December 2003 - cypherpunks-legacy

RE: Mass-market crypto phones
by Mullen Patrick 17 Dec '03

17 Dec '03

_______________________________________________________________________________ From: Lucky Green on Fri, Nov 22, 1996 14:52 <snip> >quality is fine. Note that a fast IP connection may or may not suffice. ^^^^^^^^^^^^^ <snip> >sending UDP packets over the Internet new problems arise. One packet ^^^^^^^^^^^ ^^^^^^^^ <snip> >--Lucky I was going to just listen to the way this thread is going because I find it fascinating, but now that it has been spelled out, I must make a very important distinction between my idea and PGPFone, WebPhone, etc. -- These are Web-based programs designed to speak over very long distances for "free" (neglecting ISP charges, etc.), adding the extra functionality of encrypting your data along the way so sniffers, etc can't listen in on your conversation. My encryptophone(tm) :-) is purely a modem-modem protocol. This way, even at 14.4k you get all of your throughput. No TCP/IP overhead. No busy Net. No "Why won't my ISP hold a connection longer than TWO MINUTES!?!?". The idea I was tossing around was a simple modem program which takes digitized voice, encrypts it, pumps it through the phone line directly to the modem on the other side which undoes it all. (Yes, I know this is a simplified view.) I also know it may not be as useful as the web-based products, but I also know you don't have to worry about the aforementioned problems and neither party has to have a Net account. This eliminates some of the problems which have been sent to me. Of course, some of the problems still apply and must be addressed. I guess now's the time to admit that the first and foremost problem is that I have never programmed my soundcard... I appreciate the tips and pointers everyone has been giving me tremendously. Hopefully, this thread doesn't do a complete reversal, because I am storing all hints/suggestions/tips to be used when I can finally get this project going. (I'm stubborn. I need to at least try it, if for no other reason than to get the knowledge... :-) Thanks! PM

3 2

Re: Mass-market crypto phones
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:50 AM 11/22/96 -0800, Sean Roach wrote: >At 09:10 AM 11/21/96 -0500, Clay Olbon II wrote: >>A while back, Eric Blossom posted a URL for a mass-market, phone encyrption >>device (http://www.comsec.com/) >At first this seemed to be a challenging goal as public key encryption (at >least the type of which I am aware) requires a public key ring, but then I >thought, what would be the point in real time communitation? Both Eric's product and PGPhone use Diffie-Hellman key exchange. They protect against man-in-the-middle attacks by displaying (part of) the resulting symmetric key and having the phone's users verify they are both working with the same key in the conversation. Until the AIs/eavesdroppers get good enough to imitate a person on the phone, this verification technique is good enough. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

1 0

FAQ on legalities SSLeay, &c.
by P. J. Ponder 17 Dec '03

17 Dec '03

the recently posted FAQ on crytpo patent expiration dates etc. stated that MD5 and SHA were not export-restricted anywhere. The FIPS Pub for SHA (which I think is numbered 180-1) specifically states that SHA is export controlled (by ITAR). I asked this list why it would be controlled, since it was a signature function, and Perry Metzger replied that crypto hash functions make good starting points for building a block cipher program. there is a section in Schneier's _Applied Crypto_ on this, too. anybody heard from the old Perry-grammer on his list project? I miss him. He would be having a field day with all this noise. surprised there hasn't been more chatter about the improved differential fault analysis (IDFA). That is pretty powerful stuff. They just don't make tamper-proof like they used to. Forget chomping on the keyspace, read the modulus and divide by the public key. I like the reference to the 'Mafia EFT/POS'. ObSciFi: Go back and read the Preface (by Bruce Sterling) to Gibson's _Burning Chrome_ collection. He talks about the sorry state of SF in the 1980's and how Gibson, among others, was turning out something new. Hmph.

