December 2003 - cypherpunks-legacy

SKIP Source Release is out!
by markson＠osmosys.incog.com 17 Dec '03

17 Dec '03

Hi, Check out http://skip.incog.com. We've released the source to the SKIP key management and IP layer encryption package for SunOs 4.x. Here's a piece of the README file: ALPHA 1 Release of SKIP Reference Source for SunOS 4.1.3 -------------------------------------------------------- SKIP is a Key-management protocol for IP based protocols. It is an acronym for Simple Key-management for Internet Protocols. SKIP is documented in the SKIP IETF IPSEC draft included in this directory as draft-ietf-ipsec-skip-05.txt. The most recent SKIP draft is always available at http://skip.incog.com and the Internet-Drafts directories. >From this public domain source release, you can build a fully functional IP-layer encryption package which supports DES and Triple-DES for SunOS 4.1.3. This means that every IP networked application can have it's network traffic encrypted. Unlike application level encryption packages, this package encrypts IP packets. Thus, applications do not need to be recompiled or modified to take advantage of encryption. The SKIP source is possible through the efforts of engineers in Sun Microsystems Internet Commerce Group. The developers and designers are Ashar Aziz, Tom Markson, Martin Patterson, Hemma Prafullchandra and Joseph Reveane. Linda Cavanaugh worked on the documentation. The package compiles under both the SunPro compiler and GCC. We expect that this release should port without too much pain to any operating system which uses BSD style networking (mbufs). A legal warning: Because this package contains strong encryption, the Software must not be transferred to persons who are not US citizens or permanent residents of the US, or exported outside the US (except Canada) in any form (including by electronic transmission) without prior written approval from the US Government. Non-compliance with these restrictions constitutes a violation of the U.S. Export Control Laws. This source release may be used for both commercial and noncommercial purposes, subject to the restrictions described in the software and patent license statements. Furthermore, Sun Microsystems has licensed the Stanford public key patents from Cylink Corp. which are available to users of this package on a royalty free basis. The patent statement is in README.PATENT. Be sure to read this, as it contains some restrictions and other important information. Also included in this release is a high speed Big Number package written by Colin Plumb. bnlib/legal.c contains Colin's software license statement. Features -------- 1. SKIP V2 compliant implementation using ESP encapsulation. 2. Support for DES/3DES for traffic and key encryption. 3. Diffie-Hellman Public Key Agreement based system. 4. Full Support for manual establishment of master keys. 5. Support for multiple NSIDs and multiple local certificates. 6. GUI tool for user friendly manipulation of access control lists and key statistics. 7. Command line tools for manipulating access control lists, etc. 8. Implementation of the Certificate Discovery protocol fully integrated into SKIP. 9 Implementation of X.509 public key certificates. 10. Implementation of DSA signature algorithm for certificate signatures. 11. Implementation for MD2, MD5 and SHA message digest algorithms. 12. Implementation of ASN.1 DER encoding/decoding. 13. SunScreen(tm) SKIP compatibility mode. 14. Implementation of hashed public keys as defined in the SKIP draft. Implementation of programs to generate hashed public keys. 15. Certificate utilities to convert X.509 Certificates to hashed keys and print both X.509 and Hashed certificates. 16. High performance Big Number library for Diffie-Hellman calculations. 17. Implementation is effectively "public domain" and may be used both commercially and non-commercially. 18. Patent Agreement with Cylink allows roylaty-free use of the Diffie-Hellman and other Stanford patents with this package for commercial and non-commercial use. Read README.PATENT for some restrictions. 19. Inclusion of prime generation program used to generate the primes in SKIP draft.

3 5

Re: Elliptic curves, patent status?
by James A. Donald 17 Dec '03

17 Dec '03

At 05:16 PM 11/28/95 -0400, Michael Smith wrote: > > > I'm unclear about the patent status of elliptic curve > > > systems. Are they covered by the Diffie-Hellman patent? > > > That is, is the lnguage of this patent broad enough to > > > cover _all_ public-key systems, regardless of their > > > mathematical basis? On Mon, 27 Nov 1995 23:16:10 -0800 jamesd(a)echeque.com wrote: > > No, but RSA will litigate you with the objective of > > inflicting extravagant legal costs regardless. At 08:13 AM 11/29/95 EST, Dan Bailey wrote: > Does the patent create any headaches for elliptic curve research or > publishing elliptic curve papers, or just for new products? Patents do not prohibit research -- Yet. Patent law continues to be extravagantly re interpreted from time to time, in a way that continually increases the power of the patent office and the power of the courts, but this creativity has not yet collided drastically with freedom of speech. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: The future will be easy to use
by James A. Donald 17 Dec '03

17 Dec '03

>James A. Donald writes >> Specs, anyone? > > I suggest a few requirements: > > Store the >keys, and information about the keys in a *real* database > ... At 09:31 AM 11/29/95 -0500, Jack P. Starrantino wrote: > Is this worth the complexity/cost? I'd have thought that the amount of > data involved would be small enough that index hashing would be > overkill, and I can't think of any operations that would require a full > up db engine. I think you envisage communicating with a few other revolutionaries, drug trafficers, etc, whereas I envisage a future where every man is his own bank and his own credit rating agency. More immediately, any extension to the web of trust to enable it to function for anything more interesting and important than logical-to-physical identity (and who gives a tinkers damn about logical-to-physical identity) will require a real database, or will be painful without a real database. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: The future will be easy to use
by James A. Donald 17 Dec '03

