December 2003 - cypherpunks-legacy

Denning questions/reverses her position?
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm too old for this! I never thought I would see the day that Dorothy Denning would terminate her star role as a shill for the Clinton/LEA encryption ban! from: http://www.news.com/News/Item/0%2C4%2C13000%2C00.html?nd Two supporters of Clinton administration's stance on encryption released a report today finding that encryption has not inhibited law enforcement efforts, with at least one author questioning her belief in the administration's position. The authors--Dorothy Denning, a Georgetown University computer science professor, and William Baugh Jr., vice president of Science Application International Corporation-- ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBM+Eh5L04kQrCC2kFAQF9wwP+INGEAnc+1akKc+dP7re8fleX4PJrmsYU UKzxgBZAsWcZC7L5WkaOygckHznOc+a37iHzDFtt3sr86DP0D/4j675qJdt/O4B+ jbxXumJ8EXmTN9bOvXK8x9JRGjR9aWzjeaJKN3X+fH4Bjbw76FR9xIFkhhNvZqnM ahBzZyL2cZ4= =MlQZ -----END PGP SIGNATURE-----

1 0

Aptical foddering
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:31 PM 8/23/95, Robert Hettinga wrote: >Tim, just what does "aptical" mean? ;-). > As in "aptical foddering." I put this as my occupation on my draft registration form (Selective Service, aka "the draft") in 1969, from memories of a science fiction story. The canonical nonsense term, but vaguely plausible. I have used it often in the past 26 years. Someone about a year ago (sorry, forgot whom) sent me a note saying he recognized this from a Keith Laumer short story, something along the lines of "Graduating Class" or somesuch. (Not this title, but something with a school or class theme.) Relevance to crypto? If you have to ask what aptical foddering has to do with crypto....! --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Certificates/Anonymity/Policy/True Names
by Jeff Barber 17 Dec '03

17 Dec '03

[ Oops -- this was supposed to go to the list too. ] Michael Froomkin writes: [ Note: I've rearranged a couple of paragraphs ] > On Mon, 21 Aug 1995, Bill Stewart wrote: > > > can be substantial even if the suit is bogus.) Under what conditions do > > you expect somebody to sue a CA? > > CA certifies key saying that holder has corporate power to enter into > deals upto $1million. Keyholder commits fraud, arguably outside > corparate powers. > CA certifies that a document is authentic and time-stamps it. Lawyers > did not do due dilligence, books were cooked, everyone who touches > document gets sued. This seems to be confusing different entities. The roles in these examples aren't the CA's role. In the usual crypto lingo, the CA only certifies that a key belongs to a certain individual. Some entity within the corporation is responsible for saying whether an individual can do deals up to $1 million. Some other organization provides time-stamps (though it's possible that a CA could be dragged into your second example). But let's keep the terminology straight: a CA as used in crypto literature means the agent who certifies that "this key belongs to X" (for some definition of X). > CA certifies you are Jack Ripper based on phony id. In fact you are Sam > Spade. CA sued for recovery of ensuing fraud. > > In each of these cases, if the CA did exactly what it promises and no > more, it (arguably) deserves a way to short-circuit the suit, thus > keeping its costs down. This is a better example to start from. I agree with your sentiment but don't necessarily agree with the conclusion. Let's start from the important "if" in your sentence. If the CA publicly guarantees only that it checks for a certain ID and can prove it did this (perhaps by producing a picture or photocopy of the ID it examined), it shouldn't have too much trouble defending the case. No reason why it should need any special short-circuit. Eventually, successful defenses will show that it's a waste of time to attack the CA if the CA did what it promised. If it guarantees more (say, that "this key *really* belongs to 'X'"), then it better be prepared to establish that fact to its own satisfaction before issuing the certificate (via birth certificates, passports, fingerprints, retinal scans or all of the above). If it fails to do those things, then it is and should be liable. After all, that's what the CA is getting paid for: to keep the promise it's implicitly making and take the heat to back up its promise. > Since (in the absence of any rules given the newness of the technology) it > is very likely that a rich CA would get nuisance suits every time a deal > in which it particiapted went sour, the absence of rules will either > raise costs CAs have to charge (e.g. to buy insurance) or will keep rich > folk out of the industry (which isn't good either, since you want CAs to > buy security and to last). Thus the need for clear liability rules. I think this is just part of the landscape for a CA. Again, that's what they're getting paid for. As for the rules, the courts will work those out through litigation. How else? :-) BTW, VeriSign is acting as a CA now for Netscape Commerce Server and Open Market Secure Web Server certificates, and perhaps others -- see: http://www.verisign.com/ I don't know exactly what guarantee VeriSign's making or what they expect their liability to be, but they are making a reasonable effort to establish the identity of server certificate holders (copy of letters of incorporation, business licenses and so forth). And they are charging $290 for a first-year certificate. It seems to me this $290 (though not huge for a business) is a lot more than it costs them just to check the papers and execute the mechanics of creating the certificate. The rest is their compensation for taking the "risk" of issuing the certificate's implicit guarantee. Presumably, some of that money goes toward insuring themselves against the kinds of claims you cited above. Just my thoughts -- IANAL. -- Jeff

