December 2003 - cypherpunks-legacy

Re: Is it legal for commercial companies to use PGP?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 10:30 PM 7/19/95 -0400, tim werner wrote: >>From stewarts(a)ix.netcom.com Tue Jul 18 02:51:50 1995 >>Selling software containing the code is pretty clearly commercial. >>Non-commercial messages from your personal non-business machine are >>clearly non-commercial. Providing a service of encrypting and decrypting >>messages for people for money sounds like it's _very_ probably commercial. >>Encrypting and decrypting messages to/from your business that deal with money >>are a very gray area. > >Maybe "commercial company" is the wrong expression. All I meant was >that my company is not non-profit, or a university, or a government >organization. It is an engineering firm. What I have in mind is >nothing to do with a commercial use of encryption per se. That's what I thought you meant. >1) I have some email pen-pals that I would like to be able to use PGP to That would be fine to use PGP 2.6.2 for; there's realky no question. >2) It's entirely likely that people within the company may wish to get > into the habit of transmitting company data in encrypted form. This > is not a question of incorporating the encryption technology into a > product, or even into the sale of a product -- it's just a question > of keeping intra-company information transfers private. >The first is the one I'm really concerned with. The second would be >sort of a natural extension that, if legal, would be nice. I can't >imagine that these uses are subject to the ViaCrypt license, but I need >some reassurance/ammunition in order to be a little more open about >getting it installed on the machines in my department. The ViaCrypt license only matters if you're using ViaCrypt. The question of whether you can use PGP 2.6.2 for these is something you _do_ need to read the RSAREF license about, and maybe ask Jim Bidzos <jim(a)rsa.com> or a company lawyer-type about; encrypted mail within the company is probably ok, encrypted mail sending credit card numbers to pay for stuff is more questionable. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Name misspelling
by perry＠imsi.com 17 Dec '03

17 Dec '03

I've been informed that the proper spelling was Taher Elgamal. Perry

1 0

Why no action alert, coalition opposing S. 974?
by Paul Elliott 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have read the EFF analysis of Senate bill 974, which is designed to inhibit encryption on Networks. I think that it is a thoughtful document but I am concerned that there has been no action alert produced to tell people the most effective way to oppose this horrible Bill. People who are concerned about the bill need to know what Senators could most profitably be contacted. Also why has no coalition been formed to oppose this bill? I am aware that many people are busy opposing S314, but S974 is equally terrible as it attempts to suppress free expression. I could try to produce an action alert myself, but I would probably make errors as I am not up on the legal subtleties and the intricacies of Congress. Could some of the savvy people please write an action alert? Otherwise I will be forced to take a stab at it. - -- Paul Elliott Telephone: 1-713-781-4543 Paul.Elliott(a)hrnowl.lonestar.org Address: 3987 South Gessner #224 Houston Texas 77063 -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBMA10YfBUQYbUhJh5AQFMBAQAgUJAj1nNdG54IxIFAboCw+Q/E8WWOvEO 9Aazj9hjHK7VeHi+vpTY7eJRbQq7LyQq/ex41PE+QXu+mjWe3c1si8HmhherA22i CUGv3UI8L/Z43zLtN2TI9reJsizeYnmHlO3uUffP3vnhwBJm1G7EAlXvKFqikC90 q1DUqqgq7k4= =4yQ7 -----END PGP SIGNATURE-----

3 2

BUS_gut
by John Young 17 Dec '03

17 Dec '03

7-20-95. NYPaper: "Clinton Assails Officers' Racist Event. Gathering Is Defended by the Organizer as Get-Acquainted Party." Mr. Rightmyer, organizer of the event, said he believed the criticism of the roundups was part of a politically motivated "setup" by the paramilitary group, the Gadsden Minutemen, who harbor intense hostility toward the ATF for its role in regulating the manufacture and sale of guns. Morris Dees, head of a prominent civil-rights organization, supported his view, and one Federal law-enforcement official said Mr. Rightmyer might be correct. JIV_tun "Montana Tax Protester Is Shot During a Raid." Local law-enforcement authorities, who had waited for more than three years to arrest a tax protester, Gordon Sellner, accused of trying to kill a lawman, shot and wounded him in a raid on his home. JAK_but [OpEd] "Terror In Montana: Judges do their jobs and risk their lives." Martha A. Bethel has been a municipal judge in Montana for nine years. This article is adapted from a statement she made last week at a Congressional forum on the militia movement. JUG_hug Trio: BUS_gut

1 0

IITF Report
by Carl Ellison 17 Dec '03

17 Dec '03

The Information Infrastructure Task Force (IITF) National Information Infrastructure Security Issues Forum draft report can be found at: http://ntiaunix1.ntia.doc.gov:70/0/iitf/security/fedrole.txt