17 Dec '03

At 09:20 AM 11/30/95 -0500, amp wrote: >unfortunately, it appears to me that if you _really_ want encryption >to be universal, it's gotta be done on windoze, it's gotta be >point-n-click and seamless to the mail application. Which, at present, means it's gotta be done on Pegasus. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: (cpx) Re:(fwd) Like FV with Crypto ... 'Cept Different ...
by Andrew Barrett/CheckFree Corporation 17 Dec '03

17 Dec '03

Lucky writes (quoting propaganda forwarded to Punks by Robert): >> WebTrader can be used as a stand-alone Internet application or in >>conjunction with SBT's Pro Series 3.0i accounting software. WebTrader has a >>suggested retail price of $1,295. ^^^^^^^^^^^^^^^^ >They can't be serious. Why would you want to pay $1,300 for a payment >system, when you can get an Ecash merchant account for a fraction of what >Checkfree is charging? Not all merchants wishing to transact on the Web are as knowledgeable or sophisticated as the Punks on the different options. The offering includes a Web presence and payment processing, hassle free. No energy expenditure required. No need to develop an instant competency in electronic commerce. If a prospective web merchant has neither in place, I imagine the cost might be attractive. I also imagine that, like any other business in the world, SBT charges what they think the market will bear. Please note that CheckFree did not price the offering - they do the CC processing for SBT at some agreed upon cost to SBT. SBT sets the price for the offering in order to recover that cost, as well as their own, and establish some sort of margin. And by the way, I had nothing to do with project, so I beg you not to direct flames thisaway, should any decide flames are called for. Hey man, I just work here.... :) AJ.

1 0

NRL IPsec/IPv6 code
by Perry E. Metzger 17 Dec '03

17 Dec '03

An early version of NRL's 4.4BSDlite based IPsec/IPv6 implementation is up on ftp.c2.org in an appropriately export controlled directory. This isn't an official distribution -- I'm just putting up the code I got because there has been some interest in it. I've been hacking it in to NetBSD of late. Perry

1 0

Re: Who has the right to read your e-mail? Old hash, but I need to ask.
by John A. Limpert 17 Dec '03

17 Dec '03

At 06:58 AM 11/28/95 -0600, (Bill) wrote: >Who has the right to read your personal e-mail. >E-mail created at work? >E-mail downdloaded at work? >E-mail stored on a PC at work? The December 1995 issue of Communications of the ACM (CACM) has several articles on e-mail privacy. Managing User Perceptions of Email Privacy Suzanne P. Weisband and Bruce A. Reinig The Ethical and Legal Quandary of Email Privacy Janice C. Sipior and Burke T. Ward -- John A. Limpert johnl(a)Radix.Net

1 0

Harbinger (sp?) system
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Sorry if this question has been asked and I missed it, but does anyone know how their system works? Thanks, -Allen (c) 1995 Copyright Nando.net (c) 1995 Cox News Service ATLANTA (Nov 29, 1995 - 09:44 EST) -- Harbinger Corp. has announced new software aimed at making the Internet safe for commerce, a move that could dramatically reshape the small company. [...] TrustedLink, the product announced Tuesday but not available until next year, will let firms connect via the Net as well as through Harbinger networks, he said.

1 0

Re: Inexpensive Crypto Boxes...
by Brian Lane 17 Dec '03

17 Dec '03

> It isn't likely to be worth doing this with a sony play-station; it's DSP > capabilities are nothing special, and you're paying way too much for > irrelevant stuff like CD-ROMs, 3D accellerators, etc. For the same money I seem to remember a product from Sony last year that had a CDROM drive in it, a small LCD display, and a minimal keyboard. I think it was meant for reading encyclopedias or something. What would be cool would be a small device like this with a Magneto Optical drive in it. Generate yourself a large one-time pad and off you go... Or, you could have a secure messaging system (running a stripped down version of PGP) that could connect to a host via POP3 protocol (thru a internal modem of course) handle your mail, etc. Brian --------------------------------------------------------------------------- blane(a)eskimo.com | Electronics, Privacy, Raytracing. ftp://ftp.eskimo.com/~blane | Embedded Microprocessor Programmer http://www.eskimo.com/~blane |

1 0

Medical Records
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Here's something that may make attempts such as Clipper a bit harder to mandate, if this (non-escrowed, I believe) system becomes common. It should also provide some pressure for relaxation of ITAR. -Allen (c) 1995 Copyright Nando.net (c) 1995 Reuter Information Service [...] A security system developed at the University of California at San Francisco prevents unauthorized access to x-rays and other medical images transmitted via computer networks. A scientist described the system in a report prepared for a radiologists' convention here. [...] Stephen Wong, assistant professor of radiology and bioengineering, and colleagues developed the system for the picture archiving and communications system used at the university to store and transmit digitized medical images. He said the authenticity of the images as well as patient confidentiality must be protected. "We have to make sure that the digital information and images are not altered accidentally or surreptitiously," Wong said. "In addition, x-rays and other imaging studies are part of the patient's medical record and must be protected from unauthorized access." The system uses mathematical formulas or codes to scramble the images through encryption. It involves a "two-key" system -- one code enables public access but a second, private code is required to unscramble the information. The private code, known only to the individual to whom the information is transmitted, is 1,024 computer bits long, Wong said. In emergencies where fast transmission is needed, the unscrambled image is transmitted with a digital "fingerprint," a smaller code that assures the intended viewer that no one has altered the original image. Wong prepared his report for the annual meeting of the Radiological Society of North America.

3 2