December 2003 - cypherpunks-legacy

Advanced cryptography course
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Sat, 28 Dec 1996 12:24:41 -0500 (EST) From: Christof Paar <christof(a)ece.WPI.EDU> To: DCSB <dcsb(a)ai.mit.edu> Subject: Advanced cryptography course MIME-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Christof Paar <christof(a)ece.WPI.EDU> This is an announcment for an advanced cryptography course in the greater Boston area: Here comes the syllabus for the course EE 589R, Advanced Topics in Cryptography and Data Security. The first class will be held on Monday, January 20, at Worcester Polytechnic Institute. The course is a continuation of EE 578/CS 578, Cryptography and Data Security. It will provide a deeper insight into several areas of cryptology which are of great practical and theoretical importance. The three main areas treated are: Detailed analysis and implementation of public key algorithms, advanced protocols, and modern attacks against cryptographic schemes. We will address many topics which are usually only treated in the research literature. Please feel free to get in touch with me any time if you have further questions about the course. Regards, Christof Paar **************************************************************************** Christof Paar http://ee.wpi.edu/People/faculty/cxp.html Assistant Professor email: christof(a)ece.wpi.edu ECE Department phone: (508) 831 5061 Worcester Polytechnic Institute fax: (508) 831 5491 100 Institute Road Worcester, MA 01609, USA *************************************************************************** EE 579R, ADVANCED TOPICS IN CRYPTOGRAPHY AND DATA SECURITY Spring `97 WPI, Monday 5:30-8:30 SYLLABUS Week 1 Efficient implementation of RSA: The Chinese Remainder Theorem. Week 2 Efficient implementation of public-key systems over finite fields: Galois fields theory. Week 3 Implementation of Galois field arithmetic. Week 4 Efficient arithmetic with long numbers: Montgomery and Karatsuba-Ofman algorithm. Week 5 Efficient exponentiation algorithms. Week 6 Attacks against the discrete logarithms: Shank's algorithm and Pollard's-rho method. Week 7 Midterm Exam Week 8 Attacks against the discrete logarithms: Index calculus method. Week 9 Attacks against block ciphers: Differential cryptanalysis. Week 10 Block ciphers from arithmetic operations: IDEA. Week 11 Secret sharing and threshold schemes. Week 12 Zero knowledge identification schemes. Week 13 Selected topics, depending on class interest. Week 14 Final Exam. TEXTBOOK Menezes, van Oorschot, Vanstone: Handbook of Applied Cryptography. CRC Press, October 96, ISBN 0-8493-8523-7, $80 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox, e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Access fees idea dropped for ISPs?
by jim bell 17 Dec '03

17 Dec '03

>Date: Sat, 28 Dec 1996 02:35:29 -0500 (EST) >From: "James M. Cobb" <jcobb(a)ahcbsd1.ovnet.com> >To: jcobb(a)ahcbsd1.ovnet.com >Subject: DAVID AWAKES! 12 28 96 > > Friend, > > 12 27 96 San Francisco Examiner distributes a newsstory > headlined: > > INTERNET SERVICE COMPANIES WIN VICTORY > WHEN FEDS DROP ACCESS FEES > > > The story reports: > > The FCC is in the process of making sweeping changes > to connection, or access, fees that could result in > a huge drop in phone rates for residential and busi- > ness customers. > > > The FCC's counsel for new technology, Kevin Werbach, says > that as part of that process: > > "The commission raised the specific question of wheth- > er [ISPs] should pay access charges.... [The FCC] ten- > tatively concluded that the answer is 'no'." > > > That tentative conclusion tallies with FCC past practice: > > In 1983, the FCC exempted Internet providers from pay- > ing the same kind of per-minute access charges that > long-distance companies pay to connect to local cus- > tomers. > > > The story reports the Internet Access Coalition has: > > ...assiduously pressed the FCC for weeks to ensure > that Internet users have access to a low, flat month- > ly rate. > > > Who are some of these IAC good guys? > > ...Intel, Apple Computer, Netscape Communications, A- > merica Online, IBM, AT&T, Digital Equipment and Compaq > Computer.... > > > The story reports that the FCC connection-fees process: > > ...to trim the $23.4 billion in annual fees that long- > distance carriers pay local phone companies...is expec- > ted to be formally approved in the spring following > public hearings. > > > We'll see what happens when the tentatives roll around! > > The tentatives? > > This latest FCC decision and the PROMISE of "a low, flat > monthly rate" --maybe even for end-users. > > > > Cordially, > > Jim > > > > NOTE. The newsstory's URL: > > http://www.nando.net/newsroom/ntn/info/122796 > /info3_20620.html > > > Wire services contributed to the Examiner's story. > > This critical essay was composed 12 27 96. > Jim Bell jimbell(a)pacifier.com

