December 2003 - cypherpunks-legacy

NYT article - WOW
by L. Detweiler 17 Dec '03

17 Dec '03

Markoff has written a BRILLIANT article. Virtually all the facts are right on, and he dances around the technical issues expertly, cutting to the core. This is FANTASTIC fodder for the cypherpunk cause! Probably just what PRZ dreamed of when he first wrote PGP :) Does anyone know Markoff's email address? Some minor idiosyncrasies, though. >Receiving the Federal subpoenas were Viacrypt, a Phoenix company >that plans to sell a licensed version of P.G.P., and Austin Code >Works of Austin, Tex., which is selling a version of P.G.P. for >other software developers to incorporate their own programs. Say what? this is false, from what I understand. *Maybe* `selling a version of RSA'? There is a rumor that G. Ward intended to include PGP in distribution disks, unconfirmed. But so far it appears there is very little related between G. Ward and PGP. >The >grand jury subpoenas, which the companies received Sept. 9 from what I can figure out so far, ViaCrypt got theirs on Tuesday, G. Ward on Thursday. This from their online statements. But it could have happened on the same day. Note that getting *served* a subpoena on the same day is very interesting -- if they were just dated on the same day and received at different times, that would be more realistic. If they were *served* simultaneously, that implies some kind of systematic coordination. Did somebody want to make sure that both places were hit exactly at the same time? Did they anticipate the rapid-fire explosion in cyberspace that would ensue? Remember, the grand jury is in California -- it would take some planning to have the summons *received* simultaneously. Don't they have to be delivered in person by agents? >Both publishers said they had no plans to sell their products >abroad. hee, hee. I wonder what Austin Code Works would think of G. Ward's Usenet postings... Pres. Leonard Mikus of ViaCrypt >"They're on a fishing expedition [...] hm, I wonder where I saw that term used before? >President Clinton alluded to the problems of controlling >distribution of software technology in a speech last week promoting >the North American Free Trade Agreement. > >"Nothing we do in this great capital can change the fact that >factories or information can flash across the world, that people >can move money around in the blink of an eye," the President said. >"Nothing can change the fact that technology can be adopted, once >created, by people all across the world and then rapidly adapted in >new and different ways by people who have a little different take >on the way that technology works." holy *cow* -- this sounds like something John Barlow of EFF would write! he almost appears to be alluding to *digital cash*! Obviously, Mr. President forgot to clear his remarks with the NSA first! Saying things like this, perhaps we should start a cypherpunk feed to president(a)whitehouse.com! cypherpunks, who'd ever have thought we'd have something from Mr. President for our signatures?! `technology rapidly adapted in new and different ways by people who have a little different take on the way that technology works' -- this is virtually from the Cypherpunk Charter. GAD! >"There is a First Amendment right to speak in a encrypted way," >said Eben Moglen, a professor of law and legal history at Columbia >University who is familiar with the case. "The right to speak >P.G.P. is like the right to speak Navajo. The Government has no >particular right to prevent you from speaking in a technical manner >even if it is inconvenient for them to understand." wow, this is *awesome* press. First time I've seen the constitutional aspect of cryptography dealt with. Markoff has got to be my absolute favorite writer. this is all what is called `bitter joy' ...

1 0

Sorry about that...
by nobody＠soda.berkeley.edu 17 Dec '03

17 Dec '03

Aargggh! Sorry about the multiple postings of Master Key. The mailer here has been very strange lately. Sometimes it's down, and when it comes back up, things which were sent get sent again... --==<< Infocalypse >>==--

1 0

minor address correction
by bart＠netcom.com 17 Dec '03

17 Dec '03

Forwarded message: > Date: Tue, 21 Sep 93 21:35:16 -0600 > From: "L. Detweiler" <ld231782(a)longs.lance.colostate.edu> ... > > note: the new sci.crypt FAQ will have a much-improved section on public > key cryptography. watch for it on the newsgroup or > rtfm.mit.edu:/pub/usenet/news-answers/cryptography-faq if you want it right away. > > You'll do better in: /pub/usenet-by-group/news.answers/cryptography-faq" is current directory. ^^^^^^^^^^^^^^^ ^