1 0

Denning questions/reverses her position?
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm too old for this! I never thought I would see the day that Dorothy Denning would terminate her star role as a shill for the Clinton/LEA encryption ban! from: http://www.news.com/News/Item/0%2C4%2C13000%2C00.html?nd Two supporters of Clinton administration's stance on encryption released a report today finding that encryption has not inhibited law enforcement efforts, with at least one author questioning her belief in the administration's position. The authors--Dorothy Denning, a Georgetown University computer science professor, and William Baugh Jr., vice president of Science Application International Corporation-- ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBM+Eh5L04kQrCC2kFAQF9wwP+INGEAnc+1akKc+dP7re8fleX4PJrmsYU UKzxgBZAsWcZC7L5WkaOygckHznOc+a37iHzDFtt3sr86DP0D/4j675qJdt/O4B+ jbxXumJ8EXmTN9bOvXK8x9JRGjR9aWzjeaJKN3X+fH4Bjbw76FR9xIFkhhNvZqnM ahBzZyL2cZ4= =MlQZ -----END PGP SIGNATURE-----

1 0

Re: Certificates/Anonymity/Policy/True Names
by Michael Froomkin 17 Dec '03

17 Dec '03

On Mon, 21 Aug 1995, Bill Stewart wrote: > can be substantial even if the suit is bogus.) Under what conditions do > you expect somebody to sue a CA? CA certifies key saying that holder has corporate power to enter into deals upto $1million. Keyholder commits fraud, arguably outside corparate powers. CA certifies you are Jack Ripper based on phony id. In fact you are Sam Spade. CA sued for recovery of ensuing fraud. CA certifies that a document is authentic and time-stamps it. Lawyers did not do due dilligence, books were cooked, everyone who touches document gets sued. In each of these cases, if the CA did exactly what it promises and no more, it (arguably) deserves a way to short-circuit the suit, thus keeping its costs down. Since (in the absence of any rules given the newness of the technology) it is very likely that a rich CA would get nuisance suits every time a deal in which it particiapted went sour, the absence of rules will either raise costs CAs have to charge (e.g. to buy insurance) or will keep rich folk out of the industry (which isn't good either, since you want CAs to buy security and to last). Thus the need for clear liability rules. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | mfroomki(a)umiami.ir.miami.edu U. Miami School of Law | P.O. Box 248087 | It's hot here. And humid. Coral Gables, FL 33124 USA | See http://www-swiss.ai.mit.edu/6095/articles/froomkin-metaphor/text.html and http://www.law.cornell.edu/jol/froomkin.htm

1 0

Denning questions/reverses her position?
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm too old for this! I never thought I would see the day that Dorothy Denning would terminate her star role as a shill for the Clinton/LEA encryption ban! from: http://www.news.com/News/Item/0%2C4%2C13000%2C00.html?nd Two supporters of Clinton administration's stance on encryption released a report today finding that encryption has not inhibited law enforcement efforts, with at least one author questioning her belief in the administration's position. The authors--Dorothy Denning, a Georgetown University computer science professor, and William Baugh Jr., vice president of Science Application International Corporation-- ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBM+Eh5L04kQrCC2kFAQF9wwP+INGEAnc+1akKc+dP7re8fleX4PJrmsYU UKzxgBZAsWcZC7L5WkaOygckHznOc+a37iHzDFtt3sr86DP0D/4j675qJdt/O4B+ jbxXumJ8EXmTN9bOvXK8x9JRGjR9aWzjeaJKN3X+fH4Bjbw76FR9xIFkhhNvZqnM ahBzZyL2cZ4= =MlQZ -----END PGP SIGNATURE-----

1 0

Re: SSL Challenge - problem with NT client?
by Peter Trei 17 Dec '03

17 Dec '03

(I think we need a separate code cracking list) I've got the NT client up and running. It can connect to the server, and download the challenges and I can request and select keyspace. But I can't seem to ungray the 'search' button, so I can't test it. Any ideas? Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

1 0

Re: The sorry state of non-US crypto
by Damien.Doligez＠inria.fr 17 Dec '03

17 Dec '03

>Italy: ftp://ftp.dsi.unimi.it/pub/security/crypt/ >UK: ftp://ftp.ox.ac.uk/pub/crypto/ >Croatia: http://pgp.rasip.fer.hr/ >Germany: ftp://ftp.darmstadt.gmd.de/pub/crypto/ Don't forget Australia: http://psych.psy.uq.oz.au/~ftp/Crypto/ It's especially relevant because there is a version of Mosaic that uses 128-bit SSL (i.e. truly secure). I have most of these pointers in my SSL crack Web page (which has evolved quite a bit in one week). -- Damien

1 0

Denning questions/reverses her position?
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm too old for this! I never thought I would see the day that Dorothy Denning would terminate her star role as a shill for the Clinton/LEA encryption ban! from: http://www.news.com/News/Item/0%2C4%2C13000%2C00.html?nd Two supporters of Clinton administration's stance on encryption released a report today finding that encryption has not inhibited law enforcement efforts, with at least one author questioning her belief in the administration's position. The authors--Dorothy Denning, a Georgetown University computer science professor, and William Baugh Jr., vice president of Science Application International Corporation-- ______________________________________________________________________ "attila" 1024/C20B6905/23 D0 FA 7F 6A 8F 60 66 BC AF AE 56 98 C0 D7 B0 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQCVAwUBM+Eh5L04kQrCC2kFAQF9wwP+INGEAnc+1akKc+dP7re8fleX4PJrmsYU UKzxgBZAsWcZC7L5WkaOygckHznOc+a37iHzDFtt3sr86DP0D/4j675qJdt/O4B+ jbxXumJ8EXmTN9bOvXK8x9JRGjR9aWzjeaJKN3X+fH4Bjbw76FR9xIFkhhNvZqnM ahBzZyL2cZ4= =MlQZ -----END PGP SIGNATURE-----

1 0

PGP for elm
by Ferreira, Ben 296-4158 17 Dec '03

17 Dec '03

Anyone know if there is a PGP interface or elm version that supports PGP?

1 0