1 0

Limiting copyright
by azur＠netcom.com 17 Dec '03

17 Dec '03

GENERAL The US Constitution empowers Congress to pass laws "to promote progress of science and [the] useful arts." Congress has chosen to accomplish this constitutional goal by granting authors a limited set of exclusive rights in their works. The founding fathers wanted, through copyright, to encourage the useful arts and thereby offer to the public the fruits of these artists. Copyright protects all original works of authorship, including such things as personal letters and corporate memoranda, from the moment they are first fixed in a tangible form. About 50,000 U.S. books go out-of-print each year. The lack of continuous availability of these works runs counter to the implicit balance sought by the founding fathers between the needs of the public and copyright holders. In the past copyright holders could reasonably maintain that economics prohibited keeping works in print, with practical, economic and ubiquitous on-line means, this is no longer a barrier. This being so, why should copyrights on "significant" works (e.g., written one's with length's greater than 20,000 words) which have been commercialized continue when the public cannot gain ready access to copy of same? This logic follows from the use-it-or-lose-it concept of trademarks. Changes are need to ensure the public that such "significant" commercialized copyright works are continuously available. Under this recommendation the works must remain available from the copyright holder or their licensee, specialty resellers (e.g., hard to find book locators) wouldn't count, but electronic publication would. If a copyright holder fails to keep a work continuously available, then after a brief interval (e.g., six months) the copyright would lapse. SOME DETAILS Reversion Often, the owner of copyright (the author) is different from the owner of the privilege to publish of a book or item. This privilege is assigned by a contract between an author and publisher, mediated by an agent and editor. Once signed, the author has little influence on the decision to keep a book in print (unless they are big-time authors, like Danielle Steele or Stephen King.) Furthermore, changes in editors, editorial direction, management, ownership, etc., can affect decisions on whether or not to support a book, keep it in print, etc., none of which the average author can influence. Usually, contracts between authors and publishers have rights reversions clauses, returning all rights to the author, once a book goes out-of-print. However, publishers have come up with a new term "out-of-stock-indefinitely" which fundamentally means "out-of-print" but doesn't trigger reversion of rights. Therefore, a part of the provision might ban author-publisher contract clauses with these reversion changes. This would be similar to music copyrights/contract law which limit a composers right to sign over more than a certain percentage of their interest in a work to the publisher. Revision An author may sometimes seek to remove a work from circulation, perhaps the work becomes embarrassing or dated and needs to be revised. So, another part of the provision might allow the author to irrevocably place the copyright for a work to be withdrawn in a state of "limbo" such that no one (including the author) could publish the work until the author's death (or the copyright's normal expiration date). Copyright for revised works would permit the author to replace one work with another by relinquishing the copyright for the former work (which cannot be republished until the copyright's normal expiration date.) -- Steve

1 0

Au Revoir to Yahoo's reverse telephone number lookup service
by Dennis S. 17 Dec '03