1 0

Bidzos on PGP and ITAR verbatim
by L. Detweiler 17 Dec '03

17 Dec '03

Bidzos comments on PGP related to ITAR, from sci.crypt a while ago (not sure of date). Essential argument: it was illegally exported, and ITAR prohibits re entry of things illegally exported, therefore it is illegally imported. Relevant section, Software export: Section 123.2 of the ITAR reads: >"123.2 Imports. > >No defense article may be imported into the United States unless (a) >it was previously exported temporarily under a license issued by the >Office of Munitions Control; or (b) it constitutes a temporary >import/intransit shipment licensed under Section 123.3; or (c) its >import is authorized by the Department of the Treasury (see 27 CFR >parts 47, 178, and 179)." There is a section on `illegal export of unclassified technical data to foreign nationals' (paraphrase) and Bidzos claims it applies to PGP export. But he appears to me to be using a bit of sleight of hand to conflate this category with *cryptographic software* mentioned elsewhere (sections also as quoted also by H. Finney). I'll let others pick it apart for the loopholes. ===cut=here=== Date: Mon, 20 Sep 93 19:31:08 PDT Message-Id: <9309210231.AA16113(a)RSA.COM> To: ld231782(a)longs.lance.colostate.edu In-Reply-To: "L. Detweiler"'s message of Mon, 20 Sep 93 19:57:35 -0600 <9309210157.AA04992(a)longs.lance.colostate.edu> Subject: PGP & ITAR Here's the ITAR part. (This was posted in 1992, so I don't know, since pgp has changed since then I understand, how it would apply.) Also, the ITAR has changed recently, and I haven't studied the changes to see how they would affect these comments. Risks of using pgp One should be careful about assuming that the documentation in electronically distributed software is accurate, especially where law is concerned. There are a few things the documentation for a program called "pgp" does not tell you about patent and export law that you should be aware of. Further, there are a number of claims and offered interpretations of patent and export law that are simply false. pgp seems to be an attempt to mislead netters into joining an illegal activity that violates patent and export law, letting them believe that they run no serious risk in doing so. EXPORT LAW pgp leads users to believe that it has circumvented export controls "...since it is not illegal to import..." You are led to believe that since you didn't import it, it's legal to use it. The "no import restrictions" claim has been made so many times, many people probably believe it. One would be well advised not to accept this legal opinion. While stated as if it were a well-known fact, the claim that "there are no import restrictions" is simply false. Section 123.2 of the ITAR (International Traffic in Arms Regulations) reads: "123.2 Imports. No defense article may be imported into the United States unless (a) it was previously exported temporarily under a license issued by the Office of Munitions Control; or (b) it constitutes a temporary import/intransit shipment licensed under Section 123.3; or (c) its import is authorized by the Department of the Treasury (see 27 CFR parts 47, 178, and 179)." Was pgp illegally exported? Was pgp illegally imported? Of course. It didn't export or import itself. pgp 1 was illegally exported from the U.S., and pgp 2, based on pgp 1, is illegally imported into the U.S. Is a license required? According to the ITAR, it is. 125.2 Exports of unclassified technical data. Paragraph (c) reads: "(c) Disclosures. Unless otherwise expressly exempted in this subchapter, a license is required for the oral, visual, or documentary disclosure of technical data to foreign nationals in connection with visits by U.S. persons to foreign countries, visits by foreign persons to the United States, or otherwise. A license is required regardless of the manner in which the technical data is transmitted (e.g., in person, by telephone, correspondence, electronic means, telex, etc.)." ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ What is "export?" Section 120.10, "Export," begins: "'Export' means, for purposes of this subchapter: ...(c) Sending or taking technical data outside of the United States in any manner except that by mere travel outside of the United States by a person whose technical knowledge includes technical data; or..." Crypto software is controlled by the ITAR. See Part 121, the Munitions List, includes Category XIII, of which paragraph (b) reads, in part, "...privacy devices, cryptographic devices and software (encoding and decoding), and components specifically designed or modified therefore,..." A further definition in 121.8, paragraph (f) reads: "Software includes but is not limited to the system functional design, logic flow, algorithms, application programs, ..." pgp encourages you to post it on computer bulletin boards. Anybody who considers following this advice is taking quite a risk. When you make a defense item available on a BBS, you have exported it. pgp's obvious attempts to downplay any risk of violating export law won't help you a bit if you're ever charged under the ITAR. Penalties under the ITARs are quite serious. The ITARs were clearly designed to put teeth into laws that make exporting munitions illegal. It's unfortunate that cryptography is on the munitions list. But it is. pgp is software tainted by serious ITAR violations. ------- End of Forwarded Message

7 8

Re: Master Key: A Clipper Story
by George A. Gleason 17 Dec '03

17 Dec '03

This is odd,... I never got the original posting; if anyone can email it to me I'd be thrilled (gg(a)well.sf.ca.us) thanks- -gg

