December 2003 - cypherpunks-legacy

pgp 6 src out
by Steve Mynott 17 Dec '03

17 Dec '03

hmmm pgp 6 source books have been released .. I wonder if there will be a pgp 6i unix version now? -- 1024/D9C69DF9 steve mynott steve(a)tightrope.demon.co.uk http://www.pineal.com/ i was gratified to be able to answer promptly, and i did. i said i didn't know. -- mark twain

3 2

RE: DNA (fwd)
by Brown, R Ken 17 Dec '03

17 Dec '03

Mathew James Gering wrote: >Monozygotic [maternal] twins do have the same DNA. Hence they >are identical. Genetically identical that is, there are non-genetic >variations. Dizygotic [fraternal] twins do not. Fraternal twins can >be visually nearly identical, but they are not genetically identical. That's right. "Monozygotic". I'd forgotten the word. >Clones on the otherhand and have identical nuclear DNA, but >are notnecessarily identical because some early development >processes rely on maternal genome material and not nuclear >DNA, and depending on the cloning process they may have >different mitochondrial DNA (mtDNA). Yep - if you mean Dolly-style clones derived from nuclear transplants into eggs. there was an interesting article in this week's "New Scientist" magazine (http://www.newscientist.com/ns/981010/contents.html) about the changing popular meaning of the word "clone". It was originally used for a group of plants produced vegetatively, like by cuttings or runners. Then it was extended to other organisms that can reproduce by division, like so-called protozoa Then to DNA replicated from one ancestor. And now to artificially cloned things like Dolly. If you got a Dolly-style clone made from you he or she wouldn't be your child, but your sibling and wouldn't be identical to you for all the reasons Matt pointed out. And of course because of different education/experience/upbringing et.c nto to mention the knowledge that they had been got in such a different way, which must do *something* to the psyche. (Anyone read "Cyteen" by CJ Cherryh?) Identical twins of course are a clone in the original sense, just as much as a variety of apples or a colony of bacteria are a clone. Really genetically identical, right down to the maternal contribution, because they drive from division at an early embryo stage (Sea-urchins can do it as well but insects can't...) If it were possible to re-potentiate adult cells and transform them into embryos (it works in plants - but then it has to because they can't move cells from one organ to another so any shoot tip has to be able to produce any kind of plant tissue) then we could make "real" twin-like clones of humans. If the search for the mysterious foetal stem cells pays off that might be possible (though why anyone would want to clone a human foetus is beyond me. Assume all the crude jokes about it being more fun to make another one using the traditional method). Ken Brown

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

>From Springfield poxmarked 9 October 1998: Subject: Springfield CypherPunks Physical Meeting FPP 10-5-98 Date: Every Saturday thru Thursday (except when it rains) Time: During 'REC' Hour. Place: Recreation Cages/The Hole (TM) Nuthouse Number Nine Looney Level 'Leven Springfield, Missouri Directions: Walk to the Cell Door. Turn around, squat down and put your hands behind you, and through the Slot In The Door. Stand up after Handcuffs are in place, turn around and wait for Guard to open Door. Step into hallway and wait for Pat-Down. (Smiling, Wisecracks & Hard-Ons not advised.) Follow first Inmate & Guard. There will be a short period for everyone to cop a few butts (cigarettes only, please), if they don't have any, light them and Shoot the Shit or Settle Old Scores before the Speakers begin to Rant & Rave or Blather Aimlessly. This Weeks Topics/Speakers Saturday: Where Are Everybody's Shoes? ~ MAY, T.C. Sunday: Does Anybody Remember What We Talked About Yesterday? ~ FroomNOSPAMkin, M. Monday: I *TOLD* You They (TM) Were Out To Get Us! ~ replay.com, N@ Tuesday: If They're So Certain This Prison is Secure, Then Why Won't They Provide Us With Blue Prints? ~ Geiger, Wm III Wednesday: This Isn't What I Had In Mind When I Helped Set the Prison Standards ~ Hallam-Baker, P. I'm Sure Glad I Put In A Side Door ~ Sameer, P. I Broke Out! (But I Can't Provide You With Any Details) ~ Zimmermann, P. How many Beatings Does It Take To Change A Prison Cell Light Bulb? ~ Costner, R. I Bet Bill Gates *Stole* Everyone's Shoes! ~ Hun, A.T. I *Love* This Prison! ~ Hettinga, R. Thursday: Prisoner #7-9-12-13-15-18-5, J. is a COCK SUCKER! ~ Warden Vulis, D. (KOTM) (DON'T FORGET YOUR SHOES!)