17 Dec '03

Below is a letter I recently sent to Yahoo regarding the discontinuation of their reverse telephone number lookup service. [ http://www.yahoo.com/docs/info/people_faq.html#numbers ] Dear Yahoo: When I saw your reverse-number lookup had disappeared, I was surprised, and over the past several days have grown angry about it. I wouldn't even be able to say I was angry at Yahoo, it would be nice for Yahoo to show backbone, but that is definitely something "above and beyond" what could be expected of a company such as yours, I am an admin and I certainly know what it feels like when a user puts up a controversial web page (or spams, or whatever). The thing that really angers me is that large corporations and institutions, and upper class people already have access to not just reverse lookup capability for listed numbers, but for unlisted numbers as well. I can get a CD-ROM for the type of service you were selling from a store for $100 or so, and unlike yours, can use it to easily created junk mailing lists etc. And for more money I can get access to people's unlisted numbers from on-line services and other sources, plus a lot more information. I should point out here that your service was useful to me for non-"nefarious" purposes. For example, I often have phone numbers written on scraps of paper with no indication as to who/what the number is. I suppose my co-workers and I should always write down the name of everyone we're calling back over it, even if it isn't necessary at that moment, but such is life. Reverse lookup helped decode these numbers, mysterious numbers on my phone bill, and so forth. I can understand the people who wander onto your page and dislike the fact that people can get their name and address from their telephone number. But that is _not_ the issue, because corporations and people who can afford to pay $300 for "Tickle Me Elmo" already has access to that information, and even more which is not even in the public domain. The issue is that this information is being taken away from people who can not afford it. What's wrong with giving the average lower/middle class person access to that information? Well, obviously a lot to some people. With all the hubbub over whether or not naked girls will be displayed on our screens, at least in the U.S., the more dull background maneuvers - the shutdown of anon.penet.fi, the continued mess of encryption export, CyberSitter's secret censorship of political content etc., forever creep forward. When all is said and done, you were simply giving less privileged individuals access to powerful information. Well, these types of letters can run on fairly long, I've tried to keep it as brief as possible while still containing my points. As I said in the beginning, I do not really blame Yahoo for this, I think some people must have been too flustered in getting the access to power which had previously been unknown to them, and blamed their confusion and fear of it on Y(ah)ou. You might even say the effort was valiant to begin with. I wish I had the resources to purchase a reverse database quarterly in order to give it away free (or maybe even ad-sponsored, how else would I pay it?) on the web, plus the costs of web hosting, possible legal costs etc., but alas, I do not. I forget what the title of John Markoff's article on the closing of Stallman's free account base at ai.mit.edu, so I'll just say Au Revoir reverse lookup, I wish I could say I'm waiting for your return, but I suspect I shall be seeing more incidents like yours in the future. Dennis Sheil dennis(a)gonif.com http://www.gonif.com

1 0

ssn hack
by Jazzmin Belle Sommers 17 Dec '03

17 Dec '03

heh. This was so simple, it still confounds me. I was asked for my social security number whilst writing a check last night (my driver license doesn't have it on there). I just said, "oh, I don't have one, I'm not a citizen." She bought it! I got asked where I belonged to, so I said Germany (not actually a lie, it's my heritage). Next time I think I'll say Belgium. What's that itty bitty country between France and Spain? Angorra? Yeah. That's it. I still find that the best line of defense regarding privacy is a complete second identity. Does anyone know how to apply for proper papers (taxpayer ID#, checking account, picture ID of some sort) for a second identity? As far as I know, it is not illegal to have one, as long as it is not used for fraud. I'm an artist, yeah, that's it. What, you really think someone's actual name is Jazzmin Belle Sommers? Get outta town! Jazz

2 1

Java compilation
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

hi there was a discussion on this mailing list on whether java to native code compilers are available now. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ todd(a)cs.arizona.edu Todd A. Proebsting at University of Arizona CS Department, SUBJECT "Toba," A Robust Java-to-C Translation System New Beta Release of Toba for Linux! URL http://www.cs.arizona.edu/sumatra/toba/ DESCRIPTION "Toba" translates Java bytecodes to C. After being compiled, the generated routines link with Toba's run-time system, which includes a complete garbage collector, threads interface (Solaris version only), and core Java API. Toba translates applications (e.g., javac), not applets. Toba-translated applications typically run 3-5 times faster than those interpreted by Sun's JDK 1.0.2. Toba's API does not currently include AWT or dynamic linking. The Solaris version of Toba has thread support; the Linux version does not. (Thread support is not needed for many popular Java applications like javac.) PLATFORM Solaris, Linux BODY Our freely-available distribution includes source code for all of Toba---we encourage outside porting efforts. Toba (the translator) is written in Java. The run-time system is in C. Toba uses the freely- available Boehm-Weiser garbage collector. The Solaris version uses the native Solaris threads package. (We have not used any of Sun's source code--in any way--to develop Toba. Toba source code is free of all of Sun's licensing restrictions.) While this is a beta distribution, Toba appears robust. Because of their significantly improved performance, we run Toba-compiled versions of javac (and Toba itself) exclusively for development purposes and have done so for the last four months. For more information please visit our website, http://www.cs.arizona.edu/sumatra/toba/ Or, simply fetch our distribution and enjoy running your java applications many times faster: ftp://ftp.cs.arizona.edu/sumatra/toba/toba.tar.Z Toba is part of the larger, on-going "Sumatra" research project at the Department of Computer Science of The University of Arizona. The Sumatra project explores the issues surrounding efficient execution of mobile code. For more information about the Sumatra Project, visit our website, http://www.cs.arizona.edu/sumatra/ Members of the Sumatra Project: Todd A. Proebsting (project leader) John H. Hartman Gregg M. Townsend Patrick Bridges Tim Newsham Scott A. Watterson - Igor.