1 0

New York Times: Federal Inquiry on Software...
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <199309220117.AA11227(a)bongo.cc.utexas.edu> zeek(a)bongo.cc.utexas.edu writes: > ---------------------------- > The New York Times > Tuesday, September 21, 1993 > Business Day > ---------------------------- > > Federal Inquiry on Software Examines Privacy Programs > > By John Markoff John Markoff regularly writes good and informed articles that he has clearly researched (if that's the right word) by reading usenet and possibly lists like this one. Yet I've *never* seen the guy post. John, if you're reading this, drop me a line to say hello just so I have your email address, in case I ever want to mail you something. Graham -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

1 0

Re: a horrible conspiracy revealed
by Perry E. Metzger 17 Dec '03

17 Dec '03

Timothy Newsham says: > > > > > > "L. Detweiler" says: > > > I was thinking. What is the significance that PRZ was not actually > > > cited in any subpoena so far? This is very puzzling. It seems to > > > > I wonder what the significance of L. Detweiler's name is? Obviously > > its a Germanic name. Perhaps he's a Nazi... in fact, he might be the > [...] > > What was the point of this letter? Is this example output of a > new stegonagrphy program you just wrote? where can I get it? > Do you know mr. subliminal from saturday night live? Can I meet > him? Can I have a porsche ? If I told you what the point was, there would be no point in having written it. Perry

