenance Account 17 Dec '03

17 Dec '03

----- Forwarded message from Bob Kohn ----- >From cpunks Fri Aug 29 04:41:12 1997 Message-Id: <3.0.2.32.19970829010600.038952dc(a)mail.pgp.com> X-Sender: kohn(a)mail.pgp.com X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.2 b3 (32) Date: Fri, 29 Aug 1997 01:06:00 -0700 To: Cindy Cohn <Cindy(a)mcglashan.com> From: Bob Kohn <kohn(a)pgp.com> Subject: Re: Stay issued; modified stay to follow Cc: sadams(a)forbes.com, telstar(a)wired.com, plotnikoff(a)aol.com, Ewasserman(a)sjmercury.com, dang(a)cnet.com, steven(a)echo.net, abate(a)ccnet.com, wendyg(a)cix.compulink.co.uk, amy(a)netcom.com, courtm(a)cnet.com, alan.boyle(a)MSNBC.COM, declan(a)well.com, sep(a)cbsnews.com, kenc(a)cwi.emap.com, arb(a)well.com, exp(a)mk.ibek.com, bransten(a)interactive.wsj.com, TomBemis(a)pacbell.net, sam.perry(a)reuters.com, jimevans(a)aol.com, ljflynn(a)aol.com, wendyl(a)ljx.com, bernstein-announce(a)toad.com In-Reply-To: <199708290123.SAA24903(a)gw.quake.net> Reply-To: Bob Kohn <kohn(a)pgp.com> Sender: owner-cypherpunks(a)toad.com Precedence: bulk [text/enriched is unsupported, treating like TEXT/PLAIN] Too bad. Prof. Bernstein was perfectly positioned to become a great -- and the only legal -- exporting reseller of PGP software. (no, this is not off the record) Bob At 06:21 PM 8/28/97 -0700, Cindy Cohn wrote: >During a conference call with counsel today, Judge Patel issued a stay of >the injunctive relief issued in her Opinion of August 25, 1997, effective >until September 8. > > On September 8 (or sooner if we get the papers to her) the Court she will >issue a formal Stay Pending Appeal which will stay the injunctive relief >issued in her Opinion of August 25, 1997, except that an injunction shall be >reinstated to prevent the prosecution of Professor Bernstein for the >"unlicensed export" of Snuffle 5.0 (which includes Snuffle and Unsnuffle) >and any later versions of that program which he has developed. > >This eliminates, at least for the meantime, the injunctive relief granted to >Bernstein as to any other computer programs which he may have developed or >otherwise wished to publish. It also eliminates the protections for persons >other than Professor Bernstein. > >The government has said that it may still challenge this more limited stay >in the 9th Circuit. Professor Bernstein may also seek relief from the stay >from the 9th Circuit. > >Cindy >************************ >Cindy A. Cohn >McGlashan & Sarrail, P. C. >177 Bovet Road, 6th Floor >San Mateo, CA 94402 >(415) 341-2585 (tel) >(415)341-1395 (fax) >Cindy(a)McGlashan.com >http://www.McGlashan.com > > > Robert H. Kohn Vice President, Business Development PRETTY GOOD PRIVACY, INC. 2121 S. El Camino Real, 9th Floor San Mateo, California 94403 Direct: (415) 524-6220 Cellular: (415) 297-6527 Main: (415) 572-0430 Fax: (415) 572-1932 kohn(a)pgp.com PGP Home Page: http://www.pgp.com Personal Home page: http://www.kohnmusic.com/people/bkohn.html <smaller>"If all the personal computers in the world - ~260 million computers - were put to work on a single PGP-encrypted message, it would still take an estimated 12 million times the age of the universe, on average, to break a single message." -- William Crowell, Deputy Director of the National Security Agency, testifying before the U.S. Congress on March 20, 1997</smaller> ----- End of forwarded message from Bob Kohn -----

1 0

Public Key Partners Dissolved!!!!!
by Standing Turtle 17 Dec '03

17 Dec '03

CYLINK CLAIMS SHARE OF RSA TECHNOLOGY An arbitration ruling has awarded Cylink Corp. control over two Stanford University patents on public-key encryption technology used by RSA Data Security Inc. following the dissolution of the companies' five-year partnership. Cylink says it plans to seek royalties from companies that have licensed the software code from RSA and are redistributing it. The arbitrators ruled that RSA's right to sublicense the software expired in 1990. (Wall Street Journal 19 Sep 95 B7)

1 0

Re: FBI calls for mandatory key escrow; Denning on export ctrls
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