1 0

Software distribution the cypherpunks way? Was: Patent Fight Could Add to Cost of Inter
by Phillip M Hallam-Baker 17 Dec '03

17 Dec '03

This turned into a long article on software distribution. > NEW YORK (AP) _ A little-known patent could raise the cost of > doing business over the Internet for companies selling software, > video or other digital products delivered online. > > E-Data Corp. of Secaucus, N.J., is suing 17 companies, including > McGraw-Hill and CompuServe, to collect licensing fees on the > patent, which protects downloading of encrypted digital > information. A court hearing is scheduled Dec. 6 in New York on the > company's claims. Although this is one of the most bogus and indefensible patent claims about I don't think it has any material bearing on the Web. Any that it does have is likely to be beneficial since the Freeny model is inherently broken and non-Web. What Freeny does is to claim the idea of encrypting an information product, delivering it through a computer network (though not a physical medium, there is another patent that claims that), and selling the decryption key rather than the product. It is a hot idea if you are trapped in traditional, pre-Web thinking but not if you understand the dynamics of the net. The problem is that encryption is not such a great barrier to preventing proliferation of software. If encryption is free than you might as well add it in, if there are patent costs then you have to ask what precisely you gain from encryption. The problem is that the information good has to be decrypted before use. Since it is very difficult to prevent copying after the decryption has occurred all that the encryption is really doing is to slow down the process of proliferation. A more important question is what if anything one gains from preventing proliferation. Microsoft has not been hurt by the massive bootleg copying of its software, far from it. Many business users are keen to buy non copy protected software because they can then obtain a "free" copy for their home machine at no cost to themselves. This minor peculation is in my view the principle reason for the dominance of the PC in the home market. There is no good reason why a person would buy a $2000 business machine rather than a $500 home machine when the latter plays much better games. But add the idea that one can use the software bought by one's employer and the PC looks the better buy. I believe that the success of Netscape demonstrates that copy protection is a bad idea. If you believe in free markets then the price of any given product is going to come down to the marginal cost of production. For software sold via the net the marginal cost is pretty close to zero. The price of the various "Office" bundles sold via the stores is astonishingly low. $200 for MSOffice or Corel Office is a silly price. If the product is bundled with the machine the price gets even sillier - a few dollars. I expect that before long we will see machines coming bundled with more than one office suite because the prices are just too low to make the choice irrelevant. An important fact to bear in mind is that companies are in general interested in being honest. There is little incentive for an employee to cheat the software vendor. The cost of lawsuits is a good deterrence since the type of company where management are likely to encourage software theft is also the type of company that is likely to have disgruntled ex-employees willing to inform. As a system manager my principle interest in net O/S such as WNT and VMS is that they have good, centralized and standardized licensing mechanisms that allow me to make sure that the software has been paid for. Its another reason why site licenses are useful! The price of net software is likely to be close to the price the OEM pays, a few dollars. This is likely to be structured somewhat differently however. I expect to see growth of two trends, software rental and componentware. Componentware, selling the package in small increments is a poor proposition if selling via physical media. The cost of a CDROM is low, (few cents), but the cost of post and packing is high. Selling componentware via the net is considerably more interesting. Just as I paid a few bucks for my XV program, I'm willing to pay a couple of bucks for additional input filters. I'd certainly be willing to pay a couple of bucks for specialized document