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

>From Springfield porkmarked 9 October 1998: Subject: Virtual Heist -- FPP #6 "I put Six Million into Hog Futures first thing this morning." Yesterday's Power Suit told his lunch companion, hoping to impress her. "Silicon Valley." Today's Power Skirt replied, almost leaning over to whisper, as if speaking loud enough for the Differently Dressed Deviate at the next table to hear would make E.F. Hutton roll over in His or Her grave. "That's where the Smart Money's going again." she continued, glancing nervously at the Differently Dressed Deviate whose Well-Tailored Suit seemed so out of place and ... well, Threatening ... in this Chicago Mercantile Exchange Lunch Room. Today's Power Skirt crossed her legs and casually admired her new Rolex as she told Yesterday's Power Suit, with a hint of disdain in her voice, "I just put *Twenty-Six Million Dollars* into ..." "Everybody Freeze!" screamed the Differently Dressed Deviate as i jumped to His or Her feet, pulling a Digital Uzi out of His or Her Well-Tailored Suit, which was a Cammo Montage of Colors Weaves & Cuts of the Power Suits of a wide span of Time & Generations. "Army of Dog!" Cammo Monty continued, sending a Shiver of Terror down the spines of the Lunch Crowd gathered today, as they were everyday, discussing (over their bag lunches) their movement of Other People's Millions into and out of various Money Market Accounts, et al. Cammo Monty pointed the Digital Uzi at the breast pocket of Yesterday's Power suit. "Let's see your Bank Book, Dick Face." Horrified, Yesterday's Power Suit shakily withdrew the Bank Book from his pocket, opened it and placed it on the table in front of him. "Just over three hundred bucks." the Army of Dog Digital Terrorist told the Lunch Crowd, causing much chuckling and snickering throughout the room. "Let's have it, Twat Face." Cammo Monty spun around pointing the Digital Uzi directly at the Bank Book of Today's Power Skirt, as she was trying to slip it out of her Briefcase, unnoticed. Reluctantly, she opened it and lay it on the table. "A hundred and twenty-eight dollars ..." Cammo Monty announced to the tittering Lunch Crowd, "and seventeen cents." i finished to a chorus of guffaws. Cammo Monty leapt onto his chair, and placed one foot on the table, waving His or Her Digital Uzi around the room, seeing the Fear (TM) in the Eyes of each Wanna Be Money Kontroller in the room - thinking that they might be the next to have their finances exposed. "Today's Power Skirt," Cammo Monty told the Lunch Crowd, "bought her Rolex on a Payment Plan," a shudder went through the room, "with a *ten percent*," i spit out the words as she began to moan, "down-payment." Today's Power skirt collapsed in tears ... "You Fucking Morons (TM)!" Cammo Monty screamed at the group, causing them to cringe in shame. "You are handling Other People's Money. It's not *your* money, you idiots, so Wake The Fuck Up (TM) and stop pretending that it is ... to yourself and to each other." <J <J Across town, one of Cammo Monty's A0D Non-Conspirators was making a similar speech to a Lunch Crowd of Federal BureauCraps. "Sunshine is the best disinfectant." the Beautiful Army of Bitch Terrorist nagged the whimpering BureauCraps, for the hundredth times, as i laid yet another Digital Printout on the Overhead Projector. "This is the amount of National Debt that is a result of you Fuck Wads holding meetings to discuss the agendas of future meetings." Beautiful Bitch snarled at the Group. "This," i continued, slapping down a picture of a Family With 2.5 Children onto the Overhead Projector, "is who is *paying* for your Incompetence & Departmental Squabbling." "Don't look away!" the Beautiful Bitch screamed, using the Zoom Feature to Highlite the Child with no arms or legs in the picture. "It's NOT YOUR MONEY you Dumb Assholes!" i continued to nag at the BureauCraps. "But you're not content to force the Taxpayers to pay An Arm & A Leg to support your Wasteful Spending - now you want *Two Arms & Two Legs* ..." "CHILDREN'S LEGS!" the Beautiful Bitch raged at the terrified BureauCraps.