September 4, 1997 Encryption Tops Wide-Ranging Net Agenda in Congress By JERI CLAUSING The word encryption traditionally conjures images of spies and sophisticated international organizedcrime rings. But with the dawn of the Internet, it is also the key to private communication and secure business transactions. And while Clinton on July 1 took a very public stand for a tax-free, self-governed Internet, his administration is pushing to create a key-recovery system that would keep encrypted codes on file for law enforcement officials to access. Translation~~These ratfuckers are trying to keep a low profile until they can get all of their draconian legislation passed, at which time the sheeple will find out why the "rubber boots" rider was attached to the legislation. How long before the Great InterNet Tax Avoidance Crisis (TM) requires them to access the records of all companies and individuals in order to make certain that the royal "we" are not "cheated" by our evil fellow citizens. "Law enforcement needs to have a system for immediate decryption" when a judge determines it is likely that crime is being or is about to be committed, Freeh told the Subcommittee on Technology, Terrorism and Government Information. "We should also look at whether network service providers should have a system for immediate decryption." Translation~~"Just as we need to be able to beat the citizens and shove toilet plungers up their ass if we have reason to suspect that they have knowledge of a crime in their mind." Freeh wants to make certain that the citizens don't have the same ability as the Whithouse, the Department of Justice, Congress, etc., to LIE to the courts, to the people, to each other. So if _we_ steal a private company, murder members of a religious sect, get filthy fucking rich on inside deals, then _we_ will go to jail. TruthMonger "What part of 'Nuke the Bastards!' don't they understand?"

1 0

Netscape on randseed issue
by Stephan Somogyi 17 Dec '03

17 Dec '03

Netscape has put up an official response to the randseed issue: <http://home.netscape.com/newsref/std/random_seed_security.html> Most interesting to me was the para: "Netscape has also begun to engage an external group of world-class security experts who will review our solution to this problem before it is sent to customers. These experts will validate Netscape's solution and insure that it is complete and effective in solving this vulnerability. The group will be used on an ongoing basis to work with Netscape's internal security experts to review the design and implementation of security in Netscape's products and to provide an additional measure of assurance that these products implement the highest levels of security possible." Anyone know anything about this group, or is this a reference to the RSADSI source review that Andrew Loewenstern mentioned earlier today? ________________________________________________________________________ Stephan Somogyi Think Tank Grenadier Digital Media

1 0

Change of address {No crypto content}
by Michael Froomkin 17 Dec '03

17 Dec '03

Just to announce that I have a new address. No more VAX/VMS, hello Unix. Donations of nice procmail files, and unix hints for the re-clueless (I last had an account on a Unix machine in 1980), most welcome. If you send me mail in the next few days and I don't reply, it's either because I fiddled wrong, or because I couldn't find a terminal in Pittsburg. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | PLEASE NOTE NEW E-MAIL: U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | Coral Gables, FL 33124 USA | It's hot here. A HOME AT LAST: http://viper.law.miami.edu/~froomkin

1 0

Re: FBI calls for mandatory key escrow; Denning on export ctrls (fwd)
by Lucky Green 17 Dec '03

17 Dec '03

Sometimes these guys can still surprise even me. That statement below is about as blatant as it gets: [Freeh] There are a number of ways that that could be implemented, but what we believe we need as a minimum is a feature implemented and designed by the manufacturers of the products and services here that will allow law enforcement to have an immediate lawful decryption of the communications in transit or the stored data. That could be done in a mandatory manner. It could be done in an involuntary manner. But the key is that we have the ability. -------------------------------------------------------------- Let me get this straight: they need *as a minimum* instant access to all cleartext. So what is the "more than minimum" they truly desire? And the two alternatives Freeh proposes to obtain this *minimum* are either "mandatory" or "involuntary". What a choice! --Lucky

2 1

Stand up and be heard!
by dr261＠cleveland.Freenet.Edu 17 Dec '03

17 Dec '03

Yes, I'm still working on a magazine, I still need authors! Write about cryptography and coverups and clipper and whatever else you find interesting, and write about it! Become rich and famous! (ahtoughalthough the rich and famous part won't be a result of writing for TCW...) I also need reporters to write blurbs about things that happen. If interested, mail me privately at dr261(a)cleveland.freenet.edu.. not on the list. -- Tobin Fricke (aka LightRay) The Digital Forest BBS (714)586-6142 dr261(a)kanga.ins.cwru.edu KE6WHF Amateur Radio, 1:103/925 fido

1 0

Re: Anonymous WWW proxies
by James Caldwell 17 Dec '03

17 Dec '03

On 17 Sep 95 at 11:24, Aleph One wrote: > Points taken. But I belive the are (or will be patches) for CERN to > d SSL. Check the SSLeay ssl-user mailing list. > While we talking abut anonymous proxies. I always wanted to set up > an IP anonymous proxie using Linux IP tunnel and maybe also IP > Masquareding. This would allow people to have anonymous Web Servers, > etc. (But as anything it would probably be abused for hacking, etc > at no end). Any commments? You can add a bit of protection for yourself to this, just some way of preventing the unwanted from using the service and terminating abusers.