tools or specialized canned document formats (e.g. IDEF0, ESA-Requirements whatever). I see the potential for componentware being primarily low cost, high volume. Componentware is now on the brink of being practical for three reasons. First as previously stated the net makes distribution costs lower. Second modern software applications are considerably more "open" to extension than previously. In the past most software houses attempted to produce products that satisfied every need. Today the large software houses realize that they cannot hope to satisfy every need but that if they can cover 95% of a persons needs in a way that allows them to add in the remaining 5% everyone is happy. Finally, Java has legitimized the componentware idea. Its worth noting that the technical suitability of Java to the task is irrelevant. What is important is the fact that several hundred startup companies have been created to do nothing else than make Java applets. Such companies are effectively committed to make componentware work and it is inevitable that at least one will succeed in establishing a paradigm for the others to copy. The second interesting development is software rental. To an extent this already occurs since the rapid rate of software development means that software rapidly becomes obsolete. Anyone who is using WordPerfect 3.1 for more than a few hours a year should probably upgrade to the latest version simply because it offers so much more functionality. The recent move by Microsoft to incorporate the year into their products is intended to encourage frequent software upgrades. It is a small step from this model to one in which software is "leased" for a period of a year or more at a time. Of course both componentware and rental strategies have been around before the net existed. What the net does is to change the economics so that low cost, high volume is the mainstream strategy. Software rental traditionally involves expensive agreements, typically brokered by lawyers on both sides. The network means that it will become economic to rent software in low volume and for short periods. Joining the componentware and rental strategies together would point to a distribution strategy in which a corporation would lease a certain number of seats worth of fully updated packages. The seats would be continuously updated on a daily basis as additional components passed the supplier's QA. In this model the purchaser is buying the up-todateness of the package. There would be little value in bootlegging the software since its unlikely that the bootleg version would be anything like as convenient. There would also be scope for different levels of uptodateness. Just as the Microsoft developer network delivers a bulging binder full of CDs to my desk each quarter there will inevitably be a large number of developers willing to risk buggy software to have access to the cutting edge technology. On the other hand there will be people who prefer to wait until others have found the bugs, waiting a judicious length of time before updating unless a patch is a response to a known bug. Encrypting the distribution process might be worthwhile to reduce fraud but the main vulnerability is probably unauthorized copying after distribution. What the Freeny patent covers is thus the old model of software distribution in the new sales paradigm. There is little point in taking costly measures to protect the copyright of products being sold for small dollar amounts. First Virtual proves this. Where more expensive software is concerned it would ideally be best to use the net. But here the price of the patent is simply too much. The 1% extorted under the patent would easily pay an intern to stuff a CD in an envelope and send it. The role for encryption in the software distribution process is in authenticating the delivered goods. The role of encryption is to provide privacy. It is very hard to keep a secret that every one knows about, still harder to sell information that is public knowledge. The net is not an information economy, it is an access to information technology. Nobody will profit from merely selling information, they will have to sell the ability to access information in better ways, better indexing, faster access, lower publication delays and so on. comments? Phill PS in checking this document Microsoft's spellchecker suggested "Mosaic" when checking the word MSOffice!