1 0

Re: Netscape the Big Win
by Rich Salz 17 Dec '03

17 Dec '03

> Luckily, Netscape recently hired Taher Elgamal > and he's a smart guy. Unfortunately, he seems to be in a > position where he has to defend the fairly bad work they did already. When I first saw him speak at the Danvers IETF I thought "gee, does this bozo know he shares the same last name as a real bright guy"? I think it was Perry, for example, that pointed out that using one RC4 stream for each comm half was more-or-less obvious and standard practice. At last month's World Wide Web Consortium working group meeting on security, everyone trashed SSL. Everyone trashed the W3C for not just picking SHTTP but instead trying to invent something new that "borrowed from" SHTTP. Tahir was silent on the former, but didn't disagree on the latter. During a break, in the hallway he mentioned how he's gonna have to do some politicking back at the office, and that he's glad someone reasonable like him came, and not other folks he could name. > Netscape is a closed system. You can't write code for it unless you > work for Netscape. I thought they announced their intent to support java. /r$

1 0

RE: Netscape the Big Win
by Pat Farrell 17 Dec '03

17 Dec '03

tcmay(a)sensemedia.net (Timothy C. May) writes: > * I use Netscape to read News. > * I use Netscape to access the Web. > * I still use Eudora to send and receive Mail. (Netscape can currently > send mail, but not receive it. This is likely to change soon.) I'm not about to argue that the web isn't the hotest thing on the net, which is the hotest thing in computing... But I've got a question that I can't resolve. The current trend is to bundle all types of functionality into huge monolithic programs. Add mail to netscape, add encryption, add ... Yet most of the computers people use are multi-windows, and soon most will even be multi-tasking. Why are all-in-one programs so preferable to using the windowing capabilities that are built into every X-window, Mac or Windows system? Why not use the best mail client, another best webcrawler, and yet another news reader? Microsoft has been preaching the use of OLE and component programs as its development vision for 2+ years, Macs have been popular for ten years, why is the trend still towards adding every possible bell and whistle to single programs? With components, it wouldn't be hard to have a universal Encryption/Signature module. It would get arround any propriatary restriction that vendors may or may not try to enforce ("can Netscape be extended or not" becomes moot). Is clicking on another icon really too hard? Pat Pat Farrell Grad Student http://www.isse.gmu.edu/students/pfarrell Info. Systems & Software Engineering, George Mason University, Fairfax, VA PGP key available on homepage #include <standard.disclaimer>

3 2

Re: Netscape the Big Win
by Rich Salz 17 Dec '03

17 Dec '03

> I'm not sure what this is getting at. SSL does use a separate RC4 stream > for each comm half. Is this a suggestion that a single key should be > used for both directions? No. They were saying "look, we use two keys." And Perry went "duh." /r$

1 0

Re: Netscape the Big Win
by Steven Champeon - Imonics Development 17 Dec '03

17 Dec '03

| From: Hal <hfinney(a)shell.portal.com> | Subject: Re: Netscape the Big Win | | [ much complaining by .pm deleted ] | | Note though that neither SSL or SHTTP requires that the certificates come | from RSA. However the current versions of Netscape's browser do require this. | This has been the source of much complaint and Netscape has promised that | they will have some mechanism in the future to allow the user to | choose his certificate signers. I am not sure how far RSA will let them | off the leash, though. I do know that at the Netscape Spring Training I attended, that was the source of much consternation from the techies (who knew what it meant) and Mr. ElGemal was certainly aware of it. The thing that scared me was that most of the sales and marketing folks took the approach that I think we can expect from them: "What! That's ridiculous! Oh, it's only $230? Oh, okay. That's cheap enough." and then they went on their happy way. The one "advantage" to SSL that they were pushing over SHTTP was that SSL is a socket-level encryption mechanism, as opposed to protocol- level. It doesn't conflict with SHTTP except in terms of adding to the processing time. I guess I don't see why SSL is so awful from a crypto standpoint. Could someone a bit more educated on the nuts and bolts clue me in on its weaknesses? As compared to other schemes, perhaps? Thanks in advance, Steve Champeon Technical Lead, Web Services Imonics Corporation

1 0

P.S. re: IITF Report
by Carl Ellison 17 Dec '03

17 Dec '03

I am told by my local net expert that it should have been: http://ntiaunix1.ntia.doc.gov:70/iitf/security/fedrole.txt (but the URL I sent before worked for me). The report is dated June 14 -- but I don't remember seeing any discussion of it on the list. IMHO, it's very good -- gives passing mention of Clipper but doesn't push GAK. - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme/home.html | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +----------------------------------------------------------- Jean Ellison -+

1 0