1 0

RE: INTERNET STOCKWATCH! I S M R
by stockadvisory79658ddlw＠gte.net 17 Dec '03

17 Dec '03

Company: Internet Stock Market Resources Symbol: I S M R Price: 2 1/4 ($2.25/share) " I S M R is evolving into one of the internet's main financial web portals not unlike E*Trade in its future potential." As a featured stock in both Success and Opportunist magazines and as a content partner with Time Warner's Web TV I S M R is rated a "VERY STRONG BUY". For more information on I S M R go to: http://quicken.excite.com/investments/quotes plxII7.

1 0

Re: What it's like to get a subpoena (re Toto) (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 13 Oct 1998 18:25:01 -0400 > From: John Young <jya(a)pipeline.com> > Subject: Re: What it's like to get a subpoena (re Toto) (fwd) > It's tough being the earliest ones contacted, having to decide > as Tom and Jim have had to do about whether to go public > or deal with the inquiries in private and hope that nothing worse > develops. That's what worries me, once the snowball gets rolling... I mean jeesh, I run a program that handles email. This sort of stuff is exactly why I don't like interacting with people via private email unless I know them personaly (ie via non-electronic means). The software is publicly available and certainly doesn't need me to explain it. While I can see some interest in wanting to know what CJ/Toto/aka said to me that night on the phone and the next day at the physical meet, it makes me wonder exactly what am I *supposed* to know about... > It's that switch from friendly and couterous to the other that > none of want to think about, eh? "You're under arrest. Anything > you say can and will be used against you." Hmm, what was I > saying, posting, here. Ahmen. Though a more insidous threat is the 'network' that gets built out of it. I wonder if this means every time some bozo I happen to run across goes postal I'm going to be 'investigated'? I wonder how long a name stays on those (probably) non-existant lists? > Makes a more convincing case to have a live body telling the > facts of the matter, explaining how things work, somewhat eager > to instruct and please, in self-preservation, to keep the cops and > court friendly and courteous. What was told to the investigators > in private, that's what hung Jim Bell and CJ. That was the ultimate reason that I went ahead and posted it. That way somebody *besides* me knew about it. > Then the friendly folks came for you and me, working a list. Which is the reason I'm talking to a lawyer to find out specificaly what is going on. I mean in my own self interest and the continued existance of TAG:SSZ it seems to be the thing to do. As far as I know I won't have access to council once I'm in there. ____________________________________________________________________ To know what is right and not to do it is the worst cowardice. Confucius The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

Who is next? (re Jim's subpoena)
by William J. Hartwell 17 Dec '03

17 Dec '03

This ran through my mind this morning before I was totally awake. Maybe somebody can help me with the original author of this.... When they came for Kevin Mitnick I said nothing. After all he was a big time hacker and I wasn't a hacker so I did not speak up. When they came for Jim Bell I said nothing. He was a criminal and I am not a criminal so I didn't speak up. When they came for Toto I said nothing. Surely he was nuts and I am completely sane so I didn't speak up. When they came for Jim Choate I said nothing. He runs a cypherpunks mailing list and I don't manage any lists so I didn't speak up. When they come for me who will be left to speak up? This is a poor paraphrase of the original but I wonder if it is something that we may be saying here in the U.S. soon? -- William J. Hartwell (602)987-8436 Queencreek, Az. billh(a)ibag.com billh(a)interdem.com billh(a)hartwell.net

2 1

Soccer Moms?
by Brown, R Ken 17 Dec '03

17 Dec '03

In the middle of an interesting article about digital cash, forwarded here by Bob Hettinga, there was the line: > After all, the kind of soccer moms who elected Bill Clinton "Divided by a common language" as I am I genuinly don't know what that means. And I can't even guess from context. I'd have expected a dig at liberals or feminists or welfare recipients at that point; and I can't work out what soccer has to do with it. Do mothers play soccer much in the USA? Football (as the 95% of the world's population that aren't either English-speaking North Americans or else Rugby fans call the Beautiful Game) is associated in my mind with young men, specifically working class men. It's connotations are entirely macho, even violent. When a big match is on men gather in pubs and bars and shout at TVs whilst knocking back the lager. You avoid the centre of town if you don't want to risk getting involved in a fight. People get *killed* at football matches. That's pretty much true in every big city inthe world outside North America (and Japan where the fans are polite). This honestly isn't a troll - I am in fact bewildered by the phrase. Ken Brown