1 0

New crypto regs outlaw financing non-US development
by Lucky Green 17 Dec '03

17 Dec '03

As you know, the President has transferred most crypto from State to Commerce. We were all waiting in anticipation for the text of new regulations to take effect on 12/30/96. Not because we thought that the new regs will be more favorable to industry and the individual (we know better), but so we could assess the damage. I will try to give a brief look at some interesting provisions in the new regs. I assume the reader is familiar with the carrot and stick (export of single DES and key escrow) provision of the new regs. IANAL. This post refers to the text of the regulations available at http://jya.com/bxa123096.txt and http://jya.com/itar123096.txt The above URL's mirror [Federal Register: December 30, 1996 (Volume 61, Number 251)], also available via http://www.access.gpo.gov/su_docs/aces/aces140.html First the good news: the export controls mentioned in the draft of the regs on any kind of data security software, regardless if it uses crypto or not did not carry into the final version. Now to the rest of the news. >equests for one-time review of recoverable >products which allow government officials to obtain, under proper legal >authority and without the cooperation or knowledge of the user, the >plaintext of the encrypted data and communications will also receive >favorable consideration. The GAK provisions require that the keys are made available without knowledge of the user. This disqualifies some of the suggested key recovery schemes alerting the user to the fact that keys are being requested. >A >printed book or other printed material setting forth encryption source >code is not itself subject to the EAR (see Sec. 734.3(b)(2)). However, >notwithstanding Sec. 734.3(b)(2), encryption source code in electronic >form or media (e.g., computer diskette or CD ROM) remains subject to >the EAR (see Sec. 734.3(b)(3)). The administration continues to review >whether and to what extent scannable encryption source or object code >in printed form should be subject to the EAR and reserves the option to >impose export controls on such software for national security and >foreign policy reasons. Printed source can still be exported. Source printed in special OCR fonts will eventually be banned. Finally, to the big one: >Sec. 736.2 General prohibitions and determination of applicability. > >* * * * * > (7) General Prohibition Seven--Support of Certain Activities by >U.S. persons--(i) Support of Proliferation Activities (U.S. Person >Proliferation Activity). If you are a U.S. Person as that term is >defined in Sec. 744.6(c) of the EAR, you may not engage in any >activities prohibited by Sec. 744.6 (a) or (b) of the EAR which >prohibits the performance, without a license from BXA, of certain >financing, contracting, service, support, transportation, freight >forwarding, or employment that you know will assist in certain >proliferation activities described further in part 744 of the EAR. >There are no License Exceptions to this General Prohibition Seven in >part 740 of the EAR unless specifically authorized in that part. IMHO, this closes the door on the foreign contracting loophole used by C2 and others. It is now illegal for US persons to finance or contract out overseas crypto development, since doing so will obviously assist in proliferation. While not unexpected (I offered a bet on Cypherpunks that this would happen. Nobody took the bet.), this provision sets a dangerous precedence. The technical assistance prohibitions of the past have been transformed into general prohibitions against "financing, contracting, service, support, transportation, freight forwarding, or employment". Again, IANAL. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://www.mersenne.org/prime.htm

5 5

CAVE Dig Out
by John Young 17 Dec '03

17 Dec '03

I just re-read John Perry Barlow's 1992 article, "Decrypting the Puzzle Palace," and was knocked over by his attack on TIA's TR45.3 committee and the CAVE algorithm. If you've not seen it lately (and Whit Diffie's comments on CAVE), I've put it at: http://jya.com/puzzle.htm Inspired by this and John Gilmore's similar attack on TIA and the TR45.3 gang in a message to me, I've put notices on my Web site that I will provide the CAVE algorithm to anyone who asks (and the TR45.3 document): http://jya.com/cave.htm Analysis of it will determine whether CAVE is as deliberately NSA-crippled as Gilmore, Barlow and Diffie claim, and that the TIA and the TR45.3 "wannabe spooks" committee cravenly caved (but, hey, it's never too late to dig out). Thanks to those who upbraded me for caving too. Digging now.

1 0

Test Only/6:37 AM
by Toto 17 Dec '03

17 Dec '03

1 0

Re: ssn hack
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:10 PM 12/28/96 -0600, Jazzmin Belle Sommers wrote: >heh. > >This was so simple, it still confounds me. > >I was asked for my social security number whilst writing a check last night >(my driver license doesn't have it on there). I just said, "oh, I don't >have one, I'm not a citizen." > >She bought it! I got asked where I belonged to, so I said Germany (not >actually a lie, it's my heritage). Next time I think I'll say Belgium. Those with straight American accents might like to claim to be Canadians. DCF

1 0