1 0

PKZ and NON-RSA
by David Colston 17 Dec '03

17 Dec '03

When I posted the offer for source code to a non-RSA public key yesterday, little did I know that I would be beseiged by requests. I will therefore send the paper on the matter to cypherpunks and ask that anyone wanting a copy of the source send me a floppy. Any size or density is okay. As a preamble to this paper, I'd like to note why and how it was developed. After the first release of PGP, Phil told me he was worried about using RSA. I offered to come up with another scheme and originally designed a version of Rabin. I asked Phil to post a copy of that paper on sci.crypt since I do not have internet access. There were few responces, none of which attacked the safety of the method, but mainly stated that it was a version of Rabin. Nothing was ever done with that proposal. A year latter, 2.0 PGP was due to be released and I came up with the current public key system. Again, Phil ignored it. Posts on sci.crypt were totally ignored by anyone with the ability to judge the math. Phil was then approached by the customs folks and I recieved a call from him in December of last year. By that time I was tired of waiting around for Phil and had coded QPK (Quick Public Key) in PDS 7.1. At any rate, I suggested that Phil foward a copy of the program to RSA and see if they would challenge that program in court. He declined. It became apparant that Phil wanted to stick with the original RSA concept and would refuse to do anything with another approach, although he did stick an bite in 2.1 to flag an encryption as being non-RSA. At any rate, I believe that RSA would not attempt to defend the original public key patent in court, since it smacks of over kill. They attempt in the RSA pattent to claim any encryption method involving a polynomial modulo another number. This is clearly prior art, since Ceaser used m+1 mod n as an encrytion method. The program I generated has been posted on Compuserve, Bix, and GEnie for over a year with no feed back from anyone, even though I am resonably sure that RSA is aware of its existance. They have not challenged it because there has been no publicity. I would welcome a court challenge on the whole idea of crypto patents. The customs thing is meerly a way for RSA to challenge Phil and scare off others while avoiding a test of their patents. The "paper" follows. FOR THE MATHEMATICALLY ORIENTED - HOW A QUICK PUBLIC KEY WORKS. Math notation: + plus - minus +- plus or minus * multiplication / division ^ exponent <> unequal = equals == congruent < less than > greater than INT truncated integer round SQR square root ( open expression ) close expression x^-1 modulo p the multiplicative inverse of x in the field of p x... y the range of values XOR exclusive or N a number equal to P times Q, where P and Q are prime Variables in capital letters are permanent and those in small letters are temporary. BACKGROUND Because the "secret key" function of many public keys methods are so slow, most cryptographers use these functions only to "boot strap" into a conventional key system, which is faster to send the actual message. Most of the conventional key systems use comparatively small numbers in relation to the size of the public N as a "random seed number". The holder of the secret key may actually have a larger amount of computer time to decipher the starting point of the conventional algorithm than to decipher the actual message. It would seem to be a good idea, if a public key function could take advantage of the actual message size required to speed up the public key process. The range of message sizes is described below, but generally speaking we a discussing messages less than SQR(Q) in actual size. Imagine a series of related equations modulo a prime, P. These equations have the formula ((e * e + e)/2 * L + C) modulo P. The value, C, is a constant determined by the rule (L - 1) * (1 / (2 * L)) modulo P == C. For L = 1, C = 0. Therefore, if L is known, the expression ((e * e + e)/2) modulo P may be determined, even if e is unknown. Each value of L has an area or series of areas, in which the value of e becomes discoverable, WITHOUT resorting to a modular square root. ie. Let r == ((e * e + e)/2 * L + C) modulo P. If e is in the correct range relative to L, then (r * L * 8 + (L - 2) * (L - 2)) will have an integer square root and the value, e, may be determined with ease. The range of values of e, for any value of L, which have this property and the location of those values vary greatly. The following illustrates a public key approach for L = 12, but other values of L may also be used. Perhaps I should also note that the particular L, which a secret key holder uses need not be public knowledge, but is not all that sensitive. ESTABLISHING A QUICK PUBLIC KEY (Q.P.K.) BASED ON L = 12 A person wishing to receive public messages, which he/she alone can decrypt calculates N = P * Q. Where P and Q are a randomly selected prime numbers, Q being the larger. A == (11 * 24^-1 ) modulo Q B == (2 * A) modulo Q D = Q - B If D > (Q - 1)/2 then set D = Q - D - 1. F = (Q - 1)/2 - D NOTE: We may chose to use the F for all of the following calculations instead of D. This applies to no value of L lower than 12 and F is not valid for most sequences higher than 12. F may be an even safer value to use, for reasons which are too long to discuss here. L is NOT super-sensitive information. Let Y1 ... Y2 be a range of numbers with in the limits: (D - k) and (D + k), where k = INT(SQR(2 * Q / 12)). Y1 may be randomly selected from any point in this range, but Y2 may not be larger than (D + k), and Y2 - Y1 is the maximum message size. A message range for N, public information, is then created by using Chinese remainder theorem to find the modular intersection Q == Y1 and P == x, x being a random number in the range x > 0, x < P. This intersection is called S. A check is made to verify the following: A' = (11 * 24^-1) modulo N B' == (2 * A') modulo N D' = N - B' If D' > (N - 1)/2 then Set D' = N - D' - 1 NOTE: P, Q, D, F, Y1, Y2, k, A, AND B are secret values. Q.P.K. ENCRYPTION A public key for short messages consists of S and N. To send a Message the sender calculates: e = (S + Message) ((e * e + e)/2) modulo N == Cipher Q.P.K. DECRYPTION t == Cipher modulo Q f == (t * 12 + A) modulo Q g = SQR(f * 8 * 12 + 100) NOTE: If g is NOT an integer value, the message is rejected as invalid. If g modulo (2 * L) <> (L - 2) then Q is repetitively added to g until g modulo (2 * L) == (L - 2). z = (g - 10)/24 e == ((B - 1) + z) modulo Q If e > (Q - 1)/2 then set e = (Q - 1) - e. Message = e - Y1 For other values of L: A == ((L - 1) * 2^-1* L^-1)) modulo Q k = INT(SQR(2 * Q / L)) NOTE: If L = 1 then D = 0 and the message range is 1... k. If L = 2 then the message range is D... (Q - 1)/2 and these values modulo Q are already perfect squares < Q. f == (t * L + A) modulo Q g = SQR(f * 8 * L + (L - 2) ^ 2) z = (g - (L - 2)/(L * 2)) If anyone wants the source code for this drop a disk to: Colston & Associates 5111 Rogers Ave. Suite 507 Fort Smith, AR 72903

1 0

a horrible conspiracy revealed!
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <9309220341.AA23923(a)snark.lehman.com> pmetzger(a)lehman.com writes: > I wonder what the significance of L. Detweiler's name is? Obviously > its a Germanic name. Perhaps he's a Nazi... in fact, he might be the I sincerely *hope* this article was a forgery, otherwise Perry you're digging yourself a big credibility hole. Drop it, please. G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

2 1

Former S.O.F. Editor Supports PGP in Newspaper
by James Still 17 Dec '03

17 Dec '03

Local boy makes good at home. The Federal Grand Jury's PGP/RSA test case, as reported in the NYT has hit full circle here in Boulder. Boulder's own Paul Danish (former editor and writer for Soldier of Fortune magazine, based in Boulder) has come out in support of PGP/privacy issues with an excellent op-ed piece in today's Colorado Daily. The Colorado Daily is read by over 50,000 students, fac/staff and residents of Boulder and the Univ. of Colorado. Danish's piece does an amazing job of backgrounding the issues, presenting them in layman's terms, and he even goes into the Clipper chip proposal. Could it be that the NSA/U.S. Customs investigation is causing a huge backlash of public support in favor of PGP?

1 0