1 0

STRATEGIES FOR MARKETING ONLINE
by dbmkts＠kryan.com 17 Dec '03

17 Dec '03

Greetings, I'm responding to your posting online and was wondering if you would like a free copy of my informative article " PROPER E-MAIL STRATEGIES FOR MARKETING ONLINE". Just e-mail me back and ask for a free copy. Thank you, Donald Bass

1 0

WWW: Unabomber Manifesto
by Damaged Justice 17 Dec '03

17 Dec '03

The Unabomber Manifesto as published in the September 19th Washington Post Special Supplement is available in a slightly HTML-ized version at http://yakko.cs.wmich.edu/~frogfarm/unabomb.html I welcome all comments on both the form and the content of this page. -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information To be a skeptic is to refuse to be a victim. "This is my .sig. There are many like it, but this one is mine." Freedom...yeah, right.

2 1

Re: AOL monitoring
by James Caldwell 17 Dec '03

17 Dec '03

On 19 Sep 95 at 15:45, Thomas Grant Edwards wrote: > On Sun, 17 Sep 1995, Sal Denaro wrote: > > > 2) My .newsrc file can tell anyone that I read alt.hackers and > > alt.2600 > > Hmmm...potential new crypto product...a "secure" newsreader with > encrypted .newsrc? How hard is it to record downloaded newsgroups/msgs from the news server? Here locally, I just found out that a group of local internet providers use a centrally located NNTP server. Bummer.

1 0

Re: Scientology and police visit XS4ALL Amsterdam
by cg＠bofh.lake.de 17 Dec '03

17 Dec '03

> > This is the second or third time I've seen descriptions of such > raids where cult (no, I'm not trying to be diplomatic) > representatives were present and participating. Is this legal in > Amsterdam? How about in the U.S.? Britain? > Probably. Amsterdam isn't exactly the wild west, and they didn't take the computer equipment with them, they just inventoried everything so to have something to sell when their claims prove valid. Which I doubt (shit, I will be moving to this country in a couple of weeks...) > If a police officer has a warrant then I really don't have much > choice about letting him in. Am I also under an obligation to > allow the people who filed for the warrant into my home or > business? > I don't know whether this is valid. I assume so. I also think it is about time we develop some ideas about anonymous web publishing. Probably some chained cgi scripts could do, but how to get around traffic analysis? -- Cees de Groot, OpenLink Software <cg(a)bofh.lake.de> 262ui/2048: ID=4F018825 FP=5653C0DDECE4359D FFDDB8F7A7970789 [Key on servers] http://www.lake.de/sonst/homepages/s2449/index.html

5 7

Death of Privacy / Was: Di Privacy, Die!
by TruthMonger 17 Dec '03

17 Dec '03

>From the Not-ly News !Server: [Mainstream, Terra] -- "Huh?" by Defcom McCull'em Mainstream Media sources today denied rumors of news stories from real people, in the real world, finding their way into the bowels of the mainstream press before being burped out to make way for more of the same-old-same-old. Asked why the initial reports of eyewitnesses using words such as "explosion" were quickly buried in favor of the word "crash," sources replied, only one guy, somewhere in Canada, was awake at that hour, and he will soon be dead, so we can't really confirm the existence of those eyewitnesses, since no one wants to talk to them. Asked why initial accounts had "five" reporters being detained and why a rumor concerning the accidental death of "two" reporters, suddenly turned into "seven" reporters being detained, the sources would only comment, "These were only preliminary estimates, before we had a chance to talk to our media prisoners and explain the severity of what they would be facing if their stories were not 'politically correct'." Asked why statements by Fayed family members concerning their views that Dodi and Diana were 'offed' by the monarchy in a bid to thwart a gain in the political influence of sandnigger mobsters, mainstream media sources said, "We saw no need to cover old ground which had been dealt with on the Cypherpunks list, both before and after the event." Asked about the missing right wheel on the death vehicle, sources inferred that it was found on the stretcher that carried Diana to the hospital, next to the magic bullet that killed Kennedy. NotlyNewsMonger "All the news that gets you killed."

1 0