1 0

Report on Net Tax Policy
by John Young 17 Dec '03

17 Dec '03

The US Treasury Department's report "Selected Tax Policy Implications of Global Electronic Commerce," reported this morning in the NYT, is available at: ftp://ftp.fedworld.gov/pub/tel/internet.wp (260 kb; WordPerfect 6.1) We've prepared an HTML version at: http://jya.com/taxpolicy.htm (140 kb) Here's the TOC Section I: Introduction Executive Summary 1. Introduction Section II: Technical Background 2. An Overview of the Global Information Infrastructure or "Information Superhighway" 3. The World Wide Web and Electronic Commerce 4. Security and Encryption 5. Payment Mechanisms Section III: Tax Policy and Administration Issues 6. Tax Policy and Administration Issues: General Considerations 7. Substantive Tax Law Issues 8. Tax Administration and Compliance Issues 9. Conclusion Glossary Notes

2 1

CNET News Dispatch November 22, 1996
by The CNET newsletter 17 Dec '03

17 Dec '03

************************************* CNET NEWS DISPATCH/SPECIAL COMDEX ISSUE Friday, November 22, 1996 San Francisco, California, USA ************************************* Welcome to the sixth and last in a series of SPECIAL COMDEX ISSUES of the CNET NEWS DISPATCH, bringing you the latest on the people, products, and parties at this exciting event. Check out our Comdex page at: http://www.news.com/Categories/Index/0%2C3%2C38%2C00.html?nd ************************************* CNET NEWS DISPATCH is a daily newsletter that summarizes the up-to-the minute technology news presented by CNET's NEWS.COM. It tempts readers with coverage of today's hottest stories, news in the making, (in)credible rumors, and other indispensable information. For complete versions of the stories updated all day long, head over to: http://www.news.com/?nd ************************************* CONTENTS SCOOPS AND TOP STORIES AOL tries to play "The Price is Right" with customers Microsoft catches up to its own browser in Macland Gates & Grove prove great minds think and clink alike It puts the whole...world...in your lap Despite IPO mishaps, tech firms still getting VC $$$ ANNOUNCEMENTS An easy way for you to customize NEWS.COM Search the site for particular topics and articles Send us your questions, comments, flotsam, and jetsam How to subscribe and unsubscribe Late-breaking stories just a click away with Desk Top News ************************************* AOL TRIES TO PLAY "THE PRICE IS RIGHT" WITH CUSTOMERS As if he didn't have enough to worry about--blackouts, churn, the growth of the Web--Steve Case and friends are also wrangling with attorneys generals in 17 states. The problem is AOL's new pricing policy, which can be summed up as: "Unless you say 'no,' your rate goes from $9.95 to $19.95." At pixel time (previously "press time"), the skirmishes were just beginning. http://www.news.com/News/Item/0%2C4%2C5674%2C00.html?nd MICROSOFT CATCHES UP TO ITS OWN BROWSER IN MACLAND Explorer for Mac users rejoice! Your hybrid platform/browser choice has just been significantly enhanced by the arrival of Microsoft's Java Virtual Machine. Some of the Web's most bleeding-edge firms are now rushing to embrace this new entrant into the market. http://www.news.com/News/Item/0%2C4%2C5675%2C00.html?nd GATES & GROVE PROVE GREAT MINDS THINK AND CLINK ALIKE First his friend and business buddy Bill Gates misses, then frantically swerves to catch, the opportunities of the exploding Internet market. Now Intel chief Andy Grove seems to have jumped into an exploding market late enough to possibly fall off. Ironically, the product at the center of this battle is Windows CE, made by none other than Microsoft itself. http://www.news.com/News/Item/0%2C4%2C5676%2C00.html?nd IT PUTS THE WHOLE...WORLD...IN YOUR LAP People will buy 190,000 of them this year and 4.1 million by 2000. They come in 20 varieties and move four times faster than analog modem speeds. It fits in your pocket, but can take you thousands of miles in seconds. http://www.news.com/News/Item/0%2C4%2C5669%2C00.html DESPITE IPO MISHAPS, TECH FIRMS STILL GETTING VC $$$ You've heard about Wired canceling its IPO. Twice. You've heard that the VC-money-for-neat-Net-ideas bubble has burst. You've heard about apocalyptic traffic jams that could choke the Web. But to get the real story on how investors and venture capitalists feel about Net-related firms nowadays, the old adage of "follow the money" yields interesting results. http://www.news.com/News/Item/0%2C4%2C5673%2C00.html?nd ************************************* ANNOUNCEMENTS AN EASY WAY FOR YOU TO CUSTOMIZE NEWS.COM So many bits, so little time? Sounds like you need Custom News. Identify the topics, keywords, or sections you're most interested in, and Custom News will a create a page of headlines and summaries for all stories that match your criteria. Check it out at: http://www.news.com/Personalization/Entry/1%2C21%2C%2C00.html?nocache=1 SEARCH THE SITE FOR PARTICULAR TOPICS AND ARTICLES Search the entire NEWS.COM database for stories you saw in News Dispatch, or track any story we've run. http://www.news.com/Searching/Entry/0%2C17%2C0%2C00.html?nd SEND US QUESTIONS, COMMENTS, FLOTSAM, AND JETSAM If you have any questions, suggestions or remarks, send us a message: newsdispatch(a)cnet.com HOW TO SUBSCRIBE AND TO UNSUBSCRIBE To subscribe to News Dispatch: Send mail to listserv(a)dispatch.cnet.com with the message: subscribe news-dispatch (your name) in the message body. To unsubscribe send the message: unsubscribe news-dispatch LATE-BREAKING STORIES A CLICK AWAY WITH DESK TOP NEWS How would you like having split-second access to the very latest news on the Net? Our Desk Top News feature puts our 20 most recent stories right there on your desktop for you to review at any time. Here's how it works: 1. From any story, click Desk Top News in the top right. 2. A window will open showing our last 20 stories. 3. Click on a headline to display the story. 4. Desk Top News updates itself every 30 minutes. 5. You become known as Ms./Mr. Cyber-Info. It feels good. http://www.news.com/Help/Item/0%2C24%2C12%2C00.html?nd ************************************* CNET: The Computer Network http://www.cnet.com/ http://www.news.com/ http://www.gamecenter.com/ http://www.download.com/ http://www.search.com/ http://www.shareware.com/