6 6

"It's a Hardware Problem..."
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Delivered-To: ignition-point(a)majordomo.pobox.com X-Sender: believer(a)telepath.com Date: Tue, 13 Oct 1998 06:33:46 -0500 To: believer(a)telepath.com From: believer(a)telepath.com Subject: IP: Sandia Labs: Foiling Hackers: World's Smallest Combination Lock Mime-Version: 1.0 Sender: owner-ignition-point(a)majordomo.pobox.com Precedence: list Reply-To: believer(a)telepath.com Source: EurekAlert! http://www.eurekalert.org/releases/snl-wsclpt.html EMBARGOED FOR RELEASE: 12 OCTOBER 1998 AT 02:00:00 ET US Contact: Chris Burroughs coburro(a)sandia.go 505-844-0948 Sandia National Laboratories "World's Smallest Combination Lock" Promises To Foil The Best Computer Hacker, Say Sandia Developers ALBUQUERQUE, N.M. -- The "world's smallest combination lock," a minuscule mechanical device developed at Sandia National Laboratories, promises to build a virtually impenetrable computer firewall that even the best hacker can't beat. The Recodable Locking Device, which uses microelectromechanical system (MEMS) technology so small that it takes a microscope to see it, is a series of tiny notched gears that move to the unlocked position only when the right code is entered. It's the first known mechanical hardware designed to keep unwanted guests from breaking codes and illegally entering computer and other secure systems. "Computer firewalls have always been dependent on software, which means they are 'soft' and subject to manipulations," says Larry Dalton, manager of Sandia's High Integrity Software Systems Engineering Department. "Our device is hardware and is extremely difficult to break into. You have one and only one chance in a million of picking exactly the right code compared to a one in 10,000 chance, with many additional chances, in most software firewalls. After one failed try, this new device mechanically shuts down and can't be reset and reopened except by the owner." Patent filed Sandia, a Department of Energy (DOE) national security lab, recently filed for a patent for the mechanism. The first working units were fabricated in July. The Sandia team, which is refining the device and doing reliability tests, expects to have it ready for commercialization in about two years. Once it is perfected, a commercial partner will be tapped to produce and sell it. "The Recodable Locking Device should be of great interest to businesses and individuals who have computer networks, have sites on the Web, or require secure computers," says Frank Peter, engineer who designed the device. "It would make it virtually impossible for break-ins to Web sites, like what occurred with The New York Times in September." (Hackers broke into the Times' electronic edition in mid-September and shut it down for several hours.) Computer crime is a growing problem nationwide. The Computer Security Institute together with the Federal Bureau of Investigation (FBI) recently surveyed 520 security practitioners in US corporations, government agencies, financial institutions, and universities. Results showed that 64 percent of the respondents reported computer security breaches within the last 12 months. And although 72 percent said they suffered financial losses from these breaches, only 42 percent were able to quantify their losses -- estimating them to be more than $136.8 million. Dalton says he 'had the notion' of the device for three years, calling it the 'digital isolation and incompatibility' project. Digital was for the digital world, and isolation and incompatibility are important concepts in stronglinks, which are mechanical locks used as safety devices in weapons. He turned to Sandia's Electromechanical Engineering Department, headed by David Plummer, to do the design because of that group's expertise in stronglinks as well as its ability to design using the new MEMS technology. Simple system "It took about three months to go from concept to the final design," Peter says. "Based on a code storage scheme used successfully in existing weapon surety subsystems, we were able to design a very simple device -- and it's the simplicity of the device that makes it easy to analyze from a vulnerability standpoint." The Sandia Microelectronics Development Laboratory used Peter's design to build a working device, which consists of a series of six code wheels, each less than 300 microns in diameter, driven by electrostatic comb drives that turn electrical impulses into mechanical motion. The 'lock owner' sets a lock combination to any value from one to one million. The entire device is about 9.4 millimeters by 4.7 millimeters, about the size of a button on a dress shirt. The Recodable Locking Device consists of two sides -- the user side and the secure side. To unlock the device, a user must enter a code that identically matches the code stored mechanically in the six code wheels. If the user makes even one wrong entry -- and close doesn't count -- the device mechanically 'locks up' and does not allow any further tries until the owner resets it from the secure side. The six gears and the comb drives would be put on a small chip that could be incorporated into any computer, computer network, or security system. Because the chip is built using integrated circuit fabricating techniques, hundreds can be constructed on a single six-inch silicon wafer. The end result is that the device will be very inexpensive to produce. Plummer says Sandia is the only place where development of such a mechanism could have occurred. "That's due to the unique multilevel polysilicon fabrication process developed by Sandia and our heritage of designing mechanical locking devices," he says. Besides being a deterrent to hackers, the device has other security applications, Peter says. For example, controlled information could be made available only in a window of opportunity. The information owner could tell the party needing the data that he or she has five minutes to enter in a specific code and gain access. Then, after five minutes, the code would be reset and access denied. A variety of potential safety applications are also possible with the Recodable Locking Device. The mechanism can confirm that a critical system is operating as expected. And if it detects a problem, it will not permit execution of a function. In this safety capacity, the device could be used, for example, to ensure that a radiation therapy machine delivers the correct radiation dosage. "This device has a powerful potential -- one that is readily understood by most everyone," Dalton says. "I've been told by Department of Defense people that this is the first real technical advancement in information security that they've seen in a long time." Sandia is a multiprogram DOE laboratory, operated by a subsidiary of Lockheed Martin Corp. With main facilities in Albuquerque, N.M., and Livermore, Calif., Sandia has major research and development responsibilities in national security, energy, and environmental technologies and economic competitiveness. ----------------------- NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml ----------------------- ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer ********************************************** --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

Commerce Undersecretary William Reinsch defends the governments encryption policy
by nospam＠freedom.net 17 Dec '03

17 Dec '03

I especially like the part about DEEPCRACK and how because EFF knew that the message was in English that it doesn't really prove that the FBI can break 56bit DES encryption. --------------------------------------------------- http://www.infosecuritymag.com/sept/q%26a.htm Q & A WITH WILLIAM REINSCH Cryptos Key Man Commerce Undersecretary William Reinsch defends the governments encryption export policyeven though it puts him "in the hot seat." BY ANDY BRINEY Q: How would you characterize current U.S. cryptographic export policies? A: The President has consistently articulated a policy of balancebetween privacy, electronic commerce, law enforcement and national security. We believe all four elements are important, and were trying to produce a policy that takes all of them into account. But is it really possible to balance all these issues at the same time? We think so. Im not sure the industry agrees with us, and its not easy. The privacy issues involved have been discussed for 50 years in debates about wiretaps and law enforcement devices for intercepting phone conversations. Encryption poses some of the same issues: privacy vs. law enforcement. The country has come to terms with wiretaps over the years, and people still use phoneseven though, with proper court orders, theres the possibility that law enforcement could be listening in. We think well be able to arrive at the same common public understanding with encryption. But theres no question that getting there will be difficult. What kind of time frame are we looking at? Is the administration looking at releasing a "final" crypto export policy within the next three months? Six months? A year? The policy I articulatedone of balanceis based on implementations in the marketplace. We expect the market to develop the products we like, and we expect that there will be a demand for the products. We want to work through the market. What that means is, if the market turns in unexpected directions, we have to be ready to re-evaluate our policy. So I dont think youre going to see a "final" versionever. As long as the market moves and changes, our policy will be tweaked to accommodate whats happening. In the short run, however, the policy we are currently operating under expires January 1. Weve told industry we expect to revisit that policy this fall, and make judgments about whats going to happen after January 1. So weve committed to trying to come out with the next update, hopefully by Labor Day, although my expectation is it may take a little longer than that. Can you be more explicit about what this policy might entail? No. Because were not there yet. What has been the industrys reaction to current policy? Industry has been quite active, particularly with submitting key-recovery plans. We provide more liberalized export controls for companies that provide plans by which they will build key-recovery products. Weve approved some 55 plans nowwith a few more pending. I dont think theyre doing it just because the government asked them to; theyre doing it because they see a market. In addition, in the spring the FBI and the Justice Department asked companies to come in to see if a technical solution could be found to deal with these issues. Companies have done that, too. At the same time, of all the economic sectors in the country, this ones moving the fastest. Theres a real danger that, if we cant get our policy together and out there in the marketplace soon, we could be overtaken by events overseas. Recently, a panel was charged with developing a Federal Information Processing Standard (FIPS). One of this groups directives was to design a federal computer security system that includes back doorswhich they failed to do. Whats next for this panel, and for this issue? My understanding is that, at the request of a majority of the panels members, the Secretary [of Commerce] has extended their charter to the end of the year. The Secretary received a letter from the panel in which the majority felt they would be able to complete their work with additional time. However, they also said they werent entirely confident that at the end of the day it would be unanimous product. Even if it were possible to do key escrow on the scale the government is asking, would anyone willingly buy such a product knowing that stronger encryption products without back doors are available? To prevent this, wouldnt it be necessary to criminalize the domestic possession of stronger crypto? First of all, we havent supported the latter. Second, I think you need to look at this problem in pieces, not as a unitary problem. The pieces are: stored data, data in transit (such as e-mail) and voice communications. I would argue that with the first two of those pieces, theres going to be substantial demand in the market for the kinds of products that are helpful from our standpoint. For stored data, we see a demand for key recoverywere not using the term "key escrow" much anymore. Particularly in business and financial institutions, theres a demand for