1 0

Star Trek: First Contact
by frantz＠netcom.com 17 Dec '03

17 Dec '03

For the fans of E.E.(Doc) Smith, go see this movie. OBCrypto: Data locks the main computer with a fractal cypher. OBMoney: Picard states the they don't have money in the 24th century. Instead they work for the good of mankind. Nanotechnology must have made everything material possible, so the only reward left is status (aka reputation). ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

10 10

Re: IPG Algorith Broken!
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Sun Nov 24 09:59:36 1996 Uni wrote: > On Sat, 23 Nov 1996 wichita(a)cyberstation.net wrote: > > > To obtain your organization free operational demonstration copy, > please > > send an e-mail request to: > > > > ipgsales(a)cyberstation.net > > > > You must include your snail-mail address and telephone number in said > > request. > > Now THIS has potential! Indeed. Note that he calls it "organization free" above. Obviously, his operation's entire marketing department is an excellent source of randomness.:) JMR Regards, Jim Ray DNRC Minister of Encryption Advocacy One of the "legitimate concerns of law enforcement" seems to be that I was born innocent until proven guilty and not the other way around. -- me Please note new 2000bit PGPkey & address <jmr(a)shopmiami.com> PGP id.A7D63DA9 98 1F 39 BA 93 86 B4 F5 57 52 64 0E DA BA 2C 71 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMphi3DUhsGSn1j2pAQHJ0gfQzgWGEb2lJ3KSPWGn3td/k2veuxZDjkHu OlITK3W6zT9MUWqh4KrdvQkt7Z/RzRls+uJPr7ZChS8f6FSHHvGWSmnTBZb+Bav8 JGJqcq+b/BwuUJ0RmVbGL9N7BCCXICroIdGQc1R+DmUuTMcqaAxD9bYWYbs/JSr0 Q00u3L/w8djc74sR2dS3PWmwF9PGLlmKrVQijY/q7WUNhKJDoZR4w511hswVHn1N BMjR49s+5Gh3N6eaRnKx/B2GnByhvL5Sgai2uPAqT5tFiA7R1nxnHZIlgMplYKsw 27nUWGYFpM+gP/wppw1neZqJcu4xKzg25IN4QIe86T78oA== =WUGy -----END PGP SIGNATURE-----

1 0

how much entropy in common answers
by Pat Farrell 17 Dec '03

17 Dec '03

I've been playing arround with some code to implement CME's secret sharing using low entropy answers. (His write-up is in http://www.clark.net/pub/cme/html/rump96.html) In the write-up, Carl says " That means that it has very low entropy. For example, a person's first name has only about 8 bits of entropy. Car makes and models have only 2 to 4 bits of entropy -- especially if one is naming cars desirable to a teenager." Further on, he says "Therefore, if each answer has entropy E, the attacker must correctly guess T=(EK) bits of answers. If T exceeds 90 bits or so, then the user is reasonably secure from answer-guessing attacks." (where K is the number of questions) My question is, how do we measure the entropy of each answer so we can calculate when we've got 90 or so bits. I know when I was a teenager, the list of car lust objects was short, and everyone wanted a Mustang or Camaro, so the entropy of those two choices was much less than half a bit. A similar idea was mentioned in a critique of the plot of West Side Story. The question is, on a hot night in Spanish Harlem, what percentage of women are named "Maria"? Clearly there are cultural issues involved. The entropy in a question such as "what is your favorite brother's name?" is low in an Irish family like mine where names cluster arround choices such as are Patrick, John, Sean, and Dan. So how do we measure the entropy objectively? Thanks Pat Pat Farrell CyberCash, Inc. (703) 715-7834 pfarrell(a)cybercash.com #include standard.disclaimer

1 0

RE: Mass-market crypto phones
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:40 AM 11/22/96 -0800, Lucky Green wrote: >The LEA's are not intested in saving the public money. They are >interested in preserving and expanding their power. If it costs >$1,000,000 per wiretap, who cares? The government has men with guns that >can always go out and extort more cash from the population. > >--Lucky They could if they would; but they can't so they won't. Governments (like real people) always collect as much revenue as they possibly can at a given time. If they could figure out a way to get more they would. To argue otherwise is to imply that they are not maximizing their total monetary and psychic income and are forebearing to grab all they could. I don't think members of this list should pay The Great Enemy such a compliment. Remember the findings of the Public Choice school. DCF

1 0