recovery products, because people want to be able to access employees data in the event of accidents or other such things. As for e-mail, the most significant development there was the announcement nine companies made in early July. Each of these companies submitted an application for a so-called "door bell" technology, which connotes a variety of means of recovery at the server level. What we see developing here is growing use of network encryptionas opposed to encryption at the PCfor secure transmission of messages. Employers will want that, for employee control purposes. From the standpoint of law enforcement, thats a happy development, because it creates two "third point" locationsthe senders server and the recipients serverthat are physically separate from the sender and recipient of the message. These points are often controlled by third parties, namely contractors running the system. So, with the proper court order, law enforcement could go to those third points and obtain plain-text access. What was your reaction to the Electronic Frontier Foundations cracking of DES in July? I think you have to contrast that situation, which was reasonably artificial, with the reality of law enforcement. In this case, it took a decent amount of resources to crack a specific message that, I believe, the people doing the crack knew was in English, and knew was one message. Now, if youre the FBI, think about that. From their standpoint, were talking about traffic that isnt so easily identifiable. It might be a long stream of encrypted material that theyre trying to intercept in real time; they dont necessarily know what language its in; they dont necessarily know what part of the message is of interest to them; and they dont know whether its words or text or graphics or what it might be. Telling the FBI that, under those circumstances, you can buy an expensive computer and crack one message in 56 hoursthats not a lot of comfort to the FBI. And it doesnt seem to me that it should make anybody in the private sector nervous about the security of 56-bit products. If thats the best were going to get56 hours for a single message decrypted by equipment most people dont have and arent ever going to havethat doesnt exactly mean that its an unsecured product. But it does illustrate a trend. As time passes, its taking fewer and fewer resources and less and less time to crack the same algorithm. In 1997, it took three months. In February, it took 39 days. Now, its one $250,000 computer and 56 hours. Whos to say in two more months it wont be cracked in an even shorter amount of time with even fewer resources? You can project that curve, and maybe youll be right. The immediate effect of that is that its going to accelerate a trend thats already begun anyway, which is toward 128-bit products. I think thats a trend that would have occurred regardless of this particular event. The technical people Ive talked to say that once you get beyond 90 or 100 bits, it doesnt make all that much difference because youre talking about brute-force cracking times that are beyond any real time that you can imagine. Obviously, the faster you can crack 56 bits, the faster you can crack 90 or 100. But since each successive bit doubles your time, by the time you get to 90, I think youre into thousands of years... But the question is, assuming that 90 is safe, wouldnt it then be prudent to have a policy that allows uniform export of 90-bit products without special dispensation? I dont think we expect to set bit-length requirements. We believe in the marketplace deciding what is secure and what is not. The government is not going to say that 90 is good or 128 is good But right now its saying 56 is sufficient. No, the government is saying that 56 can be exported under certain circumstances. What the government has also said is that if its a key-recovery product, it can be exported with any bit length without constraint. And thats what we would prefer to focus onto tell people, if youre product has recovery features, bit length doesnt matter. Thats the incentive. What happens if a key-recovery standard cannot be agreed upon? Is there a fallback plan? We are doing everything we can to encourage people to find it acceptable and to get the market to move in that direction. We think thats whats happening. So I dont think weve developed a Plan B in that sense. Can you discuss progress on the Advanced Encryption Standard (AES)? No. Im not particularly involved in that. I think you need to talk to some NIST or NSA people about that. ALSO Q: You seem to be the governments point man on encryption policy issues. Is that a function of your office, your background, or what? A: "Designated victim" is the term we use [laughs]. Actually, its a function of the office. An integral component of our policy involves export controls, and the BXA [Bureau of Export Administration] administers export controls of dual-use items for the government. So I end up in the hot seat. EDITORS NOTE: Next month, Bruce Schneier, author of the definitive text Applied Cryptography, will respond to Undersecretary Reinschs comments in a special Word in Edgewise article.

1 0